Israeli scientists develop tissue implants that won't be rejected - <AUTHOR> https://www.israel21c.org/israeli-scientists-develop-implanted-organs-made-from-patients-own-cells/ <comment> andy-fillebrown This is interesting stuff but I don't think the article describes anything groundbreaking. The cells used by the scientists in the article are called adipose-derived stem cells and their applications are already well known in the regenerative medicine industry. See [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3668445](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3668445)

The biologists I develop software with have been talking about adipose-derived stem cells for over a year, so I was hoping the article was going to announce a technological leap in organ manufacturing. It did not.

<comment><USER2> The joys of press releases vs. actual scientific papers.

<comment><USER3> The innovation is personalized hydrogels built to avoid rejection, not the induced pluripotent stem cells which were re-differentiated into things. The key was the structural materials which hold those cells.

[https://onlinelibrary.wiley.com/doi/10.1002/adma.201803895](https://onlinelibrary.wiley.com/doi/10.1002/adma.201803895)

<comment> andy-fillebrown That makes sense but is hydrogel rejection really a thing? I thought hydrogels were already safe from rejection because they don't contain anything the immune system sees as a threat. Same goes for collagen, no?

</comment></comment></comment></comment><comment><USER4> It seems to me that the main advancement here is that the native extracellular matrix is being re-seeded with differentiated stem cells, as opposed to ordinary tissue engineering which uses a manufactured ECM or tissue transplants, which do not involve making stem cells.

There's still a long way to go before organs can be engineered, even with this tech. We will need much finer control over the delivery of differentiating signal factors for pluripotent stem cells as well as ECM structure.

<comment><USER5> I thought we already had processes for taking pig organs to use as ECMs (by chemically flushing them of cells) and then reseeding then with a patient's stem cells? If so then this discovery is about not requiring stem cells, instead they have found a new reliable process to repurpose stomach cells, which are obviously easier to harvest.

<comment><USER4> You're right that we could already re-seed decellularized pig ECMs with human stem cells, but we have also already been able to derive stem cells from the stomach. I think the main claim that they're making is that by deriving both the ECM and the Stem cells from the patient, the resulting tissue engineering scaffold is less immunogenic than other methods.

While this is somewhat interesting, they get into trouble by going on to claim that they've been able to generate "functional cardiac, cortical, spinal cord, and adipogenic tissue implants". From what I can see in the paper they saw increased expression of a few markers associated with those cell types and some minor electrical activity, etc.

The idea that differentiating stem cells into vaguely tissue-like phenotypes is equivalent to being able to manufacture organs brings back memories of the shenanigans that went down at UCL a few years ago [1].

1\. [https://forbetterscience.com/2016/12/21/birchalls-trachea- tr...](https://forbetterscience.com/2016/12/21/birchalls-trachea-transplant- trial-at-ucl-suspended-by-health-authorities/)

<comment><USER6> >decellularized pig ECMs

why not 3d print the ECMs? Isn't it just basically collagen with some fibrin/laminin thrown into? Do the decellularized ECMs not have any immunogens left? Definitely isn't an issue with the printed ones.

<comment><USER4> Unfortunately even with just collagen we can see an immunogenic response that is annoyingly exacerbated by UV cross-linking of the individual collagen proteins. That's why many of the best manufactured ECMs are cross-linked using a mixture of UV exposure and EDC-NHS. Without photolithography i'm not sure you'd be able to get a resolution high enough to mimic native ECM structures.

</comment></comment></comment></comment></comment><comment><USER7> No one likes to talk about the potential side effects of stem cell therapy. They express tissue factor, which increases after culture required for these treatments. Tissue factor is highly thrombogenic and can cause blood clots.

[https://stemcellsjournals.onlinelibrary.wiley.com/doi/full/1...](https://stemcellsjournals.onlinelibrary.wiley.com/doi/full/10.1002/sctm.18-0015)

</comment><comment><USER8> Sounds like great news for damaged organs, but the article seems imply full organs.

Like the first line is: "cutting the risk of an immune response to implanted organs."

