When FFI Function Calls Beat Native C - <AUTHOR> https://nullprogram.com/blog/2018/05/27/ <comment><USER2> This is one of those things that sounds better than it really is.

The timing used here in this post is ns per call, which somewhat obfuscates what's going on. A better metric would be clock cycles of overhead, because the differences here are only around 2-3 clock cycles. In other words, the potential savings is going to be drowned out by jitter caused by things like the processor deciding to service interrupts, or your hyperthread partner doing work. If the relevant code is so hot that the cost is showing up in profiles, then very likely, the fact that a function call is going through the PLT versus being directly called is not going to be the thing that makes the most difference: it's the fact that you're making the function call in the first place.

<comment><USER3> Well, sure, but by the same measure and for the same reasons, "clock cycles" are not a deterministic measure of software performance, while "nanoseconds" are, by definition. The test can't easily control for cache effects (which are vastly bigger in aggregate than IRQ or SMT effects, FWIW), so it doesn't try and assumes everything averages out, and it does.

The reason the effect seems bigger than it is is that for all but the most trivial leaf functions, PLT indirection just isn't a big deal. Never has been, isn't now, never will be. It's a cool trick that a JIT can skip that step, but there are bigger fish to fry.

<comment><USER4> And the most trivial cases will be inlined more often than not.

<comment><USER5> Well FFI calls will never be inlined, by definition, and that's kind of what people are testing here.

<comment><USER4> This is comparing FFI calls against native C, and in idiomatic native C, short calls will be inlined

</comment></comment></comment></comment></comment><comment><USER6> The PLT is mostly a necessary evil of two requirements: lazy-loaded symbols and W^X memory. The former is necessary to reduce binary load times, and the latter is necessary for security (RWX segments in memory are ripe for abuse in the event of a vulnerability). A JIT trades off very differently: slow startup ("warm up" period) and often creates RWX segments, but gains speed advantages as seen here.

Of course, the GOT referred to by the PLT is itself is a bit of a security vulnerability, because it's usually a writable chunk of memory with a ton of frequently-called function pointers; corrupting it gives you relatively easy control over program flow. The new mitigation is "full RelRO", which resolves all GOT entries during binary load, then marks the GOT segment read-only. This gains in security, but trades off binary load time, and it is still going to be slower at runtime than the JIT. Full RelRO is usually off by default because of this added overhead.

Modifying the code segment to include direct function references (either during binary load or later, during runtime) is also not a great approach because it means being unable to share the code segment between processes, which would increase memory pressure. We could do what Windows does, which is to have static randomization (randomization of binary addresses is performed once per boot, not once per process), enabling code to be "statically relocated" lazily per boot, but this carries its own complexities, and opens you up to different security vulnerabilities.

There's no magic bullet here, unfortunately. There are just tradeoffs everywhere in many directions - between runtime speed, startup time, security and memory usage.

<comment><USER7> Static linking avoids this overhead right?

<comment><USER6> Yes, a statically-linked binary will have all internal references resolved by the linker. If PIE is disabled, the addresses will all be fixed, which makes exploiting such a binary much easier. Glibc has only _just_ added support for static PIE executables (in Feb of this year), and I'm not sure what the implementation is - whether it relocates all the references in the binary (increased memory usage), or uses a PLT/GOT approach to support relocations (increased runtime overhead).

<comment><USER8> Depending on the linkage, function calls internal to the library can use ordinary PC-relative function calls instead of fully indirect function calls. So you get the low per-call cost, but pay a higher per-process cost in memory consumption.

<comment><USER5> Exactly.

The cost of indirect jumps isn't implied by position independent (PIE/PIC) code alone, but by PIE/PIC combined with jumps across separately loadable segments. For jumps _within_ a segment you can just use a direct relative call which is the fastest type of call and doesn't require any load-time fixup ever.

Of course then there is also the consideration of symbol interposition: if you want to support that even _within_ a statically linked thing (usually something other than the main executable), then you need a GOT-like thing, but not necessarily a PLT-like thing.

</comment></comment></comment></comment></comment><comment><USER9> This reminds me of working with C++ and the Pebble SDK. The Pebble builds ELF binaries but doesn't have an ELF loader. It also uses position independent code. The SDK uses objtools to strip the code out of the ELF and the Pebble OS just copies the code into memory and jumps to it.

In C, this works fine. But in C++, gcc generates the GOT for virtual method calls but there is no ELF loader to fill it.

I accidentally found out if my code contains a destructor that makes an assignment to a static variable then no GOT is generated and virtual method calls work for the entire project! I'm not sure the logic behind that but this is the code that is needed:

        class SampleObject
        {
        public:
            //! Destroys the underlying Pebble window
            virtual ~SampleObject()
            {
                // The assignment to a static variable makes the virtual methods work for subclasses
                // I have no idea why!
                dummy() = 0;
            }

        private:
            // Dummy static variable needed for virutal method pointers to work (see destructor)
            inline static int& dummy() { static int dummy = 0; return dummy; }
        }

</comment><comment><USER10> Fortunately "native C" is not one, unchangeable thing. If the plt overhead really is important in your situation, you can still compile either static, or with "\--fno-plt".

</comment><comment><USER6> FWIW, I get very different results from inside my Linux VM (MacBook Pro, 2.9 GHz Core i7):

        jit: 1.433856 ns/call
        plt: 1.700611 ns/call
        ind: 1.404397 ns/call

The PLT is double-indirected (call->jmp->func), but the single-indirect call performs the same as the JIT. This backs up @tlb's note that modern x86 machines will predict indirect calls.

<comment><USER6> Now that I'm thinking about it a bit more - I recall that GCC 6.1 added "-fno- plt" for x64 targets, which replaces PLT calls with "call [func@got]" instead, eliminating the double-indirection. Unfortunately, I don't have a GCC 6.1 environment, so I'd be curious to see if someone can run the benchmark with "-fno-plt" and how it performs. A combination of that plus indirect call prediction should basically close the gap with the JIT approach.

<comment><USER11> It does close the gap.

Before:

      cc -shared -fPIC -Os -s -o empty.so empty.c
      cc -std=c99 -Wall -Wextra -O3 -g3 -fpie -pie -o benchmark benchmark.c ./empty.so -ldl

      jit: 1.541608 ns/call
      plt: 2.309939 ns/call
      ind: 1.540583 ns/call

After:

      cc -shared -fPIC -Os -s -o empty.so empty.c
      cc -std=c99 -Wall -Wextra -O3 -g3 -fpie -fno-plt -pie -o benchmark benchmark.c ./empty.so -ldl

      jit: 1.541836 ns/call
      plt: 1.539239 ns/call
      ind: 1.542874 ns/call

</comment></comment></comment><comment><USER12> A rule of thumb:If you see "faster than C" claims its either poor C or they use different code path/algorithm thats not equivalent to C code. A FFI that is faster than native, isn't FFI but some other mechanism that more direct - in this case bypassing the address of the function resolution. 'static inline' is of course even faster. The only C overhead i recall that is legit is libc startup time with glibc, and you can use faster libc alternatives.

<comment><USER13> Unless it is FORTRAN obviously

<comment><USER14> FORTRAN is only faster than C because it doesn't allow aliasing. Use the `restrict` keyword in C and you should get FORTRAN-like performance.

<comment><USER15> Fortran can give you much better speed at comparable code-complexity, as long as your problem is one which FORTRAN is optimized for, i.e. multidimensional array manipulation or numerical work.

</comment></comment></comment></comment><comment><USER16> Any micro performance gains from a function call will become rounding errors compared to the extra cost of any arithmetic operation on a dynamically-typed language.

It may be an interesting article for describing how JIT and some late- optimization techniques can produce optimized code given the right optimization preconditions, but I fail to see how the title is supposed to describe the contents of the article.

Last, but not least, performance-sensitive C code tends to be statically linked.

</comment><comment><USER17> PLT and GOT are quite orthogonal to the C programming language, these are implementation details of dynamic linking and shared libraries.

Back in the 90s we would statically link performance-sensitive executables to avoid this overhead. It didn't require changing the language.

</comment><comment><USER18> Damn, he beat me to the writeup.

> The most surprising result of the benchmark is that LuaJIT's FFI is > substantially faster than C.

[https://news.ycombinator.com/threads?id=ndesaulniers](https://news.ycombinator.com/threads?id=ndesaulniers)

</comment><comment><USER19> I'm still amazed that there is code in-lining across lineages. I saw that on the last post and I still can't imagine all of the edge cases that are being handled by that. Are there many other languages that do that other than LuaJIT?

<comment><USER20> Rust is planning to enable inlining C functions in the near future. I believe this should work in both directions, and works because they are both compiled using LLVM.

<comment><USER21> [https://github.com/rust-lang/rust/pull/50000](https://github.com/rust- lang/rust/pull/50000) is the first bit, [https://github.com/rust- lang/rust/issues/49879](https://github.com/rust-lang/rust/issues/49879) is the tracking issue.

</comment></comment></comment><comment><USER22> Time to bring back self modifying code?

A C program, that self modifies as it runs, to inline commonly called functions, or make direct jumps instead of indirect.

<comment><USER23> We already have these - JIT compilers as the other person commented. You can even get them for C if you want.

</comment></comment><comment><USER24> I didn't even know the plt existed... Fascinating. I'm curious if other JITd runtimes (like the jvm) offer the same optimizations

<comment><USER25> The JVM could do this, but there is a lot of other overhead for JNI calls (by virtue of the JNI API specification). Project Panama is working on improving native interoperability: [http://openjdk.java.net/projects/panama/](http://openjdk.java.net/projects/panama/)

<comment><USER26> I was under the impression that although C->Java is slow, Java->C calls have been fast for years, with the JIT generating full-speed calls - [https://web.archive.org/web/20160304055443/http://nerds- cent...](https://web.archive.org/web/20160304055443/http://nerds- central.blogspot.co.uk/2012/04/extreme-jni-performance.html)

<comment><USER27> It's fast, but it depends on exactly what you're doing. There is always a bit of work managing the stack and converting between ABIs, and JNI is quite poor in performance when dealing with anything other than primitive types.

The sort of thing Panama is adding is support for layouts of structures so that you can get results to and from C quickly, along with things like expressing vector algorithms in a way that allows good optimisation on different CPUs.

<comment><USER26> Sounds good. Better FFI is always good, and Java seems to be way behind .Net when it comes to utilising SIMD.

</comment></comment></comment></comment></comment><comment><USER28> Especially timely as Spectre/Meltdown mitigations put indirect calls and branch predictions under more performance pressure -- nice reminder of how these things work.

