Comparing Pythagorean triples in C++, D, and Rust - <AUTHOR> https://atilanevesoncode.wordpress.com/2018/12/31/comparing-pythagorean-triples-in-c-d-and-rust/ <comment><USER2> By the way, is it a secret to programmers that Pythagorean triples can be parametrised?

I understand that the point of the code is to enumerate them without knowing that they can be parametrised, but the parametrisation in this case is not so scary, so it's a fun bit of trivia for programmers (for mathematicians, it's more fundamental, as the Pythagorean parametrisation is an important prototype for counting rational points on elliptic curves, a fundamental problem in number theory).

[https://en.wikipedia.org/wiki/Pythagorean_triple#Generating_...](https://en.wikipedia.org/wiki/Pythagorean_triple#Generating_a_triple)

Slightly less easy nor well-known amongst mathemticians (or at least, this is new to me), you can enumerate all primitive Pythagorean triples in a tree!

[https://en.wikipedia.org/wiki/Tree_of_primitive_Pythagorean_...](https://en.wikipedia.org/wiki/Tree_of_primitive_Pythagorean_triples)

This tree is really interesting! I wonder where those matrices come from. The proof that it works is a boring mechanical check, but I'm now interested in how they were derived in the first place. This is a 20th century discovery, unlike the parametrisation which comes from antiquity. I think I'll be reading some papers about this.

<comment><USER3> This was useful to me when doing Project Euler exercises, but I wouldn't know how to prove this generates _all_ triples.

<comment><USER2> The basic idea I like is, take x^2 + y^2 = z^2, but divide by z^2 to get (x/z)^2 + (y/z)^2 = 1. Now you're looking for the rational points on the unit circle. An important observation is that any two rational points define a line with rational slope. You know of one such rational point on the unit circle, say, (-1, 0). Now you can invert this process and pick a line with rational slope that goes through (-1,0). All lines with rational slope going through (-1,0) will hit another rational point on the circle, so you've found all rational points on the circle by this method, which include all primitive Pythagorean triples.

When you work out this math, you recover the classical parametrisation, where the slope m/n of the line corresponds to the parameters, and this line- intersection method is a good inspiration for how to do the same with some higher-order curves such as elliptic curves, where it leads to the group law on them.

</comment></comment></comment><comment><USER4> Those of us who have compute-bound workloads (scientific simulations in my case, but this often comes up in gamedev and elsewhere) often complain about how unusably slow debug builds impede our workflow in C++. One fairly common solution to this in extreme cases is sticking to a mostly C-like subset of the language or just using C. I don't have much experience with Rust, but judging by the results here, debug builds in Rust are effectively useless, even compared to C++. How do Rust programmers deal with this? Do you just give up and resort to printf debugging, or are there ways to improve the situation?

<comment><USER5> This is going to sound unbelievable, but I don't really ever do runtime debugging of my Rust code. Nearly all my debugging happens at compile-time (which is faster to iterate with thanks to cargo-check skipping codegen and linking). That said, I do know some people with large Rust codebases who do value the ability to run debug builds, and the slowness of -O0 binaries is a sore spot for them. As with C, you can try -O1 for a compromise between runtime and compiletime.

<comment><USER6> How do you debug logic errors in that case? I imagine that most logic errors can't be caught by the compiler, although I could be wrong.

<comment><USER7> Most logic errors can definitely be caught by the compiler if you're taking the approach of encoding your logic into your type system. I've done this with real codebases (in Python as well, actually, using Mypy) and it's been very effective.

<comment><USER6> Can it catch something like accidentally writing "x == y", when you meant to write "x != y"? I feel like this kind of bug can be insidious enough to waste lots of debugging time, yet difficult to catch until you run the code.

<comment><USER7> Not easily. Rust's type system has limits, and what you're talking about is something you'd probably want dependent types for.

But it can catch lots of other logic errors.

The approach I have used in both mypy and rust is to encode state transitions into types. It's more elegant in Rust, and safer as well, but even with mypy it means I could be very sure about certain properties of my service (it was a sensitive service and I needed to be reasonably sure it wouldn't end up in an invalid state).

[https://insanitybit.github.io/2016/05/30/beyond-memory- safet...](https://insanitybit.github.io/2016/05/30/beyond-memory-safety-with- types)

This is an example of the pattern.

When you take a "Type driven" approach to your code - stating your constraints upfront, and encoding them into your types - you can push a lot of the debug cycle to your compiler.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Update: The Rust versions can all be made to run faster with a simple edit. I've updated the timings and edited some of the text.

<comment><USER8> Not mentioned in the post but I'm assuming you're using O0 for "debug"? It may be worthwhile to reconsider as O0 is now considered to be a tool for compiler authors & regular people should use -Og (or opt-level 1 for Rust) as a way of generating builds that have performance optimizations applied that don't impact debugging.

<comment><USER9> I've usually found -Og to inline functions or optimise out variables I needed to investigate. It's happened often enough that I just use printf in release mode.

</comment></comment></comment><comment><USER10> The C++ version is taking a compile and runtime short cut by using printf instead of iostream.

This pull request has timings with this changed: [https://github.com/atilaneves/pythagoras/pull/1#issuecomment...](https://github.com/atilaneves/pythagoras/pull/1#issuecomment-450661579)

<comment><USER11> Using the <iostream> stuff isn't really idiomatic - on both modern and legacy code bases I've used operator<< overloads on custom types, but never called std::cout in a hot loop or used std::endl to do anything but actually flush the stream.

<comment><USER12> Is std::endl guaranteed to flush the stream? I'd think you'd be better off with std::cout::flush(), std::flush if you prefer manipulators. It would certainly be clearer, assuming it's not temporary debug code.

<comment><USER13> It is. That is the only reason to use it other than '\n'

</comment></comment></comment></comment><comment> dj-wonk To save a some human parsing effort in interpreting the column names:

      CT = compile time
      RT = run time

</comment><comment><USER14> I would be really interested to know where the overhead in the simple rust version comes from. At first I thought it might be the println() being less efficient for whatever reason, but even without that line this[1] takes 300ms, compared to 184ms for this[2] (with the printf!).

1\. [https://raw.githubusercontent.com/atilaneves/pythagoras/mast...](https://raw.githubusercontent.com/atilaneves/pythagoras/master/simple.rs)

2\. [https://raw.githubusercontent.com/atilaneves/pythagoras/mast...](https://raw.githubusercontent.com/atilaneves/pythagoras/master/simple.cpp)

<comment><USER15> Someone found a single character change providing a 2x speedup: [https://www.reddit.com/r/rust/comments/ab7hsi/comparing_pyth...](https://www.reddit.com/r/rust/comments/ab7hsi/comparing_pythagorean_triples_in_c_d_and_rust/)

<comment><USER16> To quote that reddit post, which I think has some good interesting details about why:

"I believe the problem with ..= is that x..(y + 1) is not identical with x..=y. They are nearly equivalent on most values for x and y, except when y == i32::max(). At that point, x..=y should still be able to function, while x..(y + 1) is allowed to do nothing."

<comment><USER17> I don't know anything about Rust, but is it part of it's "safety" that it has operators to allow rollover of type max size and others that do not?

As a C programmer, that sort of feels like cheating ;)

<comment><USER18> Safety means "memory safety". Integer overflow cannot cause memory unsafety directly, and so it's safe.

(safe) Rust does not claim to make your code correct, it claims that it will not have undefined behavior.

We _do_ care about helping you make your code correct; it will check for overflow and panic at runtime in debug builds. But it's a secondary concern. Memory safety is hard enough!

</comment></comment></comment></comment></comment><comment><USER19> If there are big differences in where you don't expect them (e.g. printf in a for loop being very slow), then it usually is a difference in implementation and possibly contract. E.g. I wouldn't be surprised if println! in Rust is synchronous, which tends to be slow on both terminals and redirections (i.e. file I/O).

For these simple examples an strace may be enlightening in this regard.

Edit: Indeed this seems to be the case from the library source code (println! -> _eprint -> stdout -> LineWriter).

<comment> ah- Yes, this benchmark would be much more interesting if it didn't do any println on the hot path and just accumulated the results and wrote them out once in the end.

Edit: I've tried (println! vs a single io::stdout::lock() and writeln!), and it doesn't seem to make any difference, at least for the range.rs example. Hmm.

<comment><USER18> Sometimes, the trick there is that compilers can be _really good_ at compile time stuff, and the whole computation may just be computed at compile time. In this case? Probably not. But it's not always the right way to do a benchmark, or at least, without some tweaks.

</comment></comment></comment><comment><USER18> The reddit thread already has one good relevant comment [https://www.reddit.com/r/rust/comments/ab7hsi/comparing_pyth...](https://www.reddit.com/r/rust/comments/ab7hsi/comparing_pythagorean_triples_in_c_d_and_rust/)

<comment><USER3> Well, that seems more like an issue with the compiler then, cause avoiding overflows would not result in a 2x slow-down in C or C++.

<comment><USER18> Possibly! Remember that the Rust language and C/C++ have different semantics with regards to overflow. It may be the programmer's "fault" for not writing the code with the equivalent semantics (you can make them have the same semantics, but it's not the default).

<comment><USER3> Looking at the Rust source [1] it seems there the `next()` call has some overhead, so it's probably not the compiler.

I remember this was simple to implement in Julia [2] where you can iterate over the full range `for i = typemin(Int):typemax(Int) ... end` without overflow and without overhead. Same should be possible in Rust I think.

[1] [https://doc.rust- lang.org/src/core/iter/range.rs.html#340-35...](https://doc.rust- lang.org/src/core/iter/range.rs.html#340-353)

[2] [https://github.com/JuliaLang/julia/blob/master/base/range.jl...](https://github.com/JuliaLang/julia/blob/master/base/range.jl#L591-L598)

</comment></comment></comment></comment><comment><USER20> For the sake of history, `range` was found/coined by Andrei [1] [2] as a way to overcome the issues with the iterator pattern (in STL). I wish Eric Niebler credited Andrei somewhere, but I couldn't find any.

Honest question: why should I use ranges after all?

As I understand, ranges are the core of idiomatic D and they are not worth it (as per OP)?

