Lessons we learned when debugging a scaling problem - sahin-boydas https://about.gitlab.com/2019/08/27/tyranny-of-the-clock/ <comment><AUTHOR> I love these sorts of write ups. I wish there was a way to encourage internal transparency like this, as opposed to my least favorite way to be greeted when I let someone know about an issue with their product: "Can you try again?"

Nothing as infuriating as that, it could be a valuable learning lesson for many people just like this!

<comment><USER2> I would love to see a blog post explaining the non-technical interaction for something like this. Is it a single person that understands all the networking plus the whole software stack, from HA-Proxy to the SSH hosts, or is it a team of people working together on the problem?

I feel like everyone involved would have to be more eager to solve the problem than worrying about assigning blame. Does that work because it's all within the same company or does GitLab make extra effort to dis-incentivize blame shifting and other unproductive behavior?

In my life (all small scale - local vendors) I call people and the only answer I ever get is roughly "our stuff if perfect. It's you."

<comment><USER3> We definitely take deliberate effort to dis-incentivize blame; it's specifically called out in our values at [https://about.gitlab.com/handbook/values/#blameless- problem-...](https://about.gitlab.com/handbook/values/#blameless-problem- solving) but speaking as an employee, I can confirm that this is my daily experience.

Of course for this specific issue there really wasn't anything or anyone to blame: no-one really did anything wrong at any point. Systems simply get complicated at certain scales and circumstances, and we have to engineer our way around the issues.

</comment></comment></comment><comment><USER4> > _Lesson #4: When you choose specific non-default settings, leave a comment > or link to documentation /issues as to why, future people will thank you._

Put it _in the commit message_. There is no better place to put it. That is the exact point in time at which you have the most information about that exact change. Commit messages are cheap, be liberal with your words and links.

It drives me nuts to read commit messages of the form "fix", "fixed 2", "add test", "new var" and on and on. You took an hour to make the change, take a damn minute to save some future colleague a day of frustration.

<comment><USER5> So this is something I want to fix about commit messages.

If you screw up and forget to add the documentation to the commit message, there is nothing you or I can do about it. And if the commit log is not uniformly useful in this way, then people start to discount the value of the commit messages.

And then I have to explain to people who keep cutting and pasting code around improperly are ruining our commit history. I often get a shrug.

The first part we could do something about, and I hope we do in the next version control system (there's always a next one). All sorts of metadata should be capable of being attached to a code commit. Some of it stuff we have been relegating to third party tools, which means you can't reason about it as a whole.

Did this commit get a green build? Did it have a code review? What PR was it in? Did we run any static analysis? Did we learn after the fact that this code doesn't solve the problem or is a bad solution?

If all of this is at my fingertips, I've got a better chance of getting a bunch of people (myself included) to have a broader understanding of the code, or at least an easier time getting familiar with it when I need to.

<comment><USER4> Well there's two things there.

One is commit discipline. People care more or they care less, no tool can truly change that.

The other is how we collect information. I'm not convinced that version control systems are the right place for that, but I know others have explored it (eg. Fossil SCM). Github provides what is a de facto data store for a lot of such annotations through their APIs, I imagine Gitlab does similar.

<comment><USER5> Commit discipline is a wider issue, but building and relying on tools that require humans to never make an error does not scale.

People always screw up their commit messages. And once they do it they stop trying because if you can't be perfect you're just torturing yourself to try. If there's a way to fix them after the fact you can begin demanding that people have more commit discipline and make them go back and fix it if they don't get it right the first time.

I take it as a matter of Broken Window syndrome. You can try to keep them from getting broken but at some point you have to have a way to fix the ones that break.

<comment><USER4> I didn't mean to give the impression that I don't think better tools are needed, I do. I feel that automation is a gift: what gets automated gets done. Tools create paradigms of working.

What I was driving at was that better tools are one part of the triad of people, tools and ways that people work together with tools. Commit discipline will always be desirable, because no tool can recover a snapshot of my mind at the time I made the commit.

</comment></comment></comment></comment></comment><comment><USER6> > Lesson #3: It is polite to log interesting information at default levels and > deliberately dropping a connection for any reason is definitely interesting > to system administrators.

Agreed. But I suppose part of the reason this feature is present is because so many ssh servers are the targets of attacks, often brute force. So logging these might be problematic.

Speaking of "Rate limiting" \-- openssh logging something like "dropped N connections exceeding MaxStartups" once per minute (if N > 0) [at WARN level] seems like a sane compromise.

</comment><comment><USER7> I can't help but notice that these kind of blogs should be recommended reading for _CS /engineering students_ as well and not just to people who are already working.

The way an issue is to be analyzed (this post is a great example of Systems thinking IMO), what happens at scale and why not to blindly Google your way out of problems are valuable skills any engineer should have and which are unfortunately not taught in many schools.

</comment><comment><USER8> Isn't it possible to just set the haproxy maxconn to a slightly lower value than what the backend can deal with, and then let the reverse proxy retry once with another backend? Or even queue it for some hundreds of milliseconds before that?

This way you avoid overloading backends. Also, haproxy provides tons of real- time metrics, included the highwatermark for concurrent and queued connections.

<comment><USER9> What you suggest is what was followed by a large-scale distributed system I worked on. Your suggestion is also in-line with Google' SRE book section on Handling Overload: [https://landing.google.com/sre/sre-book/chapters/handling- ov...](https://landing.google.com/sre/sre-book/chapters/handling-overload/)

> _Mandate that batch client jobs use a separate set of batch proxy backend > tasks that do nothing but forward requests to the underlying backends and > hand their responses back to the clients in a controlled way. Therefore, > instead of "batch client → backend," you have "batch client → batch proxy → > backend." In this case, when the very large job starts, only the batch proxy > job suffers, shielding the actual backends (and higher-priority clients). > Effectively, the batch proxy acts like a fuse. Another advantage of using > the proxy is that it typically reduces the number of connections against the > backend, which can improve the load balancing against the backend._

Other chapters on Load Balancing, Addressing Cascading Failures are related too.

</comment></comment><comment><USER9> Scheduled tasks are a great way to brown-out your downstream dependencies.

In one instance, MDAM RAID checks caused P99 latency spikes first Sunday of every month [0] (default setting). It caused a lot of pain to our customers until the check was IO throttled, which meant spikes weren't as high, but lasted for a longer time.

Scheduled tasks are a great way to brown-out yourself.

In another case, the client process hadn't set a socket timeout on a blocking tcp connection [1] (default setting), and so it'd run out of worker threads blocked on recv routinely when the server (fronted by reverse-proxy) started rejecting incoming due to overload. Only a restart of the process would recover the client.

Scheduled tasks are a great way to prove HAProxy will scale way better than your backend. Thanks u/wtarreau

Speaking of HAProxy: It fronted a thread-based server processing all sorts of heavy and light queries with segregated thread-pools for various workloads. During peak, proxy would accept connections and queue work faster than the worker threads could handle, and on occasion, the work-queue would grow so big that it not only contained retries of same work scheduled by the desperate clients but a laundry list of work that wasn't valid anymore (processed by some other back-end in the retry path, or simply expired as time-to-service exceeded SLA). Yet, there the back-end was, in a quagmire, chugging through never-ending work, in constant overload when ironically the client wasn't even waiting on the other end and had long closed the connection. The health-checks were passing because, well, that was on a separate thread-pool, with a different work-queue. Smiles all around.

Least conns and the event horizon. Tread carefully.

Least conns load balancing bit us hard on multiple occasions, and is now banned for similar reasons outlined here: [https://rachelbythebay.com/w/2018/04/21/lb/](https://rachelbythebay.com/w/2018/04/21/lb/)

[0] [https://serverfault.com/questions/199096/linux-software- raid...](https://serverfault.com/questions/199096/linux-software-raid-runs- checkarray-on-the-first-sunday-of-the-month-why)

[1] [https://stackoverflow.com/questions/667640/how-to-tell- if-a-...](https://stackoverflow.com/questions/667640/how-to-tell-if-a- connection-is-dead-in-python)

<comment><USER10> I guess it would be nice to have a "fuzzy" cron job setting, so you could specify "run it at a random time during the day/hour/minute"

<comment><USER3> Someone pointed out in comments on the blog post ([https://about.gitlab.com/2019/08/27/tyranny-of-the- clock/#co...](https://about.gitlab.com/2019/08/27/tyranny-of-the- clock/#comment-4593761983)) that systemd actually has some good functionality for that.

</comment></comment></comment><comment><USER11> Bravo to the people that can navigate such a complex (not an insult) architecture and pull useful information from it! I expect it to be quite tricky to get in between the production environment(s) and capture packets or change logging etc.

I did wonder though: the authors seemed a bit unsure about the relation between MaxStartups and resource usage, wouldn't it be wise to just send an email to the openSSH mailing list or something to not be surprised by possible future problems?

<comment><USER12> Might be valuable if it reacted the same way in all environments (not always the case). And if someone answered faster (correctly - without sending them down an unrelated rabbit hole too!) then they could have found the answer out by just experimenting.

Don't get me wrong - I'm a huge fan of community support, but sometimes it's faster to just try things and see how the systems reacts.

Not to say you can't do both in parallel; and they might have - you aren't going to detail everything you did in a writeup like this.

As others said, I really enjoy reading write-ups like these. Who needs fiction when you have real world mysteries to solve?

</comment></comment><comment><USER13> > It would make everyone more comfortable if OpenSSH let us see the how close > we were to hitting MaxStartups at any point, rather than having to go in > blind and only find out we were close when the limit is breached and > connections are dropped.

If they are not afraid to dive into source, it should be fairly easy to add some logging when the value reaches 75% for example. Of course one needs to be careful not to break anything else (issuing thousands of warning logs at the same time that the system is at peak load is probably not a good idea), but it shouldn't be that difficult. Also, I assume this would be something that OpenSSH would be happy to get a PR (or MR, coming from GitLab? ;) ) for.

