What Is Wrong About 17259 Lines Of Code? - <AUTHOR> http://webreflection.blogspot.com/2011/10/what-is-wrong-about-17259-lines-of-code.html <comment><USER2> There's a lot of magic going on in this generated code that people keep getting wrong.

First and foremost, generating a 5 line function whose input/output types are fixed will almost certainly result in the function being inlined, _where meaningful to do so_ , by any modern JIT.

For that reason, the analysis of the bind() variants in this article are probably wrong: each variant has a fixed set of types, and doesn't fuck around with variable length argument lists, leading to simpler analysis, which leads back to the previous point.

In both these cases, after gzip, the presence of the functions is almost certainly negligible. In any case, optimizing the cases above prior to output is low-hanging fruit that the team probably just haven't gotten around to yet.

The code is doing some annoying things, though. It looks like it's extending the build in JS objects with its own functions.

<comment><USER3> > In both these cases, after gzip, the presence of the functions is almost > certainly negligible.

and

> In any case, optimizing the cases above prior to output is low-hanging fruit > that the team probably just haven't gotten around to yet.

Are both huge assumptions. What you're not considering is that as the complexity of the program grows beyond a 'Hello World' to a complex web app, the runtime of 17K lines may balloon further. You have no idea what efficiency they already built in.

What is _more_ telling is that the non-runtime code was _much_ more verbose. If you have a complex app that is already 17K lines, you might see that balloon to 100K lines.

You can't tell until you try and my intuition tells me that my app based on MooTools or JQuery is going to be much leaner, faster, just as easy to maintain, and I don't have to compile anything.

</comment></comment><comment><USER4> That hello world takes 17259 lines isn't really a valid point, dart seems to be aimed at building desktop-like applications experiences that happen to be delivered through a web browser. So the valid question is:

What do these 17259 lines enable the developer to do that are impossible or difficult to do with plain old web technologies of HTML, CSS and JavaScript? What's the use case these 17000 enable?

<comment><USER5> If their aim was to permit building desktoplike applications, they already failed, because the difficulty in building those has almost nothing to do with javascript. The big problem is the DOM api, which is too lowlevel to program large apps in. Javascript's limitations are almost inconsequential next to the deficiency of the DOM api.

Google invents too many programming languages, and too few frameworks / platforms. It's a typical computer scientist response to a software engineering problem. We don't need more languages, we need better api's.

</comment></comment><comment><USER6> While there's a huge amount of redundancy and nested method calls, it's worth bearing in mind that:

1\. This is a preview release

2\. The intention is almost certainly that the output code will be compiled and optimized later.

Compilation is a huge point. When you run the HelloWorld sample through Google's Closure Compiler, it's 71 lines, not 17,259 (<https://gist.github.com/1280982>). That's still enormously wasteful, but the duplicate method declarations and other obvious fat disappear.

<comment><USER7> While I think your points are very valid, the "71 lines" metric is not, because Closure Compiler tends to create really long lines.

When pretty-printed, that code became 2255 lines again.

</comment></comment><comment><USER8> It looks like going through the Dart code, the author gradually loses his grip on reality as his writing becomes increasingly incoherent and ungrammatical. Now we know: poorly optimized transpilers have the Cthulu effect on people.

It's too bad he couldn't handle staring into the abyss, because he makes a handful of great points before completely losing his marbles.

</comment><comment><USER9> It's generated code... Who cares what it looks like?

Lars Bak is on the Dart team. He knows what JavaScript VMs will optimize. Without some sort of "I tried this in my browser and it was too slow/took too long to load" I don't see the point of articles like these.

</comment><comment><USER10> It's called runtime library. Each language have it, even C. The only exception is assembly.

</comment><comment><USER11> I am surprised at how many people got pissed off by Googlers presenting a new language which also is able to be translated into JavaScript. It sort of reminds me of the bashing of google closure library code.

Take a step back guys. No one wants to step on your toes just to give you a hard time. In the end it will matter how good the tooling is and how good the code optimization will be and I think when we look at the closure compiler and many other developer tools that Google released we can expect greatness.

I might sound like a fanboy but I think it helps to see the bigger picture. It is not only about the JavaScript that the 0.0.1 version of the draft of the runtime is generating …

<comment><USER12> Until dart suddenly appears in Chrome as a native language to give Chrome a performance boost.

</comment></comment><comment><USER13> I'm definitely not an expert in languages but from a developer point of view, this Dart thing is really not step in a right direction. Here is why:

* Introducing a new language: like the existing ones cannot be improved.

* Not following what actually majority of web developers want: an easy to use framework which is extensible and modular

* Not thinking about maintainability and scalability of the code (a while ago the C++ compilers where actually creating C code and then compiling that... worked in theory but not in practice - at least not on HP-UX)

* It seems like a half baken think (and people assume this will be in preview/beta forever and then just closed as project)

* Not ability to use the exiting tools and libraries with it.

I wish (just my personal preference) that Google will get behind javascript / ruby / java and make them interoperate more. The jruby is awesome approach: just mix java and ruby.

</comment><comment><USER14> I thought the idea was to make a competitor to Javascript (essentially <script type="text/dart">) and provide a Javascript-generator as fallback. Checking up on the website, it seems i have misread this.

<comment><USER15> No you're right! The idea is to implement Dart VM's all major browsers. It is claimed that due to the design of the language, these implementations will be a lot faster than JavaScript.

But as no Dart implementations exist yet, people are studying the generated JavaScript code. Also, certain browsers (IE?) will never get a Dart VM and will thus need to rely on this JavaScript.

<comment><USER16> > Also, certain browsers (IE?)

chrome frame?

</comment></comment></comment><comment><USER17> I think I'll ask future job candidates to go through parts of the Dart runtime and find optimizations they could make at their interview. Thanks, Google!

</comment><comment><USER18> go & dart, they are bold attempts if you are from a java background, however now that most of us code in Ruby, Python, PHP etc, they don't appear quite state of the art. The syntax does not appeal unfortunately.

maybe someone will develop a certain node.dart?

<comment><USER19> Please don't lump Go in with Dart. It is a totally different beast and a pretty nice language over all. Considering the people who are writing the Go language (eg. Pike, Cox, etc...) and the language itself it really doesn't have anything to do with Java.

tl;dr Dart looks stupid and isn't what I am looking for. Go is a pretty good language for the right use case.

</comment></comment><comment><USER20> I think the author just explained what's wrong with all those lines of code.

</comment><comment><USER21> Abysmal.</comment>


The Most Modern of Modern Sports - <AUTHOR> https://www.damninteresting.com/the-most-modern-of-modern-sports/ <comment><USER2> A similar story at vaguelyinteresting: [https://www.vaguelyinteresting.co.uk/the-great-romford- and-h...](https://www.vaguelyinteresting.co.uk/the-great-romford-and- harringay-cheetah-races/)

Converging domain name and topics?

</comment><comment><USER3> This story was more than gripping enough until I got to the bit where the cheetahs started running at Harringay Stadium. That's just down the hill from where I'm sitting right now!

Of course that's not the only exciting thing that ever happened there. We had greyhound racing, ice hockey, riots, gangsters, motorbike races, Billy Graham, boxing matches, and an enormous cold storage facility. Of course most of these things didn't happen at the same time!</comment>


Ask HN: Affordable US cities to startup? - <AUTHOR> Looking to move out of Bay Area, the city doesn't necessarily have to be a tech hub but having small local like minded community is always awesome. I'm looking at this in terms of no extreme weather conditions, cost of living, walk-able, social and friendly neighborhoods. Want to get out of sweatshop. Want to continue working on my own prototype, which is already halfway through. Where do you live ? Any recommendations? <comment><USER2> Ann Arbor, Michigan

Beautiful area, quite cheap for the quality of the area in my opinion. 300-600k for a good home within a 10 minute walk of downtown.