AFAIK, ranges (at least in D) are not thread-safe [3]. So what real benefits does it bring?

[1] [https://accu.org/content/conf2009/AndreiAlexandrescu_iterato...](https://accu.org/content/conf2009/AndreiAlexandrescu_iterators- must-go.pdf)

[2] [http://www.informit.com/articles/printerfriendly/1407357](http://www.informit.com/articles/printerfriendly/1407357)

[3] [https://github.com/carun/parallel-read- tester/commit/3e69da4...](https://github.com/carun/parallel-read- tester/commit/3e69da45bfe6820d3a93d28a61e1608bfbb945ed)

<comment><AUTHOR> I wrote the blog post and I definitely think ranges are worth using, and said as much in the link. I just don't think they're worth it in this particular case. The code is usually clearer and more reusable with ranges, and if by chance they're bottleneck (unlikely) then rewrite into raw for loops.

<comment><USER20> Thanks!

</comment></comment></comment><comment><USER21> Website is basically useless on mobile. Redirects to random garbage

<comment><USER22> Not for me.</comment></comment>


Is up for iot devices - <AUTHOR> http://is-up.xyz <comment><USER2> First request was Error 500. Then it worked nice!

Any rules for using? Description is a little bare bone right now ;)

<comment><AUTHOR> hi, thank you. I see one 500 response. Could you try again :)

no rules, [http://google.com:80](http://google.com:80) google.com bla bla

<comment><USER2> Couldnt reproduce it, so yeah it was just this one time.

Nice to hear that, bookmarked.</comment></comment></comment>


Storing state in Erlang with processes (2014) - <AUTHOR> https://dantswain.herokuapp.com/blog/2014/09/27/storing-state-in-erlang-with-processes/ <comment><USER2> That's a good introductory article in that it starts from a very basic idea of just an assignment and ends up with a gen_server.

This explicit state management and immutability is very nice in large applications. You can see what is happening in a piece of code just by looking at the local context (a function or a module) since you'd have the initial state, the update operation, and the new state. If something goes wrong, tracing just that function can often reveal the error. Contrast that to an implicit "this" object with multiple levels of class inheritance, then things become a lot more complicated.

Further, when it comes to state management, process heap isolation is invaluable. If something goes wrong, you can safely restart just some parts of the application without leaving others in an unknown state. Operating systems have figured this out many decades ago, and going back to concurrency units that share a single heap feels like we are back in the Windows 3.1 world, where your calculator crashing also took down your editor.

<comment><USER3> >You can see what is happening in a piece of code just by looking at the local context

^ This. A thousand times this.

When I read this article, all I could think was _this_ is what object oriented code is meant to be about, aka message passing.

I have been working on a Rails codebase and it's an absolute nightmare - without knowing everything all at once you can come to a tiny class that has a bunch of identifiers set via inheritance or somehow used via inflection. It's completely mad.

Not meaning to start a flame-war but it confuses me how OO went from a simple idea of encapsulated "objects" having well defined interfaces to this crazy spaghetti mess of inheritance etc.

That said, bad code is bad code and you can ship a ball of mud in anything...

</comment></comment><comment><USER4> hmm, its better to store state in ETS so when it does crash it can be restarted by the supervisor without losing the state.

<comment><USER5> This depends highly on what you are storing. Letting a process reuse "old" state after a crash can easily cause a restart loop.

</comment></comment><comment><USER6> There's a higher, systems-architecture-level equivalent to this, too (which Erlang is also designed to take advantage of, re: the Erlang distribution protocol, and the Mnesia DBMS), and that's the idea that "durability _is_ replication."

That is, there's no semantic difference between "a disk" and "the in-memory heap of another node on the network", in terms of what fault-tolerance guarantees you get by adding one or the other to your system. Machines can crash? So can disks. Back up to a disk? Back up to another node. Restore from on-disk state? Restore by streaming state from another node.

You can build a DBMS cluster, or even something "ultra-durable" like S3, with clusters of disk servers, sure. _Or_ — providing memory is cheap-enough for your use-case — you can build it with clusters of RAM nodes, with no disks at all (and thus one tenth the maintenance costs.) Power outage wipes the whole cluster? Not if you've got a UPS, a generator, and a whole lotta gas (like telecom base-station switches are stocked with.) Or if you've got backup nodes — which are also just RAM nodes! — to stream to in another region. (Your system itself doesn't need to be multi-region distributed; it can treat these nodes the same way a regular persist-to-disk system treats tape backup.)

And, conveniently, it's not just memory accesses that are faster with such an architecture. If you build your cluster architecture as a set of services where each service isn't just a single node (or just a load-balanced set of nodes), but rather a "distribution set" of nodes—i.e. one "transaction router" node that _multicasts_ commands to a set of equivalent worker nodes, where the worker nodes all deterministically do the same things in response; then, rather than one master, you have N copies of your node, _all_ of which are equivalent hot-standbys of your "master"! (You don't have to use them as such; you can route client requests to just one "master" in the distribution set, making the others merely _warm_ standbys.) Compared to streaming replication, where some of your nodes are always "behind" their master, this approach is far less risky in terms of data loss. This isn't streaming replication; it's RAID for memory writes!

(And yes, this is the precise use-case that Erlang's distribution protocol is designed for: nodes in the same "distribution set" working as equivalent, deterministic warm-standby _alternatives_ to one-another, presenting as a single virtual "node" in a larger cluster architecture, almost always connected by a non-partitionable network backplane, like a single top-of-rack network switch. Of course, nobody _uses_ Erlang's distribution this way other than Ericsson... but that's because nobody but Ericsson has needs that _force_ them to avoid disks—and avoiding disks entirely isn't cheap, at least today. Still, it's important to keep in mind, because the Erldist protocol works best when you hew to this design, and actively fights you when you don't; and because Mnesia was never designed for anything other than being a memory-to- memory replicated DBMS—and it works great for that!—but it really kind of sucks once you introduce any disk copies to its replication strategy.)</comment>


Marsh Ray's analysis of the OpenBSD IPSEC ESP flaw - <AUTHOR> http://extendedsubset.com/?p=41

<comment><USER2> Left out of all of this is that Sam Leffler found this bug when he was incorporating the OCF into FreeBSD.

Yet the team at OpenBSD has never credited him.

Why?</comment>


Digital sleuths unravelled the mystery of Iran's plane crash - <AUTHOR> https://www.wired.co.uk/article/iran-plane-crash-news <comment><USER2> It'd be interesting to know how provenance and originality is ensured. Locating the scene of footage is certainly part of it but how is ensured that footage from an original location has not been altered. A state sponsor would certainly be able to alter footage from multiple sources.

</comment><comment><USER3> Or, you know, just wait to see the giant hole in the re-assembled plane parts.

<comment><USER4> Nah, the Iranians government already bulldozed the crash site.</comment></comment>


The new ideological divide - <AUTHOR> http://www.marketwatch.com/story/the-new-ideological-divide-2010-06-30

<comment><USER2> This OP suffers from the same delusion as a lot of financial professionals.

The "Investment capital" that he talks about mostly goes to buy and sell stocks and bonds. These are not real capital investments, but wagers on future prices. I bought $5000 of Google stock last year. To say that the $5000 did anything to help Google is foolish. I bought someone's bet and now he has $5000 more while I have $5000 less. He may have invested it in something useful (buying goods or services) but more likely he used it to make another wager. No true value was created, though the brokers and money managers (like the OP) take their cut. On the other hand, if I had purchased government bonds, the bond money would have been injected much more broadly into the economy via capital spending or entitlements. Don't pretend that money that doesn't go to government bonds would go to building bridges.

Should or national savings rate be higher? Yes. Should we move toward a balanced budget? Yes. Should we try to fix these things while on the edge of a double-dip recession? Most certainly not.

<comment><USER3> " _I bought $5000 of Google stock last year._ "

And obviously the people from who you bought it burned that 5K in a bonfire....

An illiquid financial system helps no one (well, no one good).

<comment><USER2> I'm not saying that $5000 didn't go anywhere... About one percent of it was eaten by fees and the rest probably went to make another wager. It almost certainly did not go into anything resembling capital investment as the OP suggests.

I'm not attacking the market system, merely pointing out that the post-IPO "capital" market for a stock does not produce any capital investment but is rather a means for trading wagers on the performance of the underlying company.

Real capital investment is mostly financed by bonds (including government bonds, which the OP appears to dislike.)

</comment></comment></comment><comment><USER3> " _Economies do not grow because consumers spend; consumers spend because economies grow....

Investment capital comes from savings, and when governments borrow, savings are diverted from private investment. While it is possible for governments to invest as well, it is much more likely that the money will be spent on entitlements or "invested" in projects that may be politically advantageous but economically useless.

Any money spent by governments is not available to the private sector to invest...._"

And he didn't even mention how following the "Stimulators" for two decades has ruined Japan.

<comment><USER2> Japan's high savings rate meant that banks had huge amounts of money to lend. The banks threw lending standards out the window because they had so much cash to lend. When the central bank raised interest rates, the bottom fell out.

Here's the important part, though. Because of the cozy relationships between banks and big industrial firms, the banks reacted by making _more_ bad loans to prop up failing firms. Plus, the government raised consumption taxes which fell disproportionately on the lower classes. The tied-up capital combined with the rising taxes on the people who spend the highest percentage of their income hurt a lot more than government spending on infrastructure.

Here's my worry about the U.S.:

1\. The home buying incentives/modifications are just an excuse to keep trying to re-inflate the housing market much like the Japanese banks kept lending money.

2\. Proposed cuts to social security and medicare will hurt the economy by affecting those who spend the highest percentage of their income.

</comment></comment><comment><USER4> Sidenote: where can I find the person who came up with the "docking bar" idea for websites (that hideous JavaScript thing at the bottom of your viewport).

I need to hurt that person.

<comment><USER3> It's there, at least visually, even if you have Javascript turned off with NoScript (Firefox).

