Ask HN: I've had some software developed, now the coder is holding me for ransom. - <AUTHOR>

I'm not a hacker/coder, but I've hired a coder to create me a desktop app using JAVA swing that I planned to sell.
I hired him in August 2008, he quoted me $2500 and said it would take two months. Its now almost april and hes almost finished. Throughout the process hes been angry, rude and keeps talking about how incredibly patient he's being with me.
I offered him 10 percent of profits, just because I thought I might as well seeing as my initial investment looked like it was going down the pan anyway. But hes been holding me ransom the whole time, basically wanting more money, a lump sum at the end of development and he wants my investor (who may invest a modest amount in the software) to buy him out.
What can I do? I cant afford to pay him bonuses, I dont want to give him more percentage and I definitely want to try and get him off my back and cut him out of the project.
I'm thinking the best way would be to get someone to reverse engineer the software so I have complete control over it. It currently authenticates the user on startup using a script on his server.
My question is, can anyone tell me what the best way to do it would be? Is reverse engineering Java Swing apps doable? Im thinking I should hire someone of Rentacoder to do this and just get this headache over and done with.
Thanks for any advice. <comment><USER5> Simple...sue him.

Dude I'm in your exact situation...hired someone to do a project, and he is now a year late. I gave the guy concession after concession just to get him to finish...hell I cut about 70% of the features just to have him finish quicker. And told him...as long as he finish quickly I'd waive the late fees.

You can't work with these people...even after all my concessions the guy still gave me major attitude when I demanded that he hurry up or I'll sue him.

So Monday I'm getting the lawyers involved. Not sure about your situation, but I had my guy sign a contract that specified late fees. So its a little easier to sue him, since the late fees will more than cover lawyer fees. Of course since you have a smaller amount, you can try your luck at small claims court.

<comment><AUTHOR> I'm very tempted to get the lawyers involved, but that will be expensive, take a long time and might not be worth it.

Sounds like you have a similar problem, at least Im not the only one.

I waived any late fees ( I didn't even mention them) and offered him bonuses if he finished within a certain date (he didnt but hes still demanding them).

Its amazing how angry he gets when I ask in the politest way possible that he show me some progress, even when he's 6 months late!

<comment><USER5> You don't need a lawyer for small claims court. You just pay the small fee(something like 20 bucks) and you get to present your case in front of a judge. And the small claims court case really won't take that much time. Chances are, you'll be presenting your case within 3-4 weeks.

I would give your guy the ultimatum right now. If your experience is anything like mine, it'll be faster for you to hire a replacement(who'll be paid upon completion) to finish the site from scratch, than it'll take your current guy to finish.

</comment></comment></comment><comment><USER6> Have you paid anything yet? Don't.

Drop him. Here are two good reasons to drop him:

1\. You are wasting your time -- I don't think he'll give you anything, or you'll end up spending so much money that profits are unreasonable.

2\. Even if he does, what guarantee is there that there is no "surprise" hidden in the code? I have seen freelancers do that when they're disappointed in the buyer.

Find another guy and learn from your mistakes:

a) Pay weekly, based on milestones.

b) Setup a Subversion repository and do a mandatory weekly commits. No commits, no money.

c) Ask for a very short but functional proof-of-concept first, once it works and you have received source -- pay money by this formula: $ = rate x hours.

There is no trust between you and freelancer and you should never work without at least a bit of trust and understanding of each other.

<comment><AUTHOR> I paid him more than 2000 dollars of the fee already unfortunately. I've learnt a lot from this, specifically that even really good coders (or any professional) can be very good at what they do but still be completely unreasonable and willing to screw you.

<comment><USER7> He's not a really good coder, really good _programmers_ don't work for peanuts. Good programmers in America make anywhere from 6k to 10k a month, what exactly do you think you're going to get for 2k?

For the price you're offering, you won't find any _good_ programmers that'll work for you, you'll only find hacks who _think_ they can and are more than willing to take your money while learning.

If you think you can spend 2k to have some monkey write some code for you that you're going to sell and make a ton of money with, you're sadly mistaken. If you think your idea is with 90% and he'll do all the work for 10% and 2k, you're also sadly mistaken and very like to be taken, as you clearly have.

If you think you have an idea that's worth anything, you need to find a good programmer and bring him on as a full partner, he'll be the one doing most of the work and offering anything less will be insulting and unlikely to work out for you. He needs to be as vested in the success of the endeavor as you or it'll likely fail.

If you just want your idea implemented by a contractor and you keep all ownership and a reasonable estimate is that it's two months of work, then you're looking at 10k to 15k to get it done right by a competent programmer, not 2k. You'll get what you pay for.

<comment><USER8> One programmer I know was making $16k per month, and that was salary. People who assume more of the risk tend to make more than that.

<comment><USER7> That's nearly 200k a year, that's certainly not typical. What was his specialty?

<comment><USER8> No, it's not typical for programmers as a whole, but it's typical of his specialty, which is quantitative market analysis. He quit to do a Web 2.0 startup for a lot more money.

</comment></comment></comment></comment></comment></comment><comment><USER9> Cut your losses. At some point you have to admit to yourself that you've been had and you won't get any kind of compensation. You're just wasting resources. Next time you'll be more apt at heeding the red flags.

<comment><AUTHOR> I feel like I've put enough time into this (not to mention money!) that makes it very hard to do that...

<comment><USER10> It may be emotionally hard to cut your losses, but it may be economically sound.

There's a concept in economics called "sunk costs". You can't recover your investment, so whatever your choice, the money's gone. The only choice you have at this point is: do you continue or do you stop?

Since it looks like you have to pay more for continuing (and maybe even more after that) you should contrast that to the costs of starting over. It may be better to stop and try again if that's cheaper. It feels terrible, but it can be the best choice.

<comment><USER11>
      There's a concept in economics called "sunk costs"

In Poker its called "knowing when to fold"

<http://en.wikipedia.org/wiki/Betting_(poker)#Fold>

</comment></comment></comment></comment><comment><USER12> First question: Has he released any source code to you yet? You mentioned in one of your replies that he's met (and you've paid for) two milestones. At either of those milestones, did you receive the code? I assume you don't but I figured I would ask.

Second question: You said, "I offered him 10 percent of profits" - did he accept? Was that part of the written agreement or an oral offer? My thinking is that he's probably going to ask for more and more as he gets closer to finishing and, if you do decide to totally back out and start over, this is important.

Third question: What will he do with the code he has written if you decide to end the project? Will he release it for free, market it separately, or...? Does your contract cover that?

</comment><comment><USER13> To answer your question, Java is very easy to reverse engineer. Google for a decompiler. Several years ago I would get an almost perfect copy of the original source, with the proper variable names, etc. The only thing missing were comments :)

The legality of you reverse engineering the software is a different matter. But if you have paid the $2500 in question, then you own it.

<comment><USER8> Whether you own the software or not depends on what the contract says. It is entirely legal to sign a contract to perform a service for somebody for some amount of money without assigning them copyright in the results.

</comment></comment><comment><USER14> I've been in similar situations. As others here have pointed out your time is the most valuable thing on the line here and there's a big danger of wasting a lot of it if you sue. Here's one way you can handle it:

1\. The quality of the work is probably middling to poor...

2\. ... so figure out how much of your time $2k and the code is worth to you.

3\. Hopefully you're friendly with an attorney. Print out all of your documentation for this deal, sort it chronologically, and run it by them to see where they think you stand.

4\. Provided #3 turned out okay have your friend send a letter asking for the deliverables or a refund.

5\. Be prepared to either walk away or negotiate an agreement both of you are equally dissatisfied with.

6\. If you walk away be careful about using the binaries you've got, this guy may have rights to the profits even with everything else that's happened.

</comment><comment><USER15> okay, first, you can't use html in an hn post for formatting. you should go back and add two-return-key paragraph breaks, so your post will be readable.

second, getting someone to "reverse engineer" an existing app is a very bad idea. you're already in a bad situation, that would make it even worse.

assuming you find someone to do this, they are going to be morally questionable. i, for one, would never agree to do such a thing, not for any price.

if you're not happy with the work you're getting, you should have said so a long time ago. if the terms you've negotiated so far allow you to do so, i'd offer him some smaller amount for the source code and call it a day. if he says no, hire another coder to start again from scratch.

2500 bucks is not very much money to lose. i just lost six months of my time working on a startup that didn't pan out, for which i received a grand total of 1500 bucks. given how much i was making at my last full-time job, that's an opportunity cost to me of about 50 grand. but i'm sure as hell not going to make things worse by mucking around in the situation any longer. i took my lumps and i'm moving on.

<comment><USER11>
      okay, first, you can't use html in an hn post for formatting. you should go back and add two-return-key paragraph breaks, so your post will be readable.

I had the exact same thing happen to me the other day when trying to submit a poll, it popped up
 tags all over the place, so I'm sure it's not the guys fault.

I had to go back and edit the thread to make it readable after someone pointed it out to me.

<comment><USER15> oh. huh, didn't know that.

by the way, by putting a couple of blank spaces at the beginning of the quote, your comment is causing the page width to get stretched out.

<comment><USER16> froo may be using a browser where that isn't evident.

Until PG fixes, you can fix this yourself client-side with a bookmarklet or a greasemonkey script. See ...

<http://news.ycombinator.com/item?id=437002>

</comment></comment></comment></comment><comment><USER17> _I've hired a coder to create me a desktop app using JAVA swing that I planned to sell._

You might be asking for advice in the wrong place.

If you want to make money selling desktop apps, the advice you'll likely get from this crowd is "learn how to do it yourself." Otherwise, give your coder at least a 50 percent interest in all of the proceeds from this app.

Given what you tell us of his reaction, it sounds like you might be offering him an insulting percentage; think about it like: where would your idea to make a quick buck be without somebody who writes code?

Sometimes it's all about respect; other times it's about credit (being known for coming up with X); and still sometimes it's all about money, but most of the time it's a combination of the three. Find out what his combination is.