</comment><comment><USER29> How important is code sharing between processes for a regular Linux desktop or server distros? Could JIT compiled applications be a sensible default in the future?

</comment><comment><USER30> It would be great if V8 could follow LuaJIT in this.

</comment><comment><USER31> immutability ftw

</comment><comment><USER32> Uh, whatever. This isn't about LuaJIT, nor any JIT, nor C, nor any high-level programming language FFI.

        ELF != C
        C does not imply ELF
        ELF does not imply C

This is about entirely and _only_ dynamic linking vs. static linking. Selling it as anything else is bunk and click-bait.

And yes, dlsym(3) should return the address of the PLT, not the direct address of the function: so that dlsym(foo, "bar") == bar (when you can link with whatever object provides "bar").

</comment><comment><USER33> LuaJIT is awesome. It's just amazing how much information is available to the JIT. I've been using it for more than five years now and I still can't believe that such a high-level dynamic language actually _is_ competitive with C for system programming.

That Mike guy knows a thing or two I reckon.</comment>


Why may allopregnanolone help alleviate loneliness? (2015) - <AUTHOR> https://www.ncbi.nlm.nih.gov/pubmed/26365247 <comment><AUTHOR> Context: "Scientists are working on a pill for loneliness" [https://www.theguardian.com/us-news/2019/jan/26/pill-for- lon...](https://www.theguardian.com/us-news/2019/jan/26/pill-for-loneliness- psychology-science-medicine)

</comment><comment><AUTHOR> "Loneliness: Clinical Import and Interventions" [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4391342/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4391342/) (2015)</comment>


Firespotting – HN Clone - <AUTHOR> http://firespotting.com/

<comment><USER2> Discussion: [https://news.ycombinator.com/item?id=5732718](https://news.ycombinator.com/item?id=5732718)

Other submissions:

[https://hn.algolia.com/?q=firespotting#!/story/forever/0/fir...](https://hn.algolia.com/?q=firespotting#!/story/forever/0/firespotting)

</comment><comment><USER3> Why would you use the same UI?</comment>


Mozilla Wants You to Build Your Own Browser - <AUTHOR> http://mashable.com/2010/10/21/mozilla-chromeless/

<comment><USER2> This is an article from 2010 and the project is considered no longer active: <https://mozillalabs.com/en-US/chromeless/></comment>


Use Encryption Because You're Boring - <AUTHOR> http://codyromano.com/use-encryption-because-youre-boring/

<comment><USER2> The essay encourages us to use encrypted services in order to prevent traffic analysis. I have no issue with the overall goal. I have only a nit to pick, with the quote "It takes the teen's Web history into account when his family applies for coverage."

That specific scenario doesn't make economic sense. There's too much variability for the insurance company to make a good decision. Consider that a health teacher may assign students to research different common ailments, as part of a lesson to understand the available tools; a science teacher may bring up the story of H. pylori as a digestive disorder which was misunderstood for a very long time, and the student wants to learn more; the teenager may be helping a stressed out friend; the teenager might be interested in going into medicine and researches common diseases; and so on.

<comment><AUTHOR> Thanks for reading and offering feedback. I agree that web searches alone are variable, but some health care companies consider the data in aggregate, along with other factors, to develop profiles of patients. Here's one example of an insurance company using online browsing data to set insurance rates and policies: [http://www.cnbc.com/id/101586404](http://www.cnbc.com/id/101586404)

<comment><USER2> That article says nothing about "using online browsing data to set insurance rates and policies."

To start with, every insurance company develops a statistical model of each and every customer. Non-smokers get lower rates than smokers. Life insurance depends on age. That's how insurance companies must work.

That article says that some insurance companies use more than just risk factors in order to determine the price, but also information like market power (or lack thereof) for your market segment. For example, poor or immigrant people may not have the time or knowledge to look for alternative companies, so an insurance company may offer an initially low price to get lock-in, then raise it after a few years to be above the price needed for actuarial reasons.

It doesn't talk about online browsing data, and it doesn't talk about personalized factors other than the expected aggregate demographic modeling.</comment></comment></comment>


Touch Mathematics – Trigonometry - <AUTHOR> http://www.touchmathematics.org/topics/trigonometry <comment><USER2> Shameless plug, I just wrote about how to learn trig without onerous memorization ([http://betterexplained.com/articles/intuitive- trigonometry/](http://betterexplained.com/articles/intuitive-trigonometry/)).

A reader made some simulations based on the dome/wall/ceiling metaphor ([https://www.desmos.com/calculator/az45nwnmis](https://www.desmos.com/calculator/az45nwnmis)).

The right metaphors are essential; I can now visualize the cosecant, where it'd be useful, and intuit why cot^2 + 1^2 = csc^2. Hope this helps someone.

<comment><USER3> It's not really clear what "learning trig" actually means.

Trigonometry, as a subject, can be fully understood in a sentence: "Triangles (especially triangles with a 90-degree angle) have special properties that make them interesting." This is not useful, of course, and worse, it fails to justify high schoolers spending most of a year on the subject.

Trig might instead be understood in this way: "Breaking down complex shapes into triangles makes it possible to find many of the values involved in the shape, because of the special properties that triangles have."

I _think_ this is a fair summary of the topic. If that's good enough, it might be worth doing an article based around taking a complex collection of lines and curves (and draw it out of a photograph for making it feel applicable), assigning a length here and there, and then spending the entire article zooming in on specific sections in order to figure out the consequent lengths of everything else.

<comment><USER4> I don't think you can get away describing trig in a sentence without using the word 'circle'. Really I'd argue trig is at its core more about the circle.

<comment><USER5> What's a circle if not all the right triangles (up to a choice of units)?

<comment><USER4> Look at the beauty of the sin function and tell me that has more to do with triangles than the circle. sin and cos are the length of the projected vector along each axis as a point moves about the circle. connecting those points forms a triangle, sure, but it seems less fundamental.

<comment><USER3> I'd absolutely concede that the sine function is more about a circle than it is about a triangle. If you could really say that the sine function is about a geometry at all.

</comment></comment></comment></comment></comment></comment><comment><USER6> Author. Looking back at this project now, I think the real takeaway is that the act of programming can teach. (Even when you program like I do.) I built this to learn concepts that had always frustrated me in school: fundamental math that I was fed up, as a 27 year old, never having understood. Building this really helped me wrap my mind around trigonometry for the first time, and I still open up this visualization when I need a reminder.

<comment><USER7> This looks decent but I think it could be made a lot better. Right now it's kind of messy with all the functions and all the lines and numbers on the circle there at the same time. It would be better to be able to select those functions you wish to view.

<comment><USER7> Reason for disagreement?

</comment></comment></comment><comment><USER8> Ha, cool visualization of sec, csc, and cot! Never really knew how they fit in the unit circle.

</comment><comment><USER9> Please add support for touch events!

[http://www.html5rocks.com/en/mobile/touch/](http://www.html5rocks.com/en/mobile/touch/)

Because "touch".

</comment><comment><USER10> Nice work

As a teacher, what would help make this _really_ useful on (say) an interactive whiteboard would be

1) On/off by the functions on the bottom left so that I can focus on (say) the sin function, then switch the cosine function on, then challenge students to say what happens to sin/cos for various angles then switch on the tan function

2) Line width control or just thicker

3) Switchable angle overlays (degrees for most, radians only for the advanced ones)

Thanks

</comment><comment><USER11> A nice simple identity I obtained in high school learning trigonometry:

z^(1/2) = ((z+1)/2)*sin(acos((z-1)/z+1))) for all z

...similar identities may be obtained using atan, etc. This came to me from the euclidean geometry construction of sqrt(z). I would like to have its construction image here, but the ascii art is too much. Perhaps Google would find it. When I messed with it, I noticed for large z, acos()--> 1, it's argument describes an angle going to zero and `bends' the left edge of the circle's subtended arc into a vertical line, say, as a zooming magnification. A dynamic screen as yours would be fun to watch the vertex of enclosed right- angle(largest) of the sqrt(z) half-chord, as you mouse drag this vertex around.

</comment><comment><USER12> Pretty cool graphics. But I don't know what to do with or take advantage of it. How do I validate that I am actually understanding what I am suppose to understand?

Idea: Can you make a list of questions, exercises, or problems can be answered by interacting with the model.

<comment><USER13> >Idea: Can you make a list of questions, exercises, or problems can be answered by interacting with the model.

This would be great.

</comment></comment><comment><USER14> This is really a beautiful work, congratulations!

As someone also said here, should have more explanation about the subject Trigonometry. But I am sure I can show this to a kid and give the explanation too.

Again, very well done.

</comment><comment><USER15> This is amazing.

I never understood trig to this level. Seeing it geometrically makes it so much clearer. Very nice.

</comment><comment><USER16> This makes me feel like an idiot.

</comment><comment><USER3> Neat as a reference chart. For amusement, add another dozen trigonometric functions?

</comment><comment><USER17> /* DON'T EDIT BELOW THIS LINE */

OK</comment>


Women-only Uber set to open in Boston. Isn't that illegal? - <AUTHOR> http://www.csmonitor.com/Technology/2016/0410/Women-only-Uber-set-to-open-in-Boston.-Isn-t-that-illegal <comment><USER2> So are the drivers actual employees or are they "independent contractors" in the uber sense? In the latter it doesn't seem like there could be any discriminatorial issues since contractors don't have rights at all!</comment>


Pioneers Festival plans "Clash of the Founders" - USA vs Europe - <AUTHOR> http://techcrunch.com/2012/07/19/pioneers-festival-plans-to-pit-europe-against-the-us/

<comment><AUTHOR> I like the self-ironic touch of the idea. If they manage to execute it without taking it too serious it could be a really nice event-add-on ;)</comment>


A New Year Toast - <AUTHOR> http://therandomthoughts.edublogs.org/2009/12/14/a-new-year-toast/

<comment><AUTHOR> This is delightful.

An excerpt:

"I'll pour a quiet glass of champagne then or on 2010 January's first day and lift it to this coming year's surprises, to all the coming unawares, to the inevitable reshuffling of the deck, to the complexity of it all, to what I cannot now know, to what I cannot now guess, to what I have no clue, to what I cannot now control, to what I cannot now guarantee, to the out-of-the-blue bolt of lightning, to the unpredicted, to the unexpected, to the unfamiliar, to the without warning, to the out of nowhere, to the unforeseen, to never stepping into either the same river or class, to all the twists and turns in life's road that will keep me from falling asleep at the wheel, to the unplanned interruptions that like an earthquake will shake me from the doldrums of routine, to the as yet unknown challenges that will keep me from atrophying, and to the unanticipated adventures that will keep me questing for truer answers."

