What Nassim Taleb can teach us - <AUTHOR> https://mises.org/blog/what-nassim-taleb-can-teach-us <comment><USER2> I really appreciate his books, _The Black Swan_ and _Antifragile_ particularly, though it does seem to me he's set up something of a cottage industry churning the same general idea into a sequence of very similar books. Then again, as long as he has extra stuff to add, and a readership willing to purchase them, I suppose this is utterly acceptable.

However, as a person, he seems to be an absolute rabid nutter. At one point he was planning to publish a book of his own aphorisms, as quoted by himself, while he is still alive. He rants and raves on Twitter[1]. Lately he's been engaged in an utterly hysterical tirade against a historian about the ethnic diversity (or lack thereof) in Roman Britain... whichever side you take in this at an intellectual level (personally, I'm more on his side than not), the tone and mode of the conversation as conducted by him is absolutely rabid and unacceptable.

[1] Full disclosure: he banned me on Twitter years ago because I fucked up an integral he had posed as a question for followers. Make of this what you will.

<comment><USER3> Have you read his books (not just the summary but all the chapters)? While he has good points, he is so egotistical, self-absorbed, and full of pseudo- scientific theories (e.g. that one should go between gorging themselves on food and fasting) that it makes it hard to actually extract out the good parts.

<comment><USER4> Ya, it's really a shame. He's got some very interesting stuff to say, but he's such a completely insufferable jackass. It's really unfortunate. I manage to ignore it and enjoy his books anyway, but he's a pretty easy person to hate.

<comment><USER5> if you start from a position of disdain instead, you'll be able to move past thinking his works have enough value to suffer the bullshit antics and be well on your way to never thinking about him again except in passing social context.

taleb is ultimately just another LARPer. people get the impression that he's something more for ~4 basic reasons:

1\. he's more verbal than them.

2\. they don't know stats too good.

so, given a crisis of confidence in all statistical orthodoxy plus a guy who really really seems to talk like he knows about stats a lot, and whom others — who _also_ don't know stats, but want social proof of reading & shit — say knows about stats, they have no choice but to remain agnostic or go along with taleb's dogmatic-sophist-monkey-dance.

3\. they fail to appreciate that his depth of extended expertise is never more than ankle-deep, and breadth very agonizingly chosen so as to min-max in terms of knowledge required to signal learnedness to the unlearned.

he'll say some poncy shit like « flâneur » out of context _just_ because his readers are unfamiliar with it. he'll go on seeming deep-dives about language evolution and community segregation in the spinning of statistical fables — and it'll be utter horseshit, but nobody reading him will suspect that, and anyone with the requisite expertise to debunk it line by line doesn't give a shit about him and has no incentive to do so: why debunk a LARPer whose entire shtick is being a cleverer obscurant than most with an institutionally-enabled gish gallop lifestyle?

4\. academic culture is so actively pathetic and conflict-avoidant that it's trivial to come across as some sort of masculine breaker-of-chains figure merely by not sucking in the _majority_ mould — sucking differently is sometimes sufficient, at this point.

just look at jordan peterson. i don't intend to imply that he sucks, but _look at him_ , presentation-wise. dude's basically a couple slices of ham held up by suspenders wrapped in a blazer, mouth-hole cut out so wind can blow through, and he's hailed as some kind of triumphant anti-establishment figure simply because culture wars shit has gotten so farcical.

wonks are thrown off by taleb's eagerness to be crass in the middle of otherwise frou-frou discourse, and that's the only thing that gives it any influence — because he discards all epistemic norms in the process. he won't circle back for them if they wait it out, or otherwise re-engage like a good lad. he doesn't choose to be vulgar for shits and giggles while nevertheless maintaining soundness of argumentation, he does it simply as a short- circuiting mechanism.

the posturing is slumming to him: he's aping a working class affectation without the life experience of having an epistemic peer+ interrupt the ritual to physically dickslap him and then resume reasoned discussion.

you see it with the powerlifting posturing as well.

i mean, nobody gives a shit what some physically unremarkable old man lifts. not young girls who don't wanna fuck unremarkable old men, nor young powerlifting guys who don't wanna have their sets interrupted by some old poseur pretending to do a 2016 election exit poll so he can inevitably find that

      HIGH T ⇒ TRUMP VOTER
      LOW T ⇒ HILLURRY

      LUK, A BUNCHA MATHEMATICA BULLSHIT
      BUNCHA MATHEMATICA BULLSHIT ⇒ IMRITE
      AND IT'S A PICTURE SOOOOO…
      YOU CAN'T USE IT W/O TRANSCRIBING IT
      DESPITE ALREADY KNOWING IT'S BULLSHIT
      HEE HAW AREN'T I SUCH TROLE

      GLOBALIST CUCKS BTFO BY #BLACKSWAN

(yeah, this refers to an actual thing⁽¹⁾ he did on twitter)

in fact, the _only_ possible audience for such effete anti-intellectual snobbery is Young Male Scholars™, pencilneck NYU Stern dandies who can project aspirations onto such a transparently less-than-nothing caricature as taleb in the same way that lots of young guys get really into _BEING LIBERTARIAN_ as a social posture & gender identity.

so taleb, then: a brand for dullwits, a statistician who squandered nigh- unsquanderably fortuitous career timing to shitpost about things he just read a single wikipedia entry on, a guy who needed to be spanked a lot more as a kid, gist him however you like.

it doesn't really matter how you do it, because he doesn't matter

____________________

¹ [https://twitter.com/nntaleb/status/814560759577513984](https://twitter.com/nntaleb/status/814560759577513984)

<comment><USER4> I don't disagree with your assessment of his character. But I do think that his insights about risk are, while not _novel_ per se, are interesting. Particularly his concept of 'antifragility'. Now, is that a new idea? No. And it's likely not his idea, either, and he also thinks that it applies way more broadly than it actually does. He's a jackass. But the mental model supposed by Antifragile is an interesting and useful one, and I don't regret having waded through his idiocy to obtain it.

<comment><USER5> Thing is that he picks an organizing principle⁽¹⁾ and rides it into the ground, through the center of the earth, and back out the other side until eventually de-emphasizing it in favor of some new organizing principle more attractive to current audiences.

That is: there are geological layers of taleb based entirely in reader- response. He can't make his subject matter audience-invariant, because how it plays determines its significance to him: it's a feedback loop of bullshit by design. Right now all his acolytes can manage to sputter forth is acronymized slogans like SITG (skin in the game), so that's what he plays up. Formerly it was stuff like antifragility, etc. It just keeps devolving.

____________________

¹ [http://enwp.org/organizing_principle](http://enwp.org/organizing_principle)

<comment><USER4> > Thing is that he picks an organizing principle⁽¹⁾ and rides it into the > ground, through the center of the earth, and back out the other side until > eventually de-emphasizing it in favor of some new organizing principle more > attractive to current audiences.

I don't disagree, but I think that the organizing principles he's settled upon (by whatever process) are interesting.

<comment><USER5> the poetics of successful sophistry is a potential research topic in its own right, so sure

<comment><USER4> It is possible to find a man to be a jackass, and have a few interesting ideas simultaneously. You haven't attempted to criticize any of his actual ideas, just his presentation of them. A criticism I agree with, though in so doing you're really committing his own primary sin: Trying to defeat substance by criticizing style. If you've got specific gripes with his math, i'd be curious to hear that, or criticisms of his actual _ideas_ i'd be curious to hear those too.

<comment><USER5> Trouble there is simple: academically, he hasn't really innovated anything substantial enough to bother discussing in isolation. I mean that in a purely descriptive sense.

Just take a look at his google scholar⁽¹⁾ or crossref search⁽²⁾ hits and gloss over the books, republications of books, translations of books. What remains are miscellaneous vagaries about tail risk etc. In particular, lots of reviews / position papers that amount to him just setting up strawmen to tear down.

That contrarian browbeating is what drove him to prominence. And in sole- author article form, the attendant research laziness manifests itself as junk like this⁽³⁾ thing that's lower quality discussion of the subject matter than a lot of replication forum posts.

____________________

¹ [https://scholar.google.com/citations?hl=en&user=64BtMdsAAAAJ](https://scholar.google.com/citations?hl=en&user=64BtMdsAAAAJ)

² [https://search.crossref.org/?q=%2BNassim+%2BTaleb&type=Journ...](https://search.crossref.org/?q=%2BNassim+%2BTaleb&type=Journal+Article)

³ Taleb, N.N., 2016. The Meta-Distribution of Standard P-Values. SSRN. [http://doi.org/10.2139/ssrn.2834266](http://doi.org/10.2139/ssrn.2834266)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Taleb holds that essentially all journalists are fools, and the articles they publish are "noise". He says "to cure yourself of newspapers, spend a year reading the previous week's newspapers". There's wisdom in this: the importance of the news of the day can't be immediately apprehended. What seems important at the time can quickly fade into irrelevance. Larger stories are often completely missed or gotten totally wrong.

Buuuuuut apparently what Taleb means is that _no one but him_ can figure out the importance of things immediately. The guy tweets, apparently believing that he understands the lasting importance of what he's tweeting about. And hey, maybe he does... except, among other things, he's in (or was in) a twitter war with JK Rowling!

The guy is a loon who has figured a lot of things out, and now believes he knows everything.

<comment><USER7> He totally lost me when he started talking about Michael Flynn being one of the great military minds or praising The Mooch's rant and "being direct, natural, and nononsense".