<comment><AUTHOR> I appreciate that I can't write code, he has a skill I don't have. But I hired him to do it, he agreed a price, but hes now almost a year late and despite me offering him bonuses, 10% of the profits, hes still holding me to ransom and wanting more.

If I hire someone to build a house they don't get insulted when I offer them 10% of future rental yields. How can it be insulting to offer a percentage which wasn't even in the initial agreement?

<comment><USER18> A programmer views "a year late" as, makeing him do more work than he was contacted to do. House construction doesn't work that way. You hand over a detail plan diagram and the contructor develops exactly that. One doesn't break down half the house after it's 80% done to build it a different way and check how it looks. Though that happens frequently in software development.

Most probably than not, this programmer can work a year more on this project and still not "finish" it in real sence. Specially if there was no specific finishing point mentioned in the agreement.

Software rarely gets finished. All these might be the programmer's point of view, just wanted to mention.

<comment><USER19> To add to this: I recently finished a small contract that I took on for the sake of family (don't do this, by the way). As a general rule I don't take contracts from people who don't know how to program, for the following reasons:

\- They don't know how to write a specification. It's like asking a non- architect to draw you blueprints to a house. You end up with things like "there should be an arch here that's... um... about this tall".

\- They don't actually know what they want 80% of the time. They will tell you (and you will document if you're smart) how they want it built, and when they see _exactly that_ they will turn around and want it another way.

\- They have absolutely no appreciation for how much work you're actually putting in. "But it's just a button on a page!". It's often insulting to work with people like this.

The spec for my contract changed constantly, and in the end took twice as long as I had anticipated.

And I still haven't gotten paid.

</comment></comment></comment></comment><comment><USER20> Give up and start over with someone else.

$2500 for 2 months of work comes out to 8 dollars an hour. This isn't a good wage for a programmer anywhere and should have been your first hint that this wasn't going to work out.

<comment> a-priori I assume the programmer is not working on this project full-time.

<comment><USER20> Even so, $2500 is less than a week's worth of work for anyone good.

<comment><USER21> In a salary or for freelance? I think salary hours are typically 0.5 * freelance hours, is that right?

So inside a company, $1250 is less than a week's worth of work for anyone good?

<comment><USER20> Freelance. Salary-wise, $1250 a week is about $62K per year which anyone with a pulse can get in silicon valley.

<comment><USER21> So what does anyone good get then? (salary-wise)

</comment></comment></comment></comment></comment></comment><comment><USER22> As an Indian living in Bangalore, I feel odd saying this, since I know that the myth of the "substandard outsourced coder" is largely just that - a myth _IF_ you know what you are doing, but that said, but do _not_ use sites like rentacoder or try to save money by outsourcing unless you personally know someone good.

Find out the market rates for a good developer in your area and pay a decent wage commensurate with the time taken to write good software (2500 $ isn't much even here in Bangalore, I think the guys is just taking you for a ride, unless the software is _very_ simple in which case it can be rewritten trivially) .

Try to meet up with the developer every 3 or 4 days (or at least talk on the phone) and as someone mentioned here, own the repository he checks into.

Good Luck!

</comment><comment><USER23> A reality check for you.

First, $2500 covers 50 hours of work. Do you think your app can be written in that timeframe ? Hardly. So this amount is not a compensation, it's more of a marginally attractive retainer.

Second, the 10% share is a joke. The reason being is that if there is a written app, then 10% _commission_ gets you a simple e-com distribution (shopping cart, invoicing, payment processing). The 30% commission buys you a "fire and forget" kind of deal - you give the distributor an app, they brand it, promote, market and sell it and they also provide front-line support. THIRTY PERCENT.

You effectively offered a guy a 90% commission deal and now seem to be surprised he isn't happy. I wonder why.

<comment><USER13> Nonsense. Once the developer accepts a $2500 offer he is obliged to do his part of the deal. Not to mention that $2500 can be a lot of money for a lot of people.

The 10% share of profits is a sign of good will on behalf of OP. It was not part of the original agreement and in that question is ridiculous to complain that it is too small. The developer is not a cofounder, he is a freelancer.

I'm sorry but contractual obligations will always come before what seems fair or not.

<comment><USER23> Which part of what I said is a "nonsense" exactly ?

I merely pointed out that ($2500 + 10% of profits) is a patently bad deal for the developer and it explains the sour state of affairs that they both ended up with.

The fact that the developer is not upholding his end of a deal is another matter. I haven't commented on it.

</comment></comment></comment><comment><USER24> $2500 will barely cover about 100hrs of effort (2.5 weeks). So a $2500 is a really simple app. If he has put that effort already consider that you have had your moneys worth.

Likely, he was thinking of a one bedroom house. You were thinking swimming pool, gourmet kitchen, etc, etc. Professional software developers know how to deal with it. The lesson is easily worth $2500.

</comment><comment><USER25> Cut your losses. You need to work out, what's worth more - the time or the money.

You could start legal proceedings and 2 months down the line see someone else launch your product... I'm one for speed.

</comment><comment><USER26> To the original poster on this topic...

I know you made a deal with this developer but the fact that your original deal was to build your app within 2 months and it has been almost a year now - you REALLY need to walk away. It hurts both emotionally and financially, but based on all the feedback you've received - you should really consider what the community is telling you and move on.

I write software for a living and I have been in positions where other contractors have written software for my groups so If I ever made a deal with someone that included having software done in two months - waiting almost a year later for the project to be completed is just plain ridiculous and totally unacceptable. Especially when you take into consideration all of the things that you have mentioned.

It hurts us to hear about your story, we wish you the best but help yourself and start over. Take what you have learned from this experience and apply it to the next iteration. The fact that you've worked through a lot of questions, issues and the conops of how your application would work - take this experience and knowledge and find someone that comes recommended and is trusted and give it another shot.

Best wishes.

</comment><comment><USER27> I'll agree with the others and say drop this guy without a second thought. That said, if you wrote the contract to include disclosure of source code you should be able to legally ask for it. That said, $2500 is a relatively small amount when we're talking about a complete system with source code rights. Your best bet is likely to file for small claims (usually costs you between $25 and $250 depending on the amount, and you can only file for up to $2500 here in Florida). You likely will not make it to court, and he'll settle. Why? Because everyone fears litigation, especially when they're wrong.

Next time around, write the contract the way you want it to read, and account for failures. Make certain everything is in writing, even if there is a deviation agreed upon by both parties. And above all, get what you paid for in increments and never pay in full before the project is done.

As a developer, I respect the 50/50 plan as well as the hourly one. 50% up front to cover development costs, 50% at the end to ensure I finish. Works like a charm.

</comment><comment><USER28> Didn't you come to any kind of written agreement on your DEAL? If not You have to be very careful of every step you are planning to take.

I suggest you to be flexible in this matter & take a step which would do less damage to your investment. I hope HN folks will come up with some good advices :).

<comment><AUTHOR> Well there was a written agreement, but the funds were released in 4 separate milestones.

However, once I'd released 40 percent of the money and it was slightly late, I'd already wasted 2 months and said goodbye to 40 percent of the funds, so I felt like I had to stick with it. A foolish move in retrospect!

<comment><USER29> Who owns the source code according the agreement? How were the milestones defined?

You can technically reverse engineer the code (it will not look exactly like the original). Depending on the agreement though, if the coder owns the source, you're probably better off not doing that.

Next time specify who owns the source in the agreement, and make sure that you're getting the source as you release the funds.

</comment></comment></comment><comment><USER30> I presume you (or your company) owns the IP. If so, fire him, take the code and find someone else (in this economy, that is not as challenging as it seems) to look at it. You will lose several months, but you will gain clarity and peace of mind (assuming you learn from this lesson and hire a better personality).

I went through the EXACT same situation with a Java developer last year. The developer extorted us, refused to hand over code, always demanded more money, was rude and insisted that he was doing us a favor. We finally let him go. Coincidentally, it was around August 2008!

Fire him and move on.

</comment><comment><USER31> I feel for you, sorry. If I could be so bold as to offer advice to anyone doing something in the future I would say:

Have a lawyer draw up a contract. Make it clear that you own the copyright to every line of code that goes into the revision control system that you own, and if possible, manage. Make sure the contract ensures you see the code often, making it a vital part of signing off any milestone. Always, always have a contract, even if you're out on this adventure with a pal. Money can't buy you friends but it most certainly can lose you some.

</comment><comment><USER32> Go ahead and get this guy to give you a full copy of your source code as it now stands. Since he did not finish the project in two months as specified in the contract - you have a written contract, right? - you can terminate the business relationship on the grounds of breach of contract. There should be no need to reverse engineer software that you paid for. The nature of the business relationship here is that you own full rights to the software. Best of luck to you as this sounds like it will be a real pain to resolve.

</comment><comment><USER33> I hire developers from time to time. I avoid the situation you are currently experiencing by asking for a development plan which includes milestones and a requirement for "reasonably" documented source code. After agreeing on a price, the fee is split based on the milestones, and paid as code is checked- in and the milestones are reached. If the developer doesn't meet the schedule or decides to bail on the project, then another developer can pick up where the previous "coder" left off.

</comment><comment><USER34> Yes reverse engineering is trivial (unless a very good obfuscator is used) if you have the binary jar files.

However, like others have mentioned, its highly likely there is nothing there of value - so you there is a pretty good chance you will have to write it off.

I have heard of similar things happening to this - commonly when the development is done in SE asia (have heard of several cases in the Philippines of this exact thing happening, interestingly).

</comment><comment><USER35> There is a lot to say on this, but much of it has already been said. I'll add just one thing:

An important red flag (among all the others in your post) is the statement that he is "almost" done.

When any programmer thinks about that statement, it's almost certain to elicit a belly laugh.

If he appears to be "almost" done, it is highly likely that he is really around 50% done. Keeping that in mind should help you make your decision to walk away.