What do you do for the new year?</comment>


The DNSSEC Root Signing Ceremony - <AUTHOR> https://www.cloudflare.com/dnssec/root-signing-ceremony/ <comment><USER2> I can imagine a Neal Stephenson book which makes a number of 50 year jumps into the future and explains how this ceremony becomes more and more religious in nature. Toss in a few dramatic changes based on either fanciful ideas of new ways to compromise the process or in reaction to actual attack attempts (or successes).

</comment><comment><USER3> > The only way to move information from the outside world into the laptop/HSM > is via USB drive. Accordingly, the key-signing request is loaded into the > laptop via USB.

Hmm, how sure are they that the OS only allows USB drives (as opposed to keyboards, network controllers, etc.), and contains no exploitable bugs? Is an image of the media the laptop was booted from publicly available, and has it been audited?

I almost feel silly asking, given all the time spent designing this and how smart the people are, but after all that trouble it seems amateurish to use USB...

<comment><USER4> I too do not know enough to not feel silly for asking this, but I have a similar feeling, and I am not sure if I have misunderstood the past year's worth of popular articles on USB security, the risk posed by the USB in the context of the ceremony, or both. I had gotten the impression that the firmware vulnerabilities of USB flash drives had proven to be inherent, unavoidable, and utterly devastating; that, basically, any given USB drive could become a general-purpose bus-querying hostile computing device, if once plugged into a machine controlled by a capable and motivated adversary.

If that understanding was correctly received, and given the strength of potential motivation involved here, my thought is that the problem presented by the USB drive could only be combated by (a) ensuring that the USB drive was obtained in a random enough fashion that vast numbers would need to be deliberately compromised with this specific target in mind for that approach to be feasible, and (b) ensuring that the USB drive was neither ever unsupervised nor connected to any USB port (except one on a "known-to-be- clean" computer) after the selection occurred.

The problem that I see with those measures is that if compromising the laptop with a compromised USB drive were possible, then the actual security of the process would be purely dependent on the security of measure (b), as established by a single actor at the ceremony: that is, whomever provides the USB with the key-signing request. This last point just by itself would seem to be a degree of risk well beyond the criteria implied by the established protocol.

<comment><USER5> Couldn't you just use an actual device medium?

The fact that a burnable CD should have no parts that can think actually makes using one for input and one for output probably safer (though you would then need the trusted application to include a CD/DVD burning capability).

As an alternative, a 'raw' interface, such as an actual programmable flash device or maybe an SD card could work.

<comment><USER6> Doesn't the laptop boot from the DVD drive? If it's already busy being used for the operating system, it can't be used for input/output.

<comment><USER3> Add another optical drive. The USB they've already got would probably be OK, as an optical disc is more "inert" than a USB flash drive.

Or, you could probably copy the OS from the initial DVD to a ramdisk, allowing to insert a new disc to load data from.

</comment></comment></comment></comment></comment><comment><USER7> _Access requires the cooperation of 7 individuals, all of whom must be present for a Root Signing Ceremony to take place:_

 _The Ceremony Administrator_

 _An Internal Witness_

 _The Credentials Safe Controller_

 _The Hardware Safe Controller_

 _Crypto Officer #1_

 _Crypto Officer #2_

 _Crypto Officer #3_

Fascinating. What's the signing ceremony for .IO look like? .COM? .NET? .CO.UK? .COM.AU?

<comment><USER8> It will probably involve a similar roll of controllers, plus supervisors/representatives from operators of all DNS root servers[0].

[0]:[https://lwn.net/Articles/647459/](https://lwn.net/Articles/647459/)

</comment></comment><comment><USER9> The Guardian did a piece on this last year including a video of part of the ceremony: [http://www.theguardian.com/technology/2014/feb/28/seven- peop...](http://www.theguardian.com/technology/2014/feb/28/seven-people-keys- worldwide-internet-security-web)

<comment><USER10> And fun anecdotes like:

      At 21.29, things go awry. A security controller slams the door of the safe shut, triggering a seismic sensor, which in turn triggers automatic door locks. The ceremony administrator and the keyholders are all locked in an 8ft square cage.

</comment></comment><comment><USER11> The next KSK Ceremony is happening today (12 November 2015, 18:00 UTC):

[https://www.iana.org/dnssec/ceremonies/23](https://www.iana.org/dnssec/ceremonies/23)

</comment><comment><USER12> Okay, so this tremendously complicated and secure ceremony is performed to essentially sign a "Verisign is allowed to do whatever they deem appropriate to the root of DNS in the next six months" certificate.

This is really just security theatre, as all the power is delegated to Verisign, and it is almost impossible to detect Zone Signing Key abuse.

<comment><USER13> Except that verisign is also replaceable in this whole thing. If they ever screw up they can easily be replaced.

</comment></comment><comment><USER14> It's amusing that their plexiglass labeled holder for the OS DVD has OS misspelled as O/S. I believe this misspelling most likely stems from people having seen and slightly jumbled part of the name of the old IBM branded operating system, OS/2.

<comment><USER15> It is a usage that has been fairly widespread in computing literature since at least the early 1970s, pre-dating OS/2 by at least a decade and a half (possibly more). Such abbreviations punctuated by slash have been acknowledged widely even _without_ the realm of computing (and for decades longer) in quite a number of manuals of punctuation and style. And they're still acknowledged today. Merriam-Webster's _Pocket Guide to Punctuation_ and _New Hart 's Rules_ give examples of slash-punctuated abbreviations including N/A, c/o, w/o, and A/C.

The amusing thing is to see it being mis-categorized a mis-spelling based upon OS/2 of all things. You could at least have picked OS/360 or something. (-:

</comment></comment><comment><USER16> So they are actually holding a physical key? Am I misreading the article? I am just imagining the case when people all get kidnapped...

How do you become the crypto officer? What are their credentials? How often do you change the people?

</comment><comment><USER17> This silly signing ceremony shows the fragility of a centralized trust model. If bitcoin/blockchain succeeds this hopefully will be relegated to the history books.

</comment><comment><USER18> So how is this logically different than the replacement of all CAs with a single one?

<comment><USER19> This was talked about a lot on the last DNSSEC story on HN. I don't have a link to the story but this site was linked to from discussions.

[http://sockpuppet.org/blog/2015/01/15/against- dnssec/](http://sockpuppet.org/blog/2015/01/15/against-dnssec/)

DNSSEC does seem pretty unnecessary at this point for security. It hands more power over the internet to fewer hands, whilst not providing any improved security.

<comment><USER20> DNSSEC only seems unnecessary under the assumption that you're already making full use of existing security measures everywhere else in the stack. If you live in a world where unencrypted HTTP still exists then it's nice to have some defense against ISPs who like to lie in DNS responses. And even if I am connecting over HTTPS through a shady ISP, I'd prefer not to send any packets at all to the wrong IP rather than wait until it presents the wrong certificate.

<comment><USER21> > If you live in a world where unencrypted HTTP still exists then it's nice to > have some defense against ISPs who like to lie in DNS responses.

As tptacek and others have pointed out numerous times elsewhere on HN (and in the article linked above):

1\. DNSSEC doesn't protect against ISPs hijacking DNS responses

2\. TLS is easier to deploy than DNSSEC

3\. TLS provides more security for the end user than DNSSEC does

3a. If TLS us used, DNSSEC provides essentially no additional security benefits to the end user.

So really, it makes sense to be advocating the use of TLS, which is what projects like Let's Encrypt are all about. DNSSEC is at best a waste of resources that could be better spent on actually securing the Internet through TLS, and at worst actively harmful (because the strongest criticism of TLS is that it centralizes trust in CAs, and DNSSEC centralizes trust even further - in a _single entity_!)

> I'd prefer not to send any packets at all to the wrong IP rather than wait > until it presents the wrong certificate.

I'm not sure what difference it makes to be sending packets to the wrong IP. The whole point of TLS is that it doesn't really matter, because they can't read what you're sending anyway.

Also, the way the Internet works, you're _always_ sending packets through the "wrong" IP addresses, so you should make the assumption that your raw traffic is visible to to any eavesdropper (and therefore encrypt your traffic so that this is not an issue).

<comment><USER20> > 1\. DNSSEC doesn't protect against ISPs hijacking DNS responses

DNSSEC protects signed zones by allowing clients to notice a suspicious lack of a valid signature on responses that should have been signed. DNSSEC doesn't protect unsigned zones, but that shouldn't surprise anyone and isn't really an indictment of DNSSEC's capabilities.

> I'm not sure what difference it makes to be sending packets to the wrong IP.

That malicious IP gets to record what kind of connection my computer was trying to make to that domain, even if the connection attempt is aborted relatively early. That's more information being leaked than if my computer had been able to determine that it got a probably-spoofed DNS response and aborted there.

Playing shenanigans with the DNS server is a lot easier than full-scale snooping and tampering on all traffic, which is why ISPs commonly do the former but the latter is usually only done with NSA involvement.

It needs to be _hard_ for ISPs to direct all mistyped domain names to their own advertising (and in the process, implicitly pretending that the Web is the only use for the Internet) or to claim that sites they don't like don't exist. DNSSEC helps with that.

<comment><USER22> But the clients' stub resolvers don't validate the answers, so how can they notice the lack of a valid signature?

<comment><USER20> Some clients don't validate. Some do. Everything on my home network is protected because my router's instance of dnsmasq validates. When I'm away from home, there's dnssec-trigger and a Firefox extension.

I really don't understand why the existence of software that doesn't try to take advantage of DNSSEC is being used as evidence that DNSSEC is incapable of doing something.

<comment><USER21> > I really don't understand why the existence of software that doesn't try to > take advantage of DNSSEC is being used as evidence that DNSSEC is incapable > of doing something.

It's not that DNSSEC is fundamentally "incapable" of doing this, but that it's literally not what the protocol is designed to do. As noted in the other HN thread on this announcement, the DNSSEC protocol is explicitly _not_ designed for end-user verification, and end-users are discouraged from running their own valdiators. There's a reason that browsers don't support this out-of-the- box and (more importantly) don't ever plan on it.

If you're concerned about people snooping on your TCP packets, DNSSEC doesn't solve that. If you're concerned about people spoofing DNS responses, DNSSEC doesn't solve that[0]. TLS + HSTS _does_ solve that, by making it impossible to load a forged page, regardless of what DNS records were returned[1].