Seems like a smart guy but...

</comment></comment><comment><USER8> I love Nassim Taleb as an academic and philosopher. I think he has a Peter Thiel like quality of being able to thinking differently, but in a very applicable way.

Nassim Taleb the author though I really can't get into, and to be fair he's had so much success that this is probably my fault.

If you want to get the most out of his work then read his medium blog. Most of his pieces are written in easily digestible formats.

[https://medium.com/@nntaleb](https://medium.com/@nntaleb)

I've re-started trying to read the Black Swan about 10 times and IMHO if you just read the first 3 chapters then you'll get about 95% of what you would if you had read the entire book.

I think the problem with his books that I have is that he considers himself not just an author but a modern day philosopher, and with that comes a level of rigor in his writing that brings me back to my measure theory and real analysis courses.

If you really want to read his books, then start backwards.

Antifragile is awesome, but still very wordy, and builds on top of all his other works. It almost seems to be the culmination of the idea's he's been writing about since the black Swan.

As a side note, for anyone who wants to learn about options trading with a focus on how a trader would view them, ie from a mathematical perspective, then check out one of his first books...... Dynamic Hedging of Options.

[http://ca.wiley.com/WileyCDA/WileyTitle/productCd-0471152803...](http://ca.wiley.com/WileyCDA/WileyTitle/productCd-0471152803.html)

As a second side note........

His latest concept of "Skin in the game" is the best form of risk control that we've found for reigning in traders. Once traders are required to

1) keep the vast majority of their bonus in the fund for a few years

2) take part of their bonus in the form of non liquid securities if they want to hold more than a certain percentage of their portfolio in non liquid assets

we have found they pay alot more attention to the liquidity of their portfolio and the long term profitability of their portfolio, both of which are good for the long term success of the fund.

<comment><USER9> Or bonuses should be based on what happens during a long period of time. Say you lead a company from 2015 to 2020, but your bonus is based on how well the company does from 2020 through 2025. And if the company fails before you get your bonus, too bad for you.

I haven't read his books but find his ideas as presented in videos and podcasts to be valuable.

<comment><USER10> That's exactly the idea. Your bonuses 2015-2020 are invested in the company every year, and you can only cash them out after five years, in 2020-2025. If the company tanks in 2020 your bonuses for 2015-2020 are retroactively zero.

<comment><USER9> I think companies should be rated by how much skin in the game its leaders have.

Companies run by founders that still have a substantial percentage of their wealth in the company would get the highest rating. And professional managers getting stock-based short term incentives would be on the low end.

</comment></comment></comment></comment><comment><USER11> Jeff Deist, the author of this article is a crypto white nationalist. You can pick up a hint of this from the article above,

"He understands that globalism is not liberalism, that identity and culture matter"

A quote from another article,

"Jeff Deist, President of the Ludwig von Mises Institute, a right-libertarian think tank for promoting Rothbardian anarcho-capitalism and the Austrian School of economics, said of the Alt-right that he found their writings "interesting...and somewhat refreshing".[20] In 2017, Deist concluded a speech at the Mises Institute titled 'For a New Libertarian' with the words, "In other words, blood and soil and God and nation still matter to people. Libertarians ignore this at the risk of irrelevance."[21]

[https://en.wikipedia.org/wiki/Paleolibertarianism#United_Sta...](https://en.wikipedia.org/wiki/Paleolibertarianism#United_States)

Note that "blood and soil" refers to the nazi phrase "blut and boden".

<comment><USER12> Why is he a 'white nationalist' and not just a 'nationalist'?

Do you have any indication that, so long as people conform to his idea of what his country's culture should be, that he wouldn't accept black, asian, etc people?

<comment><USER11> I just brought up his use of the nazi slogan "blood and soil".

Also, listen to this. It's Jeff Deist's take on Richard Spencer.

[https://www.youtube.com/watch?v=l6kJNHZvanI&t=1s](https://www.youtube.com/watch?v=l6kJNHZvanI&t=1s)

Within the video Deist advocates for what he calls a "Benedict Option" whereby a white ethnostate would secede from the US.

Overall the tone of the video is that Deist disagrees with Richard Spencer's economic stance, but that he doesn't take issue with Spencer's views on race.

</comment></comment></comment><comment><USER13> The Black Swan has a good point to make about reliance on over-simplified mathematical models, but Taleb's macho anti-intellectualism is ultimately nihilistic since he denies even the possibility of achieving a deeper mathematical understanding of risk. But what I really have a problem with is that he has created a band of idiot Twitter acolytes who can be counted on to heap brainless abuse at anyone who Taleb chooses to disagree with, which these days seems to be almost everyone with even slightly diverging views to his. He will not attempt reasonable debate, especially when he is faced with superior erudition: in this regard Mary Beard is only the latest of his many victims. The guy is a pure and simple thug.

<comment><USER14> I followed the drama around it and my end conclusion (to paraphrase somebody's tweet)

Mary Beard is respectable, well educated and gracious. Taleb is right.

</comment></comment><comment><USER15> How to be a blowhard...

</comment><comment><USER16> I see more people are now against hims since he stopped virtue signalling.</comment>


MIT scholars produce new method of harvesting correct answers from groups - <AUTHOR> http://news.mit.edu/2017/algorithm-better-wisdom-crowds-0125 <comment><USER2> A link to the actual paper:

[http://www.nature.com/nature/journal/v541/n7638/full/nature2...](http://www.nature.com/nature/journal/v541/n7638/full/nature21054.html)

This method has actually been discussed for some time now, and I'm surprised the abstract wasn't written that way. I think it was referred to as the "oracle method" in a prior publication, although it's been awhile. I tried looking for it but realized all the keywords I would think of first bring up many unrelated hits.

The previous paper I'm thinking of couched it in terms of identifying experts, I think, under the premise that experts should both understand others' predictions and have a more accurate prediction, and therefore should be weightedly more heavily. But the upshot was the same: that surprisingly correct answers were more likely to be accurate.

I might be remembering the details incorrectly, but my first thought when I saw this was "oh, I wonder if this is a new paper by that same group."</comment>


Bing and Wolfram Alpha BMI calculation - <AUTHOR>

Do you get Wolfram Alfa BMI calculator when you search Bing for "bmi calculate" as claimed in MS blog http://www.bing.com/community/blogs/search/archive/2009/11/11/how-many-calories-in-a-burger-what-s-2-2-2-2-2-bing-and-wolfram-alpha-have-the-answers.aspx
I don't see it:
http://www.bing.com/search?q=bmi+calculate&go=&form=QBLH&qs=n <comment><AUTHOR> Live links

[http://www.bing.com/community/blogs/search/archive/2009/11/1...](http://www.bing.com/community/blogs/search/archive/2009/11/11/how- many-calories-in-a-burger-what-s-2-2-2-2-2-bing-and-wolfram-alpha-have-the- answers.aspx)

[http://www.bing.com/search?q=bmi+calculate&go=&form=...](http://www.bing.com/search?q=bmi+calculate&go=&form=QBLH&qs=n)</comment>


So How Do We Fix the Patent System? - <AUTHOR> http://www.phphosts.org/2011/08/so-how-do-we-fix-the-patent-system/

<comment><USER2> Best to go over to techdirt.com for the original, plus the usual stimulating comebacks to persistent "Intellectual Property" maximalist trolls.</comment>


PDFMiner: Python PDF text parser - <AUTHOR> http://www.unixuser.org/~euske/python/pdfminer/index.html <comment><USER2> Does anyone know of a good way of converting MS OpenXML (docx, pptx etc) and old Word (doc, ppt etc) files to txt through command line Linux?

<comment><USER3> xlhtml will work for .xls files. I'm not aware of one utility that will read out the text reliably from all MS formats though. I've been pondering this same problem as of late and have been thinking about a virtual machine approach.

have a conversion "service" running in a Windows VM that has the latest office installed. Use something like Python with the pywin32 module to extract text via COM.

Advantage there is you don't have to worry about your thing breaking with new releases of Office, you just upgrade to the latest version.

Disadvantage obviously, the overhead of the VM cost of a windows and office license and need to role back the vm snapshot from time to time if you get any viruses.

<comment><USER2> I'm hoping there's a way to automate it through OO.o... I'm pretty sure you can run it headless.

<comment><USER4> _"... I'm hoping there's a way to automate it through OO.o. ..."_

Try <http://search.cpan.org/dist/OpenOffice-OODoc/> and <http://search.cpan.org/dist/OpenOffice-OODoc/OODoc/Intro.pod> I've had some success parsing Open Office docs & word docs to text. Be prepared to parse XML and read the spec.

</comment></comment></comment></comment><comment><USER5> Been looking for something like this for a while now. Thanks. Wonder if there is a Ruby effort underway.</comment>


Lessons From a Failed Startup - <AUTHOR> http://thenextweb.com/in/2011/07/25/lessons-from-a-failed-startup/

<comment><USER2> great article</comment>


I had a feeling that flatironjs is coded by amateurs its down - <AUTHOR> http://flatironjs.org

<comment><USER2> it's</comment>


Map of Travel Time to Major Cities: A global map of Accessibility - <AUTHOR> http://gem.jrc.ec.europa.eu/gam/index.htm <comment><USER2> This is a really cool map. It seems fairly accurate from my experience.