</comment><comment><USER36> > I'm thinking the best way would be to get someone to reverse engineer the > software

You don't have the source code? He just gives you a crippled binary to demonstrate his progress which only works after authenticating with his server?

I'm not sure why people here are telling you that there is either some ethical or legal problem with taking control of the work you already paid for.

<comment><USER20> There is a legal problem. Unless the contract specifically states that the IP for the project belongs to the buyer, the software belongs to the programmer, even after it has been paid for. Threatening him with legal action is a waste of time.

<comment><USER36> This seems like a pretty basic thing for the contract to specify. What else would the buyer be paying for?

<comment><USER20> It's unintuitive, but most software contracts do not explicitly give the buyer the IP. It doesn't sound like either of the parties involved know what they are doing, so it's unlikely the contract gives the buyer any power over the IP.

<comment><USER36> A contract is only valid if something is exchanged in both directions. This is a legal principle called consideration, and in the absence of consideration a contract has no legal legitimacy.

Without some transfer of IP rights either by copyright assignment or by bare license I don't see what consideration would be for a contract to produce custom software.

If the contract is determined to be invalid the buyer can then make claims to the IP under the doctrine of promissory or reliance-based estoppel since they have built a business on the expectation that the software would be delivered with appropriate rights to distribute and modify it.

<comment><USER37> What precisely is transferred depends on the contract and the legal jurisdiction.

I have some clients that were gypped for a lot more than USD2.5k - <USER2> thought they were getting the IP and instead they were getting a non- transferable license to use (and the software was buggy and had - <USER3> - developer backdoors and remote off-switches).

Explicit terms in contracts is a very smart move; don't assume anything about what the local version of contract and tort law will deliver to you.

Of course, off-shored development makes it all a bit more complicated - <USER4> party actually holds source code and can be sued? It's a bit of a mine-field.

</comment></comment></comment></comment></comment></comment><comment><USER38> "It currently authenticates the user on startup using a script on his server."

 Wow, ridiculous. This should definitely be changed before project completion. You need to get more stuff in writing from the sounds of it.

 I don't want to scare you, but from the sounds of this post, I don't see things working out in a positive way.

</comment><comment><AUTHOR> Thanks for all the advice guys. I'm not from California or even the US, so I wasn't sure about my legal options here. But I've done a little reading and the advice here has helped a lot. It's amazing how solitary you can feel doing this sort of thing! Thanks to all.

<comment><USER8> What jurisdiction are you in? That might help people give you better advice about legal options.

<comment><AUTHOR> I'm in San Fransisco...

</comment></comment></comment><comment><USER39> Tell him to provide the source code to you. You have a 90% stake in the product, you are of course allowed to have a copy of the code. When you have a copy of the code, make your terms clear.

</comment><comment><USER40> what does the _contract that i hope you got signed_ say?

if you didn't get a contract signed, you kind of brought this on yourself. if you did and he's violating the terms, take him to small claims court.

if there isn't a contract, consider walking away and finding someone else to do it.

i'd highly suggest avoiding rentacoder and simlar sites. they do not typically produce high quality work, and there is often a language barrier issue.

</comment><comment><USER41> Walk away. There is no point in having the relationship when trust can never be there.

</comment><comment><USER16> It's a bad working relationship, you have to end it. The only question is how to salvage something.

If you've paid for work so far, and your contract gave you rights to the source code, demand the source code. You could hand that to another developer and it might be of some use.

If he won't provide it, and especially if he's local, sue in small claims court for your money back.

If you have a running version without source, you could rebid this elsewhere and use both your previous correspondences and the working version itself as a new spec to accelerate the new work.

If it's truly $2K worth of work by an ornery contractor, it can likely be reproduced for about the same cost. But it's also possible that he was way undercharging you and that's why he's become ornery.

If you have a working code delivery but not source, Java code can be decompiled to recover somewhat useful source code. However, unless there's some fancy custom algorithms/graphics/etc. in your app, a basic 'Swing desktop app' might be easier for a new contractor to build from scratch in their style than try to reuse something from an unreliable coder. Only go the decompilation route if you are confident of your rights to the work (because it was clearly a work-for-hire with you receiving the rights under your written contract, and you haven't orally modified that contract in your pleadings with the developer).

Rentacoder and other sites really help prevent a lot of these problems by nudging people -- especially those new to software development -- into doing things the right way... having a clear contract, planning for likely delays, staging things, getting multiple bids for comparison, etc.

</comment><comment><USER42> _Its now almost april and hes almost finished._

Call me skeptical, but...

:)

</comment><comment><USER43> You were cheap and you've been had. Learn two lessons and move on.</comment>


Chinese virologist posts report claiming Covid-19 was made in Wuhan lab - <AUTHOR> https://nypost.com/2020/09/14/chinese-virologist-posts-report-claiming-covid-19-was-made-in-wuhan-lab/ <comment><USER2> Also, these submissions link directly to the paper discussed in this article: [https://news.ycombinator.com/item?id=24476300](https://news.ycombinator.com/item?id=24476300) [https://news.ycombinator.com/item?id=24476929](https://news.ycombinator.com/item?id=24476929) [https://news.ycombinator.com/item?id=24477162](https://news.ycombinator.com/item?id=24477162)

</comment><comment><USER2> Direct link to the paper: [https://zenodo.org/record/4028830](https://zenodo.org/record/4028830)

I posted what appears to be the top comment on the previous submission of a similar paper describing the probable laboratory origins of SARS-CoV-2 ([https://news.ycombinator.com/item?id=23875758](https://news.ycombinator.com/item?id=23875758)), so I'll try and do another quick summary here. (Caveat: I have no particular expertise in this area, I just read a lot of scientific research)

The lead author here is an immunologist who, unlike the authors of prior papers alleging laboratory origin, is Chinese and was trained in Chinese institutions. At the time of the outbreak Dr. Li-Meng Yan was working in a public health lab at Hong Kong University and was asked to investigate. She claims that she fled to the US after realizing that there was a cover-up going on and she knew too much already.

The most striking and novel claim made here is that the bat coronavirus RaTG13, which is a 96% genetic match to the novel coronarivus, is a total fabrication. This argument is based upon a few key observations:

1\. RaTG13 was supposedly discovered in 2013 but not publicly reported until after the outbreak already started, in a paper (published by researchers closely affiliated with the WIV) that claimed it as evidence SARS-CoV-2 likely originated from bats.

2\. A number of independent preprint papers raise significant concerns about the veracity of RaTG13, and one published paper indicates that the RaTG13 spike protein is actually ineffective at binding to ACE2 receptors in horseshoe bats (the supposed reservoir).

3\. After excluding RaTG13, the next closest relatives are two bat coronaviruses (ZC45/ZXC21) that were discovered and characterized by Chinese military research labs. A Chinese lab published research near the start of the outbreak which identified these viruses as the closest relatives, and that same lab was apparently closed for "rectification" shortly thereafter.

The paper goes on under the assumption that ZC45 or ZXC21 was the backbone for engineering the SARS-CoV-2 virus, noting how the particular characteristics of the genomic match (100% E protein, 94% Orf8 protein) align with what one would expect after the gain-of-function modifications that produced the unusual RBM and furin cleavage site which were also identified in the Sørensen paper. This paper goes into much more detail on those two points, and provides counterfactuals to describe how unlikely these observations would be in a naturally-evolved virus.

In the second half of the paper the authors describe in detail how a lab with sufficient technical acumen could engineer a virus like SARS-CoV-2 through a sequence of well-defined steps, with references to published research demonstrating these capabilities. Then they postulate the exact components involved in engineering the actual SARS-CoV-2, along with a projected timeline of six months for the whole process.

<comment><USER3> note: your paper link contains an unnecessary fingerprinting element after the # symbol, which can be removed (including #)

<comment><USER2> thanks, removed

</comment></comment></comment><comment><USER3> previously: [https://news.ycombinator.com/item?id=23875758](https://news.ycombinator.com/item?id=23875758)

(from a different scientist)

</comment><comment><USER4> Why is this obviously false conspiracy theory being spammed so hard on HN today?

<comment><USER5> Why obviously false?</comment></comment>


R in Ecology - <AUTHOR> https://blog.dominodatalab.com/r-in-ecology/ <comment><USER2> A lot of statistical analysis and R packages were pioneered for/by ecologists. In ecology we get some of the more complex and interesting data, and questions to be asked of that data. For example, the popular R package vegan was made for ecological analysis.

<comment><USER3> My sense is that ecology tends to have more on spatial covariance (along with epidemiology), psychology on building scales out of latent factor models, and economics on temporal covariance.

(although there is substantial overlap between the three)

</comment></comment><comment><USER4> > I'm a bit of an R nerd. Ok, that's a lie; I'm a major R nerd. But for good > reason, because R is incredibly useful in streamlining the scientific > process, and increasing the ability to replicate findings with less human > error.

If only we could make the spreadsheet not get used by most scientist it would be a better place.

<comment><USER5> Agreed. The `raw` data collection should be transparent and in a format that is not locked into Excel spreadsheets.

<comment><USER6> I'm no big fan of excel, but the modern xlsx format is "open", in that it's documented (though maybe not perfectly). It certainly is possible to read data from it using a variety of open source packages, from LO Calc to libraries like pyxl.

<comment><USER4> It's not that it's open it is that all the steps are seen and can be repeated. Excel is just manual labor without seeing how the person took the raw data and got to their conclusion.

</comment></comment></comment></comment><comment><USER7> I don't find the title misleading, but I think it's worth noting that the message isn't very R- or ecology-specific. The message is something like "if you do science, you should use scriptable data processing tools."

edit: I guess the message I described is on top of the more specific message that R, specifically, works well for ecology, specifically.</comment>


Find the sun in any image with Python and PIL - <AUTHOR> http://pythonicprose.blogspot.com/2009/09/python-sun-image-detector-outline.html

<comment><USER2> I'd like to see what this does to a night-time skyline of a major city.