</comment><comment><USER9> I feel threatened by this and consider my ability to reject tissue implants as a last line of defense.

</comment><comment><USER10> How does the immune system distinguish between native tissue and foreign tissue?

<comment><USER11> Many ways you could a semester of immunology on this. High a level there are molecules called MHC (Major Histocompatability Complex), or HLA (Human Leukocyte Antigen). They are very important to the immune system in a number of ways. Any individual has a few sets of these, and there are many different genetic types of these molecules so the differences between any two people can be many. The immune system is even sensitive to their absence, since their down regulation is a strategy for some pathogens such as virus. Anyway, as the name MHC suggests, this is one way that the immune system detects foreign tissue.

<comment><USER12> Apologies for an unsubstantial comment, but biology blows my mind.

Do we know when these features in our immune system evolved? I assume something this foundational is shared with fish or maybe earlier?

<comment><USER13> Vertebrates have an adaptive immune system. It's astounding from a biological and information theory perspective. Genes basically mutate themselves so they can form an enormous variety of proteins instead of the typical one to one mapping of gene to protein. Then there is a protein selection process that weeds out those antigens that bind to the host of that don't bind to anything, leaving those that can bind to foreign proteins. (There's another process to replicate antigens when they attack something.)

At least, that's my primitive understanding. Come on HN, please someone fill in the real story, because I'd love to understand it better. :)

<comment><USER11> I think you described it pretty well. my version of the same: During their development Lymphocytes have 'gene cassettes' that get shuffled randomly so that the specificity of the receptor (antibody for cells, T cell receptor for T cells) is random for each individual lymphocyte cell during development. The ones that bind "Self" stuff are killed off during their development and the rest of them other just hang out waiting for something that binds their receptor. (There is a step here where T cells must bind to MHC within an affinity window to survive) If they find it the reproduce rapidly making many more cells with that specify. once amazing thing is that during that cell replication at the sites of antibody specificity the DNA copying gets sloppy, allowing new mutations to 'fine tune' the specificity of the antibody to the antigen (called somatic hypermutation). The cells that bind the tightest to the foreign antigen, reproduce the most robustly providing an 'evolution' of increasing affinity to the antigen. This stuff is only the tip of the iceberg - immunology it is amazing.

</comment></comment></comment></comment></comment><comment><USER14> Broadly speaking, does this mean that all we have to do now is figure out how to rejuvenate the brain and spinal chord because everything else is replaceable?

</comment><comment><USER15> They didn't

</comment><comment><USER16> The title is totally misleading.

\- The 'implants' are not organs.

\- The cells being implanted are from the recipient, so they naturally won't be rejected.

If the headline were true at all, we'd be reading about this in one of the big journals.

Edit: changed transplant to implant

<comment><USER17> >\- The cells being implanted are from the recipient, so they naturally won't be rejected.

Well, they appear to have engineered a patient's own cells into stem cells which were then re-implanted into a patient(s).

>"We were able to create a personalized hydrogel from the materials of the biopsy, to differentiate fatty tissue cells into different cell types and to engineer cardiac, spinal cord, cortical and other tissue implants to treat different diseases," said lead researcher Prof. Tal Dvir

>The researchers extracted a small biopsy of fatty tissue from patients, then separated its cellular and a-cellular materials. While the cells were reprogrammed to become induced pluripotent stem cells — able to make cells from all three basic body layers, so they can potentially produce any cell or tissue the body needs to repair itself — the extracellular material was processed to become a personalized hydrogel.

</comment></comment><comment><USER18> The title is about "organs", but the article apparently refers to tissue transplants? No small feat, don't get me wrong, but isn't it a little misleading?

<comment><USER19> you're right, there is a difference between organs. Tissue make up organs just like amino acids would make proteins.