What I'd like to see now is a map of global network inter-connectivity and reliability super-imposed on this map.

[edit for typo]

</comment><comment><USER3> I was hoping that this was a map of time travel to various cities, possibly with details on the modifications to history that resulted.

</comment><comment><USER4> I love that Tibet is one of the most remote regions...looks like even more so than the middle of the Sahara.</comment>


I've Worked with Hundreds of Recruiters – Here's What I Learned - <AUTHOR> http://firstround.com/article/Ive-Worked-with-Hundreds-of-Recruiters-Heres-What-I-Learned <comment><USER2> I just wish we could solve this recruiter problem. For an industry full of problem solvers, nobody seems too keen on really fixing this.

1\. Programmers don't like recruiters and would prefer not to have to work with them.

2\. Companies think recruiting firms are experts and are adept at finding qualified candidates, which is false.

3\. There are good companies that need good employees and good employees who want to work at good companies. Currently the 'solution' is to use the same corporate middle men who shuffle bad employees to bad companies and mediocre employees to mediocre companies.

<comment><USER3> Recruiter here (independent agency), and I've always felt that the problem is that fees are too high. With this much money being thrown at recruiters, it keeps the bad ones in the business. If fees were lower, only the best recruiters would survive - as well as those that are just best at making money, which doesn't necessarily mean 'best' \- and eventually most of the bottom recruiters would exit the market.

Contingency recruiting is the overall source of the problem. Someone could make a few lucky hits a year and make good enough money to stay in business. If fees were say half of what they are now, that would put many out of business, and I'd assume those would the recruiters that everyone complains about.

The size of fees also leads to the ethics problems. You may or may not lie for $5, but what kind of lies might you tell for say $30,000? The large numbers and competitive nature make it a high-reward game that gives incentive to cheat and lie when necessary.

Smaller fees. I use small flat fees with a portion paid up front. The fees are small enough that I have little incentive to lie, and the up front portion is small enough that I'm going to hustle to get the second payment.

Contingency recruiters absorb 100% of the risk, meaning they can work hundreds of hours on a search but if the recruiter down the street fills it they get nothing. This is the reason fees are high - the risk factor. If you remove that risk to some degree (or share the risk) by paying some money up front, recruiters should agree to lower fees and companies should like the results.

As a recruiter, would I rather compete against 20 bigger firms for a 30K fee or would I rather be practically guaranteed a 15K fee? The answer for me is the latter, but may differ for others.

<comment><USER4> I frankly don't care much about fees.

I care a _lot_ about recruiters utterly wasting my time with garbage resumes, even when I've told them what I wanted.

I would prefer to see two or three resumes a month of people I want to talk to than two or three resumes a day of people that don't meet the bar.

Most of the good hires come from referrals anyway. Very, very few recruiter- fed folks have passed interviews and worked out, at any company I've worked at.

<comment><USER3> If you want two or three good resumes a month, you should pay recruiters some money in advance as I suggest. When on retainer, you don't feel a need to send unqualified candidates to give a client the impression you are working hard. Contingency recruiting is the reason you get three unqualified resumes a day.

Take away the recruiters incentive to send everybody they see, and you'll see quality go up.

<comment><USER5> You've given some good feedback here from the perspective of a recruiter, but I think there's a point being overlooked in the conversation: most recruiters don't seem to know that they are sending an unqualified candidates. That is to say, they are either lazy and haven't done any due diligence on the candidate, or more likely, they don't actually understand the skills at play and lack the ability to assess whether the candidate is qualified. A candidate is a string of buzzwords that they can bill out at X with margin Y. That seems to be the only things the typical recruiter knows. I'm sure there are excellent tech recruiters out there, but they must be as rare as good technical talent itself.

<comment><USER3> Thanks. And I agree. I, and you as well it seems, would like to smoke those people out of the market. If companies only used firms that did a good job and didn't give out their searches to every firm out there, those recruiters will be put out of business eventually. Some might get hired by these better firms who now have increased demand, and hopefully the bad recruiters who now work for good firms will learn.

Sounds easier than it is, but it starts with lower fees in my mind.

</comment></comment></comment></comment></comment></comment><comment><USER6> Are a lot of company founders really asking "How do I find a Great Recruiter?" instead of "How do I find a great employee?"

<comment><USER3> In my experience as a recruiter, founders have a very easy time finding their first few hires as they are all from the friends and family plan - all known quantities to some degree, perhaps a 2nd degree connection at worst. Then those few hires are probably good for a few more referrals.

Business starts picking up, all employees are working at capacity, and suddenly the pipeline dries up. This is when founders (and engineering leaders) start hitting up recruiters from their past. It's also the point where the company might be on the radar of recruiters, so engineering leaders are also getting incoming calls soliciting their business.

</comment></comment><comment><USER7> Is there a version of this article for candidates? I don't have the network to be able to make a couple of phone calls and have a job in a week, so I'm interested in using a recruiter, but I don't know any good ones.

<comment><USER8> [http://jobtipsforgeeks.com/2013/08/09/pretty/](http://jobtipsforgeeks.com/2013/08/09/pretty/) is a good read for someone who is interested in finding a recruiter. One thing that the writer didn't mention was that some recruiters focus on jobs for a specific tech stack so you may want to look around their profile for a bit on LinkedIn to get a good idea of what they focus on.

<comment><USER3> Hey, I wrote that! +1 on what you said about tech stack, but I think fewer recruiters focus on tech stack these days. I think you are more likely to find recruiters with depth in a specific geography than a single language/platform.

</comment></comment></comment><comment><USER9> and I thought this was going to be for the hunted...

</comment><comment><USER10> recruiters are old news, try using Mighty Spring ([https://www.mightyspring.com/](https://www.mightyspring.com/)).</comment>


Women in crypto - <AUTHOR> https://firstname.lastname@example.com/women-in-crypto-3972d6c45442 <comment><USER2> It's getting obvious now the scam faux outrage these people are pulling isn't it? I think it's transparent more so in this instance because... "the crypto currency industry" if that's even really such a thing, started like yesterday.

And has everyone not been beat over the head with gender bias this, misogyny that.. to an extant that were not gonna buy it this time? Who are these oppressive men running the decentralized crypto industry holding women back?

And from what exactly... buying bitcoin? Running a mining rig? Pretty sure it's an open market and women's fiat is as good as men's.

Oh.. oh people didn't talk to you at "crypto currency events".

Ohh... you want men to pay for subsidized tickets. I see.

Does anyone read that blog and, gender aside, feel like that's someone you'd enjoy hanging out with? Didn't think so...

<comment><USER3> My experience so far with women in cryptocurrency as someone who attends quite a few meetups:

The Beginner - Doesn't know much about cryptocurrency or technology in general, wants to learn about it for various reasons. There are men who fall into this category of course. I usually enjoy talking to these people.

The Enthusiast - Knowledgeable and experienced in cryptocurrency topics. Fun to talk to.

The Feminist - Might know something about cryptocurrency, but all she seems to do is plug the various "women in cryptocurrency" groups around the city. Rarely contributes to the conversation. Writes whiny blog/Twitter posts like this one.

I think everyone is getting tired of this browbeating.

<comment><USER4> I can write blog posts like this one and be knowledgeable and experienced in cryptocurrency topics. Feel free to check out some of my other Medium posts [https://firstname.lastname@example.com/](https://email@example.com/)

</comment></comment></comment><comment><USER5> People today get upset about fucking everything.

Lets break the points down, shall we?

> introduces himself to the men in a group but ignores the women

Just bad behavior. Hard to say anything else about such a general claim. I can't say I share this experience.

> makes eye contact with the men while speaking and ignores the women

Well if you make eye contact with women today, some get offended so easily that they write blog posts and even accuse men of being creeps. If we don't, obviously we do not respect you.

> asks a woman if she is a plus one at the event acts surprised to discover a > woman knows about cryptocurrencies

Not weird at all, how many women have you met that knows a lot about cryptocurrencies? Seriously, this is just statistics. Of course people are going to be surprised of this. It's like being mad about a person acting suprised in learning that another person never have taken a car ride.

> comments on the woman's appearance rather than what she is saying

Most men are attracted to women in general, so unless this is in a moment that is highly unprofessional I am not surprised. However, I have pretty much never witnessed this except on psuedo-anonymous places like comment sections on internet, never IRL in a professional context.

Personally, I follow people because what they do / what they have to say. I also believe most men do that. I am very tired of feminism and this constant nagging. In fact, it is my experience that women follow and judges people a lot more based on their looks and not what they actually have to say.

<comment><USER6> "Not weird at all, how many women have you met that knows a lot about cryptocurrencies?"

Overwhelming majority of men don't know about cryptocurrencies either. It is only people who go to tech events who do. Of people who go to meetups and such, I haven't seen any +1 of any gender. The assumption that if you went to tech event then you know about tech seems safe for anyone.

And dunno, going meta offended over someone expressing that yep, this makes women questioning whether they are treated equally behind back is, well, being special snowflake too. You just explained to me what for construct is instead of reacting to my proposal seriously, do you want me to pretend I think I am treated equally?

I know I am not, you know I am not (because statistics), so why expectation to pretend otherwise? It is just a lie.

<comment><USER5> Depends completetly on the event. The author doesn't specify any example of what type of event this regards (except that it is a "crypto event").

> I haven't seen any +1 of any gender

Sure this is probably quite uncommon on most tech events and meetups but there are several events where people bring family that is related to technology.