Edit: turns out does <http://i.imgur.com/EK0cO.jpg> -> <http://i.imgur.com/wOWje.jpg></comment>


Using select(2) the right way - <AUTHOR> http://aivarsk.github.io/2017/04/06/select/ <comment><USER2> I have worked on servers that had this problem with select(2). poll was better but kqueue was much much better (from near-100% utilization with a few thousand open fds to < 1% cpu utilization; please forgive the vague numbers, it was 7 years ago at a company that I no longer work for).

If you're using nonblocking I/O, or threads, select can become the bottleneck with a few thousand interesting connections at sizes that are much less than the FD_SETSIZE max.

The user-space CPU utilization should be near-0 since this is really a kernel I/O problem; the fact that it is much higher is an indication that a lot of wasted user space work is being done.

Select, by design, has a flaw: the kernel must scan the bitmask for the highest-numbered fd passed in, even if there is little change in the fd_set bitmask (as is usually the case). This means incurring a cost if any fd in the set has a high fd number. The fd on which you accept probably has a low number, but your client I/O fds will have increasing numbers as the server gets greater and greater utilization.

kqueue (and epoll, but I haven't used it) resolve this problem nicely. Only things that change state must be communicated. poll is better than select in this respect if the array is sparse, but if a large number of fds are interesting, it will also get expensive.

<comment><AUTHOR> What you wrote about the design flaws of select is correct but a feed set with 10,000 sockets is just 1250 bytes or 157 longs and hardware is very good at sequential memory access. I agree it will be slower than kqueue or epoll for long-lived connections because there is more work to do for the kernel and application but for many applications select is good enough when used correctly.

I have my doubts about select causing 100% cpu utilization, I suspect you were doing other suboptimal things as well. The sample code I wrote is running well with both 100 and 10,000 connections. I have my own anecdotal evidence where application was barely handling just 100 mostly inactive connections and OPS guys suggested limits of just 50 connections per application. After I fixed how feed sets were created and how the result of select was processed the same application was running just fine with 8,000 connections. We had to support Linux, Solaris, AIX and HP-UX at that time and select/poll were available on all of them. That's why I invested time in optimizing the code instead of switching to epoll. OPS guys still suggested limit of 1,000 connections per application but this time it was for availability and other non-performance reasons.

<comment><USER3> In my experience, there's definitely a point where poll() beats select() when handling lots of connections, long-lived or short-lived. But at that point you are much better off moving to epoll() or kqueue() depending upon the OS. And if you support those syscalls, there's little point falling back to select().

For most people, if your program is handling 10s or 100s of concurrent connections, select() should be just fine.

If you are going to be handling more, it's worthwhile looking into the other syscalls to improve performance. In any case, I'd recommend abstracting away the event handling so that you can switch between different syscalls and can use benchmarking to try to replicate the traffic you want to handle. There's lots of libraries that will do this work for you, unless you need to get into the low-level stuff.

Trying to judge the syscall performance based on reasoning about amount of data transferred between your program and the OS, number of syscalls etc, is very difficult. You are much better off measuring the actual behaviour. For example, epoll() seems like a terribly designed API to me as it involves making many syscalls (whereas kqueue() is just one per loop). However, I found epoll() was very high performance. I guess the cost of syscalls on Linux can be very low in some cases.

<comment><USER4> systems calls on linux that deal with per-process state try very hard to not invalidate userland memory mappings.

The kernels _real_ range and userland's _virtual_ range won't overlap so for a lot of functions kernel memory just has to mapped/unmapped on call, not invalidate _all_ userland bindings.

Well okay they will overlap. So yeah your mappings may get invalidated but for synchronized higher performance systems calls they _shouldnt_.

This lets them be in the 10's to 100's of nano-seconds.

Normally the most _expensive_ part of a linux syscall is the TLB misses after one.

\---

Your model of memory transfer size assumes data is being copied.

The Linux kernel has a lot of features to let userland, devices, and itself all share the same memory copy free.

<comment><USER5> This is wrong.

Kernel address space and userspace address space don't overlap at all. There's zero mucking with memory mappings, TLB etc. on syscall.

</comment></comment></comment></comment></comment><comment><USER6> I've written lots of servers in C and found this article quite interesting.

The techniques that the author presents are new to me and I know that I will take them into consideration when I write a server in C the next time.

More importantly, they are techniques that I think library writers should use. My uneducated guess is that the underlying implementations of servers in Node.js and Iron, etc, could be improved with these ideas, even though they might not be directly applicable since those servers are written in different languages.

I can't vouch for the results, but the author's experiments seem conclusive.

<comment><USER7> His allocating an fd_set to an arbitrary size is somewhat iffy standards wise, but if it works it works - especially for a solution for specific OSs like Linux, where this won't be broken in the future. On that note, it is worth wondering how expensive the copying is, but I would wager he is right in that the copying isn't actually that expensive - it's only an 8K buffer.

Also, when creating an array that is indexed by fd, if you want to only use the memory you need instead of creating an extremely large array for the max fd of the system you can just allocate the memory using `mmap`. Systems like Linux won't actually allocate all the memory right when you do the `mmap`, instead it will map in a zero-page in each spot. When you write to it, the kernel will automatically allocate a page to back that memory. When you combine that with the kernel always selecting the lowest fd, it means that the memory backing your array will only grow to be as large as needed for the maximum number of fd's you use. (Note: It's likely that such a large array would be allocated via `mmap` in it's own spot by malloc/calloc anyway, but using `mmap` ensures you get the functionality you intended.)

</comment></comment><comment><USER8> The thing that really resonated for me in this article was the point that for most of us, the performance of select() or accept() really doesn't matter, because any time spent there is easily dwarfed by application logic, database lookups, queries to other services, etc.

You only really need to care about this if you're working on something mainly concerned with the connections themselves, like HAProxy.

<comment><USER9> The right way to think about these kind of things is in terms of responsiveness. For example, when I think of any request intiated by a user, there is a ~200ms budget of time to service that request. If you can shave off a couple hundred micro seconds, those can be spent on returning a better answer.

Everyone has a piece to contribute to servicing user requests, and every should be mindful how much of the budget they consume. Using select (or epoll) more efficiently makes everyone elses job easier. It is important for everyone in the pipeline to think this way, you included. The user experience depends on it.

<comment><USER10> In a nutshell: performance still matters because your program isn't the only one running on the computer.

</comment></comment></comment><comment><USER11> Regarding this:

> epoll uses system calls ("slow") to add or remove descriptor to the set. > select does the same thing in userspace. If you have to add and remove many > descriptors per iteration which is typical for short-lived connections then > select might be more efficient.

I would have estimated that on a select system call the kernel needs to internally attach some kind of event listener for each passed FD and uninstall it before the system call returns. Which means select is interally a sequence of "iterate over all FDs, check if an event is available and if not install listener", "wait at least one event to happen" and finally "uinstall all listeners". While epoll requires only "wait for at least one event to be available and then iterate over the FDs and record all available events". So I would guess that while epoll requires more syscalls for setup it should be a lot more efficient if a FD is polled more than once. With edge triggering most of the registration/unregistration calls can also be avoided.

Or do kernels have special optimizations that make select internally more efficient than I described? Maybe some memoization of former used pollsets?

<comment><AUTHOR> [http://pod.tst.eu/http://cvs.schmorp.de/libev/ev.pod](http://pod.tst.eu/http://cvs.schmorp.de/libev/ev.pod) and search for "EVBACKEND_EPOLL (value 4, Linux)" to read how much fun epoll is :-D

<comment><USER12> Or read this: [https://idea.popcount.org/2017-02-20-epoll-is- fundamentally-...](https://idea.popcount.org/2017-02-20-epoll-is- fundamentally-broken-12/)

</comment></comment></comment><comment><USER13> A lot of the advice seems misguided, if not wrong. Rather than optimize around the limitations of select(2), I'd suggest using different APIs instead.

For example:

> Literature ussually says that fd_set is limited to 1024 descriptors but some > mention that you can increase that by defining FD_SETSIZE to a larger > number.

If you just need a one off tool for a few descriptors, why not just use poll(2) instead? No problems with high fd numbers, and the API is quite simple.

> To find out which sockets have events some loop through data structures and > check each socket they contain. But a much better way is to iterate through > fd_set as array of long and check 32-64 bits at a time.

If you've reached the point at which this trade-off matters, you're better off switching to a socket API that scales well (epoll or kevent) and does this filtering for you. Or like another commenter suggested, using a library that abstracts this functionality.

> select modifies descriptor sets passed in. A common mistake is to create > descriptor set from zero before calling select by looping through data > structures and adding all sockets they contain. I've seen that to take huge > amount of time due to locking and synchronization between threads. The > correct way is to maintain a descriptor set all the time and create a copy > of it and pass the copy to select.

Again -- if you've reached the point where this tradeoff matters, just go directly to epoll/kevent.

> Most programs will need to store some state associated with the socket. Map > seems to be a good choice at first but you should use an array indexed by > socket (it's an int). The POSIX API says that kernel always has to use the > lowest unused file descriptor when creating a new one. So the array will be > as big as many connections your program handles and kernel will take care of > finding a free slot in your array.

Maybe your program deals with non-socket fds, and the set of socket fds is fairly sparse. Using a map is actually pretty reasonable even if fds are dense.

<comment><AUTHOR> I probably should have started by telling it was years ago when applications had to work on OSes other than Linux and BSD (AIX, HP-UX, Solaris). Today it's libev or Boost.Asio.

> why not just use poll(2) instead?

Because as I mentioned later poll basically is the same as select but requires more memory to be copied to/from kernel and was slower in some test cases although I can come up with cases where poll will be faster than select. Networking libraries like libev and others allocate fd_set the same way.

>> To find out which sockets have events some loop through data structures and check each socket they contain. But a much better way is to iterate through fd_set as array of long and check 32-64 bits at a time.

> you're better off switching to a socket API that scales well (epoll or > kevent) and does this filtering for you. Or like another commenter > suggested, using a library that abstracts this functionality.

