I wrote the SQL query in 5 mins. Why does my engineer say it will take a month? - <AUTHOR> https://wtfismyengineertalkingabout.com/2017/03/11/i-wrote-the-sql-query-in-5-mins-why-does-my-engineer-say-it-will-take-a-month/ <comment><USER2> On the flip side, when something DOESN'T need HA, sub-millisecond query response time, or lynx and IE Edge compatability, people need to know when "good enough" is good enough.

On my ops team, we've gotten some flak for not building robust enough of a request queue for some tasks. But it's been down several hours in the past year. The server almost never needs maintenance. None of the workload is real- time. App restarts are acceptable if memory leaks occur.

If we did everything by the enterprise book, we'd still be 70% of the way to a deployed product, instead of 15 months into its completion.

<comment><USER3> I once had an infrastructure guy who worked in the same company quote me £70K for new hardware to host a single static HTML web page.

£70K of new hardware!

I stuck it on an existing server and nobody noticed though I might have got into trouble with the Change Prevention Board for not using the right form or something...

Edit: He did have a carefully worked out explanation of where the money had to be spent.... which I ignored after hearing "£70K".

<comment><USER4> Tsk, poor choice on your part. You should have started a side consultancy (get a spouse to own it maybe?) and say that you can do it for a mere £40K.

Then dump the static file on S3, and let the interest from the £40K in your bank account pay for it.

<comment><USER5> Okay, that sounds pretty cool. S3 can host static HTML files?

<comment><USER6> Yes, I host my blog that way:

\- Generate static files using Pelican

\- Dump the files to S3

\- Set up Route53 to point a domain at the bucket

\- Set up CloudFront (Amazon's CDN) to sit in front of the S3 bucket, since I found pure S3 to be too slow

Works incredibly well.

<comment><USER7> Why use Amazon for static pages? My github page works just fine.

<comment><USER8> I believe Amazon is more robust if your website gets hit by a lot of traffic.

<comment><USER9> keep in mind S3 bandwidth is roughly 20~30x more expensive than a VPS.

I put my photo/video blog on S3 reasoning that it'll handle spikes better. At one point it reached the front page of HN and cost me $450. Afterward I looked at the logs and found that my single $20 linode would have handled it fine...

<comment><USER4> Definitely depends on your requirements. AWS can indeed charge a bit for bandwidth.

But if you're talking about small static websites, AWS gives you an easy interface, Cloudfront, Route53, etc. It's a very easy way to do some very complex things.

You might also look into billing alarms. I've got some simple background jobs that I run on lambda, pulling some files to S3 every hour. It costs me a buck or two a month. But if it ever looks like it might charge me $20, it will alarm and email me.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> "Maybe you ran your SQL query a few times, fixed the errors you got, eyeballed the results, and called it a day. That's not good enough for code integrated with a product."

Biggest lie ever. That's pretty much a production-quality code here.

<comment><USER11> You ran it more than once? That's battle-hardened, in my book.

</comment></comment><comment><USER12> You definitely need to think through your requirements or you end up with this:

Asked to get some kind of analytics query to someone, and they need it fast and want it in some kind of visualization tool.

1\. You open Zeppelin, take a bunch of database tables and whip out a query that is basically what they want and export it to an Elasticsearch + kibana instance.

Now comes the edge cases:

Oh I forgot, it needs to be on the internet

2\. Need to set up a public IP, DNS, Nginx server and a series of rules to make it read-only (and it's still dangerous mind you)

Why isn't this password protected?

3\. Add a nginx basic-auth with a single password

It needs to be available to admins and sales managers only.

4\. Set up ngx_http_auth_request_module to hit the our authentication server (the cookies should be present - OHH the DNS name doesn't match the cookies. Set up a /subpath on the existing application.

It needs to work as an embedded view in the company's mobile app.

5\. That uses tokens not cookies, so the auth-request module no longer works for this, need to come up with a SSO solution with a cookie and a place to store the cookie in a database. That requires a REST service on the existing app server, which will require a redeploy.

I just added a product to our system and it's not in Kibana

6\. Need to modify the spark code to use spark streaming

The Spark server restarted and my new products aren't showing up!

7\. Need to set up a service on the system to auto-start the spark job.

It is feasibly an actual product feature at this point, but (1) was asked for, but they really wanted 1 - 7. I would argue that (1) would only take 25% the time 2-7 takes to do. Not every product change is like that, obviously, but sometimes people think all changes are just so simple. Often it's the history and unstated features that make a huge difference.

Also this for fun: [http://outofmymind.scanlen.com/wp- content/uploads/2011/04/Wh...](http://outofmymind.scanlen.com/wp- content/uploads/2011/04/What-the-Customer-Wanted.jpg)

</comment><comment><USER13> > Nothing ever works as soon as an engineer writes code; it is an iterative > process.

One of my complaints about working in an environment where I am the only person who can program is that nobody else understands this. I've taken the time to explain this point to people, and they seem to grasp it fairly well, but once they see something that somewhat resembles the final product they get really impatient.

The last 25% of functionality takes far more time than the first 75%, especially once you consider handling edge cases, etc.

<comment><USER14> Pro tip: Do the user interface last. Or, if you need to do it first for prototyping / mockup reasons, _don 't show it to anyone you don't have to_.

Learned that one in my first ever project. We mocked up the entire application in Visual Basic (just windows and buttons, no actual functionality implemented, we just wanted to know if it'd work for them) and then the client got really upset when we couldn't come round and install it the next day. Classic case of failing to manage expectations.

<comment><USER15> That one's hard, however, since it's frequently the case that the user interface is what makes it real to people and leads to plan revisions once they realize that e.g. the cool visualization they asked for doesn't work with 100k data-points.

I haven't found a way around this other than careful communication, which works with most but not all clients.

<comment><USER16> Perhaps doing the user interface in a mockup way. I mean, really like it was draw on paper and not a software-looking software.

Like this: [https://media.balsamiq.com/img/examples/wiki- sketch.png](https://media.balsamiq.com/img/examples/wiki-sketch.png)

</comment></comment></comment></comment><comment><USER17> Because your "5 minutes" is pure bullshit and your engineer knows it.

Your engineer knows that if she writes your "5 minute" query without careful analysis, peer review and documentation and the query ever produces a questionable result --- whether it was anticipated by your requirements or not --- it's your engineers ass; you'll throw your engineer under the bus _instantly_.

Your engineer knows that if she writes your "5 minute" query and it produces any actual value you'll be back the next day with a "5 minute" enhancement. Anything you ask for that might matter the next day has to be built to be maintained by others because if she happens to take the day off when you show up and demand a revision to your "5 minute" wonder query and there is nothing for the other engineers to go on (revision controlled work, documentation, etc.) then that's her ass; she knows you won't stand up for her.

Your engineer didn't just fall out of the boat and is in no hurry to obligate herself to take responsibility for your adhoc miracle queries and the questions that will emerge when you go waving the output under everyone's nose, and she knows that's exactly what you'll do with it. Your little query is _your_ view of the world and that view is _highly unlikely_ to survive the first bit of scrutiny that's applied by anyone other than yourself, much less the second.

<comment><USER18> I had a veteran DBA close to retirement (she was my cube-mate) warn me about this when I was an intern. I had a very simple request come in to update some data. Didn't even take 5 minutes. She told me: never do the simple tasks immediately. Sit on them for a bit. Business users don't understand complexity of different tasks and think they should all take the same amount of effort. So, if you do one thing in just a few minutes, they'll expect everything to take the same amount of time. In my experience, it's proved to be true.

<comment><USER19> I heard a story from an ex-wall-street engineer who related he was once asked to fix a message passing system so that it could now pass something like 10 x as many messages per second that before. He rewrote it and it now passed 1000 x messages / sec. He _almost_ turned it in that way and then realized he was undercutting his future self. So he backed off the improvements to the required 10 x. Sure enough he got a big bonus and kudos for his work and a year later he was asked if he could pull another miracle out of his hat. Indeed he could. He sat on it for weeks, updated one line of code and then got another big bonus. LOL.

<comment><USER20> Haha, that reminds me of the speed-up loop: [https://thedailywtf.com/articles/The-Speedup- Loop](https://thedailywtf.com/articles/The-Speedup-Loop)

</comment></comment></comment></comment><comment><USER21> Had a similar thing a while ago. Very complicated IPSEC tunnels, routers switches firewalls and whatnot between us and our customer. Customers techs were - not great - so needed to make sure port 443 worked through the tunnel. Our side mainly Linux, theirs was mainly Windows 10.

Asked a programmer our side (.net) who said it'd take a couple of hours to write a simple webserver, package it up into an .msi and give it us. I got annoyed, did it in Golang in about 10 lines of code.

I then realised i'd compiled a Linux executable on Linux, remembered it did cross-compiling, 10 seconds later I had a Windows .exe. All for a simple webserver that printed "cock", not useful but it proved the tunnels worked.

Sometimes we overcomplicate the simplest shit.

EDIT: As it wasn't clear (my fault) - we were trying to get to port 443 at their end - they were on Windows, we mainly Linux but the guys I asked were .net programmers..

<comment><USER22> _> Sometimes we overcomplicate the simplest shit._

Indeed. Why not use nc and telnet on port 443 to test? Linux already has nc and Windows already has telnet.

<comment><USER21> The endpoint at their end was Windows. No nc. Apologies if that wasn't clear. I was testing our end reaching their endpoint at port 443.

<comment><USER23> nc is the client, if you could host a webserver surely you could have run nc...

<comment><USER22> Actually I misunderstood and thought the server was Linux.

You could of course use nc as the client too, but it would be an additional install on Windows. [0]

And nc wouldn't help if the firewall was stateful and actually expected to see HTTPS traffic on port 443, so I do see their logic of putting an actual webserver there.

But without sufficient detail, it does seem at first glance to be overkill ;-)

[0] [https://joncraton.org/blog/46/netcat-for- windows/](https://joncraton.org/blog/46/netcat-for-windows/)

</comment></comment></comment></comment></comment><comment><USER24> Unless I catch myself breaking my own rule, I never second guess my developer's time estimate unless I think it's too short. I've been a developer (still am one even though I manage people now too), and I've learned that I can't factor in all the things going through that person's mind.

I have cleaned up too many messes because of negligence from people who do not understand how hard programming actually is. That's what most people, especially us developers at times, fail to recognize. That 5 minutes someone took to write an "easy" query against the CI and deployment server almost brought it down (true story, luckily I was monitoring it look at another issue).