City is young and hip while staying super family/small-town friendly.

Great little tech community as well with lots of meetups and events. Talent is actually affordable in both the form of the university student and the graybeard.

I recently moved to Denver from A2 and already planning on moving back within the next few years to buy a house/retire.

Shoot me an email if you want to learn more, it's really an underrated spot.

</comment><comment><USER3> Not sure what you consider extreme weather conditions, but Madison/Milwaukee, WI has plenty of start-up events, etc. If you are used to the Bay area, Madison has a very similar feel being between two lakes, similar to Berkeley area, etc. Madison has a strong startup community and very good accelerator programs [http://www.gener8tor.com/](http://www.gener8tor.com/).</comment>


What Can a DAO Do for John Doe? - <AUTHOR> https://www.zeframlou.com/2019/05/what-can-dao-do-for-john-doe.html <comment><USER2> Last paragraph hits the nail on the head.</comment>


Being a Professional - <AUTHOR> http://blog.folyo.me/being-a-professional/

<comment><USER2> Always good to remember, as these rules of thumb apply to any kind of professional relation.

</comment><comment><USER3> Very thoughtful post as always :)

</comment><comment><USER4> Well written.</comment>


The healing power of Greek Tragedy - <AUTHOR> https://www.smithsonianmag.com/arts-culture/healing-power-greek-tragedy-180965220/?no-ist <comment><USER2> This piece is excellently written. At the same time I find it incredible that so much of the work described is dedicated to recovering from war and hardly any of it is about preventing it.</comment>


Rat Park - <AUTHOR> https://en.wikipedia.org/wiki/Rat_Park <comment><USER2> For anyone who finds _Rat Park_ interesting, this is an excellent comic about it:

[http://www.stuartmcmillen.com/comic/rat- park/](http://www.stuartmcmillen.com/comic/rat-park/)

<comment><USER3> Thank you, his work is amazing</comment></comment>


The 451 status code is now supported - <AUTHOR> https://developer.github.com/changes/2016-03-17-the-451-status-code-is-now-supported/ <comment><USER2> Besides the reference to Fahrenheit 451 the referece to Life of Brian at the example from the RFC made my day:

[https://tools.ietf.org/html/rfc7725#section-3](https://tools.ietf.org/html/rfc7725#section-3)

"Unavailable For Legal Reasons

This request may not be serviced in the Roman Province of Judea due to the Lex Julia Majestatis, which disallows access to resources hosted on servers deemed to be operated by the People's Front of Judea."

<comment><USER3> I wonder if China would respond favorably to the code 451 (which would be ironic) or if they would take offense at it. If something is to be censored, wouldn't the censor want to deny its existence?

Imagine trying to watch a movie critical of China in China--status code 451.

<comment><USER4> China doesn't try to hide the fact that they censor a huge chunk of the Internet. In fact, they seem rather proud of it.

Perhaps they could even use 451 as an easy way to detect potential "terrorists". Sort citizens by the number of 451s they generate each month, send a cop to the top 1% of them, and publish this fact to scare the other 99%. They're already using TCP resets as a core component of their censorship regime, so I wouldn't be surprised if this Internet standard got co-opted, too.

So instead of:

        You are not in the sudoers file. This incident will be reported.

They'll get:

        HTTP 451. This incident will be reported.

</comment></comment></comment><comment><USER5> This could be really useful. If this was done by other big content sites (Youtube for example) then a search bot could build up an index of banned resources. A repository of burned books.

<comment><USER6> YouTube also bans content based on your location (e.g. In Germany), so the index would have to take that into account.

<comment><USER7> I really wanted to use it when our German customer try to view product pages for games that are illegal in Germany, but the business people said no.

<comment><USER8> You probably meant an advertising ban to under 18 year olds (no, a form asking for your birthday isn't enough). Only very few games are actually banned, KZ manager ([https://en.wikipedia.org/wiki/KZ_Manager](https://en.wikipedia.org/wiki/KZ_Manager)) for instance. For those only distribution is banned, possession is legal.

<comment><USER7> >You probably meant an advertising ban to under 18 year olds (no, a form asking for your birthday isn't enough).

For a webshop that effectively a ban isn't it?

<comment><USER9> No?

PayPal, EC Cards, and the eID system can do 18yo verification online.

</comment></comment></comment></comment></comment></comment><comment><USER10> "Responses using this status code SHOULD include an explanation, in the response body, of the details of the legal demand: the party making it, the applicable legislation or regulation, and what classes of person and resource it applies to."

So in the articles example, GitHub should really include who is requesting the DCMA in the response.

<comment><USER11> While it isn't part of the 451 response, you can see the takedown notice submitted to GitHub. Load the blocked content in a browser and you will see a message with a link to the takedown notice. Here's an example: [https://github.com/popcorn-official/popcorn-app](https://github.com/popcorn- official/popcorn-app)

<comment><USER12> Their link to the DMCA should be included in the response. It's weird that it's not

<comment><USER13> It is in the body of the response. How do you make out that is is not?

<comment><USER12> Let me edit my post.

The link to the DMCA should really be included in the __api response __

</comment></comment></comment></comment></comment><comment><USER14> [https://en.wikipedia.org/wiki/Fahrenheit_451](https://en.wikipedia.org/wiki/Fahrenheit_451)

Coincidence? I think not!

<comment><USER15> ha, was thinking the same thing - sure enough, it's totally named after that

</comment></comment><comment><USER16> I like the Farenheit 451 reference. Is that intentional, or does destiny have a sense of humor?

Edit: Wikipedia knows it all, as always. [1]

[1] [https://en.wikipedia.org/wiki/HTTP_451](https://en.wikipedia.org/wiki/HTTP_451)

</comment><comment><USER17> Original discussion on HN from 4 years ago [https://news.ycombinator.com/item?id=4099751](https://news.ycombinator.com/item?id=4099751)

<comment><USER18> I thought this was an interesting comment[1] in the context of AWS:

>If the .ru site sent 404s for nonexistent users and 451s for real ones, you'd be able to gather potentially useful information. It's like if I go to bad- porn.com and type your email into "forgot my password", it should neither confirm nor deny the existence of your account, simply tell me the request was received. In any event if delivery of the requested resource is legally prohibited, why would I go to the trouble to determine whether the resource exists?

>A final analogy: 10 year old enters US gas station: "Have you Marlboro 100s, menthol?" gas station attendant (without checking whether or not he has this particular brand/style of cigarette): "get out of here, kid. [HTTP/1.1 451 Unavailable For Legal Reasons]."

Amazon will similarly return 404 for S3 assets which exist but which you don't have the right to see. Annoyingly, they will also do the opposite of the cigarette analogy in the AWS console: they will gladly let you walk though the whole process of configuring and launching an EC2 server and only reject you at the very end because you don't have permission. Hence my "AWS bar joke":

[http://blog.tyrannyofthemouse.com/2016/02/some-of-my- geeky-t...](http://blog.tyrannyofthemouse.com/2016/02/some-of-my-geeky-tech- jokes-with.html)

[1] [https://news.ycombinator.com/item?id=4100526](https://news.ycombinator.com/item?id=4100526)

</comment></comment><comment><USER19> I was under the impression that the 451 status code should be used for requests blocked by proxies, where the original content is technically still available at the source but blocked for some reason. Probably got the wrong idea.

<comment><USER20> To clarify this:

> This status code indicates that the server is subject to legal restrictions > which prevent it servicing the request.

The "server" here could be a proxy server or the original, hosting server.

> The use of the 451 status code implies neither the existence nor non- > existence of the resource named in the request. That is to say, it is > possible that if the legal restriction were removed, a request for the > resource might still not succeed.

