A strong math bg necessary for computer scientists?(CS professors' perspective) - <AUTHOR> http://ocirs.com/2011/03/11/computer-science-education-and-math/

<comment><USER2> Urgh.

I personally think one of the underlying tenets of his argument is false -- there is NO ambiguity over what Computer Science is, at least not in the way that he's suggesting. CS is and should be an academic pursuit coupled with a strong mathematical background. CS is about understanding the underlying principles of the what, why and how of computation. A couple of kids from Stanford didn't create Google because they blindly hacked something together. Seriously, check out their paper on PageRank.

A well-understood analogy is the difference between physics and mechanical engineering: the physicist seeks to advance knowledge of the principles that govern our universe, the ME applies that knowledge in practical applications.

A direct comparison should be drawn between Computer Science and Software Engineering.

I've always maintained that students solely interested in learning how to program should be enrolled in a Software Engineering associate's degree program, not 4-year Computer Science. It would be a practical rather than theoretical education.

<comment><USER2> s/his argument/the Academic\/Applied dichotomy/

I noticed that he doesn't really present the argument as his own, just reporting what he's seeing.

<comment><AUTHOR> Hey OP here,

Just wanted to point out that it was my original intention to express a more nuanced view regarding the role of math in computer science both in industry and academia but decide to save that for another day after I realized the professors' arguments were very interesting on their own and that they deserve to stand on their own.

Part of the reason I went through such great lengths to analyze the multitude of arguments from the entire thread was to point out that they were missing the bigger picture, which I'm hoping to discuss in a later post.

Also wanted to point out that top U.S. universities do not offer associate degrees in software engineering, in most cases it's a course or two lumped under cs; if you want to go in to software engineering you must go through the cs curriculum that is related/implied by my last point where the professors were concerned that just the image of computer science as a mathy subject scare students away from participating in the computing industry.

</comment></comment></comment><comment><USER3> You may be able to code some stuff without math. However, you need math for a lot of computer science, computer engineering, and programming.

If you want to do 3d animation or vector graphics, you really need to know vector calculus. If you want to work with a codec, or do video processing, you need math for the encoding algorithm. Analytics are useful for a lot of things. It helps if you understand the standard deviation, and such. Encryption and hashing algorithms use a lot of math.

Have you tried programming in Scala? Have you used generic functions? A lot of this stuff ties back into Abstract Algebra.

I haven't started with talking about discrete math. Are you going to literate enough to understand the difference between a hash-table and a b-tree?

I think it is a lot easier to teach yourself to code, than to teach yourself math. Thus, universities should focus on teaching math. If you know math and some basic programming, you should be able to learn the rest by reading the coderature of good open source projects.

<comment><AUTHOR> Definitely agree with you regarding the fact that math is used extensively in many projects but just wanted to point out that the math is very different for 3d animation vs video processing and only a very small subset of software engineers or computer scientists will every need to know it.

I am able to fully understand the uses of and apply hash tables, btrees, kd- trees or any data structure. Ex. although I can't prove to you the correctness or to create a good hash function that still doesn't prevent me from understanding basic concepts such as hash collisions due to excessive entries or the look up speed O(1) of hash vs O(log(n)) for btrees. On the other hand, if I actually were to implement search for a project I would just use MySQL(I don't need to understand set theory at all to be able to write efficient queries with a firm understanding of the role of indexes).

Never tried programing in scala, but I have no problems with functional programming concepts like map/reduce(currently doing a lot of new projects in couchdb because I think its more interesting to writing sql queries).

I also would like to point out that none of the example you gave require calculus, which was the requirement that I found to be a bit ridiculous and all of your examples involve very different branches of mathematics with very little overlap and most computer algorithms can be applied to great effect without a perfect understanding of the mathematical foundation or proof of correctness. At what point do you stop and ask whether you are teaching too much math and not enough computer science?

I would agree that its easy to pickup how to code but nearly impossible to become a good coder on your own without criticisms and feedback from others. The quality of code I've read some really atrocious code from cs graduate students or engineers all of whom have a extremely good understanding of math. And I would also argue that it is very unrealistic to expect someone to download and read tens and thousands of lines of open source code and hop on IRC to discuss why things were done certain ways with the maintainers. I would also argue that a firm understanding in math does not mean that you can just get map/reduce, MVC, design patterns, web services, distributed computing, multi-threading, event driven programming and many more fundamental concepts that programmers now a days need a firm understanding of to do anything significant.

<comment><USER3> If you want any sort of physics in your 3d, you pretty much gotta know some calculus. You need calculus to understand acceleration, gravity, etc. Statistics also uses calculus. For example, the normal distribution, is \integral{e^(x^2)}. If you want to do any A/B testing, regressions, machine learning, etc. you will need it.

Map/reduce comes out of algebra. Is your operator associative? If not, you better be careful how you map-reduce algorithm executes. If you don't understand, associativity and your operator isn't associative, it can cause problems.

Finite state machines are important too. It can be really hard to write a parser, if you don't understand FSM. I suppose that ties in with design patterns.

If you can write a good proof, I don't see how can be that terrible of a programmer. How many CS graduates do you know, who can write a good proof, and aren't good programmers?</comment></comment></comment>


I spent 21 years in prison for a murder I didn't commit.  [Reddit AMA] - <AUTHOR> https://www.reddit.com/r/IAmA/comments/6uaklk/i_spent_21_years_in_prison_for_a_murder_i_didnt/ <comment><USER2> "Since we can never know anything for sure, it is simply not worth searching for certainty; but it is well worth searching for truth; and we do this chiefly by searching for mistakes, so that we have to correct them."

The injustices done by a jury of peers who are certain beyond reasonable doubt can be seen from Christ's trial under Pilot clear through the Salem witch trials and into the present day. What's newer is the incentivized nature of the American criminal justice system. Until people are educated enough to be aware of their own fallibility and psychological biases, and the fallacies inherent in human cognition more generally such instances of state sponsored injustice will continue. I shudder when I hear calls to always believe the victim, not because victims do not deserve justice, but because injustice done by the state, legitimized by a jury of peers, is nothing more than tyranny.

<comment><USER3> so should we make it mandatory for jurors to undergo training? maybe make it a career?

<comment><USER4> I would definitely say make jurors go through training and pay them more; a lot more. The more expensive for the state to prosecute someone, the better.

<comment><USER5> Why would it be better for it to be more expensive to prosecute someone? The point of laws is that we'd like to see them enforced. If the people don't like the laws they should change them not try to cripple their government's ability to do its job.

<comment><USER4> "That it is better 100 guilty Persons should escape than that one innocent Person should suffer, is a Maxim that has been long and generally approved."

-Franklin

</comment></comment></comment></comment></comment><comment><USER6> Also relevant: In 1989, Donald Trump, a private NYC citizen at the time, bought a full page newspaper ad to prosecute five young boys in the court of public opinion[1].

They were later exonerated from the Central Park Jogger rape and assault and won a large civil case for malicious prosecution. Trump, proven wrong in a court of law, denied that they were innocent and "he refused to acknowledge the Central Park Five's innocence and stated that their convictions should never have been vacated."

[1] [https://en.wikipedia.org/wiki/Central_Park_jogger_case#Accus...](https://en.wikipedia.org/wiki/Central_Park_jogger_case#Accusations_by_Donald_Trump)

</comment><comment><USER4> I'm horrified by police and the justice system. I don't see them as protective, I see them as someone in the USSR would see their police.

<comment><USER6> s/justice/legal/

I have similar feelings, but I don't see the US and the USSR legal systems as remotely similar.

The US system requires a much greater amount of complicity and culpability of citizens and elected officials. We, the citizens, are completely culpable for the entire system. Our elected representatives (for whom we are responsible for curtailing) have given police+prosecutors:

* far too many tools+laws to invade our liberties, * detain us with insufficient evidence, * interrogate us with mentally coercive techniques, * provide a massive asymmetry to legal information, * allow the poorest of us to rot in jail awaiting trial * incentivize those charged with crimes to settle pre-trial 98% of the time * too much credibility in the mind of juries

and governments underfund the public defender's offices to the point that they are essentially just a tool of the prosecution to help make plea deals faster.

<comment><USER4> I agree with everything you've said about problems with the justice system, but I've never been given the option to vote otherwise, state or local. Both parties are happy with this way of doing justice. Until we get a viable third party, this will never change. The two parties we have now made it awful difficult to get a third viable party.

We may be responsible for curtailing them, but we have no ability to do so. It's great in theory, but in current day practice, we can't do much about it.

</comment></comment></comment><comment><USER7> I saw the screening of the movie about his story, "Crown Heights". It's a must see.</comment>


NPM: 429 Too Many Requests - <AUTHOR> https://github.com/npm/cli/issues/836 <comment><USER2> This seems to be slowly clearing up.

Regardless, can we talk about the conduct in this GitHub thread? I know every community is different but is it common to have memes and jokes posted this quickly and often in a GitHub issue? It makes it really hard to follow and discourages genuinely useful discussion of workarounds or progress.

<comment><USER3> Some people getting in the workforce in the last few years have troubles making the distinction between work and play contexts. It's extremely visible on github, slack, &c. which are more and more looking like discord / reddit (gifs, memes, random jokes in the middle of serious discussions)

<comment><USER4> You say it like it's a bad thing? It's possible to be both professional and have some fun (not talking about the linked GH).