Nice writeup. What I miss is how they added monitoring for these kinds of errors, so it doesn't escalate to 1.5% of all connections again. But other than that, good job!

<comment><USER3> Oh, that's a fun story. We use [https://github.com/google/mtail](https://github.com/google/mtail) to turn log data into metrics exported for prometheus. We were already doing this for our haproxy logs; we just added a stanza to capture a secondary indicator that the problem is occurring (termination_state 'SD', and 0 bytes_read), and export that as a metric. You can see the relevant MR at [https://gitlab.com/gitlab- cookbooks/gitlab-mtail/merge_reque...](https://gitlab.com/gitlab- cookbooks/gitlab-mtail/merge_requests/47) (and [https://gitlab.com/gitlab- cookbooks/gitlab-mtail/merge_reque...](https://gitlab.com/gitlab- cookbooks/gitlab-mtail/merge_requests/48) to fix some bugs)

Then we just hooked it up through the usual sort of prometheus alerting rules. We made it really twitchy, because this combination of logs Should Not Happen if everything is working right, and we want to alert as soon as it starts occurring, so we can bump the limits again (or re-evaluate in general)

</comment></comment><comment><USER14> Interesting read.

But i bumped into the same problem recently while working on distributed simulation. I was writing an agent for an application which talks to clients over ssh. I started getting the same error when i cranked up machine count to 60.

I googled like every layman and zeroed in on MaxStartups. Looked at the manual to cross verify and fixed the issue in 5 minutes. I agree with what ever he did after he found out the issue but it was a clear case of SSH throwing an error. Why not just look up manual or google instead of wasting time on laborious packet inspection.

<comment><USER15> > Why not just look up manual or google instead of wasting time on laborious > packet inspection.

When you've got a load balancing layer, and virtual machines, and interacting with the real world, there's a reasonable chance that the problem is not a (relatively) simple application configuration issue. If you've looked through enough of these, getting a pcap (especially with an identified customer) and looking through it with Wireshark is relatively quick.

<comment><USER14> I could have worded it better like "why packet inspection to start with".

<comment><USER16> I love packet inspection, but I always feel that if I have to go to that depth, then we missed an opportunity to have observability (metrics/logging) earlier.

</comment></comment></comment></comment><comment><USER17> They should have led with the bottom line - add a `sleep 7` to any cron job that is going out to the network and set it to start at the top of the hour plus 3 minutes

</comment><comment><USER18> It's blog posts like this that make me realize I have no idea what I'm doing. Great work on troubleshooting a complex and interesting problem.

</comment><comment><USER19> I thought this was a pretty good piece, and points to the problems caused by running services at regular intervals.

</comment><comment><USER20> I remember that few years ago same issue occured to either Github or Bitbucket and they made a blog post about it.

</comment><comment><USER21> > we have 27 SSH backends, and 18 HAproxy

No autoscaling? This load pattern is a prime candidate for it.

<comment><USER22> I disagree.

Autoscaling sounds great, but in practice it notices that there is a problem after you already have once, and by the time you've scaled up, there is no problem any more. Which is the worst of all worlds.

For example in this case you'd realize there is a problem at the top of the hour. And 2 minutes later you'd have a bunch of autoscaled instances up, all wondering what the fuss was about. So they scale down again, but then at the top of the next hour the same thing happens again with the same result.

The same thing happens with ad servers. An ad buy goes in for 30 seconds. When it hits, you have a firehose. That then shuts off.

In fact this problem is so common that I recommend against autoscaling unless you have specific reason to believe that it will work for you.

<comment><USER5> And god help you if that starts your autoscaler to flapping.

Too much CPU load, start some servers. Too little, kill some servers. Oops now CPU is too high, bring them back. No, it's too low...

It reminds me of the old UI bug where you get an off-by-one error for scrollbar logic and so it appears and disappears in a cycle until you resize.

Edit: I think we want something akin to a learning thermostat, but for servers. Figure out that I get a CPU spike at 5:20 on week days and spin some servers up at 5:10. Then spin em down at 8:00 when EST starts to go to bed.

<comment><USER21> > .. Oops now CPU is too high, bring them back. No, it's too low...

You just described closed-loop control system oscillation. Cause is wrong gain and/or delay parameters. AWS ASG has some knobs for tuning like Cooldown, MaxSize. What you described above is most probably long boot time (delay) problem. Service should be ready in less than 30 secs after boot. To get there, one should bake AMIs, not install afresh all the stuff on boot.

<comment><USER5> You can get an oscillation without long boot or ramp-up time but they sure don't improve the situation.

Lazy loading of modules is a common cause, but any other resources that are loaded on demand or in the background. But that's more of a situation of thinking you need two additional nodes, getting three, settling back to two after warmup, and then killing them all off again when the spike ends.

I may have said elsewhere that I'm more comfortable with scaling load based on daily and weekly cycle patterns, with perhaps a few exceptions for special events (sales, new initiatives, article publications) and making it easy for someone to dial up or down.

To use a car analogy, get really good at power steering and power brakes before you attempt cruise control, get really good at cruise control before you attempt adaptive cruise control. And don't even talk about self-driving unless you're FAANG.</comment></comment></comment></comment></comment>


U.S. announces first criminal charges against foreign country for cyberspying - <AUTHOR> http://www.washingtonpost.com/world/national-security/us-to-announce-first-criminal-charges-against-foreign-country-for-cyberspying/2014/05/19/586c9992-df45-11e3-810f-764fe508b82d_story.html <comment><USER2> The point that most of you are missing is that the NSA's intelligence gathering activity and activities of that class are completely unrelated to these charges. They are being charged with _economic_ hacking activities. Trade secrets were being lifted and handed to Chinese companies. An analog would be like the NSA harvesting data from Samsung and then passing it to Apple, which is the type of stuff that we have no evidence of thus far. Regardless of your feelings on the NSA's actions, this isn't the same type of "all countries hack each other" activity.

And if you think metal and solar companies are the only one suffering these sorts of attacks, you're crazy. I think it's just that the other victims don't want to be named publicly for a variety of reasons. This sort of activity is a serious problem, but you can't just file charges all willy-nilly. Fortunately the U.S. already had economic actions in motion through resolution channels pertaining to the dumping of solar tech, so it makes this sort of thing much easier to do I think.

<comment><USER3> >An analog would be like the NSA harvesting data from Samsung and then passing it to Apple, which is the type of stuff that we have no evidence of thus far.

What ?

We've known that the NSA was engaging in corporate espionage on behalf of American corporations for a long time now and the American government doesn't even deny it: [http://news.bbc.co.uk/1/hi/world/europe/820758.stm](http://news.bbc.co.uk/1/hi/world/europe/820758.stm) (from 2000)

>The journalist, who has spent much of his life investigating Echelon, has offered two alleged instances of US snooping in the 1990s, which he says followed the newly-elected Clinton administration's policy of "aggressive advocacy" for US firms bidding for foreign contracts. The first came from a Baltimore Sun report which said the European consortium Airbus lost a $6bn contract with Saudi Arabia after NSA found Airbus officials were offering kickbacks to a Saudi official. The paper said the agency "lifted all the faxes and phone-calls between Airbus, the Saudi national airline and the Saudi Government" to gain this information. Mr Campbell also alleges that the US firm Raytheon used information picked up from NSA snooping to secure a $1.4bn contract to supply a radar system to Brazil instead of France's Thomson-CSF.

>former CIA director James Woolsey, in an article in March for the Wall Street Journal, _acknowledged that the US did conduct economic espionage against its European allies_ , though he did not specify if Echelon was involved.

<comment><USER4> That's not the same thing as stealing trade secrets and giving them to a domestic company.

<comment><USER3> The European Parliament report is here: [http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//...](http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//NONSGML+REPORT+A5-2001-0264+0+DOC+PDF+V0//EN&language=EN)

Here is an example:

Who: NSA, What: Wind wheel for electricity generation, developed by Aloys Wobben, an engineer from East Frisia, Aim: Forwarding of technical details of Wobben's wind wheel to a US firm, Consequences: US firm patents the wind wheel before Wobben; (breach of patent rights)

Sounds exactly like "stealing trade secrets and giving them to a domestic company" to me.

<comment><USER4> I couldn't find the original source "Aktenkriegerì, SZ, 29 March 2001", but it sounds like a news report. If you can find the source, I would be happy to read it and judge it based upon its reported sources.

<comment><USER5> The European Parliament report cites a single journalist, Nicky Hager. This particular allegation was based on interviews with anonymous French intelligence sources.

Basically, the French government selectively leaked to a New Zealand journalist, to justify retaliation (tariffs at the EU level, which never materialized) against the US government for burning their Saudi deal.

There has never been any credible evidence that US intelligence agencies pass trade secrets to American companies.

</comment></comment></comment></comment></comment></comment><comment><USER6> It's so strange seeing a person in full military outfit (and Chinese) on FBI's "cyber" most wanted list: [http://www.fbi.gov/wanted/cyber](http://www.fbi.gov/wanted/cyber)

When it pretty much has always been 20-something eastern-euro/Russian and the odd middle eastern hacker.

<comment><USER7> Where? They might not be on that page anymore.

<comment><USER7> I swear there were no Chinese entries on that page the first time I looked...

</comment></comment></comment><comment><USER8> For those who are calling the actions of the US "hypocritical" and others who are indiscriminately defending the US by saying "but we didn't do this and that" \- don't forget to distinguish between individuals and countries.

Those who are doing this in China are most likely not doing this for China - they are taking advantage of state resources to benefit themselves and their cronies. As much as they are stealing from the US, they are stealing from their own citizens. This is good old-fashioned corruption.

The loop of corruption tends to be more subtle and longer in the US, but it's also most likely the case many people who are engaged in espionage, corporate or otherwise, are out for themselves and using the information, expenditures, etc, to directly or indirectly benefit themselves.