> And dunno, going meta offended over someone expressing that yep, this makes > [...]

I am not offended, I am simply tired to hear this over and over when in reality it at least for me seems to almost never happen.

> I know I am not, you know I am not (because statistics), so why expectation > to pretend otherwise? It is just a lie.

I think women and men are treated equally, at least where I live and in all the events I've attended. Of course people are going to be douchebags and uncomfortable situations between genders are going to occur, but this is true for everyone. I have been disrespected by both women and men but I do not get upset about all of them because of it.

<comment><USER7> So your position is:

"I don't experience this so it probably doesn't happen often but others should stop talking about it because I'm tired how often this comes up."

I'm curious what aspect of your contribution you think contributes to anything.

<comment><USER5> No my position is a tad more complicated than that.

My position is that of course people should voice concern over actual discrimination based on gender. But this rant on social interactions in which there is no evidence presented and just big claims that this happens a lot is simply what is is, big claims.

I claim that this don't happen as often as some people suggests, a claim that is just as valid as the authors. My position is that this hurts women in tech and diversity as a whole.

Baseless arguments like the authors contributes to the toxic environment we have today where everything you do is wrong. Just take that conference Github was supposed to have. They picked all candidates from without knowing gender or anything about the authors (blind review) [1] and when it was discovered every presenter picked was a male, the conference was cancelled because meritocracy is appearantly not ok if only men were selected even if their talks were deemed superior [2].

This is just one demonstration about the extreme views that is hurting equality. Another is Brit Ruby 2013 which was cancelled for the same reasons basically: [https://gist.github.com/seanhandley/4106776](https://gist.github.com/seanhandley/4106776)

And it is just the absolute top of the mountain, there are so many stupid things going on in the name of equality and diversity it's unbelievable.

If we are not supposed to care about genders, why do we care if there is more women in tech at all?

[1] [https://cfp.githubapp.com/events/electronconf-2017](https://cfp.githubapp.com/events/electronconf-2017) [2] [https://news.ycombinator.com/item?id=14480868](https://news.ycombinator.com/item?id=14480868)

<comment><USER7> your position is the same as I stated but you have rationale behind it. I get that. the issue I have is still the same though, you're projecting your experience onto others and expecting an argument where none is being made.

as a woman in cryptocurrency, this isn't a valuable resource because it proves our work environment sucks. it's speaking to others like me who already know our work environment sucks and signals to each other so we can at least create spaces where not everything is terrible. don't think there's a problem? cool. it's not a universal experience, just common which is why you hear about it all the time. we're not looking for your help except to do your part or get out of the way.

I'm honestly taken back every time I read opinions like yours since you don't experience this, think these are claims that need evidence, and want to shut down debate over something that doesn't impact you. I can only assume you're somehow threatened but I struggle to see how. men feeling threatened by women talking about their spaces is very strange but maybe that's because you think we're saying something about you when we complain about how we're treated.

<comment><USER5> > your position is the same as I stated but you have rationale behind it. I > get that.

But it is not. Which I just explained why. The difference is that the things I complain about is specific examples with data to back it up. The author and other people similar just throw out random shit that is as provable as a religious experience.

> it's speaking to others like me who already know our work environment sucks

Great attitude there buddy.

> think these are claims that need evidence

I provided evidence for the examples I brought up, the rest is just as the authors anecdotal with no evidence. This is my whole point.

> I can only assume you're somehow threatened but I struggle to see how. men > feeling threatened by women talking about their spaces is very strange

Why do people always resort to this jargon? I am not "threatened" I just do not like discrimination based on gender and I believe that is happening more towards men than women in tech today. It is happening in the name of diversity and equality.

<comment><USER7> > I just do not like discrimination based on gender

if you feel that way then maybe don't drop into a conversation women started to tell them their likely misinterpreting situations and need to provide better evidence before you'll take their claims seriously. maybe don't go point-by-point refuting their experiences as conjecture then center discrimination concerns against men. maybe don't engage others who, like you, don't like discrimination based on gender with the opening line:

> People today get upset about fucking everything.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> > makes eye contact with the men while speaking and ignores the women

Maybe they want to avoid accusations of flirting, being a creep and/or sexual accusations? Wouldn't surprise me, in this atmosphere...

<comment><USER9> What atmosphere? I can look around right now and see 10+ male-female conversations happening with eye contact and no accusations of flirting, being a creep, etc.

<comment><USER10> sure you are in tech?

</comment></comment></comment><comment><USER11> Sorry for the angry rant and I know this doesn't follow the general opinion of HN.

But who cares. Why is it important to write an article of women in [Insert X]. Their gender is not important, and quite frankly demeaning of their efforts to further the field.

Try to stray away from ad hominem

<comment><USER12> You can easily restate the whole blog post and include other categories that are often victims of the same behaviors, because of physical differences, gender, nationality, and so forth. Yes, focusing _just_ on women is not optimal IMHO because this also happens to other persons that should be defended as well, however it makes sense to remark that women are a "notable" category of discrimination. Also for the problems exposed in this blog post, I think the author really nailed it, and certain things are women-specific, like focusing and making a comment on the beauty instead of content, and also this eye contact thing. But in general it should always be remembered that the same happens to other categories.

<comment><USER4> Absolutely, I included in the post that gender was only one aspect of diversity that I was focusing on in the post but should have made that more clear.

</comment></comment></comment><comment><USER13> > introduces himself to the men in a group but ignores the women

> makes eye contact with the men while speaking and ignores the women

I'm guilty of this but it's because I'm nervous about interacting with women in general.

<comment><USER14> Doubly so because there's strong punishments (being kicked out due to violating the CoC / making people feel uncomfortable, publicly shamed on twitter / blogs, etc) if you say the wrong thing. Not engaging at all is the safest course of action.

<comment><USER13> I'm not nervous about that though. I simply lack self-confidence. As soon as I make eye-contact with a girl I look away.

</comment></comment></comment><comment><USER15> Is it just me or do others out there also get angry when people refer to "crytocurrency" as "crypto"? I know perhaps in their circles it's a handy abbreviated word for "cryptocurrency", which admittedly is a mouthful, but this just makes me angry that they would conflate "crypto" (upon which the whole basis of the modern internet is built on), with a form of currency that people have no idea about and are just mindlessly speculating on. Perhaps it's because I've taken some classes on cryptography and understand how beautiful a subject it is, that I find it demeaning for people to use "crypto" to mean "cryptocurrency".

<comment><USER4> "Crypto" has been used as the abbreviation in the space but note taken and will refer to "cryptocurrency" in future posts to not conflate the two.

</comment></comment><comment><USER16> The blog post is not about cryptography but crypto currencies. This should be mentioned in the title.

</comment><comment><USER12> "introduces himself to the men in a group but ignores the women"

A truly terrible thing is that I see this happening even in other contexts that have nothing to do with work. Sometimes women are just ignored for the first part of the conversation, or men will just look at other men when saying something. I hate it, it's deeply offensive, however the cool thing is that it takes just a single person to change the shape of the conversation and include everybody. P.S. the same thing is observed often with teenagers as well, which is equally disgusting.

<comment><USER17> >I hate it, it's deeply offensive

Deeply offensive, really? You must be exhausted from being so deeply offended all of the time.

It's hyperbolic language like this that is really divisive because it makes people defensive when you're putting their actions in the same category of murders and violence (the "deeply offensive" category).

<comment><AUTHOR> The "offensive" attribute aside (which I also have issues with in many contexts), doesn't antirez have a point?

<comment><USER18> In order for antirez to have a point, let assume we built an experimental environment with cameras to observe how people behave.

Let say we want to observe how eye contact is being made, in which order, and to whom and at what rate when a test person enters a group to introduce themselves. Variables we adjust are among things like hight, age, gender of test subject, gender distribution of the test group, appearance of strength, social economical status signals, gait, posture, and olfaction.

Then we take a base line, and compare that to when we change a single variable. The question to be answered is: which variable has no effect, which variable has biggest effect, and what is the underlying reason when an variable has an effect.

</comment></comment></comment></comment><comment><USER19> the main problem in the crypto or tech industry is not the misogyny it is the fact that the few women that have public visibility and power are scammers or frauds at best, just look at marissa mayer, ellen pao, Elizabeth holmes and now for crypto just look at paragon coin, google the ceo, breaking eggs on her half naked body in a tesla car on a clip and taking selfies in front of a pile of cash to promote her ICO.

When women will stop blame men and stop idolizing a woman in tech just because she is a woman and not because she is doing great things (and there are legions of women in tech with no public exposure doing that) then we will move forward.

<comment><USER20> A counter-argument: majority of visible anything in cryptofin is a fraud, or shady at best.

</comment></comment><comment><USER21> Thanks for the article ! I enjoy reading testimonies about misogyny in science and tech industry as it gives interesting insights on what concrete problems I can address.

As for other comments, I am really annoyed that mostly people come just here to complain that such article exists, and take all the space. Just drop it ! The atmosphere is becoming as bad as reddit regarding misogyny. Can't you just admit you are not interested/don't get it for the moment and go somewhere else ?

<comment><USER9> > The atmosphere is becoming as bad as reddit regarding misogyny.

As long as I've been on HN, it's been a pretty misogynist place but yeah, it's definitely getting more toxic.

</comment></comment><comment><USER22> front page article, loaded with comments opposing its position with vitriol. HN as ever.