And, yeah, it's very annoying.</comment></comment>


Traversable Achronal Retrograde Domains in Spacetime - <AUTHOR> https://arxiv.org/abs/1310.7985 <comment><AUTHOR> Article here: _" A Researcher Has Come Up with a Mathematical Model for a Viable Time Machine"_ ~ [https://news.ycombinator.com/item?id=14236087](https://news.ycombinator.com/item?id=14236087)</comment>


Ask HN: How to Hire Hackers - <AUTHOR> JamLegend is about to hire some interns for the summer and we'd like your advice.
We're about to conduct some interviews and are still receiving applications. Honestly, this would be our first time bringing folks in. We don't know how to go about this the right way, so we wanted to seek out HN advice advice about Dos and Don'ts in the world of hiring and share with everyone.
Since we've just begun our process, we've come upon some tips on HN and elsewhere that we thought would be nice to share. See the comments below separated by stage (sorting resumes, interviewing, puzzles, etc.). We'd really appreciate the help because we want to make sure we're bringing on the right people.
Edit: I took off links so I'm not hawking my wares like a Chinese DVD merchant, we're honestly interested in getting advice on how to hire correctly. <comment><USER2> Most startups today (those you've actually heard of) generally do 2-4 phone screens which encompass a technical interview. You can utilize Google docs and watch them code.

Take the feedback of everyone who interviewed (your team) into consideration and either offer the position because you feel they are motivated and technically sound or you can fly them in for a 3-4 hour person-to-person after a phone screen or two.

This is what Slide, Facebook, Google, etc. do. None of them mandate puzzles, seems like they use them as a way to "Wow" them.

In the past, I've seen companies give "quizzes" they can do in a limited amount of time. Generally 10-15 question quizzes as a quick way to judge, without wasting your own time, if they are competent enough but hopefully a resume is enough.

Disclaimer: This isn't necessarily my opinion of how it should be done, just how companies that have been around the block do it.

<comment><AUTHOR> Any thoughts on video chat interviews instead of flying people out (ah the startup wallet calls again)?

And... what is your opinion of how it should be done?

<comment><USER2> You should only fly people out if you are _strongly_ considering them. You're going to pay this person $20-$35/hour all summer, what's $300-400 just to make sure they are exactly what you want?

You do not have to fly people out, Google/hi5/Ning don't seem to do this but Slide/Facebook still do. It's clearly how convinced you and your team are of this person. You can try and make video conferencing part of the phone screen process of course.

I am no expert on how interviews should be done and it depends on the kind of intern you want: Someone who can learn fast? Someone who is already skilled with your stack? Someone purely motivated?

Ideally all, I'd pick one and base your questions accordingly. Companies I mentioned above let potential hires code in any language and simply check that they know the fundamentals: recursion, data structures. Gauging their passion/motivation/drive is done through their resumes and side projects like others have mentioned.

My personal opinion, you want to pick someone who is capable of learning most things without asking you otherwise it's going to be a struggle of he/she constantly asking you questions.

</comment></comment></comment><comment><USER3> Here's my personal advice. While there are plenty of companies hiring strategies to look at to get ideas on how to accomplish getting the "best person" I would first take a step back and evaluate on what's important to you and your team and then filter based off that - be creative if you have to in order to get what you want.

While Frocer touched upon a majority of what we did, I'll throw in my interviewing experiences. We are partly in the video game industry so my #1 requirement was the applicant MUST have video game playing experience (of the 'core' variety) and the more the better. I just couldn't see anyone who only played Wii Sports or Bejeweled on the iPhone could comprehend what we do and therefore unable to help the team in any sort of discussion beyond the technical. So that was what was most important to me and that was what I filtered on and not surprisingly, I had a good feeling immediately after each interview on whether or not I wanted them.

My interview consisted of no stupid puzzles or whatever cause it was of no use to me. Show me you are technically proficient (of which a lot were, otherwise why waste time applying for the job) and then show me you understand video games by carrying an intelligent conversation with me about let's say your favorite xbox 360 game, which smash bros was the best, or why world of warcraft is both the greatest and worst game ever, etc. You'd be surprised on how many people couldn't do that.

Also I'm seconding the reference/portfolio thing. The more you can find about their past, the better the idea you will have about their future.

<comment><USER4> I'm curious. Did you ever try hiring someone who was an occasional gamer (the Wii and Bejeweled gamer) and they didn't work out or did you just assume that they wouldn't be a valuable addition to your team and automatically exclude them? The reason I ask is because I wonder if having some diversity in the level of gameplay ability in your staff might actually produce better games (i.e. ones that mere mortals can play). Of course, I have no idea what your target market is, but its pretty clear to me that occasional gamers are a largely untapped market that the large game companies are mostly ignoring. There's no doubt that Halo, Call of Duty, WoW, etc. sell a lot of units, but there are also a lot of people (I am one of them) who have absolutely no interest in playing those kinds of games for the very simple reason that we have other things to do with our lives. We still play games, but we avoid games that require a significant time investment in order to achieve competency at gameplay. For example, I do not play first-person shooter games at all - the user interfaces are too complex to learn when you're the sort of person who only plays games for a couple of hours on Saturdays and may go for a month or more between sessions of playing any particular game. Battle for Middle Earth II is at the upper limit of interface complexity that I am willing to tolerate before I give up on a game because it seems like I'm spending more time trying to remember the mechanics of the controls than I am just having fun playing. I tend to gravitate towards simple turn-based or mouse-click slash & hack RPGs (Pool of Radiance, Dungeon Siege, Diablo II), sim games (Sid Meier's Civilization, Masters of Orion II, The Sims), and simple arcade or puzzle games (Dig Dug, Arkanoid, Minesweeper). If it takes more than a minute to relearn the controls of a game when a month has passed since the last time I played it, odds are that I'll get frustrated and stop playing that game and avoid others like it. Similarly, if the default game AI is tuned to perform at the level of a hardcore gamer and there's no way to turn it down to a level that a perpetual n00b like me can compete with, I'll ditch the game and never buy another one like it (many real-time strategy games are guilty of this offense).

<comment><USER3> Sorry if there was some misunderstanding - what I meant by a 'core' gamer (and I hate this term) is one who doesn't play hardcore, but someone who is familiar with and plays in the more traditional gaming industry (which is our target market). Whether they be a casual gamer or not, I don't care, but if they can discuss all those things you just did in that huge paragraph and carry a conversation with me about them then that's what I'm looking for.

The problem is, trying to talk to someone who's only knowledge of gaming is Wii and iPhone about traditional gaming tends to go nowhere in my experience, whereas talking to a traditional gamer about the Wii and iPhone still leads to interesting conversation and ideas as those "casual" games are pretty much small extensions of traditional gaming.

</comment></comment></comment><comment><USER5> Here's my advice as a two-time former intern at two different places.

As a small startup looking to hire hackers, you obviously want the best. You want experienced hackers who already know how to code and perhaps have experience on a project before (e.g. open-source). Of course, you want the brightest.

But this is always a challenge because the smarter, more experienced, and more valuable a hacker is, the rarer they are and--odds are--the less likely they are willing to work for you because they're less desperate for an internship; they can afford to shop around, or may even just decide to do their own projects for a summer.

So here's how you can try to attract those people.

1\. Pay decently. A lot of companies like to pay interns nearly nothing these days (or in some particularly obnoxious cases, actually pay them nothing). This of course doesn't mean pay them as much as a full employee, but it does mean they should not feel insulted by the amount of money you're offering. If they could earn more than 5x your pay as an independent contractor, you're doing it wrong. While not all hackers do internships for the money, it's definitely a huge plus. And if you don't think you're going to get enough out of your intern to justify the pay, don't hire them; you should not hire an intern unless you have no doubts about their ability to produce significantly more value through their work than you're paying them.

2\. Deal with the interns' practical issues with regards to working for you. For example, if they're coming from out of town, deal with their housing and flights. Hackers dislike dealing with bureaucracy--you'll save your intern's time and effort and sanity by dealing with these issues.

3\. If your interns' time is so much less valuable than your employees' time that you cannot spare significant employee time to helping the intern with what he is doing (in the same way they would help another employee), don't hire an intern.

In terms of picking an intern, often you have to actively seek them out to be successful, especially if you're looking for the kind of hacker that doesn't go around applying to every internship he sees. For example, if your company makes very significant use of open source software, you can look through those open source projects for potential interns.

<comment><AUTHOR> That's great advice. What about the type of responsibilities? It seems that what we've heard is just being able to make an impact and being able to show exactly what they've done to future employers.

<comment><USER5> I think a good intern should be able to take real responsibilities as well. They shouldn't be exposed to the worst of the firefighting if it happens (they should still take part, but don't put them under the worst of the pressure; that's what your employees get paid for).

This means a number of things:

1\. Give them at least one project to work on with specific things that need to be done. Don't necessarily have a hard deadline unless there actually is one for the project; as long as your intern has work to do he clearly can't justify goofing off, so always make sure he has work to do.

2\. Have at least one project available for him to brainstorm on. Any good hacker is going to have loads of good ideas; the best way to waste these is to throw the hacker onto a project that doesn't need them. Your hackerf is not just a codemonkey. When you have your hacker dropping by your office or pinging you on office IM about a really cool idea he had for Project X, listen to him; it just might be a good one.

3\. Ideally, hire an intern who has a skill set or knowledge base that _nobody in your company has_. I don't need to describe the value of this.

</comment></comment></comment><comment><AUTHOR> Best places to post- Aside from the HN startups, so far, we've found the biggest pickup to be from Craigslist, Snaptalent, Startuply, Startupers, and JobScore. Others have said we're likely going to work off referrals (our personal networks).

</comment><comment><USER6> I feel the economic situation didn't make the hiring process easier, but actually much more difficult. We thought it would be easy since there are tons of talents being laid off from top-notch tech companies, and what happened was the exact opposite -- there are THAT many more resumes out on the market, and it takes THAT much more time to find the perfect fit. Keep in mind because we were still a small team, every hire must has the right balance of cultural fit, technical abilities, and entrepreneurial spirits. Finding good guys who can get the job done is easy, but finding the great guy who can take our product to the next level is much more difficult.

