Google acquires Zynamics - <AUTHOR> http://techcrunch.com/2011/03/01/google-buys-security-analytics-startup-zynamics/ <comment><AUTHOR> Most of you probably haven't the faintest clue who Zynamics is. They're based in Germany and used to be called Sabre Security. This is Halvar Flake's team; they sell BinDiff (the most popular binary diffing tool in reverse engineering, used by teams around the world to back security patches out to learn about flaws), along with BinNavi, a popular debugger-based reverse- engineering tool.

For the past few years, they've been working on an engine called VxClass that uses control flaw graph analysis to automatically classify malware. One presumes this is what motivates the acquisition. Google already scans content on the Internet for malware.

Or it could be mostly a talent thing. Google's been on a hiring tear. Extremely strong software security talent isn't easy to come by. Lord knows Halvar's got it. Zynamics is hugely well-known and respected in the software security world.

<comment><USER2> Like a lot of folks, I'm curious how this will effect sales of BinDiff and BinNavi (I don't see Google in the business of selling security software); but this should be really good news for Halvar and Co.

<comment><AUTHOR> Wouldn't it be neat if they just open-sourced them? They almost might as well; both have open source substitutes already, neither could possibly make Google any money.

<comment><USER3> I am very sure this does not happen because the products (especially BinNavi) are entangled in commercial licenses for 3rd party components.

<comment><USER4> Are those 3rd party components easily replaceable?

</comment></comment></comment></comment></comment><comment><USER3> Congrats to my former company! I was lead devevloper of three of our products (BinNavi, BinCrowd, PDF Dissector) until 5 months ago when I was tired of the stuff we worked on and bailed out.

Curiously, we always saw HBGary as one of our main competitors. However, we were focused on tech, not shady deals. :)

<comment><USER5> While Responder Pro and Recon are pretty awesome tools, I'd certainly say that BinNavi and BinDiff are very different and serve different purposes.

<comment><AUTHOR> What do you like about Responder and Recon? I've never used or seen them (I've used both BinNavi and BinDiff).

<comment><USER5> They do different things, so I'll give you an overview:

HBGary have a tool called FastDump Pro for imaging memory. What Responder does is it takes (or acquires) a memory image and reconstructs the processes and left over memory modules. It also reconstructs details of open files, sockets, registry entries etc. at the time of the snapshot.

Responder Pro has a thing called Digital DNA (which backs up nearly all of HBGary's enterprise products) - it's a mechanism that looks for potentially malicious code (I say potentially because it's easily triggered by things like McAfee because it has a load of strings in memory at any one point in time). Digital DNA uses known indicators to look for specific signs of things like keyloggers. It's not 100% but it usually reduces analysis time by a lot.

There's a fairly straight forward disassembler, you can look at strings tied to processes and memory modules, check for hooked SSDT, IDT entries etc. and there's a canvas type function for mapping out a processes' structure. There's a C# interpreter for scripting but it's not well documented so most of our guys don't use it much for other than basic scans for specific things.

Recon comes with responder pro and is used to test potentially malicious code pulled off disk in a VM. You define how long it's going to run for then it runs the code under the VM. You can then go back to responder and there's an actual slider that shows you all the changes from registry, files, even cpu registers over time so you can zoom in on your process and see the encryption algorithm in the malware decrypting and flip back and forth, which makes it really cool for basic malware cryptanalysis when you're me and not you :) - it's also handy for extracting 0day from exploit code because you get to see what's being exploited and how, so you can quickly write a cheeky canvas/metasploit module.

There's another tool called flypaper that stops the process in recon from exiting, which can be quite handy.

Although the company's in a bit of disarray at the moment the products are really great for malware analysis, and could be used for exploit dev (but I wouldn't).

</comment></comment></comment></comment><comment><USER6> I would love to know what the typical acquisition process for Google is like. Where does it start (product team, management, engineering, etc)? How long does it take? How intense are the negotiations? Are deals typically cash or stock?

<comment><USER7> You probably have to sign an NDA about it.

<comment><USER8> Indeed we did. Although I wasn't involved in the negotiations proper I can say from working with Halvar (I'm the BinDiff lead) that google is a tough bargainer... Intense indeed ;-)

<comment><USER4> Any idea where you will end up, and what you'll be doing?

<comment><USER8> We'll work at the Zürich office. We are not (yet) allowed to talk about what we'll be doing.

</comment></comment></comment></comment></comment><comment><USER9> Halvar is pretty much a baller in the security industry. I met him and immediately knew he was brilliant, even putting all the history and his contributions aside. Talking to him about some of the things I was working on was enlightening.

Kudos to him and his team. BinDiff is a great product.

</comment><comment><USER10> Congrats to Halvar and the team. They've done great products for years and as 'tptacek says, they've got great security talent.

And kudos to Google -- a great investment in technology and people. Acquisitions aren't easy, so let's hope they can make it work!</comment>


Ask HN: Can you please help me with this? - <AUTHOR>

I have to submit an assignment based on response of a survey. THis is a very small 8 question survey and would not take more then 3-4 minutes. Could you please help me to fill this? Here is the link -
http://www.surveymonkey.com/s/9RNMBRN
Thanks. <comment><AUTHOR> WOW!! 8 people filled this up in 11 minutes. Thanks people but i still need around 20 more to complete 500 mark. Thanks a lot again..

</comment><comment><AUTHOR> Thank you people for your kind support, i just need 2 more to achieve my target</comment>


Exploring new forms of chess using artificial intelligence - <AUTHOR> https://www.wired.com/story/ai-ruined-chess-now-making-game-beautiful/ <comment><USER2> When I was in college, a Monopoly game appeared on the DEC-10. Playing that for a while completely ruined the game for me. Then someone wrote a bot to play ADVENT, which ruined that, too.

My ability to play chess declined precipitously after I learned how to program, because while thinking of my next move I'd always digress into how to design a program to do the work for me.

I originally wrote the Empire game because it was unbearably tedious to play manually, but the computer took care of the tedium and what was left was the fun.

<comment><USER3> Walter, your D source code link on classicempire.com fails with a permission error. Kudos to you for creating what Wikipedia credits as (according to one ranking in 1996) the 8th most popular game of all time.

Considering the power of most portable devices these days have you considered revisiting Empire for an IOS or Android version?

<comment><USER2> I'll just put the code up on github. It'll take me a bit, so check back in a day or two.

[http://classicempire.com/](http://classicempire.com/)

I'll announce it here:

[https://twitter.com/ClassicEmpire](https://twitter.com/ClassicEmpire)

<comment><USER2> [https://github.com/DigitalMars/Empire-D](https://github.com/DigitalMars/Empire-D)

It'll likely need some minor work to work with the latest D compiler, attend to that in a bit.

<comment><USER3> Thank you!

</comment></comment></comment></comment></comment><comment><USER4> This is a slight tangent to the article, but in the hope HN readers will find this as fascinating as I have recently...

There's a three-way battle developing between AlphaZero (as described in the article, courtesy of DeepMind), LCZero[5] (derived from LeelaZero[1] -- an open source interpretation of the same principles as AZ), and Stockfish[2] (a long-standing open source chess engine that has recently begun including neural network support).

The 'Top Chess Engine Championship'[3] seems to be a good way to follow the latest news; they also stream matches live on their website[4] (it is quite an information-dense site).

You can play against an up-to-date implementation of Stockfish in your browser -- no registration or signup required -- at [https://lichess.org](https://lichess.org)

[1] - [https://zero.sjeng.org/](https://zero.sjeng.org/)

[2] - [https://stockfishchess.org/](https://stockfishchess.org/)

[3] - [https://en.wikipedia.org/wiki/Top_Chess_Engine_Championship](https://en.wikipedia.org/wiki/Top_Chess_Engine_Championship)

[4] - [https://tcec-chess.com/](https://tcec-chess.com/)

[5] - [https://www.lczero.org/](https://www.lczero.org/)

Edit: correct LeelaZero -> LCZero

<comment><USER5> LeelaZero is strictly used for the Go AI nowadays, the chess version changed their name to LC0 (or Leela Chess Zero, or LCZero), and the website is at [0]

AlphaZero is not involved in any battle with LC0 or Stockfish, as no one outside of Deepmind has accessed to it. The battle for chess supreme is between LC0 and Stockfish, with both trading blows pretty much every update :-)

[0] [https://lczero.org/](https://lczero.org/)

<comment><USER4> My mistake, thanks for the correction :)

</comment></comment></comment><comment><USER6> A summary to undo the clickbait: AI is making chess beautiful by making it easy to check how new rules affect playability. Rule changes suggested in the article are:

\- No castling

\- Allowing self capture

\- Pawns can move sideways

\- Pawns can move 2 squares at a time

<comment><USER7> The rare occasions that I played against my wife and tried to castle, she rejected it outright with, "No fancy moves!"

<comment><USER8> The true metagame

<comment> dane-pgp I'm reminded of this classic bit:

[https://youtu.be/i-oDOJlWBTw?t=1849](https://youtu.be/i-oDOJlWBTw?t=1849)

"That's castling sweetheart... It's an advanced level manoeuvre, they added it in the last patch."

</comment></comment></comment></comment><comment><USER9> Question for those knowledgeable on AI: what sort of game would be easy for a human to understand, but difficult or impossible for a computer to play or easily defeat humans? I imagine one based purely on randomness, like dice, would be one.

I remember reading somewhere that languages like Finnish and Hungarian are difficult for computers to parse, [1] due to their agglutinative grammatical structure. Not sure if that is actually true, but it seems an interesting starting point.

[1] Discussion sort of about this: [https://news.ycombinator.com/item?id=21572261](https://news.ycombinator.com/item?id=21572261)

<comment><USER10> Not the answer you're looking for, but motor racing and simulations of it.

