Hydrophilic disc uses solar power to separate salt from water - <AUTHOR> https://newatlas.com/solar-steam-generator-water-desalination/60726/ <comment><USER2> "This device can produce six to eight liters (1.6 to 2.1 gal) of clean water per square meter (of surface area) per day"

That's really bad from a density standpoint. You're talking ~8,000 gallons per day per acre of land. Solar powered reverse osmosis is something like 1/500th the space.

If the can get installed costs below 1$ per square meter it might be interesting, but even just land costs are likely to be an issue.

<comment><USER3> But what do you do with the salt and brine that is toxic to soil used in the farming? The wind will scatter the salt in all directions.

<comment><USER4> You dump the brine into well-mixed ocean areas.

<comment><USER5> You sell it, salt is required for mammals.

<comment><USER6> Funny how our bodies need water and salt, both are in such abundance but in a problematic way.

Max recommended salt intake is less than 1 teaspoon per day. You need 2 liters of water per day. There's nearly 6 teaspoons of salt in 1 liter of sea water. That's quite a bit of excess salt. Kind of a bummer really. Wish we had a gland that got rid of excess salt then we could just drink sea water.

<comment><USER7> > Wish we had a gland that got rid of excess salt then we could just drink sea > water.

If such a gland existed, it would probably require a lot of energy to work. Plus, what would the gland do with all of the salt it is filtering just send it to your kidneys/bladder? I'm imagining kidney-stones formed from all the excess salt your body is trying to get rid of

<comment><USER8> Halophyte plants use a sacrificial salt leaf. They concentrate excess salt into a specific leaf, then cut it loose when it reaches capacity.

The mammalian equivalent would likely be salt hairs.

<comment><USER9> Wow interesting. Are there any edible such plants? Then their salt leaves could be used as natural seasoning

<comment><USER8> _Salicornia bigelovii_ is an amaranth, sometimes known as "sea beans", "sea asparagus", or "samphire greens". It is edible, and the seeds are an oil crop. It can grow at 200% the mean salinity of ocean water.

It can grow in seawater, brackish water, or effluent from other agriculture or aquaculture. We should be growing more of it.

 _Atriplex_ genus are amaranths called "saltbush"; many are edible directly or usable as livestock forage. _Atriplex hortensis_ is a leaf vegetable, like spinach, often paired with sorrel.

 _Tetragonia tetragonoides_ is "sea spinach" and has been cultivated as a leaf vegetable.

 _Attalea speciosa_ is an oil palm tree.

 _Anemopsis californica_ or "yerba mansa" is used as a medicinal herb.

<comment><USER9> Oh wow, of course! I know _salicorne_ from vacations in France. Totally forgot about it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> One cool thing about this is that it looks inexpensive and simple, as well as functional. If a square meter can generate enough clean water for a person per day, islands of it could support entire cities.

</comment><comment><USER11> Reminds me of dye chromotography, I wonder if you can get different salts to turn up at different places on the edge? Might be able to get useful concentrations of lithium out of it that way.

</comment><comment><USER12> This doesn't make for a good drinking water, this creates distilled water that would drain your body of minerals if you drank it.

You now need to expend energy to gather those minerals from somewhere else and then put them in the water. Is the energy spent gathering those minerals more than other desalination processes?

<comment><USER13> That's an urban legend. We get nutrients and minerals from the food we eat.

<comment><USER14> The first sentence is probably true, the second seems false.

"Results of experiments in human volunteers evaluated by researchers for the WHO report (3) are in agreement with those in animal experiments and suggest the basic mechanism of the effects of water low in TDS (e.g. < 100 mg/L) on water and mineral homeostasis. Low-mineral water markedly: 1.) increased diuresis (almost by 20%, on average), body water volume, and serum sodium concentrations, 2.) decreased serum potassium concentration, and 3.) increased the elimination of sodium, potassium, chloride, calcium and magnesium ions from the body"

</comment></comment></comment><comment><USER15> Do I understand it correctly that this doesn't actually produce liquid water but only somewhat more humid air in the general area above the device? I wonder how much additional effort it takes to actually get the water into a container.

<comment><USER16> To me it looked like moisture was condensing inside the column and maybe collecting in the bottom.

<comment><USER15> Yeah, I saw the condensation in the column, but since that's where the salt water comes in I figured it would be related to that. The article talks about "steam that builds up on the disc", which I understood to mean its upper surface.

The university's press release at [https://www.monash.edu/news/articles/water- solutions-without...](https://www.monash.edu/news/articles/water-solutions- without-a-grain-of-salt) says: "Researchers created a disc using super- hydrophilic filter paper with a layer of carbon nanotubes for light absorption. A cotton thread, with a 1mm diameter, acted as the water transport channel, pumping saline water to the evaporation disc. The saline water is carried up by the cotton thread from the bulk solution to the centre of the evaporation disc. The filter paper traps the pure water and pushes the remaining salt to the edges of the disc."

My best guess at what this means is that _some_ of the water is turned into vapor (not really steam at 100 C, I guess?) and that this evaporation drives the capillary effect that keeps bringing in new water. Some other part of the water, the part that "the filter paper traps", could then drip out into the column. Maybe? Or maybe this prototype is really more about just demonstrating that salt can be collected, and doesn't care about capturing the water.

Here's the original article, paywalled at UKP 42.50: [https://pubs.rsc.org/en/content/articlelanding/2019/ee/c9ee0...](https://pubs.rsc.org/en/content/articlelanding/2019/ee/c9ee00692c/unauth#!divAbstract)

</comment></comment></comment><comment><USER17> Hydrophilic anything in the environment quickly fouls to hydrophobic.

<comment><USER18> Even when supplied via wicking?

</comment></comment><comment><USER19> [https://en.wikipedia.org/wiki/Solar_still](https://en.wikipedia.org/wiki/Solar_still)

is a lower tech solar solution?

<comment><USER20> One cool application of solar stills is when you can't find any liquid water, no matter how salty or dirty, but you can cut up parts of plants and seal them in plastic to collect the moisture from the plants. Obviously not scalable, but it can be a useful survival technique.</comment></comment>


Ask HN: What offline tool do you use for design diagrams - <AUTHOR> Often, I have found a need to draw something to explain what I have in my mind as a high level design for a particular software. I don't really mean in the UML diagram kind of sense, but just boxes, connections between them etc..., some simple ones but at the same time crisp and clean looking ones, which I can present either as images or in slides.
The best thing so far for me has been drawing something on a paper and then taking a picture of it and sharing. It has worked most of the times, but at times trying to put together something that fits within a paper's size and then making any notes in there clearly visible in the image has been difficult.
I have tried a few online tools too. Tools that require you to create the diagram online or tools that require you to have a specific browser plugin for them to work.
Does anyone here use any offline tool which is just a native application and is easy to use for such free from diagrams? I'm on Linux and have tried gimp but I haven't felt productive with it for such uses. <comment><USER2> In the past I've set up Windows in a VM to run Visio. Their default UML glyphs require a ton of fidgeting to put together, but there are some good third- party glyphs that don't require you to program your diagrams.

For online tools I've used Lucidchart most extensively, and I much prefer it to Visio.

</comment><comment><USER3> I've used DOT and then used LibreOffice Impress to overlay text on the resulting image. It's not fast, not fully automated, but after a little practice I find it fast and effective to produce clean, one-off diagrams.

DOT could be used with more annotations than I use, getting the base diagram and then annotating it "by hand" seems fastest.

<comment><USER4> I've used Dot [1] too.

Ditaa [2] is also useful for anyone into Emacs Org-mode.

Racket's Pict language [3] provides functional pictures and it's also an alternative.

[1]: [http://www.graphviz.org/](http://www.graphviz.org/)

[2]: [http://ditaa.sourceforge.net/](http://ditaa.sourceforge.net/)

[3]: [https://docs.racket-lang.org/pict/index.html](https://docs.racket- lang.org/pict/index.html)

</comment></comment><comment><USER5> maybe yed is something for you: [https://www.yworks.com/products/yed](https://www.yworks.com/products/yed)

Inkscape is THE open-source vector editor and probably better suited than GIMP. Also useful to retouch/modify vectors graphics created with other tools, e.g. yed or LibreOffice

<comment><AUTHOR> Thanks, that looks promising. Downloaded and tried it a couple of times, am going to try it out a while longer and see how it goes.</comment></comment>


More Thoughts on Discourse: Let's Give it Some Time - <AUTHOR> http://1fifty9.com/post/42814597429/more-thoughts-on-discourse-lets-give-it-some-time

<comment><AUTHOR> IF this is not the project a newcomer would want to dive into, what is then a good, modern Rails app you can learn from? It appears most popular Ruby repositories on GitHub, for example, are tools rather than full web apps that can be used for learning purposes.

A more specific question would be a reference implementation of client-side MVC with Rails backend.</comment>


Ask HN: Would Firebase/Firestore work with a billion users? - <AUTHOR> <comment><USER2> Probably, but you wouldn't like the cost.</comment>


Spotify should stay as Netflix for music, earth needs a YouTube for podcasts - <AUTHOR> https://twitter.com/milkers/status/1226812529273458688 <comment><AUTHOR> I wonder what do you all hackers think about that?</comment>


The world's worst air force - <AUTHOR> https://hushkit.net/2016/12/03/the-worlds-worst-air-force/ <comment><USER2> At the Battle of Midway, forty-one TBD Devastators were launched between 7 and 9 a.m. By 11 o'clock, 35 had been shot down. After the battle, all other Devastators were withdrawn from non-training units and they never again flew in combat.

The Devastator was so bad that the Navy destroyed all remaining planes by the end of 1944. So there are now no museum exhibits anywhere of what was at one time the U.S. Navy's frontline torpedo bomber.

<comment><USER3> They were terrible outdated planes that should have never been flown into battle, but they did at least serve one important role at Midway by diverting the Japanese fighters at just the right moment so that the US Navy's dive bombers could approach almost undetected.

</comment></comment><comment><AUTHOR> Looking at the conversation under the "Messerschmitt 163" entry, I wonder how many HN folks have had the software version of that conversation?

<comment><USER4> It reminded me the feature creep scene in HBO's Pentagon Wars, which is eerily similar to what can happen in the software world: [https://www.youtube.com/watch?v=aXQ2lO3ieBA](https://www.youtube.com/watch?v=aXQ2lO3ieBA)

</comment></comment><comment><USER5> Without reading the actual article, I was going to say something like:

      "Even the worst air force
       might be better than no air
       force at all, unless of
       course, you consider how much
       money gets wasted, and how
       many lives a fleet of death
       traps needlessly costs a
       country."

