Umbra: an ACID-compliant database built for in-memory analytics speed - <AUTHOR> https://umbra-db.com/ <comment><USER2> There's been an explosion of new DBs, but I haven't found anything that really beats Postgres or MariaDB for most workloads. The main advantages of these battle tested DBs is that they're easy to operate, well understood, full featured, and can handle most workloads.

It does make me wonder what will be the next big leap in DB technology. Most of the NoSQL or distributed DB implementations have a bunch of limitations which make them impractical (or not worth the trade offs) for most applications, IMO. Distributed DBs are great until things go wrong, and then you have a nightmare on your hands. It's a lot easier to optimize simple relational DBs with caching layers, and adding read replicas scales quite effectively too.

The only somewhat recent new DB that comes to mind which had a really interesting model was RethinkDB, although it suffered from a variety of issues, including scale problems.

Anyway, these days I stick with Postgres for 99% of things, and mix in Redis where needed for key/value stuff.

<comment><USER3> The issue that I frequently run into is not that I'm looking for a fancy distributed/sharded database because of reasons of performance, but because I need to store large amounts of data in a way that allows me to grow this datastore by "just adding boxes" while still retaining a few useful database features. I'd love to use Postgres but eventually my single server will run out of disk space.

Now, one approach is to just dismiss this use-case by pointing at DynamoDB and similar offerings. But if for some reason you can't use these hosted platforms, what do you use instead?

For search, ElasticSearch fortunately fits the bill, the "just keep adding boxes" concept works flawlessly, operating it is a breeze. But you probably don't want to use ElasticSearch as your primary datastore, so what do you use there? I had terrible experiences operating a sharded MongoDB cluster and my next attempt will be using something like ScyllaDB/Cassandra instead since operations seem to require much less work and planning. What other databases would offer that no-advance-planning scaling capability?

Somewhat unrelated, by I often wonder what one were to use for a sharded/distributed blob store that offers basic operations like "grep across all blobs" with different query-performance than a real-time search index like ElasticSearch. Would one have to use Hadoop or are there any alternatives which require little operational effort?

<comment><USER4> What is the difference between one server with many TB vs multiple servers with less space?

<comment><USER5> With multiple servers you can add space to each of them. With a single one there is a much lower limit to what you can do - that's the idea behind vertical/horizontal scalability. That, and the systems with multiple nodes can be made more reliable than single node servers.

</comment></comment></comment></comment><comment><USER6> Great work and very interesting ideas. I'm working on a versioned database system[1] which offers similar features and benefits:

        - storage engine written from scratch
        - completely isolated read-only transactions and one read/write transaction concurrently with a single lock to guard the writer. Readers will never be blocked by the single read/write transaction and execute without any latches/locks.
        - variable sized pages
        - lightweight buffer management with a "kind of" pointer swizzling
        - dropping the need for a write ahead log due to atomic switching of an UberPage
        - rolling merkle hash tree of all nodes built during updates optionally
        - ID-based diff-algorithm to determine differences between revisions taking the (secure) hashes optionally into account
        - non-blocking REST-API, which also takes the hashes into account to throw an error if a subtree has been modified in the meantime concurrently during updates
        - versioning through a huge persistent and durable, variable sized page tree using copy-on-write
        - storing delta page-fragments using a patented sliding snapshot algorithm
        - using a special trie, which is especially good for storing records sith numerical dense, monotonically increasing 64 Bit integer IDs. We make heavy use of bit shifting to calculate the path to fetch a record
        - time or modification counter based auto commit
        - versioned, user-defined secondary index structures
        - a versioned path summary
        - indexing every revision, such that a timestamp is only stored once in a RevisionRootPage. The resources stored in SirixDB are based on a huge, persistent (functional) and durable tree
        - sophisticated time travel queries

As I'm spending a lot of my spare time on the project and would love to spend even more time, give it a try :-)

Any help is more than welcome.

Kind regards Johannes

[1] [https://sirix.io](https://sirix.io) and [https://github.com/sirixdb/sirix](https://github.com/sirixdb/sirix)

<comment><USER7> > _\- completely isolated read-only transactions and one read /write > transaction concurrently with a single lock to guard the writer. Readers > will never be blocked by the single read/write transaction and execute > without any latches/locks._

> \- _variable sized pages_

> \- _lightweight buffer management with a "kind of" pointer swizzling_

> \- _dropping the need for a write ahead log due to atomic switching of an > UberPage_

LMDB made those same design choices and is extremely fast/robust.

<comment><USER6> In my particular case it was also a design decision made back in 2006 or 2007 already. It's designed for fast random reads from the ground up due to the versioning focus (reading page-fragments from different revisions, as it just stores fragments of record-pages). I'll change the algorithm slightly to fetch the fragments in parallel (should be fast on modern hardware, that is even SSDs and in the future for instance with byte-addressable non-volatile memory).

</comment></comment></comment><comment><USER8> For some context, this project is from one of the leading research groups in high-performance main-memory OLAP databases. Neumann's 2011 paper, in particular, basically invented the modern push-driven operator-collapsing approach to query compilation.

</comment><comment><USER9> This is a tidy and thoughtful database architecture. The capabilities and design are broadly within the spectrum of the mainstream. At this point in database evolution, it is well established that sufficiently modern storage architecture and hardware eliminates most performance advantages of in-memory architectures. However, many details of the design in the papers indicate that this database will not be breaking any records for absolute performance on a given hardware quanta.

The most interesting bit is the use of variable size buffers (VSBs). The value of using VSBs is well known -- it improves cache and storage bandwidth efficiency -- but there are also reasons it is rarely seen in real-world architectures, and those issues are not really addressed here that I could find. Database companies have been researching this concept for decades. If one is unwilling to sacrifice absolute performance, and most database companies are not, the use of VSBs creates myriad devilish details and edge cases.

There are techniques that achieve high cache and storage bandwidth efficiency without VSBs (or their issues) but they are mostly incompatible with B+Tree style architectures like the above.

<comment><USER6> I think with modern hardware as for instance the now available first byte- addressable NVM variable sized pages and buffers should in theory get more widespread use and the reading/writing granularity gets more fine granular in the next years. I think as of now the Intel Optane memory however still has to fetch 256 Bytes at the minimum.

However, variable sized pages also allow page compression.

Can you give us some links to the mentioned issues and techniques that achieve high cache and storage bandwith efficiency without VSBs?

<comment><USER9> I can explain it, the methods are straightforward. As with most things in database engine design, much of what is done in industry isn't in the literature.

The alternative to VSBs is for each logical index node to comprise a dynamic set of independent fixed buffers, with each buffer having an independent I/O schedule. This enables excellent cache efficiency because 1) space is incrementally allocated and 2) the cache only contains parts of logical node that you actually use. References to the underlying buffers remain valid even if the index node is resized. Designs vary but 8 to 64 buffers per index node seems to be the anecdotal range. The obvious caveat is that storage structures that presume an index node is completely in buffer, such as ordered trees, don't work well. Since some newer database designs have no ordered trees at all under the hood, this is not necessarily a problem. There are fast access methods that work well in this model.

The main issue with VSBs is that it is difficult to keep multiple references to the page consistent, some of which may not even be in memory, since critical metadata is typically in the reference itself. A workaround is to only allow a single reference to a page, but this restriction has an adverse impact on some types of important architectural optimization. The abstract objective makes sense, but no one that has looked into it has come up with a VSB scheme that does not have these tradeoffs for typical design cases. That said, VSBs are sometimes used in specialized databases where storage utilization efficiency (but not necessarily cache efficiency or performance) is paramount, though designed a bit differently than Umbra.

The reason to use larger page sizes, in addition to being more computationally efficient, is that it gives better performance with cheaper solid-state storage -- storage costs matter a lot. The sweet spot for price-performance is inexpensive read-optimized flash, which works far better for mixed workloads than you might expect if your storage engine is optimized for it. Excellent database kernels won't see much boost from byte-addressable NVM and people using poor database architectures don't care enough about performance to pay for expensive storage hardware, so it is a bit of a No Man's Land.

</comment></comment></comment><comment><USER10> I love seeing this: there are massive opportunities to build fundamentally differently architected database based on evolving computer architectures (ram, persistent ram, GPU, heck - even custom hardware) as well as improved understanding of ACID in distributed environments. SQL remains an important API :)

<comment><USER11> Potgresql has some GPU (&nvme) support already through an extension: [https://github.com/heterodb/pg-strom](https://github.com/heterodb/pg-strom)

</comment></comment><comment><USER12> From the paper.

> and subsequently allow the kernel to immediately reuse the associated > physical memory. On Linux, this can be achieved by passing the MADV_DONTNEED > flag to the the madvise system call.

Shouldn't this be MADV_FREE? This instantly reminded me of this classic Bryan Cantrill talk [https://youtu.be/bg6-LVCHmGM?t=3529](https://youtu.be/bg6-LVCHmGM?t=3529)

Edit: It seems that the Linux behavior is relied upon? From later in the paper.

> Note that it is even legal for a page to be unloaded while the page con-tent > is being read optimistically. This is possible since the virtual memory > region reserved for a buffer frame always remains valid (see above), and > read accesses to a memory region that was marked with the MADV_DONTNEED flag > simply result in zero bytes. No additional physical memory is allocated in > this case, as all such accesses are mapped to the same zero page

</comment><comment><USER13> > It is a drop-in replacement for PostgreSQL.

Well, that's a bold assumption as pg is speaking one of the richest sql dialects out there. And it also means it supports pg WAL protocol ?

The product is backed by solid research, so I suppose that there must be some powerful algorithms built-in, with a good coupling with hardware [1].