Sounds counter intuitive, but despite doing fast laps when on the circuit alone, even the best AI racers have difficulty surviving a race distance in close pack racing without crashing.

Roborace, the autonomous racing league in development has barely managed to put two cars on track and doing an overtake safely. A lot of money and state of the art research has gone into this.

I expect that AI will be able to beat humans on the (simulated) race track in a decade or two but we aren't there yet.

<comment><USER11> I get that this is true of real cars, but is it really true of simulated cars? Can you share an example?

<comment><USER10> There are no racing simulators or even games that have reasonable AI opponents that don't cheat.

I, mid-tier sim racer, have no chance against good AI in hotlapping on track in some popular sims, but all of them either yield or cause a crash that would take them to the stewards (or grave) when racing for position on the same piece of track.

Pro racing team have excellent sims these days but they don't have AI opponents.

<comment><USER11> Do you have any particular reason to believe that the "AI" you refer to are sophisticated ML models built over the sim, rather than hand crafted bots. You say "don't cheat" which makes me think you're referring to the bots included in the sim. Because an AI that's not built into the game shouldn't have any way to cheat.

Forgive this comparison, but the ai drivers in mario kart games also cheat, but aren't particularly representative of current state ML tech. There's likely no ML involved in them at all. There's not much in the way of actual attempts to do this with ML either so it's not proof either way (especially on new untrained courses).

<comment><USER10> No, they are not sophisticated ML models. Such things don't exist in this space as far as I know.

The ones that cheat are in racing games. The hardcore sims that have AI bots don't usually cheat, and they are the ones that are fast by themselves but hopeless and/or dangerous in a pack.

Roborace is the only place where this kind of research has been done, and after many years and millions of dollars they're past their first baby steps, but still learning to walk before they can run.

</comment></comment></comment></comment></comment></comment><comment><USER12> There are promising chess variants where all draws are eliminated: no black castling or no black short-castling Armageddon (draws are counted as wins for black). I wish they would test them instead of their picks - they are still chess unlike some variants they tested, which are probably too radical if you want to attract current chess players.

<comment><USER13> I got back to chess few years back, and following scene a bit.

The classical long for chess is basically dead. Its boring, with majority draws (close to solved game - de0incentivizing aggressive play). I am glad there is shift towards shorter time formats.

Shorter time control creates more urgency and allows to play subpar moves to throw off your opponent. Its much more interesting to observe.

Armagedon rules are being used now as tie breakers and there is a lot more discussion about changes/rules tweaks.

So who knows what next year will bring.

<comment><USER14> I strongly disagree with the assertion that chess is a "close to solved game" in human OTB play in particular.

Top GMs currently will probably score 0/12 against Leela/Stockfish. We see innovations frequently in recent years as we learn from engines themselves, h4/h5 pushes as a simple example, but also in terms of style like favoring rapid development and attacking play.

Yes, draws are frequent but that doesn't mean there is no excitement in long games. Rapid/blitz is damn fun to watch and play but there's a certain, different kind of elegance in carefully considered moves as well.

<comment><USER13> > I strongly disagree with the assertion that chess is a "close to solved > game" in human OTB play in particular.

I meant 90min +30mins classical format. It really is stale and boring to watch. And it seems like its mainly a memory game with some meta counter preparations pre-tournament. Where you develop and memorize lines to counter your opponent. That's what I meant by "close to solved game" \- as both players are almost role playing for first 20-30 moves. With tiny variations throughout the tournament.

That results in quite uneventful games, usually same line being played in multiple games.

Anyhow that's just an opinion, if someone enjoys classical more power to them.

<comment><USER15> Slow chess is not solved by any human; it's broken. It's dead-ended because some better players avoid aggression so they can play short-time tiebreakers instead.

<comment><USER13> agreed - 'solved' is wrong term. Maybe peaked to the point top players are almost equal.

</comment></comment></comment></comment></comment></comment><comment><USER16> An important piece of context here is that making a living by playing chess competitively is close to nil, so many even top players like Kramnik end up taking consulting/PR jobs like this in order to pay the bills. I have a hard time believing Kramnik actually believes (or said directly) that AI ruined chess. My read is that he's not really promoting changes to the rules of chess as much as he's trying to build support for new types of chess variants.

It's true that the highest levels of play include teams of researchers and computers that develop 30+ move preparation, but what we're also seeing as a result of that are games that are more precise, which IMO is a fundamental component of chess "beauty". Some notable games that were deemed "beautiful" in the past are now seen as less-beautiful as it became apparent that play was suboptimal. Chess beauty now is less about flashy combinations and more about qualities of a position and reverse engineering the "logic" behind certain AI moves, which is still great but admittedly requires more of an investment on learning the game than a spectator might care about.

That framing, though, leaves out the massive benefit that AI has had in training and improving new players. It used to be that you needed to hire a chess master to play against and learn from in order to improve. Now your phone can easily give you a challenge of master-level strength, as well as analyze your games over the board to look for improvements.

<comment><USER17> > Chess beauty now is less about flashy combinations and more about qualities > of a position

No it's the opposite. Since the advent of strong computer programs it has become clear that there are tactical intricacies in lots of positions that have long been overlooked by everyone, including top players. Gambits that everyone thought should not be accepted because it would give away a too strong positional advantage turned out to be winnable by clever defence moves. End games that were thought to be draws turned out to be winnable by although sometimes it would take more than 100 moves. The bottom line is that the tactical part of chess is deeper than most people thought.

<comment><USER18> Well I agree with your first example.

But would you call someone who wins a supposedly drawn endgame after 100 moves a tactical player or positional player? No one I know would claim that what happened on the 100th move was a tactic. It was 90+ moves of jockeying for position.

<comment><USER19> I'd call them a stubborn player.

A human can't normally predict out 100 moves of optimal play, so that's why it is jockeying instead of being part of an intricate plan.

I mean, it does bring the question, do you play a game for the experience or solely to win?

I play games for the experience, the world's best chess player probably gets a thrill from being the best and winning. Obviously both experiences are legitimate and in competitive chess, studying historical games to learn patterns has always been a thing, so who's to say that studying scenarios 'solved' by a computer is really any different? Possibly there's a little less romance because a human didn't do it on their own? It doesn't appeal to me personally, but neither did studying chess moves. It really looks like a question of scale of preparation to me.

</comment></comment></comment></comment><comment><USER20> There's a really interesting hour-long interview (more of a monologue really, heh) with Kramnik about no-castling chess: [https://www.youtube.com/watch?v=RPe6xQjO98Q](https://www.youtube.com/watch?v=RPe6xQjO98Q)

</comment><comment><USER21> Also covered here with a little more technical (chess) info:

[https://www.chess.com/news/new-alphazero-paper-explores- ches...](https://www.chess.com/news/new-alphazero-paper-explores-chess- variants)

<comment><USER22> Surprised they didn't include the "crazyhouse" and "suicide" variants. I played those a lot on earlier Mac OS X versions.

<comment><USER23> I was interested to see what they were doing with [https://en.m.wikipedia.org/wiki/Kriegspiel_(chess)](https://en.m.wikipedia.org/wiki/Kriegspiel_\(chess\))

</comment></comment></comment><comment><USER24> People have been wailing about chess being dry and full of draws and memorized openings for a century now. Capablanca wanted to swap bisbops and knights to reset opening theory, and Fischer wanted to just randomize the starting positions. I'm probably missing some other people.

All of these attempts failed, because of several reasons:

1) The aforementioned problem of memorizing openings and accumulating draws only occurs at a very, very high level. Even if you're a GM you won't prepare at the level Carlsen et al. do, memorizing entire 30-move games they had against each other twelve years ago.

2) Opening theory moves on and playstyles evolve. AlphaZero shifted the mood from conservative, materialistic, 'computer-like' play to a highly dynamic style that puts an emphasis on piece activity. Just like when we think we got most things figured out, new breakthroughs show we've only barely scratched the surface of what the game has to offer.

3) Most chess players don't see the abundance of draws as a problem. I think it is specifically an American sentiment - in a country where you're either a winner or a loser, the game's failure to rank its top players can be frustrating.

4) Most players see preparation against their opponent as part of competitive play. Think of it as a kind of metagaming. Changing the rules would completely reset that.

5) There's a good chance that any change of rules would aggravate White's marginal first-move advantage. It doesn't matter what the computer says, what matters is how humans play it and how it reflects in the winrates among humans.

That doesn't mean the variants are bad or useless though. Bughouse and suicide chess are crazy fun

<comment><USER25> I really doubt (3) and (4). I think most chess players would agree that the draw-ish nature of high level play is boring and uninspiring, and that careful preparation of openings dozens of moves deep isn't the interesting part of the game.

<comment><USER24> I assure you that drawish games are only boring on the part of the spectators, not on the part of the players. People often struggle epically to catch that half-point, it doesn't feel boring at all when playing from the inside. There are many records of epic draws between titans where both sides played incredibly accurately - see Alekhine - Reti or Korchnoi - Topalov off the top of my mind.

And as I said, people rarely if ever prepare openings 'dozens of moves' deep at all but the absolute top level play.

At this point you have to choose if you want chess to cater to competitive chess players (who are mostly content with the rules as they are) or amateur spectators and organizes (who want to see blood).

</comment></comment></comment><comment><USER26> Shogi is the most complex Chess variant. But seriously. Just play go. New patterns emerge everyday now it seems. The most complex pattern can arise from such simple rules.