But that was maybe in the sense that an odd third world country might have been nurturing some money pit of a vehicle pool.

Having read the article about a hypothetical air force, I kind of like the look of all those ineffective airplanes. It reminds me of that web page with the simulator video game, where the polygonal race cars evolve to endure a randomized terrain, according to a genetic algorithm.

<comment><USER6> Well, the South or Central American country with the longest-lived and most stable democracy is the one that abolished its professional millitary, so at least sometimes "no air force" is the right answer.

(Similarly the Spanish republic might have lasted a big longer if they hadn't had an air force...)

<comment><USER7> Yes and no [https://en.m.wikipedia.org/wiki/Air_Vigilance_Service](https://en.m.wikipedia.org/wiki/Air_Vigilance_Service)

</comment></comment></comment><comment><USER8> There's a common theme for just about all of those aircraft: they're ugly. There's truth in the saying that good aircraft are always beautiful aircraft.

<comment><USER9> Google "A10 warthog". This is probably the exception which proves the rule. The air force hates it because it's ugly, but they can't eliminate it because it's amazing at doing what it does.

<comment><USER10> They don't hate it because it's ugly. I think the simplified version here is they hate it because they don't want to fulfill the role it does.

<comment><USER11> It's not that the Air Force doesn't want to fulfill the CAS role, they wan't the F-35 to do so instead which won't be truly CAS capable in a high threat contested environment for at least another 4-6 years. So, they want the F-15 and F-16 community to take over the role in the meantime -- a job the A-10 was built for and better equipped to handle (which is why it's the most requested asset for CAS). The Army would have been a much better place for these rugged jets, but they have no budget capacity for it and the Air Force is not going to allow them to have a fixed-wing CAS aircraft.

<comment><USER7> The RAF is the same; they would much rather the nation not even have a capability at all, than allow the Army or Navy to operate it.

</comment></comment></comment></comment></comment><comment><USER12> This article reminded me of the RAF banter sketch from Monty Python.

[https://www.youtube.com/watch?v=myIB1TrPpTE](https://www.youtube.com/watch?v=myIB1TrPpTE)

</comment><comment><USER13> I've often imagined WWII's "best" air force. The worst, somehow, I didn't consider.

<comment><USER14> I assume that would be a hypothetical best created by combining aircraft from many different countries? What do you imagine that would look like?

<comment><USER13> Yes, exactly. P51 D-H Mustangs, Spitfires, Messerschmitt 109s for fighters. Serious shame they didn't have midair refueling. I consider jets, ie Messerschmitt 262s to be outside the idea.

For bombers Lancasters, B17s, and B29s, of course.

But picking an air force of the worst is much funnier.

<comment><USER15> Your bomber choice is pretty inflexible... The heavies are great at flattening cities, but have little tactical use. For instance, it was the medium bombers (the B-25 and B-26, for example) that paved the way for the invasion of the continent (taking out the defensive emplacements and railways/bridges the Axis needed to resupply.

<comment><USER16> They also did serious damage in the Pacific, e.g. the Bismarck Sea.

</comment></comment></comment></comment></comment><comment><USER17> I'd be more interested in seeing the exercise applied to modern or cold-war era equipment. There are some great lemons out there, but nobody dares mention them for fear of angering any living pilots. Sticking to the 40s makes that very unlikely.

F-104.

<comment><USER18> The modern list will start with the F-35.

<comment><USER19> Eh, the F-35 is more an example of how truly infinite time and money can eventually overcome even the worst development processes—at this point the LRIP 10 35As are coming in around the mid-$90m range flyaway with engine, which puts them solidly under the Rafale/Eurofighter price point and on par with the still-in-development Gripen NG. The Danish type selection report is worth a read.

Here's some actual contenders for a modern/Cold War list, though it should be noted that most of these aren't fatally flawed in some fundamental fashion, just designs that didn't turn out as hoped:

\- the F-111: much too expensive and only good at long-range strikes \- the original Hornet, but not the Super Hornet: not enough fuel and too immature a design for its intended role \- the Eurofighter: mind-blowingly expensive, its AESA radar development program is older than the F-35 project and still isn't available, unfortunately timed (becoming a mature platform as VLO aircraft begin to enter service in many air forces) \- the F-16/LWF as it was originally conceived: range-only radar, no real payload, more or less a target drone \- the MiG-29, a point defense fighter that never really could be molded into a true multirole

<comment><USER20> How do you price something while ignoring the development cost? You can't really call it a less expensive plane and ignore the sunk cost can you? I'm far from an accounting expert as you likely realise.

</comment></comment></comment></comment><comment><USER21> "Its main tank could hold 300 gallons of fuel but it wouldn't take off with more than 80 gallons on board"

<comment> jon-wood Sounds completely useless but I guess at a pinch you could take of and then do a midair refuel. Maybe.

<comment><USER22> Isn't mid-air refueling a much later invention? Never heard of it being used during WWII..

</comment></comment></comment><comment><USER23> Even the worst plane on here could take out the the NZ air force :-(

luckily nothing has the range to get here :-)

</comment><comment><USER24> The headline makes me think what Stalin would have said about the air force of Vatican.

</comment><comment><USER25> I immediately thought about Argentina's air force. Main reason for it being so bad wasn't technical, but political (corruption, etc...).

<comment><USER26> That seems a bit harsh - UK accounts of the Falklands War tend to be rather respectful of the performance of the Argentinian air force.

<comment><USER27> They were respectful of the pilots ( "good stick-and-rudder men" is a quote I remember ) but not of the tactics or overall strategy.

For example on 1 May 1982 a 'maximum effort' was launched again the British ships. But the Mirage & Dagger fighters were used to escort the attack aircraft, rather than first achieving local air superiority. In the resulting chaos none of the attack aircraft found their targets and three of the escorts attacked the ships instead.

With the disparity of air assets available to them versus those of the two small British carriers, in theory the Argentinians should have eliminated the surface fleet without much problem. Yet three weeks later the amphibious landings commenced...

<comment><USER26> Yes, good point - I did think that I should have changed it before seeing your comment but the edit link had timed out.</comment></comment></comment></comment>


Fibers & Cooperative Scheduling in Ruby - <AUTHOR> http://www.igvita.com/2009/05/13/fibers-cooperative-scheduling-in-ruby/ <comment><USER2> I've been in the industry long enough to remember the issues with the Mac OS when it was still cooperative. Having continuations is sort of neat, but selling it as a threading solution rather ignores decades of experience that pretty uniformly point towards it being incredibly problematic for that purpose, to the point that I wouldn't touch it with a ten foot pole. There's a reason all OSes use preemptive scheduling. All the benefits of cooperative scheduling come with gigantic tradeoffs that dwarf the benefits, such as the ability of one cooperative unit to suddenly stop cooperating and halt the whole shebang, which pretty inevitably happens. (It doesn't even have to be a "crash", just a fiber that wants to, say, find and replace a string in one pass but suddently gets passed a multi-gigabyte string. This sort of thing happens all the time, and if you think you can avoid it... I don't believe you, but you're free to try. The problem space of reality is a lot spikier than anyone can imagine.)

Also, if Ruby really does schedule an I/O-locked thread for its full slice regardless of it being locked, that's Ruby's problem, and "fixing" that is not an advantage of cooperative scheduling. However, I doubt Ruby works that way. Somebody please tell me it doesn't.

It's a great tool for many other tasks, no question. But it's really questionable to use it for scheduling. If you feel it's the best tool, be sure you understand the tradeoffs before diving head-first on the basis of one article's breathless summary. There are reasons this approach has been abandoned for scheduling, and why virtually nobody is proposing that it come back for that purpose, even with all the recent interest in such matters.

<comment><USER3> AFAIK, Ruby marks I/O blocked threads and does not schedule them. However, if you have a native extension that's blocked on I/O, it may be scheduled--so there is a potential problem.

<comment><USER4> Ruby 1.8 implements threads in userspace, so if a native extension is blocked on I/O then no context switching is possible in the first place (unless the native extension is using Ruby's own I/O functions, in which case Ruby will relinquish control to another Ruby thread).

Ruby 1.9 implements native threads, so a native extension blocked on I/O will be rescheduled by the kernel, assuming that the native extension unlocks the GIL before performing the I/O operation.

</comment></comment></comment><comment><USER5> There is a great description of a true first-class continuation on Wikipedia:

 _Say you're in the kitchen in front of the refrigerator, thinking about a sandwich. You take a continuation right there and stick it in your pocket. Then you get some turkey and bread out of the refrigerator and make yourself a sandwich, which is now sitting on the counter. You invoke the continuation in your pocket, and you find yourself standing in front of the refrigerator again, thinking about a sandwich. But fortunately, there's a sandwich on the counter, and all the materials used to make it are gone. So you eat it. :-)_</comment>


Show HN: Functional Programming Interactive Tutorial for Kids - <AUTHOR> http://kids.klipse.tech/ <comment><AUTHOR> A note to the parents: This tutorial's goal is to teach the kids the foundations of functional programming, in a fun and interactive way. It is mostly based on Clojure and LISP.

The code snippets are interactive. It is supposed to be fun for kids to play with that.</comment>


NIST Selects Winner of Secure Hash Algorithm (SHA-3) Competition - <AUTHOR> http://www.nist.gov/itl/csd/sha-100212.cfm <comment><USER2> Keccak's (pronounced: ketchup) team includes Joan Daemen, who was also on the Rijndael team, giving him a hand in both AES and SHA-3.

Keccak's structure is simple and markedly different from that of MD4, MD5, SHA1, and the SHA-2 family, all of which share a common design pattern called Merkle-Damgard (MD). MD-style hashes chunk their inputs into blocks and tag the last block with a length; they then run in a manner similar to a block cipher, where each block is combined with the previous block after the hash function core is applied. The resulting output of these MD-style hashes is literally the internal state of the hash at the last block; you can take most SHA-2 hashes, for instance, and "feed them back" to the SHA function with more data to generate a continued hash. This gives rise to a common crypto protocol flaw called a "length extension attack".

