Ask HN: Alternative for Truecrypt - <AUTHOR>

Due to recent events with Truecrypt security, what alternatives and tools we have for secure disk encryption? <comment><USER2> If you're using a Mac, Filevault 2 is sector-level AES-XTS with a solid user interface and good performance.

</comment><comment><USER3> My scenario is simply replacing TrueCrypt volumes.

I use TrueCrypt volumes to store personal files like scans of passport, credit card info, 2FA codes, etc.

These volumes are then on NAS or USB sticks, though a couple are in Dropbox for emergency remote access (those 2FA codes).

I primarily access everything via Linux, but the emergency scenario means I would like to be able to access via Windows and/or Mac.

I'm looking for super-simple, and ideally packaged binaries that do not need elevated privileges to run... as these deal with the emergency scenarios.

</comment><comment><USER4> I have been trying out alternatives for more than 1 year and I feel nothing good & reliable exists for Windows (other than BitLocker - need to upgrade to enterprise/utimate/pro). The feature set of Truecrypt was pretty neat.

I doubt there'll be a good alternative anytime soon. I'm guessing the data is sensitive enough that you don't want to experiment with tools that aren't widely adopted.

</comment><comment><USER5> Mac: FileVault for FDE, encrypted disk images for files.

Linux: dm-crypt for FDE, gpg for files -- or dm-crypt with loopback volumes.

Windows: BitLocker for FDE (unless you are a potential US IC target, but then why would you use an OS from a company who has a proven history of being eager to work with the US IC), gpg for files.

<comment><USER6> Asymetric for files? Wouldn't that be slow? Or does GPG automatically do a combo?

I had used OpenSSL's enc tool before and seems to work too. The sucky thing is that I liked having a tool where I at least had access on my iOS devices. With encrypted disk images (ironically) that wouldn't be the case whereas I at least had read access to TC volumes.

</comment></comment><comment><USER7> Anyone know if a group is organizing to take on dev for Truecrypt?

<comment><USER8> I have found these : * [http://truecrypt.ch/](http://truecrypt.ch/) * [https://github.com/bwalex/tc-play](https://github.com/bwalex/tc-play)

</comment></comment><comment><USER9> I'd like to see one based on Threefish' 1024-bit blocks.

<comment><USER2> Why?</comment></comment>


WTO agrees global trade deal worth $1tn - <AUTHOR> http://www.bbc.co.uk/news/business-25274889

<comment><USER2> If the trades aren't linked to providing these trades in a sustainable, non- polluting way - then it's overall bad IMHO.</comment>


Secretary Clinton: The Internet Has Become The World's Town Square - <AUTHOR> http://techcrunch.com/2011/02/15/secretary-clinton-the-internet-has-become-the-worlds-town-square/ <comment><USER2> This looks like a follow-up to one of her previous statements,

<http://en.wikipedia.org/wiki/It_Takes_a_Village></comment>


Introducing Mozilla Winter of Security 2014 - <AUTHOR> https://blog.mozilla.org/security/2014/05/15/introducing-mozilla-winter-of-security-2014/

<comment><USER2> This sounds like a great way for students to do some real work. Are there any legal issues to this? Are students allowed to work on Mozilla projects while at school when they are not paid (not an internship)? Or is it alright since the whole thing is open source? The question becomes more relevant because a good percentage of the students (especially masters students) are on student visas and are not allowed to work outside the campus. Am I over thinking this?

<comment><USER3> Not sure how it works in the US, especially because every country has its own rules, but I don't think there will be any problem. There seems to be no mention of any pay so it can be treated as any other University project (I guess).

In my Master's programme (Studying in Amsterdam, so not an american) we can choose to work on University-approved projects(it's up to the professor) and can receive credits for them. A few friends of mine have worked at GSoC projects and got credits from those, I'm currently doing some independent research with a mentor/tutor and will get credits once I finish (and hopefully publish). This doesn't sound any different.

<comment><AUTHOR> This is exactly what MWoS is about.

</comment></comment></comment><comment><USER4> Winter _is_ coming at Mozilla, but only because they've chosen to betray their community and adopt DRM, too.

<comment><USER5> Riiight. Unlike other browser vendors with more than >5% marketshare, which all voted NO on DRM.

Anyway the message is frivolous and OFF TOPIC.

<comment><USER6> Not entirely: the DRM code modules are necessarily closed-source and cannot easily be audited for security vulnerabilities. Given that _Adobe_ is apparently supplying one, and given the number of remote exploits provided by the PDF reader plugin, I think it's reasonable to assume that the DRM modules can present a security risk.

<comment><USER7> The CDM is strictly sandboxed.

<comment><USER6> So it's not native code? Interesting.

<comment><USER7> It's native code, but it's strictly contained within an open source sandbox that implements all the interfaces it can use to communicate with the outside world.

<comment><USER8> Could you provide a link to the source for the sandbox implementation?

<comment><USER7> I'm not on that team so I'll have to get back to you—it's quite possible that the code hasn't been written yet. Currently, we use the Chromium sandbox [1] for sandboxing where it's supported.

[1]: [http://mxr.mozilla.org/mozilla- central/source/security/sandb...](http://mxr.mozilla.org/mozilla- central/source/security/sandbox/)</comment></comment></comment></comment></comment></comment></comment></comment>


One LaaS Thing: Building the Indian Internet in local languages - <AUTHOR> https://medium.com/@sahilkini/one-laas-thing-building-the-indian-internet-in-local-languages-1a8109417ff1

<comment><AUTHOR> Vivek Pani, CTO of Reverie, the company mentioned in the post, will be following this post to answer any technical questions developers may have. So fire away!</comment>


Windows 8.1 officially finished; nobody to get it until launch day - <AUTHOR> http://arstechnica.com/information-technology/2013/08/windows-8-1-officially-finished-nobody-to-get-it-until-launch-day/

<comment> T-A ... or it just means that changes from the latest publicly available release preview are so small that there is no need for an updated preview...

</comment><comment><USER2> Why would Microsoft announce that the product is finished if they aren't willing to let people use it? That seems incredibly stupid in a world of digital distribution.

<comment><USER3> I suspect they may have taken the (good) decision to spare an extra month before release just for polish and QA, and then marketing wanted to publicise that as "we're really doing it properly this time". If that's the case, it might have been a better idea to announce that as part of launch PR.</comment></comment>


Which book is best use for java web app development - <AUTHOR>

i'm new to java web app development but i don't really know the book to start with. Any help will do me good. Thanks. <comment><USER2> I have been programming in Java for quite a while and unfortunately I can't recommend a generic Java web programming book. Moreove, you don't need one.

Web development in Java is highly fragmented by the framework of choice. There are several frameworks like Spring MVC, Struts, JSF , Wicket , Tapestry etc. and the new Play Framework. If you are prepared to put in the time, you can start with Spring MVC --- this is the best documented web framework in Java .Spring folks have created excellent tutorials and there are several other blogs on this subject that can get you upto speed. Moreover, every enterprise java job that you will apply for will demand Spring expertise.

I hope this helps.

<comment><AUTHOR> Sure it helps! I will give a try, i was thinking JSF will make it a little bit easier. Well, thanks pal!</comment></comment>


US government halts study on health effects of coal mining - <AUTHOR> https://www.nature.com/news/closure-of-us-coal-study-marks-an-alarming-precedent-1.22512 <comment><USER2> The study's budget was only $1m. Seems like the readership of HN could easily pull that money together and donate the funding, if the researchers could accept it.

<comment><USER3> I'd be surprised if this "community" could gather money for anything remotely useful.

Also: I'd like to see the outcome of a fundraising, and the demographics of the donators, to see how many pledge outside of CA, and outside of the USA. This would give me an impression about the extent of the Trump is Satan and the world is about to end mindset. (imho nothing changes, things proceed with trump as before. business as usual)

Just to make it clear: I'd not give a single penny for it, I care for the health of US citizens only as much as they care for the health of citizens of other countries.

<comment><USER4> You're not thinking strategically. The US is one of the biggest emitters of CO2, and coal plants are about 1/3 of that. If the study can convince the population to reduce their use, even if with a different argument, that's helpful for the whole planet.

<comment><USER5> You just admitted the would-be study actually has ulterior motives. That's not good.

<comment><USER6> Almost all research has ulterior motives in this sense, particularly government-funded research. You want to guide policy so you collect information on the impact of that policy, existing or proposed. The alternative is to make policy in the absence of data.

Research guided this way is problematic only if it amounts to cherry-picking of facts, studying only the benefits or costs to the exclusion of the other.

</comment></comment></comment></comment></comment><comment><USER7> The information age is built on gathering raw data and doing pure research, neither of which are profitable activities.

The implied threshold for wastefulness here is offensively low; basically any project that might require one moderately competent PhD researcher for a year.

<comment><USER8> You hit the nail on the head, pure research is not a profitable activity. This is why we can't trust companies and corporations to research.. their motives are almost always profit driven. This only underlines the importance of government funded research, and the need to have a government in place who is willing to put the advancement of our society over their own personal gain (We don't have that right now..).

<comment><USER9> You're forgetting about the $1.9 trillion nonprofit sector, of which 15% is spent on health research, 12% on public + social benefit...[1]

That seems to bely the need for a government that can fund research that 'puts the advancement of our society over their own personal gain.'

[1][https://philanthropynewyork.org/sites/default/files/resource...](https://philanthropynewyork.org/sites/default/files/resources/The%20Nonprofit%20Sector%20in%20the%20United%20States%20Size%20and%20Scope.PDF)

<comment><USER10> Non-profit does not mean the system is working outside of capitalism or people are not making money.