The ability to write code is taken for granted, because anyone can learn it. Some programming is easy, and some is extremely difficult and the real trick is knowing which. What scares me most about the code being written are the one off queries, etc. The ones that will "only be used once" or "only for low transaction instances". That's never true, someone will always have it laying around for that time when "we just really needed to make that update".

An old boss of mine used to say "the perfect is the enemy of the good." This is true, there are a number of times you need get something up and running and worry about fixing it along the way. There are other times when that "good little app" got used in the wrong way and cost us hours of downtime because of a mistake due to rushing. Now the perfect solution doesn't look like it was such a bad choice after all. I can wait a day or so for a query that I could write in 5 minutes. In the long term, waiting a few extra hours isn't going to impact anything that much. I'd rather the developer be through then explain why no one went home that night because we had to clean up a mess.

</comment><comment><USER25> This is a little off-topic, but I'm not entirely sure I understand who this article was written for. It reads as a bit condescending to people who might benefit from it (namely the hypothetical MBA who wrote the query), and most of this is what engineers already know about.

</comment><comment><USER26> Great Post! Most people understimate the depth of simple-looking tasks: it's not just managers that make this mistake. Even experienced engineers can end up not realizing all the complexity in the beginning.

</comment><comment><USER27> Nice. I wrote something similar [1] after noticing that it's easy for developers to make this mistake too (especially more junior developers) -- once your proof of concept works, you still are far from shipping.

[1] [http://philfreo.com/blog/the-last-20-before- shipping/](http://philfreo.com/blog/the-last-20-before-shipping/)

</comment><comment><USER28> seems to be apples and oranges. Ad hoc query vs. a modification/new feature of a product. Depending on the product and dev process around it, it may take a month even for the minor among minor modifications/features.

>Why does my engineer say it will take a month?

if you don't know the answer to that, you're a bad manager. Either you hired bad engineers or you have no idea how your dev process works.

</comment><comment><USER29> Adam, great to see you on HN. I assume you're the same ABS that founded calc.org. I always love seeing people from the TI Calculator community doing well.

\- Harper

</comment><comment><USER30> This is a popular anti-pattern with a name - Yak Shaving: [https://medium.com/@firehoseproject/a-guide-to-yak- shaving-y...](https://medium.com/@firehoseproject/a-guide-to-yak-shaving-your- code-d30f98dc759)

<comment><USER31> That's not yak shaving. Yak shaving is trying to fix issue A and running into issue B. So you try to fix issue B and run into issue C, etc.

This post is about engineering a future-proof solution rather than fixing bugs.

</comment></comment><comment><USER32> Because he's using Hadoop :P

</comment><comment><USER33> SELECT * FROM ObviousTable?

</comment><comment><USER34> Ugh that domain. "my" engineer? Fuck off.

<comment><USER35> "my" parents?

"my" employer?

"my" spouse?

"my" country?

</comment></comment><comment><USER36> If I was a CEO, and wanted to create a way for me to analyze data and I don't know much about efficiencies of SQL for ad-hoc analysis If instead I did have an issue where I did create this issue while doing my ad-hoc analysis I would try to search for solutions that would solve the problem. If this occurs then you probably want a data lake or even a local version/snapshot of production if possible.</comment>


Fortnight.io – unique task planner built with Meteor - <AUTHOR> http://fortnight.io

<comment><USER2> Oh, come on. No https. No way to change your credentials (email/password) later. No way to delete your account. Weeks start on Sunday, only English time format. Haven't tested further.

</comment><comment><USER3> I can't see it on your website so I must ask : is it free ?

</comment><comment><USER4> Can't manage to signup... is there a bug ?</comment>


Peoplegogo – community is strong - <AUTHOR> https://www.peoplegogo.com/ <comment><AUTHOR> Peoplegogo is an online platform for social engagement. If Kickstarter is a crowd-funding platform where you can create a project and collect money from other people, Peoplegogo is exactly the same but instead of money you can attract people and their skills.

You can create anything...community projects, tech project, events, etc. It is up to the people to decide what they can do.</comment>


Show HN: – Unlimited digital services for a fixed monthly fee - <AUTHOR> https://useultimate.com <comment><AUTHOR> Hi HN,

After working as a consultant for some time, I've realised that hourly/daily billing is a real barrier for many clients.

To provide a solution to this, I'm launching a new service called Ultimate that offers unlimited digital outsourcing tasks for a flat monthly price.

[https://useultimate.com](https://useultimate.com)

Pay a fixed monthly price and get your work in 1-3 business days. No hourly billing. No contracts. 14-day money back guarantee.

Our full scope of services can be found here: [https://useultimate.com/scope- of-services](https://useultimate.com/scope-of-services)

Here to answer questions if you have any, or feedback would be great!

Rob</comment>


Scant Evidence of Power Laws Found in Real-World Networks - <AUTHOR> https://www.quantamagazine.org/scant-evidence-of-power-laws-found-in-real-world-networks-20180215/ <comment><USER2> In grad school scale-free networks were the soup du jour and my advisor was hammering on me to show that the human metabolic networks I studied had that property. "Guaranteed paper in Nature, get on it!", he exhorted. I sensed folks were not using the right statistical tests to show that distributions were scale-free (hint, doing a log-log-plot and doing linear regression to get a slope does _not_ give you the base of the power law if there is no power law in the first place) and found a few notes on homepages that this was the case, but no publications (this was 2006 or so).

There seems to be an attitude in the physical sciences that math is there as sort of a glaze or condiment you can throw on top of bad data to make it palatable. I didn't make many friends in the biology department by telling them their pet model they'd based their careers off of wasn't only bolstered by $trendy_math_analysis but actually weakened by it. People seemed less interested in truth and more interested in appearance and publication prestige.

<comment><USER3> Speaking as a statistically-impaired person, how do you determine if you have a power law?

<comment><USER4> MLE, then vuong's test against alternatives. The linked paper is just vuong's test against alternatives.

<comment><USER5> Might want to try that again...

</comment></comment></comment></comment><comment><USER6> Always a good time to re-read Cosma Shalizi's classic "So You Think You Have a Power Law — Well Isn't That Special?" ([http://bactra.org/weblog/491.html](http://bactra.org/weblog/491.html))

<comment><USER7> > that I have long had a thing about just how unsound many of the claims for > the presence of power law distributions in real data are, especially those > made by theoretical physicists, who, with some honorable exceptions, learn > nothing about data analysis. (I certainly didn't.)

Statistics really needs to be a fundamental skill taught in all sciences (or any field involved in research/studies) as 101 courses as math and writing are.

It's amazing how much time/energy is wasted in research, across a wide swath of fields, because the ultimate analysis lack a strong fundamental grasp of statistics and data analysis.

I want to pull my hair out every time I read a Wikipedia article documenting the historical back/forth of a particular social science... where the status quo of knowledge is repeatedly discredited based on a biased manipulation or simply a poor grasp of analyzing complex multi-faceted data.

<comment><USER8> I completely agree. You can be a genius in your field, but mess things up when it comes to basic statistics. it can be surprisingly easy to make major errors. analyzing your own data is a fundamental skill that not only affects how you present your own research, but how you learn from and perform your research.

</comment></comment></comment><comment><USER9> I love when facts contradict socially propagated truth, and we actually change our minds as a consequence. That update mechanism is one of the biggest sources of faith in humanity I can think of.

<comment><USER10> Any time I hear a very socially useful truth proposed, I get very wary. History is littered with ideas that were proclaimed to be true mostly only because it would be very useful if it were true. It's certainly no guarantee of illegitimacy, but if an idea comes along that basically says "hey, you know how your society likes to do X? Turns out that's the best!" I immediately enter high-skepticism mode. Everything from leaded gasoline to eugenics to the Industrial Revolutions views on the dangers of masturbation can be laid at the feet of people who so desperately wanted something to be true that they skimped on rigor and ended up leaving unimaginable suffering in their wake. When the doctor (I can never recall his name!) suggested other doctors wash their hands between performing autopsies and delivering babies, he was insulted and rejected, as the idea that doctors who wanted desperately to help their patients were responsible for the astronomically high rate of death of both mothers and infants was offensive. This is the opposite side of that coin.

<comment><USER11> That's effectively Appeal to Consequences fallacy, though in both its usual (false rejection of an inconvenient truth) and inverse (false support of an appealing falsehood) forms.

That's a useful counter-bias to have, though not an infallible one.

</comment></comment></comment><comment><USER10> This would be tremendously comforting. After reading the book 'Linked', I have been worried. It presents a possibility that I hope no one is immoral enough to pursue. If it's claims of how social networks cluster, and how both important and fragile the most critical edges in those networks are in terms of enabling the society-wide spread of information/viewpoints/etc are all true.... it opens a very dangerous door.

In the book, they claim that something like 'Six Degrees of Kevin Bacon' works not because of those heavily-connected nodes, but primarily because of nodes which bridge mostly-disconnected clusters. So like a member of a biker gang who plays bridge with his elderly aunts knitting circle on Sundays would be an example of that. Ideas can flow from the group of bikers to the group of elderly knitters pretty much only through him. And almost by necessity, those links are weak. Once broken, for information to travel from one of those groups to the other immediately becomes extremely difficult.

So conjecture that there were an organization that had the ability to observe the social network of peoples communications. Conjecture that they also felt that they had a mandate to protect the status quo, at least on the largest scale, and to do what was within their power to prevent things like widespread social unrest, formation of disruptive political movements, etc. If they had the ability to interfere with those communication networks even in a very mild way, they could affect the most successful and quiet oppression in history. By bouncing a few emails, dropping a few packets here and there, communication between these weak links would break down pretty easily. And once mostly- connected clusters only talk amongst themselves primarily, it becomes fundamentally impossible for widespread social change to occur.

Now this is a very 'blind' approach, of course. You don't get to pick which ideas get isolated and which are permitted to spread. But, you do gain a guarantee that even if an idea is very powerful, it can never spread far enough fast enough to gain widespread acceptance. Sure there might be "large groups" that get very loud about it... but they wouldn't have an 'inside man' to introduce the idea in ways acceptable to the mostly-disconnected group, so it simply wouldn't spread. I've been wondering for several years now if this kind of manipulation would leave telltale fingerprints.