</comment><comment><USER27> I invented a game called Arimaa that could be played with a chess set but the rules were very different to make it harder for computer. I put up a $10k challenge to develop an AI that could defeat the top human players. A challenge match was run every year from 2004 to 2015 when it was finally claimed (one year before AI took over Go). There was a variant of Arimaa that I didn't go with since the games did not seem that interesting. It was the same as current Arimaa, but without any trap squares. So no pieces were captured and the game seem to take longer to finish, but I think it may have been a more strategic version (less tactics). I still wonder sometimes if that would have been helped the humans stay ahead a bit longer. I avoided that version since I was not sure if it could lead to deadlock positions. Play testing to check for flaws especially at high level play would be way to much effort for humans. It would be less effort to have an AI check the game rules. Although there is still a big cost to doing that. The AI researchers in the Arimaa community have recently developed an AI that has learned to play Arimaa through self play. They have also brought down the cost of training from about $1 million to about $1 thousand. If anyone is interested, there is a discord channel where we discuss this kind of stuff [https://discord.gg/XTAcDjR](https://discord.gg/XTAcDjR)

More information about the Arimaa game as well as a gameroom where you can play it available here: [http://arimaa.com/](http://arimaa.com/)

</comment><comment><USER28> I did't like the article in the sense that AI hasn't ruined chess. Its more popular than ever, but the focus has moved to shorter time controls...which can be quite exciting to watch. I watch chess tournaments on twitch.tv with two grand masters commentating...and honestly, its like watching a godly hockey match.

That said, I'd like to see some of these variations get implemented on chess.com. A lot of the variations (aside from 960) are a bit silly feeling (e.g. a variation where when you take a piece, all pieces within a 1 square radius get blown to smithereens).

</comment><comment><USER29> I would love to see AlphaZero play go on other manifolds than the plane.

I and some friends attempted to play 3-space go, toroidal go, and go with other mathematical roadblocks a long time ago. It was fun for a few weeks, and we even discovered some interesting properties about where life can exist on a torus, but a computer could do much better. And I'd love to just see the answers.

<comment><USER30> How do you define "surrounded" on a torus?

<comment><USER31> The actual Go concept is 'no liberties'. That works on any topology.

</comment></comment></comment><comment><USER32> It's weird that they the start of this article seems to imply that AI has taken the joy out of chess. I guess I was only a kid for the Deep Blue vs. Kasparov days so maybe I don't know any different, but to me fundamentally chess is joyful because it's a sport. It's not about trying to be the best algorithm in the world, it's about trying to put out strong consistent performance on the spot in a game. Sure, your moves won't be as good as a computer's but that doesn't take the joy out of making them try to be as good as possible.

</comment><comment><USER33> AI ruined chess the same way horse riding ruined running.

</comment><comment><USER34> Lichess has great variants to play. If you haven't tried crazyhorse or multi- player version bughouse, highly recommend it. In crazyhorse you can put captured enemy anywhere on the board as your own piece.

Likewise in bughouse, you play with a partner (where you are opposite colors) against another team. You each play your own game against the opponent but each opponent piece you capture you can give to your partner to place on their board and vice versa. First person to win the game wins for their team. It requires good communication and a different strategies than traditional chess as you need to account for two games and the flow of pieces on both boards.

<comment><USER35> Also, if you really want to dive into the crazyhouse idea you can try learning Shogi which is effectively the Japanese version of western chess and has the drop rule and interesting promotion mechanics.

<comment><USER34> thanks for sharing!

</comment></comment></comment><comment><USER36> > In chess, AlphaZero initially doesn't know it can take an opponent's pieces. > Over hours of high-speed play against successively more powerful > incarnations of itself, it becomes more skilled, and to some eyes more > natural, than prior chess engines.

'doesn't know it can take an opponent's pieces' \- really? How would the world be different if it did 'know'?

I know this is kind of a nitpick, but I'm tired of all the metaphors in tech journalism that hold no informational value. I think giving a sense of false understanding is worse than just saying nothing at all.

<comment><USER37> I think it's an imprecise way of saying that AlphaZero isn't given the game rules, so it doesn't know the difference between legal and illegal moves, and also that before any training it would evaluate a caputure no differently than any other move.

<comment><USER36> > isn't given the game rules, so it doesn't know the difference between legal > and illegal moves

But it does have some way to determine a list of legal moves from any given state, and a way to determine whether a state is winning. To me, that's being 'given the game rules'.

> before any training it would evaluate a capture no differently than any > other move.

That's a good way to say it!

<comment><USER37> > But it does have some way to determine a list of legal moves from any given > state

No it doesn't. That's the Zero part.

</comment></comment></comment></comment><comment><USER38> Kramnik is the one to talk about computer chess alright... I remember when I was still in school the huge scandal with him going multiple times to the bathroom in his match against then world champion Veselin Topalov (should be around 2005-2006). It caused huge outrage and upset in my native Bulgaria.

On a different note I learned Xiangqi (Chinese chess) this past February and I found it quite interesting and exciting. Rules seem a bit more complicated than chess and I'm not sure how it compares to Shogi for example. Pretty sure Go is still more complex though :)

<comment><USER39> Analysis of the 2006 match by a CS professor:

[https://cse.buffalo.edu/~regan/chess/fidelity/Elista2006.htm...](https://cse.buffalo.edu/~regan/chess/fidelity/Elista2006.html)

</comment></comment><comment><USER40> Fascinating, and genuinely refreshing.

Wonder if we could go one further and have tournaments where the rules changed to a different ordered variation after a set number of moves.

Now that would be mind bending.

</comment><comment><USER41> How widespread amongst chess experts is the premise that "AI ruined chess" ?

<comment><USER42> Not very. It is poetic licence on the part of the writer.

AI had a real impact on how the game was played however. After the advent of computer evaluation, there was a broad consensus that the way to win was to play solid positions. In a way, professional chess became more about not losing than winning. Anish Giri who peaked at number 3 in the world a few years ago is nicknamed the artist because he keeps drawing. Some found that pretty boring.

Funnily, salvation might actually have come from AI. AlphaZero doesn't play boring games and reminded everyone that favoring activity and initiative is a viable strategy.

Still, all things considered, streaming had probably a much bigger impact on chess than AI in the last few years.

</comment></comment><comment><USER43> Played chess in high school and lost interest in actually playing the more I explored AI... I find it much more fascinating to explore Alpha's games. (Probably I'm also mentally lazier now.)

</comment><comment><USER44> I can heartily recommend "Deep Thinking: Where Machine Intelligence Ends and Human Creativity Begins" by Kasparov.

It's his story on what happened around Deep Blue.

</comment><comment><USER45> I believe its very much the arbitrary numbers we gave to pieces that we coded into our brute forced chess AIs that has allowed new chess AIs to be better.

As this article hinted, its understanding of piece value fluctuates based on the rules of the game but also as the game changes. Alpha Zero makes sacrifices human players wouldn't because they're too wedded to the idea that a queen is 9, a rook is 5 and a knight/bishop is 3.5. As flexible as a human mind gets is valuing a rook pair, bishop pair or knights if the position is closed.

This means that Alpha Go destroys the greedy Stockfish because Stockfish counts the numbers but Alpha Go counts the position of the entire board which is much more complicated.

<comment><USER46> Stockfish evaluates the position of the entire board, e.g. mobility of pieces, how much opposing space they control, etc. But still, the evaluation function is hardcoded and weaker than AlphaZero.

Recently Stockfish introduced neural network evaluation.

[https://blog.stockfishchess.org/post/625828091343896577/intr...](https://blog.stockfishchess.org/post/625828091343896577/introducing- nnue-evaluation)

<comment><USER45> By that I just mean Alpha Go is assuming less about board state than StockFish and other conventional chess AIs do. Evidently the two engines have different assessments which is why Stockfish will greedily lap up a sacrifice by Alpha Zero onto to then lose because of it.</comment></comment></comment>


Open Sourcing Uber Manifold, a Visual Debugging Tool for Machine Learning - <AUTHOR> https://eng.uber.com/manifold-open-source/ <comment><USER2> Manifold, a model-agnostic visual tool that surfaces the differences in distributions of features (i.e., the measurable properties of the phenomena being observed).

From: [https://venturebeat.com/2020/01/07/uber-open-sources- manifol...](https://venturebeat.com/2020/01/07/uber-open-sources-manifold-a- visual-tool-for-debugging-ai-models/)</comment>


PHP and the Lean Startup - <AUTHOR> http://blog.mayflower.de/archives/819-24.12.-PHP-and-the-Lean-Startup.html

<comment><USER2> I've just moved from years of PHP to RoR. And there's a lot that I miss about PHP. Deploying Rails Apps is still a motherfucking nightmare - I hanker for the days of just git pulling and changing a couple of config vars. I can google any error message in PHP and find dozens of answers - not so with Rails, where I end up really have to scrabble around for a solution.

But there's also a lot to love about RoR. I just needed to calculate the number of business days between two dates - step forward the business_time gem. Five mins later and I've got a stable, tested solution.

I've built and sold businesses on PHP, I run some sites on it still. But I've never got into testing with PHP, it just isn't seamless. And because of that, I've always hated going back into the code and improving things later - projects have tended to stagnate. With RoR you have to make an effort NOT to write tests, and making minor tweaks isn't like moonwalking across a minefield.

If you just want to whack up a prototype right fucking now then PHP and a Framework are for you. But if you think that you're working on something more than a punt then either put in the effort to write decent tests in PHP, or use a framework that will force you to do so.

In summary - PHP and Yii Framework do _almost_ all of what Rails do. It's fast, stable, clean and easily deployed. But the weight of the developer community is now behind Rails. And Ruby is a neat language that I enjoy working with.