Again, TLS solves all the problems you describe (including the problem of ISPs redirecting mistyped pages to their own advertising pages). TLS is also supported by _every_ browser, out-of-the-box. It's more secure, easier to deploy, and already widely used.

[0] Again, as explained in the post, DNSSEC is _not_ designed to protect end- users against malicious ISPs. This is literally a matter of what problems DNSSEC is even aimed at solving.

[1] Notice how [http://google.com](http://google.com) (not even [https://](https://)) will _never_ redirect to a captive portal. That's not DNSSEC. That's TLS + HSTS. DNSSEC is redundant in this situation.

<comment><USER20> > _[...] but that it 's literally not what the protocol is designed to do._

> _the DNSSEC protocol is explicitly not designed for end-user verification_

> _This is literally a matter of what problems DNSSEC is even aimed at > solving._

Repetition doesn't make that argument any more valid. If DNSSEC wasn't intended to have this capability, it's for the same reasons that it wasn't intended to be used for on-the-fly signing: it was designed in the mid-'90s when that was impractical. Nowadays it _is_ practical and it _does_ in fact work just fine for this purpose, and it provides an extra layer of defense in depth and stops some attacks sooner than TLS can and provides some added security to things that aren't using TLS (because remember, there's more to the Internet than just the WWW, and many of those things don't have the aggressive upgrade cycle that Chrome uses).</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Office 365 global authentication outage - <AUTHOR> https://status.office365.com/ <comment><USER3> I'm just assembling the non-comprehensive list of office 365 outages or login problems in the last seven months (r/sysadmin):

6days ago: [https://www.reddit.com/r/sysadmin/comments/ajavl8/its_that_t...](https://www.reddit.com/r/sysadmin/comments/ajavl8/its_that_time_again_anyone_having_office_365/)

1mo: [https://www.reddit.com/r/sysadmin/comments/a4w7ap/office365_...](https://www.reddit.com/r/sysadmin/comments/a4w7ap/office365_outage/)

2mo: [https://www.reddit.com/r/sysadmin/comments/9ygjpv/psa_micros...](https://www.reddit.com/r/sysadmin/comments/9ygjpv/psa_microsoft_azure_mfa_is_down_limited/)

2mo: [https://www.reddit.com/r/sysadmin/comments/a0vepo/office_365...](https://www.reddit.com/r/sysadmin/comments/a0vepo/office_365_mfa_down_again/)

3mo: [https://www.reddit.com/r/sysadmin/comments/9nbst7/office_365...](https://www.reddit.com/r/sysadmin/comments/9nbst7/office_365_outage/)

4mo: [https://www.reddit.com/r/sysadmin/comments/9cuwhs/loginmicro...](https://www.reddit.com/r/sysadmin/comments/9cuwhs/loginmicrosoftcom_down_for_everyone_or_just_me/)

5mo: [https://www.reddit.com/r/sysadmin/comments/9bihjl/office_365...](https://www.reddit.com/r/sysadmin/comments/9bihjl/office_365_down_for_anyone_else_uk/)

7mo: [https://www.reddit.com/r/sysadmin/comments/8r9y3w/365_outage...](https://www.reddit.com/r/sysadmin/comments/8r9y3w/365_outage/)

<comment><USER4> I love the top comment: "Pretty sure It's Office 361 at this point"

<comment><USER5> If that, been an enterprise customer with a company that is a gold partner and been using Office365 for 7 years now - it's down so often we stopped monitoring it, easily the most flaky, unreliable, slow and poorly managed online service I've personally used. (Words are my own, not necessarily those of my employeer(s) etc...)

<comment><USER6> You still can't actually change your billing country in Office 365 without starting over with a new account. Even support can't do it.

[https://office365.uservoice.com/forums/273493-office-365-adm...](https://office365.uservoice.com/forums/273493-office-365-admin/suggestions/11214702-add- ability-to-change-country?page=1&per_page=20)

It's a complete shitshow.

<comment><USER7> It's the same on Azure, so I created a new account to circumvent that issue and then they randomly banned me for doing that.

</comment></comment></comment></comment></comment><comment><USER5> Update: This apparently affected all of Microsoft Cloud products - not just Office365 as I stated in the title. Source: [https://twitter.com/AzureSupport/status/1090366788972404737](https://twitter.com/AzureSupport/status/1090366788972404737)

*Edit: I believe this includes Azure-AD, which I would assume would affect people using it for auth for non-Microsoft cloud products (perhaps even on-prem (if people do that?)).

<comment><USER8> Cloud always was a single point of failure that's why it failed in the past that's why it will fail when the first virus ignites a forest fire.

The truth is the users needs weight in little compared too drm and control of pricing via shakedown methods.

<comment><USER9> A well run service run by a world-class team will provide global availability performance and service that small teams are incapable of.

However, in this case, I don't think the service is very well run, so there's downtime. Not really an issue with "the cloud", this is just an issue because of bad management and/or design of the system.

</comment></comment></comment><comment><USER10> I wonder if this will be a wake up call to Microsoft to maybe allow offline use of things like OneNote. It's really unacceptable to have something that important so reliant on an online service.

(I doubt they'll change their tune. Theee years of complaints about this and they still refuse to allow local notebook storage on Mac, so it seems unlikely that they'd change their minds now.)

<comment><USER11> Piracy of Microsoft products that allow offline use is rampant, especially in poorer countries. A cloud service is a really good tool to prevent piracy.

<comment><USER12> piracy is only an issue if it effects people paying for your product; if they were never going to pay anyway, why not give it away for free? keeping a digital product locked away out of spite is just... spiteful

especially when it comes to poor economies! the cost of a windows/office license is a good portion of (if not an entire) yearly salary in some countries! removing the tools that help them to compete with more affluent economies is pretty poor form

<comment><USER11> > the cost of a windows/office license is a good portion of (if not an entire) > yearly salary

In poorer economies you can just adjust the price to be comparable to local yearly salaries. It's not that piracy means that end users get the licenses for free any way: there are many people who sell pirated versions of Windows and Office.

> removing the tools that help them to compete

You can be just as competitive with Libreoffice and GNU/Linux as you can be with MS Office and MS Windows. The cime of piracy steals a giant market of hundreds of millions if not billions of people from Libreoffice and GNU/Linux and turns these people into second-class citizens.

<comment><USER13> many software companies choose to upload "cracked" versions of their own software ...

</comment></comment></comment></comment></comment><comment><USER5> The status page reads as below (I've copied the text here as it a) may not be accessible to everyone and b) often has old information removed / edited, c) this status page / information is usually pay-walled and only available once you've authenticated):

\--

Microsoft 365 Service health status

Title: Unable to access Microsoft 365 services

User impact: Affected users are unable to authenticate to and access Microsoft 365 services.

Current status: We've received reports of an issue affecting access to Microsoft 365 services. We've identified a degraded portion of infrastructure that manages authentication requests and have restarted that infrastructure to mitigate impact.

Scope of impact: This issue may potentially affect any of your users attempting to access Microsoft 365 services.

Start time: Tuesday, January 29, 2019, at 9:15 PM UTC

Preliminary root cause: A portion of infrastructure that manages authentication requests is degraded, affecting access to one or more Microsoft 365 services.

<comment><USER14> I love how they are just "turning it off and on again".

<comment><USER15> It's pretty common practice for complex systems. If it's already dead, and nobody knows what's wrong or how to fix it, you try restarting it. (normally you first redirect traffic to a different region, but apparently big orgs are still running critical infrastructure with changes that affect all regions and can't be backed out)

<comment><USER16> Kubernetes doesn't even have a "restart this deployment" ability...

</comment></comment></comment></comment><comment><USER17> Looks like it's started with a DNS outage @ Level3: [https://downdetector.com/status/level3/map/](https://downdetector.com/status/level3/map/)

<comment><USER18> My ISP (Telefonica) currently doesn't return addresses for login.microsoftonline.de (cloud Germany) while Google's DNS servers do. I wonder if that's related.

<comment><USER5> Interesting, I suspecting their 'restart' of 'authentication infrastructure' may be a rolling restart and perhaps they have not got to Germany yet, perhaps by using Google's DNS different 'authentication infrastructure' is being provided?

</comment></comment></comment><comment><USER19> And, while this may not be connected, Microsoft also seem to have deleted all of our Sensitive Information Policies in the Office 365 Security and Compliance Center overnight too. Policies that we running yesterday all seem to have been turned off or deleted this morning. This is a HUGE security risk. As I say it could be coinicidence but I'm not so sure.

</comment><comment><USER20> Christ I cannot stand Office 365.

For some reason, I cannot open files that are in my OneDrive folder without O365 authentication shitting itself, and refusing to save files. This means to edit files that are in OneDrive, I have to move them out of OneDrive, open them, edit them and save them, then move the back into OneDrive.

The situation with having a different fucking login/account for every single fucking Microsoft service (Skype, Office, etc.) _even when you 're on the business tier for them all_ is insane and endlessly frustrating.

<comment><USER21> There seems to be an attempt at a single-sign on solution, but when I used it about 2 years ago, it sent me a on trip to about 6 different domains (live.com, microsoft.com, office365.com, something with sharepoint in the name, and several subdomains of those).

In the past, I've given folks the tip to not open links if they send you to a different domain than the link suggests -- by that standard, the SSO looks like a complete scam. It takes some serious knowledge of the Microsoft products to know that those domains all belong to the same corporate entity.

<comment><USER22> Office 365 Message Encryption looks exactly like phishing. (and is also useless as it doesn't have a second channel)

Good news: You can pay more to get phishing warnings in Office 365.... spooky

<comment><USER23> Can you clarify what you mean by second channel?

<comment><USER22> You have to send the way to decrypt data via a different method than your send the encrypted data, otherwise the person who can intercept one can intercept the other.

If you email me a file which needs a password, and then the password, that's pointless, you have to phone me or post me the password.

In MS's case the way you see the document is to login to MS's servers using your email account (so an attacker could send a password reset), or an emailed one time code (so an attacker can intercept and use it, either first, or if they can change the intercepted channel, not pass it on)

</comment></comment></comment></comment></comment><comment> a-dub it was a marketing stunt! "hey everybody! you know that big google outage today? we have a cloud too! it's big, and it goes down every once in a while just like google's and amazon's! we're a real internet company now too!"

</comment><comment><USER24> Around the world millions of accountants were able to go home early as they couldn't twiddle some cells in their spreadsheets, middle managers were spared from death by PowerPoint and countless people weren't told about their use of passive voice by Word's grammar checker.