<comment><USER9> I don't understand your issue with people making money. Why should people not make money while doing beneficial research for humankind? Is there some reason why making money and helping people are mutually exclusive?

</comment></comment></comment></comment></comment><comment><USER11> Outside/In interviewed some miners and families recently. It's phenomenal radio, actually talking to the people everyone else just talks about.

I haven't been able to get it out of my mind.

[http://outsideinradio.org/shows/ep34](http://outsideinradio.org/shows/ep34)

Note, I know this isn't 1:1, not about the communities surrounding mountaintop removal, but there are some good notes in it about modern changes to mining techniques all the same.

<comment><USER12> That really puts a face on greed's victims. Thank you.

</comment></comment><comment><USER13> You don't need anymore research to know it is obviously dangerous. What we do need is leadership that doesn't bow down to cronies & supports stupid beliefs.

<comment><USER14> I lost an uncle to black lung. Coal mining as an industry needs to die. And I grew up in WV.

<comment><USER15> Hello from WV. (Northern panhandle here) Most of my family were steel mill folks but before the mills took off they were miners. Coal and mining (in general) are hell on the body.

<comment><USER14> Absolutely correct. Thanks for writing - I'm ready to travel back there for real weather.

</comment></comment></comment></comment><comment><USER16> "But think of the freedom of speech!"

In all seriousness though, the most important bit wasn't even clarified by the article:

 _The agency says it is reviewing spending on all projects that cost more than $100,000._

So is it actually true and I'm supposed to be manipulated into outrage due to cherry picking this one project? Or is it false and I'm supposed to be actually outraged at this shadowy deceitful action?

<comment><USER17> It can be true and you can still be outraged, because that justification is probably just an excuse to can projects that the current government doesn't like.

<comment><USER18> > can projects that the current government doesn't like.

All administrations do that.

<comment><USER19> Really? Can you show me a legitimate scientific project that the Obama administration shut down?

<comment><USER18> As I recall, one couldn't (and still can't) get funding for research into medicinal uses of drugs like marijuana and heroin.

Politics always drives what gets government research funding and what doesn't. Politics defines what is "legitimate" and what isn't, and those shift over time.

<comment><USER20> > shut down

You're citing research that was never started.

</comment></comment></comment></comment></comment></comment><comment><USER21> I assumed it was widely known that coal mining was hazardous to ones health. My grandfather died from black lung before I was born.

<comment><USER22> This study is on the health risks of surface coal mining (also known as mountaintop removal) on the surrounding communities, not on the miners. As the article notes there is some evidence of unusually high lung cancer and birth defect rates in communities near such mines.

<comment><USER23> I was eating dinner with two doctors about a month ago, and they were discussing this. They said it was difficult to prove that coal mining causes things like lung cancer in the miners themselves because it is just about impossible to find a coal miner who doesn't smoke.

<comment><USER24> Would they get cancer sooner or have different effects than non-miner smokers?

<comment><USER25> I think the sample sizes might get out of hand as you'd need a good deal of miner and control subjects to filter out the noise.

</comment></comment></comment></comment></comment><comment><USER26> Just bring back the rule of law. Tort law would mean that coal burning would be sued to extinction. Accepting the death of all tomorrow so that some may survive today is absurd. The church of pseudo-finance tells us that burning our forests down and poisoning all our rivers is 'growth'. Any child would laugh this away as insanity.

</comment><comment><USER27> Do they really need to conduct a study to determine that spewing black smoke into the air hurts human beings?

The Coal lobby must love Trump.

Glad millennials won't work for Coal or Oil.

<comment><USER28> You're probably premature on the oil bit, the latest oil boom is over but it was a good run for high paying, manual labor without any education requirements.

Coal jobs had the double whammy of cheaper energy sources for power reducing demand and replacement of mining veins to mechanized mountaintop removal reducing need for manual labor.

Oil demand will probably come back for the same jobs - until they can mechanize oil/natural gas drilling like mountaintop coal removal.

</comment></comment><comment><USER29> Lysenkoism proved fruitful many unpopular subjects.

</comment><comment><USER30> The world will not come to an end yet but this is not a good way to ensure its ensuing survival.

<comment><USER26> They cut the research. So what? People are free to end their own robbery (paying taxes) to fund the research themselves. The taxes of five working people can finance a PhD.

</comment></comment><comment><USER31> > The agency says it is reviewing spending on all projects that cost more than > $100,000.

Title of this article is somewhat misleading; it's actually even more serious, apparently.

</comment><comment><USER32> These studies are often started with political goals in mind -- the article confirm this when it highlights "the political nature of the topic". Maybe the money is better spent on a study on the health effects of lithium extraction?

</comment><comment><USER33> Title is misleading. All projects that cost more than $100,000 are being reviewed.

</comment><comment><USER34> So glad POTUS did this. It is a huge waste of money to find out what the general public already know. The health effects are very, very bad! The worst!

<comment><USER35> Nah, you just clean the coal and it's fine.

<comment><USER34> So many jobs washing coal coal is so dirty. Dirty as, well, coal. Can you imagine how many jobs? I can't, so many.

</comment></comment></comment><comment><USER36> What are they afraid of? It's too dark down in a coal mine to read any health studies anyway!

<comment><USER37> The article is about surface mining and its effects on the local surrounding communities not about underground mining.

<comment><USER36> Ah, it was hard to read because of all the soot in my eyes.</comment></comment></comment>


Rails 2.3.5 on Google's App Engine - <AUTHOR> http://gist.github.com/268192 <comment><USER2> Has this patch been submitted to the 2-3 stable branch for 2.3.6?</comment>


Ask HN: What do you dislike about your RSS reader? - <AUTHOR> I'm currently working on an RSS reader as a replacement for Google News for myself. I'm curious what kinds of things other people who use content aggregators like or dislike about the ones they use. <comment><USER2> After Google Reader I haven't been able to use an RSS reader ever since. IMHO the competition often tries far too hard to make the UI pretty.

I don't need minimalism, over-complicated UIs, personalized reccomandations and so on. I don't need social sharing (on the desktop at the least).

I need a fast, easy to follow, predictable UI. An easy way to categorize feeds. I would like to be able to read and save my OPML in the cloud (a github gist, a Google Drive document, etc) and possibly use on another device with the same app or possibly even with another. On the mobile side, it would be great if the reader was a progressive webapp rather than an android/iphone application.

</comment><comment><USER3> Until 2 weeks ago, I would have answered: that I can't use the same app/site to read RSS as I can to read documents that I manually saved, so I have 2 apps and queues (Feedbin and Instapaper) for 1 resource (my casual/quick reading time).

But… the service I use, Feedbin, just implemented that: [https://feedbin.com/blog/2019/08/20/save-webpages-to-read- la...](https://feedbin.com/blog/2019/08/20/save-webpages-to-read-later/). The saved pages could use better categorization (tags/folders), but Feedbin has those for RSS feeds so I suspect they'll exist eventually. If/when I can categorize saved pages and stop using Instapaper, I can't think of anything else about Feedbin I'd change.

<comment><AUTHOR> Interesting, thanks! I hadn't thought about that kind of a use case before.

</comment></comment><comment><USER4> I used to use Newsblur and the only feature I wish it had (which maybe it did and I just didn't know about it) is to see trending articles like Feedly does, just so I could get a feel for what was going to be a hot conversational topic. RSS really needs a renaissance though.

</comment><comment><USER5> To be honest, I'm agnostic to the particular RSS reader I use as long as it gets the basics right - read later, save webpages in read later, basic organization and a decent search. My current poison of choice has been Feedly but I've had a great time with Inoreader as well.

</comment><comment><USER6> I use other sites to curate content for me. Mostly HN and the people I follow on Twitter. I try to stay on a news diet.</comment>


Do you want to learn some abstract math? Will you give me your opinion? - <AUTHOR>

It's a recurring theme on HN that whenever some deep math turns up, a few people say they wish they knew more.  Others say they wish they could read math, and still others ask how they can learn more.
I'm writing a bunch of stuff, but it's not necessarily aimed at the level HN readers would want.  If you'd be willing to offer your thoughts, I'd be happy for you to read as much as you like, and let me know what's good, what's bad, and at what point you gave up.
Email me - address in the profile.  I won't necessarily reply immediately as I'm often on the road or otherwise find it difficult to get to email, but I will reply. <comment><AUTHOR> I should learn that before posting something like this I need to set up an auto-responder. It's late here and I have an early start, but if you email me, I will reply.

Thanks for all the emails so far - I hope you get something interesting out of it, and I look forward to your comments.

</comment><comment><USER2> I would love a simply math blog. You know, even the most silly things to higher levels. And with real life applications or software. Sometimes, the easy and plain language works better than complex formula

<comment><USER3> Totally agree. Another blog in the lines of Good Math & Bad Math or Betterexplained would be awesome.</comment></comment>


Ask HN: What open source packages are available to display chart and graphs? - <AUTHOR>

Google provides an API to create charts. But it's hosted by Google. What alternative options are available to display charts on a web based application? <comment><USER2> Highcharts is my fav and default charting library.

<http://www.highcharts.com>

Highcharts is not open source but is free to use for non-commercial use. I have paid the $80 to use it on commercial websites and client/managers are always very impressed with its capabilities. I think its well-worth the $$

<http://www.highcharts.com/license>

<comment><USER3> Highcharts _is_ open source, but it has a restrictive license for commercial use. It is free for non-commercial use (personal, non-profit) and it is also free during development, even commercial apps.

I also highly recommend. It's a pleasure to work with. Sites using it include MixPanel if you want to see it in action.