Unlike MD, Keccak uses a design called a "sponge function". It's called a "Sponge" because it splits hash into two distinct stages: one in which the hash function "absorbs" data, applying the hash core function to permute an internal state, and another in which the hash is "squeezed" to produce output (which further permutes the state). Somewhat like a cryptographic PRNG, the security of the hash function is delegated to the confidentiality of the internal state, which isn't disclosed by producing the hash.

Furthermore, Keccak's Sponge design derives security by only allowing inputs to directly influence a subset of the internal state bits. Like MD hashes, the inputs are chunked into blocks and fed to the hash algorithm. But each block fed to the hash affects only that block's worth of internal state bits; the remainder of the hash's state (called the "capacity bits") are mixed in with the "outer" bits during the application of the hash core. Here's a picture that may tell the story better:

<http://tinyurl.com/cryptosponge>

Notice how the "M" bits of the input hit only the "r" bits of "outer" state in the hash, while the "c" bits of "capacity" are used only during the "f" function.

<comment><USER3> If all it does is prevent length extension attacks, then there are much simpler and less risky ways to do that (i.e., MD variants).

Also, your explanation of the sponge structure omits the real difference between it and MD: It is a transform that turns a non-compressing function (f in that diagram) into a compressing function. MD, on the other hand, starts with a fixed-input-size compressing function and extends its domain.

By the way, what do you mean by "Furthermore, Keccak's Sponge design derives security by only allowing inputs to directly influence a subset of the internal state bits."? That's as true for an MD-type construction as it is for a sponge construction. In fact, it's a crucial fact that allows us to build a reduction from, say, the collision-resistance of MD[f] to the collision- resistance of f.

<comment><USER2> Regarding the bits exposed to inputs in Keccak, I read the claim in the same manner as the claim that CTR is more side-channel resistant because attacker ciphertext bits never hit the AES core; here further margin is given by the additional capacity bits. That's my attempt at exposition from the Sponge paper. You would know far better than I would, though; I'm a tester, not a cryptographer.

Regarding length extension, strong disagree; we see the SHA functions routinely abused this way.

</comment></comment></comment><comment><USER4> At some points throughout the competition, the determination criteria used by NIST were somewhat unusual, with the decision committee stating that

"We preferred to be conservative about security, and in some cases did not select algorithms with exceptional performance, largely because something about them made us "nervous," even though we knew of no clear attack against the full algorithm."

[http://csrc.nist.gov/groups/ST/hash/sha-3/Round3/documents/E...](http://csrc.nist.gov/groups/ST/hash/sha-3/Round3/documents/Email_Announcing_Finalists.pdf) [PDF]

<comment><USER5> That is actually bit more interesting in the light of Schneier complaining about SHA3 not being significantly better than SHA2.

</comment></comment><comment><USER6> I found this overview <http://keccak.noekeon.org/> quite approachable. Especially the pdf linked here : <http://keccak.noekeon.org/Keccak- reference-3.0.pdf>

</comment><comment><USER7> My impression is that people, in the absence of obvious (to them) differences in security, will choose a cryptographic function based on speed, which is simple to understand and quantify.

Going by the eBASH benchmarks, software implementations of Keccak are mostly the same speed as SHA-2, and for some CPUs it's significantly slower.

It does have better throughput/area ratio in hardware, but chip manufacturers are not early adapters.

With that in mind I can't see any major push for general SHA-3 adoption unless the SHA-2 family is broken.

Still, I'm looking forward to the reading the report.

<comment><USER8> "Keccak, created by Guido Bertoni, Joan Daemen and Gilles Van Assche of STMicroelectronics and Michaël Peeters of NXP Semiconductors"

I don't think there will be any issue with regards to some early adopters. Maybe even a concideration with regards to common hardware usage like smartcards at some level.

But whilst your right about SHA-2 not being broken and making the rush to SHA-3 moot, it does not stop marketing types getting sales over SHA-2 only complient. In that it will be marketing and drive for sales and standing out that will drive it into market with all things being as they stand. Besides, everybody likes a plan B to fall back upon.

</comment></comment><comment><USER9> Surely, as tptacek's professional life (you know the one here on HN) is dedicated to proving that the security of the encryption algorithm is mostly incidental to the security of the system as a whole, then I would like the next competition to be about producing reference implementations or similar. Sort of like keyczar but down to the point where all browsers simply incorporate the same approved crypto libraries and Apis, securely use areas of memory without file handles anywhere in the background and all the other good stuff that takes us into a 80% done by default world.

I am not saying this isn't good stuff, but as someone struggling to implement a user login properly it would be much nicer to have a template to follow. (and he waits for someone to point to the template ...)

<comment><USER10> A user login, you say? First, find bcrypt or scrypt bindings for your programming language of choice. Here's one for Python, with some very concise example code:

<http://www.mindrot.org/projects/py-bcrypt/>

Store the hashed password that bcrypt gives you in a database somewhere. Make sure your login goes over HTTPS. I think that should cover the basics; do you have any specific questions?

<comment><USER9> What about handling single sign on for multiple applications - what do I put in the cookie if anything? If I am encrypting a cookie what scheme? What key rotation? How many failures of a cookie to decrypt is suspicious

What about password reclamation - do I keep the answers to their grandmothers maiden name in the same database? What about adding a new email address to the list of ones I will mail a password reset token to - do I force them to prove ownership of the first email address before adding the second ? Or will a SMS to their phone do?

I am sure I am missing a hundred items and none of them are to do with bcrypt vs scrypt. Thus is hard stuff and I am avoiding most of it with the magic words "Mozilla persona" but I still don't know how to do sso well. I can do not badly but not well.

Edit: I am being a bit snipy and I apologise but I know I am in deep waters and would be happier if NIST were producing reference implementations. Perhaps actually they have - there is kerberos. If you want a key visit room 303 with your passport

<comment><USER10> Sounds like I misinterpreted what you were asking. Yes, those are some tricky problems. It looks like our best choice for a longer-term answer is Persona, but it'll be a while before it's as slick as it should be. :-(

<comment><USER11> Unless Persona drastically changed in the last couple months, it seems to fundamentally misunderstand the problem of user authentication by assuming email addresses are both canonical and authoritative.

<http://news.ycombinator.com/item?id=4233391>

<comment><USER9> Well what is canonical and authoritative?

Most people keep an email address for years and that's a lot more than own their own domain.

I simply don't know what would work better than an email address as a virtual identifier - if u have a suggestion please (seriously I want to know) say

edit: wow am I in a bad mood. sorry! I would still like to know if there is a better answer than email addresses - but more politely. Cheers

<comment><USER11> When people decide to change their email address, they don't want to lose their accounts, and when someone else gets their old email address, they shouldn't have their accounts compromised. Seriously: even just "username" is better than email address. All of the advantages of using an email address as the primary key for an account are either not true or _actively dangerous_ once you realize how little they mean to the vast vast majority of "normal people".

Facebook is a reasonable example: they allow you to use email addresses to log in, but your account is not tied to your email address. Ever since nearly forever, they have let you add new email addresses to your account, and you can remove old ones. They also seem to have some schemes in place for mitigating "I lost access to my University email address, and someone else got it" (which one would imagine to be nigh unto endemic for their use case).

<comment><USER7> This is getting a bit off topic, but:

Changing addresses can be dealt with just as it is today: Let logged in users add additional email addresses to their accounts.

Other people getting your old email address is a bit worse. The easy solution is for providers to not reuse names. You could extend the protocol with a version token, so a provider could say that new bob is different from old bob, and shouldn't be able to log in to old bob's account.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Here's a competing author's take on the final round of this competition: <http://news.ycombinator.com/item?id=4564190>

<comment><USER2> I don't think I understand Schneier's point here. This is only the second time (AFAIK) that NIST has held a contest like this to standardize a crypto primitive. In the first contest, there was a clear and urgent need to retire DES. In the case of SHA-2, it was clear going in that there wasn't a "speeds and feeds" problem with SHA so much as there was a gathering unease about the basic design of the family of hashes from which SHA-2 is derived: MD4 and MD5 are broken, and SHA-1 isn't looking long for this world. Meanwhile, hash functions are not as well studied as block ciphers and number theoretic crypto, and the pace of development in hash research is increasing.

There is value simply in diversifying the gene pool of hash functions.

<comment><USER4> I think it was just a case of Schneier being a bit of his usual contrarian self. But is he correct in his assertion that the security of SHA-3 is not going to be much greater than that of SHA-2? (I don't mean that as a leading question.)

<comment><USER2> What does "greater" mean? I buy into the idea that the attack that breaks SHA-2 is unlikely to break SHA-3, and vice versa, and that's apparently a key design goal for the standard.

<comment> B-Con "greater" here means that we would think that SHA-2 is easier to break than SHA-3. Technically speaking, it's a guess, but I think that the general consensus is that it is more likely that SHA-2 will be broken before SHA-3.

</comment></comment></comment></comment></comment><comment> B-Con A little more detail from NIST here: <http://www.nist.gov/itl/csd/sha-100212.cfm>

<comment><AUTHOR> It's the same link.

<comment> B-Con Yep. Wrong tab. A different submission did not link to this page and I meant to post there.</comment></comment></comment>


Gulp.js is awfully similar to James.js, coincidence? - <AUTHOR>

I think by now most of you are familiar with Gulp.js, the new and shiny JavaScript task runner on the block, but I just came across another build tool that's surprisingly similar called James.js which has been around for longer then Gulp.
What's the story behind James.js and why didn't it get the attention that Gulp got?
Gulp.js: https://github.com/gulpjs/gulp James.js: https://github.com/leonidas/james.js <comment><USER2> Marketing. If you want people to use your tool, they need to know about it. Gulp has a website, a Twitter account, people writing about it, etc...</comment>


What does 'showdead' on my profile page do? - <AUTHOR>

<comment><USER2> It lets you continue to see articles/comments that Paul kills. Dupes, spam, etc.

<comment><USER3> It's not only me who kills them. There are a bunch of people (mostly founders of startups we've funded) who have editor auth. 90% of dupes and spams are dead before I see them.

Editors can also fix typos and replace linkjacks with the url of the original article.

<comment><USER4> OT: What is policy (or general understanding) regarding near-dupes, i.e. submissions of different articles that all cover the same material?

(I seem to be fixating on this today--it's the metaweb/freebase thing.)

<comment><USER5> Submissions on articles that cover the same content should be fair game. The voting of the community should decide which article is worth reading.

</comment></comment></comment></comment><comment><USER5> Try it out. Then report back here and let us know. ;)

<comment><USER6> I tried it and it reset my karma.