Random people from China and France and the US arguing among themselves pretending that the enemy is definitely the spying apparatus in the other country and not their own and so on is kind of missing the point and worse, doing exactly what the perpetrators want us to be doing. The discord between nations, manufactured or not, is their raison d'etre - it's what keeps them funded.

With that said, holding specific individuals responsible and make their lives difficult is sounds pretty good to me. I wish this happened more often, for US officials abusing their authority as well as foreign officials.

Edit: The point isn't that these people aren't employed by the Chinese government, but that the end goal is almost certainly private gains. China isn't some single unified entity where all government employees are working tirelessly for "China" or in this case, to benefit corporate titans who are much richer than they are - economic espionage on behalf of specific private sector entities is almost certainly about some quid pro quo by which government employees are monetizing their official capacity.

<comment><USER9> This is exactly what I thought. Think about the organizational challenge and the bureaucracy involved, there's no way for a "secret" spy unit's head to evaluate the economic value of all those targets, select for the ones needed, carry out the operation and distribute gained information to the corresponding domestic parties. It must work in the opposite way: the military set up the unit and recruited/trained the people for strategic missions like hacking through US military and private contractors. In the process of doing this, these people came across many other stuff, which they sell to other players through black market or backroom dealings to compensate themselves over the laughable salary they receive from the government. And I guess that's also how they got caught in the first place.

Bottom line is this, for your Particular corporation to be really helped by your government, there must be some corruption involved. I think this is true everywhere, but especially true in China.

</comment></comment><comment><USER10> Nice timing, Cisco just sent Obama a letter complaining about NSA tampering...

[http://www.bbc.com/news/technology-27468794](http://www.bbc.com/news/technology-27468794)

</comment><comment><USER11> I've yet to read up on this. But my initial reaction is: And zero accountability for those responsible for the gross systems mismanagement that too often enabled this activity.

I fear that security on the Internet is moving towards "rubber hose" security. It's not about truly securing systems and processes; instead, physical means will be used to intimidate and "punish".

And even then, it's not the truly responsible who are being intimidated. Nor, in the current circumstance, are the physical measures directly effective.

Instead, we have propaganda. "Don't look at our mistakes and neglect. Spend your anger and frustration on these foreign nationals, all conveniently framed for maximum effect. And never mind that we (government as well as private industry) do the same -- we're the 'good guys'."

</comment><comment><USER12> I'd say this is an instance of the pot calling the kettle black but the US has done far more than simply spy on foreign companies so calling it straight up hypocrisy is a huge understatement.

</comment><comment><USER13> Magicians misdirect the audience using similar tactics.

This is the equivalent to a woman in a skimpy outfit walking around on the stage, and bending over in a low-cut dress, while the magician switches one object for another.

</comment><comment><USER14> I wonder if the Chinese will charge a few Americans with something in retaliation.

Standing on its own, this action is pointless. As part of a larger strategy to provide evidence to justify future tariffs or sanctions, it would make sense. My guess is that's where the US is heading with this.

</comment><comment><USER15> hmmm... before Snowden said it out we didn't know anything about what NSA is doing, but at that time, the US government was always saying China is doing what NSA is doing.

I was not accusing anything, but you see, the announcement is lack of persuasion.

The spying game seems to be a zero-sum game. After charged china for spying for business, the US government may find it won't have any effect, then the best strategy will turns out to be doing the same. Think about the billions of the dollars companies spend as political contribution.

After the war begins, It really doesn't matter who shot the first bullet.

<comment><USER16> There is a lot of justifiable skepticism regarding spycraft. Read declassified accounts of the cold war. What happened swings between delusional paranoia -- where the Soviets thought the US & UK were preparing for a pre-emptive nuclear strike, to extremely serious, where the Soviets knew everything the US Navy was doing for a year. At best a zero sum game, at worst, it creates situations where wars start based on things that just aren't true.

Espionage is a bit different, but still a mess.

Presumably the only enforcement the US can take against those indicted here is financial -- which would mean assets that fall within the US's control. How does Beijing react?

The most interesting end effect of this could be the US's loss of criminal enforcement on the global financial system, reversing much of the benefits of post 9/11 anti-money laundering policy. Co-operation occurs when both sides benefit. I suspect some people in the US State Dept are very annoyed today.

</comment></comment><comment><USER17> No doubt said Chinese persons are distraught at the prospect of never being able to visit Disneyland. Short of WWIII there isn't much way to enforce such a verdict over foreigners on foreign soil.

</comment><comment><USER18> I wonder what the motivation is behind these charges. I have a hard time believing this to be remotely comparable to what NSA is doing both in term of technical capability and scale. I mean, ffs, these "military hackers" use their initials in the aliases. (according to FBI's wanted page)

</comment><comment><USER19> Nice moral high ground there!

</comment><comment><USER20> Well, as they say, best defense is a good offense.

<comment><USER21> +1

</comment></comment><comment><USER22> And this sort of thing is why you keep the moral high ground. Too bad, it would have been an excellent case otherwise.

</comment><comment><USER23> I didnt realize Keith B. Alexander was Chinese. Good job on bringing appropriate charges and finally impeaching that bastard.

..oh wait

</comment><comment><USER24> US Press Release - 'China are the bad guys and don't forget it!'

</comment><comment><USER25> This just in: pot calls kettle black.

</comment><comment><USER26> Hypocrites.

</comment><comment><USER27> When can we file criminal charges against the US government?

<comment><USER28> At any court you like. It happens all the time.

<comment><USER27> Sure, if they want to be sued.

</comment></comment></comment><comment><USER29> in what court exactly ?

</comment><comment><USER30> Ironic. I guess.

</comment><comment><USER31> Im surprised it isn't Russia they are going after. I guess the justice dept. didn't get the memo.</comment>


Clojure: Confessions of a threading macro addict - <AUTHOR> https://medium.com/@hlship/confessions-of-a-threading-macro-addict-5a026dae4af7 <comment><USER2> It really depends on what you're doing. If you're programming a sequence of actions against a collection like this example depicts then the threading macros visualize the processing pipeline. If instead you're reusing functionality via function composition then the "traditional" notation makes that obvious. Which form should be utilized then depends on which form makes it more obvious what you're doing.

<comment><AUTHOR> I am personally a fan of the "as->" macro, but I like the way you can embed a threading macro within another - never though of that.</comment></comment>


Man Shoots Girlfriend's Computer After Installing Windows Vista - <AUTHOR> http://www.funtechtalk.com/man-shoots-girlfriends-computer-after-installing-windows-vista/

<comment><USER2> I wonder if it was true? Flurry of blog-ish posts in July 2007. No "real" article since.

This article contains a small collection of similar shooting incidents.

[http://shekel.blogspot.com/2008/11/i-dont-condone-this- but-i...](http://shekel.blogspot.com/2008/11/i-dont-condone-this-but-i-really- really.html)

[[Fullish disclosure: I did crush a horrid little Gateway server with an intermittent problem into a tiny ball of metal and debris with a rented excavator. I can see where these people come from, I've been in the neighborhood.]]

</comment><comment><USER3> I'm guessing Microsoft won't include this guy in their "I'm a PC" ad campaign...

</comment><comment><USER4> I miss TechTV. Patrick Norton in a kilt destroying a PC with a sledgehammer was classier than a pistol.</comment>


A Dreaded Superbug Has Officially Arrived in the United States - <AUTHOR> http://gizmodo.com/a-dreaded-superbug-has-officially-arrived-in-the-united-1788584920 <comment><USER2> The fact that this fungus is strongly antibiotic-resistant and so far has only been found in healthcare settings, suggests it may be "iatrogenic" (resulting from activities of healthcare professionals) - or at least that such settings are vectors of infection.

"...a sweep of the Illinois patient's hospital room revealed traces of C. auris in his mattress, bedside table, bed rail, chair, and windowsill."

Scary stuff, considering the description of its effects on the human body, and that we're only now beginning to be aware of its danger.</comment>


If I could ask only one job interview question - <AUTHOR> http://asserttrue.blogspot.com/2009/05/if-i-could-ask-only-one-job-interview.html

<comment><USER2> I couldn't disagree more with the central point of the article: that newbies should only ask for help from expert programmers as a last resort.

An expert may be able to solve an issue in seconds that a might stump a newbie for weeks. Moreover, a newbie will learn much quicker if given guidance from an expert than if left to their own devices.

I have been in both situations, learning from experts and sharing my expertise with newbies. I have always been happy to help out others and have certainly been shown the same helpfulness by people more expert than me.

<comment><USER3> I absolutely agree with the article on this matter.

While what you're saying is 100% correct, I'm now seeing first-hand (we're dealing with a bunch of new hires at our company, and I'm the most senior developer on the floor) the reasons behind this.

The biggest reason is this: 9 out of 10 hires haven't yet cultivated the art of researching for themselves (we're speaking entry level programming jobs). If you give them an easy way out, yes, they do benefit more in the _programming_ aspect in that they now have an answer and have gained a jewel of information; but they're missing out on researching for themselves. The art of looking for an answer. Cultivation of the persistence that is required of good programmers, both in searching for and implementing any given solution.

These talents are worth more than the coding knowledge itself. The coding is propositional knowledge, but getting the solutions and doing it right is propositional knowledge and worth the wasted weeks.

<comment><USER2> Research of the sort we are talking here is easy, in that it isn't mentally challenging. Doing a google search and then sifting through all the articles does not require any skills other than patience, just as searching through a 1,000 page book to find the page you want doesn't require anything more than patience.

You don't learn anything by these actions. You learn by understanding the solution, and the sooner you can find an explanation for the solution the better, and in my opinion there is no quicker way of getting to the solution than by asking an expert.

</comment></comment></comment><comment><USER4> I only ever do ask one question in an inverview. I decsribe a simple application and then ask the candidate to design the database schema and business objects to support it. That usually takes up the time I'm given with the candidate, and tells me a ton about what techniques and technologies they've been exposed to and their maturity level working with same. I also watch for how willing they are to involve me in the process. The best team candidates have me working along side them (but then I get to toss in a few curve balls)

</comment><comment><USER5> I would ask "What are we looking for?" A correct answer requires great insight and pretty much compels the candidate to continue and explain how they fit the description.