</comment><comment><USER3> The key point of the article seems to be embodied in this quote:

 _So we PHP people are good at failing early, fast and cheap. If you want enterprise grade fail, ask the java guys, if you want scalable fail, ask the c guys. If you want smart fail, ask the clojure guys. But early and cheap, ask us._

The claim here is that one can get to a working product using PHP substantially faster than with other languages. However, the article has no data to back this claim up. Indeed, one of the big goals of newer languages like Clojure, Python, and Ruby (the latter two not being explicitly mentioned) is to write code faster and with fewer errors. Java, while verbose, also has strengths: a great many excellent frameworks and libraries. This is also true for web development (e.g. <http://www.playframework.org/>). Including C in the argument is a little strange. As far as I've seen, it's one of the least used languages for deploying web applications these days!

In summary, I am wholly unconvinced by the claim of this article. And I say claim as it's missing any substantial argument. Does anyone have any actual data here? There are certainly many case studies for the newer languages and frameworks if you dig a bit. It's an interesting topic.

</comment><comment><USER4> People bag on PHP a lot (was a truer sentence ever written?). But the fact is that it's fast to prototype with, it has a number of mature frameworks available, and time-to-productivity is quick. That's what business people want -- quick and cheap.

With proper engineering, PHP can be quick, cheap, AND good (see: Facebook. You want to argue the point, fine, but I don't see you becoming a billionaire on the back of your Haskell application).

Like every language, there is an appropriate place for it -- I would probably not write code for the Space Shuttle or a medical device in PHP. But, a great place for a language like PHP is web applications, especially for businesses who have to consider things like hiring people.

<comment><USER5> > With proper engineering, PHP can be quick, cheap, AND good

This is true for any language. It is also true for any language that poor engineering can make things really bad. PHP is in a unique position, though - it is so easily accessible to non-engineers that they begin writing applications without the slightest idea what they're getting themselves into.

This results in lots of improper engineering, and people blaming the _language_ for the world's problems.

Javascript and Actionscript have this problem too. They get a lot less flack, though, because I think client-side scripting isn't held to the same standards.

<comment><USER6> I don't know about ActionScript, but javascript is actually a pretty beautiful language. It's basically scheme with Java syntax.

Also, we're stuck with JS for the time being. PHP is easy to ditch by comparison.

<comment><USER7> No TCO makes it very much not scheme or lisp or anything fp.

<comment><USER8> Having lambda expressions, closures, and being able to construct higher-order functions makes it pretty "functional" in my book. Having to be careful about recursion is a negative, and TCO would be a welcome addition.

It's really a hybrid language. You can do a lot functional stuff with it if you'd like. You can also do a lot of the OO thing with it. Neither is perfect, but if you stick to the "good parts", it's a strong language.

<comment><USER7> Lambda expressions implies currying because lambdas take only a single argument unless you think of function application as implicitly constructing a tuple of arguments (but JS lacks tuples and only offers maps and arrays). Javascript has first-class anonymous functions, not lambdas.

Closures in JS are broken due to everything being a reference cell by default. This causes closures to be annoying to construct correctly and more expensive than they should be. "Functional" languages typically treat mutation as a side-effect and require reference cells to be explicitly declared. This helps enforce function purity and referential transparency -- functional-ness.

"Being careful about recursion" is like being careful about looping except recursive expressions are a superset of succinct iterative expressions making Javascript weak when it comes to, say, describing state machines. Lack of TCO makes Javascript a terrible compile target as CPS is impossible.

Javascript is an ambiguous, unsafe, difficult-to-analyze language. It supports some constructs that look like constructs in functional languages but because it does not enforce any functional or type systemic restrictions, these features are mostly cargo.

If you write a recursive algorithm in Javascript, you pay like O(n) for stack frames. The same iterative algorithm costs O(1) for stack frames. Thus, many developers eschew recursion in favor of iteration. This means that the logical code that developers write _could_ be both mathematically sound and run efficiently on the machine but instead developers must either resort to temporal reasoning or perform recursion -> iteration transforms in their heads. This is broken.

Just because Javascript is ubiquitous doesn't mean it's good. I don't understand Javascript evangelists -- they seem to be spreading half-truths.

<comment><USER8> I'm not a Javascript evangelist. I'm the first to admit that it has flaws. Some (like recursion) are fundamentally broken and a trap to unknowing programmers. I think you'd be hard pressed to find anyone with any real javascript experience who says the entire language is perfect.

There are good parts though, and if you stick with them, it's not bad. In fact, it can be a pleasant experience to work with. Just because it's ubiquitous doesn't mean it's all bad.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Blah blah blah PHP blah blah startup blah blah blah blah lean blah pivot blah blah we're special blah blah.

I don't see how the unstructured development of the past has anything to do with using PHP in startups today. It's not about the language capabilities (90% of business aren't doing anything special in code), but developer speed and happiness. If you're happy with PHP then so be it, but that doesn't make it better.

<comment><USER10> Exactly.

The part that bugs me the most about the post is when it says "that's what we PHP guys do well: fail fast, fail cheap". Basically what he is stating is:

1) PHP developers are going to hit a wall earlier than other developers 2) PHP developers are cheap in general. How is that a positive statement, I don't know.

There's this stupid belief that by paying less for someone who does "a quick job" you can test a feature and then "build from there". It's bullshit.

From my own experience, I've regretted time and again hiring a cowboy (the fact that he was a PHP dev is not unrelated) developer just because we needed something "quick". What was supposed to be a 10-day deliverable turned into a 4-month mess of a codebase that I couldn't wait to rewrite. We ended up being hostage to our own code.

</comment></comment><comment><USER11> It feels like the longer you develop web applications the less it matters what language you use. I highly recommend experimenting with as many languages as you can because each one has something unique to offer. You are often able to take lessons you learned using one language while using another.

This seems to go a long way with frameworks as well.

</comment><comment><USER12> PHP's biggest strength is also it's greatest weakness: flexibility. For a beginning programmer it is great because you can just do simple stuff in minimal number of lines. For advanced programmers it is great because you can build a flexible framework that fits your unique business situations. However, for intermediate programers there is enough flexibility to really write terrible code that somehow works, but could never be maintained.

</comment><comment><USER13> "The only difference is that today it's organized, tested and validated." Unbelievable. Those are the three reasons developing in PHP was such a pain back in 2000: procedural web code was a pain to keep organized, don't even get me started about testing PHP code back then, and at least the projects I was working on suffered from horrible unvalidated feature creep.

Yes, I would say that's the "only" difference. ಠ_ಠ

</comment><comment><USER14> I hate Rails. Why? Because of the type of people that make up the community. They defend Rails to the death and won't admit it has any faults. It reminds me of the people that are pro-universal health care. Because of this, I won't use it for any of my projects. I will only start using it when there is no other choice.

I use PHP for almost all web development. However, I'm not against using other languages.

I admit, PHP has its faults, but it's still a great web dev language. PHP 5+ has really added some great OO functionality.

<comment><USER15> > It reminds me of the people that are pro-universal health care.

Thank you for lumping all of them together.

<comment><USER14> Well, it's the truth in my experience. Very rarely will I ever see anyone that is pro UHC tell me the the things that are wrong with it. Same with the people that love ruby.

I love PHP, but I freely admit there are issues. I love private care, but I also admit it has problems.

It's this sort of intelligent discussions that we need for me to take those sides seriously.

<comment><USER15> It seemed like a very needless comparison, and a politically charged one at that.

</comment></comment></comment></comment><comment><USER16> These debates are always silly at best, and painfully indicative at worst.

Indicative of what exactly? A certain type of nerd (emphasis that I mean a sub group) that is likely to never accumulate wealth or create anything particularly successful on their own because they're too anal-retentive to understand that success in building a Web app or business is not defined by whether you use PHP or Ruby or Python or even ColdFusion.

Unless you think you're the next Facebook or Tumblr, then extreme optimization is necessary. Otherwise, the rest of the discussion is bullshit stacked on top of bullshit.

If the common wisdom were followed, Plenty of Fish should have never existed, given their infrastructure and development approach. And Stack Exchange should have never existed with their 'lame' Win stack (popular opinion of the Windows development environment among a certain class of developers =) ).

There are a lot of ways to 'skin a cat'. The only thing that matters is whether you can get to the finish line, build something people want to use, and perhaps monetize it so you can keep putting resources into making it better. Who gives a shit what you use to get there, just so long as you get there.

<comment><USER13> What a pleasant attitude painfully indicative of a certain kind of entrepreneur that can only see green in the world.

You see, what you call a "certain type of nerd" are actually craftsmen who enjoy things done well. You can be all the IKEA you want, and you're surely gonna rack up some interesting profits. But if I'm the kind of furniture maker who enjoys taking 6 months to build the perfect cabinet, you can be sure I'll pay special attention to selecting tools that I love. And none of your monetization arguments are going to count really.

So the bottom line is that PHP vs Ruby vs Python etc is a craftsmen's discussion. (If it's a serious discussion at all, that is - comparing it to Lean Startups isn't a serious discussion.) Bringing arguments like yours to such a setting just makes you look silly (especially when you think it's about "extreme optimization", then you just look like you really have no idea what you're talking about).

<comment><USER17> It's not a craftsmen's discussion. A craftsman picks the tools they feel the most comfortable with to get the job done.

Sure, craftsmen like to discuss their tools, but as an open exchange about their experiences in order to learn from it, or maybe even simply out of professional curiosity.

The whole "my stack is better than your stack", and the "PHP sucks" thing that is commonplace on HN, proggit and other forums is not a craftsmen's discussion. It's a juvenile playground pissing contest that has nothing to do with craftsmanship.

By the way, anybody who thinks that real crafsmen typically use the _"best"_ tools available has never seen neither an artist nor a plumber at work.

<comment><USER18> <blink>By the way, anybody who thinks that real craftsmen typically use the "best" tools available has never seen neither an artist nor a plumber at work.</blink>

Should go on top of proggit/hn (yes, including blinking tags :).