So the last question is how the code is made and tested, because good algorithms are not enough for a having a solid codebase. pg+(redis/memcached) is battle-tested.

Seems to use some common ideas with pg such as query jit compilation but mixes it with another approach.

> Umbra provides an efficient approach to user-defined functions.

possible in many languages using pg.

> Umbra features fully ACID-compliant transaction execution.

jepsen test maybe ?

Didn't harvest the clustering part neither.

[1] [http://cidrdb.org/cidr2020/papers/p29-neumann- cidr20.pdf](http://cidrdb.org/cidr2020/papers/p29-neumann-cidr20.pdf)

</comment><comment><USER14> Perhaps I am a bit slow, but could someone else with better understanding ELI5 what benefits this provides over Postgres?

I would really appreciate it.

The only bit I really understood was:

        The system automatically parallelizes user functions

Now granted, I only understand how DBs work from a user-facing side so that might be a barrier here.

<comment><USER15> The abstract here is helpful: [http://cidrdb.org/cidr2020/papers/p29-neumann- cidr20.pdf](http://cidrdb.org/cidr2020/papers/p29-neumann-cidr20.pdf)

</comment></comment><comment><USER16> I'm still surprised that the industry barely knows about ClickHouse. Very few times I had the impression the be adopting a game changer technology and that's the case with ClickHouse. We only currently use it for analytical purposes but it's been proven that it's very valid solution for logs storage or as time-series DB. I already have in my roadmap to migrate ElasticSearch clusters (for logs) and InfluxDB to ClickHouse.

<comment><USER17> Does Clickhouse already have an inverted index capabilities or how are you going to search for logs containing "error"? Just LIKE's performance is going to be enough? Or it's not the case for you?

</comment></comment><comment><USER18> Amazing! I wonder if this is going to be acquired in similar way like HyPer. Commercialization of HyPer took a lot of resources, I wonder what state is Umbra in.

<comment><USER19> Thomas Neumann told me in person, that they will not sell Umbra

<comment><USER20> Isn't that exactly what the Instagram founders said?

I'm perfectly willing to belief that they have no intention of selling. But that's really not a promise one can easily make. Even if you're capable of withstanding the allure of whatever large sum someone is offering, it's always possible to be faced with a choice of selling or shutting down, or selling or not being able to afford your spouse's/child's/own sudden healthcare needs.

<comment><USER21> Hi, just a quick note that your comment on internet in the thread about Turkey is dead (shadowbaned) despite being relevant. You should contact the hn team at firstname.lastname@example.com

<comment><USER22> You can also resurrect people's auto-mod-hidden comments (frequently new users, especially with links) by clicking the time to get to the comment's page, and clicking "vouch". (Needs >30 karma.)

<comment><USER21> Cool, I never knew that. Thanks!

</comment></comment></comment></comment></comment></comment><comment><USER23> Anyone know of any benchmarks are specific features this has over other DBs? "Built for in-memory speed" might as well say "web scale."

That browser based query analyzer is cool.

</comment><comment><USER24> the innovation has happened at cloud database projects. dynamo, redshift, cosmos, big query, etc. they don't publish their code, but there is plenty happening under the covers. at this point, i think anyone who acquires machines and installs software has a desire for pain, and isn't making a sensible business trade off - unless you are an infrastructure company or are operating at high scale.

</comment><comment><USER25> > Drop in replacement for PostgreSQL

Well that's impressive. Can I just drop this into my test suite and get a mega speed improvement? Could be worth it.

</comment><comment><USER26> Where's the source code? It's open source, I guess?

</comment><comment><USER27> [http://hyper-db.com/](http://hyper-db.com/)

<comment><USER28> That group has been doing interesting and industry-relevant work for a long time. Not surprised they're trying to commercialize it as existing databases didn't really pick it up.

</comment></comment><comment><USER29> Hyper, which was created by the same group, can now be used for free with the Tableau Hyper API [https://help.tableau.com/current/api/hyper_api/en- us/index.h...](https://help.tableau.com/current/api/hyper_api/en- us/index.html)

I especially like the super fast CSV scanning!

</comment><comment><USER30> This thread makes it pretty clear to me that managed DB services from the cloud providers are a Very Good Idea on their part.

</comment><comment><USER31> One aspect where rdbms development have forgotten to work is to become a real contender for Access/dBase family.

You will see a lot of people chasing the "Facebook wanna-be" kind of workloads.

I work with small/medium companies (or that are big, but with < 1TB of data). I bet 90% can't pass the first stages of data manipulation:

\- Most(all?) rdbms have the same datatypes, mean: Use of nulls (bad) not algebraic types (sad), very unfriendly means to model data/business logic

\- Use only SQL, that is impractical to anything bigger than basic queries. I work before with foxpro: I could do ALL THE APP with it, including GUIS, reports, etc. So to say SQL is disappointing is to say the less.

\- All the engine stuff is a black box. That is great, until you wanna do your own index, store columnar data, save array or text or whatever you want, plug into the query executor and do your own stuff, etc.

You know, if you have JS and I tell you you can't code your own linked list, you will ditch that quickly. Sometimes, if you db engine allow to plug into the storage I could save my graphs for the only time I need it, instead of hack around putting it in tables or worse: Bring ANOTHER db engine to make my life hard.

Wait! Why?

All that stuff that some put in the middle-wares, model or controllers? In any other product you will reject the tool if you can't, but rdmbs FORCE to use anything else to finish it, despite the fact most run in the same box.

\- Everyone add your own auth tables/logic, because the one implemented in rdbms is for a use case that not exist anymore. Then do it wrong, of course

\- We are in the http world, but rdbms need something else for that.

\- Import/Export data is still SAD.

\- Import/Export data outside the few half-backed attempts (like csv, that a lot of time better you do it with python) is impossible in most. Using foreign adapters could work yet, you need to step out the black box, bring the adapter, compile it, install it, then use it. You need to become a C++ developer, despite you pretend to be a SQL one.

That is making thing worse because:

\- Not exist a "rdbms" packager managers.

Look, how great if you just:

        db install auth-jwt
        db install csv-import

end. Like everyone else

\- Making of forms and reports. You can bet any company (even users!) will kill if their dbs allow to create reports and forms. Yep, alike access. Yep, that is because access is still a thing with the most weak db engine in town.

\- You wanna allow to send emails, connect to external apis, call system services, etc.

But why? Is not that problematic? Well, if you JS (a language FOR THE BROWSER) allow it, why not your db? I live in that world before (foxpro) and it work GREAT.

\---

A lot of this stuff is because the rdbms are look with a too narrow POV. Is crazy: People use half-finished NoSQL engines and are happy making his own query engine, yet talking about do else than SQL (or: plug into the query parser so i enhance it) will sound crazy to some.

Rdbms get leap-frog by NoSQL because until very late, get stuck in a mindset and use cases of the 80s.

Not exist ANYTHING that say you rdbms must be like all the others.

Broad the view is what, I think, rdbms need to do to get invigorated, and considering that are also performant, and very good, then will made to conquer the world!

</comment><comment><USER32> isn't sqlite doing the same ???</comment>


Ask HN: Does the "Hire me" pages designed for a agency or startup work? - <AUTHOR>

From time to time, a well designed page designed to get a specific job (in an Agency or Startup) appears, and receives a lot of good critics.<p>But do they work? Does the creator finally get the job? I'd like to know that and, if you have, some good examples :) <comment><USER2> [http://www.phildub.com/](http://www.phildub.com/) has a resume that looks like amazon and a link at the top with the story.</comment>


The short version, my Kindle died. This happened before... - <AUTHOR> http://charmeleon.github.com/misc/2013/01/08/my-kindle-is-dead-again/ <comment><USER2> TL;DR

The author had two Kindles which both died with the symptom of lines showing on the screen, and ended up getting stuck in warranty hell with Amazon.

AFAIK this is the display controller going bad, which is a seems to be a pervasive and persistent problem with e-ink displays; I had a much-loved Hanlin V5 in 2009 that was very well taken care of which succumbed to this after only a few years of ownership.</comment>


On Melissa O'Neill's PCG random number generator - <AUTHOR> http://lemire.me/blog/2017/08/15/on-melissa-oneills-pcg-random-number-generator/ <comment><USER2> A few notes:

The author writes "Meanwhile, at least one influential researcher (whose work I respect) had harsh words publicly for her result", and then quotes some of these words:

       Note that (smartly enough) the PCG author avoids
       carefully to compare with xorshift128+ or xorshift1024*.

However, the author fails to note that said "influential researcher", Sebastiano Vigna, is the author of xorshift128+ and related PRNG.

In the linked test [2] by John D. Cook (who uses PactRand, a test similar to the (obsolete) DIEHARD), xorshift128+ and xoroshir0128+ fail within 3 seconds, while PCG ran 16 hours producing 2 TB of pseudo-random numbers without any suspicious p-value detected.

On the other hand, Vigna claims that the xoroshiro family does "pass" PactRand.

I've submitted an answer to StackOverflow a while ago [1], recommending xoroshiro and PCG, thus I'd be concerned if PCG turns out to be flawed. It's actually quite hard to get academics in the field to give an authoritative recommendation (I've tried) - their response is typically along the line "It's complicated"...

[1] [https://stackoverflow.com/questions/4720822/best-pseudo- rand...](https://stackoverflow.com/questions/4720822/best-pseudo-random- number-generator/38202922#38202922)

[2] [https://www.johndcook.com/blog/2017/08/14/testing-rngs- with-...](https://www.johndcook.com/blog/2017/08/14/testing-rngs-with- practrand/)

Edit: remove italics due to asterisk in PRNG name, & add link to John. D Cook's test.