</comment><comment><USER6> "Can you please teach me something?"

I only use it when I'm interested in the candidate, and the interview has progressed to the point where we're both comfortable.

</comment><comment><USER7> I'd ask what technical communities they are part of

</comment><comment><USER8> OP's one question would not be my one question, which would be:

"What would be different here in one year because of your presence?"

Their approach, as well as their response, would teach me a lot about them.

</comment><comment><USER9> The key in asking someone else is to avoid the disturbance effect. Hence, email: a delayed questions & answers session.</comment>


Ask HN: How does an engineer transition to problem solving roles at a startup? - <AUTHOR>

A lot of junior engineers we hire, some of them right out of college for whom this is their first job experience, acquiring some specific skills (like iOS/Android development) are not to hard to come by over a year or two. However it is hard to transition them to projects that involve planning and designing a system and then building different components that can work together. What sort of learning curriculum can help an average developer improve their problem solving ability within the context of the start-up given that there might not be very experienced folks to learn from and not too much time available to attend a full time program. The problems aren't complex algorithms or anything, just simple application systems that need to work end to end. <comment><USER2> My favorite thing to throw people at is working on network APIs, file format libraries, and SDKs.

The problem space is well-defined and testable--a file either parses or it doesn't, an HTTP request either produces the desired results or it doesn't-- but the problem space is also limited enough in political and philosophical complexity that it doesn't distract them from the planning and care and architecture work they'll need to do to accomplish their goal.

I'm actually rather proud of an intern of mine...in the last month and a half, their work has been:

1\. Creating an auditing and compliance tool to help meet regulatory requirements. They were allowed to use whatever they wanted (they chose Ruby with some cleverness in the programming), and then made something that pulled from wikis and Github in order to automatically annotate issues and produce reports showing what had been tested, where, by whom, etc. Simple project, had some practice extracting requirements (some meetings I sat in on to help smooth things along), and then they executed wonderfully.

2\. Working with me to draft and specify a binary and JSON format for shipping realtime waveform data. We did the design work in a weekend, presented the draft to the CTO, and got it approved for use (which was all expected, but intern got to learn about politics). This also had several conversations where I had to push back on good engineering decisions to meet business requirements, which is important because I could explain both why it had to happen and acknowledge how frustrating it was for them.

3\. Worked on the Ruby and C library implementation of aforementioned spec, and then they took over my C# implementation when I ran out of free cycles to work on it...basically the testing and verification work that I hadn't finished. The project is about done enough to ship to our partners for use.

4\. (not started yet) will be native Ruby and Python bindings for working with our data collection platform, and maybe JS bindings too. This will expand on their experience doing documentation and testing, and give them a pretty free hand in doing larger architecture work on important things, but still with limited scope and no politics so that they'll learn a lot.

~

The previous summer we had an intern who wasn't experienced enough in programming to take to that sort of work, so I instead had them working on doing test data generation and simulation. That worked out alright, but our business folks kinda kept sticking their noses in and interfering with what they were working on--"Hey, you like art, can you do logo design?", "Hey, we need this data set, can you just hand generate it?", "Hey, we need an inforgraphic...". Worst thing ever.

~

Basically, give them:

      1. Work that is important to the company.

      2. Work that is technically straightforward (doesn't have to be _easy_).

      3. Work that does not block on or blocks anyone else.

      4. Work that does not cross political boundaries. They talk to you, or you both talk to customer.

      5. Work that requires planning and implementation correctness.</comment>


Asciimo: Online web app to generate Ascii art text - <AUTHOR> http://asciimo.com/

<comment><USER3> That a nice clone of the Figlet command line tool. (<http://www.figlet.org/>)

However, _real_ ASCII art is more than a text with a special font.

<comment><USER4> I'm actually using .flf (FIGlet) files as fonts <http://github.com/Marak/asciimo/tree/master/fonts/>.

You are very right in your comment. I have ascii coding laying around right now in JavaScript that can take any image and convert it into ascii, but making it work server-side is going to be hard.

If you think you can help with any of this drop me a message on the github.

<comment><USER3> _> I have ascii coding laying around right now in JavaScript that can take any image and convert it into ascii, but making it work server-side is going to be hard._

Why do you want to code it yourself? There's the all-time favourite AAlib (<http://aa-project.sourceforge.net/aalib/>). _[1]_

However, automatically generated ASCII images aren't really _art_ , either. It's just the generators themselves which can be called art. ASCII art almost always requires some tough hand work to become really good. For example, have a look at the Star Wars Asciimation (<http://news.ycombinator.com/item?id=1446358>).

 _[1]_ The great BB demo (<http://aa-project.sourceforge.net/bb/>) has been created using the AAlib.

<comment><USER5> Ah the great bb demo, it comes along Knoppix, thats where I saw it first :)

<comment><USER3> It's available on all Debian-based distributions, and maybe other distributions, too.

</comment></comment></comment></comment></comment><comment><USER5> I think <http://www.network-science.de/ascii/> has existed for more than 9 years and does its job pretty well. [http://web.archive.org/web/*/http://www.network- science.de/a...](http://web.archive.org/web/*/http://www.network- science.de/ascii/)

<comment><USER4> yes...and where exactly is the code with demos? where is the support? where is the server-side node.js implementation?

<http://github.com/marak/asciimo>

<comment><USER5> Hmm, fine point, so for the lazy and old ones that one has served the purpose for a long time.

For the curious and for the freedom - <USER2>

<comment><USER4> :-)

i really have to apologize for the hosting. i'm using some experimental hosting software instead of a battle hardened solution. if anyone is having issues with the site you can clone your own repo and just open the index.html in your browser locally without installing anything.

site will become more stable over then next few weeks.

</comment></comment></comment></comment><comment><USER6> Wow, I had no idea there were over 300 ASCII art fonts.

Actually, I had no idea there were ASCII Art fonts at all.

</comment><comment><USER4> hee hee, i was a bit hesitant to post the live site on HN.

lets hope the hosting holds up! ^_^</comment>


Ask HN: Which Password Manager for Teams? - <AUTHOR> Do you have a preferred Password Manager for teams? Looking for a solution which allows role-based sharing of certain passwords (i.e: Only User A and User B can access credentials for Website X).
Ideally looking for a solution that has the smallest possible amount of friction.
What do you use, and are there any password managers that you would specifically avoid? <comment><USER2> All the password managers I know of for teams don't have any RBAC type of controls. Either you get everything that is shared, or you don't.

For personal stuff, I use 1Password on my Macs and all my iOS devices.

At work, they standardized on LastPass.

There are other choices in this space, but a lot depends on which other features you may need.</comment>


Book discussion: What do you think of "Daemon" by Daniel Suarez? - <AUTHOR>

The technologies described in the book are certainly not science fiction and well within our grasp at the present time, or achievable over the next decade. A question is how plausible is such an event scenario for the world we live in now, and the world of our children? <comment><USER2> Thanks for mentioning this book: I missed it before this. There's a good talk by Suarez at:

[http://fora.tv/2008/08/08/Daniel_Suarez_Daemon_Bot- Mediated_...](http://fora.tv/2008/08/08/Daniel_Suarez_Daemon_Bot- Mediated_Reality)

</comment><comment><USER3> I liked the book. I got the audio version as a gift and listened to it on a long automobile trip. It is not boring and the technology is plausible. _____</comment>


A waterless toilet that turns poo into power - <AUTHOR> http://www.theguardian.com/sustainable-business/2016/feb/07/waterless-toilet-turns-your-poo-into-power-nano-membrane-technology <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=10895347](https://news.ycombinator.com/item?id=10895347)

</comment><comment><USER3> Neat idea, but it won't be adopted in third world countries. Its too complex, and if it requires any maintenance, it will be thrown away once it stops working. That's a common theme with these kinds of devices targeting poor nations.

<comment><USER4> Absolutely. Membranes will foul, things will clog, it's basically doomed in a developing world environment.

Re. Service contract/rental model, the economics of providing that service are extremely challenging. People who need this product have very little money to spare. The price would need to be set low enough, and in those price ranges the profit margin basically disappears.

For other interesting companies doing this with these cost and pricing issues in mind see:

[http://www.xrunner-venture.com/](http://www.xrunner-venture.com/)

[http://resourcesanitation.com/](http://resourcesanitation.com/)

Edit: full disclosure, second link is my brother's venture in the space. I've heard a lot about toilets over dinner for many years :)

<comment><USER5> The toilet OP linked to is a real toilet experience. Flush and forget with no exposure to what went down before you. These [http://www.xrunner- venture.com/the-toilet/4586730377](http://www.xrunner-venture.com/the- toilet/4586730377), [http://resourcesanitation.com/our- concept/](http://resourcesanitation.com/our-concept/) are nothing more than outhouses.

</comment></comment></comment><comment><USER6> First world patronising Africa, again.

As if the minute amount of power produced by this shameless, transparent attempt at viral marketing will ever recoup the cost of production of the device itself, let alone the R&D budget or maintenance cost.

This is like a Toyota Prius with 10x worse environmental impact. Its biggest impact is on the conscience of people who are predisposed, literally, to believing bullshit, so that they can continue to eat diesel-ship-fuelled sushi and fly on aircraft, a single hour of which will negate a lifetime of sitting on an environmental toilet.

<comment><USER7> People downvote you but there's definitely some truth there to find.

Thing about these projects is long-term gain. Maybe these toilets will pay off in 20-30 years, they have to, if they want to be sustainable.

But yes, a single plane flight would negate all of the savings. It definitely negates all of the energy you save by showering with cold water, by recycling, by turning of the light.

It is definitely a gigantic problem when India, China, Africa turn into energy hungry giants that already are Germany, USA, UK etc.

We'll see how it all will turn out to be, business seems as usual, hope that's going to change fast.