<http://www.highcharts.com/license>

</comment></comment><comment><USER4> There's always Protovis: <http://vis.stanford.edu/protovis/>

<comment><USER5> Protovis is fantastic. It goes well beyond charts and graphing, but you can create some wonderful, interactive charts with it.

</comment></comment><comment><USER6> There's flot: <http://code.google.com/p/flot/> Raphael.js (along with gRaphael): <http://raphaeljs.com/> jqPlot: <http://www.jqplot.com/>

I'd recommend flot out of these three, had the best experience with that one so far.

</comment><comment><USER7> Check out Flot for jQuery: <http://code.google.com/p/flot/>

Some excellent examples here (scroll down):

<http://code.google.com/p/flot/wiki/FlotUsage>

</comment><comment><USER8> For time-series, I like dygraphs: <http://dygraphs.com/>

For server-side chart generation, I tend to use matplotlib (semi-recently changed from gnuplot).

</comment><comment><USER9> One option, depending on the type of chart your looking for, might be the Javascript InfoVis Toolkit: <http://thejit.org/></comment>


Of Debt and Decisions - <AUTHOR> http://www.monkeysnatchbanana.com/2015/04/19/of-debt-and-decisions/ <comment><USER2> This article addresses one problem with technical debt, the idea that one day the debt will "come due" and you'll have to fix some latent problem in a hurry and very painfully. While that can happen, a lot of the time you can carry the debt forward, as the article illustrates well.

The bigger problem with technical debt is that it limits or slows your ability to do things. With real debt you have to make monthly payments and that reduces the total amount of cash you have to spend, which reduces your flexibility. With technical debt you "make a payment" whenever the speed you can make changes is reduced due to bad technical decisions of the past.

For example, if you don't have tests then you can still change the code, but you have to spend a great deal longer doing manual testing. When the inevitable bug slips though, you have to spend the time to fix it. Since it's often not catastrophic, non-technical management will be willing to pay a known ongoing cost instead of an large, unknown one-time cost to remove the problem altogether.

At my last job we were so mired in technical debt that progress had slowed to a near standstill. It was a 20-year-old codebase running on an IBM AS/400, mostly written in RPG (which is sort of like assembly language but for databases.) Field and table names were limited to 11 characters. When they migrated the product to the web, they kept the RPG code but added in a bunch of perl. When DB2 couldn't keep up, they started adding new data to MySQL.

In all, there were 500 thousand lines of code in the system. Adding a field to the most important table was a 20 hour process, including a late night or two to issue some commands while the system was doing its nightly maintenance. There were five programmers while I was there, and the majority of our time was spend keeping the system going. There was never time allocated for cleaning up the existing system, so instead we'd just try and add features without making any schema changes (or adding fields in MySQL instead, as I mentioned before).

<comment><USER3> You beat me to it. While you can "avoid" the debt by working around it, you're still paying by having to implement the workarounds rather than being able to do it in a more straightforward manner. All you're doing is swapping interest costs with opportunity costs. The piper has to be paid, one way or the other.

</comment></comment><comment><USER4> I love this story. It offers an important reminder about how our industry really works.

Whenever a practice becomes established as a "best practice", such as automated testing, then the next question that arises is "Why isn't everyone doing this to the max?" And folks that don't follow best practice generally feel guilty and keep quiet. But those who follow fashions in tech tend to underestimate the opportunity costs of doing so.

This is the moral of the above story, and it is a good one:

"Hopefully you are horrified by all things we didn't do that are now considered best practices. No reproducible builds, lack of automated testing, creating and then repeatedly sidestepping technical debt. For a long time, that is how I told these stories: as horror stories that came complete with hand gesticulations to emphasize the "can you believe I had to do that?" nature of it all. Here's the thing though: we were making money. We were growing and supporting ourselves."

I spent this winter working for a startup that had the opposite problem of most startups. The CTO was a serious Pythonista, and he wanted to ensure that all the code was written was of high quality. He wanted to avoid the build up of technical debt. There were 9 programmers on the team, using Python on the backend and AngularJS on the frontend. And he felt they could invent a new way forward, in terms of combining Python and Angular. And so the team was reinventing the whole Python stack: they had their own serialization libraries, their own database libraries, their own web server, their own authentication system. Adding each new feature lead to very long meetings in which people were encouraged to be thoughtful -- everyone was suppose to think about the long term consequences of whatever design was chosen. In some ways, it was a careful style, but it had a cost: the 9 developers spent more than 50% of their time on infrastructure questions that had already been solved elsewhere. In terms of meeting the real needs of this small startup, the startup might has well have had a team of 4 developers -- the money paid to 5 of the developers was, in a sense, an act of charity being offered to the Python community.

We've all ready endless stories about startups that cut corners, ran up technical debt, and eventually succeeded. We read much less often about startups that doing everything perfectly and then become successful. And that suggests that, for startups, cutting corners is the more adaptive path.

<comment><USER5> I've seen that a couple of times, startups that insisted on rolling their own code for everything instead of using standard tools.

I worked one place that wrote their own build tool (instead of using Make or Visual Studio). They wrote their own templating engine, instead of using PHP or ASP. They had their own version of MFC and String library, with everything implemented slightly weird, so I had look at the source whenever I needed to know how it actually worked. It was nuts. They spent a year writing their own tools for everything, which was a year they didn't spend working on the product.

<comment><USER6> I know of a non-software industry company that for a brief time seriously considered implementing its own proprietary relational database engine. Thank god that project got killed.

</comment></comment></comment><comment><USER7> "Technical debt only hurts if you have to pay it back"

To continue the "debt" metaphor, when your product dies, it debt dies with it (or if you switch technologies, you might get a 'debt relief').

So for the thousands of startups and products that disappear or get pivoted before they can mature - it might be worth it to bet on not paying technical debt.

<comment><USER8> Perhaps you could call that 'technical bankruptcy', as in, "we're declaring technical bankruptcy and writing an entirely new version".

<comment><USER9> "technical write off" is probably a better term.

<comment><USER10> I don't think the debt metaphor works, because there's no real or implied creditor. (Except maybe time or entropy?)

Technical mass might be better. The code keeps accreting, developer efforts orbit around it in ever-decreasing circles, and at some point it becomes impossible to escape from it.

But is this really a technical problem, or a documentation and specification problem? If there's no separate formal model for the project, the code _is_ the documentation, and that's never a good place to be.

</comment></comment></comment></comment><comment><USER11> For me the moral from that story is that in a mature market there is a lot of accreted wisdom and best practices - but in the early stages you don't have that and you need to trudge along with whatever you have. And judging those early projects through the lenses of the learned wisdom is silly.

</comment><comment><USER12> This "Yeah we had a lot of technical debt but we kept finding inventive ways to sidestep having to pay it. The debt metaphor that we've adopted is misleading. You don't always have pay off the debt you created; you can work around it and avoid ever having to pay it off. Technical debt only hurts if you have to pay it back."

<comment><USER13> [http://www.higherorderlogic.com/2010/07/bad-code-isnt- techni...](http://www.higherorderlogic.com/2010/07/bad-code-isnt-technical- debt-its-an-unhedged-call-option/)

</comment></comment><comment><USER14> tl;dr?

<comment><USER15> Technical debt is only worth caring about if you have to 'pay' for it one day</comment></comment>


Lessons from a Study of Perfect Pitch Decks - <AUTHOR> http://techcrunch.com/2015/06/08/lessons-from-a-study-of-perfect-pitch-decks-vcs-spend-an-average-of-3-minutes-44-seconds-on-them

<comment><USER2> We already had that [https://news.ycombinator.com/item?id=9687696](https://news.ycombinator.com/item?id=9687696)

</comment><comment><USER3> I'll never understand the notion of a "prefect pitch deck." The one that is perfect is the one that tells the dirty I'd your company in the most convincing/compelling way. That would be very different depending on the company.

The way they're passed around and analyzed and "open sources" is a little weird to me. I mean I get it, I just feel like there's more emphasis on pitch decks than they warrant or deserve.</comment>


Greece's Proposals to End the Crisis - <AUTHOR> http://yanisvaroufakis.eu/2015/06/18/greeces-proposals-to-end-the-crisis-my-intervention-at-todays-eurogroup/ <comment><USER3> Someone recently suggested the current mood in Europe was a bit like the mood in the spring of 1914 -- a sort of uncaring and sloppy optimism, a sense that real disaster can not possibly happen, a stumbling blindness that makes real disaster more likely, exactly because so few, among those in leaderships positions, are thinking that disaster is possible.

15 years ago German was stuck in a slump with high unemployment and little growth. It got out of that slump thanks to the euro, which created a boom in southern Europe, and thus generated export markets for Germany. The nation which benefited the most from the euro is Germany, and yet Germany seems willing to sabotage its own success. If Greece leaves the euro, it becomes more likely that Spain or Italy or Portugal or Ireland might leave the euro. Once these countries leave the euro, they will have weak currencies that will make it easy for them to underprice Germany. One can get a small sense of how this plays out by looking at the growth that Poland has enjoyed, thanks to the weakness of the zloty. Of course, Poland has not seen high growth, since all of its trade partners are stuck in, or near, recession, yet Poland has gained market share in dozens of small industries, such as coffins and beer. And the advantages that Poland has would also become advantages of Greece and Italy and Spain, etc, if they leave the euro. A rational German minister would avoid this at any cost, but the Germans themselves seem entirely blind to the disaster they are getting themselves into. If the euro dies, all of Europe will be hurt, but Germany most of all.

Edited to add: interesting about the rapid upvotes and downvotes on this comment. Right now the comment has a total of 20, but every time I check it has gone up 4, then down 3, then up 2, then down 1, then up 3, down 2, etc. I've never before written a comment that drew forth such intense up and down voting.