<comment><USER3> I think Vigna's claim is that if you ignore the PractRand tests that fail, it passes. (Really!)

O'Neill has instructions on how to test with PractRand and with TestU01 on her blog ([http://www.pcg-random.org/blog/](http://www.pcg-random.org/blog/)). I had a go with TestU01 on Vigna's generators, and when you test the low 32 bits reversed (for 64-bit PRNGs, you have to test the high 32, the low 32, both forwards and reversed), I found that all Vigna's generators fail.

Given the PractRand results it makes sense, I guess, but I had read that Vigna's generators were supposed to pass TestU01.

Does anyone else wants to have a go at testing so I can know if I screwed up somehow?

<comment><USER4> _I think Vigna 's claim is that if you ignore the PractRand tests that fail, it passes. (Really!)_

The code does explain exactly what the issue is, i.e. that the last bit isn't random:

       This generator passes the PractRand test suite
       up to (and included) 16TB, with the exception of binary rank tests,
       which fail due to the lowest bit being an LFSR; all other bits pass all
       tests. We suggest to use a sign test to extract a random Boolean value.

But I'm tempted to agree this isn't a desirable property for a generic RNG.

How many users of JavaScript know about this property? (it's the default RNG for most browser engines) Or does it not matter because they return 53-bit floats?

<comment><USER2> In the comment section to the V8 JavaScript blog post [1], Vigna writes:

      - Technically, it would be better if you used the upper
      52 bits, rather than the lower 52 bits, to generate a
      double. The lowest bit of a xorshift128+ generator is an
      LSFR, and while people has been happy using LSFR for
      decades, it is slightly inferior in quality to all other
      bits. This is really OCD, as computational errors makes
      the lowest bit almost irrelevant, but now you know.

I don't know whether that's been implemented, but the maintainer replied:

      Thanks for the suggestions! I will definitely revisit the
      current implementation with your tips in mind.

[1] [https://v8project.blogspot.nl/2015/12/theres-mathrandom- and-...](https://v8project.blogspot.nl/2015/12/theres-mathrandom-and-then- theres.html?showComment=1452592903162#c1549004517443909784)

</comment></comment></comment></comment><comment><USER5> Here's the site for the random number generator.[1] It's basically a simple linear congruential random number generator (well known, but not very good) fed into a mixer. The mixer is new.

Most of the analysis is about the LCG or the final output. The suggested mixer is just

        output = rotate64(uint64_t(state ^ (state >> 64)), state >> 122);

That's simple, and the insight in this paper is that something that simple helps a lot. I would have thought that you'd want a mixer where changing one bit of the input changes, on average, half the bits of the output. The mixer above won't do that. DES as a mixer would probably be better, but it's slower. The new result here is that something this simple passes many statistical tests.

This isn't crypto-grade; both that mixer and a LCG generator are reversible with enough work.

[1] [http://www.pcg-random.org/](http://www.pcg-random.org/)

<comment><USER6> >linear congruential random number generator (well known, but not very good)

Relevant quotes from the paper:

"But if you began reading the section with the belief that "linear congruential generators are bad" (a fairly widely-held belief amongst people who know a little about random number generation), you may have been surprised by how well they performed. We've seen that they are fast, fairly space efficient, and at larger sizes even make it through statistical tests that take down other purportedly better generators. And that's without an improving step."

and

"Despite their flaws, LCGs have endured as one of the most widely used random- number generation schemes, with good reason. They are fast, easy to implement, and fairly space efficient. As we saw in Section 3.3, despite poor performance at small bit sizes, they continue to improve as we add bits to their state, and at larger bit sizes, they pass stringent statistical tests (provided that we discard the low-order bits), actually outperforming many more-complex generators. And in a surprise upset, they can even rival the Mersenne Twister at its principle claims to fame, long period and equidistribution."

"Nevertheless, there is much room for improvement. From the empirical evidence we saw in Section 3.3 (and the much more thorough treatment of L'Ecuyer & Simard [28], who observe that LCGs are only free of birthday-test issues if n < 16p1/3, where n is the number of numbers used and p is the period), we can surmise that we may observe statistical flaws in a 128-bit LCG after reading fewer than 247 numbers (which is more than BigCrush consumes but nevertheless isn't that many—an algorithm could plausibly use one number per nanosecond and 247 nanoseconds is less than two days)."

<comment><USER7> > 247 nanoseconds is less than two days

Yes, yes it is.

For those just as confused as I was, replace all instances of 247 with 2 __47

<comment><USER8> Hmmm... is HN removing ^carets?

Replace 247 with '2^47', Which is ~'1.28x10^14' or ~36 hours in ns.

<comment><USER7> Hah. I used double asterisks, should have seen that coming in hindsight. Muphry's Law.

<comment><USER9> I've often been frustrated trying to put more than one asterisk (not italic tag) in an HN comment.

Serious question, what happened to WYSIWYG? The Web has supported it for like 20 years, why have we standardized on clunky in-line markup for rich text entry, pretty much everywhere?

<comment><USER10> WYSIWYG is kinda crap on mobile. A checkbox saying "Don't format" would be nice, though.

<comment><USER11> It'd be nice if the formatter would realise that two asterisks in a row aren't emphasising any text and therefore just leave them as is.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I love O'Neill's work on PCG, and loved the talks by her I watched online.

As a tenured professor I want to say two things about this piece:

1\. I think academic publishing will be forced to change. I'm not sure what it's going to look like in the end, but traditional journals are starting to seem really quaint and outdated now.

2\. As far as I can tell from what she's written on the PCG page, the submission to TOMS is a poor example, because no one I know expects to be done with one submission. That is, no one I know submits a paper to one journal, even one reputable journal, and is done. They submit and it gets rejected and revise it and resubmit it, maybe three or even four times. After the fourth or fifth time, you might give up, but not necessarily even then.

I have mixed feelings about the PCG paper as an example, because in some ways it's great: an example of how something very influential has superceded traditional academic publishing. In other ways, though, it's horrible, because it's misleading about the typical academic publishing experience. Yes, academic publishing is full of random nonsense, and corruption, but yes, you can also get past it (usually) with just a little persistence. In still other ways, it's a good example of what we might see increasingly, which is a researcher having a lower threshold for the typical bullshit out there.

</comment><comment><USER13> > I wonder whether the academic publications are growing ever less relevant to > practice.

I think there are two topics here. One is whether academic research and work is becoming less relevant to practice. The other is whether the formalism of academic-style publishing are becoming less relevant to the modern world where more and more venues for publishing, rating, and discovering work.

On the former, I believe that academic work is as relevant as ever. There are some areas (like systems) where I'm doubtful about relevance from the point of view of a practitioner, but other areas (like hardware and ML where work remains extremely relevant). I haven't noticed a trend there over the last decade, except in some areas of systems where the industrial practice tends to happen on cluster sizes that are often not approachable for academia.

On the latter, academic publication does indeed seem to be getting less relevant. There are other (often better) ways to discover work. There are other ways to tell whether a piece of work is relevant, or credible. There are other, definitely better, ways to publish and distribute work. In some sense I think this is a pity: as an academic-turned-practitioner I like academic-style publications. Still, I think they are going to either change substantially or die.

This article raises another very good point: sometimes the formalism of academic publication makes the work harder to understand, less approachable, or less valuable. That's clear harm, and it seems like this professor was right to avoid that.

</comment><comment><USER14> As an engineer who switched to PCG:

\- PCG is not crypto, everybody should understand that. It's for simulation and rendering.

\- PCG mainly replaces Mersenne Twister which is in c++11. The Twister has a LOT more state and is a LOT slower for less randomness.

\- In rendering and simulation speed really matters, and PCG excels there.

\- Xorshift is another algorithm in the same class. I would really like to see an objective comparison. In my cursory engineering look PCG seemed better.

\- Fast PRNG is almost a new field again: It's not crypto, but immensely useful. How did the Twister get into C++11 while it is so much worse than PCG or Xorshift? Nobody cared!

\- Maybe PCG should have been a paper at SigGraph.

\- For the style of the paper, I think one contribution is rethinking PRNG outside crypto. That deserves and requires a lot of exposition.

<comment><USER3> Yeah, it's not for crypto. But I think it's for more than simulation and rendering. It's meant as a _general purpose_ PRNG. It's just as good for randomized algorithms like picking the pivot in quicksort, or playing games, procedural content generation (PCG!), or whatever you want to use it for.

I think that the whole point of the prediction difficulty stuff is that a library (e.g., C++11's) with general purpose PRNGs can't know how they'll be used. Maybe some idiot write code for a gambling machine in C++ and use whatever PRNG is to hand. There was a story in the news the other week about people going around casinos predicting slot machines, so maybe this has already happened! PCG is trying to make your simulation and rendering code fast while trying to offer at least some defense against egregious misuse.

Basically PCG is trying to be a good all rounder. As you say, it's meant as a replacement for the Mersenne Twister.

<comment><USER14> I found the story: [https://www.wired.com/2017/02/russians-engineer-brilliant- sl...](https://www.wired.com/2017/02/russians-engineer-brilliant-slot-machine- cheat-casinos-no-fix/)

And yes, PCG is harder to exploit in this way than the Twister, but you still really should not bet money on it!

</comment></comment></comment><comment><USER15> I like this because she is a professor at Harvey Mudd. They took steps to make CS more inclusive, with great results. I appreciate her attitude on accessibility, which is in keeping with that institution's philosophy.

That she ran into a paper wall doesn't bother her because she's openly publishing is even better.

<comment><USER16> There's room for accessible and for abstruse literature. Usually what happens with novel work is that initial publications are abstruse but met with excitement by the scholarly community and gradually more accessible works (as the number of collaborators/coauthors grows too) are published.