</comment><comment><USER25> Funny enough, GMAIL had regional outages yesterday too.

<comment><USER26> Or not funny. Suspicious coincidence. Hope it is just that and not outside actors testing things.

</comment></comment><comment><USER27> Maybe it is just me but... The interest we here at HN have in showcasing service outages seems like it's mostly because we want to point to some big/other company and say "see they went down!" so we can feel better about it when our own services go down.

<comment><USER28> It may be that to a degree, but there is also a desire to point out reliability deficiencies in a product or platform that inevitably gets pushed down everyone's throats by management with low resistance to kool-aid.

</comment></comment><comment><USER29> Microsoft's auth infrastructure has been a hot mess over the last 12 month. These outages are getting old.

</comment><comment><USER5> The Office365 status page now states "There are currently no known issues preventing you from signing in to your Office 365 service health dashboard." and when you click the link and are forced to login (now that auth appears to be working for me at least) you're presented with an error preventing you from seeing service status or historical events stating "You don't have permission to access this page or perform this action."

Screenshots: [https://imgur.com/a/pALWiIR](https://imgur.com/a/pALWiIR)

</comment><comment><USER30> Could this have affected my ability to log into Skype for Business? I could log in with my home wifi, but not my cell phone hotspot. Didn't think much of it at the time!

<comment><USER5> Yes, Skype / Skype for business uses Microsoft's centralised servers including for authentication.

</comment></comment><comment><USER5> This also impacted "US government cloud resources": [https://twitter.com/AzureSupport/status/1090379738424569859](https://twitter.com/AzureSupport/status/1090379738424569859)

Also from ITNews: [https://www.itnews.com.au/news/microsoft-hit-by-global- offic...](https://www.itnews.com.au/news/microsoft-hit-by-global- office-365-login-problems-518580)

</comment><comment><USER31> > I would say is pretty fair and based on today's events everyone affected > could be eligible for 25% discount on their bill as the service credit for > breaching 99.9% SLA is 25%

[https://www.reddit.com/r/sysadmin/comments/ajavl8/its_that_t...](https://www.reddit.com/r/sysadmin/comments/ajavl8/its_that_time_again_anyone_having_office_365/eevk047/)

</comment><comment><USER32> I need 365 since it can do some things Google docs can't do.

But, a while ago there was a widespread bug making is so that some percentage of people who had used the Mac or iOS apps couldn't sign in. It was never officially acknowledged, and only fixed due to random people getting journalists to write about an emailing randome people on other teams within Microsoft.

Their cloud stuff is good but the auth and account stuff is a total mess.

</comment><comment><USER33> Not sure if it is related, but the safelink service (the thing that wraps a link with a jump) is down at my school's mail service (that uses MS suite).

</comment><comment><USER34> Someone pointed me to this [0], and I wonder if it is related? Maybe Microsoft tried some changes in response?

[0] [https://medium.com/@lukeberner/how-i-abused-2fa-to- maintain-...](https://medium.com/@lukeberner/how-i-abused-2fa-to-maintain- persistence-after-a-password-change-google-microsoft-instagram-7e3f455b71a1)

</comment><comment><USER35> Lovely, there's this link on the page (doesn't work on Chrome): Add this page to your favorites

<comment><USER36> It's using the old IE window.external

</comment></comment><comment><USER37> Ironic to read all the negativity here when on the day after the OP Microsoft will announce quarterly earnings which will undoubtedly be driven by continued "Enterprise buy in to Microsoft Cloud Solutions".

</comment><comment><USER38> Glad I purchased a standalone license (although I do have Office365 through work).

<comment><USER5> Does that mean that you don't (ever) have to login to Microsoft / Office365 online services with the desktop software? I have been hearing that people are having issues with desktop apps asking them to log back in to use them - <USER2> they can't.

<comment><USER39> You don't have to log in anywhere. MS sells Office 365 and Office 2019, 365 being a subscription service and 2019 a one-time purchase. People you talk about probably had issues with desktop apps that were a part of O365.

</comment></comment></comment><comment><USER5> and today Microsoft's "Xbox live" cloud service is down and it's causing Xbox's to fail to boot: [https://techcrunch.com/2019/01/30/xbox-one-black- screen/](https://techcrunch.com/2019/01/30/xbox-one-black-screen/)

</comment><comment><USER40> I'm still using my copy of Office2008. It still works just fine. It never has an "authentication outage". And, as a bonus, it costs me nothing to continue to use it. I would feel sorry for all of the poor shmoes who are locked out of their office suites, but I'm sorry, you brought this no yourselves when you accepted a subscription model. If people just said no to the subscription model, no one would have this problem.

<comment><USER41> Your personal home use case of Office is not really relevant here. Good luck organizing a huge company on that.

<comment><USER40> Companies are even more relevant because they have more leverage as buyers.

</comment></comment></comment><comment><USER42> I see these comment sections get somewhat rowdy and negative. Anyone care to comment on the other side of things?

Are there any "it may be down, but it is up quite often and saves us heaps of time and labor, totally worth the occasional outage" type experiences?

We're considering G Suite and O365 soon.

<comment><USER3> Yes, there are some great things about O365.

For example, I often hear that O365 licenses are a bliss compared to complexity of microsoft enterprise licensing, when even ms reps don't agree how much licenses you need.

<comment><USER43> To be fair, "the licensing isn't completely miserable like their other product" isn't exactly a selling point.

My two cents from what I've seen (note mainly see GSuite sie of things).. You can get much more productivity & actual collaboration with G Suite, dependent on a few factors.

One, there has to be total buy-in @ the executive level because you most likely need to completely re-think how work gets done across every function. Often, we do what we've been doing and don't see the full picture because of that existing perspective.

So that requires a legit G Suite partner to help execute change management as for O365 I imagine. It's not so much a risk unless you do it for the wrong reasons; They've done it enough times to have a proven migration formula. Saving licensing costs for example should be on the bottom of your considerations because that more or less evens out and becomes irrelevant.

</comment></comment></comment><comment><USER44> I know people make a big deal out of availability, but I personally don't usually mind that much when things go offline. I'm sure it could cause serious problems in specific situations though

</comment><comment><USER45> Does anyone know how to get office 365 pro plus installed on a server to stop deactivating itself? Should we have just paid the insane amount for office enterprise or whatever the one time fee version?

</comment><comment><USER46> How is it that everyone keeps screwing themselves with MSO when even if you pay for commercial use for libre office you come out way ahead. If you want to collaborate on a document or spreadsheet, you dont need to prostitute yourself to microsoft, its a case of being so self important and lazy that one more click or shifting between a telepresence application and an office suite application is to hard. All you people complaining about being down because msoffice products are unavailable need to get a grip on how to use a computer.

<comment><USER5> While I agree with your sentiments about the products, MS as a company and their software model, some of us are forced to use their products at work and of course some of us have tried to improve things and move away to more standards based and ethical software we don't always win (no pun intended) (and words are my own etc...)

</comment></comment><comment><USER47> Incredibly this has taken down typingclub.com

</comment><comment><USER48> Www.dayssincelastazuremajoroutage.com is constantly down because it is hosted on azure

<comment><USER5> Said domain is not registered, While I suspect your comment is just aimed at being humorous it may be taken by some as a bit of a troll comment.</comment></comment>


I'm working on a startup, how do I take care of the business aspect of it? - <AUTHOR>

Hello,
My name is Andrew, I'm located in the US, and I'm currently working on a startup (yes, by myself; I'm glad I know programming as well as graphic design.) And I really think it will be something a lot of people will find very useful, so I'm excited about finishing it (it's about 1/3 done).
I'm wondering though, how do I legally and officially create a company to back my startup? What steps should I take after creating my company, to make sure everything goes well? Also, does anyone have any tips for this kind of thing?
Thanks to everyone who helps me out. <comment><USER2> Creating a company is the administrivia aspect, determining how to make money (and a profit) separates a hobby from a business.

The single largest business risk you face is whether a market exists for your product. Before you finish coding and graphic design, you should determine how you are going to sell your product by talking to prospects. Perhaps you have overlooked a feature or two that you will need to add. Or you may discover that you can cut your initial feature list by 1/2 to 2/3 (you may already be done!) and still find buyers.

Finishing sooner means cash flow sooner means viability sooner and external validation (people paying you is a far more serious endorsement than telling you they will buy when you finish) sooner. If it's just you coding on your own I wouldn't worry about doing anything more than operating as a sole proprietorship (which is how you are operating now) until you were reasonably confident you can generate revenue (profit often comes later).

</comment><comment><USER3> Short version from someone in the middle of doing this:

Get a Delaware-incorporated C-Corp. You don't want any other structure if you want to raise VC money. Delaware is good for tax.

You can do this easily online. Should be $US200-500.

Have a small amount of shares at first. You can change this later. I forget why.

google delaware site:news.yc.com for more info.

If you live outside the US, get a a US postal forwarder. Also handy for the USPTO and getting Apple products without being priced gouged (eg, if you live in Australia or the UK).

</comment><comment><USER4> Hope this helps ...

<http://news.ycombinator.com/item?id=79626></comment>


Ed Sheeran quits Twitter after abuse from trolls - <AUTHOR> https://www.theguardian.com/music/2017/jul/04/ed-sheeran-twitter-abuse-trolls <comment><AUTHOR> In a previous thread, I got called out for asking a loaded question regarding the complete degeneration of human society on social platforms, specifically Facebook and Twitter. Conveniently, this article today highlights my point.

<comment><USER2> No society is not degenerating we just have the wrong social tools available to us. Yes, there are nasty people all over. Some are always trolls by choice some are trolls but don't really know it, trolls by accident you might say. I argue that they are the minority by a long shot. Unfortunately, social media amplifies their voices to the point of domination.

Mr. Sheeran quit Twitter because of trolls but from the fact that he's a popular singer, we know that he has many more fans that love him than people that dislike him. Yet, he was overwhelmed by the trolls.

In the same way that we would never tolerate someone yelling disparages at someone else in real life we need to find tools that will minimise that in social media.

Unfortunately Twitter finds it more advantageous to let things be as they are than to minimise the antisocial behaviour of their users by enforcing social norms of civilised behaviour.

So it's not society falling apart but it's social media not policing itself properly. That's what needs to get fixed.

<comment><AUTHOR> Except it's not about "civil behaviour", politeness and courtesy. It's about large scale criminal behaviour specifically targeting of minorities and women.</comment></comment></comment>


Presumed Abundance: Funding it Forward - <AUTHOR> http://www.presumedabundance.com/ <comment><USER2> First angel group I actually want to apply to. Not really for the money (I have enough to bootstrap for more than a year), but because that is what I want to do if I do make a profit anyway.