[http://www.withouthotair.com/](http://www.withouthotair.com/)

A great book that describes how simple and easy it is to analyse sustainability - purely by numbers.

</comment></comment><comment><USER8> Interesting, a friend of a friend of mine is the founder of [http://saner.gy/](http://saner.gy/)

They've been very successful in Kenya.

</comment><comment><USER9> From the last time around :

[https://news.ycombinator.com/item?id=10895347](https://news.ycombinator.com/item?id=10895347)</comment>


Ask HN: Code School for an Experience Project Manager? - <AUTHOR>

So I'm going to ask yet another one of these annoying questions....
My background: I've got a degree in engineering management w/ a specialization in Industrial Engineering. I've been in the software/hardware world for 6 years. I started in aerospace as what can only be translated loosely as a "Solutions Engineer" which was a unheard of rarity, my co-workers were grey beard engineers called back from retirement. After a few years there I went on to a Big 4 Management Consulting firm. I did a lot of Project Management IT stuff in the finance and health care sector for just over a year.
Now I work at a web agency where I'm the "technical project manager," "devops" and cranky IT guy.
Here's my challenge: I'm trying to leave Washington DC to move to San Fran, Austin, or Portland. I've been actively trying to get a job in one of these cities for the past 5 months. I've had some really great interviews in the beginning with some more mature startups and other mid sized companies. For the past 2.5 months I can't get a single person to respond to my applications.
My skills thus far (Python, Django and Bash): Several web scrapers, load testing via Locust, I run my own set on Mezzanine (Django project), I've got another site for a wedding that runs on Django and uses some CBV for RSVPing to the wedding, as well as a JS integration with Echonest.
Last night I applied to what I only later realized was a dev director position, there wasn't much of a hint to writing code but I caught it after I applied. I continuously find myself attracted to this position and only wishing I could have those type of positions.
Today I realized maybe I should go to code school boot camp.
My Ask:
1. Does anyone have an opinion/experience similar to this? 2. Is this a really bad idea? 3. Any recommendations on schools?
Ps. I looked at getting a MS in Comp Sci is out of the question. <comment><USER2> Do you want to program, manage projects, or manage people? They're all entirely different, and usually a different personality. I am guessing by asking for a code school, you would rather program? Or are you mainly interested in a code school because of the perceived higher salary of coders (not true, btw)

<comment><AUTHOR> No I'm not in this as some sort of salary booster. I'm looking to manage(lead not manage) people in particular developers. The reason I'm saying code school is that no one (that I know of) lets people who weren't at some point a developer, manage developers. Although I do like writing code so I'd be shooting for maybe a 40% of my time writing code.</comment></comment>


Was XML Flawed from the Start? (2005) - <AUTHOR> http://www.rebol.com/article/0108.html <comment> sven-n I guess the author didn't get the purpose of XML. It doesn't have the goal to use the least amount of metadata/tags as possible. If you need that, just compress it. Whatever, XML offers a wide range of tools, such as:

\- Data in XML can be transformed into almost any other format using XSLT.

\- It can be validated using XSD.

\- It can be searched using XPath.

This makes it a perfect data exchange format.

<comment><USER2> Perfect? Really? There's no possible better way to achieve those goals? I've used XSLT; it's nasty.

<comment> sven-n Well, I don't say there are not better ways, but I don't know any. I've used XSLT a lot. It requires different thinking, if you are used to procedural programming. If you deeply understand how it works, it's pretty straightforward.

<comment><USER2> The concepts are straight-forward, but the syntax is absurd. I really liked it at first because it's functionally oriented, which is exactly what you want for transforming data. But it's so, so verbose because it's still trying to be markup instead of a programming language.

<comment><USER3> You nailed it. XSLT is not a programming language, it is a data transformation language. Furthermore, it is a data transformation language written as a valid and well formed XML document.

I was recently involved in an exercise to create a JavaScript runtime environment running in Java, and wrote JavaScript scripts to process JSON payloads that transformed them into a set of instructions that would change network switch configurations. The process that kicked off the transformations initially generated XML payloads, but it had been modified to generate JSON for the exercise... or more accurately that is what it would do, but we were in the POC phase.

The difficulty in using JSON was that the payload wasn't flat but represented a system of woven objects, as was true of the original XML payload. The XSLT transformer while cumbersome to write was able to transform the payload using backtracking XPath references that was significantly more difficult to articulate when using JavaScript. In the end my POC method worked and it was easier for someone with a procedural programming mindset to read and write, but it lost some of the nuance of the XSLT method.

Use the right tool for the job. I personally thought the best approach would have been a combination. Use a lighter weight XSLT to transform the objects into a more manageable payload and then use the JavaScript to handle the last mile tasks it was better suited to do. It was an interesting exercise and maybe I'll be able to leverage what I learned on a future project.

<comment><USER2> What do you mean, the original XML payload wasn't flat? At first glance XML is just as inherently flat as JSON (being a text string), but I guess there's some internal referencing semantics for XML documents? What did you really lose moving away from XSLT?

Anyway, I think I'd rather have a nice programming language that's also well- suited to data transformation. I'd ditch XML for something more elegent and flexible and have a transformation language to match. That's my dream, anyway.

<comment><USER3> What I meant was that it was a collection of different, but related objects. I had nothing to do with creating the structure and content of the payload, so I was stuck using it. The XSLT had grown organically over several years to solve each immediate problem and didn't seem to be designed. This wasn't a problem for XPath because it could walk backwards on the RTF and index based on keys contained elsewhere in the payload. I'm sure it didn't perform as well as some alternatives, but it is still a powerful and unambiguous language in that respect.

Another subtlety was their use of attributes in the XML payload that were simply interned as any other property in the JSON representation. I did some hand waving earlier by suggesting the original system was configured to emit JSON. That would eventually be the case, but for the POC it was transformed by an intermediate process that did a straight transliteration. This made the JSON a little less friendly because I had arrays of objects where they would have been better described as a dictionary, but I had to be more generic in that approach.

Once I was in the transformer portion of JS code, I converted the arrays into something more usable. This still meant nesting multiple loops as I iterated over the collections and built usable objects.

There was some attempt by the original programmer to use XSLT best practices. The transformation was broken up into multiple templates that were then applied, but there was too much reliance on conditional variables for my taste.

Arguably had the JSON payload been rewritten and structured better, the JS approach would have worked. But this was building a plane in mid-flight. I didn't have that luxury. I had to ingest JSONified XML and emit a text document.

To make the template easier to read in the source I defined it using Moustache. This was probably the biggest issue with the existing system. With all of the conditionals, it was next to impossible to know what the final transformation would look like. This is why the client was looking for other options, because the existing system was becoming too costly to maintain.

I think this is what I was trying to get at in my original comment. XSLT worked better as a data transformer. XPath made it easier to describe these transformations than I could do in JS alone. On the other hand, the JS was easier to maintain and if from your background you only know procedural languages, it was easier to read and write. The problem in this case was that the data they were using to drive the process was already in an XML format and XSLT was a known working solution.

I still think the best solution for this case would be rewriting the backend, but that wasn't an option. The next best solution would be to use XSLT to transform the data into something more manageable in JS, but the client wanted to eliminate XSLT entirely. My POC was the end result, for better or for worse. It was still an interesting project.

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Much discussion of similar issues here:

[http://c2.com/cgi/wiki?XmlIsaPoorCopyOfEssExpressions](http://c2.com/cgi/wiki?XmlIsaPoorCopyOfEssExpressions)

</comment><comment><USER5> XML works very well as a serialization format. Especially when you apply schemas that are able to validate your XML structure. I agree, typing XML can be cumbersome but so can JSON (which can be quite nightmarish in larger blobs and which doesn't allow comments).</comment>


Show HN: Muna, your personnal paperboy - <AUTHOR> https://muna.io/

<comment><AUTHOR> Hey there, I created Muna. It's a bit late in my TZ right now, but I'll be happy to answer to everything when I wake up!

In the meantime, here's a blogpost that explains the why and how of Muna : [http://geoffrey.io/muna-your-personnal- paperboy.html](http://geoffrey.io/muna-your-personnal-paperboy.html)

</comment><comment><USER2> Does it track click throughs so you don't get the same links every day? I'd love something like this for instapaper!

<comment><AUTHOR> Yes it does track links, and instapaper integration is planned very soon!

</comment></comment><comment><USER3> This is cool! I've definitely looked for a site that did this before. What's it built on?

<comment><AUTHOR> It's built on Symfony with a few cron jobs to process everything in the background and sendind the emails through Mandrill. I'll most surely add some kind of queuing mechanism (either with redis or RMQ) soon to handle things more gracefuly.

The design is a paid wrapbootstrap theme called Harp.

</comment></comment><comment><USER4> Nice idea to leverage twitter's starred items. Do you plan to support other social services ?

<comment><AUTHOR> Thanks for asking!

Yes I plan on supporting at least Pocket and Instapaper, maybe more depending on demands.

</comment></comment><comment><USER5> Do you think tools like this will make people star/favorite more or less stuff over time ?

<comment><AUTHOR> Yes. I know I personally do, now that I don't fear to forget content I favorite anymore, it's made favoriting stuff even easier than before!

</comment></comment><comment><USER6> FYI you can actually achieve this same thing for free using IFTTT and email digests

<comment><USER7> It's true yet it's going to be free as in "build it for yourself and maintain it all your life". I tend to forget how I've built some tools I'm using and I sometimes spend hours re-understanding what I've done.

Regarding the price, services like feedly - disclaimer: I've been a paying subscriber in the past - cost $45 per year, and it's not been clear to me what value it was providing me (except some integrations with 3rd party tools maybe).

Anyways, I would certainly love to see an integration with RSS readers like the one mentioned above (which would also mark as read all the posts I received in a digest).</comment></comment>


Gnome Shell JavaScript Documentation - <AUTHOR> https://mathematicalcoffee.blogspot.com/2012/09/gnome-shell-javascript-source.html <comment><USER2> This is very old (2012) and may be out of date at this point.