After going through thousands of resumes, and conducted probably 100 interviews, we finally brought on-board our first couple of team members. Some tips to share from my experience:

1\. Don't bother with job boards, such as Craig's list, Dice, etc. In this economy, there are too many resumes floating around, and reviewing them is an incredibly time consuming process when you can spend the time building the product. Negotiate a low rate with a recruiter and outsoruce that process. We wasted over a month using job boards, and got tons and tons of junk resumes. Probably only 1% of the candidates we got from job boards were interview-able. We got fed up, so we engaged about 5 recruiters simultaneously, and within the first week we got the perfect guy. If you really want to use job boards to try your luck, I had the best experience with Startuply though it still didn't result in a hire.

2\. Be extremely selective, if there's something that doesn't seem right, it's probably your gut telling you he/she isn't the right person. For hackers -- my favorite question to ask is "when did you first started hacking?". I have found most great hackers started hacking when they were very young (middle school to high school time frame). I found most people who started hacking in college is because they were forced to, not because they are interested in it. Of course this doesn't apply to every case.

3\. Do reference checks. In fact, ask the references for additional references. A candidate can master the art of interview, but reference check may tell a totally different story.

Also, I don't recommend technical puzzles. I recommend you to just ask a technical challenge you are facing right now. e.g. How would you architect JamLegend? How do you solve so-and-so problem? etc. While puzzles can test brain power, I think it's much more practical to have them solve a real problem that you face on a daily basis specific to your product.

Hope that helps, by the way, if you get referrals from personal network you can probably skip a tons of things I mentioned above, and they are usually the best early hires. Good luck with your hiring process!

<comment><USER6> Just want to add another quick note -- this is actually something I learned from Mike Cassidy.

We like to do all of our interviews in 1 day, and when the candidate is in his/her last interview, we will all gather and make a decision right on the spot. If we like the candidate, we will make an offer when the candidate is on the way out. You can say this offer stands pending all reference checks went through. But this serves two purposes:

1\. You show you have strong interest and is willing to make decisions quickly.

2\. You lower the risk of the candidate going to another interview and receive another on-the-spot offer, and take that offer on the spot.

Great candidates are very hard to come by, and they are in very high demand. So realize your offer won't be the only one they receive. If you are unable to make a decision on the spot, he/she is probably not the right person.

<comment><AUTHOR> I thin he said to "Hire Fast, Fire Fast" something someone just said to me.

</comment></comment></comment><comment><AUTHOR> Selling It-

Joel Spolsky's Field Guide to Developers (or what a developer wants) \- [http://www.joelonsoftware.com/printerFriendly/articles/Field...](http://www.joelonsoftware.com/printerFriendly/articles/FieldGuidetoDevelopers.html)

<comment><USER7> Joel also has a book on the subject: <http://tinyurl.com/dx4gyf>

</comment></comment><comment><AUTHOR> Interviews- two resources we found here:

<http://news.ycombinator.com/item?id=89615>

Joel Spolsky's Guerilla Guide to Interviewing Developers: \- Version 3.0: [http://www.joelonsoftware.com/articles/GuerrillaInterviewing...](http://www.joelonsoftware.com/articles/GuerrillaInterviewing3.html)

We honestly don't know what were great interview questions or were terrible ones. For example, google asks "can you teach us something?" while James Hong of HotorNot said once that he would have loved to asked the question "If you had to rob a bank, how would you do it?"

</comment><comment><AUTHOR> For Fun-

Anti-rockstar thread: <http://news.ycombinator.com/item?id=255587>

The ultimate secret to hiring: <http://www.netjeff.com/humor/item.cgi?file=hire.txt>

</comment><comment><AUTHOR> Puzzles:

We've been told to give simple puzzles during the interview (intro CS) and to not make puzzles a requirement to apply. Nevertheless, here were some prominent ones we found

\- Justin.tv puzzles: <http://jtvproblems.weebly.com/> (problems for flash developers too...) \- FB Puzzles: <http://www.facebook.com/careers/puzzles.php> \- Meebo puzzles: <http://www.meebo.com/jobs/#web> \- ITA Puzzles: <http://www.itasoftware.com/careers/puzzles07.html> \- ICFP contests

<comment><USER8> Those links are all to companies who have the puzzle sent in with the application, not given in the interview. Also, on that note, Joel Spolsky advises (<http://www.joelonsoftware.com/articles/SortingResumes.html>) that this will reduce the number of applicants you get, but not increase the quality. The reasoning is that, since great programmers will have options, including the problems will be equally likely to dissuade good candidates and bad candidates from applying and what you're left with will be desperate candidates that are willing to jump through any hoop. Perhaps just one take. Anybody that has used the with-application puzzles, how did they do for you?

As for in-interview questions, Joel also had some good advice ([http://www.joelonsoftware.com/articles/GuerrillaInterviewing...](http://www.joelonsoftware.com/articles/GuerrillaInterviewing3.html)), use two types of questions: (1) softballs, and (2) complex questions requiring a grasp of multiple layers of abstraction, like C pointers or recursion. With type 1, he recommends caring more about how quickly they do it than if they eventually get it right. For type 2, the goal is more to see how they think, and you're free to help them along with the trivia that is easy to forget but easy to find on Google in 15 seconds.

</comment></comment><comment><USER9> If you are at the point where you are communicating with people (via phone screen or full interviews) make sure to ask about any side projects the candidate might have. I cannot stress enough how many strong candidates I have seen with this being their leading indicator. Do not directly ask "Are you working on any technical side projects?" because they will know immediately what you are asking for and they will give you something that you want to hear. Phrase it more from the standpoint of what they do in their downtime or even what they enjoy doing other than writing code. That is where you should be able to see what kind of drive this candidate potentially has.

</comment><comment><USER10> My old article, still somewhat useful, imho:

[http://inter-sections.net/2007/11/13/how-to-recognise-a- good...](http://inter-sections.net/2007/11/13/how-to-recognise-a-good- programmer)

<comment><USER11> I like your article a lot. I think passion is what really separates the 9-to-5er from someone who genuinely cares about programming.

</comment></comment><comment><AUTHOR> Dealing with Resumes:

Joel Spolsky's Sorting Resumes \- <http://www.joelonsoftware.com/articles/SortingResumes.html>

</comment><comment><USER12> I have hired hundreds of people during the course of my career. In my experience, the most effective way to make solid hires consistently is to a) conduct an analysis of the candidates history of accomplishment and b)evaluate brains.

I understand you are currently seeking summer interns, no problem. Today, young people that are proven achievers have much to examine:

1) Projects they've built or been a part of--just because they were curious if they could do it.

2) What are they passionate about: who have they read/studied in the area?

3) Are they aware of market leaders in your sector and can they discuss what they believe is right/wrong in their model.

4) Extra-Curricular's (speaks to buy-in of culture)

5) How do they define providing value/work ethic?

The above represent top 5. Be certain that when you find a candidate you'd like to hire that you can articulate the value proposition you offer to them. Be prepared to demonstrate how being a part of your team will benefit them. Don't bullshit, anybody smart enough that you want to hire can smell it a mile away. Be Good. Absolute best of luck.</comment>


Applying machine learning to mammography screening for breast cancer - <AUTHOR> https://deepmind.com/blog/applying-machine-learning-mammography/ <comment><AUTHOR> [https://deepmind.com/applied/deepmind-health/working- nhs/hea...](https://deepmind.com/applied/deepmind-health/working-nhs/health- research-tomorrow/cancer-research-imperial-optimam/)

[http://www3.imperial.ac.uk/newsandeventspggrp/imperialcolleg...](http://www3.imperial.ac.uk/newsandeventspggrp/imperialcollege/newssummary/news_23-11-2017-15-55-49?hootPostID=9817a1f6532b31c1c6286bf9485df975)</comment>


Dataflow/Beam and Spark: A Programming Model Comparison - <AUTHOR> https://cloud.google.com/dataflow/blog/dataflow-beam-and-spark-comparison <comment><USER2> I'm much disturbed that the big G hijacked the dataflow term, to suddenly mean _their specific - rather involved I must say - dataflow based programming model_. The real dataflow [1] is a much broader term that doesn't outline specifics like programming semantics.

Seems as if they're trying to ride the wave of the recent upsurge in interest in dataflow in general (with sub-fields such as Flow-based programming, and implementations like Akka streams etc). That's OK, but hijacking a term for the whole field, is not.

[1] [https://en.wikipedia.org/wiki/Dataflow](https://en.wikipedia.org/wiki/Dataflow)

<comment><USER3> It's called Google Cloud Dataflow. Your complaint is like saying Google Cloud Platform is hijacking the meaning of Platform.

<comment><USER2> Yes, but if you look at the use of the word in the linked post, you will see that plain "Dataflow" is almost exclusively used - even in the title.

</comment></comment></comment><comment><USER4> I think that this is useful.

One question though. Is there a reason you can't use the Spark Window functions? [https://databricks.gitbooks.io/databricks-spark-reference- ap...](https://databricks.gitbooks.io/databricks-spark-reference- applications/content/logs_analyzer/chapter1/windows.html)

<comment><USER5> I haven't studied the code very carefully, but I think this is mostly PR piece. Not only using Spark from Java isn't a very good idea, but the "canonical" way to do transformations like that is using dataframes or datasets (which are from Spark 1.6 and provide some improvements over dataframes).

Take it with a grain of salt.

<comment><USER6> You're not going to get clean out-of-order processing semantics with any mode of Spark transformations. If you actually take the time to read the article, there's a section discussing the Java/Scala angle. The difference in code size is really secondary (though it is a difference). The difficulty in maintaining and evolving your pipeline over time using Spark is the main point, given the way important concepts become conflated with their API (any version of it). This all comes across much more clearly for those that actually take the time to read the words.

<comment><USER5> > If you actually take the time to read the article, there's a section > discussing the Java/Scala angle.

They claim this isn't about the length of code, yet they select the most verbose way to use Spark and proudly display how long it is.

I mean sure, lack of event-time based processing is known limitation of Spark (and a pretty annoying one - though it is supposed to be worked on) but there are ways to write about it without code made to look bad on purpose.

EDIT: come to think of it, this whole article is "spark streaming can't do event time" written in thousands of words with contrived examples attached.

<comment><AUTHOR> I think both length of code is a side effect that results from the primary argument, and "cant do event time" is one of the symptoms. Neither is a primary argument in the blog post.

The primary argument is demonstrated through color coding different logical bits, which end up being clearly portable and elegantly distinct in dataflow.