<comment><USER21> It's like IETF's own Glomar status code.

</comment></comment></comment><comment><USER22> Help Me Understand:

I am a government who is censoring content. I do not like the explicitly saying I am 'censoring' the internet I instruct my infrastructure not to use the status code 451. and I instruct my nation's infrastructure to reject or rewrite all responses with 451 status code to 404.

What stops me?

<comment><USER23> Nothing. This is not some kind of mandate. What the general public gets out of it is that, for sites nice enough to use it, the viewer will know why they cannot view something. The alternative is for them to not know why.

</comment></comment><comment><USER3> If I understand NSL correctly, its existence cannot be published without a government waiver? So in the case a repo needs to be taken down due to a NSL, what does GH do? 404? 401? 451? Returning 451 in response to a NSL would definitely violate NSL requirements?

<comment><USER24> Probably 404 would best fit the intention of an NSL, although I think 400 would also be defensible.

</comment></comment><comment><USER25> This means webcrawlers/bots can now compile stats.

</comment><comment><USER26> I actually saw the status code 451 in the wild.

First time I saw it was in December and after that in January, both on the same site. The site that was blocked was archive.is.

This block was targeted at Finland and none of the different Internet connections I tried could get to the site, I tried my home connection, cellular and connecting from my school network. It's a shame that anyone even thought of censoring such an useful tool for history and other legitimate uses. I wrote a thing about it to a Finnish newspaper and a few weeks after that the block was gone. I suspect that the newspaper conatcted archive.is and it was removed so they don't get bad publicity.

It was kind of ironical that I had to subvert the archive.is censorship to read an archived version of a thread discussing web censorship in Sweden.

I think this error code is a bad idea as it legitimizes censorship.

<comment> Tuna-Fish Just to clarify: Archive.is decided to block all of Finland not because of some Finnish legal requirement, but because the guy running it had a bad experience in Finnish customs and wanted to have revenge of some sort. Not really censorship.

<comment><USER27> What a hilarious misuse of power. I hope my country doesn't piss off wikipedia or something.

<comment><USER18> And misuse of status code too. Rejecting a country because you had a bad experience with them should just be the general 403 Forbidden.

<comment><USER28> Would've been better to use 418 if he was just being petty.</comment></comment></comment></comment></comment>


11 Must Have Firefox Extensions (programmer heavy) - <AUTHOR> http://www.shoemoney.com/2008/03/10/11-must-have-firefox-extensions/ <comment><USER2> noscript isn't on that list?

i personally think that site looks terrible.</comment>


Ask HN: Is there software to manage hundreds of containers per CPU core? - <AUTHOR> e.g. a 32-core host running 8,192 containers.
Such containers would require a small CPU & RAM footprint :-)
This implies it's possible: [1] https://blog.ubuntu.com/2015/06/11/how-many-containers-can-you-run-on-your-machine
Kubernetes has a default limit of 110 pods/node, and perhaps a max of ~250: [2] https://prefetch.net/blog/2018/02/10/the-kubernetes-110-pod-limit-per-node/
K8s permits numerous containers/pod but its unit of mgmt is the pod, IIUC. <comment><AUTHOR> Here are the links, live:

[1] [https://blog.ubuntu.com/2015/06/11/how-many-containers- can-y...](https://blog.ubuntu.com/2015/06/11/how-many-containers-can-you-run- on-your-machine)

[2] [https://prefetch.net/blog/2018/02/10/the- kubernetes-110-pod-...](https://prefetch.net/blog/2018/02/10/the- kubernetes-110-pod-limit-per-node/)

</comment><comment><USER2> You can set K8s to increase the max pods per node.

[https://prefetch.net/blog/2018/02/10/the- kubernetes-110-pod-...](https://prefetch.net/blog/2018/02/10/the- kubernetes-110-pod-limit-per-node/)</comment>


Uncorrectable freedom and security issues on x86 platforms (2016) - <AUTHOR> https://decentralize.today/uncorrectable-freedom-and-security-issues-on-x86-platforms-2e6220fa07ed#.4bahgsnc0 <comment><USER2> Isn't it sci-fi-level incredible, and frankly both scary and shady, that every modern x86 CPU has this forced sub-ring-0 control program? And that the CPU vendors apparently go to extreme lengths in hiding its functionality? Why would even large vendors like Apple or Dell agree to this?

The 30-minute timeout is particularly mischievous. It's like they REALLY want to slow down any effort at patching out the ME.

Are we going to have to wait on an insider leak on what's the real deal here? Or have I completely missed out on a perfectly good excuse for what's going on?

<comment><USER3> NSA 100% . Some time around 10 years ago governments decided the internet was too "dangerous" to be free. Arab spring cemented that into their minds, and now a bastion of free thought has become the worlds biggest spying apparatus.

<comment><USER4> So why not build our own network with crypto, blackjack & hookers on libre hardware? Say on an OrangePi PC2 with a bunch of high gain USB 5GHz radios attached, and throw some spinning rust on there so you can run a Nextcloud instance and/or join your local Ceph cluster/IPFS.

We have CJDNS (which salsa20's all your data & can VPN legacy networks to ya), fully FLOSS SBCs for under $20ea, and 802.11n and AC outdoor radios can be had for cheap, this is merely a community involvement problem.

<comment><USER5> The issue is not widely known, silicon is very costly to manufacture, and most people frankly don't care, as long that spying is unobtrusive (and hell it is so).

Also, most people already are living with the thought that their computers are cracked/hacked/virused the moment they are connected to the internet - all my friends and relatives ask me to check their computer for viruses - almost none trust their computers or phones (especially Android phones, it seems). For such people, where this is the natural state of the world, it's very hard to imagine that they can change anything about it - and telling them that there are backdoors from the moment the laptop is assembled, doesn't help much.

<comment><USER4> Sure, but the silicon & libre drivers already exist and don't need to be manufactured, so at this point its a marketing problem of selling a more secure computing box.

</comment></comment></comment></comment></comment><comment><USER6> Happy to see more attention to this problem. The FSF called it out back in 2014, as well:

[https://www.fsf.org/blogs/community/active-management- techno...](https://www.fsf.org/blogs/community/active-management-technology)

</comment><comment><USER7> Should point to: [http://mail.fsfeurope.org/pipermail/discussion/2016-April/01...](http://mail.fsfeurope.org/pipermail/discussion/2016-April/010912.html)

Canonical presentation: _REcon 2014 - Intel Management Engine Secrets (Igor Skochinsky)_ [https://www.youtube.com/watch?v=4kCICUPc9_8](https://www.youtube.com/watch?v=4kCICUPc9_8)

Decoding ME firmware in BIOS updates until Skylake (2015): [http://io.netgarage.org/me/](http://io.netgarage.org/me/)

</comment><comment><USER8> While it would be great to liberate x86, more than 4 billion people in the world use mobile phones, and phones are beyond saving. x86 is in very healthy shape compared to the clusterfuck that is the smartphone industry. If you think that coreboot is a fringe project, you need to head over to replicant or neo900 to see what the fringe actually is.

<comment><USER9> Well, then you can go deeper and check out baseband firmware liberation project - OsmocomBB [1], since baseband firmware in a far worse shape than applications firmware (and TrustZone firmware) in smartphone industry.

[1] [https://osmocom.org/projects/baseband](https://osmocom.org/projects/baseband)

<comment><USER8> I don't think baseband can ever be truly free because of regulatory issues. The only realistic way of containing it would be through isolation.

<comment><USER10> You could also change the regulatory framework.

</comment></comment></comment></comment><comment><USER11> ... I confess I'm very frustrated reading about how trusted computing modules hurt the cause of FOSS but no alternatives to actually try and carry out cryptography to execute trusted code.