Per the GNOME docs [1] it sounds like there still isn't much documentation for the GNOME Shell Javascript code.

[1] [https://wiki.gnome.org/Projects/GnomeShell/Development](https://wiki.gnome.org/Projects/GnomeShell/Development)

<comment><USER3> Thank you for the update. A bit tragic, the accessibility of GJS (Gnome JavaScript) drove plugin creation for countless solutions. Many solutions which I still use.

<comment><USER4> Completely separate from the submission of this link:

I've been working on triplescripts.org, and I have plans to dive into Gnome and GJS, with the goal being to highlight GJS as a potential target for the system layer. Along the way, I intend to pour some energy into the Gnome/GJS docs. In the past, I was heavily involved in shaping the JS docs on developer.mozilla.org in its early days (ca 2006–2008).

For pragmatic reasons, triplescripts.org is "launching" with a focus on NodeJS right now, due to its ubiquity. GJS is a capable alternative, though, especially for environments where you'd expect it to be installed and where NodeJS isn't already, like default Ubuntu installs.</comment></comment></comment>


Comet Lovejoy Plunges into the Sun and Survives - <AUTHOR> http://science.nasa.gov/science-news/science-at-nasa/2011/16dec_cometlovejoy/

<comment><USER2> Their headline makes you think one thing, and then the story delivers another. Still, that is an interesting story.

It would be interesting to know the real heat transfer out in the area the comet passed through. It may be a million degrees, but it is extremely tenuous.</comment>


Why Gold? - <AUTHOR> http://kevinlawler.com/gold <comment><USER3> Completely off topic, but as a geologist, phrases like this are a bit like nails on a chalkboard:

>> "Gold is still rare, but it's also everywhere, roughly speaking. It's geologically distributed like this because it leaves the center of the Earth through volcanoes and other cracks. The Earth's surface has cracks all over it, so gold is all over it."

In context, it's innocent enough, but it's the sort of thing that makes me twitch grumble... (The phrase "fault line" provokes the same reaction... It's not a line! Just say "fault".)

The main part is that a) gold isn't everywhere. It's concentrated in specific areas. and b) Why add the "center of the earth" part in? That's just silly... Next, most(ish) gold deposits are probably sourced from metamorphic fluids rather than igneous activity. It's true that there is a major category of gold deposits associated with felsic magmas, and another associated with oceanic crust production, but way off base that "gold comes from volcanoes".

Next:

>> "Coming from the center of the Earth is going to ensure that gold has qualities not usually seen on the surface."

What?? Yes, gold is relatively nonreactive and relatively soft. That's because it's a noble metal. It doesn't come from "the center of the earth"... Yes, the core is probably enriched in gold compared to the crust, but the gold we mine at the surface doesn't rise up from the core. (In fact, it was probably added by meteorite bombardment after the planet was formed.)

At any rate, enough ranting. Neither of these have any bearing on the topic of the article itself.

<comment><USER4> I feel as though Dave Barry would jump in and point out that you've just shared an awesome band name:

Felsic Magmas

<comment><USER5> Cummingtonite.

(There is a long tradition, among earth scientists, of geological dirty puns.)

<comment><USER3> We do know how to make the bedrock.

<comment><USER5> My thing was crystallography. We do have the odd characteristic habit.

</comment></comment></comment></comment></comment><comment><USER6> Sorry but this theory is completely wrong.

Gold has value because it is a currency (medium of exchange) and money (store of value) due to the following properties:

a) Indestructible - bury it in your garden for fifty years, still the same.

b) Infinitely divisible - use it to buy a goat or the neighbouring kingdom.

c) Easy to detect adulteration

d) Stable supply (around 2% growth in supply annually since time immemorial)

e) No other use - Gold is terrible for most other things (swords, stirrups, axes....) so demand for it is purely for its value as a currency.

This is why rich people had a lot of gold - rich people have money and gold is money

There is one other very precious thing and that is diamond, basically the same except not divisible. Silver also caught on but not as much as gold. Pretty much every other metal lacked on one or more of the above properties.

Bitcoin is exactly the same, except you can send it over the wire.

Over the millenia, the properties people have looked for in currency have not changed.

<comment><USER7> >e) No other use - Gold is terrible for most other things

Not true, Gold is one of the best conductors of electricity and is used in electronics and wiring.

<comment><USER8> Gold's not a great conductor. It's used because unlike copper or silver it doesn't tarnish.

And because it's shiny so it looks good in adverts.

<comment><USER9> This. Also, you can durably plate other metals with gold only tens-to-hundreds of atoms thick, so actual mass usage is kept very very small for these applications.

</comment></comment></comment></comment><comment><USER10> Kinda off topic, but here's on Einstein's relativistic effects in gold atom, that give gold its glow: "Why is Gold yellow? Special relativity causes length contractions and time dilations in objects that travel at speeds approaching the speed of light. The valence electrons of large atoms such as gold have such high energies that their speeds actually approach the speed of light—and the relativistic effects on those electrons can become quite large.

Special relativity changes the energy levels of the 5d orbital in a gold atom so that the energy difference between 5d and 6s orbitals equals the energy of a 'blue' photon. Gold thus absorbs blue light when electrons are elevated from the 5d to the 6s orbitals, while other metals do not. These special relativistic changes to the energy levels of atomic orbitals are slightly different for each element.

Relativistic contractions on gold's valence electrons (the 6s subshell) pull the 6s electron very close to the nucleus. Being closer to the nucleus makes the 6s electron less accessible to any potential reactants. Special relativity is not only the reason for gold's yellow colour but also for its very low reactivity!"

[https://jameskennedymonash.wordpress.com/2014/07/13/why- is-g...](https://jameskennedymonash.wordpress.com/2014/07/13/why-is-gold- yellow-the-chemistry-of-gold/)

[https://www.fourmilab.ch/documents/golden_glow/](https://www.fourmilab.ch/documents/golden_glow/)

<comment><AUTHOR> This is too cool not to try and incorporate.

</comment></comment><comment><USER11> Not to sound harsh, but are there any historical sources or references for this essay?

It's likely another _just-so story_ about gold and the emergence of money from the barter economy.

[https://en.wikipedia.org/wiki/Just- so_story](https://en.wikipedia.org/wiki/Just-so_story)

<comment><USER12> It's ridiculous and completely made up. He's treating prehistory like history -- we have absolutely no clue how this stuff evolved. Based on the role of art in history, it's highly likely that people did what they did with gold because religion / witch doctory, not economics.

"Rich people" with lots of stuff in the history we know about were rich because of force and threat, not trade.

Edited to add: that doesn't mean trade didn't happen, just that people mostly weren't "rich" off of it.

</comment></comment><comment><USER13> Here is my serious question for Hacker News community: who the ____upvote this piece of __ __? I mean, seriously, guys, why, in the name of all that is (even if marginally) correct, did you up vote this piece of fantasy?

I frankly don't think this piece of ____deserve any more attention than the few minutes I spent insulting it, but I think my insults require defense. After all, they are probably less trashy than their target (in this case; note: I am generally against insult; but guys, I can 't help myself). Here goes the defense (feel free to ignore it; again, just ignore this whole things to save yourself a few precious minutes): 1\. Gold is among the most useful material on earth. It is impervious to any kind of oxidization, as well as soft and easy to work with, plus conducts heat and electricity superbly. This means that even the least developed societies can fashion high quality tools out of it (from bowls to utensils to weapon). The idea that somehow gold is useless (beside decoration) is beyond laughable. 2\. Secondly, the idea of rich and poor within a lowly bartering-only society is also laughable (well, this one is slightly less obvious than the uselessness of gold). Wealth implies accumulation, which implies settlement, which implies (relatively) high food production capacity. By then, oops, you are talking about relatively advanced societies. There is one thing I have yet to find: a society with wealth that looks at gold with no more than amusement.

So, 1+2 means that a place where rich people only employ gold for decoration is a fantasy by idiots. Again, I am against name-calling, but this is just so.... Sorry, my bad. Anyhow, please save yourself and STOP UPVOTING IDIOCY.

<comment><USER14> Yes, thank you, this article is trash, to the point where I have to wonder if it isn't some attempt at trolling akin to "the purpose of a ninja is to flip out and kill people".

[http://www.neatorama.com/2010/11/30/why-gold-is-the-ideal- me...](http://www.neatorama.com/2010/11/30/why-gold-is-the-ideal-metal-for- currency/)

</comment></comment><comment><USER15> Gold isn't useless, it's great for decoration, jewelry and small sculptures. For instance, because it's so malleable, you can easily turn it into a sheet and apply it to a sculpture, as the Greeks did.

We don't usually think of decoration as something that's worth a lot of money, but that's partly because we have access to so many cheap organic pigments. Before the 19th century, natural pigments could be very expensive and societies spent a lot of money on them (like the Greeks who painted and gold- plated their statues).

<comment><USER16> That's not really true. Gold is used in decoration because it's expensive. i.e., it's use as a status symbol derives from its costliness primarily, not the other way around.

Aluminium had a similar status, at one point it was used for decorating the most fancy things, it was a show of wealth and power and more expensive than gold or silver. If you had aluminium cutlery, you were the bomb. Then they were able to produce aluminium cheaply, instead of mine the small amounts that naturally exist. It became dirt cheap, and thereby lost its status.

Was it any less decorative? No. The cutlery still looked the same. It became uninteresting to use aluminium not because it became ugly, but because it became cheap.

Same with gold. Yes we sorta-kinda like shiny things, but we don't like the gold apple watch the best because we like the tacky golden color so much, we like it because we all know it's expensive. There are lots of pretty metals, pretty colours etc, it's not what gives gold its value.

Of course gold isn't useless, it has industrial applications and indeed artistic applications as you mention. But what is clear as day, is that it trades at a value that far exceeds this use, at a value that can't be explained by its functional utility alone.