Here is a clear explanation:

The difference between cells, tissues and organs. A group of cells working together is defined as a tissue and several tissues working together comprise an organ*

source: [https://www.merckmanuals.com/home/fundamentals/the-human- bod...](https://www.merckmanuals.com/home/fundamentals/the-human-body/tissues- and-organs)</comment></comment>


Invite HN: Blockchain Against Evil, Next Week in SF - <AUTHOR> Hello everyone. My name is Sonya Mann and I run communications at the Zcash Foundation. I'm also a longtime Hacker News reader and commenter, because the inside view of the tech industry is fascinating.
Next week I'm co-hosting an event in San Francisco called Blockchain Against Evil: https://www.eventbrite.com/e/blockchain-against-evil-tickets-52069749021
> Imagine that you're a supervillain and you want to fund your dastardly plans. You know what might come in handy? Decentralized, censorship-resistant, anonymous payments technology.
> As members of the nascent blockchain industry, we plan to keep building that technology anyway, but we want to minimize the opportunities for supervillains. (Or even regular villains.)
> The organizers of Blockchain Against Evil believe that an open, permissionless financial system will have tremendous benefits for civil society. At the same time, it will enable bad actors to wreak havoc in new ways. Even if the harm doesn't outweigh the good, limiting harm is still a worthwhile goal.
> Blockchain Against Evil is an opportunity to come together and brainstorm: What might bad actors come up with? How can the rest of us can design around their ill intentions without limiting everyone's freedom?
Hopefully at least a couple of you will be able to attend! (You don't actually have to work on blockchain stuff, just be interested in the topic.) Tickets are $20 and all proceeds go to a nonprofit called Open Privacy. <comment><AUTHOR> Clickable event link: [https://www.eventbrite.com/e/blockchain-against-evil- tickets...](https://www.eventbrite.com/e/blockchain-against-evil- tickets-52069749021)</comment>


Recommendations for Astrophysics Tuition Funding - <AUTHOR>

I'm reaching out to you, a community I respect tremendously as top-of-the-line talent and results-oriented people, for off-the-beaten-track ideas on how to solve the Astrophysics Tuition Funding question.
My 18 year daughter has been accepted to a prestigious private college to pursue her dream of becoming an astrophysicist. This has been her goal since she was 10 years old and built a 6" telescope. She wants to go beyond star parties and showing the glories of the universe to the general public to become an astrophysicist pushing back the frontiers of our understanding of the universe.
Significant funding is needed, but scholarship searches mostly yield spam results or recommendations to hold a car wash. Government funding (Pell and Cal Grants) is not an option.
I'm looking for high quality ideas to help her raise sufficient funds to cover private college tuition. Summer jobs help, but are not enough.
Is there something like Kickstarter.com or http://www.modestneeds.org/ already in existence to help students pursuing the sciences?
A friend recommended using PayPalto set up an online fund-raising account, link it to the '592' plan, and spread the word to friends and associates. Has anyone gone this route and willing to provide lessons learned?
For the curious, her summer job was creating the web site and building telescopes for http://www.stellarvue.com/ And this week she met with the SETI people about doing some work with them. Yes, she takes this very seriously! <comment><USER2> What university is she accepted to? What country? How much does she need?

</comment><comment><AUTHOR> USA, West Coast, a great deal.</comment>


Regular Expression Crossword Puzzle - <AUTHOR> http://gregable.com/2015/12/regular-expression-crossword-puzzle.html <comment><USER2> Here's a nice site for these: [https://regexcrossword.com/](https://regexcrossword.com/)

The default puzzles are a bit basic, but there's a large amount of player- created puzzles that are great.

<comment><USER3> I love these! I tried automating the creation of them a while ago[1] (refreshing the page creates a new one). I should probably revisit it though as the generated puzzles aren't tricky enough..

[1] [http://padolsey.github.io/redoku/](http://padolsey.github.io/redoku/)

</comment></comment><comment><USER4> The original source for this puzzle was the 2013 MIT Mystery Hunt:

[http://www.mit.edu/~puzzle/2013/coinheist.com/rubik/a_regula...](http://www.mit.edu/~puzzle/2013/coinheist.com/rubik/a_regular_crossword/index.html)

<comment><AUTHOR> Awesome, thanks! I've added attributions on both the blog post and the puzzle page. It's a really fun puzzle, the author of it definitely deserves credit.