Inevitably the complaint is, "Well if they have physical access you're screwed anyways." And I just don't understand how _anyone_ can maintain that farce when the last year has shown that it's a genuine challenge even for the US FBI to unlock a mobile device without the owners say-so and it's getting harder all the time.

If you truly believe that physical access is a trump of any security then you can never trust your hardware anyways, as it is exceptionaly hard to prove it conforms to a spec.

<comment><USER12> The FBI issue wasn't a technical issue. When they gave up on grandstanding, the phone was cracked in hours.

<comment><USER11> They purchased a hack for an old phone, according to the stories I read.

</comment></comment></comment><comment><USER13> I was struck by the following passage:

>including Secure Boot, which even now requires FOSS users to purchase a license from Microsoft to boot FOSS on affected machines that lack an appropriate Secure Boot override."

Can someone explain this to me, would this be for instance be Lenovo laptops making a deal with Microsoft since Windows is the default OS installed on these laptops? Is Microsoft mandating all OEMs/hardware vendors to configure secure boot with a MS signing key? Even if I order a laptop with no OS installed?

<comment><USER14> Secure boot has 4 types of keys:

The signature database (db) and forbidden signature database (dbx) contain a whitelist and blacklist respectivly of keys, signatures, and hashes that are trusted to run.

Updates to either of the above lists must be signed by a Key Exchange Key (KEK). Most implementations allow multiple Key Exchanges Keys.

Updates to the list of Key Exchange Keys must be signed by the Platform Key (PK). Most implementations only allow 1 PK, and that PK is Microsoft's.

This means that any binary run on a secure boot machine with Microsoft's PK has a chain of trust rooted at Microsoft.

It may be possible to update the PK before transitioning the system to secure mode; but most consumer devices ship already in secure mode. This is different from simply disabling secure boot, which would still not allow you to update PK (for obvious reasons).

EDIT: It appears that it is called "user mode" and "setup mode" instead of secure mode.

Also it seems that some systems allow you to re-enter setup mode from the "bios" [0].

On an unrelated note, what do we call the firmware provided settings app now that it is no longer part of the BIOS.

[0] [https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Co...](https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Configuring_Secure_Boot#Entering_Setup_Mode.2C_and_Installing_New_Keys)

<comment><USER13> Thanks for the detailed answer. In regards to:

>" Most implementations only allow 1 PK, and that PK is Microsoft's."

Isn't this a bit monopolistic and coercive though? "If you want the Microsoft Hologram on your product the PK has to be has to be Microsoft and there can only be one PK." I can't believe this doesn't violate some type of anti-trust laws.

<comment><USER15> How so? The OEMs want to make hardware that runs Windows. Microsoft provides a specification[0] and certification suites[1] that defines what "Windows- compatible" means, which OEMs then follow. Nothing coercive about that.

There is no open standard that defines what a PC is. Linux and other operating systems are piggybacking on the Windows PC standard. If they want OEMs to manufacture hardware to their standards, they'll have to create their own "Linux-compatible" specification and persuade OEMs to follow it.

[0] [https://msdn.microsoft.com/windows/hardware/commercialize/de...](https://msdn.microsoft.com/windows/hardware/commercialize/design/compatibility/index)

[1] [https://msdn.microsoft.com/en- us/library/windows/hardware/dn...](https://msdn.microsoft.com/en- us/library/windows/hardware/dn930814.aspx)

<comment><USER13> >"The OEMs want to make hardware that runs Windows."

I disagree. I think the OEMs want to make hardware that consumer buy. I don't think they care one bit what OS consumers run on top of their hardware. In fact I would imagine OEMS would prefer to bring their products to market without consulting Microsoft at all.

It's coercive in the sense the the secure execution is predicated on there only being one PK and the OEMs have to knuckle under to MS just to be considered a "potential" machine that Microsoft allows to run Windows.

>"Linux and other operating systems are piggybacking on the Windows PC standard."

What exactly is the "Window PC Standard"? I have never heard this term before. Linux didn't piggy back on Windows anything. Maybe you mean X86? X86 predates Windows.

<comment><USER16> They also want to make hardware that doesn't get them assasinated by the King's agents.

</comment></comment></comment></comment></comment></comment><comment><USER17> This needs more attention. Particularly now that AMD may actually look into cooperating with the community on this matter somewhat. I wouldn't get my hopes up yet though, as this was a Reddit AMA done during a time when AMD is keen to please the community. This matter must not go away for something to be done about it.

<comment><USER18> Are there any projects out there that throw the baby out with the bathwater and just restart computing from the ground up with freedom as a foundation? I'd love to participate something like that and I think it'd be a great way to respark 80's like hacker movement.

<comment><USER17> Libreboot and coreboot are trying to open source things on the software side of things (think dd-wrt or openwrt or tomato for routers, custom firmware basically). With hardware it's a bit of a different story. You hear about attempts from time to time, but getting away from Intel / AMD is really hard. The suggestions from the article about alternative architectures seem to be our best bet currently.

<comment><USER18> Alternative architectures is definitely the most pragmatic thing to go for. I was going off on a bit of a tangent from the article and just wondering if anyone has tried redoing the 70's - 90's without trying to be compatible with any existing technology but still learning from the mistakes.

<comment><USER15> The crowdfunded Open-V implementation of RISC V comes to mind.

[https://www.crowdsupply.com/onchip/open-v](https://www.crowdsupply.com/onchip/open-v)

However, it doesn't look like they're going to come remotely close to hitting their funding goal. Fabricating chips is expensive.

</comment></comment></comment></comment></comment><comment><USER19> I'm trying to understand all of this and especially the threats to privacy, control of my computing hardware, and data security.

I read about some new hard/software for _secure boot_ , etc., but don't recall all the details now.

So, for a shorter approach, suppose I just buy a processor from AMD, a motherboard from ASUS, hard disk drives from Western Digital, etc., and plug it all together for myself. So, then I'm the _manufacturer_ or OEM of my computer.

Q. 1. For what the OP is talking about, where do I have threats to privacy, control of my machine and its data, and security?

Q. 2. To use the machine I plugged together, do I have to get some keys from Microsoft?

Q. 3. Suppose I install operating systems from Microsoft, e.g., Windows 7 64 bit Professional, Windows 10, Windows Server or the database SQL Server. Then do I have to get keys from Microsoft?

Q. 4. Will the _support processor_ and its software, whatever they are called, on their own without my knowledge or approval use the Internet to send/receive data from/to my computer, modify the data on my hard disks, etc.?

Thanks.

<comment><USER5> 1\. The motherboad has a ARC chip, that loads a firmware included in the flash chip. That ARC chip is supposedly inside the PCH (Platform Controller Hub, a north bridge on steroids) - it's efectively in the silicon, you can't remove it.

2\. Depends on the motherboard and the BIOS written in the flash chip

3\. No. They are already signed.

4\. If somebody controls them and ask them to do so. All that's necesary is a LAN connection (or wifi, but only with Intel chips) and power. The HDD is completely irrelevant, as is the OS.

<comment><USER19> The motherboard I have in mind is the ASUS m5a97 r2.0. Back in October, 2015 I got a PDF on that motherboard at

[http://data.manualslib.com/pdf2/42/4150/414970-asus/m5a97_r2...](http://data.manualslib.com/pdf2/42/4150/414970-asus/m5a97_r20_user_manual.pdf?21746bed4ca8a7cf8dc1026baaa917b8&take=binary)

Just checking, the PDF does mention the Unified Extensible Firmware Interface (UEFI) but not ARC or PCH.

That ASUS manual does mention that the UEFI BIOS does offer automatic updating of the BIOS version; that feature, if enabled, does seem to raise security concerns.