That said, even if multi-culti math means that top-line researchers are going to be spending time with song-and-dance introductions, she should still have put a grad student onto the task of making the short paper that experts will actually read.

If the whole thing is a matter of style and not of obfuscation, this would have given a grad student an easy, cool first publication.

<comment><USER17> What is multi-culti?

<comment><USER16> It's a common sarcastic term hurled at things like "inclusive CS".

For all I know this iteration of "inclusive" could be the Right Stuff -- proper intellectual discipline even as it advances secondary goals of "inclusiveness". But stiiill... she should have by now had the common courtesy of producing a short document aimed at experts, possibly prepared by her underlings. This would also have helped the career of the underlings.

</comment></comment></comment></comment><comment><USER18> It sounds like an interesting result, I look forward to reading the paper more carefully. That said, it's clearly not written for an academic journal. Section 2.4.3 is entitled "The Importance of Code Size", and explains why shorter code is better. I think you can argue that some academic papers are excessively concise, but this is a 58-page paper about an RNG. It is clearly not a journal paper and has a ton of extraneous content. I have to sympathize with the commenter that the author has made a trade-off and written a paper that's less rigorous than it should be (for peer review). I wonder why she didn't write 2 versions.

<comment><USER19> > I wonder why she didn't write [two] versions.

Because the reviewers took over 10 months to respond with a rejection mainly citing the length of the paper. And more importantly, "By that point, everyone who might have wanted to read it had almost certainly found it here and done so, so I saw little merit in drastically shortening the paper."[1]

She has updated the blog post which discusses all the nuanced details of the whole affair last month (2017-07-25)[2].

[1] [http://www.pcg-random.org/paper.html](http://www.pcg- random.org/paper.html) [2] [http://www.pcg-random.org/posts/history-of-the- pcg-paper.htm...](http://www.pcg-random.org/posts/history-of-the-pcg- paper.html)

<comment><USER18> There is no excuse for the journal to take so long to provide a response. At the same time, it seems to me that their response was entirely predictable. Or does the journal usually post such long articles directed at a general audience?

</comment></comment></comment><comment><USER20> This is an interesting article, but it's more about the changing landscape of academic publishing than it is about random number generators.

[EDIT] The actual paper is here: [http://www.pcg-random.org/pdf/hmc- cs-2014-0905.pdf](http://www.pcg-random.org/pdf/hmc-cs-2014-0905.pdf)

<comment><USER21> Only if it turns out the work is actually good. If not this is exactly what should happen in peer review.

<comment><USER20> You don't think the peer review process ever produces false negatives?

<comment><USER22> The peer review process absolutely produces false negatives, but that doesn't really change the fact that this paper doesn't need to be nearly 60 pages, doesn't sufficiently analyze one of its central premises (6.2.2 Security Considerations) and in general focuses on treatise and levity rather than rigor.

<comment><USER23> Peer review is basically just proof-reading, and taking 60 pages to present 10 pages of findings is exactly the kind of thing a proof-reader should catch.

</comment></comment></comment></comment></comment><comment><USER24> As a general comment, I dislike deliberately obtuse writing in papers. In my current work, I came across a very in-depth survey of our industry (sex work). Excellent study, very helpful. But some of the sentences seemed to over- complicate the math. Example: "Consider the set P {p1, p2, ... pN} representing providers and the set C {c1, c2, ... cN} representing customers". I am pretty sure this kind of stuff is filler or pretends to make things look more rigorous than they are.

On the other hand, maybe spending more than a line explaining what the birthday paradox is should be cut out and put in a backgrounder paper or appendix so that the paper can focus on the actual novel ideas.

<comment><USER17> are you joking? That is your example of abstruse mathematical notation? Some variables with names?!

<comment><USER24> No. I am saying that giving the definition of a set each time is just extra verbosity. The whole paper had that extra verbiage, everywhere. Kind of why- use-one-word-when-ten-will-do feeling.

<comment><USER17> Could you share the paper? I mean if they were making a mathematical argument...it is kind of hard to do that without defining things..

<comment><USER25> "Consider the set P {p1, p2, ... pN} representing providers and the set c {c1, c2, ... cN} representing customers"

versus

"Consider the set P of providers and the set C of customers"

The former is about 2x the length of the latter. This is the verbosity I read into the original comment.

<comment><USER26> The first is required when you want to later refer to an individual element from the set.

"Consider the set P of providers" means when you eventually refer to p_2, you'll have to note that you mean an element (the second, in some sense) of P. That moved the verbosity around rather than eliminating it.

To me it seems like a much bigger error that "Consider the set P {p_1, p_2, ... p_N} representing providers and the set c {c_1, c_2, ... c_N} representing customers" states outright that the sets are equal in size. I would expect C to be much larger than P.

<comment><USER25> If this is a commonly used notation in the paper, then it would make sense to state once up front "here's how we refer to sets and their members". DRY and all that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Melissa O'Neill gave a talk describing the PCG random number generator at Stanford in EE380. [https://www.youtube.com/watch?v=45Oet5qjlms](https://www.youtube.com/watch?v=45Oet5qjlms)

</comment><comment><USER28> I once tried to develop my own fast random number generate using nothing but bitwise operations. On the theory they were the fastest/simplest. I had a program generate thousands of random combinations of bitwise functions. And then used statistical tests to see which ones produced the most "random" seeming behavior.

It worked as far as I can tell. But I don't trust the statistical tests. Who is to say there isn't a very obvious pattern in the numbers that I didn't test for or notice? How do you prove a random number generator is good?

<comment><USER26> > How do you prove a random number generator is good?

You can't; that's the nature of randomness. You can prove they're bad, though.

</comment></comment><comment><USER22> I have a few comments:

1\. The paper itself[1] is _extremely_ readable by the standards of most cryptography research. On one hand, this is great because I was able to follow the whole thing in essentially one pass. On the other hand, the paper is _very_ long for its result (58 pages!), and it could easily do without passages like this one:

 _Yet because the algorithms that we are concerned with are deterministic, their behavior is governed by their inputs, thus they will produce the same stream of "random" numbers from the same initial conditions—we might therefore say that they are only random to an observer unaware of those initial conditions or unaware of how the algorithm has iterated its state since that point. This deterministic behavior is valuable in a number of fields, as it makes experiments reproducible. As a result, the parameters that set the initial state of the generator are usually known as the seed. If we want reproducible results we should pick an arbitrary seed and remember it to reproduce the same random sequence later, whereas if we want results that cannot be easily reproduced, we should select the seed in some inscrutable (and, ideally, nondeterministic) way, and keep it secret. Knowing the seed, we can predict the output, but for many generators even without the seed it is possible to infer the current state of the generator from its output. This property is trivially true for any generator where its output is its entire internal state—a strategy used by a number of simple random number generators. For some other generators, such as the Mersenne Twister [35], we have to go to a little more trouble and invert its tempering function (which is a bijection; see Section 5), but nevertheless after only 624 outputs, we will have captured its entire internal state._

That's a lot of setup for what is frankly a very basic idea. A cryptographer being verbose in their writing might briefly remind the reader of these properties with the first sentence, but they'd still likely do that with much more brevity than this. I understand wanting to make your research accessible, but for people who understand the field this detracts from getting to the "meat." It might make it harder to get through, but a 10-30 page result is preferable to a nearly 60-page one that assumes I know nearly nothing about the field. If I don't know these details very well, how can I properly assess the author's results?

2\. The author's _tone_ in her writing is something I take issue with. For example, passages like this one...

 _Suppose that, excited by the idea of permutation functions, you decide to always improve the random number generators you use with a multiplicative step. You turn to L'Ecuyer's excellent paper [25], and without reading it closely (who has time to read papers these days!), you grab the last 32-bit constant he lists, 204209821. You are then surprised to discover that your "improvement" makes things worse! The problem is that you were using XorShift_ 32/32, a generator that already includes multiplication by 747796405 as an improving step. Unfortunately, 204209821 is the multiplicative inverse of 747796405 (mod 2 32), so you have just turned it back into the far- worse–performing XorShift generator! Oops.*

...go a bit beyond levity. If you're trying to establish rigorous definitions and use cases to distinguish between generators, functions and permutations, this isn't the way to do it. This isn't appropriate because it doesn't go far enough to _formalize_ the point. It makes it intuitive, sure, and that's a great educational tool! But it's a poor scenario to use as the basis for a problem statement - research is not motivated by the failure of an engineer to properly read and understand existing primitives, it's motivated by novel results that exhibit superior qualities over existing primitives.

3\. The biggest grievance I have with this paper is the way in which it analyzes its primitives for cryptographic security. For example, this passage under 6.2.2 Security Considerations:

 _In addition, most of the PCG variations presented in the next section have an output function that returns only half as many bits as there are in the generator state. But the mere use of a 2 b /2-to -1 function does not guarantee that an adversary cannot reconstruct generator state from the output. For example, Frieze et al. [12] showed that if we simply drop the low- order bits, it is possible for an adversary to discover what they are. Our output functions are much more complex than mere bit dropping, however, with each adding at least some element of additional challenge. In addition, one of the generators, PCG-XSL-RR (described in Section 6.3.3), is explicitly designed to make any attempt at state reconstruction especially difficult, using xor folding to minimize the amount of information about internal state that leaks out.17 It should be used when a fast general-purpose generator is needed but enhanced security would also be desirable. It is also the default generator for 64-bit output._

That's not a rigorous analysis of a primitive's security. It _is_ an informal explanation of why the primitive _may_ be secure, but it so high level that there is no proof based on a significant hardness assumption. Compare this with Dan Boneh's recent paper, "Constrained Keys for Invertible Pseudorandom Functions"[2]. Appendices A and B after the list of references occupy nearly 20 pages of theorems used to analyze and prove the security of primitives explored in the paper under various assumptions.