This is demonstrated in two ways:

1\. The "juicy value add" code that does the aggregation is labeled yellow, and doesn't change across all the samples with Dataflow. With Spark, it needs to be rewritten for every use case. Similarly, for all colors.

2\. In Dataflow all the colors are separate. This makes expressing your logic easier. In Spark, the colors mix in dramatic ways with every demonstrated use case.

As Tyler said, all this is described in the blog post itself, but I don't blame you for missing it, since it's a really long post :)

</comment></comment></comment></comment></comment><comment><USER7> I really like the Dataflow programming model, but this feels to me like an apples-to-oranges comparison.

Spark Streaming is a fully open-source project; although the Dataflow SDK is also OSS, my understanding is that the released version can only handle bounded datasets. Support for streaming (which is the major innovation, IMO) is only available in the form of stubs that call out to Google's paid, proprietary Dataflow service.

It's totally fine to compare an open-source project with a proprietary alternative, but I think it's odd that this article opens by talking about how the Dataflow SDK is being opened, and then spends all its time talking about proprietary features.

<comment><USER8> Accoring to the proposal ([https://wiki.apache.org/incubator/BeamProposal](https://wiki.apache.org/incubator/BeamProposal)), OSS impl. of streaming is on the way, by Apache Flink, etc. The blog is just suggesting the model itself is superior, regardless of OSS or not.

<comment><USER7> Huh, I can't find anything to that effect in the proposal. It does mention the existence of runners for Spark and Flink, but doesn't say they'll be getting streaming support. I had assumed it was unlikely for the same reason that this article talks about (lack of support for first-class processing by event time).

But assuming it's true. it's very welcome news! I'll be keeping a close eye on future releases.

<comment><USER6> Flink's event-time support is coming along nicely. Their first round of true event-time support came in November ([https://flink.apache.org/news/2015/11/16/release-0.10.0.html](https://flink.apache.org/news/2015/11/16/release-0.10.0.html)), and much more is on the way. Flink will be an excellent platform for Beam, both batch and streaming.

As I understand it, Spark has event-time support coming soon as well. I think basic stuff is landing in 1.7. Not sure precisely what they have planned, but I can only imagine that Spark will also become an excellent platform for executing streaming Beam pipelines in due time. In the meantime, the streaming runner for Spark can either target those features which Spark does support well (i.e., processing-time windowing, in this case), or try to emulate those it doesn't (such as how it was done in the article).

</comment></comment></comment></comment><comment><USER9> Did anyone read this? There was so much buzzwords and bullshit I couldn't slog past the first page.

Who do they write these things for anyways? It's not like we're college admissions or professors, just give us the straight deal. Unless you're pitching to schools and naive undergrads of course.

</comment><comment><USER10> Hey, this is kind of offtopic, but figured still appropriate to ask;

How come Google Cloud Storage can be used instead of HDFS? I'm comparing google/amazon/azure right now. Both Amazon and Azure have 2 types of storage options - the regular object storage (S3a and Blobs) and block storage (S3 and Data Lake Store). S3 and DLS can act as the file system for Hadoop themselves (meaning you can let the data sit there and fire up clusters just for processing when needed), but they cannot interface with tools like the regular storage.

Meanwhile, Google's storage is like regular object storage, but you can run map/reduce (dataproc) and Spark on it.

<comment><USER11> GCS can be used instead of HDFS, Dataproc is shipped with GCS connector installed ([https://github.com/GoogleCloudPlatform/bigdata- interop](https://github.com/GoogleCloudPlatform/bigdata-interop))

<comment><USER10> That... was kind of my point.

</comment></comment></comment><comment><USER12> Spark is dead.

<comment><USER13> long live _____ !

</comment></comment><comment><USER14> Url changed from [https://cloud.google.com/blog/big-data/2016/02/comparing- the...](https://cloud.google.com/blog/big-data/2016/02/comparing-the- dataflowbeam-and-spark-programming-models), which points to this.

<comment><AUTHOR> Thanks! The original URL is a new developer-focused Big Data blog by Google and Google customers:

[https://cloud.google.com/blog/big-data/](https://cloud.google.com/blog/big- data/)</comment></comment>


Ask HN: which mobile framework, if any, to use? - <AUTHOR>

Im developing a mobile web app for iOS and Android phones and Im not quite sure which approach to take.
Here are my options as I see them:
1. Use JQueryMobile or Sencha
I've had some experience with JQM when it was in alpha. I liked the structure and UI "look and feel" stuff, but the built in controls (ListView) were slow and the fixed positioning did not work as expected.
Haven't tried Sencha, but the pure Javascript approach seems abit unnatural.
2. No Framework
This is the most tempting approach, but I don't want to reinvent the weel.
Are there any good mini-frameworks/libraries for messaging/fixed-tabbar/basic mobile ui ?
As an example, I really like the feel of the GMail mobile app, they seem to have the fixed positioning sorted also.
Feedback welcome! <comment><USER2> I suggest not taking the "no framework" approach, as you will never be able to test exhaustively across the various mobile platforms (and also the various versions in each).

I agree jQuery mobile is a bit bloated, but with better processors in phones these days, that is no longer as much of a concern as it was a year back when JQM project was launched.

<comment><AUTHOR> My main issue with JQuery mobile was that the fixed bar did not work at all during scrolling. Will take another look though, maybe it has improved.</comment></comment>


Did Frank Zappa Come Up With A Business Plan For File Sharing In 1983? - <AUTHOR> http://www.techdirt.com/articles/20090405/1806484395.shtml

<comment><USER2> This interview of Frank Zappa, 'explaining the eventual downfall of music quality and talent' is so poignant. <http://www.youtube.com/watch?v=KZazEM8cgt0> Currently, the musicians on the top of the charts don't right their own songs and aren't every good musicians. The label's shape them and prop them up. Frank Zappa saw our current condition very accurately. The techdirt interview/article shows how much he wanted and needed to subvert the labels.

</comment><comment><USER3> Since when is downloading a file from a server considered file sharing?

Otherwise: Zappa was 20 years ahead of his time, it seems like the technology he proposed really would have worked, amazing read.</comment>


Fulfillment by Amazon suspends non-essential inbound shipments - <AUTHOR> https://www.businessinsider.com/coronavirus-amazon-suspends-all-non-essential-shipments-to-warehouses-2020-3 <comment><USER2> TL;DNR: Through April 5th, they're preventing marketplace vendors from shipping new inventory to Amazon's fulfillment centers that aren't household staples, medical supplies, or otherwise high-demand products. Marketplace vendors that do their own warehousing and customer shipments are unaffected. This may affect the available selection, inventory, and shipment options seen at Amazon, but no restrictions were placed on customer purchases.

The following notice was sent to my Amazon Marketplace account:

Hello from Fulfillment by Amazon,

We are closely monitoring the developments of COVID-19 and its impact on our customers, selling partners, and employees.

We are seeing increased online shopping, and as a result some products such as household staples and medical supplies are out of stock. With this in mind, we are temporarily prioritizing household staples, medical supplies, and other high-demand products coming into our fulfillment centers so that we can more quickly receive, restock, and deliver these products to customers.

For products other than these, we have temporarily disabled shipment creation. We are taking a similar approach with retail vendors.

This will be in effect today through April 5, 2020, and we will let you know once we resume regular operations. Shipments created before today will be received at fulfillment centers.

You can learn more about this on this Help page. Please note that Selling Partner Support does not have further guidance.

We understand this is a change to your business, and we did not take this decision lightly. We are working around the clock to increase capacity and yesterday announced that we are opening 100,000 new full- and part-time positions in our fulfillment centers across the US.

We appreciate your understanding as we prioritize the above products for our customers.

Thank you for your patience, and for participating in FBA.

The Fulfillment by Amazon team

</comment><comment><USER3> The title may be slightly confusing. They aren't suspending shipments to customers, they are suspending shipments _to Amazon_ from vendors (Fulfillment by Amazon vendors, who ship to Amazon and then Amazon handles everything from there).

The suspension covers non-essential supplies as mentioned in the title.

<comment><USER4> Surprised, but not surprised, that Business Insider would run an ambiguous, panicky headline in a time like this. Imagine if web journalism wasn't funded by clicks and precision of headline/reporting was the metric that mattered.

<comment><USER5> Imagine if people were willing to pay for journalism that prioritized accuracy over sensationalism.

<comment><USER6> Which one disappeared first? An audience willing to pay for quality journalism or quality journalism? I suspect quality journalism declined first, and it declined to the point where it made customers skeptical of journalism in general. That then shrunk the audience, and it circled back around again in a continuing cycle.

<comment><USER7> High-quality and low-quality journalism have always existed, regardless of business model.

The difference is, when told to put their money where their mouths are, people on the internet like to pretend that high-quality journalism doesn't still exist so they can keep their wallets closed.

<comment><USER8> So far, the only journalism I've found worth paying for is Monocle. Had subscriptions to The Economist and The Information for awhile before canceling them.

What would be nice is a pay per article approach. I find Monocle quality enough for an annual subscription, and sometimes The Economist is worth getting for a weekly here and there.

Also, another thing keeping me from having many subscriptions to different rags is how much information is free online (even things like the HN comments section have a wealth of information).

<comment><USER7> To summarize your post:

"I should pay to support quality journalism, but since there's stuff free online, I won't, and it will die."

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The Reuters version of this news is on page 2 right now with a clearer HN title: "Amazon stops receiving non-essential products from sellers amid COVID19 outbreak" [https://news.ycombinator.com/item?id=22605116](https://news.ycombinator.com/item?id=22605116)

</comment><comment><USER10> Kind of hard to know what exactly is an "essential" item.

Last week the condensate pump for my furnace stopped working. A condensing furnace produces about a gallon of water an hour while it's running.

I rigged up a storage bin to catch the water and would dump it out manually a few times a day. The size of the bin is limited because the furnace drain is only a few inches off the ground.

Keeping my house heated basically depends on that condensate pump. I ordered one on March 12 and it was delivered March 14.

There's probably a very long tail of strange things which are actually relatively crucial components that people depend on being able to order (rather than having spare parts on hand).