<comment><USER6> luckily though my karma is actually a formula- [danielha - rand(10,50)]

<comment><USER5> har har. :)</comment></comment></comment></comment>


You can still make millions of $$$ on the Mac App Store - <AUTHOR> https://medium.com/@denzhadanov/you-can-still-make-millions-on-the-mac-app-store-9c7134a924#.idaeahk00 <comment><USER2> Thanks for posting this, I appreciate you have posted some numbers; but over what time frame are those numbers?

Also, what advertising have you done specifically for the MAS?</comment>


Liquid Light - <AUTHOR> http://johncarlosbaez.wordpress.com/2011/11/28/liquid-light/ <comment><USER2> Thanks for submitting this. I wish it had gotten enough up-votes to attract the attention of some of the physics folks on HN.

<comment><AUTHOR> Yes, it's a shame it's missed its chance now. HN can be such a lottery, especially at busy times.</comment></comment>


Camels, Not Unicorns – DTC Founders Who Are Thriving - <AUTHOR> https://beautymatter.com/2020/09/camels-not-unicorns-three-thriving-dtc-founders/ <comment><AUTHOR> Per a recent Harvard Business School case study, Dollar Shave Club continued to be unprofitable for 3+ after its acquisition by P&G. Read more juicy stuff in this article and discover 3 badass founders who built profitable brands without venture capital.</comment>


Ask HN: What interesting front end problems do you work on? - <AUTHOR> Seems like most DOM updating and architecural strategies have been re-invented many times over since Angular1 and the like. These problems aren't all that interesting anymore and frontend has become much more like lego building. What new ground, or what tough challenges are you still working on? <comment><USER2> That highly depends on what you find interesting, is it _only_ web front end you're interested in? It's always handy to know how to put a GUI together in Python, Java, C#, etc.</comment>


Show HN: CIM – A simple CloudFormation command line utility - <AUTHOR> https://github.com/thestackshack/cim <comment><AUTHOR> CIM is a simple command line utility that bootstraps your CloudFormation CRUD operations, making them easier to execute, repeatable, and less error-prone. CIM separates out the stack template (YAML file) from the stack configuration (CLI options) so both can be stored safely in your project and executed again- and-again for stack updates.

Hey guys. Thanks for taking a look at CIM. CIM was a fun side project I did because I've been working a lot with CloudFormation and wanted to make my day- to-day dev a little easier. Hopefully it can help other devs as well.</comment>


Interview with a cracker - <AUTHOR> http://successfulsoftware.net/2011/04/07/interview-with-a-cracker/ <comment><USER2> If you enjoy puzzle games and programming I would strongly urge you to look into learning to crack. I'm not very good at it (it usually takes me a couple days to break into lightly-protected Mac software) but it's way more fun and challenging than any other puzzle I know.

Just don't release what you crack. I either delete the cracked one or pay for it after I'm done; cracking things is more fun than using them to me.

</comment><comment><USER3> I've previously had interactions with CrackZ. He's an incredibly sharp individual.

He runs a reverse engineering forum called woodmann and he has some great essays here: <http://www.woodmann.com/crackz/index.html>

Definitely worth reading if you're into reverse engineering.

</comment><comment><USER4> If you want to learn more about cracking, the woodmann pages are probably amongst the best (the guy being interviewed is involved in woodman)[1].

If you want to learn more about reversing in general (which in many respects is a lot more wholesome and for some, interesting than cracking) try BIW[2] as the woodmann library is easy to get lost in.

[1] - <http://www.woodmann.com/forum/index.php>

[2] - <http://www.reversing.be/>

</comment><comment><USER5> I'm all for cracking. In this age of multi-TB drives, it severely pisses me off when I can't rip a DVD/CD to disk or must have the CD/DVD in the drive to play a game. As an admin, mention of "flexlm" gets my blood boiling.

As illustrated by the zillions of man-hours wasted on the cat-and-mouse game of protection/cracking, as opposed to productive furthering of the software or other coding pursuits, protection is a waste of everyone's time, especially of the end-user who must put up with it.

</comment><comment><USER6> _A few software authors have 'crack catcher pages' for the search engines that say things like "I work 60hrs per day on my software, please support me if you want me to continue adding features" etc._

Sounds like it would also be a good idea to include some comments / code in there for crackers to stumble across and guilt them into stopping.

<comment><USER7> Uhh... when was the last time you shipped software with source code or unstripped binaries? Might as well put up a white flag at that point.

<comment><USER8> A cracker will be able to see any unencrypted strings in your binaries.

e.g.

const char* s = "Dear Cracker...";

<comment><USER7> Yup, I guess you can put any unencrypted line in the .text that you want. I would probably encrypt all the strings though (and just insert the unencrypted in manually).

</comment></comment></comment></comment><comment><USER9> Why does a cracker use a Hotmail account?

<comment><USER10> Because you wouldn't expect one to?

<comment><USER9> I guess. Somehow I pictured crackers jumping between disposable mailing accounts. Or better yet, substituting email needs for /msg on obscure IRC networks.

<comment><USER11> He is not a scene cracker, real sceners would never speak public, the sceners are very paranoic about their privacy and security (several layers of vpn and/or bnc) (and they have reasons, there were several raids of several so called top-sites in yurop). Also they don't spread their releases, they "pre" them into the scene and for the scene, but of cource, there are "unsecure" guys there who spread them to p2p/rapidshare/etc.. And site ops are hunting them down and banning from the scene.

I can answer to questions, if you want to ask more.

<comment><USER12> There are quite a few 'public' places where you can hear 'real sceners' speak these days. Also NFO files (which often contain a lot of 'talk' as well) and scene magazines (such as commented charts) have always been there.

</comment></comment></comment></comment></comment><comment><USER13> Ohhh, that kind of cracker. I thought it was just going to be an interview with a white guy.</comment>


The New Population Bomb: Four Mega Trends That Will Change the World - <AUTHOR> http://www.scribd.com/doc/24424882/The-New-Population-Bomb-the-Four-Mega-Trends-That-Will-Change-the-World <comment><USER2> I fucking hate Scribd; here is the original article:

<http://www.foreignaffairs.com/print/65877>

And PDF version:

[http://andrewgrahamnyc.files.wordpress.com/2009/12/the- new-p...](http://andrewgrahamnyc.files.wordpress.com/2009/12/the-new- population-bomb.pdf)

<comment><USER3> Scribd: bringing the worst of flash and PDF together in one annoying package.

Thanks for the links. I wish I could mod you up more than just +1

<comment><USER4> I love your description of Scribd - does anyone here know what audience scribd was intended for or what problem it was supposed to address? I can't see any possible benefit from the way it works and wonder what I am missing.

<comment><USER2> The cynic in me says that the problem they were attempting to address was the lack of money in their pocket, and the solution they came up with was to release a platform ostensibly about displaying PDF files for the web (which is ridiculous to start with, but whatever), so they could get users to steal other people's content for them, and then run ads against that content. Huzzah!

</comment></comment></comment></comment><comment><USER5> Only read half so far, but so far it's interesting.

It's NOT just a return to Malthus and Ehrlich, although the latter is cited several times as a sort of parallel. Even so, I think they miss the point of why Ehrlich lost his wager with Simon. While it's true that prosperity is helped by constant increases in manpower, it's not the biggest factor.

Our climbing prosperity is primarily due to improving know-how. And barring really extreme circumstances, we're not going to forget the technology that has allowed us to feed more with less work, and other feats.

That technology will still exist into the future, and because IP isn't rivalrous (claims of Disney and RIAA notwithstanding), it'll be available the whole world.

<comment><USER4> >due to improving know-how

The biggest factor is _educated_ manpower. That is more important than any other factor by a fairly large margin. Not least because increasing manpower even without education increases market size, which is an independent benefit of its own.

</comment></comment><comment><USER6> I can't read this on my iPad.

</comment><comment><USER7> Former CIA director agreed: <http://news.ycombinator.com/item?id=414373>

(Link to this speech has now changed to: [https://www.cia.gov/news- information/speeches-testimony/spee...](https://www.cia.gov/news- information/speeches-testimony/speeches-testimony-archive-2008/landon-lecture- series.html))

</comment><comment><USER8> The update on ye olde population hysteria seems to be this: Erlich thought there would be too many people. He was wrong, but he didn't distinguish between people. The real problem will be that will be too many of _the wrong kind of people_ ... foreigners mostly.

</comment><comment><USER9> Magnificent article, a great read</comment>


How Geico Wastes $90MM a Year on SEM - <AUTHOR> http://blog.tippingpointlabs.com/2009/04/how-geico-wastes-90mm-a-year-on-search-engine-marketing/ The more and more people I talk to, the more often I find myself taking a militant stance against gigantic search engine marketing (SEM) spending. My position is simple: if you create relevant, frequently generated content that's high-quality and of a significant volume, you don't need AdWords. That's it. <comment><USER3> This person obviously does not understand the value in capturing BOTH organic search visitors and paid search visitors.

Let us say 30% of the searchers for "auto insurance" click on Geico's organic search listing. What about the other 70%? Some of them click on other organic search listings, some of them will click only on other paid search listings, some of them will click on a combination of listings (comparing).

It would only make sense for Geico to buy paid search listings as well - <USER2> capture SOME of that other 70% that do not click on their organic listing.

Simply, ranking organically and buying keywords will only increase the chance for a potential customer to find your site. And with an industry as competitive as car insurance, if Geico doesn't spend that $90MM to acquire new visitors someone else will.

Also I highly doubt the accuracy of the $90MM figure as Spyfu's database is only an estimate.

Finally let's not forget this article also doubles as a marketing material for Tipping Point Labs, I'm sure they agree they are "expert story-tellers" who completely "understand online content marketing".

<comment><AUTHOR> Thanks Omar. I think you make some great points. However, as much as google would like you to believe that AdWord buys are more successful than the top ten organic search results, that's just not the case. Organic search results have higher conversion rates than adword buys. Hands down. I'll give you the SpyFu inaccuracy, however, it's some insight into adword spending. Also, although the post helps market tippingpoint, we're much more eager to spark a debate and engage in an active dialogue. Thanks again for your insight.

<comment><USER3> How can you say that paid search traffic converts less than organic search traffic? The beauty of paid search traffic is being able to target the RIGHT keywords for the RIGHT customer and the RIGHT time.