That's how kernel, libev and others work with fd_set.

>> The correct way is to maintain a descriptor set all the time and create a copy of it and pass the copy to select.

> Again -- if you've reached the point where this tradeoff matters, just go > directly to epoll/kevent.

Again -- libev and others do this

> Maybe your program deals with non-socket fds, and the set of socket fds is > fairly sparse. Using a map is actually pretty reasonable even if fds are > dense.

Yes, there might be cases where you have non-sockets and you can't use array indexed by socket. But it's great in most of the cases and kernel will keep it as dense as possible. It might be that you have 10,001 connections and then 10,000 are closed and highest socket is still in use and array memory is wasted. But it will not require more memory than during peaks.

libev use of select: [http://cvs.schmorp.de/libev/ev_select.c?revision=1.56](http://cvs.schmorp.de/libev/ev_select.c?revision=1.56)

</comment></comment><comment><USER14>
      unsigned long *wfds = (unsigned long *)wfds_out;

Unless fd_set has the same or stricter alignment requirements as unsigned long, and fd_set and unsigned long are compatible effective types, this line of code provokes undefined behaviour twice (breaks strict alignment and breaks effective type access).

<comment><USER15> In this case, it is most probably OK, because wfds_out comes from calloc(), which uses the largest possible alignment to work for any type (it returns void* and cannot know which types are inside the allocated memory, so it needs to assume the max on the architecture).

</comment></comment><comment><USER16> Another problem with select() is that trying to use a file descriptor above FD_SETSIZE in FD_SET() and the likes will actually result in overwriting the stack and will cause random segfaults in other areas of code. Note that sockets aren't the only thing using up file descriptors and it is quite easy to run into this issue. The solution is to use poll() as essentially a drop in replacement. Strangely the winsock version of select() acts more like poll and instead of a bitmask based on socket fds, uses an array of sockets so you can actually use a number of sockets up to FD_SETSIZE regardless of their file descriptor.

</comment><comment><USER17> Btw "ussually" instead of usually

</comment><comment><USER18> Does Apache web server use this trick?

<comment><USER19> In general it cannot, because it does not do asynchronous IO on "sane" platforms. (what it does/did on Netware might pass for async IO)

</comment></comment><comment><USER20> It took me a few seconds to realize this article is _not_ about select2[0], the javascript library.

[0]: [https://select2.github.io/](https://select2.github.io/)

</comment><comment><USER21> The correct way to use select() is not to use it. You should instead use a library designed to do at a high level whatever it was you were going to use select() for. This library will then (hopefully) figure out what your application needs as efficiently as it can, rather than you having to spend a week researching how modern operating systems work to finally learn that you should have been using a library to do what you were about to try to reinvent.

<comment><USER22> Are there really no applications for using low-level async I/O APIs/syscalls? Embedded systems? Game servers? Proxies? Software routers? Hidden command & control servers?

<comment><USER23> For embedded systems, LWIP has a socket API that supports select(). Try finding an event library for that one! I had to roll my own, and I learned quite a bit in the process.

<comment><USER11> Actually if you use the low-level LWIP (sometimes called Raw API) instead of the socket API it will be actually event-driven (singlethreaded, callback- driven, etc.) by design. The socket abstraction layer on top of it then provides blocking APIs and multithreading support - with the cost of a lower performance.

<comment><USER23> I'm planning to eventually migrate to the netconn API, but was deterred by a lack of documentation. Do you know of any sources? This doesn't help much: [http://www.nongnu.org/lwip/2_0_x/index.html](http://www.nongnu.org/lwip/2_0_x/index.html)

<comment><USER11> I also had quite some hard time with the lack of documentation for LWIP. The only other source that I found was the Wiki which is also linked there: [http://lwip.wikia.com/wiki/LwIP_Wiki](http://lwip.wikia.com/wiki/LwIP_Wiki)

But I still had to figure out lots of things from the actual code.

<comment><USER23> Rats. I had a feeling you'd say that, thanks!

<comment><USER11> I found something more in my work bookmarks: [http://www.atmel.com/Images/Atmel-42233-Using-the-lwIP- Netwo...](http://www.atmel.com/Images/Atmel-42233-Using-the-lwIP-Network- Stack_AP-Note_AT04055.pdf)

Maybe it also has some extra information which can help.

<comment><USER23> Thanks!</comment></comment></comment></comment></comment></comment></comment></comment></comment>


EduBlocks: Transition to Python the easy way - <AUTHOR> http://edublocks.org <comment><AUTHOR> Hey,

My name is Josh and I am 14 and created EduBlocks . Which is a tool to help kids go from Scratch to Python the easy way.

Let me know your thoughts.

Josh</comment>


The spirit of the game - <AUTHOR> http://sethgodin.typepad.com/seths_blog/2008/05/the-spirit-of-t.html <comment><USER2> From Seth: "The web is nothing but a system, a bunch of (largely unwritten) rules regarding search, linking, promotion, etc."

Seth rarely goes deep on his succinct this-is-an-idea-I-have posts, but the question of what are the rules on the web is making me wonder...

Since paulgraham.com is linked, maybe we can reverse-engineer what these rules might be - establish your unique voice (essays), build and nurture an active discussion (news.YC), have a real-world event that dovetails with your mission (e.g. Seth's Purple Cows gatherings in cities or better Y-Combinator), create something that people will use and/or argue about (essays, Arc, Seth's controversial The Dip [e.g. quit if you can't handle it])

<comment><USER3> I think the gist of his idea is "do stuff people like, don't piss them off even if you can profit in the short term. If you can win by not pissing people off, it's more rewarding and they won't be motivated to make you stop".

I don't think there is much to reverse-engineer from that. The guy is a great marketer, he presents a simple idea and makes it sound like it's some profound pearl of wisdom.</comment></comment>


Ask PG: what are the elements of a great accelerator?  - <AUTHOR>

I am committed to start an accelerator in my country (Dominican Republic). What are the most important elements of a Great Accelerator? <comment><USER2> PG doesn't hang around HN at present. I'd recommend reading some of his essays, including: [http://www.paulgraham.com/siliconvalley.html](http://www.paulgraham.com/siliconvalley.html)

<comment><AUTHOR> Thanks for telling me.

</comment></comment><comment><USER3> You should read jedc's mba thesis on the topic:

[http://www.scribd.com/doc/19982837/Copying-Y- Combinator](http://www.scribd.com/doc/19982837/Copying-Y-Combinator)

<comment><AUTHOR> Thank you ig1, do you have more material like this that I should read?</comment></comment>


Reduce React/Redux/TypeScript Boilerplate with Preducks - <AUTHOR> https://www.preducks.com/
preducks is an open source developer tool that helps you organize and get started on React-Redux projects. It lets you visualize your React component hierarchy, easily set up TypeScript interfaces to describe the desired shapes of your data, plan out the shape of your Redux store and types of your actions, and create connections between React components and the Redux store. It lets you skip the tedious boilerplate setup (including webpack configuration) and get right to writing the logic of your app by outputting a full React-Redux boilerplate with TypeScript.
preducks encourages organization and best practices. The app generates code in TypeScript, including extensive interfaces, so your code can act as its own documentation. If you don't know TypeScript, you can still write the rest of your JavaScript code as you usually would, but you are encouraged to implement type-checking. The app also makes use of the new hooks APIs from both React and React-Redux, so it encourages the separation of concerns, and avoids wrapping your Redux connected React components in higher order components.
It's completely free and open source, so give it a try. There's also a lightweight Node module (npm install -g preducks) which works the same was as create-react-app, but also generates basic Redux boilerplate and uses TypeScript. You can include a config file that describes your Redux store, but if not, it'll still output the skeleton of a Redux setup so you can skip right to coding your application logic.
Let us know what you think! <comment><AUTHOR> [https://www.preducks.com/](https://www.preducks.com/)</comment>


Twitter relaunches name search, still no tweet search on site - <AUTHOR> http://venturebeat.com/2008/12/23/twitter-relaunches-name-search-still-no-tweet-search-on-site/ <comment><USER2> """ After the Summize purchase, Twitter wrote on its blog:

We will be adding search and its related features to the core offering of Twitter in the very near future. In the meantime, everyone is welcome to access search.twitter.com

That was July; we're still waiting. """

He's still waiting for Twitter to put the search box in the header? Is it that hard to go to search.twitter.com? Bookmark it.

Look on the bright side, at least there is twitter search.</comment>


Y Combinator Has Gone Supernova - <AUTHOR> https://www.wired.com/story/y-combinator-has-gone-supernova/ <comment><USER2> I have been fascinated with YC since the beginning and twice tracked batches for stories--W07 for Newsweek and W11 for Wired. So it was great to return in the Sam Altman (and large cast of others) era to see how YC has basically made the pivot from its focus on mainly helping the founders in its batches to the broader mission of spreading startups (and the mentality of founders) throughout the world. When I spoke to PG from his happy UK exile, he reminded me that he was thinking this from the start. It was also great spending time with Sam and many other partners, some of whom I've known for years. Thanks to Kat, Sharon, and all the other YC folks and founders who helped me on this.

<comment><USER3> Looking forward to reading it, however your first sentence threw me off:

"If the casting director of the TV show "Silicon Valley" were asked to produce a canonical example of an applicant to Y Combinator's incubator program, she may well have come up with the guy strolling _to the front of in a basement auditorium_ at Stanford on a mid-April day this year."

Am I reading that correctly or was it just an editorial misplacement?

<comment><USER4> Eighty words to point out a typo. Thanks, man. You are a canonical HN commenter :)

</comment></comment></comment><comment><USER5> The writer uses words that sound cool and impressive. In his opinion. Truth is, they make this piece an annoying read.</comment>


Hacking Real World Systems - <AUTHOR> http://mattmaroon.com/?p=328

<comment><USER2> I'm rather confused as to the code of ethics here. My hack was by no means fraud, I simply took advantage of a stupid system. I didn't cheat or steal, or even violate the site's Terms of Service (which said you couldn't use automated scripts to manipulate their GUI but nothing about the website).