<comment><USER5> I mean there is a difference between having fun and conducting yourself in a professional manner where appropriate.

With the increase in adoption of certain technologies (node etc) I have noticed a relationship with the people employed to work with them and their poor level of professionalism in the workplace with regard to their work and how they deal with other people (in the UK) and even how they dress. Similar age groups in other areas don't display these traits.

A number of these people work as contractors as well, so at least it was easy to get rid of them.

Go post memes on the LKML and see what happens

<comment><USER6> > [..] and even how they dress.

While there are many points in your post that I agree with, we really should stop worrying about how people dress.

If it's a developer sitting behind a computer screen all day long with zero customer contact whatsoever, he really shouldn't be forced to wear a certain dress code just to satisfy someone's standard of professionalism. Such feelings are in similar spirit as "woman should not wear trousers" a few decades ago - there is just no rationale behind it other than conditioning by society.

<comment><USER7> > conditioning by society.

There is a limit. I'm sure you have one too if you really think about it. Is it tattoos all over the face? What about sandals? Or shorts? Or going bare- feet around the office.

I don't know... It's about people giving me money for work. I don't feel like I can go to work dressed like any given Sunday.

<comment><USER8> > I don't feel like I can go to work dressed like any given Sunday.

And why not? As you said: they are giving us money... for work. Not for playing dressing up.

If they expect otherwise, they should be clear about it up front and give a good reason to give up on that freedom while we work for them.

<comment><USER7> > And why not?

To me (and of course, it's a personal opinion) it shows that someone cares. It's like when you do your resume, you want it clean and presentable, without typos, to show that you care.

We all like good user interfaces and experiences in our programs. To me, the _look_ is like the presentation layer of our own UX. Is it required for our work? Most of the times it is not, because our work depends on the _logic layers_ , but it doesn't hurt to have a nice presentation layer.

And I'm not telling about going to work in a D&G suit.

EDIT: and I'm not telling that I would discriminate or think right away that someone doesn't care! I don't do that. My attitude about good looking is mono- directional; from me towards others.

<comment><USER8> Well, to me, people care by showing up on time.

They care by solving problems.

They care by being there when the team needs them.

They care by being honest, authentic and candid.

They care by making things simpler and smoother for themselves and those around them.

They care by striving to avoid office politics and back stabbing.

They care by being the team mate we all wish we had and strive to be.

They care making our common working space a place we are all eager to come to in the morning.

And I would pick a reliable, self-aware, well-rounded, face tattooed, green haired and barefoot colleague that's comfortable in their own skin any day, over any well-dressed, high maintenance, drama king / queen.

What's interesting though, is that even knowing, and thinking that, I couldn't help but be spontaneously biased towards he or she who made the so-called effort of dressing to look the part. And that's a problem.

Also, I am nowhere near being that ideal team mate. More like a work in progress >.<'

<comment><USER7> > biased towards he or she who made the so-called effort of dressing to look > the part

Anecdote: my wife is a psychologist. They are taught to observe how a patient presents him/herself at an appointment. Is her/him presentable? What about personal hygiene? Does he/she take care of him/herself? These are characteristics that say a lot, and should be taken into account when meeting someone. There is a difference between taking care of oneself and trying to appear like something else by wearing branded clothes, or to appear like something else by dressing like a 60's hippie (or whatever).

> And I would pick a reliable, self-aware, well-rounded, face tattooed, green > haired and barefoot colleague

Me too. But the first 3 are characteristics you wouldn't know for a while. In the meantime you have to work the hiring with what you see. Unfortunately, it's like that.

I also believe that the worst and most dangerous people in the world walk around in expensive suits, behave correctly in public and never say a bad word.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Honestly, don't depend on central repositories for daily availability. Especially if you are doing CI that redownloads everything from scratch. Use something like artifactory to cache the repository you are using: [https://www.jfrog.com/confluence/display/RTF/npm+Registry](https://www.jfrog.com/confluence/display/RTF/npm+Registry)

<comment><USER10> I think that's the issue of cost/reward. The cost is

\- N developers can't work for X hours

\- or the company can't release new versions due to CI dependency on the registry.

\- or the registry removes a package you were using

\- or the existing package contents changes to something malicious

BUT you pay this price very occasionally and if you're a small shop, the cost is often negligible.

On the other hand, maintaining your own mirror has very real costs even though they can be small. One time setup, hardware, sometimes license or hosted service fee, security upgrades. When there's a sponsor maintaining the central repository, having very good uptime and offering it for free, the marginal utility of a local mirror is quite small.

<comment><USER11> There's no reward. It's a risk/cost tradeoff.

</comment></comment></comment><comment><USER12> If this happens in future, you can switch an NPM mirror, such as:

\- [https://open-registry.dev/#get-started](https://open-registry.dev/#get- started)

\- [https://npm.taobao.org/](https://npm.taobao.org/)

WARNING: Research who runs the mirror before putting your trust in it.

How to turn on:

      npm config set registry https://npm.open-registry.dev

How to turn off:

      npm config delete registry

<comment><USER13> I would not recommend to use the Taobao registry though. This is operated by a Chinese company. Aside from the cybersecurity concerns, if it's hosted in China you'll be getting bad latency.

<comment><USER14> It's just a mirror service address, the NPM package is the same. Worrying too much about cybersecurity is a bit of a storm in a teacup.

<comment><USER12> Well, how do you know it's "just" a mirror service, and it is not using a zero-day to exploit your system, by installing a root-kit or copying your code to their servers?

I agree that it's a valid concern.

<comment><USER15> If you're concerned about injection into a third-party package, you should be using `package-lock.json` (or equiv) and integrity hashing your dependencies at install time.

</comment></comment></comment></comment></comment><comment><USER16> I dealt with this problem at a previous job where we had a build pipeline and apps that were very dependent on NPM. To fix it, I used nginx to build a set of two-tiered caching servers within our CI Kubernetes cluster. One used a ramdisk to provide a low latency cache for the NPM client fetches. The second was a disk-backed cache to provide persistence to the ramdisk-backed cache. I had a script that would alter the package deps so that they were pulled from the ramdisk-backed service, which used the disk-backed service as it's backend. The disk-backed service uses actual NPM URLs for its backend.

The result was lightning-fast fetches and no rate limiting.

We needed the two-tiered system because this was Kube and occasionally we would have to rebuild/restart nodes and we didn't want to completely lose the cache when that happened.

You can easily extend this system to handle any package artifacts used in your build process: .deb's, .rpm's, etc.

</comment><comment><USER17> Here's an explanation from CloudFlare as to the root cause. [0]

> I am the engineering manager for the DDoS protection team and this morning > at 11:06 UTC we tweaked a rule that affected one of our signals. The signal > relates to the HTTP referer header, and we have a piece of code that looks > at invalid referer headers. In this case we tweaked it to include not just > "obvious garbage" but "anything that does not conform to the HTTP > specification"... i.e. is the referer a URI? If not then it contributes to > knowledge about bad traffic.

> So... why did this impact npmjs.org? It turns out that a lot of NPM traffic > sends the referer as "install" which is invalid according to the HTTP > specification. As NPM is also a heavily trafficked site this resulted in the > DDoS systems picking this up and treating the traffic as a HTTP flood and > determining that a rate-limit should be applied.

> When we noticed that NPM was seeing an increase in HTTP 429s (as seen on > Twitter) we contacted NPM and started an internal investigation. As soon as > we identified the root cause we reverted the change, which was at 13:00 UTC.

> We'll note that NPM and 1 other site use the referer for purposes outside > the HTTP spec and we'll update our systems to ensure that this does not > happen again. Additionally we'll improve our monitoring around changes of > this nature so that we can discover impact sooner and roll back > automatically.

[0] [https://github.com/npm/cli/issues/836#issuecomment-587019096](https://github.com/npm/cli/issues/836#issuecomment-587019096)

</comment><comment><USER18> I came here to see if anyone had insights about what happened to see if I could apply any lessons learned. But all the comments seem to be "get off my lawn" style comments annoyed about people posting jokes in the issue.

Unfortunately, I am unable to resist the urge to add to the noise by complaining about people complaining.

</comment><comment><USER19> Is it common to rely on a free service like npm for your company's core business? It seems like you would be taking a huge risk by not mirroring anything you need internally.

<comment><USER20> I believe (based on lots of anecdata) that it's not just common, it's absolutely overwhelmingly often the case at companies of pretty much every size, be it a data scientist using stuff from CRAN for mission-critical modelling or an OS package repo or the like. It appears that few shops have this fully under control.

</comment></comment><comment><USER21> I wonder how many requests to npm are an utter waste given that often dependencies don't change due to the lockfile.

In Travis there's some (not too obvious) caching mechanisms that in many cases avoid this and speed builds up a ton.

I wonder if we would win from a review on popularity of configuring the cache and to educate people further on its use. I'm sure other CI systems have similar capabilities.

</comment><comment><USER22> I've been considering checking node_modules into source control for some time now, has anyone else done that successfully? There would be a variety of benefits:

1\. Eliminate redownload of packages on every CI build 2\. Reduce the amount of gigantic IO operations from unpacking the tens-of-thousands of files sitting in node_modules. 3\. Better security: code checked in can be audited better if not downloaded every single CI build.

yarn's PnP system is promising for the zero-install paradigm, but it doesn't seem quite ready yet (so many packages don't seem to get their dependencies right).