<comment><USER6> I mean, there is one comment that disagrees? As much as I disagree with that one, calling it vitriol is an overstatement. And one that claims bitcoins are scam which is attack on bitcoins not on women?

<comment><USER22> One comment? The only positive one I saw was antirez's at the time I wrote this, and as of now the top comment calls it "scam faux outrage," the reply to which insinuates that this person is not worth listening to on this subject and/or is less experienced because they're a feminist, accusing feminists of "browbeating."

The second comment from the top is your typical "kids these days" trope about snowflakes and says they're "very tired of feminism."

Further down people imply you can't talk to women anymore because you'll be accused of harassment for no reason ("Wouldn't surprise me, in this atmosphere..."), dismissively ask why this needs to be discussed, blame the humanities for killing America with the cult of identity politics, claim all powerful women in tech are frauds, bemoaning this being "another SJW crybaby piece," and finally, above that one, someone who noticed the same thing I did ("As for other comments, I am really annoyed that mostly people come just here to complain that such article exists, and take all the space.") and someone who agrees with them.</comment></comment></comment>


Ask HN: Where can I learn autoconf, automake and make? - <AUTHOR> I am struggling to learn how popular projects maintain their build process using their configure scripts and Makefiles. I have come to known that they mostly use autoconf, automake, libtool and make. But is there any resource which takes us through this process step by step? Maybe with examples and links to documentations for further studies. <comment><USER2> [https://www.sourceware.org/autobook/](https://www.sourceware.org/autobook/)

</comment><comment><USER3> I am a huge fan of "Learn X in Y Minutes". If you already have a good technical background, these articles are a great intro to a lot of technologies.

[https://learnxinyminutes.com/docs/make/](https://learnxinyminutes.com/docs/make/)

I only see make here, though, not automake or autoconf.

</comment><comment><USER4> I'd just suggest creating your own side project and copy a make file that uses the same tech stack and see how they do. Strip it down move it all around. Good ol messing around!</comment>


$89 Drum Machine Data Transfers Through Sound - <AUTHOR> https://teenage.engineering/products/po-32 <comment><USER2> And it just has to be next to a picture of a Macbook. Why can't anybody "think different?"</comment>


Your Facebook profile picture may be going into a facial-recognition database - <AUTHOR> http://www.thestar.com/business/2013/08/30/your_facebook_profile_picture_may_be_going_into_a_facialrecognition_database.html <comment><USER2> Is that news? For how long now do they "suggest friends on that picture"? I'm off facebook now for at least one and a half years, even before they "deactivated" (made it invisible) for EU users. Anyone thought there are facebook moderators suggesting friends in just milliseconds while uploading? I personally was shocked it suggested me standing aside in the far background - I didn't recognize myself that fast!

</comment><comment><USER3> Still want to use Facebook to remain connected, never like/comment anything, never post a picture or a status update. If you want to chat, tell the user to use one of the apps listed on [https://prism-break.org](https://prism- break.org)</comment>


Preventing heartbleed bugs with safe programming languages - <AUTHOR> http://bluishcoder.co.nz/2014/04/11/preventing-heartbleed-bugs-with-safe-languages.html <comment><USER2> To take it one step further, it might be a good idea to specify the whole thing in Coq, prove correctness and derive the C code from there. Coq is a theorem prover based on the Martin-Löf type theory like the ATS mentioned in the article. Xavier Leroy (the man behind OCaml) managed to write a whole verified C compiler in Coq[1] so while it's slower than writing C directly it should still be feasible for projects of such critical importance.

On a related note, mathematicians are also finding it increasingly difficult to trust unverified proofs. Papers by Vladimir Voevodsky, a Fields medalist and one of the most prominent in the field, were also discovered to contain errors more than ten years after publication, having been cited hundreds of times and nobody noticing the errors in the proofs. This was one of the principal motivations for him to initiate the project for homotopy type theory, which also has roots in Martin-Löf type theory and is also being developed formally in Coq.

[1][http://compcert.inria.fr/diagram.png](http://compcert.inria.fr/diagram.png)

<comment> jude- I've said it before and I'll say it again.

Formalizing the TLS specification and proving that an implementation is consistent with it only shows that the implementation is _logically correct_. However, it does NOT show that the implementation is _secure_. Your implementation can be vulnerable to side-channel attacks (particularly timing attacks) while still being logically correct.

Proofs of correctness are a (big) step in the right direction, but they're not a silver bullet for building a secure implementation.

<comment><USER3> You can use mathematics to prove other things as well. You could e.g. use a special bool type for all secure data that you can't branch on, so that no secrets could be exposed by examining the runtime path of execution. Or build a model of your CPU's caching and prefetching behaviour and prove that you're code doesn't expose any secrets by that channel.

<comment> jude- Right--this will work on some types of side-channel attacks. For example, I could prove that my decryption function runs in a constant amount of time no matter the input.

However, you can't proactively defend against side-channel attacks. By definition, a side-channel attack exists because the designer didn't know that the cryptosystem leaks information when (s)he designed and proved the correctness of the implementation.

Proving that the cryptosystem doesn't leak information is damn nigh impossible, and often outside the scope of software engineering. My favorite example is acoustic analysis ([https://www.cs.tau.ac.il/~tromer/acoustic/](https://www.cs.tau.ac.il/~tromer/acoustic/)). Before this was shown to be possible, how were cryptosystem designers supposed to know to defend against it?

The best we can do is come up with and formalize a threat model, and then prove that the cryptosystem is secure against the adversaries in the threat model. The problem is that threat models don't help you with adversaries in the future, who have means of getting information from your cryptosystem that you didn't think of.

<comment><USER4> I take your point, but I don't think _anything_ can defend against unknown attacks. However, we could defend against all known attacks using formal methods, which is a lot better than we're doing at the moment. Further, when a new attack becomes known, I would wager that having something that is verifiable today will be easier to verify or fix in the future, as compared to a code-base that is not provable.

Just because we can't achieve theoretical perfection, we should not rule out using methods that would solve many of the actual problems we encounter today.

Of course, if you can find a way to defend against unknown future problems, I'm all in favor of using your method!

<comment><USER5> Unknown-unknowns as it were.

</comment></comment></comment></comment></comment></comment><comment><USER6> In the age where "most" web-servers are idling at 10% load and yaaaawning most of the hours away, it makes no sense that security-critical network-code should be written in unsafe languages which can leak memory, such as C.

Due to improved hardware, we've now reached the point where we can have reasonable security _and_ performance at the same time. We no longer need to sacrifice security by using unsafe languages. So why _are_ we using them?

Yes some companies like Google and Facebook has busy servers, but for the rest of us, for the rest of the entire internet having to redo all our keys and certs and passwords due to a archetypical C-style bug in OpenSSL, the _cost_ using C compared to the potential performance-benefits is absolutely not worth it. Not even close.

TLDR: Stop writing network-code in C unless you bloody well need to

<comment><USER7> I think the point of TFA is that we can write this code and it will run as efficiently as C in a language which is safer than C.

<comment><USER8> It was already possible in the 70's with PL/I, Mesa and Modula-2, but alas they though it would be better not to offer bounds checking in the language, instead of a way to disable them if required, like the other languages.

</comment></comment></comment><comment><USER9> We really need to stop writing network code in unsafe languages, period.

<comment><USER10> But even 'safe' languages have unsafe VMs. There is no question that over the years these VMs (or the runtimes) have had equally severe vulnerabilities.

The thing that really sets heartbleed apart is not the details of the bug, it's the scale of the 'infection'. OpenSSL is a core dependency of so many distributions and of so many pieces of software.

I think we could argue for lots of different solutions (diversity of implementations, safe languages, more tests) and all of them might be good in one way or another but none of them are a silver bullet for any possible bug either.

I think the take away is that you need to in a position to upgrade _any_ part of your software stack at a moment's notice not just the obvious top-level (e.g. Rails/Django/Jetty).

<comment><USER11> Rust allows you to write safe code without a VM. It is statically checked to be memory and concurrency safe.

<comment><USER10> 1\. I think a lot of people believe Rust will just type-check any old program and tell you when it has faults. So you can start with a bit of Ruby/C/Python, translate it to Rust and presto, all your bugs are exposed for the world to see.

In practice Rust's type checker accepts only a _very_ small subset of correct programs. I've been in a position to write some decent sized Rust code recently and it takes a shift in your mindset to start writing decent Rust code.

Even now there are patterns I'm unsure how to model in Rust. Arena allocation is a good example because it was partly the cause of Heartbleed too. Arena allocation in rust seems to require unsafe pointers and unsafe code blocks. You can look at Rust's standard library and see this.

2\. The point being that the Rust language exposes unsafe code blocks and pointers. At some point you're going to hit those blocks (if nothing else in 3rd party code) and you're back to square one: You need to trust unsafe code that it is correct. It doesn't matter if that code is a VM or unsafe code.

*edited for some legibility.

<comment><USER12> The argument Rust devs make is that most of the time you would not need to use unsafe code and when you do, being explicit about it would make you more careful and think twice about it.

To me it makes sense. And the example you give here is very relevant. First you'd try to do it within the standard language bounds and only when you realize you can't do it that way, I'll resort to unsafe code. But now your very aware that this part of the code needs to be treated why extra care. So, to me, you're not completely back to square one.