Looking at the UEFI page of Wikipedia at

[https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_In...](https://en.wikipedia.org/wiki/Unified_Extensible_Firmware_Interface)

there is

> UEFI can support remote diagnostics and repair of computers, even with no > operating system installed.[3]

which seems to raise some security concerns. Also it does appear that some people trying to install an operating system might encounter some mud wrestling. Maybe what I'm intending to do with Microsoft's Windows 7, 10, and Server will be easy enough.

Thanks.

</comment></comment></comment><comment><USER20> Want complete software freedom? How about the MIPS chips the Russian military uses[1]? Those don't have an NSA back door. Sucks you can't really buy them as they are only made for use in Russian military and government applications.

"Last year, the Russian government announced that it doesn't want to rely on Intel and AMD chips from the U.S. anymore and will focus more on using homegrown chips from Russia."

[1] [http://www.tomshardware.com/news/baikal-t1-mips-cpu- omnishie...](http://www.tomshardware.com/news/baikal-t1-mips-cpu-omnishield- support,29178.html)

<comment><USER21> Those probably have Russian backdoors though.

<comment><USER22> In most cases, a foreign gov spying on you is harmless.

<comment><USER23> In most cases a foreign government spying on you is trading their insights with your government in order to sidestep domestic spying restrictions.

</comment></comment></comment></comment><comment><USER24> >Both serve effectively the same purpose; to ensure that the physical owner of the machine never has full control of said machine.

That is the end-result, yes, but that wasn't the purpose: the purpose was to allow companies to keep track of their laptops--to remotely push out firmware updates, to inventory the hardware/asset list, etc. It was a convenience feature, essentially.

Of course, the end-result, as stated, is that you've got a complete black-box second processor that can do whatever it wants, even when your device is off.

<comment><USER25> Nah, that wasn't the purpose unless Im misremembering. It came later as a selling point. It started in initiatives such as Trusted Computing Group where these companies agreed on technologies to control what runs on the PC for security and DRM purposes. Featured regular, secret meetings on top of the public ones.They took lots of flak when DRM goals got press attention. That they're just helping companies manage stuff or users fix computers sounds much more pleasant. They also made sure it was true by adding those features. ;)

</comment></comment><comment><USER26> >As Intel owns all rights to the x86 architecture, there will never be any new manufacturers licensed to make x86 chips ...

This strikes me as the root problem here. How can one company be granted a monopoly on what is basically an instruction set? Particularly in the case of the instruction set our civilization runs on?

Since I can't understand how something like this could happen I don't understand why any replacement architecture wouldn't end up being controlled by a single entity.

<comment><USER27> I believe it's not the instruction set they have patents on per se, but rather on how to implement it efficiently.

<comment><USER28> Which provides strong evidence that patents are the root of all evil.

</comment></comment></comment><comment><USER29> > These technologies, in turn, are used to implement various forms of remote > control and Digital Rights Management (DRM) technologies, including Secure > Boot, which even now requires FOSS users to purchase a license from > Microsoft to boot FOSS on affected machines that lack an appropriate Secure > Boot override.

I dislike the mandatory use of these features as much as the next nerd, but this is inaccurate FUD. Secure Boot is a code in flash that checks the signature of whatever you try to boot against some rather complicated policy. It's regular code and would work more or less the same on any platform that runs machine code off of ROM or flash.

There's something that Intel calls, IIRC, "Verified Boot" that tries to prevent someone with an in-system programmer or desoldering skills from changing the flash, but that has nothing to do with the Management Engine either.

And FOSS users don't need to purchase any license from anyone. They can use a tool like Linux Foundation's PreLoader or Red Hat's shim (open source but awkward to modify because you need the signed binary to boot on a stock system) to boot anything they like. No negotiations, no license, no communication with MS at all.

<comment><USER30> > > These technologies, in turn, are used to implement various forms of remote > control and Digital Rights Management (DRM) technologies, including Secure > Boot, which even now requires FOSS users to purchase a license from > Microsoft to boot FOSS on affected machines that lack an appropriate Secure > Boot override.

> I dislike the mandatory use of these features as much as the next nerd, but > this is inaccurate FUD. Secure Boot is a code in flash that checks the > signature of whatever you try to boot against some rather complicated > policy. It's regular code and would work more or less the same on any > platform that runs machine code off of ROM or flash.

"Regular code" doesn't mean it's not proprietary, and doesn't mean that it's not concerning for free software users.

> And FOSS users don't need to purchase any license from anyone. They can use > a tool like Linux Foundation's PreLoader or Red Hat's shim (open source but > awkward to modify because you need the signed binary to boot on a stock > system) to boot anything they like. No negotiations, no license, no > communication with MS at all.

Those preloaders are signed by Microsoft. While it is a good hack for distributions at the moment, it doesn't mean that Microsoft is no longer in the loop. They still have an incredibly worrying amount of control over what can run on modern hardware.

<comment><USER29> > "Regular code" doesn't mean it's not proprietary, and doesn't mean that it's > not concerning for free software users.

Which has essentially nothing to do with the article and isn't even Intel's fault in any meaningful sense.

</comment></comment></comment><comment><USER31> Would love to see and ARM or MIPS setup get within shouting range of Intel.

I have yet to hear any explanation of the IME that makes sense without the presence user-hostile intent.

<comment><USER32> > I have yet to hear any explanation of the IME that makes sense without the > presence user-hostile intent.

The entirety of enterprise laptop management. Not because you don't want users to change their laptop. The point is to be able to run updates for the users.

Or consider the remote KVM option. Disregarding security, that is a sysadmin's wet dream. Being able to recover a system that can't boot saves a lot of boots on the ground.

<comment><USER31> I get all that - I've worked in enterprise IT my entire career.

It does not explain the 30 minute timer.

<comment><USER33> > It does not explain the 30 minute timer.

An innocent use would be: "If the ME is hung, turn it off and on again."

<comment><USER31> Sigh. If I need to spell this out:

Why is the ME watchdog mandatory?

What innocent explanation details why Intel has chosen to deny me the option to consider the ME a security risk in my environment and disable it?

</comment></comment></comment></comment></comment><comment><USER34> Is "uncorrectable" still a valid description? There seems to have been some progress lately in eliminating ME that are not necessary?

[https://news.ycombinator.com/item?id=13056997](https://news.ycombinator.com/item?id=13056997)

[https://news.ycombinator.com/item?id=13416378](https://news.ycombinator.com/item?id=13416378)

</comment><comment><USER35> > Major distributions have worked around this issue by purchasing a signing > key from Microsoft for their binary packages, but the end user is unable to > modify the signed software without a license from Microsoft, even though > they have the source code available to them under the GPL.

Is this an accurate description of what is happening? (I don't pay much attention to desktop systems: I spend most of my time concentrating on the ever-worsening mobile arena.) Do these "major distributions" come with a recent version of bash? As someone who develops software under the GPLv3 license, I would not want my software being distributed to these machines via this hack :/.

<comment><USER30> > > Major distributions have worked around this issue by purchasing a signing > key from Microsoft for their binary packages, but the end user is unable to > modify the signed software without a license from Microsoft, even though > they have the source code available to them under the GPL.

> Is this an accurate description of what is happening? (I don't pay much > attention to desktop systems: I spend most of my time concentrating on the > ever-worsening mobile arena.) Do these "major distributions" come with a > recent version of bash? As someone who develops software under the GPLv3 > license, I would not want my software being distributed to these machines > via this hack :/.

It's not entirely accurate. Effectively what most modern distributions do is that they have a "shim" which is signed by Microsoft. That shim then enrols the distribution's own UEFI keys on the laptop. So their kernel is signed with both their own key and Microsoft's key. This means that you can modify your code without "permission" from Microsoft. openSUSE, Fedora and Debian all employ this tactic so that our distributions can boot on newer laptops.