I did not break any law in any country, or even violate a site rule. It's preposterous to call it unethical. I simply took advantage of a flawed system.

<comment><USER2> As near as I can tell here, a hack is ethical unless it makes money. It's the tortured artist ethic perhaps.

<comment><USER3> I for one misread your story, should have read more carefully. I thought you got points just for repressing the button after one deposit. The other way (as you described it), yeah, I guess it was just stupidity on the part of the poker firm. Morality would still be debatable - if it had not been a poker firm, but a charity or whatever, people might feel different about it.

I also often have to sign contracts, and I am not sure if all of them are 100% waterproof - probably they are not. But even though the opposing lawyers could probably screw me over, doesn't mean it would be ethical for them to do so.

</comment></comment></comment><comment><USER4> There seems to be a good tradition of "gambler hackers", e.g.

\- Edward O. Thorp ("Beat the Dealer" <http://en.wikipedia.org/wiki/Edward_O._Thorp> )

\- Keith Taft (<http://www.blackjackforumonline.com/content/taftint.html>)

\- the MIT Blackjack Team ( "Bringing down the house" <http://en.wikipedia.org/wiki/Bringing_Down_the_House_>(book) )

<comment><USER2> Amarillo Slim was a great one too, before he got all child-molesty.

</comment></comment><comment><USER5> This should disqualify him right away. Bragging about it tells me that he can't tell the difference between right and wrong.

<comment><USER6> What was wrong here? It's not like the gambling company needed the money.

<comment><USER6> -2 and no one telling me what was wrong.

Was it the clicking of the button? Or was it the scripting? Perhaps it was the not committing a crime part?

People, reread the story -- he deposited tens or hundreds of thousands of dollars at once, only to withdraw it after a week.

</comment></comment></comment><comment><USER7> "Wow, I could write a book on these, as that's pretty much my one true passion in life..."

I was thinking the same thing as soon as I read the question.

</comment><comment><USER8> I'm not sure Paul Graham meant "publicly admitting to fraud" when he said "best non-computer hack."

This would make me drop you like a sack of armpit hair if I were a VC...

</comment><comment><USER9> This was a crime. He stole money from the site.

<comment><USER10> There's no crime here. He followed the rules of the promotion.

Party Poker awarded points for making deposits. Matt deposited money. He would deposit so much money at a time (up to $50K) that he got bored clicking buttons, so he wrote a script to do it for him.

So, if depositing money wasn't against the rules and withdrawing the money after he got the FPPs wasn't against the rules, how can you possible claim that "this was a crime"?

<comment><USER11> Making deposits with certain time restrictions...

<comment><USER3> I could imagine there were others trying the same thing, but then gambling away all their deposited money within a week. So maybe it was all good for the poker firm after all.

</comment></comment></comment></comment><comment><USER3> Interesting, but maybe better kept secret?

<comment><USER12> why?

<comment><USER3> Well, it's kind of like admitting fraud in public (for lack of a better word). It reminds me of the recent incident were some gangsters were busted because they posted revealing videos on YouTube. Moreover, I wonder if some crawler could be devised looking for people admitting their scams on their blogs, and solve a huge amounts of crimes that way...

<comment><USER13> Fraud is the best word you could choose.

In several countries (e.g. Germany, France... don't know about US) this is called computer fraud. And because he did it to sell the goods and make money, some countries would add "professional" and double the punishment.

<comment><USER6> But what was the fraudulent act? Clicking the deposit button?

<comment><USER3> OK on second reading, I guess it really was just stupidity of the poker site, for allowing withdrawal of the money after having received the bonus points. Sorry I misread, I thought he just gained the points for clicking the button repeatedly after a single deposit.

</comment></comment></comment></comment></comment></comment><comment><USER14> I represented myself in US Federal court on a civil rights action against a county and Sheriff's department, and prevailed. Had never previously picked up a law book. Gathered evidence myself, and circumvented the defendant's attempts at destroying some of that evidence. All things considered, it was a coup on my part.</comment>


Managing two million web servers - <AUTHOR> http://joearms.github.io/2016/03/13/Managing-two-million-webservers.html <comment><USER4> OMG, guys, this is getting really strange. Half of the commenters here read the word "process" and jumped to their own conclusions, possibly true in general, but obviously wrong in the case of Erlang.

It bears repeating: Erlang processes _are not_ OS-level processes. Erlang Virtual Machine, BEAM, runs in a single OS-level process. Erlang processes are closer to green-threads or Tasklets as known in Stackless Python. They are extremely lightweight, implicitly scheduled user-space tasks, which share no memory. Erlang schedules its processes on a pool of OS-level threads for optimal utilization of CPU cores, but this is an implementation detail. What's important is that Erlang processes are providing isolation in terms of memory used and error handling, just like OS-level processes. Conceptually both kinds of processes are very similar, but their implementations are nothing alike.

<comment><USER5> Thanks. That wasn't really clear from the article.

</comment></comment><comment><USER6> With the same speak, you could say Facebook mangages billions of PHP web servers, though no one speak like that. (PHP has a shared nothing architecture; HHVM works simlar to the Erlang VM, if one can say so)

<comment><USER7> Exactly, also I do not understand the comparison with apache. Apache can be configured to spawn one process per connection. You also could call a thread a "server" in it's own, so it's just a matter of playing with words.

Also if an apache process dies it will not crash other requests

<comment><USER8> > Also if an apache process dies it will not crash other requests

can you have 2m Apache processes on your machine ?

<comment><USER7> Well that would depend how long you run it for. They don't have to be simultaneous. It wouldnt make much sense to recycle the process for each request however.

MaxConnectionsPerChild defines how often the process is recycled

<comment><USER4> > They don't have to be simultaneous.

Now you're just moving a goalpost. We're talking about Erlang processes - <USER2> _can_ have millions of them simultaneously.

> It wouldnt make much sense to recycle the process for each request however.

It does make a great deal of sense from the fault-tolerance perspective. It also helps security.

I have an unpleasant feeling that you don't know much about Erlang and its philosophy. The "one process per connection" architecture has many benefits; it's a canonical way of getting concurrency and parallelism on Unix systems, for example. The problem is the way OSes handle and schedule processes, it simply doesn't work with a very large number of them. Erlang implements its own kind of processes, which enforce the same constraints os OS-level processes without taking megs of RAM each and without being pressed after spawning a few thousand processes.

<comment><USER7> What I'm saying is that it's misleading to call one process a web server when they really are saying "How we handle 2 million simultaneous web requests". Also I would be very interested in reading such a writeup. There are many different approaches to dealing with it (i.e. on thread per connection / one process / poll based approch). I certainly can see the benefits of having it in lightweight threads called processes in this context.

<comment><USER4> > What I'm saying is that it's misleading to call one process a web server > when they really are saying [...]

No. It's simply a terminology used in Erlang, there's nothing misleading in it, once you know the definition. I mean, there is very specific thing called "server" in Erlang: [http://erlang.org/doc/man/gen_server.html](http://erlang.org/doc/man/gen_server.html) and also "processes" are described here: [http://erlang.org/doc/reference_manual/processes.html](http://erlang.org/doc/reference_manual/processes.html)

What's highly misleading is using more general definitions of such words instead of Erlang-specific meanings. This is a conversation about Erlang and it makes sense to use the terms accepted in Erlang; you can't blame anyone for the fact that some of these terms have meanings different than you'd expect.

<comment><USER9> It's misleading because there are now 2 different definitions of the exact same word at work. It's a computer running a process running an Erlang VM that is then running multiple Erlang processes. It is completely reasonable to be annoyed at that. Many languages have a concept of threading in userspace rather then kernel space, but they don't just call it threading, they give it another name so that it can be distinguished from the existing concept. For example, stackless python's tasklets, Go's goroutines, green-threads.

<comment><USER4> Well, you can't really expect to hold a meaningful conversation about a language without knowing, at least, its basic concepts. With Erlang "processes" are front and center; you read about them in every tutorial and reference, in most blogposts, basically everywhere Erlang related, ad nauseam. So you're guaranteed to understand what kind of processes we're talking about if you have any familiarity with it at all.

And there is a good argument in favor of calling them "processes". Conceptually, both are providing a very strong separation/isolation and cleanup guarantees, which is not true for _any_ of other constructs you mentioned. The range of operation you can perform on a process: spawning, monitoring, sending signals - is the same for both OS and Erlang processes. You can very much think and use both kinds in exactly the same way, other than rather excessive memory usage by the OS-level kind.

I actually have a somewhat related talk tomorrow, about - in essence - replacing Celery in a Python project with Elixir. Integration via ErlPort makes it natural to think of Python worker processes as simply (Erlang) processes - you spawn and link and monitor them just like you would normal (Erlang) processes. It even works with Poolboy out of the box.

<comment><USER9> On the other had, the _exact same_ comparisons hold true for threads vs. green threads. They are extremely similar, they perform almost identically to threads in many languages, and yet, green threads have their own name, as they are a different thing. I can understand that Erlang is built around calling them just "processes", but that's, in my opinion, a bad idea. To me, the fact that Erlang developers insist on co-opting the name "process" seems arrogant.

<comment><USER10> Time out. Let's go back to the late 80s, when Erlang was written. It ran on Ericsson's switches. The platform needed to describe a unit of concurrency that provided execution and memory isolation. Process fits that definition perfectly.

Fast forward to today. Look at projects like LING, where the Erlang VM runs directly on Xen, without a traditional operating system. Processes in Erlang are 100% analogous to OS processes.

Also look at something like Virtualbox or VMware. Is your process running in a VM less of a process than the OS process powering the VM itself?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> I really love the idea of explaining the actor model as tons of tiny little servers compared to a single monolithic server. I tried to make the same comparison recently when I talked about adding distributed transactions to CurioDB (Redis clone built with Scala/Akka): [http://blog.jupo.org/2016/01/28/distributed-transactions- in-...](http://blog.jupo.org/2016/01/28/distributed-transactions-in-actor- systems/)

<comment><USER12> What was the motivation to rebuild it in Scala?