</comment><comment><USER3> My friend Kim put this together after a conversational epiphany. I'm really excited to see how they make it work.

I'm also excited to see more HN types building companies that end up creating social value - there is a lot of overlap between web startups and "social entrepreneurship" IMO

<comment><USER4> Yeah, it seems like a pretty ingrained part of the hacker ethos, going back to the 70s. The microcomputer revolution was as much about changing the world by getting tech into the hands of ordinary people as it was about making lots of money in the process.

</comment></comment><comment><USER5> Great job! I really love this idea of social investments.

</comment><comment><USER6> Is this a pyramid scheme?

<comment><USER4> No more than VC in general is, I don't think. Making money on tech and then re-investing that money into new tech is basically the whole premise of the business. It does in a sense depend, like pyramid schemes, on a continual influx of new money; otherwise VCs couldn't, on average, actually make more than a 1x multiplier on their exits.

But unlike pyramid schemes, that not-yet-made money isn't actually promised yet: the article didn't say that they're _already_ funding new startups with their future profits, only that they decided that, _if they do_ make profits, they'll use them to fund new startups.

Edit: Actually, the above comments make more sense when comparing to a Ponzi scheme. Pyramid schemes are even less similar. A pyramid-scheme way of funding tech startups would be: you put in $1000 towards funding the current round of startups, and in return, get your name put on a list of startups that'll get funded in the next round. The direction of money flow is different: in a pyramid scheme, tomorrow's startups are funding today's startups, while in a Ponzi scheme, today's startups are funding other startups of today with money they don't have yet (which they hope to get from tomorrow's investors in an exit). In a normal, non-fraudulent investment scheme (like this one), today's startups will, in the future, fund tomorrow's startups, once they have the money to do so.</comment></comment>


Ask HN: What are some good ways to restore curiosity? - <AUTHOR> Most of us realize that we were a lot more curious in childhood than we are now.
And it's such an important trait for living a healthy life in my opinion.
Did you try to restore your curiosity? What worked or what didn't? What did you learn out of it? <comment><USER2> I feel like I'm more curious now (young adult) than when I was a child. This might just be biased or selective memory though. I have felt myself become more curious when interacting with some "infectiously" curious individuals. In retrospect I feel some jealousy as to their apparent natural curiosity but also can imagine that some of it might have stemmed from the interaction we had. Practice is also good: finding any kind of new skills and learning some discipline at improving in them and regularly moving on to something new improves your cognitive capacities and helps see past personal biases. Interacting regularly with new people about varied subjects is good training too.

I sometimes felt a lack of something when progressing in programming skills—it didn't feel so much a lack of curiosity as a lack of actual ideas: I didn't not want to discover new things but I didn't know how to transform that abstract desire into actual discovery. Maybe questioning your definition of the words you give to your problem can helps you find solutions.</comment>


Our operating systems are incorrectly factored - <AUTHOR> https://eighty-twenty.org/2016/05/05/unix-is-incorrectly-factored <comment><USER2> Not sure this rests at the core OS level. Text encoding certainly adds complexities to many applications but I don't see how abstracting this to the system level would really solve anything. Especially considering the fact that this wouldn't happen across all platforms and thus would just be adding another level of complexity in terms of supporting this specific extension.</comment>


A Happy Life May Not Be a Meaningful Life - <AUTHOR> http://www.scientificamerican.com/article/a-happy-life-may-not-be-a-meaningful-life/ <comment><USER2> Sums it up for me. Having two kids and starting and running my own business has been stressful and difficult to put it mildly.

I know my wife and I would kill to get a decent holiday without the kids and day to day stresses but that's unlikely in the forseeable.

That said having a kid and working for myself has been a life altering experience. Not only has it changed my time and spending habits but it has really shifted my appreciation for the work put in to build a person or a company up.

Can't say I'm happier, but can't say I care about that as much I used to - these new parts of my life are as the article states incredibly meaningful and give immense satisfaction.

</comment><comment><USER3> Exactly :)</comment>


How Hyperconnected Cities Are Taking Over the World - <AUTHOR> http://www.citylab.com/housing/2016/04/cities-drive-the-new-world-order-parag-khanna-connectography-maps/480165/ <comment><USER2> Connected people always existed. Maybe they connect nowadays more than they did before (but there is a biological limit to that, nevertheless), maybe they connect over greater distances than they did before given the technological means, but they were and are a minority (even if a loud one). The bulk of the populace are not like that. The bulk of the populace connect and live in a physically delimited place. Yes, you give them cars and make it easier with other forms of transportation, enlarging those limits, but that only produce results when it couples with an internal drive like a desire to travel, which again has its limits. Place proximity still holds a great weight in shaping human relations on a very broad level and that is a fact given by our human nature. "Geography is destiny" is here to stay, and so are all the local things that affect most of us.

</comment><comment><USER3> I feel like this is at least the third article that's showed up here recently making the claim that "cities are more important than countries for economic development" with no real argument behind it.

<comment><USER4> It's all based on the same book (Connectography). I highly recommend instead reading The Stack that just came out from MIT Press, which gives a much deeper analysis on the relationship between cities, software and geopolitics: [http://thestack.org](http://thestack.org)

<comment><USER5>
      Hardcover: £25.99
      Kindle:    £23.99

Does it really cost £2.00 to print a hardcover and ship it across the Atlantic, or is MITPress taking the metaphorical mickey?

<comment><USER6> >Does it really cost £2.00 to print a hardcover and ship it across the Atlantic

That's actually probably pretty close to correct.

Not defending the Kindle pricing but printing and distribution of physical books is a lot cheaper than many assume it is.

</comment></comment></comment></comment><comment><USER7> "global strategist and world traveler" \- that so totally qualifies him to bloviate!

</comment><comment><USER8> They must be looking for a replacement for Thomas Friedman. Needs more incomprehensible metaphors, you can't just repeat yourself into credibility.

</comment><comment><USER9> looking at the pictorial map representative and suggestive of "hyperconnected cities" looks rather like trade routes.. which of course have been around for milenia

<comment><USER10> The I-85 corridor from Atlanta to Greensboro has been known to be a hub for a while. But like the article says, it's hampered by poor road quality.</comment></comment>


Announcing GitHub Issues for iPhone - <AUTHOR> https://github.com/blog/904-announcing-github-issues-for-iphone <comment><USER2> These Mac/iOS apps are great but making their site mobile compatible would benefit more people immediately IMHO.

</comment><comment><USER3> Yikes, that completely custom, non-standard UI is pretty jarring for me.

<comment><USER4> I thought it's quite a fresh breath of air from all the other apps. Conventions be damned!

<comment><USER3> Don't get me wrong, I love a custom UI in an iPhone app when it's done right. See: TweetBot. Gorgeous, 100% custom UI, and they preserved button sizes, labels, behavior, etc that the user is used to in an iPhone app.

</comment></comment></comment><comment><USER5> Do people use GitHub Issues? Is there something that it's best at compared to the alternatives?

<comment><USER6> If you're evaluating it against a full blown bug/requirements tracking system like JIRA, Fogbugz or similar it is fairly lacking.

If you want a dead simple, integrated, free (with your github subscription) bug tracking system that lets you close issues via git commit messages it is just what is called for.

</comment></comment><comment><USER7> When I click on the "download it today" button, it forwards me to a not found page in the app store. :(

<comment><USER8> Yes, same experience here, but doing a search popped it right up.

This should be a direct link to it.

[http://itunes.apple.com/us/app/github- issues/id453833494?mt=...](http://itunes.apple.com/us/app/github- issues/id453833494?mt=8)</comment></comment>


Do messaging apps cause too much distraction at work? - <AUTHOR> https://blog.hive.com/is-messaging-killing-productivity-914f67d55a21#.uixy1mmdh <comment><USER2> Seems like if people are distracted by FOMO related to discussions on messaging tools they'd be even _moar_ distracted if all the important decisions are being made in in-person meetings.</comment>


Twindr – Tinder for Cleaning Up Your Twitter Feed - <AUTHOR> https://itunes.apple.com/us/app/twindr-clean-up-your-twitter/id955230393?ls=1&mt=8

<comment><USER2> Cool. I have aggressively unfollowed companies in the past couple of weeks since New Years, but my follow list was never so large that I would need an app for it --- for others I'm sure it'll help.

I'm going to throw something else out there --- what I'm beginning to learn is follow _people_ not companies. So many times I might want to unfollow the guardian, for example, but follow their reporters or photographers. After all the point I reckon is to get away from the noise and closer to the signal.

<comment><AUTHOR> Same! That's also what I've found over the years...I've unfollowed so many brands and official accounts in favor of reporters and other individuals.</comment></comment>


Salmon Cannon Fires 40 Fish a Minute - <AUTHOR> http://www.cnet.com/uk/news/salmon-cannon-fires-40-fish-a-minute-up-to-22mph/ <comment><USER2> Reminds me of Chatham Island black robin conservation efforts that turned out not so good:

[http://www.plosone.org/article/info%3Adoi%2F10.1371%2Fjourna...](http://www.plosone.org/article/info%3Adoi%2F10.1371%2Fjournal.pone.0079066)

Conservation management often focuses on counteracting the adverse effects of human activities on threatened populations. However, conservation measures may unintentionally relax selection by allowing the 'survival of the not-so-fit', increasing the risk of fixation of maladaptive traits. Here, we report such a case in the critically-endangered Chatham Island black robin (Petroica traversi) which, in 1980, was reduced to a single breeding pair. Following this bottleneck, some females were observed to lay eggs on the rims of their nests. Rim eggs left in place always failed to hatch. To expedite population recovery, rim eggs were repositioned inside nests, yielding viable hatchlings. Repositioning resulted in rapid growth of the black robin population, but by 1989 over 50% of all females were laying rim eggs. We used an exceptional, species-wide pedigree to consider both recessive and dominant models of inheritance over all plausible founder genotype combinations at a biallelic and possibly sex-linked locus. The pattern of rim laying is best fitted as an autosomal dominant Mendelian trait. Using a phenotype permutation test we could also reject the null hypothesis of non-heritability for this trait in favour of our best-fitting model of heritability. Data collected after intervention ceased shows that the frequency of rim laying has strongly declined, and that this trait is maladaptive. This episode yields an important lesson for conservation biology: fixation of maladaptive traits could render small threatened populations completely dependent on humans for reproduction, irreversibly compromising the long term viability of populations humanity seeks to conserve

<comment><USER3> I think the lesson should be: If a species is hovering over the brink of extinction, it's a better idea to do whatever it takes and only worry about the consequences later...