Nicholas Matsakis make this very point near the end of this talk: [https://www.youtube.com/watch?v=9wOzjbgRoNU](https://www.youtube.com/watch?v=9wOzjbgRoNU)

I would even add, if care is taken to make that unsafe code really small it can even been generated by Coq for instance as stated in some comments here.

That said Rust might not be the best out there for the job but IMHO it shouldn't be dismissed to fast either. It is similar enough to C++ to allow a less painful transition for devs with the domain knowledge.

<comment><USER13> Would you not assume that the entire OpenSSL library would count as being in need of extra scrutiny? The point is that any time you let people directly access memory, they can, and often will, screw it up.

<comment><USER12> Ok, maybe we should make a distinction between, let's say the plumbing code and algorithms. Rust could help with the former. According to some comments I've read here it seems OpenSSL is using it's own abstraction of malloc/free (not that I have actually read the code). I suppose that this part of the code would be a suitable candidate for unsafe code with special extra care taken, then the rest of the algorithm does not not to be unsafe code. If you watch the video you might understand better what I mean : the ARC is unsafe but provide you with a safe abstraction for you to use in the checked part of the language.

Of course such a project must require extra scrutiny on all level and Rust does not resolves all the problems. I'd say pick your battles. Rust provide some interesting middle ground between C/C++ and a completely different language like Ada.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Since the 70's we had lots of safe programming languages with native compilers to choose from

Ada, Modula-2, Modula-3, Oberon, Oberon-2, Active Oberon, Component Pascal, Delphi, Turbo Pascal, Turbo Basic, Quick Pascal, D, Haskell, OCaml, Eiffel, Go, ...

C only got widespread into the industry as a side effect of UNIX's adoption.

Nowadays we pay the price for it.

Security conscious developers should only use C when there isn't any way around it.

<comment><USER14> I'm trying to learn ATS right now, and indeed I immediately thought of ADA. One of the advantage of ATS is that it is a lot more functional, but far from being anywhere as mature yet.

</comment></comment><comment><USER15> There seem to be misconception that safe language implies inefficient and slow code . It is not so in ATS2 , generated code is quite efficient and is safe even when manipulating memory from ATS2 .

</comment><comment><USER16> There will always be a compromise between cost, performance, features, usability and security.

'Safe' programming languages will improve security, presumably at the cost of usability through decreased performance. A bit like how a Ferrari is faster than a Volvo, but not as safe.

Performance has been a major driver in the choices made so far, I'm sure that the heartbleed affair will move the needle towards the 'security' end of the spectrum but I doubt it will move enough to drop C as the main work horse of systems software coding.

Reducing the complexity of the protocols used would seem to me to be a better place to reduce the exposed attack surface. No matter what the language used if you make a system extremely complex bugs are going to be more numerous and due to the interactions between the various parts much harder to detect.

<comment><USER2> >'Safe' programming languages will improve security, presumably at the cost of usability through decreased performance. A bit like how a Ferrari is faster than a Volvo, but not as safe.

This is fundamentally untrue. Safeness of the kind described in the article does not come at the cost of performance -- all type checks, invariant conditions and general formal proofs of correctness are determined at compile time. The produced code is to be indistinguishable from a correctly written, efficient C program. You are allowed to play as much as you like with direct memory accesses and use all the dirty tricks you like as longs as you can prove that the resulting program is formally correct.

What could be argued is that price you pay for all this is the difficulty of writing such programs. But definitely not their performance.

<comment><USER16> Ok, point taken, if you take the pre-processor or code generator approach such as in the article the performance hit might be manageable, but when I look at that 'memcpy' example I can't help but suspect that that is not a free lunch (as in, that all the extra work is done at compile time). For that you'd need to look at the code generated.

Even if there is a 0 performance hit in this case, the majority of 'safe' languages are neither pre-processors for C or code generators for a C like language (which would presumably also require the linked libraries to be re- written using something safer).

So in the specific case outlined here this may be true but in the more general case there are usually run-time trade-offs involved.

I think the key operative word in your comment is 'correctly', writing correct C is extremely hard and this approach makes it harder to create a certain class of bugs at the expense of making it harder to write the program in the first place. Tough choice, even in the absence of a performance hit!

<comment><USER17> In the example given in the article there are no run time costs. The generated C code is much the same as the original C code from OpenSSL. There is no ATS runtime that gets included either.

</comment></comment></comment></comment><comment><USER18> OK, help me out here...

If I understand the heartbleed bug correctly, isn't there an RFC that it is implementing? Does the RFC say that you can ask for a length, and you get that length? That is, isn't this really a bug in the RFC?

If the security flaw's in the spec, there's not too much that the programming language can do to help you. The best it could do is point out that you're overrunning a buffer, at which point the programmer has a choice: Proceed to implement the spec in code that is declared to be unsafe (useless), scream about the spec (the right answer, and useful if anybody listens), or find some other way to generate the extra bytes that are supposed to be in the reply (which makes _this_ implementation safe, and still satisfies the flawed spec).

</comment><comment><USER19> I feel like every one is using heartbleed to pitch their products.

<comment><USER20> I don't the author makes any claim to have invented ATS. But why not show why an alternative technology would have avoided this issue?

<comment><USER21> Just because this alternative language would have avoided this bug does not mean a much worse but would not have been created with a higher level language or even ATS.

<comment><USER20> Well, people can write bad/unsafe code in any language. But ATS can remove entire classes of bugs from a program, while C is notorious for its lack of safety. Though obviously, it has no more built-in protection from side-channel attacks than C.

<comment><USER21> Basically the cut down to everything is the laziness of how it is developed and how many people are actually looking over the entire code. ATS allows the developers to know that the can be even more lackadaisical about coding as ATS will remove bugs for them...

<comment><USER20> "There are collisions because people don't pay enough attention. Imagine if we installed a collision detection system, people would pay even less attention!"

I hadn't heard this line of argument before.

</comment></comment></comment></comment></comment></comment><comment><USER22> So Rust has unsafe code blocks that you use when you can't use the type system to enforce that a piece of code is safe. I wonder if would be viable to write those things in ATS with all the proofs to guarantee that the code is safe, compile to C and then call that trusted C code through the FFI?

It might not work in all cases, since I have the impression that unsafe Rust code is even more expressive when it comes to low level code (I guess this also means more unsafe) than C.

<comment><USER23> Rust code within "unsafe" blocks is still way, way safer than C code, while still being almost uniformly more powerful than C.

</comment></comment><comment><USER24> You can write unsafe code in _any_ language. It's not the language's job to protect you from yourself, that's what tests are supposed to do.

<comment><USER25> Actually that's what types are supposed to do ;)

Tests are still useful, as sanity checks and for checking empirical properties (eg. wall-clock time usage, timing attacks, etc.)

<comment><USER24> Consider the scenario where my programme is dangerous for values of an unsigned integer less than or equal to 2. As far as I know, there is no such type for unsigned integers equal to 3 or more. Sure, in object oriented languages you can essentially define your own type, but this flexibility is where you are not protected against yourself.

I see your point about types though. That said, both types _and_ testing exist to protect you. I stand by what I said, however; languages do not exist to protect you from yourself.

<comment><USER22> > Consider the scenario where my programme is dangerous for values of an > unsigned integer less than or equal to 2. As far as I know, there is no such > type for unsigned integers equal to 3 or more. Sure, in object oriented > languages you can essentially define your own type, but this flexibility is > where you are not protected against yourself.

You can specify that type in a dependently typed language. Then, if you can prove that values of that type can not violate your requirement, there is no runtime overhead.

Are there things which are unknowable or unprovable in a dependently typed system? Sure. But I think your initial assertion that all languages are unsafe to a degree and therefore it can't be their job to protect you against mistakes is unhelpful; it muddies the water by appealing to the fact that 'nothing is perfect/no approach is perfect'. But the whole point with type systems is to eliminate certain classes of bugs - the rest can hopefully be caught by other, less rigorous means, like fuzzy testing and unit testing. All other bugs are relegated to problems which are (in general) undecidable.

<comment><USER26> I think there is an important and quite general point here: it is not just about programming languages, but also about programming knowledge and skills. You are replying to someone who was unaware of the state of the art in program verification (to be fair, he recognized the issue to be solved, which is an important start.)

As the example in the original post demonstrates, programming in languages that have this level of support for verification is very different from programming as it is currently commonly practiced. Not everyone will be capable of making the switch, and for an organization to simply say 'from now on, we are going to use this safe language', without addressing the skills issue, is setting up for failure.

<comment><USER22> > I think there is an important and quite general point here: it is not just > about programming languages, but also about programming knowledge and > skills. You are replying to someone who was unaware of the state of the art > in program verification (to be fair, he recognized the issue to be solved, > which is an important start.)

Well let me be clear that I knew of program verification because I'm a PL geek, not because of any skill whatsoever.

> Not everyone will be capable of making the switch, and for an organization > to simply say 'from now on, we are going to use this safe language', without > addressing the skills issue, is setting up for failure.

Well, let's keep the discussion to programmers who really _need_ the things that we are after - safety and efficiency. It's not _all_ programmers, just programmers in some domains. Some people might even think that some people _can 't_ adjust to writing low-level code ala C, period. But some domains need these things, which means that we just need the programmers who are motivated enough/have the patience to learn it. Just those programmers, not all programmers.