<comment><USER23> Helps if you only have one platform you're developing on and deploying to (e.g. x86-64 Linux). If developing on macOS there can be Mac specific binaries installed, depending on the package.

<comment><USER24> And if you do have more platforms, why not just check in one node_modules- directory for each?

This idea to redownload all packages all the time from external sources (and not even having a fallback-plan) seems completely brain-dead to me. Didn't the people learn from leftpad-gate?

<comment><USER25> > And if you do have more platforms, why not just check in one node_modules- > directory for each?

Now you have to sync it or risk running into unreproducible build failures. Also, if you update the binary dependencies on say, macOS, then you still need some x86-64 Linux to build the dependency.

Not saying it is not possible but without a proper process (e.g. a build server being the only place that updates dependencies) this is going to be painful.

</comment></comment></comment></comment><comment><USER26> I was (incidentally) just looking for a way of running a npm repository. Apparently it is not so simple as running a web server with a manifest (which is the case for basically every other package manager out there). Is there a reason for that? Is npms approach somehow better?

The thing with using web technology for distribution is that it's easily accessible and, crucially, that it's cachable in-line.

<comment><USER27> NPM started off as a CouchDB app, and you used to be to keep a local mirror of the full repository by running a copy of CouchDB and setting up one-way replication (not sure if this is still possible).

</comment></comment><comment><USER28> This is one of the reasons why, in Go, my team vendors our dependencies. For any service that seeks stability and the ability to deploy any time, removing networked build dependencies is important.

<comment><USER29> > vendors our dependencies

Is that like a local cache?

<comment><USER28> Vendoring is checking in your dependencies with the source. You can def consider that a local cache. The next step up is to run your own proxy server (pretty much a package server / mirror). Next is to use a service like artifacory that does similar.

<comment><USER30> We should call it a backup. Calling it a cache puts people in mind of size/hit ratio tradeoffs; what's needed is zero tolerance for loss of mission critical code.

</comment></comment></comment></comment><comment><USER31> In the last company I worked for, we had a pretty standard build pipeline for a web application. I was a bit shocked to see how many different packages repositories we depend on for every build: NPM, Pypi, Alpine packages, docker hub ...

a single failure in any of those centralized systems that we don't pay for and builds fail.

</comment><comment><USER32> Here's a postmortem comment from a Cloudflare engineer: [https://github.com/npm/cli/issues/836#issuecomment-587019096](https://github.com/npm/cli/issues/836#issuecomment-587019096)

</comment><comment><USER33> If this is causing production CI/CD pipelines to fail, this might be a bigger issue than it seems. Has this already happened in the past with npm?

<comment><USER2> > if

It 100% is, unfortunately. I don't recall this happening in recent history, but it has been the case that 3rd party services have broken CI/CD pipelines and production pushes (e.g pip broke a few weeks ago, and their own pipeline for deploying changes was blocked by the bug).

<comment><USER34> It's very easy for these kind of dependancies to creep into the build process. If the worst case cost of not being able to create a new build out-weights the cost of rearchitecting your build process then it's something you should seriously consider. On the plus side it also brings additional benefits like faster builds and resilience against packages being unilaterally removed.

</comment></comment></comment><comment><USER35> I'm always surprised that npm, a for-profit company with a lame business model, is graciously serving redundant package requests millions of times per day to everyone's CI/CD flows.

One day this is going to happen for real and it will be because npm org decided to charge for API requests by `npm ci`.

</comment><comment><USER36> Isn't mirroring still a thing? I am not saying this as the old creepy guy (well a bit), but seriously wondering why a registry like npm doesn't have tons of geographicaly spreaded mirrors. Package can easily be signed and mirrored, that shouldn't be complicated.

</comment><comment><USER37> Check their status page [1] to see the progress:

> _Investigating - We are currently investigating 403 / 429 errors received by > some users._

[1] [https://status.npmjs.org/](https://status.npmjs.org/)

<comment><USER38> It seems the issue is resolved at the moment. From the same link

> Monitoring - Our content delivery partner has informed us they've > implemented a fix. We are monitoring. Feb 17, 13:07 UTC

Edit: And in the OP GH thread, people are also mentioning it's back up.

</comment></comment><comment><USER39> 1) Glad we have a Nexus proxy in front of npm... [a] 2) Cloudflare strikes again, this one company is at the same time making the internet better and worse. I'm constantly blocked by cloudflare for something that should not be, it's extremely frustrating. Then when you complain to them they throw their hands up and say "owner hasn't configured their site for that". Ugh.

[a] [https://blog.sonatype.com/using-nexus-3-as-your- repository-p...](https://blog.sonatype.com/using-nexus-3-as-your-repository- part-2-npm-packages)

<comment><USER40> Cloudflare must value my ability to identify fire hydrants and crosswalks, because I sure get a lot of these challenges...

</comment></comment><comment><USER41> Yearly reminder to vendor your dependencies.

</comment><comment><USER42> Reliance on npm is one of the things covered in Ryan Dahl's "10 Things I Regret About Node.js" talk at JSConf EU 2018 and is fixed in Deno.

 _Includes a built-in package manager for resource fetching, thus no need for NPM._

[https://en.wikipedia.org/wiki/Deno_(software)](https://en.wikipedia.org/wiki/Deno_\(software\))

</comment><comment><USER43> I guess the solution here is for the larger CI providers to host a mirror of popular package repositories locally and provide an easy way to use them.

It really doesn't make a lot of sense to re-download tons of packages for every minor commit where you run your CI.

</comment><comment><USER44> Most of the responses to the ticket are completely irrelevant.

</comment><comment><USER45> Some users in the issue are reporting it's fixed.

</comment><comment><USER14> That's why we need a decentralized network.

</comment><comment><USER46> and the js/npm clown show marches on

<comment><USER47> Looking at your username, I'm unsure if this is a positive or negative thing.</comment></comment>


GDPR Shield: block your website from EU visitors - <AUTHOR> https://www.gdpr-shield.io/ <comment><USER2> Previous discussion (123 comments): [https://news.ycombinator.com/item?id=16991185](https://news.ycombinator.com/item?id=16991185)

</comment><comment><USER3> I'm an EU resident that travels. Good luck!

<comment><USER4> The GDPR applies only when you provide services to EU territories otherwise every EU tourist would trigger this and yeah this won't hold water.

Good luck asking the Hostel you stayed in Argentina about GDPR compliance.

And if the EU will try to force it via the payment processors which is quite possible then the only thing you'll see is sorry we don't accept American Express or EU payment cards signs at many places around the world.

<comment><USER5> Article 3 for anyone who's interested.

And yeah simple VPN can beat this service. There are ways to block EU residents so as to not have to comply with the regulation, but they require more than a single piece of javascript code.

<comment><USER4> Like with any law the intent matters if it won't it's going to be even more of a clusterfuck.

Technically a pop up saying we do not provide service to EU residents is sufficient.

My biggest fear currently is that PayPal will force people to comply or refuse to allow EU users to checkout on non compliant storefronts which may impact a lot of small and or niche merchants from being able to sell to the EU or and me form buying form them.

This is what the payment processors do in the PCI world and for PayPal to be GDPR compliant they need to make sure that anyone they share data with are also compliant.

Not mention that within the EU a lot of blockchain related companies are scratching their heads in how to comply with the data deletion requirements of the GDPR if you write any PII to the blockchain.</comment></comment></comment></comment>


Show HN: ZeroKlik – sharing reimagined - <AUTHOR> https://zeroklik.com/

<comment><USER2> While I am unlikely to install something that loads yet another shell extension, downloading before the upload is finished is a cool idea. The last time I saw it was on ge.tt, which seems to have evaporated.

<comment><AUTHOR> Thanks for your feedback :) At first we did load a shell extension but we stopped due to performance issues. now its just a user-registry entry that starts the executable with the dir/file as parameter.

</comment></comment><comment><USER3> Is this, in anyway, related to the unity game engine? The logos look too similar.

[http://unity3d.com/](http://unity3d.com/)

<comment><AUTHOR> No not at all.I was not aware of that, will definitely check with the designer. Thanks a lot for informing me!</comment></comment>


Waving Goodbuy: Facebook's Big Whiff on Traffic of Commercial Intent - <AUTHOR> http://hunterwalk.com/2013/06/28/waving-goodbuy-facebooks-big-whiff-on-traffic-of-commercial-intent/ <comment><USER2> I'd much rather see elf boobs than Apple ads.