<comment><USER5> Thanks for updating your post with the attributions!

</comment></comment></comment><comment><USER6> One note about the interface - the rotation arrows are very confusing. You should always put the curve on top, rather than on bottom, since most people think of rotation directions based on the movement of a point on the top of the arc. Additionally, the left arrow rotates right, while the right arrow rotates left.

<comment><AUTHOR> I reversed the order of the arrows, but I'm not sure about flipping the glyphs. Those are the standard unicode glyphs for rotation arrows, I didn't want to use any images on the page. I suppose I could use CSS to invert them.

</comment></comment><comment><USER7> I had a lot of fun writing a program to solve this puzzle last year. I wrote about it here: [http://almostobsolete.net/regex- crossword/part1.html](http://almostobsolete.net/regex-crossword/part1.html)

The Haskell code is also on GitHub

</comment><comment><USER8> Sites like [http://regexper.com/#.*OXR.*](http://regexper.com/#.*OXR.*) help interpret the clues without solving the puzzles

</comment><comment><USER9> I solved this a while back. It's a bit challenging, but mostly due to the fact that the clues aren't really completely determining the solution, so you can't deduce each square like you can in e.g. sudoku. You have to make some guesses and then backtrack if they're wrong.

<comment><USER10> It took me a while, but I solved it without any guessing+backtracking.

<comment><USER11> Same. Definitely doable. It did take me a guesstimated 1.5h though.

</comment></comment></comment><comment><USER12> Assuming a puzzle had a single solution: How computationally hard would it be to prove that one solution was the only solution?

</comment><comment><USER13> Could you move the puzzle on amazon a few (20?) pixels to the right, the. _(.)(.)(.)(.)\4\3\2\1._ regex gets cut off on the left when you rotate [http://i.imgur.com/qcG1kav.png](http://i.imgur.com/qcG1kav.png)

<comment><AUTHOR> I added 20 pixels of left margin to the puzzle, let me know if that helps. I think it depends on screen resolution, I'm not seeing the same thing. If it's still causing you trouble Cntrl +/\- should work for resizing the page too.

<comment><USER13> It's fixed now. Thanks

</comment></comment></comment><comment><USER14> After spending most of the morning solving it manually I was thinking about how an algorithm might work for this.

Perhaps converting each regex into a DFA, but there are too many dependencies with all the other regexes. Any ideas on how to avoid brute forcing it?

<comment><USER15> This kind of puzzle falls under a general class of problems called Constraint Satisfaction Problems. Sudoku puzzles, map coloring, and cryptarithms are all examples of CSPs. A CSP is defined by a bunch of variables, each of which can take on some values in their _domain_ (In this case each cell is a variable, and initially their domain is all 26 letters.) and a group of arbitrary _constraints_ over the variables (the regexes).

One method of solving a CSP is to keep a set that initially contains all of the variables. On each iteration you choose a variable from the set and remove all values in its domain that are impossible given the constraints containing the variable and the domains of the other variables in those constraints. Then you add all of those other variables to the set because they are now restricted more than before. You keep doing the above until you get stuck (which may or may not happen). You then start guessing. There are a bunch of heuristics about how you should choose which variable to guess (eg the variable with the smallest domain). Once you have made your guess, you then add all of the variables back to the set. If you find out the puzzle is impossible, you backtrack to the last guess you made. I believe there are ways you can determine which guess was the problem and immediately backtrack to there.

<comment><USER16> What books come highly recommended for learning CSP?

<comment><USER9> I wrote my master's thesis in Constraint Programming. The textbook for my CP course was Apt's "Principles of Constraint Programming"[1], but I have to admit to barely using it. Most of the books and "introductions" to CP which I've read have been lacking in either rigor or clarity; many important details are glossed over, partly I think, because of CP's development from other kinds of optimization/satisfaction programming. When learning, I mostly used lecture notes from Christian Schulte (from KTH in Sweden) and Pierre Flener (from Uppsala University, also in Sweden). I can unfortunately not find these accessible online at the moment.