It is inherently wrong to say paid search traffic converts worse than organic search traffic because different variables will change the outcome (conversion rate). Those variables can be keywords, negative keywords, type of keyword matching, ad copy, time of day, landing page, geography, industry, product. I can change these variables and make the paid traffic convert poorly compared to the organic visitors. I can also tweak these variables and have my paid traffic converting much better than organic traffic!

What is my point? The data that you used to draw your conclusion, that organic is better than paid, was simply data from a poorly converting paid search campaign. Not to worry though, _most_ paid search campaigns are full of flaws because a lack of understanding of the Adwords system.

Furthermore, Google does not want me to "believe" anything. I have websites that rank organically AND which receive paid search traffic (Google). I have my own data to draw conclusions.

</comment></comment></comment><comment><USER4> I see some of his points. However, buying keywords on searches that you rank highly in is often not a negative. We buy brand terms for our clients all the time and it only helps them. They do very well in the organic listings for these same terms, but they often make more money through the PPC terms. The reason I feel that it often works that way, is that people clicking on PPC terms, are often more in a buying mode.

Because, people clicking on PPC ads want to be marketed and sold to. Is this always the case, no. You have to run the analysis on it to determine if it is worth it to buy keywords you do well with in the organic searches.

<comment><USER5> Absolutely. Also, I question the assumption that a significant percentages of searches for "cavemen" would convert.

I would ballpark that conversions on "cavemen" versus "auto insurance quotes" would be much less, probably 2-3 orders of magnitude or more.

But the basic idea that Geico is wasting some money on search is probably right. However, it could also be that they are not spending ENOUGH. It's hard to tell without being on the inside.

<comment><USER6> It's hard to tell when you _are_ on the inside. :)

<comment><USER5> Good point!

</comment></comment></comment></comment><comment><USER7> This article misses the much bigger picture on two points:

1) Geico is forgoing efficiency in favor of growth. In the past 20 years it has roughly quadrupled its market share. It can do so safely as it is owned by Berkshire Hathaway. As many other auto insurance companies have failed, Geico has climbed to a top 4 insurer.

2) Geico is owned by Berkshire Hathaway. Unlike some of the other companies, it does not have profitability as an exclusive motivation. Even at break-even, it generates significant float for Bershire to invest. This is why growth is favored to high margins.

<comment><USER8> _Unlike some of the other companies, it does not have profitability as an exclusive motivation. Even at break-even, it generates significant float for Bershire to invest._

Can you explain?

<comment><USER7> An insurance money makes its money from the premiums people pay and spends money on claims. Once a claim is made, there is a period of time before the company must pay it.

Even at break-even, an insurance company must keep a large amount of cash on hand to pay future claims. This is called float. Even though the company does not 'own' the money, it is free to invest it while it holds it. Buffet has used Geico and other insurers primarily as vehicles to invest their float.

<comment><USER9> On the other hand, it's important to note that Berkshire's insurance companies have been unusually profitable. Their combined ratio (ratio of expenses to premiums collected) is often below 100% -- not especially common for the insurance business. However, that average incorporates more volatility, and more deviations from the norm.

<comment><USER10> Well, any insurance company that doesn't have a combined ratio (CR) less than 100 is not making money.

Example: a CR of 92 means that for every dollar of premium, the company has to spend 92 cents, leaving 8 cents of profit. A CR of 102 means that the company has to spend $1.02 for every dollar taken in.

How much spent depends, in general, on operating expenses and claims paid. Limiting how much you spend can only get you so far; hence the rest of an insurers profit comes from investments.

(And where does the money for investing come from? Collected premiums!)

<comment><USER9> An insurance company with a combined ratio of 99 has a cost of capital lower than the US treasury. So yes, it is probably making money -- even if it has its assets in T-bills.

</comment></comment></comment></comment></comment></comment><comment><USER11> If someone at Geico can track that the $90 million a year gets them more than that back in business, why is it a bad decision?

Sure, they could create some insurance related content and have some articles show up higher in the rankings, but I doubt they would hit first page for all they keywords they want.

<comment><AUTHOR> Thanks so much for your comment. I too hope they're doing some real testing and tracking to make sure they're seeing a big ROI. Too often I've seen agencies hand deliver reports to clients that are 'stretching' at best. All the client cares about is that they're performing 'better than the benchmark.' As long as that's the case, they don't dive much deeper. It's entirely possible to garner every result on the first page of search results, if the content is REAL content of value it can be done. Thanks for the comment. Really appreciate it.

</comment></comment><comment><USER12> This guy completely discredits his company with a nonsense post like this. The reason Geico wouldn't PAY for the Caveman keyword is because it's not going to have much benefit. When someone types in "caveman" into Google, they aren't looking to buy car insurance. When someone types "car insurance quotes" into Google, they are. Geico wouldn't be dropping 90MM a year into that keyword if it didn't have a positive ROI. Althought "Caveman" might be cheaper to buy, I would bet any amount of money that it still have a negative ROI.

<comment><AUTHOR> Thanks for your comment. You don't need to buy the Caveman keyword... that's my point. What you need to do is convert people who are looking for caveman content at the height of it's popularity, and turn them into Geico loving insurance consumers. That IS the goal of the ad campaign, I would assume. I'd be surprised if their keyword campaign is THAT effective. If they don't buy the keyword, I'd imagine they see little to no drop in conversions. Thanks again for the dialog.

<comment><USER12> So all Geico needs to do is convert people who are looking for cavemen into paying customers and they can stop paying $90 million a year to AdWords?

Honestly, your article doesn't make any sense. You're title is that Geico "wastes $90MM" a year in paid search. Yet you offer no evidence that Geico has a negative ROI on this spending.

If your point is that Geico isn't concerned with organic traffic, they are ranked #1 for "car insurance" and #2 for "car insurance quote". I think they seem to be doing alright.

What do you think the point of the Caveman commercials were? The appeal was "it's so easy, even a caveman could do it". The cavemen were an added benefit of a recognizable character. While Geico probably could have spent some time and money getting higher ranking for "cavemen", you don't provide any evidence that doing so would actually covert sales. Missing this is huge because common sense tells me that folks looking for the Geico Cavemen are probably more interested in some quick entertainment than car insurance.

</comment></comment></comment><comment><USER13> It is always tempting to point to a big company and to try and argue how stupid they are and how they waste money etc. but as most of the comments here have already pointed out, there are fatal flaws in their argument.

I will add one more to the list. The difference in click-through rate for the top result from the second result is 3.5x. ie. Top result gets 43%, second place gets 12% CTR. Ranking first means a lot.

Also the spikes in trends for the caveman keyword being linked to Geiko is very speculative at best.

<comment><AUTHOR> Thanks for your comment. Really enjoy the dialog. The caveman spike is correlation, not speculation. It does correlate very closely, the news stories for the time period even other platforms like YouTube, trend very highly for Caveman around the same months... but you're right - I don't know for sure. Where did you get your CTR stats? Those are intriguing. Our experience is very different. Thanks again!

</comment></comment><comment><USER14> He's making the assumption that Geico hasn't done any sort of testing to verify that this is optimal. You can use urls in adsense to track which of your traffic comes from there and which organic.

My guess is that Geico isn't spending $90m blindly. But, like everyone in the tech industry, the author assumes that everyone not in the tech industry is stupid.

</comment><comment><USER15> Just a personal note, my experience with SpyFu's numbers are horrible. They have always been way off the mark.

<comment><USER16> I've worked for a company spending hundreds of thousands of dollars per month on SEM. SpyFu's numbers are really poor.

</comment></comment><comment><USER17> This is largely unrelated to the content of the article, but as a community of intelligent individuals, can we make an effort to avoid TLAs (three-letter acronyms?)

It would be helpful for the uninitiated to have acronyms spelled out. For those of us in the physical sciences, "SEM" is generally understood to mean "scanning electron microscopy." While this is obviously not the case of Geico's search engine marketing (surprising that they have a daily search advertising budget of $244k!), disambiguation would be helpful.

</comment><comment><USER18> That's ballsy. I like it.

<comment><AUTHOR> Appreciate it. Ballsy is fun.

</comment></comment><comment><USER16> So, he thinks nobody at Geico has ever looked at that $90MM and tested what happens if they spend less? Really? The idea that nobody has ever wondered what would happen to his or her bonus that year if they saved even 5% of the SEM spending is kind of far fetched, IMO.

<comment><AUTHOR> Thanks earl for your comment. I'm not that silly to assume no one's watching the adword buy, but I also know from experience that clients blindly take a 'better than the benchmark' as a sign of success - especially in the keyword space. Thanks again.

</comment></comment><comment><USER19> Because his point is that they could spend less and still generate the same income therefore increasing the profit margin.</comment>


Mental disorders affect 1 in 5 US children each year - <AUTHOR> http://www.newscientist.com/article/dn23567-mental-disorders-affect-1-in-5-us-children-each-year.html?cmpid=RSS|NSNS|2012-GLOBAL|online-news

<comment><USER2> I think the mental disorder is more an authority disorder, in like "If you don't do as I say then I will declare you a madman".

[http://www.madinamerica.com/2012/02/why-anti- authoritarians-...](http://www.madinamerica.com/2012/02/why-anti- authoritarians-are-diagnosed-as-mentally-ill/)</comment>


Mysticism and Machines - <AUTHOR> http://www.historytoday.com/er-truitt/mysticism-and-machines

<comment><USER2> Great article, thanks for the share! I wrote a piece in the same spirit this week: ZEN-RRNN - On Meditation & Machines: [https://medium.com/@samim/zen- rrnn-on-meditation-machines-bb...](https://medium.com/@samim/zen-rrnn-on- meditation-machines-bbeb92aa62d3)</comment>


Ask HN: How do you become a better communicator? - <AUTHOR> When I was in college, I assumed that the difference between a junior and senior engineer was that the senior engineers wrote more code and/or just solved the more challenging technical problems.
However, after a couple of years on the job, what I've noticed from observing more senior folk is that it all boils down to communication: they are simply more empathic, effective communicators. What I've noticed is that they are better at bridging the gaps between different teams, good at project management / delegating work, and mentoring other engineers.
Given that, what suggestions do you fine folk have on becoming a better communicator and a more effective senior engineer? Are there any recommended resources / books to read up on? <comment><USER2> For me, keeping in view how other people look at the situation is the most important thing in effective communication. I've found PG's advice the best in this regard:

""" If you want to learn what people want, read Dale Carnegie's How to Win Friends and Influence People. [8] When a friend recommended this book, I couldn't believe he was serious. But he insisted it was good, so I read it, and he was right. It deals with the most difficult problem in human experience: how to see things from other people's point of view, instead of thinking only of yourself.