<comment><USER17> A minor nitpick: aluminum was mined before and after it became cheap, what made it cheap was improvement in the process of refining the mined ore into pure aluminum, not that it was suddenly "produced cheaply" instead of "mining the limited amounts that naturally exist".

<comment><USER16> thanks

</comment></comment></comment></comment><comment><USER18> "Gold is not useful"

Gold is useful. Good thermal conductivity and low chemical reactivity with many corrosive compounds.

Using it for money and decoration is perhaps the least sensible thing.

<comment><AUTHOR> We all know that gold has industrial uses. But those won't appear for thousands of years. Mentioning that you can use gold in integrated circuits does nothing to explain gold in the Stone Age.

<comment><USER19> The fact that gold doesn't corrode explains why it is used for money and decoration. You don't want your decorations to tarnish, and you don't want your currency to degrade over time. When it comes to resisting time, you just can't beat gold.

</comment></comment></comment><comment><USER20> Is this article well-researched, or is it mostly speculation? I'm fine with speculation, just I'm surprised it made the front page of HN.

</comment><comment><USER21> Gold has some uses, but the utility value is far less than the monetary value.

The reason for this is a sort of religious idolization.

>When I was older, I learned what the fighting was about that winter and the next summer. Up on the Madison Fork the Wasichus had found much of the yellow metal that they worship and that makes them crazy, and they wanted to have a road up through our country to the place where the yellow metal was...Our people knew there was yellow metal in little chunks up there; but they did not bother with it, because it was not good for anything.

-Black Elk

</comment><comment><USER22> The success of Bitcoin has led me to think that perhaps its concept of value is not wholly new, but rather illuminates how money has worked all along.

All my life, explanations of why gold is valuable have all boiled down to more intellectually nuanced versions of "Ooh, Shiny." But I suggest that gold is agreed to have value because of two traits it has which can be seen as analogous to traits of Bitcoin.

First, worked gold items like coins and jewelry represent a certain measurable and comprehensible amount of work. Not too much and not too little, in terms of available labor resources. Second (as I learned from the TV show Connections), the purity of a nugget of gold can be quickly estimated to a high confidence level by rubbing it on the smooth surface of a black basalt river rock. The deepness of the yellow of the streak on the rock immediately shows the quality of the sample.

So I believe gold is agreed to have value because to our ancestors gold artefacts demonstrated a certain amount of work invested, and the quality of those artefacts could be quickly evaluated with an efficient "proof of work" algorithm.

Why does "proof of work"=value in the Bitcoin ecosystem? In part because it guarantees a cap on inflation (thus preserving value while allowing appreciation), in part because dedicating valuable resources to mining represents a vote of confidence in the system.

I believe the simplest explanation for why gold has value is that there is nothing new under the sun, and analogous reasons applied when gold first came into use in human trading systems.

</comment><comment><USER23> I liked this:

 _What really drives the demand for gold is the social aspect. The primary driver is that rich people accumulate gold and so are associated with it._

This is also why Chanel can charge $3,000 for a purse.

It's also why Apple can charge a premium. It's been a part of their marketing strategy from the beginning.

From pg 78 of Isaacson's biography of Steve Jobs:

 _The third and equally important principle, awkwardly named, was impute. It emphasized that people form an opinion about a company or product based on the signals it conveys. "People DO judge a book by its cover," he wrote. "We may have the best product, the highest quality, the most useful software, etc.; if we present them in a slipshod manner, they will be perceived as slipshod; if we present them in a creative, professional manner, we will impute the desired qualities."_

There's a great deal of value in perception of value. If you have enough imagination to see value in pieces of paper with dead Presidents on them, then you've got enough imagination to see value in perception.

<comment><USER6> Paper money (fiat currency in particular) gets value because you can pay debts and taxes with it.

<comment><USER24> No, paper money gets value because your government forces you to use it - <USER2> accepting payment in local currency is punished by fine or jail time in the most parts of the world.

<comment><USER6> Correct. You can discharge any financial obligation with the legal tender and the recipient is obliged to accept it. We're saying the same thing.

</comment></comment></comment></comment><comment><USER25> Gold is an accident of history. It's valuable because it's shiny, it was one of the first workable metals (gold jewellery dates back at least to Sumerian times), and it required effort to produce (too Marxian?). Also, royalty and nobles had control of most gold because they controlled the means of production. With the connection to wealth and power, it was then used as a medium of exchange because let's face it, shekels of grain are somewhat inconvenient. Golds value persisted because of its durability, history, beauty, but mostly because it was always in demand.

</comment><comment><USER26> Stop using gold as reserve currency and the price of gold plummets >99%

<comment><USER27> Canada has eliminated all but 77 ounces of their gold reserves.

[http://www.mining.com/web/and-then-there-was-none-canada- sel...](http://www.mining.com/web/and-then-there-was-none-canada-sells-its- gold/)

<comment><USER28> ...right before gold shot up ~15%. Bad timing.

</comment></comment></comment><comment><USER29> This reminds me about signalling theories in animal mating (reminder: we are animals too).

For example, the idea about the peacock's tail being a good signal precisely because it serves no other purpose (and in fact can be a burden!). It signals that the individual is so well off, he can afford wasting resources on such a "useless" ornament.

According to this story, trading actual goods for a useless ornament would be a strong social signal that you are so rich, you can afford to lose actual resources in exchange for mere ornaments.

</comment><comment><USER30> This is written in extremely simplistic language, as if trying to explain to a small child - has it been through the Randall Munroe Thing Explainer filter?

<comment><USER31> No. Paste it into the Simple Writer, and there are many less simple words used.

[https://www.xkcd.com/simplewriter/](https://www.xkcd.com/simplewriter/)

And yes, I got that vibe, too. It's the same one I got when writing an article about encryption using it.

</comment></comment><comment><USER32> Already the author is talking about barter and "protomoney" which sets off many alarm bells for me.

I encourage anyone interested in the topic of the origins of money to read "Debt the First 5,000 Years" by David Graeber.

AFAICT there is wide consensus among anthropologists that forms of "money" existed far in human prehistory, and barter was never common in early cultures.

</comment><comment><USER33> Why Gold? Why not Silver? Gold isn't useless, as others have said. Silver's a lot less useless; it's used in so many useful things, and both gold and silver are currently undervalued.

I liked the article, although I was hoping to read more about its value as an investment, and how it's survived and thrived through all of our past depressions.

<comment><USER34> Silver tarnishes.

</comment></comment><comment><USER35> Good article. I'd like to nitpick, rich != power, just because you're rich does not mean you can hire people to steal gold violently for you. For that, you need followers. Without followers and having lots of gold just makes you a target.

</comment><comment><USER36> A far better history of Gold and its relation to art:

[https://www.youtube.com/watch?v=grULH297m48](https://www.youtube.com/watch?v=grULH297m48)

</comment><comment><USER37> [https://www.youtube.com/watch?v=rc0vb5jImuE](https://www.youtube.com/watch?v=rc0vb5jImuE)

</comment><comment><USER38> As a side note, the author's bio is interesting. He went from assistant VP at Merrill Lynch to being a software engineer at Etsy.

<comment><USER39> Assistant VP in a big bank usually means underpaid third-class software dev. Working as a software engineer at Etsy is most likely a promotion.

<comment><USER40> Maybe job titles should somehow indicate the number of others in the company with the same job title. So VP/3500 would mean there are 3500 people with the title "VP" in the company. Not so impressive.

I remember once when my dad worked at IBM, he mentioned the president of IBM was only 5 "bosses" up from him. I was really impressed, until he told me that it's not that impressive, because 10,000 other people are also in the same position.

<comment><USER41> I think the point of calling people VP, executive etc is explicitly to not do that. It's meant to sound impressive. :)

<comment><USER16> Absolutely. A lot of sales-heavy companies have thousands of vice presidents, because if you're getting approached by a 'sales employee from XYZ investment bank' you hang up, if you get approached by 'the' (really 'a') vice president of sales from XYZ investment bank, you're more inclined to consider the sale.

There's entire industries where you start out of college around age 22, get an entry function for 3 years, a follow-up function for 3 years, and then become vice president by 30, and stay there for life, become a partner or change careers. The amount of VCs is ridiculous and totally lost its meaning.

</comment></comment></comment></comment></comment><comment><USER42> It's a viechle for value. If not gold, there will be other viechles.</comment>


How Not to Learn Cryptography (2014) - lucas-piske http://esl.cs.brown.edu/blog/how-not-to-learn-cryptography/ <comment><AUTHOR> I've been working through the Cryptopals Crypto challenges ([https://cryptopals.com](https://cryptopals.com)) over the last month-and-a- half (almost done with Set 6), and they've been extremely educational.

Attacks that I thought were just "theoretical" turned out to be very practical (sometimes even quite simple.) I've always known that one shouldn't roll their own crypto because there's so many ways to shoot yourself -- but holy hell, executing some of these attacks really drive the point through.

(Also, I've learned more number theory in the last few weeks than in my whole life!)

If anyone's interested, I've been solving them in Go (which turned out to be surprisingly convenient for many reasons), and my solutions (so far) are here: [https://github.com/0xfe/cryptopals](https://github.com/0xfe/cryptopals).

<comment> loup-vaillant Cryptopals strikes me as a very good way of scaring people from not only inventing, but also _implementing_ their own crypto. It seems it's primary effect is to make people confident enough to repeat the "don't roll your own crypto" mantra to anyone who would listen.

Some people however don't really have a choice. "Just Libsodium" doesn't work on anything smaller than a Raspberry-Pi, or pretty much any embedded system out there. There are alternatives out there (shameless plug: [https://monocypher.org](https://monocypher.org)), but sometimes your only choice is to code and optimise it yourself.

Sometimes, your only reasonable choice is to implement your own crypto. And I can tell from experience, a few weeks of full time learning is enough to not shoot yourself in the foot. The trick is to learn the right things (not everybody can spend a few weeks with Dan Boneh), but if you limit yourself to simple primitives like Chacha20 and Curve25519, it's not that hard. (Fun fact: I did _not_ spend a few weeks with Dan Boneh, and I _did_ shoot myself in the foot once.)