If we can't get them, then maybe some one will actually have to offer some incentives like money - instead of a purely volunteer effort as I think was the case in this debacle. :)

<comment><USER26> I wasn't intending to cast doubts on any particular individual's skills, which is why I wrote 'knowledge and skills'. I am learning this stuff myself.

You make some good points about where safety matters most, but I think a greater general awareness would help drive adoption where it matters. Furthermore, while this problem had widespread consequences due to it being in widely-deployed system- or middle-level software, 'ordinary' programming can have quite serious vulnerabilities, too.

I think schools, especially below the first tier, could do more to promote awareness of static verification and other safe practices, and that might modify the way their graduates approach development, even though they probably will not be using formal methods.

There are things that can be done to improve safety in general-purpose programming languages. I feel certain that garbage collection and the avoidance of pointers has made programming safer, but I suspect 'duck' typing has had the opposite effect.

In the past, the DOD has been a driver of code safety, though it has backed down from its possibly ill-advised 'nothing but Ada' position. In fact, Ada might be the counter-example to the idea that you can drive safety through language choice.

You would think the banks would have a vested interest in improving things. Perhaps they could divert a fraction of their bonus payments to create incentives...</comment></comment></comment></comment></comment></comment></comment>


This may be the best LinkedIn profile Ive ever seen... - <AUTHOR> http://www.linkedin.com/profile/view?id=91819231

<comment><USER2> Maybe it is. But this closed system crap is one of the things I hate about LinkedIn. When I visit the link you offered I am greeted with:

"You and this LinkedIn user don't know anyone in common. You can only view the profiles of users within your network. However, as you add connections, you may discover people you know in common."

Want to take a screen shot of what _you_ were able to share?</comment>


ASX Replacing CHESS with Blockchain Technology - <AUTHOR> https://www.asx.com.au/services/chess-replacement.htm <comment><USER2> From TFA:

      Why is ASX replacing CHESS?

      While CHESS is a stable and reliable system, it is over 25 years old.

Why yes that sounds like a perfectly valid reason.

      Will ASX give everyone access to the distributed ledger?

      No. ASX is not using a publicly available implementation of DLT. ASX will use a permissioned system where ASX clients – that meet the necessary regulatory requirements - are permissioned to access the network, just as they do today when connecting to CHESS.</comment>


Provenence for wikileaks material - <AUTHOR> Why does anyone give credence to material from Wikileaks? Seems trivial to edit/create text files purporting to be stolen email than to actually hack someone's email account. Does (or can) Wikileaks provide any sort of believable provenance for their material? <comment><USER2> The main things that support the credibility of these mails is that:

\- If they were fake (i.e., not real e-mails that were stolen), the people involved wouldn't be blaming the hack on the Russians. They'd be saying they were fake.

\- Hillary Clinton actually addressed some of the issues brought up in one of the e-mails during the last debate (the excerpt from her Goldman Sachs speech in which she talked about saying different things in public and private). If the e-mails were fake, she'd just say so and not feel the need to justify what she was quoted as saying.

 _" Seems trivial to edit/create text files purporting to be stolen email..."_

It would be a lot of work to create thousands (maybe tens of thousands by now) of fake e-mails that could plausibly come from John Podesta and the people he exchanged e-mails with. And unless the fakes were created by a group of insiders who knew these people and their dealings very well, there would inevitably be all sorts of errors that would make the fakes easy to disprove. (Remember that all these e-mails are published on Wikileaks' web site, and anyone can pick through them if they want to try disproving them.)</comment>


Ask HN: Who has been your top mentor? - <AUTHOR> I'm curious to find out who some of the top mentors out there are - for myself, up to this point, it has been my mother, who ran her own business for 16 years and went from homelessness to owning our family home.
I'm not picky - your mentor in life, tech, business, love - whomever has been your top mentor.
Thanks in advance for sharing :) <comment><USER2> A good piece of advice I got once was to make sure you have a solid network of 25 people with more experience than you who also believe in you, and to be sure to maintain that network over the years. I'm really not anywhere near reaching that yet, imo.. but it is a good guiding principle, I think.

<comment><AUTHOR> Whew - 25 is quite a few. Who was your top mentor, though?

<comment><USER2> My parents provided a good foundation, and there have been a few stand-out teachers along the way who gave me opportunities I'm not sure I would have said I deserved. This is kind of a cop-out answer too but I think lifting weights has also provided a lot of clarity.</comment></comment></comment>


IPage.me - Create web pages just by sending e-mails - <AUTHOR> http://www.ipage.me/ <comment><USER2> "Users System API: There is no fault information allowed. Your account may be terminated anytime with a fault information."

Fails to inspire confidence, for several reasons. Generally, clicking around, lots of loose ends & typos.

Also -- have to sign up to try out the service? Bah.

<comment><USER3> The poor English is especially strange since they're in Sydney, Australia.

Other confidence-sappers:

\- The company's address is residential. This not bad in itself, but the address leaves off the suburb name in an apparent attempt to look like they're in the CBD. The cover-up is not just worse than the crime, it _is_ the crime!

\- Appears to be using a generic CRM system; note the "powered by" lines everywhere, indicating it's probably not even registered.

\- Said generic CRM is misconfigured, eg. offering language translations where no localisations have been entered

etc etc, much more I'm sure. I don't like small companies trying to look big. There is nothing wrong with small companies, in fact if anything I prefer them, but trying to look like something you're not - and not even doing it well! - is a big turn-off for me.

<comment><AUTHOR> The guy who created this site use to work with me and English is not his first language - that should explain the typos. The implementation definitely needs to get better, but, the concept is interesting and works well, and, that's why I posted it to HN.

<comment><USER3> Fair enough. Make sure you impress on him the importance of correct language in his marketing material and implementation. If possible, get a native speaker to proofread it. That's what I would do if I was launching a product in Chinese.

</comment></comment></comment></comment><comment><USER4> <http://posterous.com>

<comment><USER5> This is a bit more sophisticated than (or at least different from) posterous, if not as immediately friendly.

</comment></comment><comment><USER6> I was able to do this years ago with my free backpackit.com account.</comment>


Bitcoin's Legacy - As a payment System - <AUTHOR> http://www.bloomberg.com/news/2014-01-16/wall-street-sees-bitcoin-legacy-as-payment-system-currencies.html

<comment><USER2> The biggest problém is imho that you cant buy BTC by credit card, then you cant use is as a payment system</comment>


How to right a comment on SUS forum? - <AUTHOR> Hi guys,
I can't create a post and a comment on the Startup School forum. Do you know how to fix it? <comment><USER2> Usually it is faster to send an email, because these post don't get noticed. Try with email@example.com

(If that fails, you can try to contact the mods of HN email@example.com , my guess is that they can not help, but they know someone that knew someone that is in charge of the forums of Startup School.)

<comment><AUTHOR> I will try to reach them directly. Thanks a lot!</comment></comment>


A new Mona Lisa queuing system - <AUTHOR> https://www.telegraph.co.uk/news/2019/10/07/shorter-wait-intimacy-mona-lisa-can-forget-selfies/ <comment><USER2> Since this is HN, I was hoping the article would say how the new system works, sadly it doesn't.

There's been a few threads about travel/tourism, and here I am again wondering about the bucket-listing. Why is "seeing the Mona Lisa" on people's bucket lists, and why do many only care about taking selfies with it, to say "I did it!"?

I suppose it's what people have been "taught" they "have to accomplish" in life. Is it about showing off/showing status?

</comment><comment><USER3> How about restricting people taking photo of the painting and make them immerse themselves with the art introspectively. There are better, high resolution images of the painting on the internet already, why take a photo? No point in taking a photo just to point out in social media "I've been there"

</comment><comment><USER4> To what degree are artists of the past just famous because of the prejudice of being "well known" instead of the skill that is expressed in their work.

What percent of the money dedicated to old artistic creations gets dedicated to the commission of new work, thereby incentivizing the development of new skills and content from contemporary creative artists.

I feel like a lot of these people just buy expensive (or even go look at) paintings so they can show off to their friends that they have a [or saw a] "Picasso", not because they genuinely love and appreciate the work. Maybe they have don't know how to actually appreciate a work. Would they understand its value without the name attached?

</comment><comment><USER5> I went to the Louvre in 2012, and I was able to walk up the Mona Lisa without a queue. I and a few others admired it for several uninterrupted minutes. I took a selfie and left. It was a very special moment.

I think they should do a reservation or lottery system to preserve the opportunity for intimacy. Make sure you actually get to spend time with work. Otherwise if you are only giving people 30 seconds (as the article states), you are encouraging the just-take-a-selfie-and-leave attitude.

<comment><USER2> There's been debates about how to handle over-tourism, one thing that can be done is to increase the price of tickets, but that seems to advantage the privileged. In Italy there are many objects where there are only limited tickets, e.g. Leonardo's Last Supper.

Maybe have a 2-tier model. The "Queue, take a selfie and go" model during the day, and the "5 minutes uninterrupted" model after regular operating hours, where you can reserve or win by lottery.

Interestingly the security guards of that area of the museum get to have the best access.

</comment></comment><comment><USER6> I visited Paris in November 2017 and didn't have to wait at all to see the Mona Lisa. The room had a good number of people in it, but wasn't crowded. My advice: If possible, take your trips in the late fall!</comment>


Show HN: DARKnetOS - Blocking NSA by P2P Identity Cards and encryption keys - <AUTHOR> http://www.darknetos.com/

<comment><USER2> If everyone has to meet in person via bluetooth, what about connecting with people you know IRL that are overseas or just a long way away from you?