[8] Buy an old copy from the 1940s or 50s instead of the current edition, which has been rewritten to suit present fashions. The original edition contained a few unPC ideas, but it's always better to read an original book, bearing in mind that it's a book from a past era, than to read a new version sanitized for your protection. """

[http://paulgraham.com/bronze.html](http://paulgraham.com/bronze.html) """

</comment><comment><USER3> Hi, these are a great question and a right conclusion. But become the good communicator is only a small thing that you have to change about themselves.

Here are just several points from my experience. 1) You have to get as much responsibility, as you can. 2) You have to became confident and tough. 3) And Yes, you have to became a better communicator.

Finally all these are about working on yourself. I can recommend you this book, which really helped me: [https://www.amazon.com/Unlimited-Power-Science- Personal-Achi...](https://www.amazon.com/Unlimited-Power-Science-Personal- Achievement/dp/0684845776/)

By the way it took more that a year to change yourself ) Good Luck!

</comment><comment><USER4> To simplify the idea, this transformation into a senior engineer starts to happen when you stop caring much about technical stuff and discover new interest in solving bigger problems to which technology is just an instrument. Basically, when you de-prioritize your initial fascination with technologies, tools, frameworks, data structures and algorithms and refocus your efforts on the bigger picture. At that point you'll begin shifting towards a different kind of a specialist. You'll see your attitude to work changing too, you'll be doing things based on other considerations and you'll be operating within a different set of constraints. Then you'll see your other abilities developing as well, including good communication skills.

I'm not sure if you can or should forcefully push that change through though. Not everybody is cut out to be a senior engineer, team leader or entrepreneur. I'm saying it with no negative implication, mind you. People have various abilities and should value them. A great software engineer pushed into a senior role might just not have the right personality type and will be miserable at it, even if he/she was great at coding things. At best just leave it there, do your job well and let this change eventually arrive to you when you're ready for it.

Myself, I went through that change a few years ago when I reached a ceiling as an employed worker and went on to do my own projects. That was the time when I gained a lot of new technical skills and also underwent a serious personal transformation, that last part changing me in many interesting and subtle ways.

One other thing that made me a better communicator happened to be writing. Some years ago I started a programming blog, at least that was the initial idea. Technical writing did not work out for me and I then went on to write a series of essays, both programming-related and not so much. This has had a profound effect on my communication abilities more than anything else that I've done in my time. It's something you may consider trying as well, if you have an inclination towards this line of work.

Whatever you do or don't do, eventually you'll get there if you're supposed to be there, based on your abilities, personality and individual inclinations. Then along the way you'll figure out what you should do next to support that transformation of yours.

</comment><comment><USER5> Book: How to win friends and influence people (Carnegie)

Book: The leader in you (Carnegie)

Audio: The-Law-of-Success (With Napolean Hill's voice)

Book: Becoming a person of influence (Maxwell)

</comment><comment><USER6> Making small talk with people is something I have found useful. Discussing (even debating) things I care about helps me get a natural flow of language.</comment>


A Generation Lost in the Bazaar - <AUTHOR> https://queue.acm.org/detail.cfm?id=2349257

<comment><USER2> Google Cached Version: [http://webcache.googleusercontent.com/search?q=cache:MiLg6t5...](http://webcache.googleusercontent.com/search?q=cache:MiLg6t5kKcoJ:https://queue.acm.org/detail.cfm%3Fid%3D2349257&hl=de&gl=de&strip=1)

<comment><USER3> PHK makes a thoughtful point. But I don't know where to go from there. What are the alternatives to the Bazaar? We have two cathedral builders (MS & Apple) who have both built very large cathedrals with very tall walls around them. If you want to get in, you have to pay up. And then you have to obey by their rules. And don't even think about watching porn inside the cathedral.

Do we need another cathedral? Or a cleaner bazaar? Or something else entirely? We ought to be careful not to throw out the baby with the (admittedly dirty) bathwater.

</comment></comment><comment><USER4> Previous discussion:

[https://news.ycombinator.com/item?id=8812724](https://news.ycombinator.com/item?id=8812724)

[https://news.ycombinator.com/item?id=4407188](https://news.ycombinator.com/item?id=4407188)

<comment><AUTHOR> Useful to see those previous discussions - thanks. There are lots of useful points made there, and yet _still_ no concrete suggestions as to how to make progress. Quite a few people agreed there's a problem, some saying it doesn't matter, others believing it's inevitable.

Is it a problem?

If so, can it be fixed?

<comment><USER3> I suppose there are two discussions ... the low level technical one wrt libraries & static linking. And the high level, philosophical one, about cathedrals vs bazaars...

</comment></comment></comment><comment><USER5> I have seen this before, and very much enjoy reading it again.

One nit is _paint company Mark Williams._ is not true. Mark Williams Company was first Mark Williams Chemical company, marketing a drink called Dr. Enuf ([http://en.wikipedia.org/wiki/Dr._Enuf](http://en.wikipedia.org/wiki/Dr._Enuf))

EDIT: There is some very lively discussion here [https://news.ycombinator.com/item?id=4407188](https://news.ycombinator.com/item?id=4407188), some fraction of which is a flame war, but includes some responses from phk himself.

(pre-1990 myself. By an embarrasing margin)

</comment><comment><USER6> Crops up once in a while. Thesis has some merits but ESR's bazaar is more akin to what is happening in web development today rather than at the OS level. Code reuse is really frequent with many package managers for many frameworks. You can start gluing software projects together with pip, npm, gems or whichever gizmo your stack-of-choice presents you with.

I can make whole products just with pip install and editing settings.py.

</comment><comment><USER7> I've often wondered what "an order of magnitude" meant exactly.

The author defines it as 100% (larger, in this case). Is that correct?

<comment><USER8> It's change by 10X, typically.

<comment><USER7> You're right, that's how he got 10,000% -- 10x and then another 10x . I thought he had done 100% times 100%...

Thanks for the reply.

</comment></comment></comment><comment><USER9> This was great.</comment>


U.S. Judge Orders RBS Unit Stop Using Software in Copyright Case - <AUTHOR> http://www.nytimes.com/reuters/2014/05/09/business/09reuters-rbs-lawsuit.html?hp

<comment><USER2> 1\. Sadly, this is a variation on an oft-told story. For example, in _Cincom Sys. Inc. v. Novelis Corp._ , a customer ended up essentially having to re-buy a half-million-dollar software license because it did a corporate reorganization that technically resulted in an "assignment" of the license without the consent of the vendor. See [http://www.ca6.uscourts.gov/opinions.pdf/09a0346p-06.pdf](http://www.ca6.uscourts.gov/opinions.pdf/09a0346p-06.pdf)

Conceivably the software vendor in this case might come to regret having taken such a hard line with its customer. That customer is highly unlikely ever to buy _anything_ again from that vendor if there's an even remotely-comparable alternative.

Of course, the vendor might be figuring that they're not likely to make any additional sales from that customer anyway, so what the hell, squeeze out whatever additional money they can.

For a discussion of the legal principles and more examples, along with contract-clause language that can help customers avoid this problem, see [http://www.CommonDraft.org/#AssmtConsentAddlCmt](http://www.CommonDraft.org/#AssmtConsentAddlCmt) and [http://www.CommonDraft.org/#AssmtConsentExceptAssetsCls](http://www.CommonDraft.org/#AssmtConsentExceptAssetsCls) (a side project of mine).

2\. In theory the judge in the _ABN_ case might have been able to award the vendor ABN's profits arising "indirectly" from the infringement --- which for bank-transaction software could have been considerable. There is precedent for that: In the 1980s, the MGM Grand Hotel was found liable for 2% of its hotel- and casino profits because its floor show had infringed the copyright in a Broadway musical, the Tony-award-winning _Kismet_. See [http://www.oncontracts.com/a-better-way-to-handle-a- breach-o...](http://www.oncontracts.com/a-better-way-to-handle-a-breach-of- contract-at-least-in-some-cases/#MGMGrand) for more details (a blog post I did a few years ago).

But in this case the judge apparently ruled that she was unable to compute the damages to which the vendor was entitled.

<comment><USER3> _software vendor in this case might come to regret having taken such a hard line_

Reminds me of Ernie Ball: [http://www.osv.org.au/index.cgi?tid=91](http://www.osv.org.au/index.cgi?tid=91)

[http://www.metafilter.com/30137/The-CEO-of-Ernie-Ball- talks-...](http://www.metafilter.com/30137/The-CEO-of-Ernie-Ball-talks-about- how-his-company-left-Microsoft-for-Linux-after-a-licensing-fiasco)

</comment></comment><comment><USER4> Wow, I am surprised we haven't seen one of these[1] sooner. Also surprised they got advice from counsel that they might be able to prevail here. From the blurb in the Times it seems pretty cut and dried. And if the unit really does make nearly half a billion dollars a year, it seems like throwing a few million over the fence in licensing fees wouldn't be a huge burden. Of course, it could be a bit more predatory than that, and RBS has been scrambling like mad to replace this chunk while their lawyers fight a delaying action in the courts.

[1] Major Corp getting screwed because some tricky licensing provision in their tech stack bites them in the backside.

<comment><USER5> It doesn't seem that tricky to me. You have to have a license to use the software. You sell the portion of your org that owns the license, you need to buy another one to continue using the software.

<comment><USER4> That isn't the tricky bit, generally you have a large organization, it has many moving parts, and general staff turnover. At some point there are parts of the system that "just work" and nobody at the place really knows all the various bits that go into the works. When one of those bits is carrying a license that needs to be paid, negotiated, but you don't know it, it bites you in the backside.

A more common example of this is a hard working engineer who, practicing DRY, finds a perfectly serviceable piece of code on Github which he plugs into the source tree with just a few small changes to hook up the plumbing. Never once checking the license terms. Those things blow up when you get a demand letter from the owner of the code. Most shops though have a license compliance officer type person who is checking for such things.

<comment><USER6> If it's a core part of your technology strategy, as RBS/ABN say it is, then your legal people need to make sure that you don't accidentally sell it away.

The problem seems to stem(from a ruling last year linked here: [https://news.ycombinator.com/item?id=7722956](https://news.ycombinator.com/item?id=7722956)) from the fact that ANB didn't actually specify that the license was staying with it instead of getting sold as a packaged part of one of their subsidiaries.