</comment><comment><USER12> This is not new, at least for biological networks. For example, see this paper by Lima-Mendez and van Helden: The powerful law of the power law and other myths in network biology: [http://pubs.rsc.org/en/Content/ArticleLanding/2009/MB/b90868...](http://pubs.rsc.org/en/Content/ArticleLanding/2009/MB/b908681a#!divAbstract) and several blog posts by Lior Pachter: [https://liorpachter.wordpress.com/2014/02/10/the-network- non...](https://liorpachter.wordpress.com/2014/02/10/the-network-nonsense-of- albert-laszlo-barabasi/)

</comment><comment><USER13> For someone unfamiliar with power laws and scale in networks, that introduction has me totally bamboozled with multiple repeating negatives.

A scale-free network is one that follows power laws, which manifests as having specific hubs that are much more interconnected than others.

A random network does not follow power laws. Hubs and edges are distributed relatively evenly.

Is that right?

<comment><USER14> Scale-free: distribution of connections follows power law across hubs. Other type: it doesnt

<comment><USER15> But "it doesn't" can include things that are both distrubuted with fatter or thinner tails?

And if it is normally distrubuted below some range, and then power law above that it also wouldn't be scale free under this paper?

<comment><USER16> For the first question, yes. "Not power law" means anything else.

But I am quite confused on what you mean with power laws "above" or "below" some range.

<comment><USER15> It seems that the reason power laws are important is the frequency of arbitrarily large values, and the implications those have on data processing.

Under a definition that strict it doesn't sound useful: imagine the most common degree / # of connections is 10 and 5 is less popular: isn't that already not a power law? Regardless of how the distribution behaves for degree 100, 1000, etc.

It seems like under many models you have some unimportant distribution of low- degree connections and then close to a power law distribution if you consider above some threshold: in terms of algorithm selection and design under those conditions the dominating factor seems like it can typically still be just the frequency of large degrees which can still be close to a power law and rejected as one by this paper, right?

<comment><USER14> Yeah , I sort of agree that practically power laws are pretty useful, even if they are approximators. I think the paper is trying to say though, the same people (including myself) who use power law to generate these models often say that these processes are actually power law processes. When in fact they may not be. Which is surprising to me (Zipfs law and all of that)

</comment></comment></comment></comment></comment></comment><comment><USER17> I think Metcalfe's law is a bit overstated. Logic seems to suggest it starts out close to exponential but eventually becomes more like log n. Because each participant only has X amount of friends, that they derive benefit from.

For network of one-to-many broadcasts it may be more like n * k where k is the number of active broadcasters.

<comment><USER11> See Odlyzko-Tilly, "A Refutation of Metcalfe's Law".

[https://www.dtc.umn.edu/~odlyzko/doc/metcalfe.pdf](https://www.dtc.umn.edu/~odlyzko/doc/metcalfe.pdf)

</comment></comment><comment><USER18> A classic from Lior Pachter (not mentioned in the article) from 2014: [https://liorpachter.wordpress.com/2014/02/10/the-network- non...](https://liorpachter.wordpress.com/2014/02/10/the-network-nonsense-of- albert-laszlo-barabasi/)

</comment><comment><USER19> What are the implications here for internet service providers and the big social networking companies?

<comment><USER20> For social networking companies, I believe that it means targeting influencers to take advantage of their networks' coverage is much less powerful than first thought. An advertiser won't expect to be able to steer dollars towards just a few of the truly deeply connected influencers and gain outsized rewards; instead, they'll have to target lots of influencers, reducing the ROI of the project.

<comment><USER21> Even more than that, the structure of these networks imply that targeting influencers may be ineffective. There's an interview [0] with Duncan Watts discussing this.

[0] Is the Tipping Point Toast? [https://www.fastcompany.com/641124/tipping- point-toast](https://www.fastcompany.com/641124/tipping-point-toast)

</comment></comment></comment><comment><USER14> Now, why do so many systems seem to follow log-normal??

</comment><comment><AUTHOR> A central claim in modern network science is that real-world networks are typically "scale free," meaning that the fraction of nodes with degree k follows a power law, decaying like k−α, often with 2<α<3\. However, empirical evidence for this belief derives from a relatively small number of real-world networks. We test the universality of scale-free structure by applying state- of-the-art statistical tools to a large corpus of nearly 1000 network data sets drawn from social, biological, technological, and informational sources. We fit the power-law model to each degree distribution, test its statistical plausibility, and compare it via a likelihood ratio test to alternative, non- scale-free models, e.g., the log-normal. Across domains, we find that scale- free networks are rare, with only 4% exhibiting the strongest-possible evidence of scale-free structure and 52% exhibiting the weakest-possible evidence. Furthermore, evidence of scale-free structure is not uniformly distributed across sources: social networks are at best weakly scale free, while a handful of technological and biological networks can be called strongly scale free. These results undermine the universality of scale-free networks and reveal that real-world networks exhibit a rich structural diversity that will likely require new ideas and mechanisms to explain.

Paper referred: [https://arxiv.org/abs/1801.03400](https://arxiv.org/abs/1801.03400)

<comment><USER17> It reminds me a bit of how Romans used to build their ships by exactly scaling up everything.

However, it is now known that, for larger ships, the proportions should be different.

<comment><USER22> I've always been a fan of Haldane's treatment of the matter: [http://irl.cs.ucla.edu/papers/right- size.html](http://irl.cs.ucla.edu/papers/right-size.html)

</comment></comment></comment><comment><USER23> "Power laws" are the golden ratio of network science.</comment>


Lock-free Sequence Locks - <AUTHOR> http://pvk.ca/Blog/2015/01/13/lock-free-mutual-exclusion/ <comment><USER2> The cooperative technique is useful for achieving lock freedom. This technique can be leveraged to build Software transactional memory: [http://link.springer.com/article/10.1007/s004460050028](http://link.springer.com/article/10.1007/s004460050028)</comment>


How a programmer reads your resume (comic) - <AUTHOR> http://stevehanov.ca/blog/index.php?id=56 <comment><USER2> "visibility: hidden" very nice.</comment>


Do you understand what cheating in CS class means? - <AUTHOR> http://blog.acthompson.net/2017/05/news-flash-school-and-industry-are-not.html <comment> wu-ikkyu From my experience, the legacy rules of the classroom are a major barrier to learning to use computers. I became a better programmer in 2 months at work than I had in 2 years of university because I was simply given a computer, a team which supported me, and unfettered access to the internet whenever I encountered a problem.

The main problem with the legacy rules of the classroom is that they put far too much focus on the "unplugged" (meaning limited to no internet access allowed), siloed individual.

This is exemplified by paper-based programming exams and a general hostility towards team-based collaboration -- which the author stereotypically oversimplifies and dismisses as merely "copying and pasting".

The legacy classroom model is one-to-many, computers are many-to-many.</comment>


The last things that will make us uniquely human - <AUTHOR> http://www.bbc.com/future/story/20170309-the-last-things-that-will-make-us-uniquely-human <comment><USER2> > So far, machines have a pretty hard time emulating these qualities: the > crazy leaps of faith, arbitrary enough to not be predicted by a bot, and yet > more than simple randomness. Their struggle is our opportunity.

Rationality makes us human instead of animals. Our imprevisibility (are we?) is make us different from AI (yes, yes, a long road yet).</comment>


The Rainbow Network: An Off-Chain Decentralized Synthetics Exchange [pdf] - <AUTHOR> https://rainbownet.work/RainbowNetwork.pdf <comment><USER2> This "synthetic" balance does closely remind me of "uninsured" balance I proposed for XLN (Lightning, extended with credit lines to solve capacity problem) [https://github.com/fairlayer/wiki/blob/master/04_four_balanc...](https://github.com/fairlayer/wiki/blob/master/04_four_balances.md)

The difference is synthetic balance is offered to be enforced from the collateral from the escrow. In XLN I proposed to try to enforce it by taking it from the other party's onchain balance.

Both options would work together even better ("synergy" haha)! From the first example:

1\. blockchain dispute resolution code tries to take USDC from Alice's onchain balance (since Alice owes 750 to Bob).

2\. if Alice still owes something, try to convert any other Alice's onchain balance into USDC using oracles, then return to Bob.

PS. will finish reading the paper sometime soon, so not sure if got it wrong.

Overall, happy to see new solutions coming to payment channels that _do not_ imply full collateralization (via cross-asset synthetic collateralization as in here). Full prepaid collateral is stupid and limiting the growth.

</comment><comment><USER3> Sounds cool. At the end of the day, someone will probably built it and deploy it and we'll get to see it succeed or fail. Very interesting time to be alive. A lot of good science going on. I think we will look back at this time as a fairly golden age in whatever we eventually call this (decentralized finance, or is that just one angle?). This will be the case regardless of what succeeds or fails. Really an industry you can make advances in.

<comment><USER4> Upvoted because I'm pretty sure this comment was written by a neural net and I'm hoping for a reply.

<comment><USER5> A neural network trained on HN comments would probably give a scathing critique of a tangentially related project.

</comment></comment></comment><comment><USER6> > 3.8 Risk of undercollateralization

> In Example C, if the price of ETH falls by 50%, Alice's balance in the > channel is effectively worth nothing. If the price of ETH falls further than > that,the channel would become undercollateralized—Bob would no longer be > able to withdraw his USD at its current value.

This can and will happen in the real world, and seeing how the "crypto-sphere" is teeming with scammers running pump-and-dumps, and exchanges manipulating prices, it's pretty much guaranteed.

<comment><USER3> Let's restrict the discussion to the top 10 cryptoassets. All of those would be pretty hard to manipulate in to a price decrease of 50% considering how much money you'd have to spend. So it seems like this concern is really only a function of how volatile or risky the asset is. And as for price manipulation, any exchange doing that is not going to be a top-10 exchange either.

<comment><USER6> There's some strong research to support Tether being used to manipulate Bitcoin's value, and Tether's site was recently updated to clarify that it is in fact _not_ backed 100% by USD.

Both of these are top 10 crypto assets...

Not to mention MtGox manipulated prices during the 2013 bullrun.

You're trying to paint this as some sort of hypothetical scenario when this has already happened! And will happen again if this "rainbow network" gains any significant traction.

</comment></comment></comment><comment><USER7> tldr; does this add a breakthrough or is it just a variation of a consensus + payment channels solution?</comment>


More Efficient TLB shootdowns - <AUTHOR> http://zinascii.com/2015/illumos-5498.html

<comment><USER2> Given the cost of TLB shootdowns, the API's should really be asynchronous. You don't always need all cores to see the same view of the page tables at the same time: [https://www.usenix.org/legacy/events/vee05/full_papers/p46-c...](https://www.usenix.org/legacy/events/vee05/full_papers/p46-click.pdf).