Do I wish this wasn't necessary and that everything ran core boot? Yes. Is there a better way of handling this problem? Not as far as I know.

</comment></comment><comment><USER36> How is this not an anti-trust issue?

Of course the government wants this capability to access anyone's system, so I assume nothing will be done. This has to be one of the worst things that has happened in the history of computing.

EDIT: Handy for CBP use, I imagine.

<comment><USER8> This has nothing to do with anti trust. Selling hardware doesn't require you provide software or the ability to run your desired software.

</comment></comment><comment><USER13> The article states the following for RISCV:

>"While this architecture is extremely limited in performance, price"

Can anyone say thy the performance of RISCV is so lacking?

<comment><USER37> Likely because there's no major consumer devices shipping them (or at least high-end versions of them) that could help them hit a scale that brings the cost down, which makes them less viable for a general public consumer standpoint, which means there's less time spent optimizing it.

I remember a wihle back when Google was shopping around for Intel replacements (likely a negotiation tactic), people were saying they should buy the POWER division from IBM (IIRC). That would have been really interesting...

<comment><USER13> >"I remember a wihle back when Google was shopping around for Intel replacements (likely a negotiation tactic), people were saying they should buy the POWER division from IBM (IIRC). "

Funny, I was speaking to some IBM engineers a few months ago and brought up the POWER chips and they kind of laughed and said something to effect that biggest use case for POWER was Google as a means of keeping Intel pricing in check.

</comment></comment></comment><comment><USER38> Am I missing something here?

> Secure Boot, which even now requires FOSS users to purchase a license from > Microsoft to boot FOSS on affected machines that lack an appropriate Secure > Boot override.

I recently installed rEFInd from source by using a self-singed certificate (signed the binary using it and enrolled the key into the EFI using mokutil) and it worked. I certainly didn't have to pay MS. I do know that rEFInd provides a key of their own (using the distro's shim) that obviously has trust rooted at MS.

</comment><comment><USER39> Good to see mention of Talos, even if it never came to fruition.

</comment><comment><USER40> Mentioned back in 2014 iirc?

</comment><comment><USER41> (Article is from 2016.)

<comment><USER24> Even then, he's a little late to the party.

</comment></comment><comment> awinter-py Is there evidence these have been used to harm anyone?

Not that I wouldn't like a world with no more blobs (or at least reproducible- build signed blobs). But I use a ton of software I don't have time to review. Why is solving this more important than, say, looking for RPC holes in docker?</comment>


It's mathematically impossible for active investors to beat the market - <AUTHOR> https://medium.com/@azumbeg/its-mathematically-impossible-for-active-investors-to-beat-the-market-1a7dc90de310 <comment><USER2> It is because you assumed it to be the case. What is the basis for the equation where you considered t _active + (1-t)_ passive = market gain? When are passive and active gains not equal with your definition?

<comment><AUTHOR> They are always equal with my definition, hence the conclusion that active investors, as a whole, perform substantially worse than the market (net of fees). The equation is derived from the fact that there are fundamentally two investing strategies. There's a passive strategy, where an investor holds a representative market index. Anything that deviates from that strategy (with regards to security selection or market timing) is considered an active strategy. "t" is used to denote the share of capital flowing to each strategy, and the total market return is the weighted return (percentage, not absoute) of both.

</comment></comment><comment><USER3> That's a tautology. On average, people can't do better than average.

<comment><AUTHOR> Good point. But it's missed on a lot of people.</comment></comment>


Facebook is locking accounts, then demanding "verify" by scanning their face - <AUTHOR> https://twitter.com/flexlibris/status/935635282564734977 <comment><USER2> Discussion: [https://news.ycombinator.com/item?id=15807200](https://news.ycombinator.com/item?id=15807200)

350 comments</comment>


The Ultimate Cheat Sheet For Starting And Running Your Business - <AUTHOR> http://techcrunch.com/2013/08/24/the-ultimate-cheat-sheet-for-starting-and-running-your-business/ <comment><USER2> The more I've read about him, the more I believe that James Altucher is doing some sort of marketing/PR experiment, a la Andy Kaufman. I believe he's a liar and I don't trust him. I think he's a kind of art-punk troll who might even be manipulative on purpose. Even taking his story at face value, I'm not sure why people would give him any kind of credibility. His own story states he made a few million lying and kissing ass on Wall Street, which is NOT a note of distinction.

This cheatsheet is ridiculous. There is no one-size-fits-all prescription. For example, IANAL but I was told by council that incorporating in Delaware means that you'll have to travel to Delaware to litigate.

Splitting equity equally with the guy with the idea? I AM an idea guy, even I have to say that's crazy. An idea without execution isn't worth anything except maybe a clever throw-away side-plot in a Neil Stephenson science- fiction story. (Although if you think differently, please contact me through my profile.)

Honestly, if you're going to take advice from someone you want to take advice from someone with a great reputation as a smart, successful, honest, and generous entrepreneur or investor. Along those lines I think DHH has done a great job (bootstrapping FTW), although I think he tends to underestimate his luck with timing. Fred Wilson has also done a great job with his excellent blog, avc.com. Warren Buffet, although not really an entrepreneur, has talked unwaveringly about sound business principles for 50 year - and he has the knack of making it sound like common sense.

Take Altucher with a big grain of salt, is all I'm sayin'.

<comment><USER3> He does not say split equally with the idea guy. Idea guy gets one fifth.

> Take Altucher with a big grain of salt, is all I'm sayin'.

Agreed. However I would take any general advice with a grain of salt. Every business situation is different.

</comment></comment><comment><USER4> Some of these answers are outright dangerous in my opinion. This list is quite a mixed bag.

<comment><USER5> The list isn't intended to be 100% serious.

<comment><USER6> Those are the worst kinds of lists then. Because if it's not clear whether they are or are not 100% serious I'm left here trying to figure out how he got to that conclusion on some contentious point and I start doubting my own strategies where we disagree.

But really, I think the author by himself meant all of it to be serious, just that he tried to be humorous along the way.

<comment><USER7> It seems to me it is like most short quick comments, there might be some valuable insight if you apply it right but sure you can easily mis-apply the ideas.

I think it is pretty obvious no advice from a list can really be used to guide your decision. But it can make you think, "founder is the head of sales" \- am I really making a good decision hiring a head of sales so quickly? Yes, the founder is wonderful but a lousy sales person. Similar to the no hiring a CEO idea. Avoid doing so is the advice, if you want to question that impulse but if there are good reasons to, well you have to decide based on the actually situation you face.

I generally find such lists of general advice close to worthless. I actually find this one worthwhile, but sure it has plenty of advice I don't agree with. What I really care about is if it provides some insight and sparks what seems like useful thought.

</comment></comment></comment></comment><comment><USER8> Could someone please elaborate on why an LLC would not be good for selling your company?

I'm aware that it wouldn't be preferable for outside investment, but this is the first I'm hearing about issues with sale to another company.

<comment><USER9> LLC is incredibly flexible, and incredibly easy to convert to a C if you do actually need.

He's wrong on that, conflicts with all his other MVP product advice. LLC is the MVP corporate structure.

</comment></comment><comment><USER10> Half of these answers is common sense, the other half is shitty advice. You can't answer by "yes" or "no". Bad delivery too.

</comment><comment><USER11> When I read about an area I know little about I generally don't want to disagree too strongly with anything. But this, even on a somewhat renowned blog, is written in such a defining way. It doesn't fit all that I read about startups to be so molded. My understanding of PG's essays is that this is still true with raising money. And this article seems very sure that it can be light hearted, reminding us that sex with employees can work (there are some forms of rape from consensual where one has standard work power over the other). Who is this list for? No-one would act on this, so it's a joke piece? Is there some in joke from experience?