</comment><comment><USER11> The dangers of overcentralization of shopping. The country in which I presently live went into lockdown a couple of weeks ago, but I have still been able to order all kinds of stuff and have it delivered to my home: some furniture, some books, vinyl records, a new vacuum cleaner. That is because none of the disparate online shops here to which one turns are overburdened. Amazon's decision to be the one-stop-shop for everyone and sell food as well, now makes it unable to provide the rest of its inventory.

<comment><USER12> Well, on the other hand, it seems like _because_ Amazon is so centralized, they had a lot of capacity which they can now re-purpose. Previously they were shipping both non-essential stuff (books, vinyl records, etc) and essential (food, medicines), and now all those resources can go into essential things.

If the vinyl record shops had a completely separate fulfillment system, there would be no easy way to repurpose it to ship essential items, so we would be in a worse position.

<comment><USER13> In an unencumbered free market system where shipping systems were not dominated by any one particular shopping vendor (not Amazon, not vinyl record companies, nobody), what would naturally happen would be a sharp increase in shipping costs in accordance with demand (incentivizing shipping companies to increase supply), followed quickly by a corresponding decrease in demand for shipping items the market deems non-essential (e.g. I'm less inclined to order vinyl records online if shipping costs go up, but if I can't get hand sanitizer anywhere _but_ online I'll probably still order it).

<comment><USER14> > In an unencumbered free market system

This is not a real thing. Stop bringing it up as if it's a meaningful concept.

<comment><USER13> I'm not sure what you're trying to say. Are you saying an unencumbered free market system is impossible, or just that it's not what our current system is right now?

If the latter, I agree; that was sort of the whole point of my comment. Amazon controls a large portion of the shipping market, therefore what we have here is closer to a monopsony than an unencumbered free market.

If the former, I mostly disagree. Obviously a perfectly idealized free market system is impossible in the real world: all idealized systems are. There's no such thing as a frictionless surface or a perfect sphere either. That doesn't mean however that we couldn't be a lot closer to that ideal than where we are now, or that idealized systems aren't useful tools for modeling the behavior of similar, non-idealized systems in the real world.

<comment><USER15> While an unencumbered free market can exist it's not a stable equilibrium. Without strong external forces keeping it in that state a free market will quickly centralize power and enact artificial market barriers.

</comment></comment></comment></comment></comment></comment><comment><USER16> Bear in mind that "essential" in these contexts is a very fluid definition, and is likely to be highly dependent on the popularity and connectedness of the sellers/partners.

For example, Elon Musk managed to convince Alameda County that manufacturing luxury vehicles is an "essential" service subject to exemption from their industrial shutdown order.

</comment><comment><USER17> On the topic of hiring 100k workers, how is amazon planning to safely manage such a large increase in a physically-present workforce when all the current suggestions are to prevent large gatherings and isolate?

<comment><USER18> Packaging doesn't strike me as a particularly person-to-person type of thing where you need to touch other people.

I'd imagine gloves, masks, and safety glasses are probably fine.

<comment><USER19> Touching something someone else just touched after wiping their cough spray off their lips is definitely a risk booster.

<comment><USER20> 24 hrs on cardboard, up to 72 hrs on plastic/stainless steel (smooth surfaces).

<comment><USER9> Caveat: that's our best understanding at this time; that study hasn't been reproduced as far as I've seen.

<comment><USER20> I would take these as minimums, still wipe down outside material with bleach/windex/soap water.

<comment><USER9> Exactly, yes. Although, does the amount of ammonia in window cleaner actually do anything useful?

<comment><USER20> It is the degreaser that makes the outside of the virus fall apart.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Anyone knows if this applies wordwide? Specifically Europe/Spain

<comment><USER2> Great question. The seller FAQ (marketplace account required) clarifies that this applies to the US and EU marketplaces.

</comment></comment><comment><USER22> dang, this title should be updated. It's inaccurate to the point of fearmongering (probably not OP's fault, since the article has probably changed the title to a more accurate one, but I'd say this falls under "...unless it is misleading or linkbait" and should have been submitted differently)

</comment><comment><USER23> Amazon's crisis is an opportunity for other online retailers.

I know I've started searching around on other online retailers like ebay, wallmart, home depot, and boutique retailers for products that were no longer in stock on Amazon.

</comment><comment><USER24> The announcement from the original source:

[https://sellercentral.amazon.com/gp/help/external/help.html?...](https://sellercentral.amazon.com/gp/help/external/help.html?itemID=GF37V7QBB8WSVF43)

</comment><comment><USER18> Pretty big news and says a lot about the state of the situation if even Amazon can't keep up (yes, with stocking, not shipping, but still).

</comment><comment><USER25> Clickbait be clickbait.

Can't we stop this bs panic inducing clickbait in times like this?

Edit: looks like they've updated the title

</comment><comment><USER26> Paywalled. Can't read it.

<comment><USER27> [http://archive.ph/CCOvG](http://archive.ph/CCOvG)

Edit: Amazon is suspending all incoming shipments of non-essentials to their fulfillment centers. You can still order non-essentials that are currently "in stock" and at their fulfillment centers.

<comment><USER28> This message will get mangled out in the public. Hopefully it won't trigger a run on Amazon and make things worse for the fulfillment centers.</comment></comment></comment>


Building a statistical significance testing web service powered by R - <AUTHOR> http://garysieling.com/blog/building-a-statistical-significance-testing-web-service-powered-by-r

<comment><USER2> I've heard good things about the package Rserve. It's a good way to combine a lot of server side R requests with your online app of choice. <http://www.rforge.net/Rserve/doc.html>

</comment><comment><USER3> There's also an R buildpack for Heroku. There's a sample app written using Sinatra (Ruby) included.

<https://github.com/virtualstaticvoid/heroku-buildpack-r>

</comment><comment><USER4> Would it be possible to code everything in something like Django to handle the HTTP, view parts, and farm out the calculations to R?

How would you design that?

<comment><USER5> Of course, but at that point you likely wouldn't be using any R-leaning webservers; rather, you'd start with any old web server, and then just make shell calls to R. Or, you _could_ do the "R as a service" type thing, and have your normal [Django] stack make a webservice call to the R-webservice.

</comment></comment><comment><USER6> Keep in mind that R is an in-memory language and that each object you'll be creating will be stored in RAM. This could be tricky if you have huge datasets

</comment><comment><USER7> This is really neat! You should post more examples, like if I had a range of data points could I post that data set and have R output a best fit line?

<comment><AUTHOR> Thanks, glad you liked it, I have more examples coming.

There is a library you can install that looks like a web-based charting frontend for R, although I have not had a chance to try it-

<http://www.stat.ucla.edu/~jeroen/ggplot2/></comment></comment>


The Distributed Robotics Garden - <AUTHOR> http://people.csail.mit.edu/nikolaus/drg/ <comment><AUTHOR> Are there any startups focusing on doing this?</comment>


On Books - <AUTHOR> http://www.tbray.org/ongoing/When/201x/2010/09/26/On-Books <comment><USER2> The lack of sharing (or even giving) is the biggest barrier to my total plunge into ebooks. As Tim notes, the fact that ebooks are barely cheaper than paperbacks, regardless of zero printing costs and no opportunity for resale, doesn't help. I can't help but feel I'm getting a raw deal.

As it stands If i know a book is just for me and/or my wife, I'll pick it up on the Kindle, otherwise it's the dead tree route.

I really hope that one of the major ebook makers will at least add the ability to 'gift' books to others, but I think it's unlikely. They have little to gain and I'm sure publishers would put up a hell of a fight. The best we're likely to get is the nook's crippled lending function, or something similar that publishers have the option of disabling, and thus do so for every title (much the same way as most books now have the Kindle's text to speech feature disabled).

<comment><USER3> This is definitely a downside but the major upside of a digital library is that I have it with me wherever I go. If I'm somewhere where I only have my Droid or my laptop I have all my books. If my Kindle falls in the sink or is lost I lose nothing. Most importantly, I don't have to lug around 20 heavy boxes of books every time I move.

On the whole the tradeoffs lean to ebooks for me, and this will be even more the case if the price of the digital versions come down a bit more.

<comment><USER4> Since this is a prominent argument may I humbly ask, why would you want to take a library with you? You can only read one book at once. The only use-case for a portable library would be writing a scientific paper at the restaurant or coffee shop. I have my doubts though that this would improve the quality of the paper.

<comment><USER5> I actually have a Kindle and seldom use it any more: [http://jseliger.com/2010/04/13/kindle-land-with-requisite- ru...](http://jseliger.com/2010/04/13/kindle-land-with-requisite-ruminations- on-the-ipad/) , but as someone with ~1,000 books I can answer:

1) Moving is a pain in the ass, to put it lightly. No, excuse me: to put it heavily. Very, very heavily. Especially cross country, though I've acquired a lot of books since starting grad school.

2) Shelving is expensive.

3) At scale the right book can become harder to find. The other day I spent 15 minutes looking for Tom Perrotta's _Election_ because it wasn't quite where I thought it was.

4) Most of us don't have infinite room and therefore eventually run out of space.

5) Searching is still pretty nice.

That being said, why do I still read paper?

1) The note-taking function on the Kindle sucks ass, and I compulsively fill margins.

2) Page turning is still too slow.

3) I actually flip back and forth between pages quite a bit.

4) I'm not convinced that DRM isn't going to bite me in the ass 1 to 20 years from now.

5) Anachronistic attachment to paper.

6) I'm a grad student, and the citation / edition situation hasn't been sorted out for the Kindle. This is very important when writing academic papers.

Note that I'm not making some kind of moral argument about whether electronic reading is good, bad, or indifferent. To me, it just is. I foresee eventually moving chiefly to electronic reading, but I'm not sure when or how that shift will happen. I'm also not interested in the iPad because I spend enough time staring at LCDs as it is.

<comment><USER6> _2) Shelving is expensive._

This is so true. Or if it's not expensive, it's not strong enough. I have a wall of Ikea shelving, and have to stabilize it using old Oracle books (our floors aren't totally flat, so I use the books to adjust the lean angle against the wall). I guess that proves Oracle is good for something though.

 _2) Page turning is still too slow._

This is a big problem. I have a Kobo, and the slow startup time and page turning time are the biggest issues.