</comment><comment><USER3> Efficient bulk TLB manipulation is also part of the secret sauce behind Azul's pauseless GC. AIUI they have a custom kernel module to provide more efficient virtual memory operations than the linux kernel APIs can provide.

<comment><USER4> What about Linux TLB Big Page [1]?

[1]: [https://www.kernel.org/doc/Documentation/vm/hugetlbpage.txt](https://www.kernel.org/doc/Documentation/vm/hugetlbpage.txt)

<comment><USER3> huge pages are useful to reduce TLB overhead too, but it's not the same as batched modifications.

</comment></comment></comment><comment><USER5> TL;DR it pays off to invalidate a range of pages per inter-processor interrupt, rather than one page per interrupt, and dtrace can get the numbers to prove it.

</comment><comment><USER6> What is TLB shootdown? [http://stackoverflow.com/q/3748384/290085](http://stackoverflow.com/q/3748384/290085)</comment>


Djibouti: A Nation High On Drugs (2013) - <AUTHOR> http://www.tesfanews.net/djibouti-a-nation-high-on-drugs/

<comment><USER2> I'm not sure why Khat is scheduled in the US.

I've chewed it before and wouldn't call it a "drug" in the sense cocaine, marijuana, or alcohol are. I might compare it to a very strong caffeine or tobacco without the dizziness. Defiantly didn't seem worth outlawing although maybe it is addictive. I only chewed it once or twice so don't know about the addictive properties.</comment>


Should we submit our startup - feedback please - <AUTHOR>

Please review this website http://www.LimeAll.com. Should we submit this for YC. Regards, LimeAll <comment><USER2> what do you have to lose?! just writing the application is a great experience -- the process helps you think carefully about many of your ideas and how you articulate them.

you better hurry though, just a few hours till the deadline. We started working on ours very early, put it through many revisions and edits and that really helped.</comment>


Represent – A better way to résumé - <AUTHOR> https://represent.io

<comment><USER2> This is cool! I like the simplicity of the design, both the finished resume and the tool for creating it.

Any plans to support listing/describing past projects?

<comment><AUTHOR> Thanks! We've thought about adding the ability to list projects, awards, etc. Possibly coming soon.

</comment></comment><comment><USER3> That's genius. Is there a way I can be grandfathered I for the annual price ?</comment>


Professor William Happer willing to deny effects of pollution for a price - <AUTHOR> http://energydesk.greenpeace.org/2015/12/08/exposed-academics-for-hire/ <comment><AUTHOR> The emails are pretty interesting [https://www.documentcloud.org/documents/2642410-Email- Chain-...](https://www.documentcloud.org/documents/2642410-Email-Chain-Happer- O-Keefe-and-Donors-Trust.html)</comment>


Twitter to Add Photo Filters to Compete With Instagram - <AUTHOR> http://bits.blogs.nytimes.com/2012/11/02/twitter-will-introduce-photo-filters-to-compete-with-instagram/

<comment><USER2> The key reason people use Instagram is not about filters. Which is why Hipstermatic which was far more popular at first let most of their employees go.

There is a level of context around Instagram pictures. The cropped square image that is easy to consume as you scroll, the filter, the way the geolocation data is shown and the way you like and interact with the picture.

The way you interact on Twitter is different to Instagram. When I see someone Instagram a picture I will rarely comment but when I see a post on Instagram I'll interact with most posts. Instagram isn't necessarily especially brilliant but all of this is about context. You don't post the same content on Twitter and Facebook.</comment>


Failing to find a startup name – Is it a sign of failure ahead? - <AUTHOR> I have an idea of an education/career development business, I have done some market research and I am sure it will work. I have a few potential clients and I need to register a business so that I can do business with theme.<p>---The Problem is I am failing to come up with a business name with a good domain extension for weeks now. Is it a red flag that this business is a non starter or how do I proceed? Your help will be highly appreciated. <comment><USER2> Thinking of good names may not need to be a core competency for your business to be successful.

Either pick a "good enough" name on your own, or hire a freelancer whose business is making up names.

If you can't commit to maintaining you current momentum by one of these means, then that's the real warning sign.

</comment><comment><USER3> > I am sure it will work

That is the biggest red flag you can have. There's no such thing as being able to bring a new thing to the market with complete clarity or confidence in any one plan.

</comment><comment><USER4> TechDC Labs</comment>


Gambling with the devil: A/B tests done right - <AUTHOR> http://www.thumbtack.com/engineering/gambling-with-the-devil-ab-tests-done-right/

<comment><USER2> With a title like that I was expecting this to be about multi-armed bandits.</comment>


Record Drop in Foreigners Buying U.S. Homes - <AUTHOR> https://www.wsj.com/articles/record-drop-in-foreigners-buying-u-s-homes-1532632676 <comment><USER2> "foreign-resident buyers and recent immigrants closed on far fewer properties in the 12-month period ending in March 2018—by about 21%"

Ok but the previous year: "Foreign buyers closed on $153 billion worth of U.S. residential properties between April 2016 and March 2017, a 49 percent jump from the period a year earlier" source: [https://www.cnbc.com/amp/2017/07/18/foreigners-snap-up- recor...](https://www.cnbc.com/amp/2017/07/18/foreigners-snap-up-record- number-of-us-homes.html)</comment>


Mozilla CEO: Apple's Safari-to-Windows Distribution Scheme is Wrong - <AUTHOR> http://www.informationweek.com/news/showArticle.jhtml?articleID=206905256

<comment><USER2> I remember hearing Tom Merritt complaining about this on BOL a couple days ago... Apple's been using its updater to sneak in installs for a while; by default, updating a standalone install of Quicktime will automatically install iTunes on your system. While I'm sure that they're not the first to engage in this practice, it is definitely shady, especially for a piece of software like a browser. In the Quicktime / iTunes scenario, you can at least treat it as a program that simply does more than you need it to do, in the same way that nobody ever really used Realplayer as their default media player. But there is absolutely no functionality to be gained here; Safari is not going to allow them to do anything that they previously weren't able to do.</comment>


RAIDCDN provides a demo project for use - <AUTHOR> https://github.com/lorriexingfang/webRTC-CDN-raidcdn-sample <comment><AUTHOR> RAID CDN uses web browser based P2P technology to break free from traditional CDN infrastructures. Check it out for free CDN service for your website's video contents.</comment>


Stanford Finds Computer Science Students Cheat More Than Others - <AUTHOR> http://bits.blogs.nytimes.com/2010/02/11/stanford-finds-computer-science-students-cheat-more-than-others/?ref=technology <comment><USER2> I would hope that the reason why would be fairly obvious to anyone who has taught programming - an awful lot of people just cannot program. They just can't grasp that kind of abstraction, no matter how hard they try. It's just not in their wiring in the same way as a tone deaf person just doesn't hear pitch. There was a long thread of discussion between Imran of Imran on Tech, Joel Spolsky and Jeff Atwood about this phenomenon and it's well worth reading if you weren't follwing it at the time.

<http://www.codinghorror.com/blog/archives/000781.html></comment>


For many young South Koreans, dating is too expensive, or too dangerous - <AUTHOR> https://www.cnn.com/2019/05/11/asia/south-korea-dating-intl/index.html <comment><USER2> ITT: people advocating for forced arranged marriages. Jeez, what the hell?

Not to dig into such petty stuff as human rights which entirely forbid arranged marriages, that would be too easy, but as if that would even solve the problem that is literally described in the article, people having _no time_ to develop meaningful relationships or interpersonal skill because in a cutthroat environment all that matters is more useless "certifications" and working one's ass off in underpaid crap jobs just to survive, much less afford a date?

Fix minimum wages, overtime limits and job supplies, and (young) people will start procreating all on their own!

<comment><USER3> Arranged marriage != forced marrige.

Majority of marriages in south east Asia and India are arranged marriages. There's nothing unethical about it.

<comment><USER2> > There's nothing unethical about it.

In many countries, the husband has a legal right to demand sex from his wife and rape in a marriage is not a crime either - in fact, even "civilized" countries such as Germany had it until recently, it took us Germans until 1998 to finally make marital rape a crime. One of the politicians in favor of keeping it legal actually ended up being our current Interior Minister but ah well, I digress... point is, the line between arranged and outright forced marriage is thin, very thin.

<comment><USER3> But it has nothing to do with arranged marriages. I know Indians in the US who have gotten into an arranged marriage, and obviously the local rules apply. OTOH if marital rape in not a crime in some country, it might as well be committed whether or not it was an arranged marriage.

</comment></comment></comment></comment><comment><USER4> Interesting how illicit filming during intercourse is one of the reasons young people don't want to enter an intimate relationship. There must be quite the horror stories floating around.

</comment><comment><USER5> It is interesting that the majority of these young adults' spare time is spent looking for better jobs and certificate training, with no time to pursue romantic relationships.

</comment><comment><USER6> Dating, crime, housing, education... so much is dependent on a good economic foundation.

JFK was right when he said a rising tide lifts all boats. Every politician everywhere should make this a foundation of their platform.

</comment><comment><USER7> When we keep animals in zoos and they refuse to breed, we consider this proof that their conditions are poor or even unacceptable. When TFRs plummet across the developed world, young people stop having sex, many consider this good because of overpopulation.

It's not good. Our civilization is quickly becoming inhospitable to humans.

<comment><USER8> TFR (total fertility rate) plummets because it _used to be necessary_ that it was way higher when the child mortality rate was higher - and indeed a decreased in fertility rate follows a decrease in child mortality with a few years of delay.

Having a child used to be a random experiment and you _needed to make sure_ that one makes it through to care for you when you will be old or sick. Pensions, health and welfare systems and much better child mortality rates make it _unnecessary_ to have many children. A replacement fertility rate of slightly over 2.0-2.1 is/would be fine in developed countries.

<comment><USER9> But, in South Korea, the replacement fertility rate is already lower than 1, and it keeps decreasing every year.

<comment><USER8> By the way: if someone wants to look up (total) fertility rates, _Our World In Data_ has you covered, of course:

[https://ourworldindata.org/grapher/children-per-woman- un?tab...](https://ourworldindata.org/grapher/children-per-woman- un?tab=chart&time=1950..2015&country=IRN+OWID_WRL+KOR+DEU+GBR+USA)

(You can change the countries displayed by clicking the (+) sign on the right hand side of the graph. I preselected UK, US, Germany, Iran and South Korea here.)