<comment><USER11> If each key/value in the DB is treated as distributed (as per the actor model), a lot of the limitations Redis faces in a distributed environment are solved. I wrote a lot more about it here: [http://blog.jupo.org/2015/07/08/curiodb-a-distributed- persis...](http://blog.jupo.org/2015/07/08/curiodb-a-distributed-persistent- redis-clone/#curiodb)

</comment></comment></comment><comment><USER13> Beautiful way of putting it. Also very close to Alan Kay's vision of "object oriented"

"In computer terms, Smalltalk is a recursion on the notion of computer itself. Instead of dividing "computer stuff" into things each less strong than the whole – like data structures, procedures, and functions which are the usual paraphernalia of programming languages – each Smalltalk object is a recursion on the entire possibilities of the computer. Thus its semantics are a bit like having thousands and thousands of computer all hooked together by a very fast network." \-- The Early History of Smalltalk [1]

I also personally like the following: a web package tracker can be seen as a function that returns the status of a package when given the package id as argument. It can also be seen as follows: every package has its own website.

I think the latter is vastly simpler/more powerful/scalable.

What's interesting is that both of these views can exist simultaneously, both on the implementation and on the interface side.

[1] [http://gagne.homedns.org/~tgagne/contrib/EarlyHistoryST.html](http://gagne.homedns.org/~tgagne/contrib/EarlyHistoryST.html)

<comment><USER14> > Also very close to Alan Kay's vision of "object oriented"

Yes! I remember reading a quote by Alan Key about how pretty much every modern OOP language gets it right entirely wrong, because OOP is supposed to be - <USER3> Kay's view - about classes or inheritance, but about sending messages to each other.

If one thinks of processes as objects and sending messages as "method calls", it is very object-oriented indeed.

<comment><USER13> Yep. Except: please don't think of them as "method calls" :-))

"Smalltalk is not only NOT its syntax or the class library, it is not even about classes. I'm sorry that I long ago coined the term "objects" for this topic because it gets many people to focus on the lesser idea.

The big idea is "messaging" \-- that is what the kernal of Smalltalk/Squeak is all about (and it's something that was never quite completed in our Xerox PARC phase). The Japanese have a small word -- ma -- for "that which is in between" \-- perhaps the nearest English equivalent is "interstitial". The key in making great and growable systems is much more to design how its modules communicate rather than what their internal properties and behaviors should be." [1]

My contribution towards this is Objective-Smalltalk[2], where I am working on making _connectors_ user definable. So far, it seems to be working.

[1] [http://lists.squeakfoundation.org/pipermail/squeak- dev/1998-...](http://lists.squeakfoundation.org/pipermail/squeak- dev/1998-October/017019.html)

[2] [http://objective.st/](http://objective.st/)

<comment><USER14> Yes, that must have been the one I was thinking of! :)

I was very happy a couple of years back when I was building a toy project in C and Lua to come across a Lua library called concurrentlua[1] that implemented Erlang-style message passing (without pattern matching, though, IIRC). It even allowed you to send messages across machines.

[1] [https://github.com/lefcha/concurrentlua](https://github.com/lefcha/concurrentlua)

</comment></comment></comment></comment><comment><USER15> I get the feeling that people reading this and saying "it's just kind of like a pool of PHP FastCGI instances or Apache worker pools" etc. Do not understand that Phoenix + Elixir can serve minimal dynamic requests about 20% slower than nginx can serve static files. This is very very fast.

It also leads to better code due to being functional, lots of amazing syntactic sugar like the |> operator and the OTP can easily allow you to move processes (these basically have very little overhead) to different machines as you wish to scale. Pattern matching and guards are also incredible.

I really do not want to write anything else!

<comment><USER16> And I think Erlang programmers sometimes, if not frequently, forget the Erlang is not magic, it runs on the same CPUs as everybody else with the same access to memory protection, same assembler, etc., and consequently, it can't actually do anything that other many languages can't do too. (And the languages that can't do it only can't do it because they've somehow locked themselves out of it.)

Yes, it's a great default to be shared-nothing, and it's great to have a VM that supports this, the differences in affordances are important and I think Erlang was a milestone language. Very serious about that. But when it comes down to it, the _practical_ difference between nginx (as in, a finished piece of software that exists right now, not the hypothetical space of future C programs) and an Erlang webserver is not much.

So when the Erlang community tries to rewrite the definition of "server" to be "an Erlang process", it is not an unreasonable response to point out that there are plenty of other web servers that have similar levels of isolation that just happen to be written in other languages, and that we don't run around saying "Oh, my nginx has two hundred thousand web servers in it!"

This is bad advocacy, and I'd really suggest that Erlangers stop trying to defend this point. It's not a defensible position. There's no reason to try to redefine "server" to be "the number of isolated processes", because even if you do, Erlang will not have some sort of unique claim to being able to run lots of such processes. Any two "processes" that don't write into each other's space and can't crash each other are "isolated", even if some implementation work had to be done to get it that way. And of all things, webservers are _the_ definitive programs that have had that isolation bashed on and banged on to the nth degree; I wouldn't be surprised that nginx's isolation is more tested than Erlang itself's.

<comment><USER17> "it can't actually do anything that other many languages can't do too."

Yes, we all are familiar with Turing equivalence, but its an exceedingly pedantic point when discussing programming languages.

<comment><USER16> "it runs on the same CPUs as everybody else with the same access to memory protection, same assembler"

I'm not referring to Turing equivalence at all. I'm 100% discussing practical considerations here.

</comment></comment></comment></comment><comment><USER18> This article got me to go figure out precisely what Erlang processes are. Tl;dr - they aren't OS processes. So it is still conceivable that an error in Erlang can bring down all your web servers.

[http://stackoverflow.com/questions/2708033/technically- why-a...](http://stackoverflow.com/questions/2708033/technically-why-are- processes-in-erlang-more-efficient-than-os-threads)

<comment><USER19> Well, not if you distribute your erlang processes across several physical nodes.

<comment><USER20> You mean just like you can with Apache or Nginx?

<comment><USER21> No. Not at all like those.

<comment><USER22> Can you please expand on why?

<comment> vertex-four The processes can communicate with processes on other servers in exactly the same way that they can communicate with processes on the same server.

If you have one traditional application server and want to do some form of cross-user interaction - let's say chat - you can do that trivially, put it in a queue for that user in a global map. Now when you outgrow that server, you need to rewrite all your code to understand the concept of users being on other servers or use an external message queueing system.

In Erlang, all of this is built in by default - if you write code for the OTP framework (the standard library for dealing with messaging, process supervision, etc), all you need to do is connect the two servers together and point them at the same shared user->process mapping process (which you have to build whether you're dealing with one server or 20, as there's no global data otherwise).

Of course, if you have absolutely no direct interaction between users, it's trivial to scale anything - fire up a new server and direct some portion of your traffic at it. Erlang's trick is to make it that easy even when you do have direct interaction between users. And of course that works for even backend workloads - if you have a backend server that your frontend servers talk to and need to scale it, if you've coded in Erlang and put as much logic as possible in per-connection processes, you're probably a significant chunk of the way there.

<comment><USER23> What does any of these have to do with the equivalence between Apache/Ngix and Erlang when running multiple servers of them to avoid crashing all?

<comment> vertex-four You can't use traditional servers to scale in lots of cases without a lot of additional development work. You can use Erlang servers to do so. Therefore, they're not the same - Erlang covers a broader range of use cases.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> The title is somewhat misleading. I clicked expecting to read how someone is managing 2 mln web server instances such nginx or apache. I was curious what kind of company would claim that.

<comment><USER25> This is Joe's blog, he co-created Erlang 30 years ago.

So he's not really affiliated with any company, but rather a voice for Erlang itself.

<comment><USER24> It's not a clickbait of course, it's just that the term 'web server' and 'manage' made it easy to misinterpret the subject. Typically, by managing a web server we mean administrative tasks involved in configuring and running a multi-threaded http daemon. Perhaps "2 million web server processes" would have been better.

<comment><USER9> Even that would be confusing, as "Erlang process" != "process" for anyone that's not an Erlang programmer(or who doesn't parse "process" as the Erlang variant by default)

</comment></comment></comment></comment><comment><USER26> In the late 90s I implemented the same concept for a web application written in Perl. (It's still running today.) There were three tiers to it:

Tier 1: a very small master program which ran in one process. It's job was to open the listening socket and maintain a pool of connection handler processes.

Tier 2: connection handler processes, forked from the master program. When they started they would load up the web application code, then wait for connections on the listening socket or for messages from the master process. They also monitored their own health and would terminate if they thought something went wrong. (ex: this protected them from memory leaks in the socket handling code.) When an http connection came in on the socket, they would fork off a process to handle the request.

Tier 3: request handlers. These processes would handle one http request and then terminate. When they started, they had a pristine copy of the web application code (thanks to Copy-On-Write memory sharing of forked processes) so I knew that there was no old data leaked from previous requests. And since they were designed to terminate after a single request, error handling was no problem; those would terminate too. In cases where a process consumed a lot of memory it would get released to the OS when the process ended. We also had a separate watchdog process that would kill any request handler that consumed too much cpu, memory, or was running much longer than our typical response time.

This scaled up to handling hundreds of concurrent requests per (circa 2005 Solaris) server, and around six million requests per day across a web farm of 4 servers. That was back in 2010; I don't know how much the traffic has grown since then but I know the company is still running my web app. This was all _very_ robust; before I left I had gotten the error rate down to a handful of crashed processes per year in code that was more than one release old.

BTW, while my custom http server code could handle the entire app on its own, and was used that way in development, for production we normally ran it behind an Apache server that handled static files and would reverse-proxy the page requests to the web app server. So those 6 million requests per day were for the dynamic pages, not all of the static files. That also meant that my web app didn't have to handle caching or keep-alive, which simplified the design and makes the one-request-then-die approach more viable.