[1] [http://www.amazon.com/Principles-Constraint-Programming- Krzy...](http://www.amazon.com/Principles-Constraint-Programming-Krzysztof- Apt/dp/0521125499)

</comment></comment></comment></comment><comment><USER17> How about that for a CAPTCHA. :)

<comment><USER18> CAPTCHAs should be easy to solve for humans and hard for computers, not the other way around :P

</comment></comment><comment><USER19> I did this puzzle with a coworker and regular "commits" ( photocopy and add a version number ) was pretty useful. We botched it more than once and it was nice being able to revert.

</comment><comment><USER20> Great puzzle, too bad it doesn't have a single solution...

<comment><AUTHOR> I'm fairly sure there is only one solution.</comment></comment>


HTML5 Last Call? - <AUTHOR> http://www.w3.org/2002/09/wbs/40318/html5-last-call-poll/results

<comment><USER2>
      Tab Atkins Jr.
      Yes
      I don't think that the existing W3C process is actually useful for HTML, but if we're playing this game, then it's better for it to be published than not.

</comment><comment><USER3> Any idea where the browser vendor's people came down on this one?

<comment><USER4> There were only 2 No's. One from Daniel Glazman of Mozilla, and one from Julian Reschke, who doesn't appear to be associated with any browser vendors.

Abstains came from Antonio Tapiador a Ph.D student, Danny Ayers of Talis, and Karl Dubost of Opera Software.

<comment><USER5> Daniel Glazman doesn't work at Mozilla; he's a contributor who used to work at Netscape on Mozilla when Mozilla was the codename for their browser.

</comment></comment></comment><comment><USER6> Would this mean a feature freeze on HTML5?</comment>


Russia, China, Tajikistan propose UN "code of conduct" for the 'Net - <AUTHOR> http://arstechnica.com/tech-policy/2011/09/russia-china-tajikistan-propose-un-code-of-conduct-for-the-net/ <comment><USER2> Soooo... people do realize that this is from September _2011_ , right?

Not sure why this was posted here today, but this is "old news" in the sense that there have been many more such proposals submitted as the nations of the world gear up for the updating of the International Telecommunications Union (ITU) treaties relating to telecommunications.

Links to news items about some of the newer proposals can be found here, among other places: <http://www.scoop.it/t/wcit>

</comment><comment><USER3> I don't need to know the details to realize that this is a bad idea, considering the countries supporting this.

<comment><USER4> Contrary to popular belief (especially among people from the west), not _everything_ from Russia and China is terrible, oppressive and meant to destroy everything freedom-ish.

But, yeah, it's still a terrible idea.

<comment><USER5> But much of it is, and looking at their past actions regarding their censorship of the Internet, I think it's safe to assume that nothing good will be in this proposal. Sounds to me like you just wish to be a contrarian for no good reason.

<comment><USER4> Did you not read the whole comment? It's not that long. The second line states "But, yeah, it's still a terrible idea." You may have missed that I wrote that comment because mtgx's comment implied that only bad ideas can come from these countries, which seemed excessively anti-Chinese and anti-Russian to me.

</comment></comment></comment></comment><comment><USER6> Why would anyone give a shit what China has to say about this? They just censor everything blind anyway.

</comment><comment><USER7> Tajikistan, the voice of the internet.

</comment><comment><USER8> Oppressor's wet dream. They miss the times when the oppressed ("extremists" and "separatists" who threaten "social stability") had no voice.

</comment><comment><USER9> Did they submit this together with the RFC I saw yesterday..?

They aren't even trying to be subtle.

<comment><AUTHOR> Do you have a link for that RFC? I may have missed it...

<comment><USER4> Here it is: <https://tools.ietf.org/html/draft-diao-aip-dns-00>

About the subtle aspect, this may very well be because they genuinely believe it's a good idea other governments may agree with.

<comment><USER10> And the HN discussion is <http://news.ycombinator.com/item?id=4122783>

</comment></comment></comment></comment><comment><USER11> If you want a vision of the future for the internet, imagine a boot stamping on a human face - forever. with apologies to George Orwell

<comment><USER12> I disagree. Censorship of the Internet will never work. It might stamp out the fires for a short time, but within weeks or months encryption will be the new status quo.