Of course, if rim-laying had been fixated, the species would still have become extinct...

<comment><USER4> Or perhaps to dig deeper as to WHY they are on the brink of extinction. If they develop a trait that causes them to lay their eggs on the rim (which can be directly linked to the species decline), isn't that just Darwin at work? Who are we to step in an say "yep, they're idiots for doing it, but we should still save them."

<comment><USER3> Charles Darwin was a scientist, not a super-natural deity responsible for evolution. He can't be "at work".

Extinction events for natural reasons shouldn't be as frequent. Otherwise there would be far fewer species left. Therefore any extinction process we witness, especially with a species starting out with a healthy population, probably isn't natural.

</comment></comment></comment></comment><comment><USER5> Transferring live fish by pipeline has been used in the fishing industry for a long time - large trawlers will store fish in salt water in tanks and when they get into port they are transferred by pipeline directly from the trawler to the fish processing plant so they are still alive when they hit the table where they are "processed".

[NB A fisherman explained this to me in Mallaig Scotland, none of the fishing boats I've been on were so high tech!]

<comment><USER6> I wonder if the tech is any different. If the fish are going to be slaughtered shortly, then it wouldn't matter (ethics aside) if they're a little hurt in the process, provided the meat isn't damaged, whereas here it is quite important that the fish remain unharmed.

</comment></comment><comment><USER7> I do not want to be there when the bears learn implicitly that salmon spring from the end of the tube :-) But I love the concept.

<comment><USER8> As a bear I will fall in love with the lunch tube.

<comment><USER9> some commercial fisheries will enjoy renting those too

</comment></comment></comment><comment><USER10> This is Hyperloop's MVP.

<comment><USER11> Yeah, I was just thinking it'd be great to have a human-scale version of this .. to get from one Soapy Land to another, perhaps?

<comment><USER12> Commuting to work by slip-and-slide sounds like a blast to me...!

</comment></comment></comment><comment><USER13> I feel like this was the highlight; [http://gfycat.com/SophisticatedFarawayEthiopianwolf](http://gfycat.com/SophisticatedFarawayEthiopianwolf)

<comment><USER14> Sophisticated Faraway Ethiopian Wolf?

<comment><USER15> It's an ID or hashcode, but in English words rather than hexadecimal.

Easier for humans to recall, communicate, and error-check.

<comment><USER16> An utter bitch to type compared to a short string of garbage, though, and typing a URL manually (friend gives you a URL over the phone or in person) is the only case I can think of where the URL itself matters.

<comment><USER17> On mobile, perhaps, where you're pecking at a keyboard like a chicken, but with a keyboard it's easier to type.

<comment><USER18> I find it the opposite to be honest, but probably only because I'm using swype on mobile.

It's easy to hit random characters when touch typing on a full keyboard, but it's much easier to just swipe a couple words together in the url bar than it is to get the correct capitalization as well as having to hold down the key for about a second each time you need a number.

<comment><USER19> If I need a number, I just swipe down from the letter that the number appears under. No press-and-hold needed. Does that not work on your phone?

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> I wonder how this affects the fish's slime coating, which is important to preserve. It seems like this would be rubbed off on the material as the fish is propelled along the tube, no?

<comment><USER21> How do they get the coating in the first place? They create it of course. I'm sure they can create more if this scrapes it away.

<comment><USER20> They can create more just as your body would create scar tissue if I scraped some of your skin off. Meanwhile, the exposed area is far more likely to become infected as your skin no longer protects it. Not a perfect analogy but it illustrates my point well enough.

<comment><USER22> Since this is to help them on their final stage of their migration to the spawning grounds (after spawning they die), I don't think infection is a big issue.

<comment><USER23> Not all salmon die after spawning.

<comment><USER24> All Pacific salmon (which is what these are) die after spawning. A few Atlantic salmon (about 10%, ATW) will survive to make another trip.

The Pacific species basically start to decompose as soon as they hit fresh water.

Once they've spawned, they fall apart like something out of a bad horror movie. I've seen semi-alive fish that you could stick your thumb through without any effort (usually snagged by a tourist who's proud of his accomplishment).

</comment></comment></comment></comment></comment></comment><comment><USER25> I recently watched DamNation [1] and was quite surprised at the shear number of dams located in the United States. The film claims that most have outlived their purpose. I can't recall the exact cost stated per fish to divert them around dams or raise them in a hatchery, but it was fairly high. The film's production quality was quite high and was fairly eye opening.

While doing a little googling, I found an article [2] claiming $7 million in fish ladder work after structural damage forced a reduction in water level. So perhaps this solution could be cost effective or quickly put in place in case damage occurs just before a run.

[1] [http://damnationfilm.com/](http://damnationfilm.com/) [2] [http://www.columbian.com/news/2014/apr/12/crack-in-dam- force...](http://www.columbian.com/news/2014/apr/12/crack-in-dam-forces- costly-fish-ladder-work/)

<comment><USER26> Per this comment, I checked out 'DamNation'. It was fascinating, thanks for the recommendation.

The number quoted as $9,000/'Snakeriver Sockeye' that made the 800 mile journey upstream to Redfish Lake, Idaho. In 1992, as they tell it, only one fish made it. But that apparently was the first year after the project began. Then again, only 243 made it 2011 [1]. Only ~1,500 made it back to Granite lake, which is 400 miles upstream [2]. So it's part of a larger problem in the area.

So the $40million spent equates to 222 fish per year on average.

I'm pretty sure the 'Fish Canon', however humane, can at least match the 1 fish every 36hrs rate of existing systems.

It's also worth noting the US Army Corp of Engineers ship large numbers of juvenile fish downstream on barges. Collecting them with the 'Fish Cannon' and then shipping them on barges back upstream (or furthest upstream lock) is just a budget/politics problem not one of technology.

[1] [http://seattletimes.com/html/localnews/2019705443_captivefis...](http://seattletimes.com/html/localnews/2019705443_captivefish18m.html)

[2] [http://www.bpa.gov/news/newsroom/Pages/Snake-River- sockeye-c...](http://www.bpa.gov/news/newsroom/Pages/Snake-River-sockeye- continue-upward-trend-in-2011.aspx)

</comment></comment><comment><USER27> Watch only the second video, the first is terrible.

<comment><USER6> Oh, I'm glad you said that. I didn't watch the second video because I didn't expect it to be any better than the first, but it turns out it's way more informative.

</comment></comment><comment><USER28> If you're interested in the current state of the US hydropower generation, potential resource out there, and really most everything around hydropower in the USA, check out the NHAAP website.

[http://nhaap.ornl.gov/](http://nhaap.ornl.gov/)

NHAAP is the National Hydropower Asset Assessment Program, and it's put together a large chunk of the groundwork for the DOE's hydropower vision project.

[http://energy.gov/eere/water/new-vision-united-states- hydrop...](http://energy.gov/eere/water/new-vision-united-states-hydropower)

</comment><comment><USER29> In 20 Million Years...

"Our ancestors traveled the beige tube to new waters, while the two-legged creatures watched and guided them."

<comment><USER15> _Old_ waters. They return the waters of their birth.

Also, the storytellers die before their audience hatches...

</comment></comment><comment><USER30> This would be crazy if fish start to understand the cannon. Use it on their own and then continue on to find their destination (rather than be totally lost and confused)

<comment><USER31> Unless I'm mistaken, the fish head upstream to die. None of them will encounter the cannon twice, unless the same river has multiple dams on it.

<comment><USER32> Similar to how the salmon "learned" to swim back to where they were born, the increased survival frequency of salmon who can efficiently negotiate such a cannon would be expected to change the population.

</comment></comment></comment><comment><USER33> I've just finished listening to a radio interview where the guest asserted that technology and innovation is solely the domain of young white males focused on social networking problems to make money for the benefit of investors. I am so happy to have seen this on the heels of such a terrible interview.

 _And_ I love the thinking that went into this invention. I really appreciate the novel approach although I can't help but wonder how they've dealt with the issue of friction and how that might affect the fish - I imagine that there's a fair amount of heat created over such a long run, even at the relatively low speeds described in the videos.

</comment><comment><USER34> Could this be used for humans? Looks like fun way to commute.

<comment><USER35> You mean kind of like the public pneumatic tube transport in futurama?

<comment><USER36> But with none of the comfort. Or safety.

</comment></comment></comment><comment><USER37> What attracts the fish to the tube? The ladders work by providing some water that is going down stream slowly it is an obvious path. If there is no water to swim upstream against I don't understand why a fish would enter a random tube.

<comment><USER38> At about 88 secs in the second video[1] they show the inside of some sort of "trap" for the fish where water flows rapidly over a grate (and claim "volitional entry"). But I agree it's still an open question whether you could mitigate the fish's behavior effectively.

[1] [https://www.youtube.com/watch?v=wSBS2F9VXaE#t=88](https://www.youtube.com/watch?v=wSBS2F9VXaE#t=88)

</comment></comment><comment><USER39> This is a huge improvement on trucking them around the dams when the reservoirs are too low for the fish ladders.

</comment><comment><USER40> How do they get back down?

<comment><USER41> They don't. For salmon it is spawn and die. Their fry will come back down with the water.

</comment></comment><comment><USER42> I'm happy to live in these times.

</comment><comment><USER43> Science article headline of the year.

</comment><comment><USER44> I've watched all the videos and I still can't understand how that thing can possibly work. They say it creates vacuum and transports things using atmospheric pressure, but both ends of the tube are open! What vacuum are they talking about? Is there a pump at one end sucking air? Am I looking at an elaborate prank?

<comment><USER45> [https://www.youtube.com/watch?feature=player_embedded&v=SDzJ...](https://www.youtube.com/watch?feature=player_embedded&v=SDzJbhOVm0Q#t=14)

Look at 0:14. This thing is put a little bit after the start of the pipe, creating a draft. The fish's own body becomes the "plug" that this air pump pushes up.

</comment></comment><comment><USER46> This device in its usefulness reminds me the squid gun of the infamous Vector superhero from Despicable Me. Normal people build cascades around dams for salmon. Once built these require zero maintenance.

<comment><USER47> I think for specific situations this can be useful. In the final video they show a 'holding tank' the salmon eventually get to and are then hand transported through the building to the next body of water.

I think it has been designed for a very specific commercial issue (maximising the restocking of wild salmon). I'm guessing this has applications elsewhere where you want to transport live fish/tubular slimy animals.