Novel research exploring functions with (pseudo)random properties is inherently mathematical; it's absolutely insufficient to use a bunch of statistical tests, then informally assess the security of a primitive based on the abbreviated references to one or two papers.

_________

1\. [http://www.pcg-random.org/pdf/hmc-cs-2014-0905.pdf](http://www.pcg- random.org/pdf/hmc-cs-2014-0905.pdf)

2\. [https://eprint.iacr.org/2017/477.pdf](https://eprint.iacr.org/2017/477.pdf)

<comment><USER29> Just to be clear: it's not a cryptography paper, is it? Did you figure out what journal it was submitted to?

<comment><USER22> She submitted it to _ACM Transactions on Mathematical Software._ I would personally consider it a cryptography paper, for three reasons:

1\. She purports to introduce a novel result that bridges "medium-grade" performance characteristics and security characteristics in one primitive. In fact, if you look at the PCG Random website (pcg-random.org), she very clearly compares and emphasizes both performance _and security_ characteristics with functions like xorshift and ChaCha.

2\. We see cryptography papers submitted to all manner of theoretical CS conferences and journals, for example _Symposium on the Theory of Computing_ , which are not uniformly crypto-focused.

3\. She acknowledges herself that she found it hard to categorize her paper (it could be relevant for simulstion, it could be relevant for stream ciphers, etc) in a blog post about how she chose the venue: [http://www.pcg- random.org/posts/history-of-the-pcg-paper.htm...](http://www.pcg- random.org/posts/history-of-the-pcg-paper.html)

As a meta point I read the whole thing, and I actually think it would be a nice publishable result if it were, say 10 - 20 pages. But 60 is _wild_! It took me longer to get through this "accessible" paper than it did for me to get through any of Boneh's papers on constrained and puncturable pseudorandom functions!

It's definitely _interesting_ , and sure, why not explore "medium-grade security" that makes explicit tradeoffs with performance and security. But the presentation seems like it was written by someone writing for a non-academic audience, and the content of 6.2.2 "Security Considerations" is really light on provable security.

<comment><USER29> If you stripped out all the (weird, random) cryptographic stuff from this paper, it would read pretty much the same and make pretty much the same points, which tells me: it's not a cryptographic paper.

<comment><USER22> That's a fair point; it was mostly the presence of the random crypto that annoyed me :)

<comment><USER3> O'Neill recently mentioned the crypto aspects of PCG in an comment on another post by John D. Cook. I'll just quote it below. But it looks to me like she thought that any analysis she did on the prediction difficulty of PCG wouldn't be well regarded.

Also, I notice that lots of people seem to think her paper was too long, but they also claim that it doesn't say enough about their favorite topic. That seems to be happening with you.

Direct quote from O'Neill's comment here [https://www.johndcook.com/blog/2017/07/07/testing-the-pcg- ra...](https://www.johndcook.com/blog/2017/07/07/testing-the-pcg-random- number-generator/)

John, in your post, you said that PCG has "excellent statistical and cryptographic properties". I've learn it best never to say "cryptographic security" or "cryptographic properties" when trying to place something on a spectrum of prediction difficulty. Too many misunderstandings. Saying "prediction difficulty" still causes some crossed wires, but it's about as good as we can go.

Dan & Dmitriy, just to be 100% clear, I HAVE NEVER RECOMMENDED PCG FOR CRYPTOGRAPHY. I do however, care about prediction difficulty, and I don't like trivially predictable generators. Because my viewpoint is often misunderstood, I have some more blog posts in the pipeline about these issues, but the key thing is that general-purpose PRNGs get used for almost anything, from using the low-order bit to toss a coin, to supporting randomized algorithms. If someone can predict your generator, they can mount an algorithmic complexity attack on your randomized algorithm, tanking its performance. If predicting the generator is more costly than the algorithmic complexity attack itself, people will try their attacks on easier targets. But if the generator spends to much time being trying hard to be unpredictable, we also tank our performance, thus we have to try to strike a balance in a different place than we do for traditional cryptographic applications. We already live in a world where hash table implementations in scripting languages need to be hardened because of algorithmic complexity attacks; this is the next logical step.

All that said, there are members of the pcg family (not pcg32 and especially not pcg32_fast!) that I personally think would be really challenging to predict. I also find it frustrating that people don't compare like with like. If you want to compare the prediction difficulty of PCG against a cryptographically secure PRNG, you need to compare a PCG variant at least broadly similar in size. Say, for example, we wanted to contrast PCG against the ChaCha PRNG from Orson Peters (perhaps with four rounds rather than the full 20), that PRNG is 104 bytes in size, so it's fairest to compare it to pcg64_c8, which is 80 bytes, or pcg64_c16, which is 144 bytes.

Regarding prediction difficulty, I'm very well aware of Bruce Schneier's law, "Anyone, from the most clueless amateur to the best cryptographer, can create an algorithm that he himself can't break. It's not even hard. What is hard is creating an algorithm that no one else can break, even after years of analysis. And the only way to prove that is to subject the algorithm to years of analysis by the best cryptographers around.", and his subsequent elaboration "Anyone can invent a security system that he himself cannot break. I've said this so often that Cory Doctorow has named it "Schneier's Law": When someone hands you a security system and says, "I believe this is secure," the first thing you have to ask is, "Who the hell are you?" Show me what you've broken to demonstrate that your assertion of the system's security means something." Thus my personal thoughts on how difficult it is mean _NOTHING_ in a cryptography context. I also can't expect cryptographers to spend their time on my education, but if someone out does know a simple and efficient algorithm that can reliably break pcg64_c8, I really would love to see how. (Also, hey Bruce, gender-neutral language, it's a thing.)

I can do at least one thing that adds a tiny tiny tiny bit of credibility in the eyes of folks like Bruce Schneier , I can show other PRNGs I have broken that might have seemed hard to predict to a casual observer. Mostly that won't actually help though, because a cryptographer would say "Ha! That's toddler level stuff!" and a mathematician might say "I can't understand why you care about prediction at all". Sometimes I feel there should be more people trying to occupy the middle ground. Meh.

But, let's be clear, DO NOT USE PCG FOR CRYPTOGRAPHY. DO NOT USE PCG FOR CRYPTOGRAPHY. DO NOT USE PCG FOR CRYPTOGRAPHY. Clear?

<comment><USER29> I think we've surrendered some of the "clarity" argument with the sentences in that paper describing which exact instantiation of the non-cryptographic RNG to select for "sensitive" applications.

Even here, in this comment, it's really hard to follow what you're saying. For instance, you've taken the time to compare the "prediction difficulty" of the PCG PRNG to that of a ChaCha20-based DRBG. But ChaCha20 is a stream cipher, a cryptographic primitive. To be competitive with it at producing uncorrelated bits is to be yourself a cryptographic primitive; that is, to argue that an LCG and a trivial mixer is all we ever needed to encrypt data. That would be... newsworthy?

Also: if you're making an appeal to the cryptographic literature, there are better people to cite than Bruce Schneier.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> Physicist here.

Off-topic

> And it is not even entirely clear what "really random" would mean. It is not > clear that we live in a randomized universe…

At the quantum level it really is clear that we live in a really random universe. What's the meaning of really random? The outcome of a quantum process.

On-topic. Yeah, you have to know your audience. As OP mentions, just because the paper wasn't published doesn't prevent anyone from thinking about it and even building on it. On the other hand these scientific publications have styles and target audiences, and maybe she got rejected not due to lack of relevance or rigor, but because the paper didn't match the publication's non- scientific criteria for publication.

<comment><USER31> A quantum process is a random process, but isn't it still an open philosophical question as to whether the "random process" we observe is truly random, or is instead governed by deterministic hidden state?

<comment><USER30> No, all theories of (local) hidden variables have been experimentally ruled out.

[https://en.wikipedia.org/wiki/Bell%27s_theorem](https://en.wikipedia.org/wiki/Bell%27s_theorem)

> Bell's theorem states that any physical theory that incorporates local > realism cannot reproduce all the predictions of quantum mechanical theory. > Because numerous experiments agree with the predictions of quantum > mechanical theory, and show differences between correlations that could not > be explained by local hidden variables, the experimental results have been > taken by many as refuting the concept of local realism as an explanation of > the physical phenomena under test. For a hidden variable theory, if Bell's > conditions are correct, the results that agree with quantum mechanical > theory appear to indicate superluminal effects, in contradiction to the > principle of locality.

<comment><USER31> Interesting. But it sounds like non-local hidden variables are still possible. My assumption is that non-local hidden variables is non-falsifiable, which is why I said this was a philosophical question.</comment></comment></comment></comment>


Show HN: I made a chrome extension to show your websites analytics in a new tab - <AUTHOR> https://gootics.com <comment><USER2> Really awesome concept, super simple, I'm a big fan! I had a few bugs / ideas that might make it a bit more useful and portable.

* (Using the web page, not extension) when resizing the window the graphs disappear.

* If I login with the website rather than installing the extension, there's no way to get form the website to the extension. A button or hyperlink somewhere would be a nice way to then decide I want to use the extension, rather than having to search the chrome store.

* The dates display in a YY/MM/DD format which is a nice compromise between US / The rest of the world, but it took a moment for me to clock that was the format. Maybe you can detect the locale from the browser and format dates accordingly?

* It's awesome to see traffic spikes, but it'd be even better to be able to see the top page people are hitting, or have a button that I can click to link through to the main GA dashboard.