<comment><USER4> Where is the evidence for this claim?

"It got out of that slump thanks to the euro, which created a boom in southern Europe, and thus generated export markets for Germany. "

Germany's biggest trade partners are France, US, UK and China.

[https://www.destatis.de/EN/FactsFigures/NationalEconomyEnvir...](https://www.destatis.de/EN/FactsFigures/NationalEconomyEnvironment/ForeignTrade/TradingPartners/Tables/OrderRankGermanyTradingPartners.pdf?__blob=publicationFile)

Germany's improvements have more to do with Germany's changes to industrial --(relations) reform than to do with Southern Europe:

[https://en.wikipedia.org/wiki/Hartz_concept](https://en.wikipedia.org/wiki/Hartz_concept)

\-- edit added (relatations) to the sentence.

<comment><USER5> Germany enjoys the lowest unemployment rate in history, while Greece has a humanitarian crisis and Spain has also extremely high unemployment. That's not a coincidence.

> Germany's improvements have more to do with Germany's changes to industrial > reform than to do with Southern Europe [...]

Then let Greece default (as a Greek I believe that's best for my country in the long term) and see how that plays out. BTW the lack of understanding of 101 macro-economics by Scheuble is disheartening[1]. Every time he speaks, he is comparing economy-wise countries to businesses and/or households, which coming from a FinMin is plain ridiculous[2].

[1] [http://www.brookings.edu/blogs/ben- bernanke/posts/2015/04/03...](http://www.brookings.edu/blogs/ben- bernanke/posts/2015/04/03-germany-trade-surplus-problem)

[2] COMPETITIVENESS - A DANGEROUS OBSESSION P. Krugman, 1994, Foreign Affairs Magazine [http://www.pkarchive.org/global/pop.html](http://www.pkarchive.org/global/pop.html)

<comment><USER6> Let Greece default ... and see how that plays out.

I'm horrified of the carelessness with which that option seems to be considered by the Greek government.

<comment><USER7> A default is a horrible outcome, but "that which can't be paid back won't".

It's been pretty clear for a while now that the debt load for the Greek economy is too great and some sort of bankruptcy(default) is required. The ECB and others have conspired to hide this with the collusion of previous Greek leaders, by heaping on more onerous debt and calling it a bailout.

It will have to end at some point. What's occurred up until now is fraud with the intent that someone further down the road will have to deal with ensuing mess. But it's likely the game of kick the can will continue.

</comment></comment></comment></comment></comment><comment><USER8> >Around 1 million families survive today on the meagre pension of a grandfather or a grandmother as the rest of the family members are unemployed in a country where only 9% of the unemployed receive any unemployment benefit.

This is simply terrifying

<comment><USER9> Aren't pensions in Greece still highest in EU even after the cuts?

<comment><USER10> Absolutely not.

60% of Greek pensioners get less than €800 gross a month, and 45% live on less than the monthly poverty limit of €665.

Also, unemployment is sky high so a lot of the pension money is used to feed impoverished family members.

</comment></comment></comment><comment><USER11> The point of this, beyond Varoufakis' actual arguments, is that he's using new media to ensure his message gets out.

As an individual, on his own blog, he's publishing material that the institutions sought to obscure and spin.

<comment><USER12> _he 's publishing material that the institutions sought to obscure and spin_

Interesting. Instead of "the institutions", here in the USA we used to say "the Man"[1]. As in "the Man is keeping me down". Sadly, that phrase is from the '60s and appears to have fallen out of the vernacular.

The problem is that in his blog we're only seeing Varoufakis own spin on the situation. What is he himself obscuring? It's hard for us who are looking in from a distance to keep up.

[1] [https://en.wikipedia.org/wiki/The_Man](https://en.wikipedia.org/wiki/The_Man)

<comment><USER13> There are always three sides in every argument: The ones arguing, and the truth.

<comment><USER14> Usually The Truth (in human matters) doesn't exist. Most human matters are nonsensical - or so complex that there is no way of knowing "The Truth".

</comment></comment></comment></comment><comment><USER15> So far I can't find anyone commenting on Putin and Russia here. There are those who say the Putin is using the Greece situation to destabilize the Euro and Europe.

[http://www.bbc.com/news/world-europe-31837660](http://www.bbc.com/news/world- europe-31837660)

[http://www.washingtonpost.com/opinions/putins-global- ambitio...](http://www.washingtonpost.com/opinions/putins-global-ambitions- could-destabilize- europe/2014/03/18/69abb2a2-aec5-11e3-9627-c65021d6d572_story.html)

[http://www.dailymail.co.uk/news/article-3133035/Greece- line-...](http://www.dailymail.co.uk/news/article-3133035/Greece-line-Putin-s- new-cold-war-Grexit-looms-leading-historian-argues-imperialist-Russian-leader- sees-chance-swoop.html)

</comment><comment><USER16> Wow, I had no idea how bad it was in Greece. This article is an incredible summary. They've removed 40% of pensions, raised taxes, agreed to sell off most public assets within 10 years, agreed to put a 'fiscal council' (read: bankers) in charge of the country's budget.

As a result: _Aggregate real GDP fell by 27% while nominal GDP continued to fall quarter-in-quarter-out for 18 quarters non-stop to this day; Unemployment skyrocketed to 27%; Undeclared labour reached 34%; Banks are labouring under non-performing loans that exceed 40% in value, Public debt has exceeded 180% of GDP; Young well-qualified people are abandoning Greece in droves; Poverty, hunger and energy deprivation have registered increases usually associated with a state at war; Investment in productive capacity has evaporated; young workers in several chain stores get fired as they approach their 24th birthday so that the employer hires younger workers in their place to avoid paying them the normal minimum wage which is lower for employees under the age of 24; employees are hired part time for 300 euros (340USD) a month, made to work full time and threatened with dismissal if they complain; Around 1 million families survive on the meagre pension of a grandfather or a grandmother as the rest of the family members are unemployed in a country where only 9% of the unemployed receive any unemployment benefit._ ... and I didn't summarize the whole article, this is only about 10% of it!

Overall it looks like the entire population is suffering, no sane young person will stay in the country, and the population are essentially being forcibly reverted to a permanent state of debt-slavery. Not sure about anyone else, but to me it sounds like it is time to cleanse the temple - [https://en.wikipedia.org/wiki/Jesus_and_the_money_changers](https://en.wikipedia.org/wiki/Jesus_and_the_money_changers) \- and default. If the state changes its name and all of its banks go under (perhaps bar one for a kickstart), it might be enough to hammer in to the minds of the rest of the Eurozone that yes, an economically failed state is not the same as its successor. The corporate world allows this to happen: it should be allowed to happen for nations. After all, it's hardly fair for a child to be born in to the world eternally cursed under the labour of a debt which, frankly, the lender(s) made in error. There is risk in money lending, as there is in borrowing, and at this juncture it's immoral to extract anything more from a victim who has already declared bankruptcy and offered up their firstborn.

<comment><USER17> Do not confuse correlation with causation. High on cheap loans, the Greek economy had a helluva party until 2008, and they were going to have a _really_ bad hangover no matter what. There are some pretty epic stories of the corruption of the era: [http://www.theguardian.com/business/2010/may/07/greek- debt-c...](http://www.theguardian.com/business/2010/may/07/greek-debt-crisis- jobs)

Has austerity made things worse in the short term? Almost certainly, and they've cut plenty of meat along with the fat. But there's no way Greece can pick itself up off the floor without some pretty painful reforms.

<comment><USER16> While I don't disagree, your comment is conservative and therefore uninteresting in that it is conceived and reasoned within the bounds of the de-facto international system, with all its well known problems. Problems we have to try to solve anyway. Greece is in a place that could meaningfully try something new, right away.

<comment><USER15> > Greece is in a place that could meaningfully try something new, right away.

Yet, what the Greece wants is more money to keep doing exactly what they were doing before - that didn't work.

What was that Einstein quote again? The definition of...

<comment><USER5> "Yet, what the Greece wants is more money to keep doing exactly what they were doing before - that didn't work."

said a guy on the internet. Then he quoted Einstein.

</comment></comment></comment></comment></comment><comment><USER18> There's a lot of people who seem to feel like the Greeks made their own bed and now they should lie in it. Well, fine, except for a few decades now most of Europe has been in the same bed, the European Common Market. And with the introduction of the Euro everyone gets to share a blanket too. This is not just a problem for Greece, and insisting that Greece should bear all the costs of solving it puts petty moralizing ahead of actually trying to solve the problem for everybody.

</comment><comment><USER19> A lot of money is spent on sustaining Greek economy. Not only by lending money to it, but by EU funds stretching back decades.

This money can be spent in other means: maybe a highway in Estonia or increasing pensions in Slovenia. Unemployment is not high only in Greece - Finland can also use funds to lower its own unemployment. Why would the money be spent on sustaining an early retirement in Greece, instead of adding Balkan countries, for example Albania, Macedonia and Monte Negro, to the European Union?

After support from the EU for such a long time, I believe Greece should be at a point where it can help support development in other countries.

<comment><USER14> The Marshall plan supported the rebuild of Europe after the WWII ("supported" in a much stronger way: it was based on donations, not credit), for a long time. Without that, Europe would have probably needed a longer time to recover - which would have been bad for the world (and particular for the American) economy.

Let's not be naive here: the Americans did this because it was in their interest to do it. Long-term, it payed-out. And we need to learn from them in this regard: it is in the interest of Europe to "invest" in a stabilization of the Euro-area. We need to make clear that for a long-term solution, sacrifices and restructuring is necessary - but those can only go so far.