</comment><comment><USER12> I googled "choice ambiguity". Nothing useful jumps out. Anyone have a good reference? [https://www.google.com/search?q=%E2%80%9Cchoice+ambiguity%E2...](https://www.google.com/search?q=%E2%80%9Cchoice+ambiguity%E2%80%9D&oq=%E2%80%9Cchoice+ambiguity%E2%80%9D&aqs=chrome..69i57j0l3.505j0&sourceid=chrome&ie=UTF-8)

<comment><USER13> I read that as 'none of my competitors stand out from the field'

</comment></comment><comment><USER13> Longest comment I'll likely ever write here. While reading this keep in mind that it is easier to criticize than it is to write and that 101 applies to me even more than it does to James Altucher who I tremendously respect.

1 & 2)

That's US start-ups only. Elsewhere consult a fellow starter-upper and/or a corporate lawyer.

4) I'd build the product _after_ finding the first customer, and I'd build it together with the first customer. I'd stay away from friends-and-family money at all costs. My friends-and-family are worth more to me than whatever money they can supply and the risk of failure is no different for this new fantastic idea than for any other.

6) Debatable. I work for quite a few venture capital companies and NDAs, while not the norm are definitely in play especially in the bigger deals.

7) I'd weigh those a bit more careful depending on where the centre of gravity lies. If someone contributes _just_ an idea and won't be doing any work an equal portion would not be on the table because it will become a deadweight in the long term.

9) depends. If the service is marketing then that would be up for discussion. Large amounts of leverage in marketing can be a big success factor and a partnership with a company with both eyeballs and experience can make life a lot easier. One way this is sometimes structured is through an investment part of which is then spent at the company doing the investment, other times it is an outright swap. Complex but workable.

10) only works for b2c. Not everybody builds apps.

11) contradicts 4.

12) strong disagree. If you feel that you're selling yourself short then simply don't. Venture capitalists telling you to take money at any valuation ...

15) no way. No deadweight, even if that brings business. Likely they're just trying to offload their friend and you'll end up with deadweight and you _still_ don't get the business or it turns out that it nets less than the friend costs. This doesn't scale unless you fire the friend right after you do get the business (in case that happens...). Needless to say this is unethical.

16) stay in touch but not once per month, you've got better stuff to do than to re-visit all your rejects once every month. Selling starts at 'no', so do keep an eye out, they never leave the 'prospect' bin.

20) do it, but if you can charge for it.

25) some sour grapes there. Contradicts 23

26) If it were easy to distinguish the obvious losers from the obvious winners this would be actionable.

27) when you need them.

28) Cisco.

31/32) It depends. Taxes are at some stage in your development unavoidable. If you are putting everything on red then not paying taxes can be a valid strategy, it can also be the fast track to bankruptcy. Adjust to your comfort level and don't let VCs push you into making bad long term decisions, their goals are _not_ aligned with yours.

35) Don't. It complicates matters tremendously and opens you up to potential lawsuits and any move you make after that will be classed as favouritism with the rest of your crew. It also makes for a very uncomfortable atmosphere in case the relationship ever sours.

36) Employees should be fired if and when they don't keep up their end of the employment arrangement or when you can predict you will run out of cash (this can be costly in and of itself!). If your employment agreement states you should not gossip then don't, otherwise I don't see how you could fire someone for that. Employees with an attitude are pretty common and those are often the best people.

41) then work like hell on getting your revenue more balanced. One customer that can sink you is a time-bomb waiting to happen.

44) do your homework and know your competition better than they know themselves. Know their weak points and their strong points, show how your attacks drive at their weak points and how your defences are taking care of their strong ones. This can be a lot of work. But don't let yourself be taken for a ride by your competition, you are driving your own course.

45) Figure out what it is worth to the other party. The cost+ model is likely going to end low, especially if you are a dominant player and/or have a significant userbase or network effects in your offering.

47) that's just sad.

48) this works if you run a lawyers office and in some b2b offerings. (I'm trying to imagine github charging extra for github pages or issues).

49) b2b only

52) only a little bit and only in the beginning. and make that clear.

56) debatable. Blog if it works for you, if it doesn't cost you a lot of time you need to spend elsewhere and if you can do it as part of some strategy. Don't just blog to blog.

57) strong disagree. Care about what you are netting and keep track of which sales are netting you money and which ones are losing. Get rid of the losing ones. Revenues are nice for a flip or a crash-and-burn strategy but at some point you're going to run out of infused cash and you'll have to stand on your own 2 feet. Don't be caught out with lots of revenues and negative profits when your growth plateaus. If you do you're dead.

60) I'd hear them out first.

62) that seems to be one for the FAQ.

63) Hm. They're all likeable, at least most of them. Turning up the charm when talking to founders is something VCs have down pat. That doesn't mean that you shouldn't be looking very closely at the terms sheet. Don't like something? Strike it and see if the deal stands. If not then walk. You don't need to sleep with them, you need to find a good partner. If you like someone but they screw you over afterwards that contract is all you have.

67) weird.

68) depends. If you're in enterprise IT then make that 6 months. Those sales trajectories can be very long.

71) Wonder what Brin & Page have to say about that.

73) You do have boundaries. You need your rest or you'll mess up for all your other clients. If a client is important enough that they can call you at night then by all means, serve them but reserve that privilege for a very select group or you'll be looking at burning out in a year or two.

76) Don't borrow from the business if you have partners. Pay everybody or pay nobody.

81) Find a good middle ground between the two, it can be done.

82) rubbish. For a VC your private life is not as important as it is to you. If a VC I worked for told a founder to quit their relationship I'd resign on the spot. It's none of their business, really.

90) not every business revolves around traffic. Some business I know have _very_ little traffic and are immensely profitable.

94) No, but make sure you're not accidentally violating your contract.

99) That's really up to you. Don't sell if you don't feel like it. Ask Mark Zuckerberg.

100) Some people do.

<comment><USER14> This is only your fourth longest comment.

Your longest is [https://news.ycombinator.com/item?id=943618](https://news.ycombinator.com/item?id=943618).

Ask me how I know that ...

<comment><USER13> Ok, you got me there :)

So how do you know that?

And if you know that, do you also know what is the longest comment?

At a guess, you've scraped all of HN into a db.

</comment></comment></comment><comment><USER15> This is way too narrow in general, and a number of the points are just wrong. He spends a lot of points talking about "clients" and "revenue" like every successful company has those right off the bat.

My absolute favorite is the irony of #21 (Should I focus on SEO? No), when this post was originally published on Quora.

</comment><comment><USER3> I love this list. If you follow James Altucher for some time, this is basically all his experience very much condensed.

As with all advice, it certainly does not apply 100% all the time for your context. But this is some sound advice from someone who has a bit of experience building business, both successful and failing.

</comment><comment><USER16> There is no one size that fits all. I've been following JA for the past year or so. He has unique business story but he sells his advice like it'd apply everywhere. Buyer beware.

</comment><comment><USER17> The one I love the most is : 13) Do you listen to venture capitalist? Yes, of course. They gave you money. But then don't do anything they ask you to do.

<comment><USER18> The corollary to that one is: Never give VCs control of your company.

</comment></comment><comment><USER19> 90) I have no traffic. How do I get traffic? Shut down your business.

</comment><comment><USER20> My biggest issue with this article is the use of "her" in the question, "when should I have sex with an employee?". Can people who are interested in men not run businesses? That's not even subtly sexist.

<comment><USER21> Whether it's a him or her, a boss having sex with an employee is probably a very bad idea:

\- If your partner ever has a disagreement with you about their job or if the relationship ends on unfriendly terms, they can turn around and hit you with a sexual harassment lawsuit that you can't afford (either in terms of expense or time).