* Finally, it'd be awesome if this was bundled into a drop down extension with a little number displaying live site visitors. That way I can see it while browsing / working as well.

<comment><AUTHOR> Thanks for the awesome feedback! Some really useful ideas in there I'll put them on the list! :)

Just one thing: there is already a link to the chrome extension in the menu.

<comment><USER2> Ah I didn't see the menu, great thanks for that! Looking forward to seeing how this progresses :)

<comment><AUTHOR> You can now customize the dateformat in your profile settings. :)

</comment></comment></comment></comment><comment><USER3> Valuable, shows the entire thing in a glimpse. Thanks mate!

<comment><AUTHOR> my pleasure :)

</comment></comment><comment><USER4> Awesome! Loved it and using it daily.</comment>


How to comfortably live out of a 26 litre backpack indefinitely - <AUTHOR> https://medium.com/@jamesturnerux/a-small-bag-on-a-big-adventure-5e4851ac7801

<comment><USER2> Step 1: have a life that doesn't require much. Step 2: have enough money to rent what you want, and buy food when you want.

Otherwise, here's no snowboarding or woodworking hobby with a 26 liter backpack. There's no amateur astronomy. There's no antique sparkplug collection. There's no home-made Bundt cake or fondue dinners. There's no stocking up bulk foods to save money. There's no place to store the boar meat from your hunting trip, or your hunting rifles.

For instance, in the summers I go on multi-week cycle camping trips. With a 26 liter backpack, I would have to rent the bike (long-distance cycles are not easy to rent), the sleeping bag and tent (or bivvy bag), and similar gear. My current lifestyle is not compatible with a 26 liter backpack.

That said, I once lived out of a suitcase for a year. I carried more then 12kg because my lifestyle then included having enough clothes to go out salsa or tango dancing every night, without having people wonder why I was wearing the same clothes all the time.

And that's okay. There are plenty of people for whom steps 1) and 2) are entirely reasonable and appropriate. But it all boils down to 1) and 2).

My favorite example is Nellie Bly. She went around the world in 72 days, in the late 1880s, with "the dress she was wearing, a sturdy overcoat, several changes of underwear and a small travel bag carrying her toiletry essentials. She carried most of her money (£200 in English bank notes and gold in total as well as some American currency) in a bag tied around her neck." As she wrote:

> "After-experience showed me that I had taken too much rather than too little > baggage. ... It will be seen that if one is traveling simply for the sake of > traveling and not for the purpose of impressing one's fellow passengers, the > problem of baggage becomes a very simple one. On one occasion–in Hong Kong, > where I was asked to an official dinner–I regretted not having an evening > dress with me, but the loss of that dinner was a very small matter when > compared with the responsibilities and worries I escaped by not having a lot > of trunks and boxes to look after. "

On the other hand, if you have a _lot_ of money, then you can still be a 'professional traveler' with no backpack - there are people who will do your shopping for you - or with a lot of trunks and boxes, that other people take care of for you.</comment>


Ask HN: How to make 250K+/yr. What are my career options? - <AUTHOR> Hi, I'm in my late 20s. I'm a software engineer and work for one of the biggest software companies in bay area. I make about 115k/yr + maybe 10-20K bonus depending on the year. Its not a bad pay, but not great either. I like coding and one of the things I enjoy. But, I'm not able to see any growth both in terms of career satisfaction and most importantly to me - money. What are my career options to make more than 250K/yr in the next say 3-4 years? Why this arbitrary figure? There are no reasons really, but this is just a "target" figure and I know I want to be making more money.
While there are no reasons, I'm very much motivated by the fact of making money than to live a lifestyle which needs this kind of money. It maybe a wrong approach, but like I said, money is a great motivator for me. I don't have any commitments like mortgage and don't see anything coming up in the next few years.
Right now, my options seem to be either:
1) Do a MBA and get into investment banking. Probably finance is the only thing I might be interested in (hence Investment Banking). Not sure, how hard it is to get a 250K job these days given the lot of MBAs laid off last year. I've really not researched this option well, but it just seems "Wall street" is a lucrative option. Don't know how hard it is land a lucrative job.
2) Try to do projects/web apps on the side which may bring additional income and/or try to do consulting on the side. However this is not
a sure thing, unlike MBA.
I've gone mostly along #2 so far - tried hacking projects on the side for couple of years, but I've not made any money. Either the projects failed to complete or the ones that I persisted, I wasn't able to achieve any traction.
ps: This is a throwaway account for obvious reasons of mentioning my salary etc. <comment><USER4> _most importantly to me - <USER2>

I hope this post isn't serious. If money for money's sake is your primary motivation, you're setting yourself up for a big disappointment. With no commitments like a mortgage, and none coming up, what can you do with $250k that you can't do with $115k?

As for #1, an MBA to go work on Wall Street in this financial climate is a hard way to go, and you have clearly "not researched this option well" as you say. An MBA is most certainly _not_ a sure thing.

As for #2, this is probably the better bet in the long run, but you are likely going to have to suffer through some long years of "not great" pay in the sub-$115k range before the moneybags come rolling in.

<comment><AUTHOR> No, this is a very honest question which has been lurking my mind for a while. Sorry, if I had worded it badly. Its not like money is my only motivation. I definitely do want to things I enjoy (coding/math/statistics/entrepreneurship) or at least as close to it as possible. I would never compromise that. But to answer your question "what can you do with $250k that you can't do with $115k?" -- I have thought about this for a long time. In fact I use this argument to suppress my dissatisfaction of not making enough money. I guess I'm not a content person when it comes to money and I guess I feel it is a measure of career progress and that I'm moving forward rather than being stagnant. Of course I would be kidding myself, if I say its the only measure of progress, there is always the value produced for obtaining that money.

<comment><USER4> Since $250k is an arbitrary number, when you reach it, what's to stop you from writing this same post asking how you can make $500k?

</comment></comment></comment><comment><USER5> As someone older than you whose income well exceeds your target, here is the advice. Deliver value to the universe first. In at least an order of magnitude larger than your target. In other words, make people really really happy and they will vote for you with little green pieces of paper.

Job description is not so important, though I probBly would stay away from poetry. :-) Go find and listen to the Merlin Mann/John Gruber panel at SXSW where they talk about what made them successful. Obsession plus voice. This Concept works with my wife's clothing business. It works with my international tax lawyering. It works for Gruber. It will work for you.

Find an obsession. I backed into mine by a process of elimination - <USER3> things I did not like. Then give. Listen to that panel where they talk about how much they give away. Then reap the harvest.

When the harvest comes you will be a different man. Long ago I was whining to a wise old man about wanting a big black Benz. He said "When you can afford it you won't want it."

I drive a Honda.

<comment><USER6> >I probBly would stay away from poetry ... I drive a Honda.

And, based on the structure of that typo (missed the 'a' key, hit uppercase key instead, followed by a now-capitalized 'B'), you almost certainly own an iPhone :-)

<comment><USER5> Bingo! :-)

in my own defense I have not purchased the new one. Yet.

</comment></comment></comment><comment><USER7> Become a dermatologist.</comment>


The Data Deluge Makes the Scientific Method Obsolete - <AUTHOR> http://www.wired.com/science/discoveries/magazine/16-07/pb_theory <comment><USER2> I'm not sure if I get it. Data has always been used to generate observations about the world, which is the starting point for the scientific method. I'm reminded of how Kepler used volumes of data to figure out the planetary orbits.

<http://csep10.phys.utk.edu/astr161/lect/history/kepler.html>

</comment><comment><USER3> Interesting article, although the basic thesis is not new.

One way to view the application of machine learning to science is simply that ML automates part of the scientific method: inducing plausible hypotheses from the data.

I don't see how the author concludes that "correlation is enough" or "we don't need models": the whole point of machine learning is to develop a model that explains the available observations and is useful for predicting future observations. Just because those models are expressed mathematically and derived algorithmically doesn't mean we don't need a model at all.

</comment><comment><USER4> The comments show that the article author presents a false dichotomy. All the data collection and analysis depends on models. Then from that analysis you get new models and do new analyses. This is how science works, whether you have tons and tons of data or not.

</comment><comment><USER5> Is there a hyperbole hall of fame?

</comment><comment><USER6> Nice to see Wired dialing back up the naive techno-triumphalism. How long until the next bubble bursts?

</comment><comment><USER7> The author of that article obviously doesn't understand the scientific method. Sad.

<comment><USER3> In what way?</comment></comment>


The New Gamer - <AUTHOR> http://venturefizz.com/blog/new-gamer

<comment><USER2> _I casually 'pitched' the idea to a respectable consumer-tech focused VC who immediately commented that he didn't think the people who like to play games were the same people who like to win rewards/deals or shop period_

They don't need to all be the same - 10% of loads of people is still loads of people.</comment>


Where is a good place to find remote friendly companies? - <AUTHOR>

Where is a good place to find remote friendly companies that hire fulltime for software engineers? <comment><USER2> From [https://github.com/lukasz-madon/awesome-remote-job#job- board...](https://github.com/lukasz-madon/awesome-remote-job#job-boards)

[http://www.authenticjobs.com/](http://www.authenticjobs.com/)

[http://careers.stackoverflow.com/jobs/remote](http://careers.stackoverflow.com/jobs/remote)

[http://www.flexjobs.com/](http://www.flexjobs.com/)

[http://frontenddeveloperjob.com/](http://frontenddeveloperjob.com/)

[http://www.golangprojects.com/golang-remote- jobs.html](http://www.golangprojects.com/golang-remote-jobs.html)

[http://hnhiring.me/](http://hnhiring.me/)

[http://jobmote.com/](http://jobmote.com/)

[http://jobspresso.co](http://jobspresso.co)

[http://nomadjobs.io/](http://nomadjobs.io/)

[http://remotecoder.io](http://remotecoder.io)

[http://remoteok.io/](http://remoteok.io/)

[http://www.remoteworkhunt.com/](http://www.remoteworkhunt.com/)

[http://jobs.remotive.io/](http://jobs.remotive.io/)

[http://www.virtualvocations.com/](http://www.virtualvocations.com/)

[http://www.workingnomads.co/jobs](http://www.workingnomads.co/jobs)

</comment><comment><USER3> [http://offsite.careers/](http://offsite.careers/)

[http://hnhiring.me/](http://hnhiring.me/) and filter using "remote"

[http://careers.stackoverflow.com/jobs/remote](http://careers.stackoverflow.com/jobs/remote)

<comment><AUTHOR> Thanks...I haven't heard of hnhiring.me

</comment></comment><comment><USER4> [https://weworkremotely.com/](https://weworkremotely.com/)

<comment><AUTHOR> I've seen this one -- its pretty good.