Greece has done whatever it was able to. They have no more reform margin. Greece is technically bankrupt, and the Euro-area has to bail it out. In three decades time, we will be happy. This is the first serious crisis of the Euro: how we handle it, will define if the Euro has a long-term survival chance - even if it does not mean immediately collapse. Letting go of Greece will destroy the Euro; which is what lots of short-sighted euro-parties (or self- interested outside parties) want, interestingly.

</comment></comment><comment><USER20> I get the feeling that the EU would rather forgive Greek debt than see Greece either leave the EU or suffer a prolonged economic stagnation. Smart people in Greece have probably figured this out, and are possibly just holding out for Germany to come out and say "you know, let's just write of a small fraction of our GDP to put this crisis behind us". Reminds me of the banks that were "too big to fail" after the GFC.

<comment><USER21> And that would, as in the case of the banks, create all kinds of moral hazard issues. Being a Greek, I could potentially feel relieved by an outcome such as the one you describe. Nevertheless, any such solution would be just a painkiller that fails to address the source of the pain. The Eurozone is fundamentally broken so, even if it is painful, I think exiting the Eurozone is the most appropriate action at this stage. How we can work together in Europe to make sure this does not mean we default to our obligations towards other European people is the question. And of course this should be based on an assessment of the debts we took to support indigenous corruption and consumption (which we should be paying) versus the debt of the last five years which has accumulated just to support imported incompetence (as proven by the outcomes) and mostly served as a concealed European banks bail out.

<comment><USER22> The moral hazard argument feels a bit flat considering that

A) Imposing harsh sanctions on Germany to "repay its debts" after WWI was a major factor leading to WWII, and

B) The modern industrialized economies of northern and western Europe owe their start to the Marshall Plan. The loan portions of the plan were eventually repaid, but represented less than 10% of the over $12 _billion_ in aid given.

In historical terms, working with Greece to restructure and actually fix the economic problems would be a financial drop in the bucket compared to the money lavished on rebuilding other European economies within living memory.

<comment><USER23> War reparations aren't debt - they are the plunder of the winning party in a war.

<comment><USER14> You could argue that Greece found itself in war against the financial markets. They share some of the blame (like everybody does in any war), but the markets won, so they could provide reparations for the defeated Greece. As in the Marshall Plan example, it is in the interest of (some) financial market players to ensure that Greece can come back to the table, and specially to ensure that the Euro-area has a long-term prospect.

The analogy may seem stupid, but I say it describes pretty well the world we are leaving in.

</comment></comment></comment></comment></comment><comment><USER24> The Global Europe Anticipation Bulletin Newsletter reports the cumulative dept of the Euro zone with 92.1%, that of the US with 119.4%.

While I am not a fan of the EU, let's see who goes "belly up" first.

<comment><USER14> Well, the US have the dollar (reserve currency) and the bombs going for them, so they can indulge in a lot more recklessness in this regard. We in Europe need to be much more careful.

</comment></comment><comment><USER25> "It would be, I submit to you, a major error to allow such a minuscule difference to cause massive damage to the Eurozone's integrity. "

It seems like this type of language is being used a lot by all sides. It kind of irritates me that Yanis throws this out like he has no responsibility for making up this "miniscule" difference. If the difference really is "miniscule," why isn't it covered in Greece's proposals?

Whether it is Yanis or Juncker, it seems they just use rhetoric to place the burden of making an actual compromise on the other side.

<comment><USER26> > It kind of irritates me that Yanis throws this out like he has no > responsibility for making up this "miniscule" difference. If the difference > really is "miniscule," why isn't it covered in Greece's proposals?

And why are those proposals, like eliminating Greece's very early retirement, only being made now? Greece's average retirement age is purportedly 61, with some people retiring as early as 50. Meanwhile Germany and Spain raised their retirement age to 67 and have discussed 69. It's completely understandable to me that their taxpayers who will work until 67 do not wish to fund these pensions.

It tells me something that Yanis suggests fixing the pension system now in this 11th hour proposal. If Greece was seriously committed to fiscal responsibility, the government would have done this of their own accord long ago, right? By including this as part of the "deal", presumably it will allow the Greek government to say it was "forced" on them, rather than taking responsibility and making a sovereign decision, independent from any new agreements with third parties, to do the right thing and institute policy that will allow their government and pension system to be solvent.

</comment></comment><comment><USER27> The Greeks are complaining that the EU and IMF's terms are unfair, but what's really unfair is that Greece lived beyond its means for years with other people's money and now doesn't want to face reality and tighten its belt under very generous terms. Without the EU and IMF's help, Greece wouldn't even have the luxury of manufacturing these crises every time they blow their previous agreements.

<comment><USER14> They are guilty. They have paid a hefty price. Bail them out, so that they can start again. They will __continue __to pay a hefty price nevertheless - bailing out a country does not magically make them prosper. Your moral sense of justice will not be severely offended, don 't worry.

We will bail them out, or they will default. What is the best option for the Greeks? What is the best option for the Euro-zone? I argue that, for both parties, the best option is to bail them out and keep the Euro-zone alive.

<comment><USER27> They are being bailed out, but they don't like the strings attached. They will never be a prosperous country if they don't reform their bloated public sector and onerous regulations on businesses, particularly those regarding labor. And yet those are the very reforms they refuse to implement.

Without serious reforms, I don't think it's in the EU's interests to prolong this sorry drama.

<comment><USER14> What the Greek are arguing is that those strings attached are not going to make any difference macro-economically speaking, and that they are going to be extremely painful to an already suffering population. Those measures amount to nothing if you compare it with the cost of servicing the debt.

Basically, they are bankrupt. To "end the sorry drama", either you let them fall on their own (out of the euro, maybe out of the EU), or you bail them out.

I think it is in the interest of Europe (and surely of Greece), to bail them out. Even if it on the surface creates so-called moral hazards: nobody really wants to be in the situation of Greece to be bailed out.

There are more aspects to the issue:

\- monetary: the whole world is running on the printing press. The Americans are doing it, big time. Isn't California bankrupt too? Why should Europe not do it? Just restructure the debt, print the money, create a huge investment program and start funding projects in Greece - and other parts in Europe. We will get some inflation long-term, but who cares? Why should Europe be applying a harsh monetary policy while the US is rigging the markets, just because they can?

\- humanitarian: do we really want to have a fallen first-world country in the middle of Europe, with third-world poverty levels? What does that say about our "community"? Can't we help one of our partners, once it has become clear that they can not get out the hole by themselves?

\- reciprocity: parts of Europe have been bailed out in the past (Marshall Plan). Why can't we do it now, when the economy is doing much better, comparatively? You can argue that that was a different situation, and a looong time ago. But crisis happen (luckily) once every so many decades. Now we have a big crisis: let's show that the European project is there in case of trouble too.

\- geopolitical: do we really want the Russian or the Chinese help one of our European partners? Do we really want to tell the world: we do not care about Greece, even if we can help them, while the Russians or the Chinese, with much looser ties to Greece and with a comparatively weaker economy, are willing (thinking on geopolitical interests, of course) to help them? How long will the European project survive if we are not there to help each other whenever a crisis arises?

Greece has to make reforms. Greece __has made __reforms. More reforms are not going to amount to much of anything. Let 's bail them out.

<comment><USER27> How can anyone claim that more reforms won't amount to much?

They've barely reformed at all. The public sector is still bloated and spending too much, the tax burden is much too high, productivity across the economy is dismal, and they refuse to cut welfare programs that they can't afford going forward, let alone with the massive amount of debt they already have.

The Marshall Plan was about building up the western alliance in the aftermath of the most destructive war in history; the US was also trying to counter the USSR's expanding influence. Greece is being bailed out because they spent other people's money so irresponsibly that no one will extend credit to them and they can't afford to service their existing debt. Two very different situations.

<comment><USER14> Well, they are paying around 4% GDP in debt (2.5% real, since some creditors are allowing for a non-service period), which is actually not _that_ much. But they have a huge debt/GDP ratio (around 200%), which has dramatically increased during the crisis, _specially_ during the austerity period imposed by the creditors. So, austerity is not working, there is not much more that can be squeezed, and the Greek worry is that squeezing more public spending will actually further reduce GDP, making the ratios all the worse. A big chunk of the Greek economy is based on public spending now, and lots of people are living off the state, because unemployment has soared. This situation is far from ideal, but what can be done? Sure, you can just force all those people under bridges, but is that in the interest of Greece or Europe?

Faced with that prospect, Greece would leave the Euro, which would be a blow to the Euro-project. We have a terminal patient, and we can help it. With a bit of luck, in a couple of decades it will become a productive member of society again.

The Marshall Plan had a lots of good reasons going for it, and probably some critique too. In the end it proved to be a good solution, which increased prosperity worldwide. It was a political decision. You could have very well argued: "those Germans, they looked for it and they got what they deserve: let them rot", but we didn't, and we are all the better off.

Regarding countering the USSR: as I have argued above, geo-politically the situation is right now very similar. The Greeks are courting the Russians and the Chinese (or the other way around). Do we want to split the European project at the Balkans?

<comment><USER27> I understand your perspective on this, I just think that bailout money should be contingent on measures to make Greece's public sector sustainable. At the very least, that means cutting the deficit so it grows slower than GDP. In the long run, it means fixing Greece's deeper economic issues.

The EU is already being very generous by accepting tax hikes in a lot of areas where Greece should really be implementing spending cuts. But Syriza wants to convert even more of the spending cuts into tax hikes.

The structural reforms are more important. Deregulating professional trades, selling off nationalized industries, easing bureaucratic barriers to business. The problem is that the Greeks have elected an anti-capitalist far-left party, which is fundamentally opposed to the goal of the reforms.