For a core tech requirement, that's amazingly idiotic, no matter what size organization you're in.

</comment></comment></comment></comment><comment><USER7> Just for clarification, wouldn't it appear that RBS was in violation of licensing terms even when it owned LaSalle, by using the software corporation wide, despite it only being licensed by a subsidiary?

Otherwise, you'd think there would be a huge market for tiny little companies that happened to have a "site license" for some expensive software.

I still think the judge, or some other authority, should put a cap on the price Complex Systems could charge, rather than leaving RBS completely at the mercy of their vendor. Perhaps the appeals court will.

</comment><comment><USER8> Court ruling from last year, which has a pretty readable summary of the case: [http://scholar.google.com/scholar_case?case=9145147889745759...](http://scholar.google.com/scholar_case?case=9145147889745759498&hl=en&as_sdt=6&as_vis=1&oi=scholarr)

</comment><comment><USER9> Why wouldn't they just buy another license? The company that owns the software makes about $20 mil a year. A new license couldn't cost _that_ much.

<comment><USER8> "Just buy a license" for something you are already infringing might end up in a license at a high price, or it might end up in a lawsuit.

</comment></comment><comment><USER10> Seems pretty cut and dried. The software license went with the other part of the firm, and not them.

<comment><USER11> It would appear so, although I'm surprised RBS and Complex Systems couldn't come to an agreement given that (I presume) RBS wants to continue using the software and Complex wants to get paid for people using it.

<comment><USER12> It's likely that the injunction is being used as leverage by Complex Systems - RBS now has what amounts to a hard deadline with a hard failure condition, rather than being able to accumulate damages that will only potentially be paid after an appeal, etc. while keeping their business up and running.

</comment></comment></comment><comment><USER13> I wonder, does FRAND apply to copyrights as well as patents? What if a company simply wanted to revoke a copyright license to a major system component for the fun of it? Or not renew it?

<comment><USER14> That's what contracts are for. You don't build your business around something without a guarantee it'll be available. Patents are different because it covers the method, you can't use an alternative supplier.</comment></comment>


Microbranches in Mercurial - <AUTHOR> http://bitquabit.com/2008/08/microbranches-in-mercurial-par/

<comment><USER2> The article is actually wrong. :\

The difference between patch queues and git branches is that git branches don't have any temporal context other than the base patch in git branches. There's no ordering or connection between git checkout -b b1 and git checkout -b b2 off a single patch.

This is not the case in hg, although I can't claim to fully understand it. Patch queues are really quite different from git's local cheap branches, and I think that trying to counter them with the pq's is a tough row to hoe.

<comment><AUTHOR> Provided you're using qguards, mq allows you to ditch temporal connections between patches as well. An early version of this article left that out specifically because I modified the default behavior of qnew on my system to create guards so that I can use them that way; I've updated the article to use qguards explicitly to achieve git-like temporal independence.

EDIT: And today I learn that Hacker News doesn't support full Markdown.</comment></comment>


The parody shirt the NSA doesn't want you to wear  - <AUTHOR> http://www.salon.com/2013/08/30/the_parody_shirt_the_nsa_doesnt_want_you_to_wear_partner/ <comment><USER2> Hmm, it appears to me that the NSA misquoted the law in that article when they sent a message to The Daily Dot.

From [http://www.intelligence.senate.gov/nsaact1959.htm](http://www.intelligence.senate.gov/nsaact1959.htm) :

Sec. 15. (a) No person may, except with the written permission of the Director of the National Security Agency, knowingly use the words 'National Security Agency', the initials 'NSA', the seal of the National Security Agency, or any colorable imitation of such words, initials, or seal in connection with any merchandise, impersonation, solicitation, or commercial activity _in a manner reasonably calculated to convey the impression that such use is approved, endorsed, or authorized by the National Security Agency._

(emphasis mine)

That changes things quite a bit. No reasonable person would believe the NSA authorized this.

<comment><USER3> Zazzle fears the cost of going to court, even if it looks like a certain win.

That's a general problem with the US legal system, and would be worth protesting about more than any NSA scandal combined.

Discrimination of the poor from access to justice.

<comment><USER4> This is the problem with crowdservices. Though it actually can be a strength if they decide to fight these types of things.

</comment></comment></comment><comment><USER5> [http://www.cafepress.com/mf/78962042/the- nsa_tshirt](http://www.cafepress.com/mf/78962042/the-nsa_tshirt)

I just ordered it. Done & Done.

Also, cafepress apparently doesn't make it clear until checkout but you can order with your Amazon account so you don't have to make a new account on cafepress. I don't like entering my CC info on a bunch of sites so I've been avoiding Cafepress until this T-shirt just made me cave in. Now I find out that I never needed to make a new account...

<comment><USER6> NSA asking for it to be taken off the site is probably the best thing that could happen for publicity.

I really want to wear this shirt while going through airport security the next time I visit the US :)

<comment><USER6> Actually, on second thought, I don't.

<comment><USER7> I used to wear a t-shirt with the TIA "Total Information Awareness" all-seeing eye logo on the front, and the slogan "Be A Good American. Don't Ask Questions." on the back, when I traveled. It was sometimes good for a few laughs with foreign border agents; but on the US side, never even so much as a smile. OTOH, I never got singled out for "extra screening" because of it (as far as I can tell); but that seems to be more common these days.

TBH, if I thought such a weak form of protest would really draw a response from TSA agents, I am pretty sure I would wear it. Maybe that's part of the reason I avoid flying these days.

</comment></comment></comment></comment><comment><USER8> > " _... At any time that NSA is made aware that the NSA Seal is being used > without our permission, we will take appropriate actions._ "

The NSA has no idea what "appropriate actions" means.

<comment><USER9> Of course they don't. That information is classified!

</comment></comment><comment><USER10> A non-story with a linkbait title.

Zazzle got scared of a design using the NSA logo. No proof whatsoever for NSA having been involved in this.

<comment><USER11> Their statement seems to confirm it though.

<comment><USER10> Their statement is a generic "you can't use our logo because of this law" (exactly what you'd expect from a government agency.) And their denied any involvement in this particular case (ditto.)

<comment><USER12> It is not protected under that law. Satire is most certainly allowed (and not just under First Amendment rights). The FBI tried to remove its seal from Wikipedia[0] and similarly miscited the appropriate law.

Sec. 15. (a) No person may, except with the written permission of the Director of the National Security Agency, knowingly use the words 'National Security Agency', the initials 'NSA', the seal of the National Security Agency, or any colorable imitation of such words, initials, or seal in connection with any merchandise, impersonation, solicitation, or commercial activity in a manner reasonably calculated to convey the impression that such use is approved, endorsed, or authorized by the National Security Agency.

It is that last bit that matters here.

[0] [http://news.cnet.com/8301-1023_3-20012575-93.html](http://news.cnet.com/8301-1023_3-20012575-93.html)

<comment><USER13> Sure, that's an arguable defense, but it's not like they're wrong in what they said.

You have to go to court to say, "fair use!"

<comment><USER12> I want to point out that "fair use" or, even more generally, First Amendment rights, are not involved here.

The statement that the NSA issued, that no one is allowed to use the Seal without written consent, is strictly false.

Section 15.a states explicitly that you may not use the Seal "in a manner reasonably calculated to convey the impression that such use is approved, endorsed, or authorized by the National Security Agency."

This t-shirt does not give you the impression that such use is approved, endorsed, or authorized by the National Security Agency. Fair use, parody, satire, doesn't matter.

I linked the CNET article because the FBI did the same thing a few years back:

"While we appreciate your desire to revise the statute to reflect your expansive vision of it, the fact is that we must work with the actual language of the statute, not the aspirational version of Section 701 that you forwarded to us," Mike Godwin, general counsel for Wikimedia Foundation, the nonprofit company that runs Wikipedia, wrote the FBI in response.

</comment></comment></comment></comment></comment></comment><comment><USER14> I had the same exact thing happen to me with Zazzle back in June when I created two t-shirt designs using the EFF parody logo. I had a bit of back- and-forth with the Zazzle reps who just kept sending me canned responses.

Luckily I was able to get the shirt shipped to me before they yanked it: [http://imgur.com/a/OOvwY#0](http://imgur.com/a/OOvwY#0)

<comment><USER7> Is that logo screened on there crooked?

</comment></comment><comment><USER15> I like this parody logo more [http://images.intomobile.com/wp- content/uploads/2013/06/nsa-...](http://images.intomobile.com/wp- content/uploads/2013/06/nsa-spy650.jpg)

</comment><comment><USER11> The NSA's statement is really pretty chilling when you think about it. The irony here is that "the government doesn't want you to wear this" is a great advertising message and the NSA in their statement has helped that along a great deal.

</comment><comment><USER16> The NSA is more than happy at the thought of people giving up for a t-shirt and becoming completely complacent with the idea of them listening and watching everything you are doing.

If a t-shirt is your idea of protesting, well it's no wonder we have the TSA and the NSA.

<comment><USER17> The t-shirt is a conversation starter, not a protest. Furthermore, he's using it to crowd-fund his defence. You can support it here:

[http://www.tfund.com/nsashirt](http://www.tfund.com/nsashirt)

</comment></comment><comment><USER18> Given the current situation, how can this usage not be covered by free speech?

<comment><USER19> That's what I thought, too. Using "The NSA" in the way the shirt does is making a political statement, which is protected by the USA's First Amendment. It's one of the few rights that the USA Supreme Court has defended zealously.

Supposing that "The NSA" is some kind of "intellectual property", using the phrase as that tee shirt does is almost certainly fair use. This is a lot less certain, as you'd have to go to court, spend lots of money, and admit to infringing to plead fair use, so it's probably not worth the effort.

<comment> super-serial Zazzle took down almost every parody shirt I've ever made - even ones with custom artwork.

For example I made a "Yo Bama Bama" shirt that had custom art of Obama wearing a Yo Gabba Gabba hat with various phrases... that was taken down.

Custom artwork of video game characters saying stupid things... always taken down. Anything that referenced some sci-fi movie or TV show was always taken down. I'm surprised the NSA even had to complain. Zazzle preemptively stifles free speech when it's obvious it's a parody before anyone complains. Zazzle is so bad about this - I don't use them for anything anymore.