</comment></comment></comment></comment><comment><USER10> They do want to date alright. When you interview a random person on the street they're lying both to the interviewer and themselves.

The problem for men is that the women generally don't think the average man is good enough.

The problem for women is that they're mostly lusting after and eventually, in the long run, sharing the same top 20% men.

If you're a man, it's a winner takes all market. Either almost all women desire you, or not a single one does.

Arranged marriage used to solve this.

<comment><USER11> I see the "women go after 20% of men" line repeated over and over again as if it's some sort of self-evident truth. Aside from the fact that people who spew this line generally go on to justify why women's agency should be reduced ("enforced monogamy" or whatever that means), I have never seen any evidence for this stat. And no, how people behave on dating sites is not an accurate representation of social dynamics at large. It takes a certain kind of personality to go on dating sites and American men and women on Okcupid don't represent all men and women in the world. Dating apps also highly bias the way you engage people with undisclosed algorithms and shady practices aiming at maximizing your time on their apps. They don't have people's best interests at heart and influence them as part of their business model.

But seriously, think about the implications of these numbers: do 8 women just patiently wait in line for 2 men, doing literally nothing in the meantime while the remaining 8 men just stare at their feet or something? Is it something that people think actually happens in real life?

<comment><USER12> I mean, the 80/20 rule is seen in all kinds of places. Probably the top 20% [0] of men are involved in the 80% of heterosexual sexual couplings, with the remaining 80% of men being involved in the other 80%.

Where the stat kind of fails flat is that the same is true of the top 20% of women.

That said, the model (with no statement being made of how much that model reflects reality) being described is sequential monogamy. One of the top 20% men will continuously have one or two partners, switching them out for new ones; the rest of the men will only rarely get a partner; and women will fall between those two. Matching them percentile-to-percentile, the average number of new partners in some timespan for a given percentile for women will be larger for women than for men, up until some crossover percentile X% at which point men will have more partners.

I do think that if a person's primary mode of dating is through online apps, they end up with a skewed mental model of what dating is like. They are, however, already the main mode of new relationships being formed, and perhaps are still increasing in importance.

[0] "Top 20%" being defined as the 20% of men who have the most sexual partners

<comment><USER11> "I mean, the 80/20 rule is seen in all kinds of places"

Sorry, repeating the same point won't make it any more true. Still haven't seen any evidence for this stat, only American stereotypes.

It's hard to track people's sex lives for obvious logistical/ethical reasons, but the most accurate study I've read on that was about teenagers in a high- school in a small rural town, so a closed environment that's easy to control. Forgot the link, will track it down if you're interested. But basically the "sex encounter" graph was fairly evenly spread and evenly balanced between men and women. Sure enough there were "clusters" but they were engaged _with each other_ , not monopolizing 80% of everyone.

As it turns out, if your social circle is made up of sociosexually unrestricted people, everyone involved is going to have lots of sex. If it's made up of restricted people, few people are going to have encounters. But one person or two keeping all women in a sort of "serial monogamous schedule" while they do liteally nothing else? That doesn't make sense and I've never seen it happen, nor have I read any actual scientific study about this.

<comment><USER10> Dating in real life within a small(ish) social circle and modern online dating where the available pool is literally millions of people is completely different

<comment><USER11> Online dating is a tiny, tiny blip in the world of dating. _Dating_ itself is a uniquely American practice and a tiny, tiny blip in the world of sociosexual dynamics. People meet, hook up with and bond with each other in all sorts of creative ways that goes way beyond Tinder, Bumble and Okcupid. If your only outlook on this stuff is through the lens of apps owned by shady companies optimizing for user engagement, you're going to have a skewed and miserable worldview.

<comment><USER10> Online dating is the only dating for many young people nowadays. Alcohol used to be a major factor in finding a partner but young people are drinking less and less by the year.

The social skills of the youth are also getting worse due to smartphones, leading to less interaction in schools at workplaces etc

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> "It's the economy, stupid." \-- Bill Clinton's major campaign slogan.

To reiterate from the article: unemployment is high. Wages are low. Prices are high.

Improve the economic well-being of the median person, and what will happen? People will be more confident in their futures, have more leisure time, and will be happier.

Every school of economics agrees on this. They differ in what they recommend to achieve it.

<comment><USER14> FWIW, the US unemployment rate is quite low at the moment.

[https://fred.stlouisfed.org/series/UNRATE/](https://fred.stlouisfed.org/series/UNRATE/)

<comment><USER13> I don't see your point. Is the article about the US population not dating, or the South Korean population not dating?

<comment><USER14> Sorry, I wasn't paying attention.

For South Korea, unemployment is quite low at 3.8%, but youth unemployment is over 10%:

[https://tradingeconomics.com/south-korea/youth- unemployment-...](https://tradingeconomics.com/south-korea/youth-unemployment- rate)

</comment></comment></comment></comment><comment><USER15> Just a consideration: for many centuries (at least in Germany), arranged marriages were quite a success story, while love marriage are a quite modern invention.

Perhaps if dating is too time-intensive for these people, they should (somewhat) go back to arranged marriages. Also, if one otherwise has to go on many dates, arranged dates/marriages are probably less expensive. Finally, this should also increase the safety aspects that, according to the article, many young people fear.

<comment><USER16> > for many centuries (at least in Germany), arranged marriages were quite a > success story

For men, yes.

<comment><USER17> Why "for men". You think men are happier than women in arranged marriages?!

<comment><USER16> > Why "for men". You think men are happier than women in arranged marriages?!

As long as they have all the money and can have lovers, how is that even a question?

<comment><USER12> Being responsible for making the money is different from having the agency to spend the money. It's fairly common for cultures to grant that role to the woman of the household.

Not sure if that's the case in historic Germanic regions, but it's a crutch to take the principle "women are universally oppressed by men" and believe that's all you need in order to make any statement about gender across all of time and space.

<comment><USER16> > Not sure if that's the case in historic Germanic regions

It wasn't (aside from food and other common needs).

> it's a crutch to take the principle "women are universally oppressed by men"

I did not say that. The OP spoke of centuries where arranged marriages were common in Germany, and there's no doubt that women did not have equal rights during that time. The crutch here is to define "success of marriages" through fertility rates and number of divorces.</comment></comment></comment></comment></comment></comment>


Hyperloop may become reality in Dubai - <AUTHOR> http://www.bbc.com/news/technology-37908915 <comment><USER2> Dubai is a much worse place than California for the Hyperloop for two reasons:

1\. Dubai and Abu Dhabi is only 100 miles. That's not nearly enough to make the Hyperloop economically attractive even if it were to work (which it won't, see point #2). Regular high-speed rail can make this trip in 30 minutes. It's just not worth paying N times as much for some value of N>>1 to shave 18 minutes off of that. 300 miles (like San Francisco to LA) is about the minimum distance for the hyperloop to compete with conventional high speed rail even under ideal circumstances.

2\. Dubai has bigger thermal swings than California, so the thermal expansion problem -- which is still unsolved -- will be that much worse in Dubai.

<comment><USER3> 1\. From a sane point of view, this argument makes sense but the UAE don't have a money problem and prestige/aura of modern technology is weighted much heavier than economical reasoning. It would be a huge attraction and a big reputation boost - they could again argue that UAE is where the future is built, not the USA.

2\. It is hot down there but from what I have experienced, the thermal swings are lower than on a normal Central European or American day. This means in October 35 C during the day, 30 C at night.

<comment><USER2> The hyperloop's thermal problems are not the result of day-to-day swings, they are the result of _overall_ swings. This is because the entire track has to be a single length of welded steel tubing. The thermal expansion at the ends is just _ridiculous_ \-- hundreds of meters. It doesn't matter if this happens over the course of a day or over the course of a year, it's still going to be a show-stopper.

</comment></comment></comment><comment><USER4> > Hyperloop was originally an idea from Tesla's boss and tech entrepreneur > Elon Musk, who conceived the technical details of the transport system but > left it to commercial firms to make the vision a reality.

The BBC needs to get their facts straight. Elon Musk did not conceive the Hyperloop. This concept has been around for much longer. The trademarked name Hyperloop is what's generally known as a vactrain and the idea has been around for at least 100 years. [https://en.m.wikipedia.org/wiki/Vactrain](https://en.m.wikipedia.org/wiki/Vactrain)

</comment><comment><USER5> Well, if there's one place in the world a project is likely to get done despite making no practical or economic sense it's Dubai.

<comment><USER6> I predicted this a few weeks ago on YC.[1] Dubai to Abu Dhabi is 50 miles of flat desert, mostly empty. It's the easy case for the Hyperloop technology.

But I bet it turns out to be maglev in a vacuum tube, not aerodynamic flying.

[1] [https://news.ycombinator.com/item?id=12708576](https://news.ycombinator.com/item?id=12708576)

<comment><USER7> If it's maglev but it's running in a near vacuum rather than a hard vacuum I personally think we could still call it Hyperloop even though it wouldn't be _exactly_ like Elon Musk's proposal. I.e. it's the "near vacuum" part rather than the air caster part that's significant.

Now if someone successfully builds a maglev in a hard vacuum tube, then that would definitely _not_ be a Hyperloop, it would just be a classic vactrain. On the other hand, I don't think Musk would be the least bit disappointed if somebody was able to actually build an operational vactrain.

</comment></comment></comment><comment><USER8> What happens when Hyperloop breaks the sound barrier inside a tunnel? Will it always be slower than the speed of sound? If yes, why don't we invest in MagLev trains instead?

<comment><USER9> Huh, I thought that speed of sound increases when pressure decreases, but it seems to be the opposite.

<comment><USER10> Here's a graph I found. It appears highly non-linear.

[https://sooeet.com/speed/speed-of-sound-in-atmosphere- graph....](https://sooeet.com/speed/speed-of-sound-in-atmosphere-graph.php)

<comment><USER9> Probably because that isn't just v vs. pressure, it probably takes the temperature into account as well.

</comment></comment></comment></comment><comment><USER11> Will I love the technology and would absolutely work for Hyperloop, I would never want them to make deals with the UAE. The abuse of human rights is just to much of an issue over there in these kingdoms.

[https://www.hrw.org/middle-east/n-africa/united-arab- emirate...](https://www.hrw.org/middle-east/n-africa/united-arab-emirates)

"The government arbitrarily detains, and in some cases forcibly disappears, individuals who criticized the authorities, and its security forces face allegations of torturing detainees."