If the EU is going to budge at all, it should be on accepting a longer term deficit reduction plan. They shouldn't budge on the structural reforms.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> Greece shouldn't be in the EU in the first place... They were only admitted into it because the altered numbers about their economy ( it got exposed afterwards)...

Then again, even Belgium ( where i live) has a to high governement debt.. But nothing beats Greece in favor of manipulated / incorrect numbers though.

</comment><comment><USER29> Europe should split somewhere in the middle into two worlds, much like the Americas (which seem to be like a weird blown up model of the old world) - <USER2> Northern part - free and prosperous and forward thinking, and the Southern part - corrupt, criminal and tragically and indulgently self-defeating. Ideally the two should not mix much, as they both seem to find happiness in their own predicament...

<comment><USER14> There are so much things wrong with this trolling comment, that I do not not were to start. Do not feed the troll they say, but I will anyway loose a couple of seconds with you, just by giving you some keywords.

Marshall plan, dollar, Irak, criminal population, TTIP, interest rates, NSA, waterboarding, Guantanamo, ...</comment></comment>


Safe-Linking – Eliminating a 20 year-old malloc() exploit primitive - <AUTHOR> https://research.checkpoint.com/2020/safe-linking-eliminating-a-20-year-old-malloc-exploit-primitive/ <comment><USER2> Blocking 15 out of 16 exploit attempts sounds great, but you have to ask yourself how many shots you get, and since most people don't think "this program crashed: I should never run it ever again", this isn't anywhere near as helpful as it seems. If you crash my webserver, I spawn a new one. You might even already have 16 webservers running right now! If the user clicks a link and their tab crashes, they might hit reload a few times before giving up. If you receive a text message or an email that crashes a parser on your phone, the retry might seriously happen in a tight loop. Like, I hear about this sort of thing being a good idea constantly, but I have never once heard of it actually blocking an attack against any "normal" target (I say "normal", as some super hardened military target might be configured to go into complete lockdown immediately upon a single unexpected event, with a protocol to call in a forensics expert to analyze logs to see if it is safe to restart the service before ending the outage).

<comment><AUTHOR> We can detect corruption in 15/16 times. In our tests, when we didn't detect a corruption, the program still crashed, but without a proper error message. One should remember that the pointer is masked, so an attacker without the secret mask won't be able to control the reveal()ed pointer. And using a garbled pointer won't give the attacker anything useful, and most probably it will crash the target program.

<comment><USER3> Are you saying the technique is effective at preventing a successful attack nearly every time, but that pointer modification are detected (thus logged) 15 out of 16 times?

<comment><AUTHOR> Yes. We have 12 bits masking just the lower page, in addition to more than 10 bit above that. Chances to guess that correctly are VERY slim.

</comment></comment></comment></comment><comment><USER4> Interesting article -- thanks! I see they used the `key ^ P` encoding where the `key` is `L >> PAGESHIFT` to use the ASLR randomized bits from the free list position `L`.

In [mimalloc]([https://github.com/microsoft/mimalloc](https://github.com/microsoft/mimalloc)) we use a similar strategy to protect the free list in secure mode. However, there are some weaknesses associated with using a plain _xor_ -- if the attacker can guess `P` that reveals the key immediately (`P^key^P == key`) or even if there is a read overflow, and the attacker can read multiple encodings, they can xor with each other, say `(P1^key)^(P2^key)` and then we have`(P1^P2)` which may reveal information about the pointers (like alignment).

What we use in _mimalloc_ instead is two keys `key1` and `key2` and encode as `((P^key2)<<<key1)+key1`. Since these operations are not associative, the above approaches do not work so well any more even if the `P` can be guesstimated. For example, for the read case we can subtract two entries to discard the `+key1` term, but that leads to `((P1^key2)<<<key1) - ((P2^key2)<<<key1)` at best. (We include the left-rotation since xor and addition are otherwise linear in the lowest bit).

Just some thoughts. Of course, this may be too much for the use-case. However, we found just little extra overhead for the extra operations (as most programs are dominated by memory access) so it may be of benefit.

</comment><comment><USER5> FreeBSD solved that problem 22 years ago:

[https://papers.freebsd.org/1998/phk- malloc/](https://papers.freebsd.org/1998/phk-malloc/)

(And got better malloc(3) performance at the same time.)

<comment><USER6> Nobody has solved "that problem".

No malloc has absolute detection of all corruption and even tools like Valgrind don't catch everything.

Let's not pretend that a few pointer hacks and checks have solved a problem.

<comment><USER5> The particular problem they boast about having solved,does simply not exist in the malloc(3) I wrote 23 years ago, because it does not have the silly linked list to begin with.

In addition to all the security problems inherent in mingling metadata directly next to user-data, the linked list gives O(Nalloc) performance on free(3) and realloc(3) whereas my malloc had O(1) performance.

That may not seem like a lot, but when the 'O' is a page-in from disk, and Nalloc is from C++ code, it is nothing to sneeze at.

Not only did that make my malloc faster, but it would, not "could", but "would" detect several classes of malloc-usage errors, double-free etc, unconditionally.

Over the next 10-ish years, that practically eliminated entire classes of malloc-mistakes, making a lot of FOSS software safer, no matter which malloc you used it with.

Given the definition of the malloc(3) family API, there is no way you can detect all corruption without hardware support, but there are people working on that too, notably Robert Watsons CHERI project at Cambridge.

So yeah, nice pointer arithmetic, but how about people solved the real problem instead ?

(On big memory and multi-core systems use jemalloc, on small memory and single-core systems use phkmalloc.)

<comment><USER7> That there are entire guides (see below) and even games written on phkmalloc exploitation proves kazinator's point rather than yours.

[1] [http://www.ouah.org/BSD-heap-smashing.txt](http://www.ouah.org/BSD-heap- smashing.txt)

[2] [https://events.ccc.de/congress/2005/fahrplan/attachments/636...](https://events.ccc.de/congress/2005/fahrplan/attachments/636-CCCmallocyy.pdf)

[3] [https://overthewire.org/wargames/vortex/vortex11.html](https://overthewire.org/wargames/vortex/vortex11.html)

[4] [https://www.usenix.org/legacy/events/woot11/tech/final_files...](https://www.usenix.org/legacy/events/woot11/tech/final_files/Novark7-7-11.pdf)

<comment><USER5> No ?

The only problem OP has solved is detecting overwriting of metadata inadvisably comingled with the user data.

That problem does simply not exist in phkmalloc, or jemalloc for that matter, writing past the end or before the beginning of an allocation does not _automatically_ give you the ability to violate the internal integrity of the malloc implementation.

If you actually read the first link you pasted carefully, you will see what an amazing tour-de-force it was to exploit CVE-2003-0015, which was a run-of-the- mill double-free mistake in CVS.

As I remember it, there were proof-of-concept exploits against list-based mallocs in a matter of days, it took months before bbp's article appeared.

When I wrote phkmalloc, most of the exploitable malloc-related problems were usage problems, double frees, freeing modified pointers, writing past start or end of allocation etc.

If you had seen my presentation in New Orleans 1998, you would undoubtedly remember my handwritten slide with around 20 setuid programs phkmalloc had found issues in within the first year.

That is the primary reason why there are so few malloc(3) related exploits these days: phkmalloc and later jemalloc complained about them.

Those are mistakes which list-based mallocs do not find, because it is too expensive to walk the list all the time, and on top of that, they run slower, because the list is O(n)!

There is neither a reason, nor an excuse for using a list-based malloc in this day and age.

Neither OP nor I claim to have solved the "big" malloc problem, because, as I already explained: That takes hardware support.

</comment></comment></comment></comment></comment><comment><USER8> I was initially surprised at their benchmark results, until I read more closely and noticed that they were benchmarking on a cloud VM. I wish people wouldn't do this for this form of test - it adds so many variables it's hard to take their benchmark too seriously.

<comment><AUTHOR> We executed the benchmark suite multiple times, and results were consistent. It was way more stable than the same execution on a PC with multiple programs. Anyway, the maintainers of glibc performed the same checks and confirmed our measurements.

<comment><USER9> Thumbs up with reaching out to upstream to mainline it.

Did you talk to musl team as well?

<comment><AUTHOR> Not yet. Working with each open-source demanded a lot of effort, so we were hoping that integrating it into a few dominant libraries will attract the attention of the rest. We will happily assist them if they need/want our help.

<comment><USER10> The musl mailing list is very active, and communication with the maintainers is generally effortless. It would be interesting to see how this plays out. They are also in the process of rewriting their malloc implementation.

Thank you for your work!

<comment><USER11> And musl is just working in merging its new mallocng.

</comment></comment></comment></comment></comment></comment><comment><USER12> Does this apply to jemalloc?

<comment><AUTHOR> While ptmalloc/dlmalloc/tcmalloc use a single-linked list meta-data that is stored adjacent to the user buffers, in jemalloc there is no such meta-data. jemalloc's design stores the sensitive meta-data separately, thus removing the need to add a dedicated protection layer for it.

</comment></comment><comment><USER6> This is a crude, unreliable debugging aid being trotted out as a security enhancement.

<comment><USER13> So you'd be opposed to merging this change upstream?

<comment><USER6> Yes; it wastes machine cycles.</comment></comment></comment>


Dieter Rams: Principles for good design - <AUTHOR> https://www.vitsoe.com/us/about/good-design

<comment><USER2> This is terrible blog material because it's not something you can digest in five minutes or copy and use on your own startup.

But if you can take the time to figure out what he means you can use it to help judge your own creations and see where they are lacking.

<comment><USER3> In other words... it wasn't designed very well...?