</comment></comment></comment></comment><comment><USER19> Articles like this really make it seem like PHP developers have a big chip on their shoulders from all the trash talking that goes on about PHP. I'm a PHP dev and I have to admit, PHP isn't cool. It's thought of as a language for bad programmers because it's so easy for beginners to pick up. That's precisely the reason why I'm a PHP developer to begin with! And boy have I given ammunition to the side that argues that PHP is a "bad programmers language". But oh well. That's really a good thing that total newbies can pick it up in a week like I did some years back.

But really no one cares about your language except other people with chips on their shoulders too. When people use a product they really don't care about the tech specs no matter what the product may be. They care about what it does for them. I can clone Facebook in Runy or Twitter in PHP with both clones being more "optimized" than the original but no one cares. They just want to write on their friend's wall or retweet something so they'll tell me to go to hell with my .235ms improvements in page load times, DB queries, whatever.

A truly good developer doesn't waste time convincing people his stack is best. He proves his skill instead by shipping and iterating no matter what the language. The rest is just too-cool-for-PHP bragging (looking your way Ruby guys) and sour grapes (looking at you PHP).

</comment><comment><USER20> LOL

</comment><comment><USER6> Maybe it's just me, but I don't think having a crappy development environment is a very good way to build things quickly. Perhaps in the days when there were few stable alternatives, this may have made some sense, but there are so many easy alternatives these days.

Perhaps the PHP community is different now from when I left it a few years ago. I'd never go back to that.

<comment><USER6> Honest question to the downvoters: All the libraries available at the time I was coding required a day or two of getting lost in documentation before I could use them. Has this changed in the past couple of years?

<comment><USER21> I'm not a downvoter, but as a Django dev who was forced to grab a quick project in PHP after almost 3yrs not touching it - no, it hasn't changed much. Doc comments and discussion boards are still filled with one gazillion solutions to every simple task, of which most is crap (even when it comes to fresh frameworks). Language features aside, what makes me stay away from PHP is the low quality of it's ecosystem (no offence to the good guys who put quality code out there), especially when you get used to the level of Python solutions and community engagement.

</comment></comment></comment><comment><USER22> Yes, I'm a Ruby fanboy, but this is ridiculous. These days, Ruby and Python are the lingue franche of quick web development. PHP had its heyday, and it's still terribly useful for Drupal-y and MediaWiki-y things... but building something from scratch?

Not a chance.

<comment><USER23> Couldn't agree more</comment></comment>


Show HN: Envision – AI-powered camera for the visually impaired - <AUTHOR> Greetings,
We are two guys who have been working with visually impaired people to understand how can computer vision deliver meaningful value to them. Our design centered approach to this has lead to two conclusion: a context-aware AI that anticipates what information user is looking for and an unobtrusive & non-stigmatising wearable camera.
We have been able to achieve the first part of it which we have just launched as a beta app. The idea is to use this as a platform to understand what contexts and feature need to be added to improve the experience. We are also going to use this to derive our hardware specifications for the camera that would compliment it and complete the experience.
We are trying to push this out to as many visually impaired users as possible, so do spread the word to people you might know. We would also like you to take it for a spin and drop us feedback if you have any.
iOS App Store link: http://goo.gl/fptaYQ
Cheers, <comment><USER2> Non-stigmatizing camera seems pretty easy.

This guy frequently gets into battles with scientologists and the LAPD

[https://www.youtube.com/user/TheEndOfScientology](https://www.youtube.com/user/TheEndOfScientology)

all the time they make him put away a phone or digicam, but nobody seems to notice he is wearing a body camera.

</comment><comment> kar-ma Hey guys! We're the co-founders of Envision. Would love to get any questions answered about our work so far!</comment>


Is It Time to Ditch IE6? - <AUTHOR> http://www.sitepoint.com/blogs/2008/08/25/is-it-time-to-ditch-ie6/ IE6 turns 7 years old this week. Its successor is almost two years old, and IE8 is on the horizon. So why do so many web sites still support it? Why do so many people still use it? And is it time we said, "Enough is enough," and dropped support for it completely? <comment><USER2> How militant some developers have become about ditching ie6 doesn't really make sense. It decision seems pretty clear: if you are a site for techy users you don't need to bend over backwards to support it, and you can probably drop it; if you are a general-use site or site that plans on having 30+ year-olds you better have some support for it or you're taking a 25-30% hit.

We tell our ie6 users one time (at registration) that their browser is not up to date and that they should upgrade to ff or ie7 to take advantage of all of our features. I've seen this solution that looks nice and unobtrusive: <http://www.pushuptheweb.com/>

I asked my girlfriend a few months ago why she never upgraded ANYTHING on her computer, ie6 included, and she said she only wanted to check her email and buy things, and that installing updates always took more time than she wanted to spend in the first place, and that she wasn't sure which updates to trust. Many people can't upgrade their browsers, many people don't care to, many people don't know why they should.

oh well. that's the world of warcraft that you play :)

</comment><comment><USER3> Yahoo uses the Graded Browser Support policy (<http://developer.yahoo.com/yui/articles/gbs/>) for a reason. It's because we check what % of our users use each browser and support the appropriate ones.

You can bet that if Yahoo is still choosing to support IE6 it's because a decent slice of the internet still uses it. That said, IE <6 is on our C-grade list. This means we actively block them from getting JS/CSS and display a "nag" message with upgrade information.

</comment><comment><USER4> Just treat it like Netscape 4 or Lynx or whatever -- try to display _something_ meaningful, but don't bother about getting all the details to work entirely right.

<comment><USER5> Exactly. Many people aren't choosing to still use IE6 - the choice is being made for them. I work onsite in a non-profit sometimes, and they are all still on IE6 until the IT dept decides it's safe/worth it to upgrade. (EDIT: And I do my part to convince them it is safe and worth it.)

I feel like every month or so, a big site says "Death to IE6," then people point out that it's not always an individual decision to upgrade, then someone like marijn points out the most reasonable solution. Make sure the content comes through, make sure it doesn't look completely ridiculous, and educate clients as you go. And if you're lucky, like 37signals, you can decide for your clients. We'll get there eventually.

</comment></comment><comment><USER6> I am one of two front-end engineers at a major site with 10 million members. We're having this discussion internally. From our side we want to stop because 80% of our time is actually spent on making things work for IE6. It's a huge number. 80% of my salary is being spent on less than 30% of our audience. 78% of our total traffic is IE, with 66% of that being ie7 and the remaining being 34% ie6.

The biggest hurdle we face is that we aren't a small company. We can't make smart decisions like adding upgrade prompts because marketing would throw a fit.

The approach right now we are taking is to get data. Microsoft ends support for IE6 in July 2010 when support for WinXP SP3 ends. After reading about the blogger who found only 2% of his ie6 visits were real, I am now looking into that for us. On our projects, I am keeping track of how much time is spent on supporting it versus ie7, ff, and safari. What it boils down to is that we will only be able to drop support when we can prove it costs us more than we make from ad clickthroughs from ie6 users.

<comment><USER7> What you you building that requires you spend 80% of your time fixing for IE6? I can't even imagine.

<comment><USER6> First, 80% is an off the cuff comment/estimate. Obviously its not that high, but it is still very high. I had meant to say 'feels like 80%'.

When you work for a large company and the major decisions on visual design are made by other people, you have little control over how it looks or behaves, and only the freedom to code. Unfortunately, this breeds an atmosphere where people with little concept of the _difficulties_ of implementing cross-browser designs are the ones expecting and demanding that they work in IE6 and "it should look like the picture from the design team."

So yes, a site or feature that takes me hours or a day to code up and be proper in FF, Safari, and IE7 usually adds up to 4x the same amount of time to make it work in IE6. Not always, but often enough that it has become an issue.

</comment></comment></comment><comment><USER8> YES</comment>


Ask HN: How do you keep up as software developer stuck at home? - <AUTHOR> Hello, i'm a software developer that's Chronically ill which doesn't allow me to leave home for the time being(probably months or years..if ever).
I spent 2 years and 6 months working on a local company before leaving due to my health getting worse and other issues (some vital members of the team were jumping ship and i was getting overwhelmed with work), i can still code when i'm "stable" but when i get flares my productivity drops (even thou i keep trying..way slower but...),i'm inconsistent, my long absence from work (been off work since august 2016) don't inspire any trust in companies looking for a remote worker..  :( (and i don't blame them, i'm like.. a walking red flag for hiring managers)...i feel kinda depressed because i feel like i'm on this position where i cant apply locally neither can i try remote  (i'm kinda burnt out of so many rejections)..
i can go out, but right now i'm only going out for doctor visits/blood tests etc, and to finish my college capstone (1 day a week).. i spend my  free time doing tutorials (udemy, pluralsight etc)..but lately even that feels like wasted effort :/.
i wish i could get something going so i can work again and get some income or get a remote work of some kind in the future..but stuck on this "don't have enough experience, cant get enough experience" and my current condition of instability makes it hard..
any suggestions?
thanks,
(update) github:https://github.com/samueldaviddelacruz
linkedin:https://www.linkedin.com/in/samuel-david-72ab9084/
don't have much on github so far, but trying to fill it in with more stuff. <comment><USER2> If you are in a situation where you can't code, there are enough good code conference videos on YouTube to keep you busy for several lifetimes. Also, you can watch the CS classes of many top-tier universities for free. But, videos are only good for keeping you informed about new tech and techniques. Speaking as someone who watches a ton of tech vids, they are not a good way to build a working understanding of anything.

To build skills, you are going to need to code. I don't know about your particular situation, but I expect you'll need to experiment with a few different approaches before you find one that works for you. For example: you know C#. But, maybe learning Haskell would set you up to read and think a lot more than you type. Or, maybe Python would be more fun, easy and motivating even when you are feeling bad.