<comment><USER12> They have very good explanation: They are only 10 years old, they don't have 1000s years of laws of europe or china. They are just studying. Isn't USA still electrify innocent people some times?

<comment><USER13> [https://en.wikipedia.org/wiki/And_you_are_lynching_Negroes](https://en.wikipedia.org/wiki/And_you_are_lynching_Negroes)

</comment></comment></comment><comment><USER14> Was Elon Musk really the one first posing this idea?

<comment><USER15> Hyperloop yes, however this is just an evacuated tube which is a very old idea. His idea is closer to an electric aircraft in a tube than a train in a tube.

After all if you are going to use a train just add cars to increase capacity.

<comment><USER16> It's not quite an evacuated tube, which makes it different enough from the old concepts to be interesting. The pressure in the hyperloop tube is very low, but it's not a vacuum. This means that the tube can be relatively leaky, and the air that it does contain is also used to lift the vehicle.

<comment><USER17> It's very very close to vacuum - 0.015 psi (99.85% vacuum). For all practical purposes, calling it vacuum is very reasonable.

<comment><USER16> Being able to have a leaky tube and use the air for lift seem like _practical purposes_ to me.

<comment><USER15> _All_ vacuums are partial. It's not a binary quality, rather vacuums are graded by how close to absolute vacuum they are. Much like 0 kelvin does not exist, but cryogenic systems are making things colder.

<comment><USER16> I'm well aware. The traditional evacuated tube is a pure vacuum _for all practical purposes_ , with any remaining air being undesirable and having no important effects on the machine. Hyperloop _requires_ a certain amount of air in the tube.

<comment><USER15> Early vacuum systems where actually using steam that was then condensed. So, it's not particularly high and only a 'pure' vacuum for relevant purposes.

Don't forget vacuum cleaners are hardly high vacuum systems.

<comment><USER16> Is there a point to this besides pedantry? My actual point is that the Hyperloop is something new, not just a rebranding of previous evacuated tube systems. If you have something to dispute that point, then by all means go ahead, but if you just want to quibble over me being insufficiently specific in my explanations then I'll let it be.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> The tone and sarcasm of this video aside, the guy makes strong arguments that the Hyperloop cannot work technically. Worth watching as he makes good arguments. [https://www.youtube.com/watch?v=RNFesa01llk](https://www.youtube.com/watch?v=RNFesa01llk)

edit: actually it can work technically, but it's not practical at all

<comment><USER19> And here's a playlist of videos debunking Thunderfoot's videos on the subject:

[https://www.youtube.com/playlist?list=PLSPi1JFx4_-Gz0Fm0qq2K...](https://www.youtube.com/playlist?list=PLSPi1JFx4_-Gz0Fm0qq2KUz4c22UbZCco)

</comment></comment><comment><USER20> And I _may_ become rich someday.

Note how elegantly that statement sums up _step 1 & ???????? = magic final result._

</comment><comment><USER21> > Initially, it will explore the feasibility of building a line linking the > two cities.

So now it's one of those "feasibility" projects?

Hyperloop suffers from the same problem as Solar Freakin' Roadways and Artificial Gills, I'm afraid: too much saying, not enough doing. I am instantly suspicious of projects that have lots of hyped up marketing but little to no prototypical substance.

To me, Hyperloop One still seems like a sci-fi pipe dream (pun intended).

<comment><USER22> It's not our money funding this company, I don't see the utility in trying to take them down a notch. If they fail, only their investors lose. If they succeed, we all win.

If it's an HN thread about the latest social media startup, the lament is that SV doesn't innovate enough. If it's about a company tackling something hard, out come accusations of 'vapourware', and predictions of their imminent doom.

<comment><USER23> "If they fail, only their investors lose"

You realize that isn't actually how a capital market based economy works, right? Investors are the "command" part of the economy, responsible for allocating resources. If they decide to only invest in ridiculous, worthless ideas then we all definitely lose. So far that hasn't happened, but never forget that it is very important for us all where investors put their money.

<comment><USER24> Wealth is the only credential required for investing. If some or all of today's investors crash and burn, loads of other wealthy people will find better opportunities with reduced competition from today's foolish investors. (Maybe they aren't investing now because their risk profiles _require_ better opportunities to get the cash out of the mattress.) If one hasn't somehow hitched her wagon to the fools, their poor investments can't hurt one at all.

This "somewhere, someone is losing money!" concern trolling fallacy is one "usefully idiotic" source of our repeated bailout follies, so I'd like never to see it again.

<comment><USER23> The Dot Com and Real Estate crashes(both fueled by very poor investment choices) didn't hurt anyone? Interesting take.

<comment><USER24> The particular crashes you cite didn't hurt me. We're not all in this together when Jaimie Dimon is enjoying his luxuries. Why would we all be in it together when he makes a dumb investment?

<comment><USER25> Because when lots of people collectively make dumb decisions, then the whole macroeconomic picture goes bad and people like you and I, otherwise not involved find ourselves out of work because of general layoffs in a down economy.

One bad decision here or there won't make much of a difference, because it doesn't dent the whole, and it likely doesn't affect anyone directly connected to us. But many bad decisions is a whole other ballgame.

<comment><USER24> At the top of this thread, one could _see_ the goalposts. At that point a "live and let live" attitude toward speculative investing was advocated, appropriately for a site like HN.

Here the argument seems to be that a transportation project in Dubai is somehow the same as Goldman purchasing CDSs from AIG.

<comment><USER25> And I agree with that argument. Where I must respectfully disagree is when you say the previous two major economic upheavals didn't affect you personally, as if implying they shouldn't affect anyone else either, which is silly. You probably didn't mean to imply that, but that's what people are going to read (myself included.)

<comment><USER24> I'm not against helping out "little people" who need help. A cursory examination of the bailouts, however, makes clear that nothing of the sort was ever contemplated. All payments were to giant financial firms. Briefly, certain shameless pundits claimed there would be some sort of "trickle down" effect, but no one really expected it.

When the general welfare is invoked to justify extraordinary action, but the action itself doesn't contribute to that at all, the original argument ceases to convince. _Cui bono?_</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


BooXtream EPub Watermark Remover - <AUTHOR> https://github.com/grayleonard/booxtream-epub-drm-remover <comment><USER2> That's not DRM, but Watermarking.

I don't see any reason why you should object to watermarking. Contrary to DRM it doesn't hurt real costumers at all and only helps finding people that distribute books without compensating the author.

<comment><AUTHOR> Some reasons why watermarks could be objectionable are covered in the accompanying Torrentfreak article (already linked in other comments here):

"'Books should be used as tools for disseminating knowledge and information. What 'social DRM' watermarking systems do instead is turn books into tools of surveillance and oppression by monitoring who shares what knowledge, where,' IBI explain.

"'We don't like this, and because the publisher Verso has refused to remove the watermarks themselves, we decided to do it for them, and to show everyone how these systems work.'

"But there are bigger issues at stake. While people in the West take the freedom to read books of their choosing for granted, not everyone has that luxury.

"'Imagine if a watermarked ebook contains someone's name (as many do). Suppose that someone is reading that watermarked ebook under a regime that bans the particular kind of material covered in that book,' IBI add.

"'If the operatives of the regime see the watermark, they would then be able to arrest and perhaps even execute the purchaser of the ebook if they too are living under the same regime.'

"But matters of life and death aside, IBI say they believe that people should not only be able to read whatever they want, they should also be able to share that knowledge with others."

<comment><USER2> The first one lauds giving other people access to books for free, leading to the author not getting compensated. Not even DRM (which watermarking isn't) prevents you from sharing knowledge for free. Just write something on your own containing that knowledge and put it up for free.

The thing with the regime seems a bit constructed, but even then authors can just decide to publish those few books where this applies without watermarks. If your goal is to reach people living in a regime you would want to translate the text from english into the language of the place anyway (I don't know of english speaking regimes)

</comment></comment></comment><comment><USER3> Any idea how this compares to Apprentice Alf's tools?

<comment><USER4> This is much newer, but I think it will eventually be included.

This tool is an implementation of [https://pastebin.com/raw/E1xgCUmb](https://pastebin.com/raw/E1xgCUmb)

<comment><USER3> Thanks. I found the background article from Torrent Freak useful.

[https://torrentfreak.com/researchers-crack-social-drm- ebook-...](https://torrentfreak.com/researchers-crack-social-drm-ebook- watermarks-160625/)

</comment></comment></comment><comment><USER5> A bit of background context

[https://torrentfreak.com/researchers-crack-social-drm- ebook-...](https://torrentfreak.com/researchers-crack-social-drm-ebook- watermarks-160625/)

</comment><comment><USER6> Would this not qualify as "producing and disseminating technology, devices, or services intended to circumvent" DRM? Because that's a crime under the DMCA. But I'm just askin', you know?

<comment><USER7> > Because that's a crime under the DMCA.

It's a crime in the U.S., it's not a crime in my country. But this guy _has_ listed American University's email address, so I would definitely remove this software if I were him.

In fact, if I were him, I would find someone not from the U.S. to host the repository, make it private, give him the read/write privileges and then occasionally push the changes to a new public repo (so that the .git folder is different and one could not track the changes as they happen).

But that's just me...

<comment><USER8> Or host it on a Tor hidden service!

<comment><USER9> A tor-ified github clone would be interesting. You'd probably see a lot of cool pro-freedom software projects that are illegal in their originating country, like this one.

<comment><USER10> A bunch of version control'd child porn is what I'd be scared of.

<comment><USER11> Yeah, that or at least terrorists!!!!!!1

</comment></comment></comment></comment></comment></comment><comment><USER10> Every day I see submissions here that are cracks, keygens, etc., and they always get flagged and killed.

I'm not familiar with BooXtream, specifically, but I'm curious what it is about this that is different? This is for DRM, sure, but it seems very similar to me.

<comment><USER12> > _submissions here that are cracks, keygens, etc., and they always get > flagged and killed_

Those are almost always spammy. If there's something intellectually interesting about the post, that would be different. (Not saying that's the case here.)

</comment></comment><comment><USER13> I'm interested in a technical sense, but this is not DRM.

</comment><comment><USER12> We s/DRM/Watermark/'d the title since people were complaining about that bit.

<comment><USER14> It should be noted that BooXtream themselves call this watermarking 'social DRM'.</comment></comment>


Show HN: Aidem Network – Launch your product on 150 websites with one click - <AUTHOR> https://www.aidem.network/?ref=hackernews <comment><AUTHOR> Hey everyone!