I think eventually FB will figure this problem out. Your article is on point; I've thought about this before.</comment>


Ask HN: advice on the customer conversion rate needed - <AUTHOR>

Hi community, I am looking for some advice on the approach to market analysis.
We are planning to enter the energy saving appliances market in Europe. The idea is that customer purchases an appliance that monitors his energy consumption and allows to save some money on electricity bills. Appliance (and our analytics service) is not free, so there should be an incentive for the customer to start using it. Say, if he spends X USD on electricity every month without an appliance, and appliance costs Y USD while allows saving of Z USD, then what customer conversion should we expect based on those numbers? It's clear that if an $5 appliance allows saving $50 of monthly bill of $100, then few people will hesitate to buy it. What about $20 appliance that allows saving $50 of yearly bill of $1000? Any advices on the conversion expectations here? Maybe something similar to statistics of 1% paying customers in freemium model?
Thanks in advance. <comment><USER2> First step: Know your competition. [http://blog.mapawatt.com/2009/10/07/list- of-energy-monitorin...](http://blog.mapawatt.com/2009/10/07/list-of-energy- monitoring-tools/comment-page-1/#comment-1962)

Count me in on your list of competitors with Gridspy: <http://www.gridspy.co.nz/>

I'd be thinking in terms of years to pay back the system. Talking to clients will give you an idea where they lie on the scale of 1 to 10 years.</comment>


Ask HN: Are there startups that went open-source and succeed? - <AUTHOR> Here is where we are:
We have a valid product, paying customers, Currently $50K MRR and we are growing.
We have competitors, they are bigger, got huge investment rounds (we only got small seed round from friends), yet we have a better product. Much better!
How do I know? Customers, customers who left them, told us clear and simple. This product is far beyond what we have had with A and B.
Now, A and B are strong with PR, most of it are exaggerations (typical to PR), one even get to post almost every week at HN's front page.
To really really beat them, we will need to inject some cash and start the PR channels, conference attending and spend a lot of time in marketing. I hate doing that. I am happy to develop the product. Very happy to meet customers and present the product, and strongly convinced the world deserve to know about our product.
Open sourcing will make the product better, will make it well known and might even speed up our growth.
I will be happy to see companies that started as closed source, then went open source, and succeeded.
Got some examples? <comment><USER2> >> To really really beat them, we will need to inject some cash and start the PR channels, conference attending and spend a lot of time in marketing.

So far so good, standard business stuff.

>> I hate doing that.

Here lies the problem IMHO. To make your business a success, you need to do stuff you don't necessarily like, enjoy or are familiar with.

You think of "open sourcing" as a lazy marketing channel that will keep you in your comfort zone. It doesn't work like that.

You could either find a co-founder or hire someone to handle that stuff. Or, you could suck it up and do it yourself.

<comment><USER3> Completely agree. Open sourcing isn't going to help a business when the business owner doesn't want to do business stuff.

</comment></comment><comment><USER4> It would depend on your definition of "succeeded", but Docker (formally dotCloud) made a great transition after releasing docker and just raised a very nice round of funding.

"In 2013, recognizing the need for flexible, PaaS-like environments inside enterprises and across clouds, the company released much of its PaaS container technology as the open source Docker project. Docker is an open source engine for deploying any application as a lightweight, portable, self-sufficient container that will run virtually anywhere. By delivering on the promise "Build Once…Run Anywhere," Docker has seen explosive growth, and its impact is being seen across devops, PaaS, and hybrid cloud environments.

The success of the Docker project led the company to change its name from "dotCloud, Inc." to "Docker, Inc." in October 2013 in order to reflect its focus on the new product. Docker, Inc. continues to run the dotCloud Platform, supporting thousands of containers running applications for a wide variety of businesses."[0]

[0] [https://www.dotcloud.com/about.html](https://www.dotcloud.com/about.html)

<comment><USER5> Yeah, Docker seems to be more _popular_ than dotCloud ever was, but do we actually know how the pivot affected their finances?

</comment></comment><comment><USER6> Your product is already succeeding. Why do you think open sourcing it will make it more successful? Are you sure you can make an open source project bigger than your company?

Why do you think these competitors matter if their own customers are telling you they're shit and you're great?

Why does HN matter to your startup? Are you sure it matters to theirs? One simple way to tell - do your competitors get on HN with stories about being a startup/engineer, or is their product itself interesting to HN? If HN isn't the best source of your customers then it shouldn't be a factor in any decisions or marketing/pr.

What about these conferences - are they closing deals and making money at these things, or are they just spending on them?

How about leveraging their marketing? Let them find unsatisfied customers and poach them straight from hn/twitter/linkedin/facebook/anything you can find.

</comment><comment><USER7> >Open sourcing will make the product better, will make it well known and might even speed up our growth.

Open source by itself won't do any of those things.

The question is, what advantages would being open source give you over remaining closed source? Whether it is open or closed, you still have to do the promotion to make it well known. If you go open source, does that automatically mean you will open the development process as well, and if so, you'll have to consider the process by which you accept changes into your product, IE: will there be an open level and then a supported "commercial" one, for example? how will you build a team of community supporters?

Yes, there are obviously examples of open-source success in the world, but it isn't clear from your posting whether there is a strategic advantage or not.

</comment><comment><USER8> At the moment, no examples of start ups which started as closed source and went open, come to my mind.

However, there are a few open source startups out there which started open from the beginning, such as Drupal or WordPress. You could also have a look at NewsBlur which got some traction after Google shut down Reader.

Whether or not being successful depends on a few things:

First, will open sourcing really make the product better? From my experience people tend to overestimate the capabilities of the open source community. This community does not translate to "legion of free developers at your disposal" but require an proactive engagement and community management. Are you well prepared for that?

Second, the nature of the product and the audience: If you're selling server software, for example, such like RedHat, there will be those "private" and "small" users which take your product and use it on their own. But there are also corporate users who will buy SLAs and first and foremost want someone to blame for things that are not working. Second, there are products who benefit from centralization. NewsBlur for example may less valuable for individuals if it would not provide a "hosted service". The same goes for Facebook. Their asset is more the user base than the technology (even if that's, of course, also a huge stack).

Third, what is your "open source strategy". There are companies like Pentaho or Alfresco which offer an "open core" and sell additional features for that. I would consider that more as closed than as open source, in some way it is a bit like a "demo version".

I would love to hear what you've build so far, because open source in a commercial environment is a topic of interest for me.

<comment><USER9> LiveJournal and Reddit both started as closed-source and went open, and it didn't kill the company. Both were already succeeding, though, so it's hard to tell whether open-sourcing their code actually helped them.

Netscape open-sourced their code as Mozilla when they started failing. Again, it's hard to tell causality, though - did they fail because they were so distracted by open-source that they couldn't react to IE? Or did they fail because the Netscape 4.7 codebase was so bad and their resources so constrained that they couldn't react to IE? And does Firefox, born out of the open-source effort, count as a "success" because it grew out of Mozilla and finally broke Microsoft's monopoly, or a failure because it was eventually eclipsed by Chrome?

<comment><USER10> Is Reddit really open sourced?

<comment><USER11> The code is [0], but I don't think the data is.

[0] [https://github.com/reddit/reddit](https://github.com/reddit/reddit)

<comment><USER10> Wow I didn't know that, thanks

</comment></comment></comment></comment></comment><comment><USER12> To echo some sentiments already voiced, open sourcing a product is about more than simply publishing your source to Github. It is about building a community around that source code to evolve the product. Contributions can take many forms such as code, defect submissions, documentation, testing, etc. This community drives conference attendance, on-going media attention, and, most importantly, your company actually gaining market position from an open source strategy. Building such a community takes a fair amount of time and effort. Very few spring up like Docker. If you are committed to the long haul of building such a community then you could gain a tremendous amount. If you are expecting to simply publish the code and get immediate and long-term PR from the act of your company working in a public repository, then I think open sourcing will not only fail to meet that expectation, but likely be a critical distraction for your company.

<comment><USER13> xara is a good cautionary tale along those lines - they open sourced what from all accounts was a very nice vector graphics editor, but it languished for want of active community management from the company.

<comment><USER3> One huge problem with Xara's "open source" move was they kept a critical element closed source:

"Xara and the volunteer developer community disagreed from almost the very beginning about a crucial issue: the company's decision to keep the application's core rendering library CDraw closed source. The developers said time and time again that a half-open, half-closed application was a dealbreaker."[1]

[1] [http://archive09.linux.com/feature/119790](http://archive09.linux.com/feature/119790)

If you do any such thing you can't expect open source to work for you.

<comment><USER13> ah, missed that! for some reason i thought they'd eventually given in and opened up the CDraw code.

</comment></comment></comment></comment><comment><USER14> Define "succeed".

Anecdote time. The last open source company I dealt with worked in the big data space. They messaged themselves as a product company and listed 3 products on their page.

I was working for a company providing client tools and we were teamed together by a larger System Integrator on a contract proposal.

While working with them I got curious about their product (hey, maybe someplace cool to go work someday).

The conversation went something like this:

       Me: So you guys have some impressive software, you must have a heck of a dev shop

       Them: We do. The good news is that we got a nice head start using some open source stuff, hadoop, etc.

       Me: Oh. So what bits did you guys make?

       Them: Well we made this (points to web accessible management console) and did the glue work to pull together the open source bits

       Me: Oh. So is your value proposition then that you guys have tightly integrated this technology stack and...

       Them: *Right* and provide the technical expertise to run it. (sits up proudly) and all the work *we* did has been open sourced as well (goes to their github page).

       Me: so....if I were a customer and I bought x amount of product A from you, what exactly am I getting?

       Them: you're getting the integrated stack and our expertise and support.

       Me: Support available by contract?

       Them: Right.

       Me: So let's say I'm the customer...what's to prevent me from just downloading and compiling all the source code for your stack and your glue and just poaching a couple of your guys and saving myself a few million dollars in FTE hours?

       Them:Well that's highly unethical...poaching our people

       Me:okay, or I find a couple really good guys on most of this stack and give them 3 or 4 months to come to grips with it and your glue...same thing...what's your guys' value proposition to go with your company instead of just doing that?