<comment><USER2> I'm not sure it was designed to be blog material. There's a fundamental difference between "A LIST OF 10 FUNNY CAT PICTURES" and "Internalize these 10 ideas to not suck as a designer"

<comment><AUTHOR> Well said. This article is meant to be useful, and act as a simple reference while designing your own products. And they are based on Dieter Ram's years of experience as a designer.

Just because, it's simple doesn't mean it's not valuable. The best experts I know make things as simple as they possibly can.

</comment></comment></comment></comment><comment><USER4> #1 Good design is innovative

I'm sure there is plenty of good design that is not innovative. In fact, there is lots of value in sticking with what is familiar to the user, i.e. avoid innovation.

<comment><USER5> Just because it's innovative doesn't mean it's non-intuitive or difficult to use.

A few of the other points reinforce exactly that, such as:

#4 Good design makes a product understandable

#10 Good design is as little design as possible

The fact Dieter stripped out the inessential aspects and frivolous features, focused on the intended function and made simple products aesthetically pleasing was innovative at the time. And still would be today for most consumer electronics.

</comment></comment><comment><USER6> This is a clip from the documentary Objectified with Dieter Rams discussing this.

<https://www.youtube.com/watch?v=ahtHKCQUD2k></comment>


No-Code vs. Pro-Code: A New Hope - <AUTHOR> https://journeyapps.com/engineering-blog/no-code-vs-pro-code-a-new-hope/ <comment><USER2> I'm currently in the process of converting a no code product to "pro code" per their definition, and I agree with their intentions here.

Many of these efforts in the past (including the team I'm on) lump opinionated libraries in with what I call secondary programming languages.

Opinionated libraries can save everyone a lot of time, as long as they are programmable and allow easy access to levels below, as well as further abstraction upwards. Throwing a new programming language into the mix interferes with abstraction traversal and stack traces in a devastating way.

<comment><USER3> There is a huge advantage to using an existing language (JavaScript/TypeScript) like this, compared to creating new DSLs. There is simply such a big ecosystem to leverage in terms of development tooling (auto- complete etc), existing libraries and existing libraries.

</comment></comment><comment><USER4> We have been using Journey's platform for years. We use it across multiple countries and tens of thousands of users. I can't recommend them enough.

</comment><comment><USER5> Firm agreement about the goals! Over at Dark ([https://darklang.com](https://darklang.com)), we've been referring to the space adjacent to Low/No-code as "Just code", to indicate that there's only code there and nothing else. Would be curious what other languages/frameworks the JourneyApps folks would include in "Pro-code"?

<comment><USER6> Good question and we also resonate with "Just code".

OXIDE at its core is built on-top of a radically new framework we architected called Reactor which allows us to build desktop-grade software in the web (such as OXIDE), which we then used to craft the ultimate experience for the Journey ecosystem.

Apps built on Journey are currently developed using Javascript or Typescript but because of the highly modular nature of our tools and platform, we are going to start supporting more languages in the near future.

</comment></comment><comment><USER7> I wonder if you are familiar with the predictive databases?

We at Aito.ai have gotten lot of interest from different RPA/no-node users and providers, and predictive database queries seem like a best intelligent automation.

[https://aito.ai/blog/could-predictive-database-queries- repla...](https://aito.ai/blog/could-predictive-database-queries-replace- machine-learning-models/)

It would be interesting to deeply integrate predictive functionality in your system, especially as it integrates a DB naturally. This could be used to offer predictive functionality from the plarform out of the box.

</comment><comment><USER8> IMHO if you want to attract no-code users you need to change your site branding. It's very 'engineerish' aka probably fine for the crowd on HN but not on Indie Hackers. Look at Webflow/Airtable/Zapier and take inspiration. You're going to have a hard time resonating with that crowd. They like bright colors.

<comment><AUTHOR> Thanks for the feedback! We are focused on software engineers rather than no- code users.

<comment><USER8> gotcha - best of luck!

</comment></comment></comment><comment><USER6> Hi I'm one of the architects behind OXIDE. Feel free to AMA

<comment><USER9> I'm a bit confused here. The article starts out talking about no-code software development and the advantages and limits of no-code software, then lays out a bunch of principals including things like using an OSS stack. Then at the very bottom drops what looks like a complicated TS development IDE with some bolt on tools (which appear to be for-fee/ non-OSS).

Who is the target market for this? What kind of app would I write with it? Since Could I build up an OXIDE stack myself and make some apps for my friends?

About the only use-case I can see here is enterprise app development and personally, I think tying yourself to a vendor Platform-as-a-Service solution like this is a bit fraught.

<comment><USER6> Hi there! So OXIDE is interesting in that it has what we believe are the best of the typical low-code tools, but integrated in a way that the developer can easily transition to and fro into typical pro-code development. The screenshot on the homepage shows a plethora of the various tools and features that OXIDE has, but the IDE can easily be configured for low-code or pro-code development independently. Out of the box we provide some default workspaces that cater for the typical paradigms of software development on our platform, which are not as complex as in the screenshot.

Regarding the OSS, we deeply integrate it into the IDE effectively removing most of the configuration and complexity required to make it all work well together.

</comment></comment></comment><comment><USER10> Obligatory: Can you hook it up to GPT-3 and an email address, so a client can just email in a feature request and get it added automatically?</comment>


Timing data comparing CClasp to C++, SBCL and Python - <AUTHOR> https://drmeister.wordpress.com/2015/07/30/timing-data-comparing-cclasp-to-c-sbcl-and-python/ <comment><USER3> People are missing the point with the Python code. The C++ code and the Lisp code aren't particularly optimized, either. The point of the benchmark is to compare the relative speeds of roughly the same Fibonacci code out of the box.

On SBCL, a memoized recursive fibonacci is about twice as fast as the Lisp code given also running in SBCL on my machine, for example.

I'm more suspicious about why the C++ code is so slow.

Edit: I wrote my own C++ Fib code and tried benchmarking it outside of Clasp ([https://gist.github.com/jl2/4d74958b02b3caea2f5c](https://gist.github.com/jl2/4d74958b02b3caea2f5c)). It routinely ran in less than 0.005 seconds, which seemed too fast, so I looked at the assembly output. AFAICT, the compiler is smart enough to realize fib() has no side effects and is "pure", and is computing the value at compile time, reducing the function call to essentially be myfib = 8944394323791464. It almost seems like an unfair comparison, but since it's comparing compiler performance, I think it's relevant information.

<comment><USER4> Thank you, you summed it up better than I could.

</comment></comment><comment><USER5> I was a bit curious, so I did a short experiment:

[http://nbviewer.ipython.org/urls/dl.dropbox.com/s/l9naqibqyt...](http://nbviewer.ipython.org/urls/dl.dropbox.com/s/l9naqibqytv8vjt/Numba_Fib.ipynb)

Using numba, and adding a one line decorator to the function (without any changes whatsoever) we get around 2 orders of magnitude speed up.

Note - this doesn't involve any fancy re-writing, annotating, etc, you literally just add a decorator.

Writing really fast numerical code in Python is very easy. There's absolutely no reason not to use numba if you have small functions that just do number crunching. numba can even inline other numba functions - so you don't even pay the function call overhead.

<comment><USER6> I love numba, but I am never successful at compiling it.

Using the Anaconda distribution results in some issues as that distribution is not compatible with some other libraries and requires installing everything through conda.

Most packages use Cython for this reason instead.

<comment><USER7> I failed to get numba installed on a Raspberry Pi 2, and I'd been wanting to try Nim, which turned out to be easy to compile on the RPi running Ubuntu.

      nim -r -d:release c rw_fibn.nim
      ...

      Hint: operation successful (12152 lines compiled; 2.632 sec total; 8.870MB; Release Build) [SuccessX]
      /home/rw/git/Nim/examples/rw_fibn

      Result = 8944394323791464
      elapsed time: 5.376946926116943

My first try at translating Python to Nim:

$ cat rw_fibn.nim

      import times

      proc fibn(reps: int64, num: int): int64 =
        var z: int64
        for r in 1..reps:
          var
            p1, p2: int64 = 1
            rnum: int = num - <USER2>
          for i in 1..rnum:
            z = p1 + p2
            p2 = p1
            p1 = z

        return z

      var start: float = times.epochTime()
      var res = fibn(10_000_000, 78)
      var finish: float = times.epochTime()

      echo("Result = ", res)
      echo("elapsed time: ", finish - start)

</comment></comment></comment><comment><USER8> In Python 2.7, shouldn't you be using xrange() rather than range()? xrange() is a generator whereas range() will actually create the entire list and iterate it.

In case anyone isn't aware: in Python 3, range()'s implementation was effectively replaced with that of xrange().

<comment><USER9> For me, range (the posted source) took 95 seconds, and xrange was only a little better at 85 seconds.

I think most of the benefit of xrange comes from the decreased memory usage, not from lower CPU usage. But xrange is definitely closer to what the other code is doing.

<comment><USER10> that's almost a 10% improvement- not just a little better!

</comment></comment></comment><comment><USER11> CClasp is looking really, really interesting. I'm still enjoy SBCL, but on the right project—why not try CClasp?

</comment><comment><USER12> Cython would make sense in this context (~19 seconds for me).

<comment><USER13> >>would make sense in this context<<

Not really -- _" I don't want to start an argument about the speed of SBCL vs C++ here, my point is that CClasp has come a long way from being hundreds of times slower than C++ to within a factor of 4."_

<comment><USER12> I meant only that Cython results would tell me more about relative CClasp performance than a comparison CPython does.

I didn't want to get into the optimization game either, but I'm happy someone here reminded me to try numba.</comment></comment></comment>


You will fail - <AUTHOR> http://www.whattofix.com/blog/archives/2010/01/you-will-fail.php

<comment><USER7> Since I'm mentioned in the post I'll put my $0.02 in the bag here.