My Co-founder and I have completed dozens of growth hacking projects like Rumblr (featured by 200+ media outlets in 4 days: [https://goo.gl/Xbp7R2](https://goo.gl/Xbp7R2)) and Hacbook Elite (six figures in sales through press and forum marketing: [https://goo.gl/LFNVc5](https://goo.gl/LFNVc5)).

In our experience, launching is the most annoying, tedious part of building something new. Spending months pouring your heart and soul into a completely new product––only to have it seen by 100 people––is exhausting.

Aidem is a simple tool to get your product in front of thousands of people with a single click.We hand-craft custom pitches for every product, then manually submit them to hundreds of journalists, communities (like Indie Hackers), and directories (like the Startup Button).

Aidem is the tool we've always dreamt of to take care of shitty launch days where we'd imagine spending our time––instead of filling out hundreds of forms and sending hopeless press outreach emails––talking to users, fixing bugs, and getting upvotes.

"What if we could just, like, pay someone to do this for us?"

That's what Aidem's for. It's a completely manual solution: no bots and no spam. Daniel and I write all of the pitches ourselves, then manually send them to our own network of writers and journalists. We don't copy/paste/spam "open databases of reporter emails." That doesn't work.

Our process takes 5 days, submission takes 30 seconds, and it starts at just $49!

We'll be here all day answering questions! We're going to continue refining this system, so we'd appreciate any and all feedback.

P.S. Bonus points if you can figure out where our name comes from.</comment>


Outsourcing Software Projects – Are Polish Developers That Good? - <AUTHOR> https://cshark.com/blog/outsourcing-software-projects-are-polish-developers-really-that-good <comment><USER2> You can't judge whether a developer is good or bad by their nationality.</comment>


Ask HN: Literal domain names - <AUTHOR>

We are in the process of naming our new company, and it's been frustrating. All of the usual tropes apply: names aren't cool until they are associated with success vs. the only people who say names aren't important are people who weren't able to secure a good name.
Of course, .com availability is a huge part of the equation. Luckily, we're not limiting ourselves to available domains; we're frugal but in my mind ten or twenty grand on a domain that helps with brand establishment and potential leverage with investors seems like a defensible expense in the grand scheme of things.
As it happens, we have the opportunity to buy the literal domain for our product category for $15k. For hopefully obvious reasons, I'm dodging mentioning the specific domain here.
My question to all of you is whether having a literal domain name is great, neutral, or negative?
Obviously there's a history of start-ups like pets.com being huge flameouts, but there are also newer companies like diapers.com and soap.com that are doing really well.
Some people love it and other people think it's boring, like we lack creativity. Let's say you're selling eggs, and you have the ability to register eggs.com or omeletto.com - which is the basis of a stronger brand?
I know naming shouldn't consume this many CPU cycles, but it's kind of driving us mental. <comment><USER2> Is your company profitable now? Are you selling your product now? If not, you're just gonna burn an extra $15K out of the gate. I can think of MANY better uses for $15K than on a domain. Can't you?

I am a perfectionist so in theory I love the idea of getting the perfect domain name. In practice, I would urge you to register an original domain name (unless money is no object for you). The perfect domain is nice, but not essential. Do you really need pizza.com (sold $2.6 million in 2008) to sell pizza?

Two final comments:

\- You will have leverage with investors when you're making money.

\- Helpful guidelines for choosing a domain: see [http://davidcummings.org/2010/05/29/the-domain-name- challeng...](http://davidcummings.org/2010/05/29/the-domain-name-challenge/) and [http://davidcummings.org/2010/08/07/more-domain-name- searchi...](http://davidcummings.org/2010/08/07/more-domain-name-searching- tips/)

</comment><comment><USER3> There's a pretty good article by Seth Godin about this...

[http://sethgodin.typepad.com/seths_blog/2005/10/the_new_rule...](http://sethgodin.typepad.com/seths_blog/2005/10/the_new_rules_o.html)

One thing to think about is how specific is it? recipes.com should be about recipes. yumit.com could be about anything that is yummy. "Hey, do you know any good vegan potluck ideas?"..."No, Just Yumit!"

Now, if you pivot and end up building something like a cat finder for eskimos...

"Hurry up, man! It's cold out here looking at all these cats free to a good home! You can just yumit when we get home"

It still works!

</comment><comment><USER4> As it happens, I work for a company that owns a portfolio of a few hundred thousand domain names, many of them single word categories. Some of the names do bring in a ton of traffic on their own, but the stickyness is up to you to create. $15,000 is way too much in my opinion. You could use that to make a much better app to retain the visitors who do find you with a quirky domain name.</comment>


Phoneme- and Word-Based Learning of English Words Presented to the Skin - <AUTHOR> https://research.fb.com/wp-content/uploads/2018/04/a-comparative-study-of-phoneme-and-word-based-learning-of-english-words-presented-to-the-skin.pdf? <comment><USER2> I was reading about a research lab somewhere in Madison that would attach electrodes to the tongue and send electric impulses based on real time cemara feed. The blind's person brain would then adapt and start seeing with the tongue. The general idea was that the eyes are just the gates that transform light into electric impulses so why not use tongue to send the electric impulses. They did achieve pretty amazing results.

<comment><USER3> I vaguely recalled reading something like that before as well, this is where I read it initially: [https://www.scientificamerican.com/article/device-lets- blind...](https://www.scientificamerican.com/article/device-lets-blind-see- with-tongues/)

As a person suffering from a disease which often causes blindness, I am particularly keen on the sensory-replacement science that we are dipping our toes into.

<comment><USER2> Looks like it's not a research anymore but a commercial product. PONS device. [http://heliusmedical.com/index.php/divisions/neurohabilitati...](http://heliusmedical.com/index.php/divisions/neurohabilitation/the- pons-device)

<comment><USER4> This thing has been having trials since at least 2009, yet apparently hasn't gone mainstream yet. More suspiciously, the scope seems to have shifted from "provides a means for people to 'see'" to "helps people reacquire motor control in tenuous and difficult-to-assess ways". Has it actually been shown to do anything or is it just modern snake oil? A quick Google search finds lots of hype but nothing conclusive...

<comment><USER2> Well I read about the lab and neurostimulation in Norman Dodge's book "The brain's way of healing". I checked his website and the message about the device that FDA might approve it in the end of 2018.

Here is the message:

PoNS UPDATE, January, 2018. Information on availability of the PoNS will now be through the manufacturer of the device, Helius Medical Technologies. In brief, some good news is that the final patients in the studies required for FDA approval finished their treatment in May and July 2017. The two studies which are the necessary prerequisites for FDA approval have now been completed, and a final package with the results, is currently being prepared by Helius for FDA submission. But the PoNS can not be made available to the public until FDA approval comes through. The latest guestitimate we have heard is that it could take until the end of 2018 for the FDA to release its decision. This may seem confusing, because the PoNS was available to patients who were in the well-known studies (for instance, the U.S. Military study of its use for treating traumatic brain injury and the Montreal Neurological Institute study for use for Multiple Sclerosis patients). But now that the studies are complete, the PoNS cannot be available to anyone until approved by the FDA. We know this is frustrating for those hoping to get access to a PoNS, and who had hoped it would be available by now, but this pace is not unusual in approval of new cutting-edge devices. Other news is that there is a migration of PoNS development activity to Helius. Because the PoNS studies have been completed, the Tactile Communication and Neurorehabilitation Lab that opened in 1992 and developed the PoNS and many other inventions, has been closed and the three scientists who invented the PoNS, Yuri Danilov, PhD, Kurt Kaczmarek, PhD and Mitch Tyler PhD, are now consulting for Helius on how to refine it. The TCNL lab website still has 50 research papers related to the PoNS posted on it, here.

</comment></comment></comment></comment></comment><comment><USER5> This looks very interesting. I was amused on my first skim-through to see:

"One-hundred common English words were selectedfor the present study (see Table 1; the 8 groups are explained later in Sec. Error! Reference source not found.)"

</comment><comment><USER6> Is this study referring to something other than braille, or is braille inclusive under "English Words Presented to the Skin".

<comment><USER7> AIUI, the ultimate goal of this work is to present spoken, rather than written, words to the skin. The idea is that you can process spoken language into phonemes, and then present those to the skin, although in this study, the phonemes were generated directly.

I assume that the belief is that it's more easier to reliably encode speech to phonemes in real time than it is to encode it to text.</comment></comment>


Breaking the D-Link DIR3060 Firmware Encryption – Recon – Part 1 - <AUTHOR> https://0x434b.dev/breaking-the-d-link-dir3060-firmware-encryption-recon-part-1/ <comment><AUTHOR> For those who are interested and found the article interesting there are additional posts in this series. The second[0] and third[1] posts are quite neat.

[0]: [https://0x434b.dev/breaking-the-d-link-dir3060-firmware- encr...](https://0x434b.dev/breaking-the-d-link-dir3060-firmware-encryption- static-analysis-of-the-decryption-routine-part-2-1/)

[1]: [https://0x434b.dev/breaking-the-d-link-dir3060-firmware- encr...](https://0x434b.dev/breaking-the-d-link-dir3060-firmware-encryption- static-analysis-part-2/)

</comment><comment><USER2> Cool! One question: I wonder why they didn't just use GHIDRA to reverse engineer the MIPS binary? GHIDRA can decompile MIPS and does quite a passable job. IDA is an awesome tool (and still edges out GHIDRA for ARM/x86 if you have the decompiler), but my experience is that GHIDRA is way nicer for pretty much any other architecture. YMMV.

I appreciated the writeup, especially since I've done some firmware decryption and repacking myself (although in my case, the encryption was just repeating- XOR!).

<comment><USER3> Hi, As much as I have to give credit to Ghidra and its capabilities and I just don't like using it. I find the UI/UX very awful. So I decided to just reverse it in IDA. After I was done with everything I double-checked what I had re- constructed from the disassembly with what Ghidra suggested the decompilation may look like. To be honest they were pretty similar. So again, Ghidra is really powerful tool, I just dislike it :)

</comment></comment><comment><USER4> At least a few models of Linksys/Cisco home routers I own had their firmware "encrypted" using GnuPG. They had the extension .gpg.img but could simply be decrypted with:

$ gpg --output decrypted.img --decrypt <model><ver>.gpg.img

binwalk can handle the rest.