       Them:...

They sold to another company a few months later and I've heard it was mostly for the customer contracts they already had in place. I'm not aware they were ever profitable or on a path to profit. Great success?

My point is, you have to _really_ consider this kind of line-of-questioning and put together a rock solid value proposition to have a chance at succeeding. Because why pay you for whatever when I can get it free as in beer and use my own people who I'm already paying for?

</comment><comment><USER15> I am a bit biased, being the founder of a startup whose products are all Open Source. BUT... nonetheless, I'll say that I don't necessarily think that going Open Source is going to be a magic cure-all for you. And it could make things worse, depending on may details.

Remember, Open Source really is more of a development methodology than a business model. And being Open Source doesn't obviate the need to think about marketing, advertising, sales, etc.

If you wanted to go the OSS route because you believe in OSS ideologically, or because you think it's a way to make the world a better place, I'd wholeheartedly say "go for it". But if you want to do it just because you don't like marketing, I'd say you should consider giving the whole thing some more thought.

Basically, what d0m said is pretty much dead-on, IMO.

</comment><comment><USER16> There is an entire movement about open companies, among them

[https://assembly.com/](https://assembly.com/)

[https://gratipay.com/](https://gratipay.com/)

[https://www.balancedpayments.com/](https://www.balancedpayments.com/)

</comment><comment><USER17> Something to think about: a proprietary program can be delivered to its users such that they have the source code. It is "open" to the licensed users who purchased the program, but not redistributable. The license can allow those users to form a community for sharing modifications to the program with each other. "Open source" doesn't necessarily mean slapping a GPL or BSD on it and blowing it out the door.

In _The Mythical Man Month_ , I seem to recall that Fred Brooks called a program without source code to be "incompletely delivered"!

The idea that proprietary programs are only given to users in some hard-to- modify mangled code, byte code or machine language form is not some axiom of the proprietary software business.

<comment><USER18> _' "Open source" doesn't necessarily mean slapping a GPL or BSD on it and blowing it out the door.'_

Your broader point - that it is possible to provide source and still keep the software proprietary - is a good one, but as most people (including the OSI) use the term "open source" _does_ necessarily mean "not proprietary":

[http://opensource.org/osd](http://opensource.org/osd)

<comment><USER17> That's just the definition of "open source" by some people who have an agenda and want to hijack the language for their own use; I will buy it when it appears in the same form in Merriam-Webster or Oxford. Until then, "open source" is purely a compositional compound noun in the English language that is understood by combining the meanings of "open" and "source". Open doesn't say anything about non-proprietary. If you're taking an "open book exam", that doesn't mean that the book comes with a license that allows unlimited photocopying for all your friends. If you "open up" to someone, you aren't publicizing your life to the whole world. If all the users of a program have the source code, or easy access to it, that source is open. If he program is proprietary, then perhaps some of those who have the source code are unlicensed users. They still have the source code, and it is still effectively "open source" to them too.

And in the context of some programming language that has no binary code, would you even continue to use the term "open source" and "closed source"? Could some uncompiled, unobfuscated script that is sold to users under a license that prohibits redistribution be called "closed source", when it is delivered in properly indented, well-commented code with meaningful identifiers?

Richard Stallman builds a good case for avoiding the term "open source" when referring to free software.

[http://www.gnu.org/philosophy/open-source-misses-the- point.h...](http://www.gnu.org/philosophy/open-source-misses-the-point.html)

Hey look, like me, he recognizes the "obvious meaning" of the term:

RMS> _" Since the obvious meaning for "open source" is not the meaning that its advocates intend, the result is that most people misunderstand the term."_

I don't agree with Stallman on this point, though: those people are English speakers who understand the term. They just don't understand how those advocates are using it, which is their fault: they are not communicating effectively.

RMS> _" Open source supporters try to deal with this by pointing to their official definition, but that corrective approach is less effective for them than it is for us [advocates of 'free software']."_

<comment><USER18> This is inane. I wasn't making any claim to a "true" definition; just pointing out that it is _manifestly_ the case that using it that way is going to confuse a lot of people - including, I think, most programmers. If you intend to reclaim the term , it's best to explicitly make plain that you are doing so.

Edited to add:

And, as it happens:

[http://www.merriam-webster.com/dictionary/open-source](http://www.merriam- webster.com/dictionary/open-source)

 _" of software : having the source code freely available for possible modification and redistribution"_

[http://www.oxforddictionaries.com/us/definition/american_eng...](http://www.oxforddictionaries.com/us/definition/american_english/open- source)

 _" Denoting software for which the original source code is made freely available and may be redistributed and modified."_

Note that both of these include that redistribution is permitted. So, um, buy it.

<comment><USER17> Bought.

They adopted that surprisingly fast!

Interestingly, both dictionaries recommend that it be hyphenated as open- source.

<comment><USER18> _" They adopted that surprisingly fast!"_

Heh, it's been around much longer than "tweet" (in the sense of posting two twitter) or "sexting", which have both apparently made it in.

</comment></comment></comment></comment></comment></comment><comment><USER19> Sounds like you should sell the product to someone that wants to do the business side of things, and stay on as the head of product development.

It is doubtful to me that open sourcing it will make it well known unless it is a technical product and your customers are developers. Do your customers care if it is open source? Most people selling Asterisk installations never explained to the customers that technically the software was free. All that will be accomplished is that someone who likes marketing & PR can pickup your work and create competitor D, that has everything you have, but with someone that likes to sell. Better to get that person on your team after they pay you some money.

</comment><comment><USER20> > To really really beat them, we will need to inject some cash and start the > PR channels, conference attending and spend a lot of time in marketing. I > hate doing that. I am happy to develop the product. Very happy to meet > customers and present the product, and strongly convinced the world deserve > to know about our product.

Why would you compete directly against their strengths? It doesn't sound like you can outspend them. Play by different rules. Focus on being more creative, more targeted in your customer acquisition, more focused in your messaging, more good.

I'd also consider ways you can outsource components of your codebase instead of the full thing.

</comment><comment><USER21> Open sourcing doesn't necessarily mean the product will get better. There are often "fights" in the open source community, and you could spend a lot of time discussing what features to add or not add instead of implementing them. (This of course all depends upon the method in which you open source the project/product.)

If you like developing and dislike marketing, use some of that $50K and hire a marketer. You don't necessarily need lots of money to market, it just makes it easier. For example, you probably missed a good free marketing opportunity by not mentioning the name of your company or your site in this post. Try and find someone to help you become a bit more clever and tactical in your marketing efforts, and it will probably pay off much better than open sourcing. My $0.02...

</comment><comment><USER22> NewsBlur[0] is open-source[1] and seems to be doing well.

[0]: [http://www.newsblur.com/](http://www.newsblur.com/)

[1]: [https://github.com/samuelclay/NewsBlur](https://github.com/samuelclay/NewsBlur)

</comment><comment><USER23> One of the early success stories of an open source SaaS product was Alfresco.

For them Open Source _was_ a strategic advantage because it short circuited the usual enterprise sales process.

That is, their competitors in the enterprise CMS space most had very long sales cycles and highly paid salespeople to get in to companies just to do a _pilot project_... and meanwhile some engineer could just download and deploy Alfresco to show it did what it claimed, before the other project even got off the ground.

Upshot is that Alfresco pretty much had a full inbound sales pipeline for support contracts and their 'value added' version, and consequently higher margins.

Is your product aimed at enterprise customers?

<comment><USER23> Matt Asay interview that expands on this point: [http://www.networkworld.com/article/2294068/lan- wan/selling-...](http://www.networkworld.com/article/2294068/lan-wan/selling- software-that-sells-itself--an-interview-with-matt-asay.html)

Summary: [http://openlife.cc/blogs/2007/august/matt-asay-alfresco- busi...](http://openlife.cc/blogs/2007/august/matt-asay-alfresco-business- practices)

Note: These are from 2007, and these insights about enterprise open source products and sales aren't unique anymore.

</comment></comment><comment><USER24> A lot of companies seem to be using this model quite well. DataStax, Couchbase, Cloudera etc.

<comment><USER25> Didn't those companies start with the open-source then build a company around it? As opposed to starting out closed then later open-sourcing?

<comment><USER26> Yep - and I agree that's a very different scenario. They didn't (necessarily) open-source the product because they thought that would be the game changer, they saw a market connected to the project and looked at how to fulfill that market's needs.

<comment><USER26> Downvoters care to explain any disagreement with what I said or how I said it?

</comment></comment></comment></comment><comment><USER27> The ArsDigita story is interesting.

[http://waxy.org/random/arsdigita/](http://waxy.org/random/arsdigita/) might be the best textual source on the web, but if you can rustle it up (download link not working for me), Greenspun's IT Conversations interview is a good listen:

[http://web.archive.org/web/20130729213414id_/http://itc.conv...](http://web.archive.org/web/20130729213414id_/http://itc.conversationsnetwork.org/shows/detail94.html)

</comment><comment><USER28> I don't see in any way how exposing your IP will make you bigger.

You say that your competitors are better at PR. Have you analyzed your growth and PR strategies?

What is your competitive positioning? Are you cheaper? Are there fundamental technological advances that you have that make you innately better?