\- It will be a morale-killer for other employees, who will think your partner is getting preferential treatment (whether it's true or not).

\- If the employee you're sleeping with isn't doing their job well, it will be harder to fire them (due to emotional baggage and/or threat of a lawsuit).</comment></comment>


NVIDIA Introduces TITAN V GPU, Original AI Generated Star Wars Themes Music - <AUTHOR> https://blogs.nvidia.com/blog/2017/12/07/titan-v-launch/ <comment><USER2> >110 teraflops

Mother of god. I know that those Flops are low-complexity and low-precision, I know that the "real" double-precision performance is ~7TFlops, but that's a staggering amount of performance for a $3000 PCIe card. By way of comparison, the fastest supercomputing cluster in the world in 2006 (BlueGene/L) could sustain 280 TFlops, burning 1,433kW in the process.

I just hope that we eventually see a 1080ti replacement based on the GV104 GPU that isn't completely gimped for ML. A $700 card with 80% of the ML performance of Titan V would be a complete game-changer.</comment>


A new approach for tracking, without electronic devices - <AUTHOR> https://www.golocateme.com/ <comment><AUTHOR> The GoLocateMe QR wristband can provide all necessary data; name, age, medical restrictions, and guardian's contact details. Scanning the GoLocateMe QR will also track the location of the scanner (and the lost subject) and automatically notify the guardians by SMS and email. Simply fill out the details, print and cut out the QR, and you're ready to go with much more peace of mind, knowing that in case of need, you and your loved one will soon be reunited, with the help of others.

What do you think, is it something you will use?</comment>


Ask HN: What is your favorite data structure, what have you done with it? - <AUTHOR> Would like to check out and learn from practical and interesting implementations of data structures <comment><USER2> Aguri tries, which are bounded-sized radix trees with an LRU aggregation rule of joining sibling nodes.

The motivating use case is tracking metrics for IP addresses. You insert individual IP addresses into the tree, and when the tree fills, it starts rolling nodes for /32s into /31s, /30s, &c. Eventually, you get a picture of ranges of IP addresses in the data. That's neat, because, of course, IP packets themselves don't tell you anything about what subnets their IP addresses belong to.

The goofy thing I've done with them is apply them to memory addresses, so that I can collect individual pointers and bubble them up into allocation ranges, without instrumenting allocators.

<comment><USER3> Does it collapse under IPv6?

<comment><USER2> Nope, should work fine. (The idea, I mean; I don't think there's an Aguri implementation that does v6 right now).

</comment></comment></comment><comment><USER4> I like when a simple data structure works in harmony with a simple algorithm to get really good performance. Like the algorithm would be completely mediocre if you replaced the data structure with something naive, but the data structure "unlocks" it and makes it fast:

\- union-find data structure in Kruskal's minimum-spanning-tree algorithm, or for labeling connected components in binary images

\- min-heap in Dijkstra's single-source-shortest-paths algorithm

\- trie in the Apriori frequent-itemset data mining algorithm

Spatial partition data structures like octrees and kd-trees are really cool. Useful for anything that simulates physical space like games, graphics, CAD systems. Never implemented one myself though.

Least favorite is the red-black tree. It has nice theoretical properties but is so ugly and complicated. Most times I've thought about using one, I ended up choosing a hash table, trie, or sorted array instead. If I ever really need all its properties, I'll go all the way and use a b-tree for its cache friendliness.

</comment><comment><USER5> A simple data structure (tree), but the process of laying it out for visualization (the Reingold-Tilmann algorithm) is more complex than you'd think.

But otherwise, I am the datastructure equivalent of a Blubber programmer :(.</comment>


Angel Fears: Why I probably won't invest... - <AUTHOR> http://adii.me/2011/05/angel-fears/

<comment><USER2> That valuation technique is definitely crazy. It's completely backwards. You figure out what the company is worth and how much you're willing to part with, and then you sell that part for its portion of the total. You don't decide what the company is worth based on what you want.

At least, not if you want everything to be fair. The way they did it, 1 side of the other is getting the short end of the stick.

<comment><USER3> In fact, since there's no way to figure out what the company is worth, you come up with a number that you can get away with, looking mostly at what other companies getting similar investment are getting.

That's rational.

</comment></comment><comment><USER4> He brings up, but doesn't directly address an interesting question: How many angel investments do you need to make to start to bring the risk down?

I'm in a similar situation, I flirted with a couple of angel investments, but decided that an angel fund would expose me to 100 startups instead of the 3 to 5 that I would have the money and time to do individually.

</comment><comment><USER5> I rarely see so much potential in something it appears worth dumping a ton of money into w/ little visible revenue opportunity.

Of course, a lot of companies that are now hugely successful are just those types. But how many have failed to generate any revenue for every one that has succeeded?

</comment><comment><USER6> So he basically says angel investing is risky so he won't do it. If you want something low risk go buy treasuries, sheesh.</comment>


Groupon proposes $8.5M settlement to a number of lawsuits - <AUTHOR> http://www.industryintel.com/news/read/3339497160/Groupon-proposes-US85M-settlement-to-a-number-of-lawsuits.html I've never had an issue redeeming Groupon offers. Has anyone had any issues with them in the past? <comment><USER2> I have never had an issue with Groupon and I have never heard of any of my friends or anyone in general having an issue with them.</comment>


BetterBible – The Bible has some issues. Let's make it better. - <AUTHOR> https://github.com/markjaquith/BetterBible

<comment><USER2> To better understand the project check out the commit history

[https://github.com/markjaquith/BetterBible/commits/master/bo...](https://github.com/markjaquith/BetterBible/commits/master/books/Genesis.md)

-11. And the angel of the LORD called unto him out of heaven, and said, Abraham, Abraham: and he said, Here [am] I.

-12. And he said, Lay not thine hand upon the lad, neither do thou any thing unto him: for now I know that thou fearest God, seeing thou hast not withheld thy son, thine only [son] from me.

+11. And the angel of the LORD whose name was Ashton Kutcher called unto him out of heaven, and said, Abraham, Abraham: and he said, Here [am] I.

+12. And he said, Lay not thine hand upon the lad, neither do thou any thing unto him: for I was pulling thine leg. Thou art Punk'd.

</comment><comment><USER3> > Make it something that we can relate to. Jesus didn't address a topic? Well > in this version, he can.

"Mommy, did Jesus really say that lisp isn't a programming language, but a construction material?"

<comment><USER4> "Jesus, what does the fox say ?"

</comment></comment><comment><USER5> As a Christian, I find the honest clarity of the project's goals rather refreshing as some bible translations have agendas other than proclaiming the word of God.

</comment><comment><USER6> Perhaps we could work on something relevant?

</comment><comment><USER7> I've always been amazed by how people can change the Holy Bible.

If you don't like it the way it is, just don't apply what's in it. Why the need to alter it.

That's like altering Shakespeare's work to modernize it, using "new" English. It became what it is today the way it was written, why change it. Just weird.

PS: I'm not Christian. Maybe that's why I'm baffled.

<comment><USER5> If you're curious about the changing the Bible - there's a split in Christian thought about the it. Some view the Bible _being_ the word of God, and some view that the Bible _contains_ the word of God. The later group tends to be more apt to expound and modify the bible for reasons of clarity and emphasis. The first group tends to be grumpy about that. :)

<comment><USER7> Yeah, I'm well aware of that. I just find that altering a religious book in any way feels kind of funny.

If I don't agree with it, I'll just do my thing but I mean, why would I change it for _others_ too. We'd have as many religious books as there are people that way.

But then again, maybe God opensourced his word saying "Thou shalt fork me on GitHub".</comment></comment></comment>