<comment><AUTHOR> I can code at home !, But im stuck at home due to illness (unstable with not very predictable flares),i have been tinkering with other languages and frameworks (right now i want to learn golang)

</comment></comment><comment><USER3> Udemy is good. Tutorials are good.

Make sure you've got something on your github.

If you find a bug, a typo, a missing test, submit a patch if you can.

If you have an idea, open an issue for the project.

Just getting involved on a small thing here and there opens doors you may not even be aware of.

Take this time to contribute what you can.

<comment><AUTHOR> yes, i'm working on my github on my free time submitting new stuff :)

</comment></comment><comment><USER4> It sounds like you already have worked at least a little in the industry, what is your background/expertise/experience?

<comment><AUTHOR> at my last job I worked as a junior Web dev(ASP.NET MVC,angular 1 ,jQuery,Oracle PL/SQL for some light DB stuff and WCF(as service layer), i also have tinkered with Nodejs on my free time and angular 2+ with Ionic framework.. so i feel kinda comfortable on C# and JS.

github:[https://github.com/samueldaviddelacruz](https://github.com/samueldaviddelacruz)

linkedin:[https://www.linkedin.com/in/samuel- david-72ab9084/](https://www.linkedin.com/in/samuel-david-72ab9084/)

don't have much on github, but trying to fill it in with more stuff.

<comment><USER4> Are you setup to issue tax invoices to clients?</comment></comment></comment>


Ask HN: What are the small things that you'd automate in a software dev team? - <AUTHOR> Typically there are a lot of IFTTT kind of tasks that we do as part of our daily lives - if we are working on a ticket, we create a branch of code, if we start the work, we mark the ticket as in progress, if a qa verifies all the test scenarios, we promote the deployment and so on. What would be your few things you would automate? <comment><USER2> I think there's so much that can be automated that isn't, in every team I've worked in. Almost everything other than non repetitive / creative processes (design, coding, exploratory testing) should ideally be automated.

The reason it doesn't happen most of the time is because other than automating tests, where the benefit is super obvious, there's no role or job assigned for automating stuff specifically. It's usually done as part of another job, such as someone responsible for SRE. Automation doesn't mean it's set and forget, it needs maintenance, updating, as processes change. People often automate once, realise the process has changed, deem the automation a failure or useless now, and because things need to work right away (to take care of other deli erivables understandably) they don't update the automation program but rather continue doing things manually because of the instant success of achieving it manually.

Automation takes upfront investment but the idea is it pays off over the long term. If people think processes are going to keep changing and the automation system is not flexible to deal with that it won't happen. It needs a dedicated person to do this and maintain this in larger teams.

You also need to figure out a way to demonstrate the value of you having taken the time to automate something, especially if your management/leadership isn't clear on it. Shameless plug, I work on Tesults ([https://www.tesults.com](https://www.tesults.com)) for reporting test results, and even though the primary aim of it is not to demonstrate the value of automation it is definitely a byproduct/side-effect, customers have said this.

Personally I'd focused on the obvious first: tests, build processes such as getting code from repos for building, release artifact output. For mobile apps for example have ipa and apk files automatically available for download by manual testers. Then go onto less obvious things like automated sprint creation for upcoming sprints in JIRA etc with their API. If in marketing, perhaps social media automation for things their apis allow.

</comment><comment> duncan-donuts One thing I've wanted my team to automate is on boarding new microservices. Being able to create a repo, generate the baseline configuration necessary and deploy a container all within an action or two. The reason we haven't is it seems like a lot of work for a process that doesn't happen very often (once or twice a month)

<comment><AUTHOR> We wouldn't want it to be too easy to create a new microservice, would we? :) Kidding aside, the closest we got to was a template service with a hello world API which has all the basic configuration goodies in a repo. Anytime we need a new service, we fork it, and start working on it in a few minutes. Wouldn't that work?

<comment><USER3> > We wouldn't want it to be too easy to create a new microservice, would we? > :)

i'll assume you're serious, so i agree. every time someone launches a new service, there's an ongoing burden to maintain that service in production. so maybe one heuristic would be to make the cost of launching a new service roughly comparable to the discounted cost of maintaining that service for its entire expected lifetime. then you could use the rule of thumb that if it costs you X to build it, it'll cost you a second X to maintain it, so you should only do it if you get > 2X value out of it.

see also: [http://classicprogrammerpaintings.com/post/131118350394/army...](http://classicprogrammerpaintings.com/post/131118350394/army- of-contractors-migrating-to-microservices)

</comment></comment></comment><comment><USER4> All local code should be backed up all the time, not just when you commit and push. I'd love that for peace of mind.

Having meeting times from outlook appear on slack would be nice. One place too look.

Maybe a slackbot for new starters. Not as a replacement for human interaction but to aid in their induction.

<comment><AUTHOR> Outlook meeting times on Slack is an interesting one. Do you see it more like alerts or someone else's meeting times in Slack that you can see?

<comment><USER4> Alerts. The idea being that slack alerts are better. Outlook seems to alert you but you can miss it, then the next day tells you about yesterday's meetings. Plus looking at one thing for alerts is more likely to work.</comment></comment></comment>


Software has its own Gresham's Law - <AUTHOR> http://www.cs.uni.edu/~wallingf/blog/archives/monthly/2015-06.html#e2015-06-14T09_17_33.htm <comment><USER2> The same dynamic shows up in a number of other systems. For example:

The Peter Principle. People who are performing well in their current role get promoted out of that role, until they reach their level of incompetence. At that point, they get stuck. Eventually the whole organization consists of nothing but incompetent people.

Gerrymandering. A political incumbent who redraws his district to include more supporters will last longer than one who doesn't. Eventually, _all_ districts are gerrymandered, and all incumbents are virtually unassailable.

Vendor lock-in. A company that promotes consumer choice is easy to switch away from; one that promotes lock-in, by definition, is hard to switch away from. Eventually everyone will be buying from vendors they're locked into. (Unless the former company's products are _much_ better - this was the strategy Google pursued until ~2011. Note, though, that they achieved this through some measure of _employee_ lock-in.)

Basically the only requirement is that "good" solutions are more liquid than "bad" ones. Many, many systems exhibit this property.

You could look at most of modern society as a way to generate feedback loops _on top_ of this dynamic to mitigate it. For example, an organization full of incompetent people is likely to go out of business and be replaced by a new one, often one founded by the very people who were driven out of the original. (See: Disney => Pixar, Apple => NeXT, Shockley => Fairchild => Intel, Netscape => Firefox => Chrome.) Similarly, a company full of bad, hard-to-replace code either embarks on a complete rewrite, or they're vulnerable to a startup without that baggage.

<comment><USER3> 'Basically the only requirement is that "good" solutions are more liquid than "bad" ones' \- this could be used as a criteria to identify both good and bad stuff

</comment></comment><comment><USER4> I look at code as biology. It competes in its environment. As it becomes more complex it can fight off all competitors.

Code grows toward irreplaceability. That's why we are surrounded by code that is hard/impossible to replace.

We shouldn't be surprised if code feels like Kudzu after it has been around for 10+ years.

<comment><USER5> Interesting that nobody have brought up the topic of computer viruses yet. People tend to grasp the evolutionary parallel better with parasitic software than with symbiotic one.

</comment></comment><comment><USER6> Exactly this happened with a lot of Smalltalk projects. The ones which were structured such that the Smalltalk Refactoring Browser parser could be used to accelerate porting projects -- usually the better architected and factored codebases -- could leave Smalltalk for other programming environments. Even if syntax driven code translation wasn't used, the better factored projects were still easier to port.

(And to head off the usual criticisms of automated code translation, this tends to work well, when the project has well adhered-to coding standards and patterns, so that idiomatic code in language A can be matched and translated to idiomatic code in language B. In other words, if there is a consistent use of project-level idioms, it's easy to do good idiomatic translation at the language level. The other necessary ingredient is a powerful parser+meta- language which can fully express the capabilities of the source and target languages.)

</comment><comment><USER7> And this is why I hate systemd: its primary design criterion, it seems, is to be as difficult to replace as practically possible -- in stark contrast with sysvinit, OpenRC, etc. Once it's suitably entrenched it can simply be declared "the standard" and then Linux systems without systemd will fall out of compliance and hence out of support by the greater ecosystem.

</comment><comment><USER8> I disagree with Sustrik's assumption that software drifts to become a collection of non-reusable components. His observation is an interesting theory but I think it breaks down because it could only really be a "law" if it is true that reusable (does he mean replaceable?) components are always switched out for irreplaceable ones.

Most projects I've worked on start out hairy messes and if they are cursed with success new requirements will eventually justify the cost of replacing the irreplaceable. Well designed components aren't quickly switched out for poorly designed ones because developers don't want to let that happen. Its not safe to assume that poorly written components are better suited to survival... to the contrary, they are the most likely targets for removal in the first place.

<comment><USER9> It doesn't require that replaceable components are always replaced with non- replaceable ones. The point is that over time, a replaceable component is likely to be swapped out multiple times, until, probably by accident, it is replaced with a component that is no easily replaceable, as which point it becomes stuck (e.g. glue code is written specifically to interface with that component and would be difficult to rewrite for a replacement).

In mathematical terms, you can imagine it as a Markov chain describing the component currently slotted in, where non-replaceable components are the absorbing states.

<comment><USER10> If the easly replacable component is good, there will be no reason to replace it at all. Components aren't getting replaced willy-nilly.

<comment><USER9> Yes, but easily-replaceable components are still going to be replaced more often than difficult-to-replace ones.

<comment><USER10> Zero * n is still zero.

</comment></comment></comment></comment></comment><comment><USER11> You could see this in action with GCC if I remember correctly; they purposely made it a monolith so that it was harder for proprietary plugins to be added; therefore only GPL'd and LGPL'd components would be worked on.