</comment><comment><USER27> I would like to see the code for the chat or presence server. I have a hunch it will look different depending on the experience of the programmer.

I'm especially interested in how they manage state. Because when you do not have to manage state, everything becomes easy and scalable. With state I mean for example a status message for a particular user.

<comment><USER25> The Phoenix Framework (web framework for Elixir) already solves this for you.[1]

It's called Phoenix.Presence. They used a combination of CRDTs with heartbeats to implement it.

You are right, it is a hard problem because of the distributed nature of Erlang/Elixir. That's why Chris provided a framework level solution for it.

[1] [https://youtu.be/XJ9ckqCMiKk?t=921](https://youtu.be/XJ9ckqCMiKk?t=921) (Erlang Factory SF 2016 Keynote Phoenix and Elm – Making the Web Functional)

</comment></comment><comment><USER28> > why does the Phoenix Framework outperform Ruby on Rails?

Ruby is known to be a slow language. Most things will easily outperform it

<comment><USER29> Language performance rarely impacts web applications performance.

Actual bottlenecks are the database, and your webserver/architectural choices.

</comment></comment><comment><USER30> Could someone explain how in the context of the article, "process" differs from a "thread", in say Java or Python? Or are they one in the same?

<comment><USER31> All interesting replies, but as I am not an erlang programmer could someone briefly explain the threading model? Whatever the unit of code packaging is ultimately it all has to get scheduled onto a core. On what platform is 2,000,000 threads a realistic scenario? If you don't have 2,000,000 threads you don't have 2,000,000 web servers. You might, for example, have 2000 web servers each using an event-driven framework to handle 1000 concurrent requests. Is that closer to the erlang processing model?

<comment><USER10> A single preemptive event driven framework is probably a closer match.

BEAM has a very efficient multi core fair scheduler. All 2M process share time on all available cores and are handled by a single scheduler. Because it's preemptive, starvation problems one might see on an event loop are avoided. A CPU intensive process can run alongside low latency IO processes and they are all fairly scheduled.

</comment></comment></comment><comment><USER32> A little while ago I wrote an extremely short introduction to distributed, highly scalable, fault tolerant system.

It is marketing material for my consulting activity anyway some of you can find it interesting.

The PDF is here: [https://github.com/siscia/intro-to-distributed- system/blob/m...](https://github.com/siscia/intro-to-distributed- system/blob/master/intro_to_distributed.pdf)

The source code is open, so if you find a better way to describe things feel free to open an issue or a pull request...

</comment><comment><USER33> I can't help but think this is madly in-efficient with cache misses and the like.

<comment><USER10> Why?

<comment><USER34> I think what he's trying to say is that silver bullets don't exist. Only pros and cons.

<comment><USER10> I'm specifically asking about caching.

<comment><USER35> Presumably he's talking about processor caches. A shared nothing means that every time you "context" switch to another "process" you're going to have to reload all your cache lines in the L1 D-cache.

<comment><USER10> In Erlang you have a "reduction count budget" of 2000 reductions. This is fairly low, less than 1ms of execution, but during that time you have exclusive use of a CPU. At the end of your budget, you might be preempted, or you might get another window. So you take a bit of a hit to cache, but it's not like you are infinitely context switching. In practice it works fairly well.

</comment></comment></comment></comment></comment></comment><comment><USER36> processes do not share memory, but threads may be,

</comment><comment><USER37> does anybody know how to undo an upvote here in HN ?? This reading was a terrible waste of time :(

<comment><USER38> You cannot alter your vote.

</comment></comment><comment><USER39> You don't need to "crash the server" in response to an error from a single user - It is sufficient to just close the connection and destroy the session.

I doubt that erlang spawns millions of OS processes because that would be extremely inefficient due to CPU context switching. So in reality, all erlang is doing behind the scenes is closing the connection and destroying the session... It's not actually crashing and restarting any processes... You can easily implement this behavior with pretty much any modern server engine such as Node.js and tornado.

<comment><USER40> How is that different than just throwing an uncaught exception? Most web toolkits will catch that, log it, and 500 the client for you.

<comment><USER41> Your web service is stateless - for those cases it's fine. However with this model, you are offloading all your state to another layer - likely the database layer.

With Erlang (or rather, the Actor model), you can build state-full pieces of code that are also resilient to crashes that cascade across the entire system, by having a standard pattern of restarting individual actors from a known clean state through a clean supervisor hierarchy.</comment></comment></comment>


Ayatana overlay scrollbars: new in Ubuntu "Natty" - <AUTHOR> http://www.markshuttleworth.com/archives/615 <comment><USER2> My concern with overlay scrollbars is that they don't seem to offer a clear affordance until the user has already taken steps to interact with them. The nub that fades in has the same feel to it as those flash websites that require you to mouse over all the graphics, just to see which ones will perform an action.

Existing scrollbars look like something in a track that you can move back and forth. Overlay scrollbars, particularly in iOS, aren't used to interact with the content. You move the content itself, the scrollbars are just indicators showing your position. They shouldn't look 'grab-able', because you never grab one.

The implementation shown in this post is grab-able, but doesn't look to be. I think that's a mistake.

(I should note, iOS is the only place I have experience with overlay scrollbars. I'm not qualified to discuss how they're used elsewhere. If other systems use them differently, please chime in.)

<comment><USER3> The video show in indicator, doesn't it? This way you know, that is something there.

I would be interested how many still use the scrollbars instead of the scrollwhell of their mouse / scroll area on toachpad.

The advantage on touch devices is obviously clear, imo.</comment></comment>


The Internet of Things Will Turn Large-Scale Hacks into Real World Disasters - <AUTHOR> http://motherboard.vice.com/read/the-internet-of-things-will-cause-the-first-ever-large-scale-internet-disaster <comment><USER2> Large-Scale Hacks can already turn to Real Word Disasters.

If you look at the banking system, how eletricity or water is distributed, or even the shipping industry, we're already _extremely_ vulnerable to hacking attacks that have the power to collapse the entire world in the blink of an eye.

I'm tired of these arguments about evil people locking your door, or driving your car to a cliff.

If you imagine just an average sized city (say, New Orleans) getting its water or eletricity blocked, it will be a zombie apocalypse.

</comment><comment><USER3> In related news "Invention of the wheel could cause wide spread accidents due to collisions"

Let's stick with foot transportation.

<comment><USER4> I doubt Bruce Schneier is suggesting we not use technology. I think the article should be taken as written--nowhere does it suggest that the Internet of Things should be avoided.</comment></comment>


George Grellas talks on "Strategic Legal Planning" in San Jose  - <AUTHOR> http://aslcpa.com/strategic-legal-planning/

<comment><AUTHOR> George Grellas is grellas on HN. This is a rare opportunity to hear him address key legal topics for founders including

       navigating the tug of war between dilution and control
       pros and cons of positioning your startup as rapidly scaling or lifestyle
       pros and cons of using incubators or startup accelerators</comment>


Neil deGrasse Tyson and futurist Ray Kurzweil on what will happen to our brains - <AUTHOR> http://www.businessinsider.com.au/neil-degrasse-tyson-interview-ray-kurzweil-innovators-2016-1 <comment><USER2> I found it an interesting interview, a little different from the usual Kurzweil presentations.

It was interesting he started programming in 1960 age 12 on an IBM 1620.</comment>


Is startup success more difficult than tenure in a top research university? - <AUTHOR>

Anyone know how the statistics compare? <comment><USER2> I think it'd be hard to directly compare statistics, because the timeframes and mechanics are a lot different.

Startup success, for some definition of success, tends to happen or not happen within five years or so; while the hurdles to become a tenured professor at a top research university are much more spaced out. Typically, it's 5-8 years of grad school, possibly 1-3 years of a postdoc, and 6-7 years being untenured faculty. At any one stage, the odds in academia are not that bad; for example, if you're an untenured Stanford prof, your chances of becoming a tenured prof are actually quite good. But you have to make it through the whole 15-20-year process to get there.

As a result, startups also have more iterability: if a startup fails, you can plausibly try a second, or a third, perhaps taking totally different approaches each time. You can't really do that with an academic career path, since the time needed to get through the process and build a reputation makes it nearly impossible to decide, "well, going for a CS faculty position at CMU didn't work, maybe I'll go back to grad school and try for a philosophy professorship at Oxford this time".

On the other hand, since it's a whole career rather than a single venture, it's less clear what "success" or "failure" is for an academic career, unless you _really_ have your heart set on a very specific goal. For example, if you end up not being able to get the tenured position you want, but do end up working at a research lab in industry doing interesting stuff, is that a success or failure? With startups it's usually clearer that either it's in business or it isn't after five years.

</comment><comment><USER3> You probably won't find any statistics, but I can give you some personal anecdotes. I met my wife two weeks after she got a tenure track job at a tier 1 university. She spent 5 years working very hard - weekend, nights, no vacations - and got tenure (after writing a book and publishing a dozen papers). Part way through that process I started a company that grew within 4 years to 20 employees. From my perspective it seems like it takes similar effort and dedication. Or a my wife puts it "nobody gets a PhD and tenure because they think it would be nice to have. It is just too much work if you are not committed".

So if you are considering one or the other, think of them as the same amount of work. I would choose the startup. As _delirium says it is much easier to fail and start over with a startup than it is with tenured professor jobs. Some people don't get tenure, I personally know two people that didn't make it. Also consider that when you are a professor there are very very few jobs to choose from. There is only one university within a 100 miles of my house that my wife could work at, so how can she change jobs without us having to move? The number of academic couples that live in different cities for work is staggering. My wife was offered a job last year that was 2000 miles away which would make it a tough commute. For a final thought, I have tried to convince my wife to move to private industry for the past 5 years. She won't even consider it, but if she did move she would get paid much more and have many more job choices.</comment>