Here is a cheat sheet that is sort of the standard when it comes to competitive strategy: [http://en.wikipedia.org/wiki/Porter_five_forces_analysis](http://en.wikipedia.org/wiki/Porter_five_forces_analysis)

<comment><USER29> If you want to go the route of improving marketing, I'd suggest [https://training.kalzumeus.com/](https://training.kalzumeus.com/) and associated links as a first cut.

That may not totally apply and you may be in a situation where you could easily justify hiring, depending on the income of the business, but it'll start you down what's probably a much better path than you're on now.

I know it's frustrating to ask how to do X and get told about how to do Y. However, I will say this: You describe some problems, then ask if open sourcing will work, and to be honest, I honestly have no idea why you think that problems connects with that solution. The average open source project crawls in a corner and dies. I think you'd be trading some admittedly long odds for some _much_ longer ones.

</comment></comment><comment><USER30> Sleepy Cat Software, the makers of Berkeley DB, went on with a fully open- source model for 10 years until getting acquired by Oracle in 2006. They however started the company around an existing open-source product, so it may or may not be relevant to your case.

[0] [https://en.wikipedia.org/wiki/Berkeley_DB](https://en.wikipedia.org/wiki/Berkeley_DB)

</comment><comment><USER31> There are a shitton of companies that are open source and don't succeed. Do what you're comfortable with. Are you more excited to nuture and manage a community rather than do marketing stuff?

Also, if you've stolen customers, and your marketing is non existent, then maybe you should just fix your marketing and not radically change your business model.

</comment><comment><USER32> $50k MRR and growing sounds like you're in a position to pay the salary of someone who actually likes marketing and PR.

Open-sourcing the product is only going to help it grow in very specific niches, and open source projects often succeed because someone behind the project is very good at marketing and PR.

</comment><comment><USER33> Instructure (the guys behind the LMS Canvas), are pre-IPO.

[https://github.com/instructure/canvas- lms/wiki](https://github.com/instructure/canvas-lms/wiki)

[http://www.instructure.com/](http://www.instructure.com/)

</comment><comment><USER34> Open source is a different business model - you won't be able to do SaaS and open source at the same time. You could try open core where open source would be your marketing channel, this one works - e.g. Talend or RedHat.

<comment><USER35> > Open source is a different business model - you won't be able to do SaaS and > open source at the same time.

Open source plus pay us to have a supported, hosted, managed installation doesn't seem impractical. Obviously, there is a challenge in that the code isn't "secret sauce" and you have to provide adequate value in terms of support/hosting/management to justify people not hosting it themselves, and open source means that a competitor can use your code to compete with you -- so you have to compete on the value of support/hosting/management or risk competing on price alone -- OTOH, the fact that they _can_ host it themselves or have someone else host it, if you have a usable outbound migration facility, also mitigates lock-in risk of your paid service, and may be a value to some customers on its own.

<comment><USER3> > Open source plus pay us to have a supported, hosted, managed installation > doesn't seem impractical.

That's the wordpress.org + wordpress.com model. Seems practical enough. Successful even.

</comment></comment></comment><comment><USER36> What kind of product is it? If this is a SaaS application, I would not recommend open sourcing it.

If you are shipping software that runs on client hardware (e.g. a database) it might make sense.

</comment><comment><USER37> I'm not sure if you would consider it a startup anymore, but:

[https://github.com/mongodb/mongo](https://github.com/mongodb/mongo)

</comment><comment><AUTHOR> \--- Thank You ALL ---

</comment><comment><USER38> Reddit started out proprietary, and then became open source. Of course, their community is necessary for a site of that type to succeed.

</comment><comment><USER39> How about Netscape? I think they've been reasonably successful with open source development and foundation governance.

</comment><comment><USER40> it seems to me open sourcing means more risks than upsides. Can't you raise funds based on your growth/customers and hire someone who will make the PR you hate? Sorry for not answering your question :-) +1 for the Docker example below

</comment><comment><USER41> [https://getsentry.com/](https://getsentry.com/)

</comment><comment><USER42> codecombat went opensource and this accelerated the growth. [http://blog.codecombat.com/uid/137237](http://blog.codecombat.com/uid/137237)

</comment><comment> Norm-- How is the commercial arm of Nginx doing? Nagios?

</comment><comment><USER43> github.com is mostly open source.</comment>


Researchers improve efficiency of human walking - <AUTHOR> https://www.nsf.gov/news/news_images.jsp?cntn_id=134667&org=NSF <comment><USER2> Does an unpowered clutch engage a spring in parallel with the Achilles tendon when the foot is on the ground, offloading the calf muscles and making walking easier?

<comment><USER3> That's... exactly what the caption under the first image says.

<comment><USER4> He's mocking the article, which repeats that caption on every picture.

<comment><USER5> The problem is, the linked "article" is not the article.

This is the article: [https://www.nsf.gov/news/news_summ.jsp?org=NSF&cntn_id=13466...](https://www.nsf.gov/news/news_summ.jsp?org=NSF&cntn_id=134667&preview=false)

</comment></comment></comment></comment><comment><USER6> [https://www.cmu.edu/me/news/archive/2015/collins- clutch.html](https://www.cmu.edu/me/news/archive/2015/collins-clutch.html)

A more conventional article about the device and related paper.

</comment><comment><USER7> I've studied a number of martial arts and body work disciplines. One thing we did was teach people is to walk more efficiently - it's not hard given that the average person just follows the example of their peers and then allows habitual muscle tension to gradually interfere.

The thing about this device is I suspect that even if did work, it would just allow people to just further lower their level of coordination and ultimately have rather poor health results.

<comment><USER8> What is the correct method of walking?

<comment><USER7> Well,

Essentially "correct," or at least elegant, walking involves balance and a lack of tension. Naturally learning this requires a lot of direct experience since walking is primarily a reflex activity. However, walking is at the same a skill which can be learned and modified if someone looks into hands-on methods.

However, you can get some idea reading about The Alexander Technique, The Feldenkrais Method, Tai Chi and so forth.

[1] [http://www.alexandertechnique.com/at.htm](http://www.alexandertechnique.com/at.htm) [2] [http://en.wikipedia.org/wiki/Feldenkrais_Method](http://en.wikipedia.org/wiki/Feldenkrais_Method) [3] [http://en.wikipedia.org/wiki/Tai_chi](http://en.wikipedia.org/wiki/Tai_chi)

</comment></comment></comment><comment><USER9> Here's a link to the nature article: [http://www.nature.com/nature/journal/vaop/ncurrent/full/natu...](http://www.nature.com/nature/journal/vaop/ncurrent/full/nature14288.html#figures)

</comment><comment><USER10> I wonder if they also increase the efficiency of running. Maybe the first marathon runner to break the 2-hour barrier will be wearing them.

If the efficiency increase is significant, I could see it becoming common to wear for commuting to work. You could run longer distances with less wear on your body.

<comment><USER11> I feel like the running community would shun them, since it's technically an method of assistance.

Besides, I bet for ultra-elite marathon runners, the bulk of the shoe would outweigh the benefits it provides. You're talking about people who wear super- light minimalist shoes because it gives them an advantage.

<comment><USER12> Depends on a lot of factors, including whether the public would like it (would they applaud the higher speeds or find it cheating?)

There already is a lot of assistance in athletics, not even limited to footwear. For example, running tracks have 9 lanes nowadays, even though only 8 people start in sprinting events. Reason? The innermost lane is softer, for middle and long distance runners; the other 8 are harder for the shorter distances.

On the other hand, it always surprises me that, in athletics, competitors wear numbers tied to their shirts with safety pins. Especially in the 100m and 200m, the one on the back of the runner must cause significant drag.

</comment></comment></comment><comment><USER13> "Download the high resolution of the image"

Unfortunately, the "high" resolution only holds for the x and y dimensions, not the t dimension.

</comment><comment><USER14> Though what we really need is a device to decrease the efficiency of human walking.

<comment><USER15> That is already a mature technology. I prefer to use a heavy pack but cell phones are also a popular technique.

<comment><USER16> There's an even simpler device -- the string. Simply tie your ankles together and presto.

</comment></comment></comment><comment><USER17> interesting. I didn't know that an unpowered clutch engages a spring in parallel with the Achilles tendon when the foot is on the ground, offloading the calf muscles and making walking easier.

<comment><USER18> I thought it was common knowlege? I know I've heard it enough times.

</comment></comment><comment><USER19> I guess you could say he's got a _spring_ in his step...

</comment><comment><USER20> I could imagine military applications for this... especially if a soldier is armored, carrying a pack, etc.

</comment><comment><USER21> Maybe these can just do my exercising for me so I can watch more Netflix

</comment><comment><USER22> I hope we'll soon be able to buy one of these. I'd get one.

</comment><comment><USER23> This is amazing, though I admit I had to click through just to see if it was an April Fools headline leftover.

</comment><comment><USER24> April fool's leftover?</comment>


API Security Checklist for developers - <AUTHOR> https://github.com/shieldfy/API-Security-Checklist <comment><USER2> There's some OK stuff here, but the list on the whole isn't very coherent. If this is a guide specifically for "APIs" that are driven almost entirely from browser Javascript SPA's, it makes sense. Otherwise, a lot of these recommendations are a little weak; for instance, most of the HTTP option headers this list recommends won't be honored by typical HTTP clients.