</comment><comment><USER12> The Gresham's law analogy is a crock. Gresham's law happens because the government compels merchants to accept the bad money as being equivalent to the good, but it can't effectively compel customers to spend the good money.

<comment><USER13> Yes, without government coercion, it's simply Thier's law: good money drives out bad. So if software tends to degrade over time, what's playing the perverse role of preventing people from switching to better modules/software?

<comment><USER14> There are of course all sorts of ways that a public API can become an entrenched standard (x86, Windows, PHP, JavaScript, C++, HTML, Java). Collectively we call it "lock in".

The thing is, the software wouldn't have been adopted in the first place if it didn't fulfill some need. Evolutionarily speaking, it's better for the cost of removing to be high and the benefit of keeping it to also be high. The most evolutionarily fit would be software that's essential, yet complicated, obscure, and unsexy, so it doesn't attract attention of idealists who will put in sufficient resources into rewriting it.

Even better if it attracts passionate advocates who will _fight_ removal.

<comment><USER15> OpenSSL immediately comes to mind, but I don't think JavaScript really fits the model - it is still evolving into a better language. In a very real sense, EMCA7 is an entirely different language than EMCA5.

</comment></comment></comment></comment><comment><USER16> This makes sense at the level of programmers as well. A programmer that does their job well is easily replaceable because the code they write is easy to maintain and so they will be replaced by someone who is not as good of a programmer and writes less maintainable code.

<comment><USER17> Speaking through my long white beard, I would say this is not _trivially_ true. If we follow what the article says and say this is about survival in a particular niche, then yes, Programmers who are good at a specific job will eventually be replaced at that job, while programmers who are terrible at that job but not obviously so will tend to stay in that job.

Thus, if you want to maintain the same piece of the same legacy application indefinitely, be terrible at at. Whereas, if you are good, do the job _and move on_. Whether that means moving upwards, or to new pastures, or embracing new technologies, being good means constantly renewing yourself.

The caution in all of this is that if you fail to be good, not only will you be irreplaceable, but you will also be immobile. So, either polish your skills on a regular basis, or polish your Swingline stapler.

<comment><USER18> This made me recall Meilir Page-Jones' book "Practical Project Management" from way back...

"Second, employees who are truly competent and are eager to make a genuine contribution to the department soon resign from a mediocracy, leaving behind them the dross of nonproducers and internecine warriors. I term this effect the Inverse Gresham's Law: A mediocracy hoards mediocre people and drives good people into general circulation."

[http://www.waysys.com/book-excerpts/ppm- ch15.html](http://www.waysys.com/book-excerpts/ppm-ch15.html)

</comment></comment></comment><comment><USER19> I think this is not so much a "law" as a failure mode. It up to the programmers, objectives, time constraints and economic considerations whether a concerted effort is made to increase code quality or to go for the "quick fix" at the expense of long-term maintainability.

<comment><USER4> Anything that changes continually with a bias toward preserving existing structure ends up looking like biology in some way.

When people add to existing methods rather than creating new methods, or add to existing classes rather creating new classes we end up with that organic feel. Fruit starts green, grows ripe, and ends rotten.

The fact we need to face is that this is what people do naturally. It's not an accident. It's more like behavioral economic incentive.

</comment></comment><comment><USER20> I'm currently tending a 16 year old Java codebase, with very little in the way of maintenance in the years since it was written.

"Software over time tends towards monsterism." is apt in my mind.

<comment><USER21> Any constraint not imposed by a compiler is a degree-of-freedom that will drive a system toward complexity. It takes extraordinary effort and discipline to avoid this, especially over the long term. (One way of thinking about what architecture is is defining what allowed DoFs are on a system, so if you need to add a field to a form or implement some feature, the architecture is the thing that maps to individual concrete artifacts.)

</comment></comment><comment><USER22> With the amount of code developed in open git repositories, surely it is possible now to quantify these observations? Bring hard facts to the discussion.

<comment><USER23> That's a great point but the amount of analysis seems huge. Also what to quantify exactly? (and the criteria is different per programming paradigm)

<comment><USER5> What about looking at evolutionary biology? Those guys already have some methodological apparatus in place.

</comment></comment></comment><comment><USER24> systemd anyone?

<comment><USER25> Thank you. You beat me with that one :)

</comment></comment><comment><USER26> Gold is never "good money".

it was a good material for making tokens back when making hard worn notes was a virtual impossibility.</comment>


Typesetting Markup Language (TML) – A Superset of Groff (2016) - <AUTHOR> https://lists.gnu.org/archive/html/groff/2016-01/msg00003.html <comment><USER2> Funny how after a few messages the author is brought to discuss SGML:

> I'm not familar with SGML, but will have a look.</comment>


Apple shows ambition to get into self-driving car race - <AUTHOR> http://www.reuters.com/article/apple-car-idUSL1N1DY0BN <comment><USER2> [https://news.ycombinator.com/item?id=13098186](https://news.ycombinator.com/item?id=13098186)

</comment><comment><USER3> From the BBC article [1], my favorite quote was that Apple _" proposes that companies in the industry share data from crashes and near-misses in order to build a more comprehensive picture than one company could manage alone, and therefore enable the design of better systems."_

Aka 'It would be really helpful if we could have access to Tesla's road training data.'

It's a good idea in principle, but if Apple wants access then they can damn well afford to pay for it.

[1] [http://www.bbc.com/news/business-38199880](http://www.bbc.com/news/business-38199880)

</comment><comment><USER4> I'd like to see an architectural overview of a self-driving car. What are the most challenging systems? I can imagine that the most challenging part is the computer-vision system for detecting the road, and the radar system for detecting other vehicles and pedestrians. Given this information, finding a path from A to B without collisions seems not so difficult in comparison.

</comment><comment><USER5> Looks like all the mega-corps are buckling and now indulging in a race to the bottom called "untold liability". I really wish I will be proved wrong.

On the other hand, there actually doesn't seem to be much happening on Apple's side. This is like the "blog post in lieu of a product" for taking "pre- orders". :-)

<comment><USER6> Or it looks like all the newspapers are trying to indulge corps into self driving cars because it's hype and people read the articles about that.</comment></comment>


Ask HN: Anyone going to the Ruby Midwest Conference this weekend? - <AUTHOR>

The Ruby Midwest conference (http://rubymidwest.com) is this weekend (July 16th and 17th) here in Kansas City, MO and my employer is sending myself and another developer on our team. I was just wondering if any of my fellow HNers would be attending? <comment><USER2> I'll be there. I'm speaking on Saturday. :-)

</comment><comment><USER3> I'll be there to (and speaking!)

</comment><comment><USER4> I'll be there. :)

</comment><comment><USER5> I'll be there.</comment>


Sherpaa, Jay Parkinson's Health Care Startup, Launches - <AUTHOR> https://sherpaa.com/

<comment><AUTHOR> I couldn't really think of a good term for the kind of start-up, but here is the text from _What Is Sherpaa?_

        Sherpaa is around the clock email and phone access to
        our friendly, NYC-based doctors (or Guides as we call
        them). Whenever you have a health question or concern,
        we're here for you. And we play nicely with the insurance
        you've got.

In other words, it's a start-up that aims to disrupt the usual routine with a general physician: diagnosis, prescriptions, treatment - 24/7. If you will, with the addition of "curated" specialists just to hit the lingo quota.</comment>


Egyptian Army Medical Research: AIDS in a Kebab Skewer - <AUTHOR> https://www.youtube.com/watch?v=O1fdHT5PfcA

<comment><AUTHOR> Even if most of the youtube comments are taking this for a fake it seems that there is something behind as the commenter Andrew Leber pointed out:

"This guy (Ahmed Ameen, the purported inventor of the device, referenced in this Guardian article from a year ago [http://www.theguardian.com/science/2013/feb/25/scientists- di...](http://www.theguardian.com/science/2013/feb/25/scientists-divided- device-hepatitis-c?guni=Article:in%20body%20link)) might be going off-script in talking about kofta, etc., but the military made this device part of a their presentation on technology the army is contributing to Egyptian society"

It would be great to see some cure for AIDS or Hepatitis C.</comment>


Unpacking HP Firmware Updates - <AUTHOR> https://jsof-tech.com/unpacking-hp-firmware-updates-part-1/ <comment><USER2> This article is bringing to light a lot of stuff that needs to be said about printers.

Also somewhat depressingly, HP is definitely the most secure printing company. That's not a very high standard though. But what it means is everything these guys have found...is much worse worse at every other printer company. HP was the first printer company to join HackerOne I believe, shockingly they still make some of their server brands in the US, and the security options on their entry level enterprise printers (m406) show at least some effort was put into them (for instance only allowing SNMPv3).

Yet at the same time, why can I only have a max 16 character password on the web management portal? Why does the username _have_ to be "admin" which is obviously super easy to guess?

NOTE: I first saw this article as a promoted tweet on Twitter. This was hilarious to me because it was the first time I had had a relevant promoted tweet shown to me where I also didn't feel like the party involved was being misleading in some sort of way.

EDIT: Had trouble accessing their site. Some things to note that they found:

\- Why do you have to download the updates manually from HP? Why can't the printer check? Why is it not automated? This process is awful. Do you then upload the zip file of the update to the printer or the bin file inside, or is it the bin file plus the md5 hash?

\- PCL and PJL are languages that predate IP. Very insecure and so many things that have never been fixed.

<comment><USER3> The analysis in TFA is of the previous generation OfficeJet Pro 8720 which was introduced in 2016.

This is fascinating but I'm looking forward to folks poking around at the current generation of printers because HP changed a lot about the firmware security lately.