This seems like a Facebook on Steroids.

</comment><comment><USER3> Good article. I've signed for it

</comment><comment><USER4> Good read. Insightful!

</comment><comment><USER5> A must have device.

</comment><comment><USER6> Very promising

</comment><comment><USER7> interesting indeed

</comment><comment><USER8> Neat!</comment>


Footprints in the NW sand: Perhaps 13,000 years old - <AUTHOR> http://crosscut.com/2015/08/footprints-in-the-nw-sand-perhaps-13000-years-old/ <comment><USER2> In a cave in Georgia (the country) you can see dinosaur footprints. It's called Sataplia Cave.</comment>


JavaScript WYSIWYM editor focused on clean, semantic markup - <AUTHOR> http://wymeditor.github.io/wymeditor/ <comment><USER2> Aren't all the mature WYSIWYG editors capable of 'semantic' markup now?

I'd like to see a specific example given of where the markup produced by WYM is specifically better than a properly configured install of CKEditor or TinyMCE.

I can think of a few places where the defaults probably give too much control to users to introduce presentational cruft (The TinyMCE 'insert image' dialog needs to have way less in it for example). But in most cases it's a simple case of "don't include the colour, font face or font size buttons if you don't want people to use them".</comment>


Neurodegenerative Disorder: Novel Targeted Therapeutic Strategies - <AUTHOR> https://email@example.com/neurodegenerative-disorder-novel-targeted-therapeutic-strategies-26b8bf6cde74 <comment><AUTHOR> Until the 1990s, growth in developing therapy for neurodegenerative diseases was slow and there were rare clinical trials. However,……..</comment>


Why the #1 Investor on AngelList Hates Venture Capitalists - <AUTHOR> http://blog.capitalandgrowth.org/gil-penchina/ <comment><USER2> I appreciate Penchinas thoughts but its getting rampant on AngelList that leads (Penchina included) put in tiny amounts of money in ($1k) and then require their backers to put in 5x more to participate. With the standard carry terms (20%)

Even that's okay but then companies are dressed up _hard_ to attract a quick investment draw. When it's largely a cheap lottery ticket for the lead.

VC is broken and AngelList allows more exposure to startups but this isn't a good thing.

<comment><USER3> Last time we got this comment, we checked the #'s and leads put in 16% of the investment on average.

Compare that to 1-5% for a typical VC fund. Partners in a VC fund also take out 10-20% of the fund in management fees.

You can learn more here [https://angel.co/economics- syndicates](https://angel.co/economics-syndicates)

Some leads have low skin in the game. In that case, you can always opt out of their investments. Or invest in our funds and we'll make the decision for you (for no additional cost) [http://angel.co/funds](http://angel.co/funds)

P.S. We don't hate VCs. They are among our users and customers.

<comment><USER4> Hi Nivi,

I took a look at some data a while ago, and your "16% on average" sounds a bit off.

Is it weighted on the amount of investments, or not?

</comment></comment></comment><comment><USER5> From what I've read so-far, this guy sounds top-tier legit "smart money" and matter-of-fact. Maybe doesn't invest a lot, but advice and philosophy are spot-on. (Added to my hit-up list in "possible top-tier Angel leads.")

Most importantly, this guy can break the ice for funding rounds, which gets the thermometer bar for cap table round going. VC's especially don't want to be first, so angels can help sort that out.

Also, another thing to consider is that angels, as a macroeconomic whole, have much more capital and data than in years past, so they're financially able (but not necessarily willing) to gobble up more and more of later-stage rounds.

</comment><comment><USER6> This is a great article. Dude is totally on point. I think it's funny that the same thing, "What are three things that turn you off when an entrepreneur pitches to you?" are apropos turnoffs of founders on investors.

</comment><comment><USER7> Disappointingly misleading title, unless I somehow missed the bulk of this interview.

<comment><USER8> Perhaps hate is a strong word but he clearly does not like them! He does talk about how they only care about themselves, boss around founders and then claim credit for the founders' success.

<comment><USER7> Which is buried in various parts in an interview largely talking about his own work as an Angel investor. Given this is HN, I was expecting something in actual depth about why VCs might warrant so much hate, and this definitely doesn't have it.</comment></comment></comment>


Ask HN: Is 1 year of programming enough to work for a startup? - <AUTHOR>

I just came across the link on HN about how to land a job at a startup just out of college (http://www.jasonshen.com/2010/get-a-startup-job-out-of-college/) and it got me thinking. I grew up in Silicon Valley, went to college in Arizona, and recently got a job at an IT company in Kansas City after graduation. I know I want to move back to the bay area and work for a startup, maybe within a year, but I'm not sure if I've got enough experience.
I took some basic programming classes in college, enough to learn the concepts, but I had a hard time understanding how to put it all together into a complete application. It wasn't until I worked as a student web developer that things really started clicking. I worked for a year learning PHP and coding small web applications. Now I'm working at an IT firm as a consultant and doing some hacking when I'm not working 8-5. I'm working on a personal project right now...It's not any groundbreaking technology, just trying to automate a process for an industry that has, for the most part, not embraced the internet for their operations.
My question is, would 1 year of web development experience be enough to work at a startup? I feel like startups are looking for awesome programmers with CS degrees. I know there are other positions at startups but I feel like I just have a well rounded set of skills, nothing that really stands out. I guess I'd like to ask you guys if you work for a startup, what is your background and did you find it hard to get hired? <comment><USER2> > My question is, would 1 year of web development experience be enough to work > at a startup?

Why are you restricting yourself to web development work?

> I'm working on a personal project right now...It's not any groundbreaking > technology, just trying to automate a process for an industry that has, for > the most part, not embraced the internet for their operations.

Why isn't that your startup?

<comment><AUTHOR> Well it is my startup, I guess I didn't say it directly. My partner and I have been throwing around the idea for a few weeks and i've started coding it recently. He's not technical at all so I've been building out the app by myself and he's going to deal with marketing and business dev.

</comment></comment><comment><USER3> To me, attitude/personality is a huge factor when start ups are hiring. I've been on both sides. When I was first hired, I had about 2 years part time work experience. When I was hiring, we often looked for recent graduates that would be our next rock stars.

If you can show that you learn fast and have the right attitude that should be enough. You mention you have worked on several personal projects. This is a huge plus to me, as it shows that you like to learn, that you like to code and that you have initiative. I'd make sure to point this out and allow them to see/review your projects.

All that said, it sounds like you are in the process of creating your own startup right now. If you left your current 8-5 job for a start up, you most likely would have to put your own project on hold. The description of your market is the exact type of market to go after. Perhaps you should give yourself a bit more time on your own project before looking for a job at a start up.

</comment><comment><USER4> You don't need to be a guru in programming to start a startup. You learn (a whole lot more than reading programming books) while working on your startup or projects.

Learning is part of startup and that drives you forward to be better.

</comment><comment><USER5> It sounds like you could do front-end work, maybe a bit more than that but you would most likely still be working with someone that has a bit more experience when the going gets tough. Otoh, who knows...

The best way to find out is to try. One way to hone your skills quickly and mercilessly is to join some open source project that does something interesting and eat your way in to an existing codebase. That'll teach you quicker than any other course. Be prepared for a very steep ascent and fairly ruthless critique by other coders on the project, but that's how you learn fastest if you're open for it.

<comment><USER6> Please lurk a little bit before starting if you go this route. I started by hanging out in the support and development irc channels to learn the common problems people had. This gave me a good idea where to jump in.

I got very lucky to get involved with some very nice people who were willing to play along and review my code.

Distributed version control systems tend to make this even easier. ( We were stuck with CVS)

PS: don't make them teach you how to use the version control system :)

</comment></comment><comment><USER7> Do you have enough experience to do a startup?

Really the only way to find out is to actually go do it yourself. See, you're thinking about it the wrong way, because skills are not a function of time, necessarily. In my opinion, tenacity and drive matter a lot more. You could start by building a project (that's what I'd do), but you could also contribute to OSS. You have all the tools, and (I assume)no compelling reason not to. Even if you don't, at the end of it all, you just might.

<comment><AUTHOR> Reading my original post I did make it sound like i'm looking at it the wrong way. I do work on a lot of personal projects and have learned a lot more than just by reading the books. I can actually write a decent app, I've written RSS parsers, a threaded comment system, an online ticketing system for my roomate's entrepreneurship project (no payment processing though), and right now i'm working on a CRM system.

We're planning to launch the CRM system soon and market it to our specific industry and i've actually learned a lot over the time i've been coding in my free time, I just feel like I don't have the skills the be hired on as a programmer at startup.

I'm leaning more towards finding a personal project that has big potential and build a prototype using my PHP skills. If it catches on I figured I could then find a more experienced programmer that could optimize the code and make it scale as the user base grows. I feel like I could use my skills as a founder and then bring in some awesome programmers to refine and enhance my app rather than getting hired as a programmer.</comment></comment>


Show HN: RedisLive, real-time monitoring for your redis instances - <AUTHOR> https://github.com/kumarnitin/RedisLive

<comment><USER2> Thanks, this looks very useful!

Edit: 8 minutes later and I'm already up and running. Well done!

<comment><AUTHOR> cool..thanks, let me know if there are some stats which are missing and might be useful.</comment></comment>