<comment><USER7> >> Shelving is expensive.

> That is so true.

It is, but it's missing an even bigger cost. Walls are expensive. Housing space is expensive. Space for all our books has been a major consideration every time we've moved house. Crudely, I estimate $1-2/book for good shelving and $5-10/book for the space to put the shelves in, even taking into account the fact that the rooms whose walls you fill with books will have other uses too.

Of course it depends where you live. I'm in a part of the UK where housing costs are heinous. In San Francisco or New York it would be even worse. In, say, North Dakota, I expect it's a different matter.

</comment></comment></comment></comment></comment></comment><comment><USER8> _But given the current arrangements, I'm being charged just a little bit less than I pay for paper and getting a whole lot less, and it just doesn't feel like a good deal._

Speaking as someone who's moved more times that he'd like to count, I enjoy getting a whole lot less--less weight, fewer boxes, less room taken up in my home. My Kindle's lighter than a thick magazine and takes up way less room in my bag. When you compare it to a hardcover (especially a fantasy hardcover) the difference is amazing. Try reading a Wheel of Time book one-handed for an entire afternoon in paperback or hardcover. Then try flipping the pages one handed, too.

For me it's a question of convenience, and I'll take my convenience over that of my friends in this case. If they don't trust my recommendation enough to track a book down in a library (or download the free sample from Amazon, if they've got a Kindle), then I really don't care what they're reading.

</comment><comment><USER6> He didn't address what the screen is like for reading on (compared to an eInk reader like Kindle etc).

I have a Kobo Reader, and it's pretty good. The DRM is a hassle, so here's my workflow for buying a new ebook (and yes, the fact I have workflow to buy a new ebook sucks, and says a lot about where my time goes):

Prerequisite:

You'll need Adobe-eBook-DRM-shit-whtaever it is called installed before you begin. Otherwise you'll download the book and won't be able to use it. OTOH, it does run on Linux, so that's something.

1) Find the book you like. I find <http://www.bookdepository.co.uk/> because they have a good range and good prices on ePub books, and give you 3 copies

2) Download the book.

3) Using the following search, find the python scripts to remove the DRM: <http://www.google.com/search?q=python+remove+epub+drm+script>

4) Use <http://calibre-ebook.com/> or the KoboBulkFixer program to remove fixed font sizes from any styles (the Kobo won't scale those, so everything appears in about 8pt writing)

5) Put my eBook in dropbox so I don't have to do this again

6) Copy the eBook to my Kobo.

I should note that I _need_ to remove DRM to fix the font problem.

Like I said, this sucks. But OTOH, ebooks are good.

</comment><comment><USER9> I love ebooks, but I prefer to read paper books. The haptic and olfactory experience of reading a book is something that I've enjoyed as long as I can remember, and I won't give it up lightly. However, all those classics I've neglected to read are now a few clicks away and available for free. The cost of building my library of paper books versus the wide availability of free ebooks has made me a happy ebook adopter. There is one other problem, however.

I use linux at home and so cannot use Adobe Digital Editions or other DRM system. So, I have to rely on freely available, DRM-free files that I find on the Internet. Legally, many classics are available; illegally, many more. The upside to this is that not being encumbered by DRM, I'm free to share my collection. The downside is that it's been all too easy for me to become a criminal in the eyes of the law.

</comment><comment><USER10> I think the publishers are probably factoring in the effects of piracy. In the past they couldn't stop people from lending/sharing printed books but they could stop mass produced counterfeit printings. Now it's the exact opposite. They can't control the digital counterfeits in the form of piracy but they can stop digital lending/sharing. Maybe they hope to break even in the end. I can see from their perspective that having both sources of lost revenue combined is a nightmare scenario. I think as readers we probably need to accept that $10 or $15 for a book that is going to bring you many hours of enjoyment isn't a bad deal. We have the Internet to research books, fairly generous samples to read, social networking to spread the word.

<comment><USER11> But we have the pirate bay. Piracy just will be widespread, like it was for software for 35 years, and for music for 12 years, and movies for almost as long.

</comment></comment><comment><USER12> Now that there are several options for reading digital books comfortably, I think the publishing industry is going to face tons of problems with piracy. A book that takes hours to consume can be downloaded in minutes. Furthermore, we're already seeing torrent files of hundreds of DRM-free best sellers, making it easy to download first, decide later.

In the short term, the best solution seems to make the official process more convenient than pirating (Amazon does this quite well). In the long term, the best solution will probably be to combine the convenience with a subscription model. Lending books becomes a non-issue if all your friends have a $10/month subscription to Amazon's entire catalogue.

</comment><comment><USER13> Books are still better, IMO.

I can lend one to a friend. They don't need a $300 compatible reader. I can lend it to as many friends as I want. I can leave it on a park bench and share it with a complete stranger.

I own the copy. I can sell it. Burn it. Press leaves in it. I can scribble in the margins. Fold the corners. Donate it to a library.

I can have two pages open at once. I can flip to indexes, important tables, and chapters without fiddling with buttons and menus. I don't have to recharge my book or replace batteries. If I drop it or get it wet, it's probably going to be fine. I know that in 50 years I'll be able to read the thing.

I've come to be of the opinion that unless I own a physical product, I don't own anything. Digital goods are meaningless and ephemeral. They come with digital locks and stupid restrictions that I don't really care to bother with. I don't want to pay a subscription or find some hack to work-around their limitations. Books are cheap and work just fine. And I get to own them.

</comment><comment><USER14> The whole sharing issue is major in my opinion. If a new technology brings new benefits but takes away some key benefits of the paper medium, I would bet that the users community will quickly question the future of e-books with some serious hacks and p2p challenges to the publishers and distributors.

</comment><comment><USER15> Everyone in our house gets to read all the iPad books.... First off most of them are drm free books from orielly and pragmatic programmers or PDFs that can be emailed. But even the ones from the AppStore are just in iTunes and itunes syncs our book libraries, so if she adds one to hers i get it immediately on mine. ITunes supports sharing of drm encumbered media this way. Also it means we have a backup in case one of e laptops dies.

<comment><USER16> I see a new definition of family emerge - are you in my Apple home network?</comment></comment>


Army National Guard announces data breach - <AUTHOR> http://www.nationalguard.mil/News/ArticleView/tabid/5563/Article/607769/army-national-guard-announces-data-breach-establishes-call-center.aspx <comment><USER2> This isn't what most people think of when they hear data breach. There was a breach of DoD security standards when data was transferred to an inappropriate environment but no evidence that the data has been leaked beyond that transfer.

I think it's laudable that the Army National Guard would do a breach notification when there's only the possibility of malicious data loss.

<comment><USER3> Maybe there is some untold, yet upcoming story behind this.

<comment><USER4> I immediately assume China and/or Russia are working on a World War III plan. Dossiers are being built to help carry out the targeted and synchronized assassination of tens of thousands of key U.S. military personnel by sleeper cell agents during a coordinated world-wide attack.

<comment><USER5> Why would either of them do that, though?

<comment><USER6> You don't need any why like that to write a successful novel!

<comment><USER7> I second this! staunch, get cracking.

</comment></comment></comment></comment></comment></comment><comment><USER3> Startup idea: apologeticpressrelease.com

Just input corporation, firm or department name.

Select multiselect dropdown "what you take very seriously".

Select number of "employees|customers|people" (pick one) that will get free credit monitoring.

Select for how long.

Press [Submit]

Input payment information.

Press release automatically issued.

(we( at )?|CORP_NAME) take your (data|privacy|security|information) very seriously

<comment><USER8> Don't forget to mention that the malware used was "extremely sophisticated".

<comment><USER9> "not yet sure if there is a nation behind it, as it seems to be too advanced for everyday hackers"

</comment></comment></comment><comment><USER10> So basically someone (who was probably getting paid by the DoD) scp'ed some info to a server he/she wasn't suppose to.

This more like a breach of standards. At least they know where the data went. The OPM breach is far worse.

</comment><comment><USER11> It is better to simply assume that all data has been breached unless incontrovertible proof is found to the contrary.

<comment><USER12> Seems kind of like the "law of security testing" \-- the lack of evidence of data breaches doesn't preclude the possibility of leaked data.

<comment><USER13> the absence of evidence is not evidence of absence.

[http://youtu.be/MFBjCM0mZHg](http://youtu.be/MFBjCM0mZHg)

<comment><USER14> Off topic, but absence of evidence is in fact evidence of absence, though depending on the circumstances it might be weak.

Say we'd like to know if A exists. There's some evidence for A's existence, which we'll E. The absence of this evidence is ~E.

By Bayes' theorem:

P(A) = P(A intersect E) + P(A intersect ~E) = P(A|E)* P(E) + P(A|~E)*P(~E)

So the probability that A exists is a weighted average of the probability that A exists when there is and is not evidence.(Since P(E)+P(~E)=1) There is a kind of 'conservation of probability'.

If the idea that 'E is evidence of A' is to mean anything at all, then it means that P(A|E) > P(A). Hence P(A|~E) must be less than P(A). Another way to say it is that P(~A|~E) > P(~A). And absence of evidence is absence of evidence.

<comment><USER13> You're speaking of negative evidence; as in, evidence that negates a particular truth claim.

Negative evidence is not the same thing as the utter and complete non- existence of any evidence whatsoever—the _absence_ of evidence. That's because negative evidence absolutely _is_ evidence.

The saying goes, 'the absence of evidence is not evidence of absence' _not_ 'the evidence of absence is not evidence of absence'. See the difference?

Watch the linked video when you have a moment.

<comment><USER14> > You're speaking of negative evidence

I wasn't. ~E is a shorthand way to write that E is not found, not that the opposite of E is found. In the language of probability/set theory, ~E is E's complement - every event in the space of probabilities except for what's in E. It's the unique set such that ~E intersect E = empty set, and ~E union E is the whole space.

The point of the proof I gave is that there is no distinction between 'negative evidence' and 'absence of evidence'.

As I mentioned earlier, there is a kind of conservation of probability. The only way for a piece of evidence to give evidence for A is that the lack of that evidence reduces the probability of A. The probability mass has to come from somewhere.