</comment></comment><comment><USER5> [http://remoteok.io](http://remoteok.io) [http://nomadjobs.com](http://nomadjobs.com)</comment>


Dropbox irks Mac users with annoying Dock icon, offers clueless support - <AUTHOR> https://arstechnica.com/information-technology/2019/07/dropbox-support-reps-dont-seem-to-know-how-dropbox-for-mac-works/ <comment><USER2> From this, the dropbox employees are either lying to their customers or they're incompetent as to how things work. Which is it?</comment>


How to implement 'realistic' swordfighting in video games. - <AUTHOR> http://www.shamusyoung.com/twentysidedtale/?p=188 <comment><USER3> If I've learned nothing else from Dan Cook of <http://lostgarden.com> it's that just thinking up a game-mechanic is practically useless - you have to make a prototype, play with it (as a game) and tweak it (as a coder) to bring out the fun. Like any other fiendishly complicated, non-linear function, the psychological response to 'fun' is not something you can just sketch out on a napkin and say 'yeah, that'll work'.

Here's hoping someone with a bit of time on their hands will take this spec, stick it into some RAD game tool and see what happens.

<comment><USER4> _'yeah, that'll work'_

"That won't work", on the other hand, is easy. Here's why "realistic" fights with lethal weapons don't work for, e.g., a Star Wars game: George Lucas can fiat that Obi Wan never eats a lightsaber until it is dramatically appropriate, but in the game, for there to be challenge there has to be the illusion of risk, and if you're risking insta-death lightsaber cuts then a lot of kids and casual gamers (bread and butter for Star Wars) are going to get cut into pieces by mooks. That is going to be deeply unsatisfying to them. Nethack has a subculture who loves it dearly ("Hah, drunk the potion on level one without first testing to see whether it is a cursed potion? Man, you must be new at this. _rolls_ Oh, you're stoned. Time to restart!"), but the "physics" for Star Wars are very, very different.

The reason D&D doesn't have the fighter die after a hit with a giant club isn't because we're capable of suspending disbelief as long as we don't see it happen. Its because, given that D&D is based around having most shots by competent opponents connect (there is another problem with the other way), having one-shot instasquish makes the heroes seem markedly less heroic, and would result in e.g. the defining D&D encounter with a dragon get skipped totally by rational players. (At least until they could find a suitably non- dramatic low-risk way to dispose of the dragon without ever being perceived by him, such as having the wizard Wish him out of existence.)

[On reflection, the "game fiats you do not die when you as the player fail to dodge an insta-kill attack" gets around this objection, although one wonders if you're sacrificing player agency for "making sense", since a player who literally abandons his controller will see the animation system play his character _flawlessly_ for a minute until his stamina runs out. "Wait, what was I adding to this performance?" is not something I'd want to cause a player to think.]

<comment><USER5> _if you're risking insta-death lightsaber cuts then a lot of kids and casual gamers (bread and butter for Star Wars) are going to get cut into pieces by mooks._

It wouldn't just be insta-death. In the article he explains how a "focus" bar would replace a "health" bar, with the only real difference in terms of the logical mechanics being that you don't just lose focus when you get hit.

</comment></comment></comment><comment><USER6> The game Dragon Realms (play.net/dr) implements a system very much like this. It's actually a mud and not a video game, but that actually doesn't make a significant difference in this context.

DR has balance, so that the better balanced you are the better you can attack and defend. Some weapons are better than other at unbalancing an opponent, and you can also use spells to gain balance or unbalance something else.

It also has stamina, so that when you swing a sword over and over eventually you'll start swinging wildly, and eventually you'll fall over from exhaustion. This also negatively affects your balance.

The mechanic of position is also used, and as you play you learn how to respond to attacks or execute sequences of attacks to gain a better position.

Benzim mentioned having thrust, slash, etc, and DR implements this idea with thrust, jab, chop, sweep, slash, charge, etc.

The DR system differs from the one in the article in that you can face multiple opponents, though that's a skill you have to level up or else you'll be overwhelmed.

Overall the combat system is very engaging and different from the typical MUD system of typing "attack" and watching lines of numbers go by. Worth playing if you're into that kind of thing.

<comment><USER7> A system with balance, focus, and stamina might be interesting. You could simulate different fighting styles using these quantities. (For example, one style could emphasize stamina -- it would greatly impact the opponent's stamina, but at great cost to your own balance.)

</comment></comment><comment><USER8> Swordfighting is a lot like sex. Often it's not what you do - but what you say.

A: Soon you´ll be wearing my sword like a shish kebab! B: First you better stop waiving it like a feather-duster.

<comment><USER7> You're thinking of the "Dashing Swordsman."

<http://oots.wikia.com/wiki/Dashing_Swordsman>

<comment><USER9> The original Secret of Monkey Island had a system called "insult swordfighting". One combatant would taunt the other ("you fight like a dairy farmer!"); if the recipient came up with a good response ("how appropriate. You fight like a cow"), they would take a turn. If not, they would get pushed back. Get pushed far enough back and you lose.

That's what VBProgrammer was referencing. During the Dashing Swordsman sequence in OOTS, Rich recieved a lot of fan mail for referencing MI, but said he'd never heard of it before.

<comment><USER7> There's also the Pkunk from the Star Control II video game. They recharge their spacecraft by shouting insults at their enemies to drain "emotional energy."

<http://wiki.uqm.stack.nl/Pkunk>

</comment></comment></comment></comment><comment><USER10> Another interesting mechanic would be different types of attacks: thrust, slash left, slash right, slash down. The player can see the attack beginning and has a small amount of time to choose the correct defense to that attack. Choosing the correct defense reduces the amount of focus lost. You could also add shields. If you press block with a shield it'll block any attack with minimal loss of focus. Shields would have hit points and break if used too many times.

Mount and Blade is the closest game I've played to this. It still has hit points, but that makes sense for a medieval game where you're fighting heavily armored humans.

<comment><USER11> This discussion is sounding more and more like the card game "En Garde"...

<http://www.slugfestgames.com/games_eg.php>

The only difference I can tell is the game uses the term "poise" instead of "focus." But the notion of attack variants, responses and improvised gear pretty closely meshes with what everybody here and at the original post's thread seem to want.

</comment></comment><comment><USER12> I think the original Prince of Persia was the most fun swordfighting game I have played.

<comment><USER13> This one guy, Jordan Mechner, has designed a lot of the interesting martial arts simulations over the years. Prince of Persia, the Last Express, and even Karateka (if you were gaming in the 80s).

<http://jordanmechner.com/bio/>

The Last Express was really interesting. It's mostly a Myst-style, er, mystery, with animated cut-scenes. But even despite the limited interface there is a cool fight mechanic. You can only survive by predicting what the opponent's next attack is going to be by subtle shifts in body posture, and doing an appropriate countermove.

<comment><USER14> "his one guy, Jordan Mechner, has designed a lot of the interesting martial arts simulations"

How does one even begin to write a martial art simulation? Does one model the human body (model things like "a human elbow can turn x degrees in 2 planes" or whatever)? Does anyone have any references to (or demo code on) how to write a martial arts simulation? Thanks in advance.

<comment><USER13> Well, I really just meant "games". I'm not a game programmer, just an occasional player.

But, maybe I chose the word "simulation" because his works are always grounded in ordinary body physics. The typical fight game is really a button-masher with the reward of seeing a body fall to the ground if you win. Mechner's fight mechanics are about things like leverage, timing, moves and countermoves. They aren't really 'realistic' either but he's going one level deeper.

</comment></comment></comment></comment><comment><USER15> I think the author needs to have a look at the latest Prince of Persia. The elaborate acrobatics plus his suggested system are what make the game interesting.

However, the other thing that needs to be remembered is that if you want to play real sword fighting, take up fencing. Better graphics and level of immersion than you'll find in any game.

<comment><USER16> _However, the other thing that needs to be remembered is that if you want to play real sword fighting, take up fencing. Better graphics and level of immersion than you'll find in any game._

I don't know. Fencing is way more effort, harder to master, and I'm not so sure I agree about "better graphics". I mean, they're higher definition, sure, but not _nearly_ as awesome.

</comment></comment><comment><USER17> I stopped reading when it seemed like he was trying to reconcile reality with games. Won't happen. In real life, a .22 caliber cartridge to the pinky will put you on the medivac. In a game, you keep playing because...the point of a game is fun, not avoiding sepsis.

</comment><comment><USER18> Bushido Blade for the original PlayStation was a one-on-one game with pretty realistic weapon fights.

One hit from a sword in a vital area and you were dead. Hits to the legs or arm would disable that limb.