Further, the list succumbs to the cardinal sin of software security advice: "validate input so you don't have X, Y, and Z vulnerabilities". Simply describing X, Y, and Z vulnerabilities provides the same level of advice for developers (that is to say: not much). What developers really need is advice about how to structure their programs to foreclose on the possibility of having those bugs. For instance: rather than sprinkling authentication checks on every endpoint, have the handlers of all endpoints inherit from a base class that performs the check automatically. Stuff like that.

Finally: don't use JWT. JWT terrifies me, and it terrifies all the crypto engineers I know. As a security standard, it is a series of own-goals foreseeable even 10 years ago based on the history of crypto standard vulnerabilities. Almost every application I've seen that uses JWT would be better off with simple bearer tokens.

JWT might be the one case in all of practical computing where you might be better off rolling your own crypto token standard than adopting the existing standard.

<comment><USER3> no JWT but "simple bearer token" is not a good advice as I have no idea how to implement that. I'd rather use JWT with restricted crypto (make sure "noop" is not allowed).

<comment><USER4> In tptacek's other post from two months ago:

> For almost every use I've seen in the real world, JWT is drastic overkill; > often it's just an gussied-up means of expressing a trivial bearer token, > the kind that could be expressed securely with virtually no risk of > implementation flaws simply by hexifying 20 bytes of urandom.

This is then to say "generate a random number, give it to the client, accept that same random number in the future as evidence of the client's authorization". A familiar form of that would be a session cookie whose content was generated by a cryptographic random number generator. The session cookie is an index into a database that indicates the properties and authorities that that particular session does or does not have.

Now I guess the reason people may like JWT is that they don't have to have a database or store of tokens that they're issued and what authority each one connotes, because they can verify the signatures on the JWT and then believe the payload. And one system can issue authorizations that another system can consume without direct communication between the two. I think these believing- the-payload properties are a part of what Thomas _doesn 't_ like.

<comment><USER2> On rare occasions there might be a good reason for stateless auth. I think stateless auth is overused (it's especially funny to see it used on sites that are otherwise dependent on HTTP cookies), but not intrinsically evil.

But there can be no reasonable argument for a standard conceived of in the last 10 years to allow users to deploy something for which _the payload chooses the cryptographic interpretation of the payload_. _No_ application anyone on HN is deploying needs user-selectable cryptography. This is never a feature; it's only ever an invitation to horrible vulnerabilities.

<comment><USER5> > But there can be no reasonable argument for a standard conceived of in the > last 10 years to allow users to deploy something for which the payload > chooses the cryptographic interpretation of the payload. No application > anyone on HN is deploying needs user-selectable cryptography. This is never > a feature; it's only ever an invitation to horrible vulnerabilities.

When I read about JWT's I saw the alg fields to a simple indicator of the algorithm being used on the JWT, not that it is allowing the token to select whatever algorithm it wants for the server to run. Granted, this is a semantic difference, but if you treat the alg field as such it then becomes the servers choice of what algorithms to support. The practical solution is simple: Only support one algorithm, and if the token's alg does not match what the server is expecting, do not authorize. Sure this is a weakness in the JWT spec, but the real underlying issue is dev's not understanding the security mechanisms and libraries they are deploying. That is bad news no matter what tech they are using.

<comment><USER6> If you leave the `alg` field out, the _exact same scenario_ occurs: someone sends you a token, and you fail to authorize using the server-side configured algorithm. Having this field adds nothing of real value.

The only thing having an `alg` field does is make the standard trivially misusable by well-intentioned developers.

</comment></comment></comment></comment></comment></comment><comment><USER7> > Don't use Basic Auth

Why not? If it's an API meant to be consumed by a server I don't see what the problem is.

<comment><USER8> Was going to ask the same question. Assuming https of course, what is the matter with basic auth?

<comment><USER9> I think that the main issue is the client must send what is essentially the plaintext password on every request, meaning the client also must store the password. It might be short-lived, might not, but is a security risk to keep the password around on the client side for the duration of the session.

<comment><USER10> I like to use Basic Auth for API's with clientid/secret pairs. So it's not the user password and individual credentials can be revoked while it's much simpler to implement than full OAuth

If I'm not mistaken Twilio does this too for their API

</comment></comment></comment></comment><comment><USER11> I don't bookmark many links but here's [1] a good one for all to keep on a similar topic.

It's a SO article on security for web transactions.

[1] [https://stackoverflow.com/questions/549/the-definitive- guide...](https://stackoverflow.com/questions/549/the-definitive-guide-to- form-based-website-authentication)

</comment><comment><USER12> No amount of checklisting and best practices substitutes for hiring someone smart to break your stuff and tell you how they did it. You can check all the boxes and still get pwned.

You can learn and run automated tools for 6 months and end up knowing 1/3rd of what a great pentester knows.

If you want to know you can resist an attack from an adversary, you need an adversary. If you want to know that you followed best practices so as to achieve CYA when something bad happens, that's a different story.

But honestly the security picture is so depressing. Most people are saved only because they don't have an active or competent adversary. The defender must get 1,000 things right, the attacker only needs you to mess up one thing.

And then, even when the defender gets everything right, a user inside the organization clicks a bad PDF and now your API is taking fully authenticated requests from an attacker. Good luck with that.

Security, what a situation.

<comment><USER13> > No amount of checklisting and best practices substitutes for hiring someone > smart to break your stuff and tell you how they did it.

Which is not to say that it doesn't help.

As a pen tester, I'd much rather they tick all the boxes and save money because now I don't have to report all the low hanging fruit (which is fun the first two times you pwn an application but gets boring quickly -- I'd rather have something interesting to test).

</comment></comment><comment><USER14> What are peoples thoughts on using TLS client certificates for authentication?

Given we're talking about APIs, we avoid many of the UX problems, but it feels like taking on a different set of problems than just using a bearer token. It does provide baked in solutions for things like revocation and expiry though.

<comment><USER15> I'm not that familiar with TLS client certificates so I'm not qualified to say, but if you consider other developers as your users, then the UX problem remains.

Web developers in general are more familiar with other forms of authentication so unless you have a strong reason for picking TLS client certificates I would suggest picking something else.

In other words: I would be more likely to try out an API if it was based on Basic Authentication. ;-)

</comment></comment><comment><USER16> > Always try to exchange for code not tokens (don't allow > response_type=token).

There is absolutely nothing wrong with the implicit flow if the application (including in-browser ones) is requesting the token for itself (and not for some server or any third party). In case of a standalone app that would be just an extra meaningless step.

There is a slight difference in presence/absence of refresh token, though, but that would make implicit flow _more_ secure (because, if standard-compliant, there won't be any refresh tokens at all), not less.

In case of a browser, the token would end up in the browser's history, but given that a) if browser itself is compromised game is already over, and b) that it's not possible for other parties to access the history (besides some guesswork that doesn't work for tokens), paired with a fact that c) such tokens should be short-lived, it's not a big deal.

> User own resource id should be avoided. Use /me/orders instead of > /user/654321/orders

This has absolutely nothing to do with security. TBH, I don't see any issue if /me/ would be a redirect or an alias for /user/654321/. That may make perfect sense if a conceptual purity is desirable ("for each object there is one and only one URL - the canonical one"), with its pros and cons.

> Don't use auto increment id's use UUID instead.

Similarly, that barely has anything to do with security. One just has to understand that sequential IDs are trivially enumerable (and an obvious consequence of this fact - that API consumers would be able to enumerate all the resources or, at the very least, estimate their cardinality).

And as for the security - it should've probably said UUIDv4, because if one accidentally uses e.g. UUIDv1 their IDs would lose the unguessability.

</comment><comment><USER17> > User own resource id should be avoided. Use /me/orders instead of > /user/654321/orders

Can somebody explain this?

<comment><USER18> what happens if I type in /user/654322/orders instead of /user/654321/orders? Did I just access someone else's account?

<comment><USER19> Yes, if you're a supervisor or parent account or something like that.

Preventing flexibility at the URL level rather than performing proper authentication strikes me as a poor decision.

<comment><USER20> I think this is a rather special usecase, this makes sense with inhouse applications where something like this might be common, but probably not something you want on the public api of a shop.

<comment><USER19> I disagree. What about the support rep, who needs to look at the customer's orders? What if it's a e.g. digital games store, and you want to have kids accounts which can be reviewed by their parents' ? What if you sell to businesses, and you want to let employees purchase stuff without having access to the address and billing info, which is configured by a master account?

You're just tying yourself down for no good reason.

</comment></comment></comment></comment></comment><comment><USER21> So I'm developing a simple SAAS with little to no private info and where failure isn't critical.

For initial release I build a page that uses html buttons and basic javascript to GET pages, passes a key as a parameter, and uses web.py on the backend.

It seems like it would be a lot of work to implement the suggestions here. At what point does it make sense?

</comment><comment><USER22> There is a lot more you can do.

For example you can sign session IDs or API tokens when you issue them. That way you can check them and refuse requests that present invalid tokens without doing any I/O.

<comment><USER23> JWT does that.

</comment></comment><comment><USER24> The guy forgets the main thing here: length, type and range checks!

I'm finding issues like API servers hanging/crashing due to overly long or malformed headers all the time when I work on front-end projects.

Programming in a language with automatic range and type checks does not mean that you can forego vigilance even with the most mundane overflow scenarios: lots of stuff is being handled outside of the "safe" realm or by outside libraries.