It looks like they mainly did this for verification, as there is an RSA public key embedded on the device. It unfortunately does make it nearly impossible to flash any modified firmware such as OpenWRT, which is very frustrating. I say nearly as I haven't fully investigated the models that I own. Some routers have a emergency recovery flash method that may bypass the PGP check, I recall older D-Link models having a web flasher integrated into u-boot.

<comment><USER5> Embedded where? If it is on a writable flash then you can probably rewrite with your own public key?

<comment><USER3> They make use of /etc_ro/public.pem to verify the integrity of a firmware update. So flashing a custom firmware (e.g.: OpenWRT) will fail all checks they put in place. I did not investigate how one could circumvent the update mechanism yet but if you're interested in doing so for these particular models my GitHub repo ([https://github.com/0xricksanchez/dlink- decrypt](https://github.com/0xricksanchez/dlink-decrypt)) has a decryption script for these firmware images so you can snoop around the file system for further clues.

<comment><USER4> I think they were replying to me about the Linksys/Cisco routers, but it is similar in that the public key is contained on the filesystem and prevents flashing any firmware not signed with it. What's worse is they added this after the fact to several models in later firmware versions, making it impossible to downgrade to older unsigned versions.

Unlike with yours, no decryption script is required, gnupg can decrypt them as-is.

</comment></comment></comment></comment><comment><USER6> > the firmware encryption that was put in place to prevent tampering and > static analysis

Code signing is enough to prevent tampering, so D-Link obviously doesn't want their users to know how their own hardware works. Does D-Link view their users as the adversary? If so, should the users view D-Link as hostile?

<comment><USER7> I was initially thinking it was to prevent security research so they don't end up getting fined again for pushing buggy insecure garbage.

I quickly reversed that thinking, knowing DLink's rep for pushing buggy insecure garbage.

</comment></comment><comment><USER3> Hey, I'm the author of this series (see my Twitter "rant": [https://twitter.com/0xricksanchez/status/1290291267914563585](https://twitter.com/0xricksanchez/status/1290291267914563585) or my repo with the re-constructed source code here: [https://github.com/0xricksanchez/dlink- decrypt/blob/master/s...](https://github.com/0xricksanchez/dlink- decrypt/blob/master/src/imgdecrypt.c) )

All your thoughts and feedback are much appreciated :). I'm happy if you guys liked it!

cheers

<comment><USER8> Thank you for doing this.

</comment></comment><comment><USER9> I'm not an expert (so I might be wrong here question-wise), but it seems to me that using the same type of encryption "key" to lock down firmware on various devices sounds like a very ill-advised way to do things.

It seems like it would be possible that once you find the "key" for one router, you could potentially exploit a bunch of other router/switch models as well. Am I incorrect in this thinking?

<comment><USER10> Encryption for firmware updates is only to obscure the contents. The imgdecrypt binary here also references RSA_verify and similarly public-key cryptography sounding names so I assume they are using that to authenticate the firmware images (checking for a D-Link signature).

Of course this is D-Link and the product is an embedded garbage router, so chances are high they are doing it entirely wrong.

<comment><USER3> You're right with your assumptions! If you go to part 3 pretty much to the bottom of the article there's a good summary of what fields are included in their firmware verification headers.

TL;DR: They verify the length of the encrypted and decrypted firmware as well as multiple RSA signatures.

As much as I like pushing security vectors on embedded/IoT devices... This approach of obscuring what is being pushed in an update may not be the right approach imo.

</comment></comment></comment><comment><USER11> I LOVE this kind of stuff!

I was able to finally extract the squashfs file from my routers firmware using dd and program I found on github called "sasquash" which patches decompression tools and can also flip endianness.

<comment><USER3> Thanks! Much appreciated :)</comment></comment>


Ask HN: Why is there so much talk about git but little about mercurial - <AUTHOR>

Is git fundamentally/technically better than mercurial or is it better marketing? Has mercurial failed? <comment><USER2> hg is easier to type than git. That's 33% better at least(with integer percentages, it's event better with float percentages... and even better with fractions).

Imagine typing git 20 times? Well can you see it now? Good.

NOW, imagine typing hg 20 times, that is 60 keys pressed, VS only 40 keys. You'll probably make less errors with 2 keys too.

git didn't bring anything new to version control... with it's 3 key system. svn had 3 letters, cvs even had 3 letters. However hg has brought a 33% improvement to version control -- with it's revolutionary 2 letter system.

Obviously a break through. Obviously fucking cool.

<comment><USER3> You forgot about "git commit" vs. "hg ci".

The real reason is that git has Linus behind it, of course, and the fiasco with BitKeeper attracted a lot of attention. This led to tremendous buzz, and then the Ruby / Rails communities* (among others) started spreading and amplifying it. I see tons of blog posts about how git is _the best thing ever_ , and it's a freaking _version control system_ , you know? It's sort of like if people suddenly got singing-and-dancing-in-the-streets excited over a somewhat better version of make, or something. Think about that.

There are other DVCSs that are also quite good (I like Mercurial, for one), but a pretty good version control system can't compete with a pretty good version control system _with a tidal wave of hype_.

* Also, since the Rails people are themselves working on a popular web development system, they probably had a disproportionately large amount of influence among bloggers in tech circles.

<comment><USER4> _It's sort of like if people suddenly got singing-and-dancing-in-the-streets excited over a somewhat better version of make_

I'd sing and dance for a somewhat better version of make that doesn't end up causing me more problems over time then it solves.

<comment><USER3> I meant people _in general_ , not programmers specifically.

People who wouldn't generally care about something like a VC system are excited about git because Linus is talking it up, I think.

</comment></comment></comment></comment><comment><USER5> Git gets talked about a lot because it's a good tool, and was written by Linus Torvalds - which basically ensures that a _whole lot_ of people will try it out. Since it's pretty damn good at what it does, most of those people kept on using it.

</comment><comment><USER6> Alas neither can support effective work in large repositories: at my day job we have about 100gb repository (just one branch), but most people only use 4Gb at a time. Except the build servers - they get the most of the stuff at once. Perforce lets you create partial enlistment and only get the 4gb you need, while both Git and Hg require pulling entire 100Gb over the network.

There's been very little progress on these issues as well - both communities seem to be content with relatively small repositories. Sad.

<comment><USER7> you may want to take a look at [http://www.kernel.org/pub/software/scm/git/docs/git- submodul...](http://www.kernel.org/pub/software/scm/git/docs/git- submodule.html). mercurial lacks this as of now.

<comment><USER8> Mercurial has extension support, and one of them (used for example on the OpenJDK project - a "real" project of some size) is "Forest", which does just that: <http://www.bitbucket.org/pmezard/hgforest-crew/overview/>

<comment><USER6> there is no documentation at all...

<comment><USER9> Most things can be found on the Mercurial repository:

[http://www.selenic.com/mercurial/wiki/index.cgi/ForestExtens...](http://www.selenic.com/mercurial/wiki/index.cgi/ForestExtension)

Not sure why there are no docs in the hgforest repository though - that seems like a pretty big oversight.

</comment></comment></comment></comment></comment><comment><USER10> Mercurial is widely used...

> Has mercurial failed?

I'm not sure why you equate hype with success. Anyway, Hg is an awesome tool. I love FreeHg too. I use it to manage my .vim/vimfiles, amongst other things.

</comment><comment><USER11> The answer you're looking for is that the cool and/or hip Rails kids decided to back git.

<comment><USER12> I tend to think that this is the case as well. If you look at the GitHub Language Stats (<http://github.com/languages>) you'll see that Ruby takes up 38% of all lines of code on GitHub. JavaScript takes up another 25%.

Python's only at 6% and Java, C++ and C files combined are only 8% of the total LOC.

Git actually is a nice tool and it's getting quite a bit better, but I prefer mercurial, and I think that it's an easier tool for devs used to SVN to make the switch.

A few weeks ago, I threw together a blog post detailing how I use mercurial ([http://naleid.com/blog/2008/11/25/my-mercurial-setup-plus- so...](http://naleid.com/blog/2008/11/25/my-mercurial-setup-plus-some-useful- shims-and-jigs/)).

There's buzz out there about mercurial, it's just hard to hear over the cacaphony being caused by git.

</comment></comment><comment><USER13> I first heard about Git when the guy who wrote most of of stood up and did an empassioned Google Tech Talk about it. I'm loathe to pick it out as marketing, because that invites the idea that any communication is marketing communication. But communication is important, I've never heard a Mercurial dev get up and talk good about their project.

Is git technically better? I have no idea, git works fine for me, someone will have to get up and point out why Hg is so great before I even try it.

<comment><USER14> <http://video.google.com/videoplay?docid=-7724296011317502612>

is a Google Tech Talk by one of the main Mercurial developers.

</comment></comment><comment><USER15> I never used a vcs before but tried git and it was very easy to use and together with github(which really is superawesome) it is truly super.

</comment><comment><USER14> Mostly it is just hype/marketing: technically, it's a wash.

<comment><USER16> Technically git is a wash? What do you mean?

<comment><USER17> The phrase "it's a wash" in this context means that Git and Mercurial are essentially equal.

</comment></comment></comment><comment><USER16> <http://whygitisbetterthanx.com/>

<comment><USER18> It is not true that hg doesn't have something similar like github.

Hg has a better Github which is BitBucket - <http://www.bitbucket.org/> .

At least, BitBucket offers at least one private repo for free accounts.

<comment><USER19> The following is written on the site:

"And no, BitBucket doesn't count just because they ripped off GitHub screen for screen. When they are 30 times bigger and I hear that anyone choose Mercurial over something else because of the community on BitBucket, then I'll reconsider.

Launchpad for Bazaar is closer, but they're still a fraction of the size, nor have I heard of anyone leaning towards Bzr because of the incredible Launchpad community they want to take part in. However, as they are more legitimate, I've removed the 'bzr' flag from this argument."

</comment></comment></comment><comment><USER20> What do you want us to say about it? I use it every day at work and at home, and it's a solid DVCS; I don't talk about grep (or any of my other tools), either, but that doesn't mean grep "failed".

It could be where you hang out. I heard about Git a lot when I was using Rails, because Rails used it. I hear a lot about Github here on HN, because it's a cool web startup. If you go someplace where Hg is used (and there are some big projects) you see a very different picture.

</comment><comment><USER21> I love mercurial. Works on windows/linux too and bitbucket.org is great.

</comment><comment><USER22> When is MercurialHub.com launching?

<comment><USER23> Check out <http://www.bitbucket.org> \- it's awesome.

</comment></comment><comment><USER24> Try both, choose for yourself.</comment>