</comment></comment><comment><USER48> into my mouth

</comment><comment><USER49> How long before this is a Minecraft mod?

</comment><comment><USER50> It's a good thing to get out of your comfort zone every once in a while.

</comment><comment><USER51> Here is a Cow Cannon, we can estimate its firing rate at 10 cows per second: [https://www.youtube.com/watch?v=F8sMXp6zCl8#t=205](https://www.youtube.com/watch?v=F8sMXp6zCl8#t=205)</comment>


Ask HN: How do i check the not so old (less than 2 yrs) archives of a website - <AUTHOR>

we know that web archive http://www.archive.org/web/web.php allows us to see how a website looked between 1995  to early 2009 month by month but how do we check out the archives/webshots of sites that came up recently or in late 2009 and after? <comment><USER2> I looked, but couldn't find any other service that does this.</comment>


Ruby 2.1: Profiling Ruby - <AUTHOR> http://tmm1.net/ruby21-profiling/

<comment><USER2> I wonder if this API allow will foster a big movement to track down all the performance-hungry calls in say, Rails, and help the framework move forward in terms of efficiency. This is really a welcome addition anyway.

</comment><comment><USER3> I think TRWTF here is that checking for (query string?) parameter existence runs a regexp...

<comment><USER4> Some of us like to pre-divine a world devoid of bugs and silliness, others like to provide us with tooling to track stuff down

</comment></comment><comment><USER5> So, I'm a Ruby neophyte. Why did adding parenthesis speed that line up so much?

<comment><USER6> Rewritten in longer form, assuming I've made no mistakes, the two versions are equivalent to...

      if params[:user_id].present?
        if !@owner
          @owner = User.find_by_login(params[:user_id])
        end
      end

vs

      if !@owner
        if params[:user_id].present?
          @owner = User.find_by_login(params[:user_id])
        end
      end

Checking the member variable truthiness is presumably faster than a dictionary lookup followed by a call to "present?". As @owner is probably frequently/always true after the first call (it will be unless find_by_login returns false/nil/? or another method resets @owner, given the same instance), this leads to fewer dictionary lookups and present? calls, resulting in a performance increase.

EDIT: Well that was an amusing spam of simultaneous answers.

</comment></comment><comment><USER7> Why is line level profiling so non-existent for dynamic languages? Function level just doesn't cut it, esp. w/ the zillions of monkey patches in Ruby.

<comment><USER4> Wait, what about stackprof rb-lineprof flamegraph rack-mini-profiler

</comment></comment><comment><USER8> At first I didn't realize OP was a GitHub employee and thought he was munging his company's GHE appliance :o

Cool read!</comment>


Secret Hospital Deals That Squelch Competition - <AUTHOR> https://www.wsj.com/articles/behind-your-rising-health-care-bills-secret-hospital-deals-that-squelch-competition-1537281963 <comment><USER2> [http://archive.is/kMS3b](http://archive.is/kMS3b)

</comment><comment><USER3> It beggars belief to blame the hospitals and not the insurance companies.

<comment><USER4> It's worthwhile to check our assumptions - in this case, that insurers dictate all terms. Maybe it's correct.

But we lack the visibility to know if it's true about every component in the system.

That said, I share your sentiment. He who has the gold (usually) makes the rules.</comment></comment>


Question: Quality Books/Tutorials for PHP - <AUTHOR>

Hello everyone;<p>I just got a job. Actually, I just got my first job, that I'm actually interested in, (I'm 19 years old) assisting in the development of a [deep breath] massively-multiplayer browser-based textual game created in PHP. Fortunately my employer does not mind that I'm just learning such things as programming and is willing to fund my endeavors. Let's face it -- I'm taking university-level courses through Athabasca University -- leading to a Bachelor of Science in Computing and Information Systems-- and I have a lot of extra time on my hands (first project is a [shivers] an Access database utilizing four relational tables for a imaginary, and simplified, video rental store). So I have the time to learn and procrastinate.

Now I have dabbled in PHP before as well as things like: LISP (Scheme), C (++), FreePascal, and Python; However, dabbling as fun as it is, does not provide me with the full skill-set that I likely require. What I need is a list of "must read" PHP and web site design tutorials (and books if possible). I have read quite a bit on the PHP home page as well as some stuff taken off of search engine results but I may have (and likely) missed something important.

So, any suggestions? <comment><USER2> Teach yourself PHP in 24 Hours. Sams Publishing....very comprehensive.

But, I must ask you: if you are using/learning PHP on the job, why not try something better/more interesting off the job (like I do)? PHP was my first web language and where I a learned lot of real world software development strategies, but I definitely wouldn't recommend learning things the PHP way to a beginner.

<comment><AUTHOR> Well at the moment my main concern is the job as there is still a good deal of work to be done (and possibly undone) and therefore I kind of have to hit the ground running. Now as far as off the job is concerned I'm definitely open to suggestions. Any recommendations?

<comment><USER2> At the risk of starting yet another language vs. language war, I will share with you some thoughts that have been rattling around in my pea-sized brain;

Actionscript 2 - fun, easy. Pre-requisite to AS3 and/or flex.

Actionscript 3 - This is by far my favorite language. For brevity, I will just say that it allows me to do a great many things, in a scripting/interactive environment that allows me to work on 'fun' stuff (such as Papervision 3D).

C# - Pound for pound,vs the compiled langs Java, C++ and C just don't stack up to it (jvm sucks, C++ is very confusing, and C, well just leave that to the experts as pg says). Depending on what you are doing it is only marginally slower than C++, but you (I) can develop ~3 times faster. YMMV.

<comment><AUTHOR> Ha ha. I've found C to be easier to understand then the plus-plus version; but then, I have not gone that far with it. I'll definitely give up some time with the C's and Actionsript in the future however. Thanks for the advice.

</comment></comment></comment></comment><comment><USER3> I have found "PHP Solutions: Dynamic Web Design Made Easy" to be an excellent learning book. It covers all the usual things you'd want to build in a web app.</comment>


Microsoft to support VP8 - <AUTHOR> http://www.zdnet.com/blog/microsoft/microsoft-to-support-vp8-video-codec-with-internet-explorer-9-after-all/6264 <comment><USER2> This isn't support in the sense that Microsoft will ship this codec, just if you install it you'll be able to use it. For me "it's up to the user", is not really supporting it any more than Microsoft supports any other third-party software. I imagine that Microsoft's implementation allows any codec installed to be used in html5.

</comment><comment><USER3> Supporting VP8 and allowing VP8 content to play if the user installs a VP8 codec are two very different things.

<comment><USER4> Microsoft whitelists all codec but h264 on IE9, so allowing VP8 is a sign of support, not very strong but quite a bit. Also remember that first versions of windows XP had a similar kind of support with mp3 until it started shipping with it once it was super popular IIRC.</comment></comment>


This startup promised 10,000 people eternal digital life–then it died - <AUTHOR> http://fusion.net/story/116999/this-start-up-promised-10000-people-eternal-digital-life-then-it-died/

<comment><USER2> A few seconds after I started reading, a popup came up asking me to like Fusion on Facebook.

Please don't do this. I stopped reading, and closed the tab.</comment>


Broadword Implementation of Rank/Select Queries [pdf] - <AUTHOR> http://vigna.di.unimi.it/ftp/papers/Broadword.pdf <comment><USER2> This paper was first published in 2008 (and has since been beaten several times over by more modern techniques). a quick glance doesn't suggest that there's anything obviously new in this version, is there a reason it has a new date?

Original: [https://dl.acm.org/doi/10.5555/1788888.1788900](https://dl.acm.org/doi/10.5555/1788888.1788900)

to those curious about this area, one of the most recent and fastest results is this one from pandey et al: [https://arxiv.org/abs/1706.00990](https://arxiv.org/abs/1706.00990)</comment>


The Intercept - <AUTHOR> https://writer.inklestudios.com/stories/theintercept <comment><USER2> A brilliant little piece of fiction. As far as I can tell, you're QWxhbiBUdXJpbmcgZHVyaW5nIFdvcmxkIFdhciBJSQ== accused of stealing part of the Bombe. Though I found a couple of successful paths, some of the "bad" endings aren't quite what I expected. Personally, I found the path where dGhlIGludGVycm9nYXRvciBzeW1wYXRoaXplcyB3aXRoIEFsYW4gYW5kIGltcGxpZXMgdGhhdCBoZSBoaW1zZWxmIGhhcyBoYWQgaG9tb3NleHVhbCBhZmZhaXJz to be the most interesting and heartwarming.

(Spoilers base64 encoded.)</comment>


Hidden Damages: The story of a father's fight to get justice for his daughter - <AUTHOR> https://read.atavist.com/hidden-damages <comment><USER2> This is clearly political propaganda. You can read the first half to learn about the daughter and what happened soon after, but it soon quickly turns into an article talking about the big bads as Israel sees them (Palestine, Iran, et al), and then makes vague hand waving implications (with no specific evidence) as to all of the evil that they're responsible for.

This and other similar media are timed to publish due to recent softening of sanctions against Iran, certain parties are keen to keep them in the dog house, and keeping public opinion against them is part of that.</comment>


The Greatest Developer Fallacy Or The Wisest Words You'll Ever Hear? - <AUTHOR> http://www.javacodegeeks.com/2012/04/greatest-developer-fallacy-or-wisest.html "I will learn it when I need it"! I've heard that phrase a lot over the years; it seems like a highly pragmatic attitude to foster when you're in an industry as fast-paced as software development. On some level it actually IS quite pragmatic, but on another level I am annoyed by the phrase. It has become a mantra for our whole industry which hasn't changed said industry for the better. The problem is this, in the guise of sounding like a wise and practical developer, people use it as an excuse to coast. There is too much stuff to know, it is necessary to be able to pick certain things up as you go along – part of the job. But, there is a difference between having to "pick up" some knowledge as you go along and doing absolutely everything just-in-time. <comment><USER2> The problem is that the article misses is that there is an opportunity cost of specializing, specialize in the wrong thing and your career is over. Try finding a Cold Fusion job now that it has seen it's glory days, sure they are still around but if you loose your job, it may be a long road until you land in another job that fits your specialty. At a certain age many developers do specialize, many of them tend to sunset with a widely adopted technology. Take COBOL for example, if you participated in COBOL development you would meet a lot of specialist, because most of the people in that technology are past the point of choosing to specialize. Participating in the latest technology is always going to create a filtered bubble of generalist, those are the ones that have less opportunity loss in transitioning.</comment>