</comment><comment><USER25> Not a security topic, but POST is not necessarily "create" and PUT is not necessarily "update".

<comment><USER26> And API's aren't necessarily REST. But this "checklist" is very clearly geared towards a "standard" set of REST APIs. So what's your point, that there are edge-cases in RESTful design?

</comment></comment><comment><USER20> I've filed a pull request to include a CSP technique I've started adding on some of my apis:

[https://github.com/shieldfy/API-Security- Checklist/pull/5](https://github.com/shieldfy/API-Security-Checklist/pull/5)</comment>


Ask HN: Anyone organized a conference? - <AUTHOR> Has anyone here organized a conference? I understand it's quite a big undertaking, but I would be curious to hear about small teams or solo organizers who successfully organized one. Even more interesting might be to hear about failure to organize one.<p>Is it possible to accomplish without significant funding in advance? What kind of profit can you expect to make? <comment><USER2> I've organized both technology and social justice conventions. To answer your questions:

1.) Is it possible to accomplish without significant funding in advance?

Yes, but it's one hell of a lot of extra legwork. When I was in University, I pulled one off without any money at all. It worked, but everything took at least twice the time it would have taken with funding in advance. I struggled with a venue up until the very end and simply cannot describe the stress of losing a venue ten days before an event. It's only 9am where I'm from, but just thinking about this makes me want to break out the hard alcohol...

2.) Profit?

I don't want to seem overly negative, but you may occasionally show a profit, particularly if you're lucky enough to score some good (ie - cash paying) donours/sponsors. However, when you throw an event the expected result is for things to get fucked up in unpredictable ways. And, under the law of throwing big events, the chances are good that the one thing you relied upon the most and considered the most foolproof will end up getting the most fucked up.

Therefore, you may see a profit (and if you do, for the love of all that is holy, share with your army of volunteers). But, the expected profit should always be zero or even a loss.

Here's a tip from the trenches. Make sure that you can personally afford to pay for the venue after the event, even if you don't make a single penny of revenue. Venue managers seem to be a fairly tight knit group and if you get a reputation for screwing one, you'll never book another...

</comment><comment><USER3> Sure do, the company I work for organizes business seminars. We're a small team (6 persons) organizing 15-20 conferences a year. We have two programme managers, two marketers, one person on customer support and one administrator/office support.

The cost breakdown is roughly: 25% speakers 25% location, F&B, tech 25% marketing 25% margin

Starting without funding in advance is damn near impossible. All parties will require an advance, you'll make costs without even having one single paying customer.

Starting an event from scratch is really hard, people won't be familiar with it. There's an old adagio: first time you loose money, second time you break even, third time you'll make profit or you won't exist anymore...

If you have an awesome idea I think the best way for you to go is to partner up with a corporate sponsor who will take care of the costs/risk. However, if you don't have any experience and a network in the field I doubt you'll be able to convince anyone...

Good luck!

</comment><comment><USER4> Is there a trade journal in your domain that you can team up with? Most of the conferences and trade shows in my line of work are owned and run by magazines.

</comment><comment><USER5> I have (More on the Financial Auditing and Web Development side), albeit one not generally related to Technology (Anime Convention)

It's possible to accomplish without significant funding in advance, but you'll either need to have connections or need to think smart. If there's a local University nearby you might be able to get a student organization to book you some rooms for free if your conference aligns with some interests. Some community centers might give you a similar deal. That takes care of the venue[0].

A nearby public park system may also have Shelters or small buildings to rent on the cheap (<$500) but you're less likely to have amenities like Wi-Fi power outlets, and Air Conditioning. It may also not have nearby restaurants if it's out in the sticks. If your guests all have cars and smart phones that's fine and dandy, but some demographics don't. Consider who you're targeting when picking a venue.

If you're doing this without advance funding, you had better have a very small event where you can do everything yourself, or volunteers. If you aren't paying volunteers you had better have some good non-monetary incentives for them [1].

I wouldn't organize this kind of thing from scratch for the profit. Conventions can be profitable, but unless you really hit it out of the park it's not something you can reliably live off of. For perspective the convention I helped organize sees >3000 paid guests annually and gets over 130 paid vendors. Not particularly large, but not really small either[2].

I can tell you now that even with freebies from the university and sponsors we couldn't pay one organizer a livable wage, let alone a team. Part of that is because we don't really milk our guests and we've reached a market cap for are area, but even if we doubled our prices I still don't think we could pay one livable salary reliably.

[0] Depending on the university, you may not be able to charge an entrance fee for rooms obtained in this way.

[1] I suspect this only works for the convention I helped organize because not even the lead organizer gets a dime of payment. Volunteers arguably get better rewards then the "staff" do, because once they've worked a few hours, they get free admission whereas the "staff" are just always working during the event.

[2] Big enough to worry about the fire code and get local newspaper and TV coverage, but not big enough to be considered Wikipedia notable. (Ironically shortly after a Wikipedian accused us of being in bed with local media outlets, our Marketing Director was made a admin of a local newspaper's website. A broken clock is right twice a day.)</comment>


Ask HN: Determining worth and negotiation points during job offer? - <AUTHOR>

I'll be receiving a job offer soon from one of the top 3 and was wondering what your strategies are for determining worth and negotiation points. Fresh BS CS grad, but I'd say I have roughly 4x the work experience of your typical fresh grad at some pretty notable places, the majority of it being pure research in ML and also have a non-profit startup. Is this sort of stuff a negotiation point? <comment><USER2> Yes! You're worth whatever they are willing to pay for you. Since you do you have a ton of experience you should be paid more than other new grads.

Here are some stats about how much developers are making these days [http://blog.goodsense.io/2013/04/02/are-you-an-underpaid- dev...](http://blog.goodsense.io/2013/04/02/are-you-an-underpaid-developer)

<comment><AUTHOR> Thanks! Wow. Those stats seem relatively high for the company I'm negotiating with. They reflect roughly SDE II salary and beyond.</comment></comment>


Ask HN: What is the best part of being an Engineer at Google? - <AUTHOR> Other than the pay/benefits, when it comes to building high quality software, what does Google get right that you wish more start-ups would adopt? <comment><USER2> There is some good perks I think:

\- Access to inmense resources and infraestructure you will never see in an startup. \- Access to many experts in many areas. \- The Google stigma: you are googler, that counts for your later enterpreneurship projects.

<comment><USER3> I've never heard of the Google stigma ... I googled it to no avail. More info pls?

<comment><USER2> It's a metaphor. Once you become Google is something that is attached to your person, everyone call themselves "ex Googler", "former Googler", etc.</comment></comment></comment>


Wuhan Traffic Report - <AUTHOR> https://www.tomtom.com/en_gb/traffic-index/wuhan-traffic/ <comment><AUTHOR> Basic observation: Weekday traffic levels still noticeably down vs 2019 average post lockdown. Weekend traffic still nearly dead.

If this is accurate, nothing about the current congestion levels and patterns appear to be "back to normal".

<comment><USER2> Most of my friends in China are still very reluctant to go out, even though most lockdowns have been lifted. People were much more concerned about it than in Europe / US, and that fear is not going to go away with the lockdowns lifted. That's probably one explanation of why people are still staying inside in the weekends.

<comment><USER3> Perhaps citizens aren't trusting what the government is saying.

<comment><USER2> If we're talking about China, then this has nothing to do with distrusting the government, most people take the government's words for truth. This has more to do with people exercising caution after almost two months in lockdown. Maybe they're aware that even if the lockdown is lifted, the virus still lingers around.

</comment></comment></comment></comment><comment><USER4> Keep in mind that this shows CONGESTION, not traffic. Zero congestion does not mean that no one is on the road; It just means that there is excess capacity compared to usage.

</comment><comment><USER5> During protests in Iran you could see blocked traffic on Google Maps.

There is some interesting data out there I'm sure is being mined, but I'm sure could be mined more. I still don't even see good traffic weather maps. Are people watching for traffic jams outside of submarine facilities?

As I guess expected Wuhan doe not have traffic on Google maps.

I'd be more worried about the factory cities than the hot spot really -

[https://www.tomtom.com/en_gb/traffic-index/guangzhou- traffic...](https://www.tomtom.com/en_gb/traffic-index/guangzhou-traffic/)

</comment><comment><USER6> Baidu Map offers real time traffic map. There is no historical data available though.</comment>


Mac Desktop Apps Said To Price At Low Cost, High Volume Model - <AUTHOR> http://www.appleinsider.com/articles/11/01/04/mac_app_store_developers_aim_for_low_prices_high_volume.html

<comment><AUTHOR> This obviously depends on the app, but my gut instinct says that the mobile app pricing model is not going work for desktop software. I buy a lot of niche tools, so I'm happy to pay the $20-$80 it costs to get a good app. For me, this low cost, high volume business is best reserved for throwaway apps and service-based businesses.

<comment><USER2> I think you underestimate the average mac user and their willingness to pay. I think this model will work well their user base.</comment></comment>


Facebook's Killer Feature: The Mutual Friends List - <AUTHOR> http://bits.blogs.nytimes.com/2009/12/02/facebooks-killer-feature-the-mutual-friends-list/ The list of mutual friends that pops up when you visit someone's Facebook page is underappreciated but immensely valuable in real-world interactions. <comment><USER2> Also useful for identifying actual real-life friends with semi-common names that haven't posted a picture. :)</comment>