Because let's be honest: you don't need to know all the attacks to protect yourself from them. What you need to know is the relevant _classes_ of attacks, and how to void them. For instance, all timing attacks are stopped if your code runs in constant time (which in practice mostly means without secret-dependent branches and without secret-dependent indices).

<comment><USER2> What's rough about implementing your own crypto is that sometimes you screw it up, as you well know. When you screw up an attack, nobody suffers. Not so for novel implementations of primitives that you provide to others.

<comment><USER3> Looking at Cryptopals in particular it's not ideal that you need to get through dozens of other exercises before you finally email off to the authors and start to run into problems concerning today's fan favourites like Elliptic curve DH.

I'm at home even more than usual now (for obvious reasons) but even then I suspect I will get distracted before I get as far as say, Challenge 42 which is - though still relevant and I get that it makes sense to drum that in - ancient history by today's standards, let alone Set 8.

As a result Cryptopals feels like it recapitulates history from the point where the authors got into the industry and so may unintentionally mislead. I remember your surprise when it turned out Microsoft hadn't done the necessary checks for a curve based signature algorithm and so they'd actually been shipping code that would accept bogus signatures. My instinct is that Cryptopals challenges would be more effective (but might make some people involved less comfortable) if they rearranged some of the 21st century attacks on those "fan favourite" algorithms into earlier sets instead of accumulating them in Set 8.

I dunno maybe this is like complaining that my school maths textbook (first written in the 1940s I swear I'm not that old) assumes you'll use log tables rather than a calculator. But the Cryptopals challenge site clearly doesn't seem to _think_ it's a historic artefact, so it shouldn't act like one.

<comment><USER4> Set 8 questions can be found here: [https://toadstyle.org/cryptopals/](https://toadstyle.org/cryptopals/)

<comment><USER3> Thank you, it's unlikely I'll get that far (yesterday I wanted to do six things, it is now 0240 and I am starting the first one...) but even if I don't end up using it somebody else might.

</comment></comment></comment></comment></comment></comment><comment><USER5> I don't think you need even an undergraduate education in mathematics to get into cryptography; for many people it's the other way around. Cryptography can be a great motivator to learn the underlying math. Concepts that may have seemed too abstract to be useful suddenly become practical tools that help you build something that solves a real problem.

I love my colleagues who have come from cryptography research programs; they are awesome! But the majority of my colleagues working on cryptography in practice come from software and security engineering backgrounds. You might think that is just a dividing line between folks who design and analyze cryptography, and those who implement it, but I don't think so. I've seen folks from both backgrounds be able to work on cryptography design and implementation.

<comment><USER6> IANAC but would the lattice stuff or the other post-quantum stuff require it? "Not having a solid math education" might be a condition with an expiration date if so.

<comment><USER5> I'm saying that working on Cryptography can also be a solid math education. You can start with very basic high-school math; primes and finite fields, extend to algebra, formal logic, information theory, codes, probability, elliptic curves, isogenies, lattices. They can build on one another, but by actually building some things. It's a great way to learn.

</comment></comment></comment><comment><USER7> This seems to boil down to:

> If you can, just get a Ph.D. at a place with a good crypto group (remember > that Ph.D.'s in computer science are effectively free)

Which I'm not sure is great advice except for someone who wants a full time career in cryptography. And if you want a career in cryptography it's fairly obvious that the most well trodden root is via a PhD (which is definitely not free when you compare it to how much you could be earning in industry with a compsci or math degree)

<comment><USER8> Can anyone elaborate on how CS Ph.D.'s are 'free'? Does this apply to UK universities?

I'm aware of scholarships but I'm not from an under-represented background nor am I a genius. I suppose the student loan would cover the costs but I don't consider that free.

<comment><USER3> I've dropped out of a PhD programme in the UK (many years ago) so perhaps I can help.

It is usual for PhD students to have tuition and a small stipend for their living expenses paid for by government. The government knows perfectly well it needs some supply of researchers, the old ones eventually die so you need to train new ones and a PhD course is how you do that.

A particular university Computer Science department might have say, six slots this year for PhD students. It needs not only the money (which you could if you're wealthy just pay for yourself) but also experienced staff willing to supervise these students which may be a more limiting factor. If it has eight capable applicants versus six slots then yes, you might get refused, but it's rare for there to be a huge imbalance between the number of applicants and available slots such that you'd need to be a "genius".

If you have a good (say first or upper second honours) undergraduate degree in the same or closely related area, and you can find a PhD topic and a doctoral supervisor, in Computer Science they can probably make the money happen.

You will not be wealthy (the stipend is small), but you should be too busy to notice and you're hanging out with other students who haven't got any money anyway.

</comment></comment></comment><comment> non-entity > (1) developing mathematical maturity;

This has stopped me from learning so many things at this point it's not even funny.

<comment><USER9> Math maturity is probably unavoidable for some of the topics out there. But there are so many more in CS that don't require a ton of it.

<comment><USER10> Best courses for mathematical maturity besides the standard CS ones? I'm thinking Algebra, or maybe Real Analysis.

<comment><USER9> Yeah both are good. Basically anything that forces you to prove a lot of theorems that look trivial (but are not easy to prove) is good because they build up a system from small theorems. Back in school we use Rudin for Real Analysis and it's a good textbook. But I'd recommend taking a class if you are still in university because Math is a bit tricky for self study IMO. If you already graduated maybe follow some MOOC.

I'd actually recommend Number theory if you want more fun or if you are interested in Cryptography which is related to CS. Elementary Number Theory throws you tons of questions that even a toddler can understand but you might hit bam head on walls for nights to prove them.

<comment><USER10> Thanks, I'm doing a Masters now and I was planning on taking Number Theory and Abstract Algebra next term. I took mathematical cryptography this term and it got me interested in more related math.

<comment><USER9> That's pretty much enough for anyone who wants to have Math Maturity. Good luck!

</comment></comment></comment></comment></comment></comment><comment><USER11> tl;dr:

To learn about some cryptography fundamentals:

* Read Katz & Lindell's Introduction to Modern Cryptography

* If you're missing math background, read Timothy Gowers' blog

* Supplement: Take Jonathan Katz' and Dan Boneh's MOOCS (links in post)

To get to the point where you can "design/analyze crypto protocols" (and maybe know what you're doing):

* Read Oded Goldreich's Foundations of Cryptography (Volumes 1&2)

* Try to have quasi-intelligent conversations with real cryptographers (advice for this in blog post)

* Get a PhD somewhere with a good crypto program

edit: formatting

<comment><USER12> "Applied Cryptography" is the best-written book on this topic that I know of. Author is a brilliant communicator. Esp. the section on cryptographic protocols should be required reading for any computer scientist. It's not overly rigorous or mathematical, and has a lot of informality and humor, so it's a fairly light read. You don't need a lot of mathematical maturity to read it (and reading things like this helps develop mathematical maturity).

Unfortunately, the 2nd edition adds "50% more words, 7 more chapters, and over 1600 new references." I thought the first edition was better in length. It was novel-length, and reads as well as a novel. Going from long-ish novel to short-ish trilogy makes this somewhat less readable. But c'est la vie.

</comment></comment><comment><USER13> well that page is not even on https

<comment><USER14> Glad to see that I'm not the only one triggered by the irony. :p

<comment><USER15> I was really amused by this. Also if you _try_ to visit over HTTPS, it serves up an expired certificate.

</comment></comment></comment><comment><USER16> I can't figure out who wrote this article, and the site doesn't really make it clear if it's one person's blog or not. Anyone know?

Edit: someone else answered already [https://news.ycombinator.com/item?id=23386815](https://news.ycombinator.com/item?id=23386815)

</comment><comment><USER17> Who is this by? There doesn't seem to be an author listed at either the beginning or the end.

<comment> lucas-piske Hi kragen. It was written by one of the Lab's directors. Here is a link to his page: [http://cs.brown.edu/~seny](http://cs.brown.edu/~seny)

<comment><USER17> Thank you!</comment></comment></comment>


Federal officials knowingly allowed distribution of flawed antibody tests - <AUTHOR> https://www.cbsnews.com/news/federal-officials-allowed-flawed-covid-19-antibody-tests-2020-06-25/?ftag=CNM-00-10aab7d&linkId=92064279 <comment><USER2> After over-regulation of PCR tests leading to the flawed CDC test being the only one available during a critical part of the pandemic, the agency decided to swing way way way too hard the other way so they couldn't be accused of holding up tests from reaching the market. This whole fiasco has revealed the importance of modernizing the FDA (they still need documents to be sent by CDs in the mail![1]). And, of proactively creating pandemic response protocols. They're a healthcare agency! This is their job! The failure of the federal government has been so profound. At least it'll make a good case study for what not to do...

[1] [https://www.washingtonpost.com/investigations/2020/04/03/cor...](https://www.washingtonpost.com/investigations/2020/04/03/coronavirus- cdc-test-kits-public-health-labs/?arc404=true)

<comment><USER3> Until only a few years ago, when you were ready to submit your NDA (new drug application — afterballnthe trials were concluded) you literally sent _trucks_ full of paper to the Agency. There were companies that specialized in making that happen properly — you didn't just hire a trucking company; a lot of coordination was required.

I (well, my company but my name was signed on the documents and I did a lot of work) filed one of the very last paper INDs (beginning of the process before you even do Phase I). Honestly it was cheaper and simpler than purchasing one of the special packages needed to do an electronic filing.

</comment></comment><comment><USER3> There was a lot of pressure in March and April to authorize tests despite them not being proven to have any reliability. Much complaint about the "hidebound bureaucracy". Apparently somebody listened to those clowns.

<comment><USER4> This should be a lesson for fast-tracking corona vaccines, but we will probably learn the hard way and turn the US into a nation of anti-vaxxers in the process.

</comment></comment><comment><AUTHOR> I had to edit the headline because the original didn't fit.</comment>