I recently purchased an HP OfficeJet Pro 9015 which was introduced in early 2019. This newer printer has automated firmware updates enabled by default. The new generation OfficeJet Pro 8025, 8035, 9015, 9025 and similar offers several security benefits over the previous generation according to a report [1]:

\- Firmware Integrity and Secure Boot

\- Automatic Firmware Recovery/Self-Healing BIOS

\- Run-Time Code Integrity

\- Automatic Firmware Update

Agreed: HP is the most secure printing company from what I can understand. Nobody else in the printer business has these security features in their products. Security elements like secure boot, firmware integrity, and automatic updates are things I expect now.

[1]: [https://www.keypointintelligence.com/media/2240/hp- officejet...](https://www.keypointintelligence.com/media/2240/hp-officejet- pro.pdf)

<comment><USER4> Glad to hear that they took our advice, and enabled automatic firmware updates by default. We suggested this feature when we helped them fix the fax vulnerabilities (DEFCON 26 - What The FAX?!), happy to see they listened.

<comment><USER3> And speaking of printer vulns, I believe it'd be really interesting to investigate IPP over USB as a attack vector to pwn otherwise secured hosts.

Despite using a VPN which forwards all of my network traffic on macOS, I can still access my printer's web server because of the automatically configured IPP-USB connection which provides a reverse proxy to the printer's embedded web server over USB. I haven't seen many articles detailing how this works and how it's secured...

</comment></comment></comment></comment><comment><AUTHOR> We reverse engineered an HP printer. Our first of a four-part blog series documenting the HP printer firmware update format.

<comment><USER5> We killed your DBMS: Error establishing a database connection

<comment><AUTHOR> The site is back on! Enjoy the read

</comment></comment></comment><comment><USER6> Relevant Defcon Talk [https://youtu.be/qLCE8spVX9Q?t=671](https://youtu.be/qLCE8spVX9Q?t=671)

<comment><USER4> Happy to see that people still remember our talk :)

</comment></comment><comment><USER7> Mirror: [http://archive.is/O6Sn7](http://archive.is/O6Sn7)

</comment><comment><AUTHOR> The site is back on! Enjoy the read [https://jsof-tech.com/unpacking-hp- firmware-updates-part-1/](https://jsof-tech.com/unpacking-hp-firmware-updates- part-1/)</comment>


Will Agents' Mutual Members Ditch Rightmove or Zoopla? - <AUTHOR> http://www.realpundit.com/home/2014/will-agents-mutual-member-ditch-rightmove-or-zoopla

<comment><AUTHOR> The answer is obviously Zoopla...</comment>


Why Backblaze Bought a Porn Site - <AUTHOR> https://www.backblaze.com/blog/why-backblaze-bought-a-porn-site/

<comment><USER2> Coincidentally, at the last company we did, MailFrontier...someone also registered the misspelling MailFronteir and put up a site selling condoms.</comment>


Google Chrome Receives Heavy Criticism in Germany - <AUTHOR> http://blogoscoped.com/archive/2008-09-07-n33.html <comment><USER2> I am from germany. You shouldnt overestimate the warning. Some background information:

1\. You have to know the context: The situation is very special in germany at the moment. Here is a big discussion about privacy and data security. There was a big scandal some weeks ago because a call center company sold some data from its customers and other companys abused these informations. Somehow the politicians and goverment agencys have a "bad conscience" now.

2\. Im a lawyer and i think if the warning is really an official warning it is rather problematic (for the goverment agency, not for google). But one has to know that in germany some ministries understand themselves somehow as consumer protection agencies. It is a little bit different than in other countries i guess.

3\. The warning is more directed to people who dont know much about the internet: mums and dads and aol-users and so on. The goverment agency didnt tell them anything different then that what every reader of this page here already knows.

</comment><comment><USER3> > Furthermore it was said to be risky that user data is hoarded with a single > vendor. With its search engine, email program and the new browser, Google > now covers all important areas on the internet.

Good thing no other company offers this trifecta. Or if they do, they must be really small, for the German government not to have heard of them.

</comment><comment><USER4> The thing I find most interesting about journalistic coverage of Chrome is that they haven't brought up the elephant in the room: Chrome will not and will never have an (official) ad blocker.

Sure, Google also wants to have a stable client side for their javascript- based software, but the reality is that those programs don't make them the kind of money that search advertisement does. With Microsoft controlling the browser, they could conceivably release an ad blocker in IE8 and turn it on by default. Google would be in serious trouble very fast.

I'm not trying to say that this will happen, just that Google's being smart and mitigating risk. Until they start making serious money from their office applications, however, creating their own browser seems to me to be a defensive move, not an offensive one.

<comment><USER5> Microsoft is trying to build a large ad business also. Why would they release an ad blocker?

I doubt we will ever see an ad blocker from any commercial entity. Unless, of course, ad blocking is the only motivator behind the entire business. Somehow, I don't really expect that either. Consumers of ad blocking software probably wouldn't be the kind of people who pay for things like that :-)

<comment><USER6> is it even legal to create an ad blocker or use one?

assuming it's altering the content of the site it's directly violating the copyright of the site.

<comment><USER7> Of course it is legal. Is it illegal to throw away the advertisements from your newspaper before you read it?

<comment><USER8> But is it legal for a 3rd party to scan in your newspaper, remove the ads, then print it out and sell it to you?

That is a more accurate analogy. It's stealing and depriving the publisher of their income.

In any event, getting past adblockers is really really simple. It always will be, and if you think an adblocker can block anywhere near all adverts, you should go read up on how things work.

<comment><USER9> Educate me - which adblocker is it that you know of that removes the adverts from websites and then sells the resulting ad-free site to the user?

To suggest that blocking an advert is stealing assumes that the author of the web page would make money off that advert in the first place. Furthermore, that logic suggests that anyone who chooses to ignore advertising rather than just blocking it is also guilty because they're depriving the publisher of a potential income too. Total rubbish.

<comment><USER8> Blocking an advert when viewing an ad supported website is stealing.

You are stealing bandwidth, processing power, storage, electricity, etc

Society is about give and take. Adblocking is about take.

<comment><USER9> Like I said, by that logic anyone who chooses not to click adverts are also stealing.

Do you click every advert you see just to make sure you're compensating for 'stolen' bandwidth, processing power, storage, electricity?

FYI: I redistribute scripts under GPL licensing. I don't ask for donations, nor do I litter my pages with advertising. I consider that pretty "giving" - and no, I don't have problems with people 'stealing' my bandwidth, processing power, storage or electricity.

<comment><USER8> No, I treat websites with the benefit of the doubt. If they provide advertising that is useful to me, I click on it.

By blocking all advertising on all websites you're sticking your fingers in your ears.

Personally, I find adverts useful. Websites that resort to crappy user experience adverts - popups/unders/flash etc usually aren't worth visiting in the first place.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Trusting Facebook that its code will not break your website - <AUTHOR>

This is a Jing video of what happened to me on http://developer.zendesk.com: https://dl.dropbox.com/u/32611441/2013-02-07_1626.swf <comment><AUTHOR> Their "Move fast, break things" motto may not go along well with your product. When you add Facebook's Javascript on your page you trust them that they will not make something dumb... but sometimes they do.</comment>


Roll Your Own VPN/HTTP/AdBlock Service? - <AUTHOR>

With all this Verizon header injection stuff going on I wonder if there is a way to combine a a VPN service like OpenVPN running on my own server to also do HTTP compression and perhaps Ad Blocking?
I would only use this on my families phones on our limited Verizon data plan so it might save us a few bucks a month and I will gain piece of mind that my family isn't being tracked everywhere they go.
A 3rd party doing this is http://www.onavo.com/apps/iphone but of course I am trading Verizon tracking for Facebook (The owners of Onavo) so I would love to run my own on EC2, or Digital Ocean or similar.
The dream would be VPN, Ad Blocking, and HTTP compression all in one on a hosted box of my choosing and in my name where only I have control.
Does anyone know of any open source projects doing this? I'd be happy to donate some money towards the cause as I think a lot of us on here could benefit from it <comment><USER2> It's actually super cheap & easy. The setup below costs a few dollars a year and uses ~20MB RAM total:

* Get a box from [http://lowendspirit.com/](http://lowendspirit.com/) (or [http://lowendstock.com/](http://lowendstock.com/))

* Install OpenVPN & setup client certs with [https://github.com/Nyr/openvpn-install](https://github.com/Nyr/openvpn-install)

* Setup your hosts file with [http://winhelp2002.mvps.org/hosts.txt](http://winhelp2002.mvps.org/hosts.txt)

* Install & config the OpenVPN connect app on each device (no SFTP? use [https://transfer.sh/](https://transfer.sh/))

</comment><comment><USER3> Privoxy is your missing piece. Combine that with OpenVPN.

For compression: [http://www.privoxy.org/user-manual/config.html#ENABLE- COMPRE...](http://www.privoxy.org/user-manual/config.html#ENABLE-COMPRESSION)

edit: Also, setting proxies on Android -- [http://w3epic.com/how-to-setting- proxy-on-android-phone-tabl...](http://w3epic.com/how-to-setting-proxy-on- android-phone-tablet/) ... iPhone: [http://appletoolbox.com/2012/08/how-to- set-up-and-configure-...](http://appletoolbox.com/2012/08/how-to-set-up-and- configure-proxy-settings-on-an-ipad-iphone-or-ipod-touch/)

<comment><AUTHOR> I went deep down this path today, and have it all working, but it looks like there is no way to enable Privoxy proxying just by connecting to Open VPN. Meaning I would have to connect to the VPN and then add in a proxy server. Will keep digging though. Great start.

<comment><USER3> Maybe this will help: [https://forums.openvpn.net/topic16143.html](https://forums.openvpn.net/topic16143.html)</comment></comment></comment>