<comment><USER13> "I wasn't. ~E is a shorthand way to write that E is not found"

You where. What you are describing is, 'we constructed a hypothetical experiment and arrived at a null result'; that is, in fact, evidence.

No one is saying, 'a null result is not evidence of absence'.

Please stop conflating the _presence_ of something with the _absence_ of something.

Yes, the statement is a tautological statement. We are repeating the same assertion twice using different phrasing. And as such, the proposition as stated is logically irrefutable.

'No evidence is no evidence', is a correct—but diminished—restatement.

Have you watched the video?

<comment><USER14> I watched the video you linked. It's a straw man and misrepresents the way the maxim is commonly used.

Let's go back to my original example and say we want to know if A is true. We have the choice to run an experiment whose positive result E would give support to A. The linked video would say that before we run any experiment, we have no additional evidence for A. Essentially that P(A) = P(A). This is true.

The way this should be used in the real world is: I look even the slightest bit for A and don't find it. As long as my search for A had the smallest positive chance of finding it were it to exist, then my lack of ability to find A gave me information about the world, and we get that P(~A | ~E) > P(~A).

Edit: To be precise the maxim should be something like: "Absence of evidence after looking for evidence is evidence of absence".

<comment><USER13> The very act of "looking for evidence" moves it out of the category of the absence of evidence.

Again, what is being said is, 'no evidence is no evidence'. If you have the _absence_ of evidence then you have no evidence of absence.

We are--kind of--using the word absence in two senses. First as a synonym for none, a number less than one, zero; the second as a synonym for non-presence, non-existence, the lack of an extant sample.

Having _zero_ [absent] evidence is not evidence that there is _no extant sample_ [absence]. I hope that helps.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> As a former ARNG member and a current Army Reserve member, this doesn't surprise me at all. The U.S. military's regard for personal information has been dreadful. Service in the military entails endless filling out of paper and electronic forms and almost every one of them has the servicemember's SSN on them. These forms get filed in filing cabinets, e-mailed around and--quite often--left on desks. The situation is made worse because our pay grades are typically part of the form, too, so a potential identity thief knows the approximate salary of the victim because our salaries are standardized and readily available.

Things are getting better and the DoD has switched to a non-SSN identification number but the SSN is still frequently used.

<comment><USER16> The point I take away from this is, how long is SSN going to be a super secret 11-digit pin for your life? Banking online, job forms, etc all use SSN and it gets thrown around everywhere. Are there any indicators that we're working on something a bit more modern for identification?

<comment><USER17> This new version of 0Auth is based on a military grade security model.

You authenticate everywhere using a long number (PIN) (so long you have to write it down and store it). All the services you authenticate with will store this PIN unhashed.

You should keep your PIN safe, because it can be used to apply for bank accounts, loans, and commit tax fraud if it is stolen.

If you ever forget your PIN don't worry. We will print it on various letters and mail them to you. If you need it urgently, you will find it next to your name in various post-hack data dumps around the internet.

</comment></comment></comment><comment><USER18> > files containing personal information was inadvertently transferred to a > non-DoD-accredited data center

Which could be anything. For example, an AWS server somewhere. Or, how about a VPS hosted by GoDaddy? A lame attempt at humor. Yet, what do we really know?

> by a contract employee,

Which could be anybody, right?

> we do not believe the data will be used unlawfully

We don't guarantee...we do not "believe".

More detail would have been useful. If my data was with the Guard I would not know what any of the above meant other than my data was made available to a contractor who uploaded it to a random server somewhere and, at the moment, it could be floating in space for anyone to grab.

Brilliant.

<comment><USER19> Two things to be aware of:

1) This was an external press release. It's possible communication to the actual Guard had more detail. Or not; it's the military, and they'll tell you what you "need to know."

2) While they don't guarantee the data wasn't leaked, I read that as more in the sense that "The non-DoD-accredited datacenter is outside of our auditing trail" than in the sense that it's actually likely the data was leaked. If you take my state's drivers' license database and uploaded it to AWS, the state can't "guarantee" the data wasn't used unlawfully either, but you can be certain that Amazon has a lot to lose if some failure of _their_ infrastructure gives China access to a list of passport-authorizing documents.

</comment></comment><comment><USER20> "All current and former Army National Guard members since 2004 could be affected by this breach because files containing personal information was inadvertently transferred to a non-DoD-accredited data center by a contract employee [...]"

<comment><USER21> I may be overly cynical of US government policies and procedures, but I read this as someone tried to use AWS or similar without permission.

<comment><USER19> I'm reminded of the breach reported by Britain's National Health Service in 2014 ([http://www.theguardian.com/society/2014/mar/03/nhs- england-p...](http://www.theguardian.com/society/2014/mar/03/nhs-england- patient-data-google-servers)), where data was uploaded to make use of Google's big-data sifting technologies in violation of NHS policy about secured storage of British citizenry PII.

The irony that the data had been uploaded to a physically secured, encrypted datacenter network from 27 DVDs in the possession of someone who could do whatever they wanted to with the contents of those DVDs without audit was not lost on me.

I don't reference this to imply it was good and proper use of the data; merely to note the difference between policy security and actual security.

</comment></comment></comment><comment><USER22> Wow, excellent response. It's encouraging to see that they don't just sweep this under the rug.

<comment><USER23> Its good that they own up to it but I'm getting a bit tired of hearing "we take security very seriously."

I feel like this phrase has become the mating call of organizations who aren't serious about security until they get hacked.

<comment><USER24> Obligatory: [http://www.troyhunt.com/2015/07/we-take-security- seriously-o...](http://www.troyhunt.com/2015/07/we-take-security-seriously- otherwise.html)

<comment><USER25> Was just about to comment. Ever since I read the article, it's the first thing I notice (whether or not that's fair).

</comment></comment></comment></comment><comment><USER26> When I read that "an employee transferred data to a non DoD-accreditated data centre", I imagine the employee transferring a dataset to Amazon Web Services or something similar (usually because the tooling in their current environment is horrible).

Edit: I just had a look and found AWS is actually DoD-certified [http://aws.amazon.com/compliance/dod/](http://aws.amazon.com/compliance/dod/). I wonder what the data centre in question could be.

<comment> jon-wood Only some parts of AWS are DoD certified, and even then only some services in the GovCloud region (which isn't widely available) are fully certified. It's entirely possible some contractor made use of a service which isn't certified still.

</comment></comment><comment><USER27> This seems non-adversarial, more like a violation of DoD's own internal policies. I wonder why they don't say whether they were able to perform any remediation?

</comment><comment><USER28> I'm sorry but there is likely to be more to come. "All current and former since 2004" .. No one transfers _all_ the files by accident unless the systems and controls and sheer "WTF am I doing this for" attitude is simply missing.

This Inwill guess is the least awful of a series of breaches to be released, as everyone falls over themselves to check their seals.

<comment><USER19> It's likely similar to the British NHS policy failure in 2014.

The shear between the tools publicly available on private data networks for analyzing and slicing bulk data and the tools available on cloud networks is wide and growing. As it continues to widen, you can anticipate that more and more tech-savvy mid-level staff in government positions will look at the status quo and say "I could follow policy to the letter, or I could use the cheap-and-easy tools I'm familiar with to get some Goddamn work done and trust that data living in AWS is at least as secure as where it currently lives, in that tool-shed-looking building on the back of the base with the door that doensn't quite latch correctly."

</comment></comment><comment><USER29> Ahem...I'm just going to leave this here for now on when I spot the following pr cliche

[http://www.troyhunt.com/2015/07/we-take-security- seriously-o...](http://www.troyhunt.com/2015/07/we-take-security-seriously- otherwise.html?m=1)

</comment><comment><USER30> who could possibly benefit by having this data? I don't think it's of any use to scammers and criminals.</comment>


How Russia is using authoritarian tech to curb coronavirus - <AUTHOR> https://www.cnn.com/2020/03/29/europe/russia-coronavirus-authoritarian-tech-intl/index.html <comment><USER2> We are the good guys so when we are using the same tech we are caring and progressive.

<comment><USER3> Exactly, this anti russia / china rhetoric has become pathetic.

<comment><USER4> So is the opposite, namely citing the apparent effectiveness of the Chinese response to argue for more authoritarianism broadly and generally.

Emergencies are not normal conditions, and it is both rational and ethical to behave differently and even employ different political and ethical models during them. In an emergency, naked pragmatism rules. Do what works, whatever that is.

Example: its normally very unethical to torture someone. What if a nuke is about to destroy a city and they know the disarm code? Maybe it is under that condition, but if so it does not follow that torture is now broadly legitimate. That was an ethical edge case.</comment></comment></comment>


npm@3 Exits Beta - <AUTHOR> https://github.com/npm/npm/releases/tag/v3.3.4 <comment><USER2> The big changes between npm@2 and npm@3 are the node_modules flattening, which has been a huge pain for those of us doing development on Windows given the MAX_PATH issues deeply nested node_modules have caused.

Very excited to see this out of beta!

(Also, the new Unicode progress bars are cute and more interesting to watch than the classic |\\-/| spinner...)</comment>


The Tiny Wire Around Manhattan - <AUTHOR> https://www.youtube.com/watch?v=KPYp3lOOOrg <comment><USER2> Interesting topic. Unwatchable video, though. Is that really how it's necessary to explain things to people these days?

The wire is called an "eruv". There are many articles about it that won't make you feel like you have been handcuffed to a tiny desk in a kindergarten.

[https://www.atlasobscura.com/articles/eruv-manhattan- invisib...](https://www.atlasobscura.com/articles/eruv-manhattan-invisible- wire-jewish-symbolic-religious-home)

 _More than 200 cities around the world are partially encircled by an eruv._

[https://www.npr.org/2019/05/13/721551785/a-fishing-line- enci...](https://www.npr.org/2019/05/13/721551785/a-fishing-line-encircles- manhattan-protecting-sanctity-of-sabbath)

Status page here.

[http://eruv.nyc/](http://eruv.nyc/)

<comment><USER3> > There are many articles about it that won't make you feel like you have been > handcuffed to a tiny desk in a kindergarten.

Yep, as someone in their mid 50's I find this style of narration and the visuals utterly annoying and condescending. Sadly it's all the rage with all the attention deficit kids. I'm clearly not their audience.</comment></comment>