A lot of the fights were over quickly. But when both players were good, you could have some pretty tense, tactical duels.

The game mechanics also encouraged you to fight honorably.

</comment><comment><USER19> Love the article and I'd just like to take a moment to lament the lack of Bushido Blade type games in the last 2 generations of consoles. Easily the greatest fighting games ever.

you can email me if you can't figure out a way of playing them >_>

</comment><comment><USER20> There was a game called Moonstone which has realtime swordfighting. You could use 8 way axis of the joystick ( preferably Phyton brand) with two button. It was fantastic and never surpassed.

I don't understand why you need realistic sword fighting in games where you play just for fun. If realism needed then probably you need a fencing simulation.

</comment><comment><USER21> The best sword-fighting game I've come across has been Defenders of the Crown. Very quick little fights, mess up three times and you die.

For an example of an original martial arts fighting game, Toribash is worth checking out and seems very interesting. My computer isn't powerful enough to play it though, so I can't give a review.

</comment><comment><USER22> re: boxing games and stamina. I've never found this game mechanic to be convincing, just vaguely frustrating. All of us know what it feels like to push our muscles to the point of exhaustion, until they no longer respond - <USER2> is such an innate experience that for me, it is impossible to convincingly recreate it with a keyboard or controller and some on-screen meters.

On the other hand, most of us probably don't have experience bludgeoning each other with sharp or blunt objects to the point of exhaustion or death. This might mean two things: first, that we don't object to flashy, fun combats, because they are closest to our fighting experience which comes from watching movies. Second, that a realistic combat - a tedious, dirty matter of concentration and endurance - might just not be that much fun to play.

<comment><USER23> > a tedious, dirty matter of concentration and endurance

Eh? Not at all. In sabre fencing, it's rare for a touch to take more than 15 seconds. Even in épée, which most closely approximates a real duel, one minute is about the norm.

<comment><USER24> In real life, "winning" 10-7 isn't all that much of a win. More to the point, "a touch" doesn't cause a position reset and some touches are far more important than others.

Fencing is amazing, but it isn't fighting even if fencers do better at sword fighting than folks with no experience.

<comment><USER23> I had an in-depth reply to this, but I accidentally closed the browser tab in the middle of composing it. So I'll leave it at this for now: historical accounts of the duration of sword duels do not distribute themselves qualitatively differently from modern fencing, and even less so from the fencing of 100 years ago.

</comment></comment></comment></comment><comment><USER25> Let's see how Red Steel 2 for the wii handles this. It will be revealed at E3 (beginning of june). It makes use of wii motion plus which adds extra input to the wiimote so that you can have a true (or as close as you can get) 1:1 motion.

</comment><comment><USER23> I think the realistic version would be more fun. But as both a fencer and the author of a Nethack variant, I might be an outlier here :-)

</comment><comment><USER26> Dark Messiah had an interesting combat system. Too bad they outsourced the multiplayer component, which absolutely sucked.</comment>


Bitcoin hits $350 - <AUTHOR> https://www.mtgox.com/

<comment><USER2> And now edging up to the $400 wall, in only a few hours.

</comment><comment><USER3> Why has no one issued a competing currency?

<comment><USER2> Do you mean like the dozens of "altcoins"? (Here is an incomplete list: [http://altcoins.com](http://altcoins.com))

<comment><USER3> Didn't know that. Thanks.</comment></comment></comment>


High-end website Jameslist launched to sell luxury goods - <AUTHOR> http://www.cbc.ca/world/story/2009/01/23/jameslist-launch.html?ref=rss <comment><USER2> Ok hackers, you just sold your startup and you can buy one item on Jameslist–what would it be?

</comment><comment><USER3> one of those reventons, amazing, love the way they present all the stuff on jameslist, pure eye candy</comment>


Ask HN: How do you deal with stress, panic attacks, and that evil voice? - <AUTHOR>

Lately I've been having this little voice in my head that says "your doomed, your not going to make it, stop it" then comes stress and the panic attack with that "feeling" that everything is going to collapse.
The only cure I've been doing is to try and keep busy.  It helps but that "feeling" never disappears.
Edit: I'm bootstrapping entrepreneurship. <comment><USER2> These are all typical symptoms of anxiety.

There's a bunch of physical approaches to reduce anxiety, better sleep, more exercise, eating better, less caffeine, less alcohol, applied relaxation or the relaxation response (two non-spiritual versions of meditation), yoga, gardening, any physical hobbies.

I'd recommend reading some books on anxiety, particularly the science-based cognitive behavioural therapy (CBT) stuff, as often people's panic attacks and the avoidance they cause are literally because people are frightened of fear itself, and the way it makes them feel, and so understanding the basic chemical responses that your body undergoes can be handy. E.g. no-one has ever actually gone crazy or had a stroke or a heart-attack as a result of a panic attack. It's hard to convince yourself of this during one but having that knowledge at the back of your mind helps to prevent you worrying about that outcome and escalating things. Try "When Panic Attacks" by Dr David Burns or some of his other books for some sensible advice on this topic.

The CBT stuff is based on logically addressing irrational thought processes like "I never succeed at anything" and facing up to stressful things so that you'll not fear them similar to the rejection therapy stuff that was popular here a few months back.

SSRI's are popular drug treatments with much reduced side-effects and addictiveness compared with previous tranquilizer type drugs, but they'll still only mask the problem, not cure it like CBT can. Handy if you need the help to get started with CBT or just cope at all, but not necessary for most people and they do have side-effects and risks worth reading up on before taking them. Beta-blockers are a low-risk medication (taken by many people every day of their life for a variety of physical ailments) for controlling the physical responses to anxiety, though it sounds like your suffering more from the mental side (though of course they feed into each other in a vicious circle) but I don't think they're officially prescribed for anxiety in the U.S. so you may have to find a doctor willing to prescribe "off-label" if you think that they'll help.

</comment><comment><USER3> You've given us very little context. Are you bootstrapping? Are you an employee in a large company? Is your concern over specific projects? Or your place in this profession in general?

Maybe you should just step back and try to enjoy life more. Work out every day, learn to cook, take a trip, read more.

Maybe you should seek professional help. Or speak to your friends and family about it.

</comment><comment><USER4> Go see a good counselor. You may get better just with talk therapy or you may need some anti-anxiety meds. Either way a counselor will help you coordinate your options. I have noticed that programmers (myself included) tend to be an anxious and high strung bunch. There is no shame in something like this happening but take my advice and don't try to deal with it all yourself. Good luck !

</comment><comment><USER5> This usually happens when you are working on something for long time and have achieved little or no success so far.

Achieving some successful results can bring a lot of motivation and positivity in your life.

Try to set smaller achievable goals/milestones, and step up from there.

From how long have you been bootstrapping?

</comment><comment><USER6> Idle hands are the devil's tools and an idle mind is the devil's workshop.

That feeling is healthy :) By healthy, I mean that at least you aren't suffering from overconfidence. I've been having that feeling for months, and I cope by trying to occupy all of my time. HN helps :)

</comment><comment><USER7> Don't forget to maintain your physical fitness level. Doing something till total physical exhaustion (like weight-lifting) combined with tranquil sauna sessions always help me through these down moments.

</comment><comment><USER8> meditate. It's a great way to bring some peace up there :P

</comment><comment><USER9> My two biggest/best calming tactics:

A) A good sounding board to hash things out with.

B) Work on resolving (or at least addressing) whatever problem is inspiring the feeling of Doom.</comment>


China's Xi Wins Constitutional Backing for New Strongman Era - <AUTHOR> https://www.nytimes.com/2018/03/11/world/asia/china-xi-constitution-term-limits.html <comment><USER2> Kinda not really keen on its perverse use of title with "Strongman". China makes up 1.38 billion people of the world's population and the over generalizations of the article don't highlight the issues that China faces in the coming few decades and the need for a unified leadership. Coming from the US's perspective, it's very hard to write a cohesive article that accurately reflects China, to be honest. Additionally, I think anyone from a high-density urban center like New York has a tough time taking into perspective how wide the country's foot-print is across Asia.

I may be equally unqualified, but its a pretty terse way to write about our largest economic party in the world.

<comment><USER3> I mean, you can always read the Chinese press if you want a counter opinion. Here, global times:

[http://www.globaltimes.cn/content/1090562.shtml](http://www.globaltimes.cn/content/1090562.shtml)

Let me warn you, however, that the worst kind of western media bias is to directly quote a chinese media article, as it gives a drastically more worse impression of China than the west ever could.</comment></comment>


Pilots have reported issues in US with Boeing 737 Max - <AUTHOR> https://www.apnews.com/0cd5389261f34b01a7cbdb1a12421e27 <comment><USER2> 140 comments on the frontpage in "Boeing 737 Max pilots complained to feds for months about suspected safety flaw" [https://news.ycombinator.com/item?id=19373216](https://news.ycombinator.com/item?id=19373216)</comment>


The Quest to Replace Passwords [pdf] - <AUTHOR> http://www.jbonneau.com/doc/BHOS12-IEEESP-quest_to_replace_passwords.pdf

<comment><USER2> The table on page 11 gives a remarkably concise view of the state of the industry shows us just how much work we still have to do.

</comment><comment><USER3> Why can't we use several authentication mechanisms at once? For example I don't think it takes that much more hassle to set-up face unlock, fingerprint recognition and NFC pairing compared to having to set-up _only_ fingerprint recognition. They are just two simple extra settings, and then NFC pairing and face unlock are pretty much out of the way.

NFC pairing could automatically activate when you try to use fingerprint recognition, being in range. And Face Unlock just activates while you hold your phone in hand, like Google did in Android 5.0.</comment>