<comment><USER20> Well, technically you have no right to or expectation of free speech on Zazzle. I'm sure it's in Zazzle's terms of service that they can reject any product submitted to the site for any reason. I don't like, but it's their site, they can do that if they want.

They're probably just being overly risk averse to try and avoid lawsuits.

</comment></comment></comment></comment><comment><USER21> What, you can't use the letters NSA? You must be joking.

<comment><USER22> There's an ellipsis at the start of that, here's what the whole text looks like:

> SEC. 15. ø50 U.S.C. 3613¿ (a) No person may, except with the written > permission of the Director of the National Security Agency, knowingly use > the words ''National Security Agency'', the initials ''NSA'', the seal of > the National Security Agency, or any colorable imitation of such words, > initials, or seal in connection with any merchandise, impersonation, > solicitation, or commercial activity in a manner reasonably calculated to > convey the impression that such use is approved, endorsed, or authorized by > the National Security Agency

<comment><USER21> Then it doesn't relate to this product then. In no way would anyone _reasonably_ think that such a parody is endorsed, approved or authorized by the NSA.

<comment><USER23> NSA is on a power trip. They've changed even the relevance of the word "relevant", in their justification for spying on everyone. They'll be using any justification to further their goals, no matter how crazy it sounds. They only only a few will call their bluff, and are using it as scare tactic.

<comment><USER24> Wrong part of the government out of control. As someone else pointed out, Zazzle is most likely more scared of the lawsuit that may or may not come from this.

If the NSA had an issue with it, CafePress wouldn't be selling the same shirt.

</comment></comment></comment></comment></comment><comment><USER25> The same is true of the Presidential Seal, under 18 USC 713 of the United States Code.

The NSA might be a little too aggressive here (satire is protected speech under the first amendment of the U.S. Constitution), but I can understand the desire to prohibit use of U.S. agency seals to falsely represent the offices to which they're attached. This is not the same as someone using the FedEx or the Starbucks logo . . .

</comment><comment><USER26> i'm probably going to print this on a t-shirt anyway just for fun...

Wondering what will happen when trying to enter USA while wearing that shirt - they will probably investigate my "resource processing system's output port"

</comment><comment><USER27> Just call it the National S __tstorm Agency. Or something.

</comment><comment><USER28> Love the design of that logo.

</comment><comment><USER29> Logo looks like a near-copy paste. Reprint with just the letters ?

<comment><USER7> "Peeping While You're Sleeping" ? The text puts it firmly in the realm of parody.

</comment></comment><comment><USER30> > Public Law 86-36, which states that it is not permitted for "…any person to > use the initials 'NSA,' the words 'National Security Agency'.

So does this mean using the acronym 'NSA' and the words 'National Security Agency' on the web without their written consent counts as a _felony_ when they pick you up? Will they apply additional 10 years to imprisonment statement? Making room for the _scapegoat_?</comment>


The new iOS6 Maps - <AUTHOR> http://www.apple.com/ios/ios6/maps/

<comment><USER2> 3D maps looks promising.

I haven't read through the iOS 6 dev manual, but I wonder what implication it has on MKMapKit and developers.</comment>


Data Infrastructure at LinkedIn - <AUTHOR> http://www-conf.slac.stanford.edu/xldb2011/talks/xldb2011_tue_1005_LinkedIn.pdf

<comment><USER2> is there a video associated with the slides that's available?</comment>


Echo chamber of outrage: Ars attends a climate skeptics' summit - <AUTHOR> http://arstechnica.com/science/2015/07/i-rejoice-that-it-is-warm-ars-attends-a-climate-contrarian-conference

<comment><USER2> For all that these people can be ridiculed by simply quoting them, their successes are really alarming. The consensus that CO2 emissions threaten the climate is something more than 20 years old at this point (the first IPCC report is from 1992), so the absence of political consensus on the issue is a significant achievement. In comparison, the Freon ban to protect the ozone took little more than ten years (in fairness the Montreal Protocol is the most successful treaty the UN has produced).</comment>


When Kids Start Doing Root Cause Analysis - <AUTHOR> http://blog.marksweep.com/post/22692428919/when-kids-start-doing-root-cause-analysis

<comment><USER2> It is pretty amazing how far down the rabbit hole you can go in "5 why's".

Louis C.K. does a very funny bit on the topic of the OP (NSFW I think)[http://www.youtube.com/watch?v=BJlV49RDlLE&feature=playe...](http://www.youtube.com/watch?v=BJlV49RDlLE&feature=player_detailpage#t=77s)

<comment><USER3> That video is the first thing I thought of while reading the article. I wasn't sure if it would get up voted or not, but I'm glad it did, since it does highlight how far you can go when determining the root cause of something.

"... but Why?" "Because some things are and some things are not!"

</comment></comment><comment><USER4> I have two kids, and the youngest is just starting on the 'why?' phase. Its great fun! I treat it as a game to try and see how long I can keep on answering. As soon as I don't know the answer, I explain that I don't know (or perhaps that nobody yet knows) and discuss how we could find out.

One interesting thing I discovered - a surprisingly large number of things will either lead to physics or human psychology if you keep asking 'why?'. However I don't know if that reflects some deeper truth about the world, or just my bias in how I answer the questions.

<comment><USER5> > However I don't know if that reflects some deeper truth about the world, or > just my bias in how I answer the questions.

It's the same reason why you always end up on "Philosophy" if you're browsing Wikipedia and consistently follow the first link in each article. Here's the path for "Airplane":

      Airplane
      Fixed wing aircraft
      Aircraft
      Vehicle
      Motion (physics)
      Natural science
      Science
      Knowledge /* we know where this going... */
      Fact
      Proof (truth)
      Argument
      Philosophy

Try it yourself: <http://www.xefer.com/wikipedia>

<comment><USER6> I think that website cheats a little bit. The first link in "Science" is not "Knowledge" but "Latin", where it's describing the root of the word "Science". If you follow it properly, you'll find that even the article for "5 Whys" _doesn't_ go to Philosophy:

      5 Whys
      Technique
      Technology
      Tool
      Goal
      Animal
      Eukaryote
      Organism
      Biology
      Natural Science
      Science
      Latin
      Italic Languages
      Indo-European Languages
      Language Family
      Language
      Human
      Taxonomy
      Ancient Greek
      Greek Language
      Indo-European Languages // Infinite loop!

<comment><USER5> That path seems to go in the same direction, but then it diverges in Science, mostly due to the first sentence on that page, where [Latin] and [knowledge] are links:

> Science (from [Latin] scientia, meaning "knowledge") is a systematic > enterprise that builds and organizes [knowledge]...

It happens again in Taxonomy, which otherwise would surely lead to Philosophy from the [classification] link:

> Taxonomy (from [Greek]: τάξις taxis "arrangement" and Greek: νομία nomia > "method"[1]) is the science of identifying and naming species, and arranging > them into a [classification].

On our way to Philosophy we are constantly confronted with Latin and Greek concepts, because Rome and Greece are where many of the concepts in Philosophy originated.

</comment></comment></comment></comment><comment><USER7> His experience of having trouble answering more than '5 why's' is a nice revelation. This is an exercise that nearly every engineer learns about (that started at Toyota[1]) and has become one of the basic tools used in continuous improvement. I often complete the exercise and it is trouble enough to make it to the 5'th why, the thought actually never occurred to me to go farther.

As a side note - when you are improving things, that 4'th and 5'th 'why' are often things that are very hard (and costly) to change.

[1] <https://en.wikipedia.org/wiki/5_Whys>

<comment><USER8> If it doesn't hurt, you're doing it wrong.

If something is hard and costly to change, _yet it's the root cause of problems_ , it's so much more important to change.

</comment></comment><comment><USER9> One of my favorite quotes regarding this is from Michael Crichton in one of his more obscure, autobiographical books called Travels:

"Although knowledge of how things work is sufficient to allow manipulation of nature, what humans really want to know is why things work. Children don't ask how the sky is blue. They ask why the sky is blue."

I recommend the book to anyone and everyone looking to explore their own understanding of the world and their place within it.

<comment><USER10> The real 'why' can be a dangerous question to answer, though. :)

"Daddy, why do the owls want to make the Sun go away forever?"

"Well, Billy, it's because the film is an expression of the cultural tension generated by the threat of nuclear warfare which faced American society in the 1980s when it was made. When they're singing about how the good guys are 'running out of batteries' it's giving you a context to interpret your experiences in a possible future in which you might have to hide out in a fallout shelter in the dark for days at a time."

"Huh?"

</comment></comment><comment><USER11> "Why" is an interesting hack. Before this children learn how things work through observation of events. "Why" is a force multiplier where the child no longer even has to wait for events to happen but can explore things that haven't happened or that are hard to observe. It's a short hop from there to deep abstraction and philosophy.

Cultivating this may be one of the most important things that parents can do in terms of ensuring children keep their curiosity long into adult hood (with appropriate training to develop the endless string of "whys" into a more socially acceptable question answering model).

</comment><comment><USER12> Perhaps children intuitively have 'chain of events' thought patterns. It's something many adults seem to lack, which makes proposing solutions to big problems difficult; because one has to be able to see far beyond simple cause & effect to both understand the problem and the proposed solution.

<comment><USER13> The technical term for this is "empiricism," and you're right that some adults lose this after a time, or at least mental models start resembling Kowloon Walled City.

<comment><USER12> I think the problem is that empiricism is often taught, in primary school, in a very 2-dimensional, black & white fashion – enforcing a rigid view of cause & effect. (Edit: often the case, but not always. There are great teachers out there.)

Maybe it's test-driven curriculum that's largely to blame: question -> answer.

I think in addition to basic empirical reasoning, kids should be exposed to determinism in the vein of chaos theory; where one is forced to accept that while connections exist, they may not be immediately obvious. (Edit 2: I guess this is "Art/Music Class", sadly non-existent in more and more schools)

</comment></comment></comment><comment><USER14> I'm trying it myself and love it. You can get real far in 5 whys. Speaking or writing it in a stream-of-consciousness fashion (first thing that comes to your mind) is quite insightful.

</comment><comment><USER15> Why is almost always the wrong question, since it involves an intention. The right question to ask is How. "Why did you do that?" vs "How did that phenomenon happen?".

<comment><USER16> I've read somewhere that kids keep asking "why?" because they figure out that it's an easy way to get people to talk a lot, and listening to people talk is how they learn language.

</comment></comment><comment><USER17> Dont kids already do this and most annoyed parents eventually answer "because the sky is so high" ....</comment>