The you'll probably fail comment was meant as a reality check because I think that the commercial success of that particular project is doubtful, even if the project itself is a success in terms of execution and use.

Simply because it targets a niche. But I'm really happy Daniel bit the bullet and built it because I think it is a useful thing to have.

The 'Failure is not an option' mentality that some seem to bring to the start- up scene always has me in stitches, because it is really terribly naive to think that somehow you are different and bullet proof. After a couple of failures you begin to get the hang of how to avoid failure in the ways that you've already seen before, and you find new, interesting ways to fail.

But everytime you 'fail', you also simultaneously succeed, you succeed in learning, in educating yourself. Three failed start-ups is probably the equivalent of a badge of merit and positions you very well for a possible success the fourth or the fifth time. It's not _just_ luck, it is a combination of a lot of factors:

      - <USER2>

      - <USER3>

      - <USER4>

      - <USER5>

      - <USER6>

      - interaction with customers / audience

      - market development

All those have to go your way to hit one out of the park. But at the same time you could be defining success as for instance building a site that attracts more than 'x' visitors per day, or being ramen profitable, or being able to live comfortably of your product.

If I look back across the years my own score is a mixed bag:

      - successful consultancy business

      - successful license business

      - homerun on the webcam stuff

      - a string of 'moderately successful' (as in lots of
        users but not much $)

      - two major losses

      - a string of failures, most of them small ideas
        worked out over a period of days, weeks or months.

If you're not prepared to 'take your lumps' the success will also never be yours, so plan ahead, know that if you start a project you can skew the odds a bit in your favor by manipulating those factors that are directly under your control and if you fail make sure you get the maximum mileage of your 'failure' in terms of study points.

Then try again, with the odds more in your favor because of your increased knowledge. One day you _will_ succeed.

<comment><AUTHOR> Sorry JacquesM -- didn't mean to "out" you. After all, I left off the M!

As usual, you are dead-on target with your comments.

You are also going to owe me dinner for your prediction it won't be a commercial success. Once it is, we're going to sit down and have a nice meal of roasted crow prepared for you to eat :)

<comment><USER7> You're on ;)

The crow will taste really good, because I really hope that it will work out. Whoever modded you down needs to get a sense of humor installed, or their current one fixed.

</comment></comment></comment><comment><USER8> I had the opportunity to recently watch an Akira Kurosawa film called Ikiru. A beautiful, not overly sentimental film about what someone can do with their life once they are determined to make something with it. Reading this article saddens me because it's positioning failure as an inevitability - but what is really failure? Isn't failure just part of the learning curve?

As someone wiser than me said, it's:

        you -> failure -> failure -> success

        not

        failure <- you -> success

<comment><USER9> Agree, and failure is such a strong word:

Did Guttemberg failed because he spend all his life trying to make a mobile types print and he died poor?

Did facebook founders failed because their original idea didn't catch? Or the flickr people? or the Photoshop creator? or Googleearth inventor?.

Did Edison failed with every new light bulb he tried and burn?. The rocket engineers when some of their rockets exploded?

Stop calling it "failures", they are opportunities.

</comment></comment><comment><USER10> I get what you're trying to say: be prepared for failure, don't take it too hard, and if you're really interested in this kind of stuff, then try again.

But: I think that this attitude is one of the things that separates the lucky entrepreneurs from the skilled entrepreneurs. As difficult as a small business can be, the attitude that failure is acceptable can mean the difference between giving up (and moving on to the next idea) or pushing on and actually becoming successful.

Others have said this better, but basically, I'd rather bet on the founders and businesses that refuse to fail.

<comment><USER11> The problem is that success has many different definitions, and to succeed at one of them, you often have to fail at several others.

For example, say that an entrepreneur has this burning idea for a revolutionary new MMORPG, one based around social interaction instead of hack 'n slash. They find out that very few people _care_ , but in the course of building it, they end up building an easy way to share photos online. Should they keep pushing through with their original idea and refuse to fail? Or should they admit that their original idea was kinda useless and go with what people actually want?

This happens over and over again. The podcasting company that realizes their product is lame and invents a way to broadcast 140-character messages by SMS. The server-side JavaScript framework that nobody uses who decides to build a collaborative editing app on top of it. The guys who wanted to put art galleries online, then discover that art galleries don't want to _be_ online and so branch out into general online stores. The HotOrNot clone that compares Harvard students with barnyard animals, then gets busted by the administration and becomes a social network instead.

Problem is that it's not usually possible to tell, a priori, which ideas deserve to fail and which ones will succeed given a bit more effort. Imagine if someone had told Larry Page that his idea to crawl the web and look at the link structure was stupid, and he'd be much better off with a web portal. And that's why entrepreneurship is hard.

<comment><USER10> I agree with everything you say, but I didn't get the sense that the original article was about iteration.

<comment><AUTHOR> It wasn't. It was just about being able to accept that whatever idea you started out with either is going to fizzle or "evolve" so much that you can't be thinking that one idea will somehow get you through. Instead be prepared to have several ideas, perhaps in many different fields.

People like telling the story of the team who started going one way and ended up somewhere else, successfully, because it conforms to their idea that some kind of attribute must be a discriminating factor (in this case the team is that factor). But I simply don't know if that's a true statement or not. I'd bet that many times it's just a dice roll whether team X can handle as many pivots that are necessary to make it all in one go. That's from my observations of lots of teams, but it's just a guess.

GP hit the nail on the head: good entrepreneurship means knowing when to hang on and when to iterate. And there are no books for that one.

I think that because our brains love order, and because we're always trying to put order on everything we see even if it's not there, we take lots of cognitive leaps to build some kind of mental model on "what it takes to succeed". With the "great teams succeed" model, the brain has a field day because selection bias and circular reasoning is in full-force. Whatever your model is, however, it should include the role of chance or you're likely to be really disappointed. And life is too short to get so distraught over the part that chance takes in getting started.

</comment></comment></comment></comment><comment><USER12> I'm unmoved by the statement "Most start-ups fail", or "Most X fail/suck" for any X. Why should a bunch of people failing deter you, or make you think you are going to fail? Yes, doing a start-up means applying your personal resources in order to succeed where others have failed. So does publishing a successful book or song, or winning a medal in the Olympics, or succeeding at any "venture" or uncertain quest in life or trying to achieve any special recognition.

Is succeeding luck or skill? The article basically claims it's all luck in the case of a start-up. This is a terrible attitude for anything involving skill! Successful people are often those who had confidence in their ability and applied themselves ruthlessly.

What limits a competitor in the Olympics, their own ability or capacity to train, or the other competitors who will determine their rank? What limits a book's success, the skill of the author, or the fickle market? The more you understand the market, of course, the more you take what would otherwise be luck and turn it into an opportunity for skill. And if you know what kinds of scores you're competing against in the Olympics and have a sense of your own ability, competing in the Olympics is hardly a foolish idea.

Different Olympic sports provide different kinds of competition. For sprinting, good genetics may give you a strong leg up. For figure skating, your confidence, grace, ability to function under pressure, and hours of training will make you a star.

For start-ups in particular, it's ultimately quite silly to chock everything up to luck. A tech start-up is just good engineering plus good business (and marketing, design, etc.). If you focus just on the engineering, I'm sure it can feel like bad luck when a competitor overtakes you, and likewise if you focus on just the business side in an area requiring strong engineering. But put it all together and it's definitely something one can get good at.

That said, the knowledge and ability to "keep trying" is an asset in itself, so more power to the author. Fortunately, there is much to learn and much skill to develop!

<comment><AUTHOR> _The article basically claims it's all luck in the case of a start-up_

Er no it doesn't. I wrote it.

The point is that knowledge and skills are incremental, not pivotal. Startups are like baseball -- you play the numbers. Every time-at-bat isn't a home run, no matter how many skills you have. But if you take that to mean you shouldn't work on your batting skill then you've read something in there that I never intended.

</comment></comment><comment><USER13> Not caring about failing is a better attitude than thinking that you probably will fail. People who are obsessed with failure or success aren't focused on the right thing. What matters is that you build something that people want to use.

That's all. No more stupid mantras.

</comment><comment><USER14> You have to succeed.

From the moment you're born, odds are stacked against you, chances of getting born in a industrialized country is 20%, of being intelligent enough to read (or care about) this is <1%, to not fail education it's 80%, to get hired somewhere is 0.3-3% (per application), to not get fired or be unemployed is 80%... To not toil at a J.O.B. = Just Over Broke is 40% and so on...

And your startup isn't just some bakery store or corner drug-store as is also included in some government statistics.

So go ahead and succeed!

</comment><comment><USER15> You only fail if you give up. Your first iteration will most likely fail because you don't have enough experience to know what works. If you can quickly and objectively identify what doesn't work, get rid of it, and try something else, then you'll only fail a little bit (but who cares). It's not over until it's over. By the way when I say "try something new," I could mean the color of a button, or the whole idea.

</comment><comment><USER16> The article reminds me of a Go proverb: "Lose your first fifty games as soon as possible." ([http://senseis.xmp.net/?LoseYourFirst50GamesAsQuicklyAsPossi...](http://senseis.xmp.net/?LoseYourFirst50GamesAsQuicklyAsPossible))</comment>


Why being the latency monkey makes you want to shoot yourself - <AUTHOR> http://telepatch.blogspot.com/2008/04/why-being-latency-monkey-makes-you-want.html

<comment><USER2> This title triggered a fairly intense repressed memory here. Something about Quake, telephone modems, and grenade launchers...

</comment><comment><USER3> I prefer the term, speed semian</comment>