<comment><USER13> Never be 100% successful != never work.

<comment><USER11> Doesn't have to be 100% sucsessful</comment></comment></comment></comment>


Facebook moves 1.5bn users out of reach of new European privacy law - <AUTHOR> https://www.theguardian.com/technology/2018/apr/19/facebook-moves-15bn-users-out-of-reach-of-new-european-privacy-law <comment><USER2> What happens if someone is a dual citizen in the US and an EU country but Facebook doesn't (yet) know that?

<comment><USER3> Residency is what matters, rather than citizenship. I expect the practise when having multiple data policies will be to ask users which country they live in when they create an account. I doubt you would be able to expect the protections of the GDPR if you falsely claimed you were resident in the US.

If this is the case, I wonder if this will lead to many people around the world falsely claiming to be EU residents to get GDPR protections, or claiming to be US residents to use platforms refusing service to the EU on the basis of not complying with the GDPR.

</comment></comment><comment><USER4> previous discussion: [https://news.ycombinator.com/item?id=16872542](https://news.ycombinator.com/item?id=16872542)</comment>


Carmakers and big tech struggle to keep batteries free from child labor - <AUTHOR> http://money.cnn.com/2018/05/01/technology/cobalt-congo-child-labor-car-smartphone-batteries/index.html <comment><AUTHOR> I have no idea this has been happening (I'm guilty of living in my own bubble).

Special report : Inside the Congo cobalt mines that exploit children

[https://www.youtube.com/watch?v=JcJ8me22NVs&feature=youtu.be](https://www.youtube.com/watch?v=JcJ8me22NVs&feature=youtu.be)

Anyone has more insights on this?</comment>


Isaac Asimov Asks, "How Do People Get New Ideas?" (1959) - <AUTHOR> https://www.technologyreview.com/s/531911/isaac-asimov-asks-how-do-people-get-new-ideas/ <comment><USER2> I used to work at IBM, which used to have "Think Fridays"\- you were supposed to use Friday afternoons for creative purposes.

Patents at IBM are very easy to submit and the process is somewhat like a game: basically you fill out a web form with the idea, which triggers a process to vet the idea and eventually get the patent written and filed if it's good. You get a small bonus for each accepted patent (and another after filing I think). You get a larger bonus after your first patent and after every fourth patent (called a plateau). You get a nice plaque for each plateau.

I have eight patents from this system, but there are IBMers who use it to enhance their income and have 100s of patents (they have a large stack of plaques). They have the discipline to use every Think Friday to come up with and submit a new idea- maybe one out of three will make it all the way through and be filed. Some form brainstorming groups. They often pay attention to new technologies and get ideas from how they could be used as components. Many ideas come from the interaction of components. (Many of mine are from hardware/software interfaces).

<comment><USER3> IBM's is a sad example of how the patent process is abused (although I guess I should blame the game, not the players).

If said patents were filed and shelved for some time, they should hold no validity in court afterwards.

Edit: that said, it is interesting how they came up with said patentable ideas :) , and it does fit with what Asimov said about the intersection of components, and daring being encouraged (at IBM, take note!).

<comment><USER4> > _If said patents were filed and shelved for some time, they should hold no > validity in court afterwards._

That's how it works right now. The "some time" is 20 years after the filing date.

<comment><USER3> Yes, you're right :) . I was thinking of a drastically shorter timeframe in case of non-enforced patents, and maybe to be determined by a judge or jury. Say a few years at most, or maybe varying according to the field (doesn't make the same sense for tech advancements to be accorded the same length of protection than medical ones, say.).

Still, much wiser heads have written lots about this :)

<comment><USER5> I don't think the law can differentiate between medical/technical/etc patents to that fine a degree.

</comment></comment></comment></comment></comment><comment><USER6> Thanks for sharing this. I read this around when it came out, but giving it a second read has helped clarify some of my thinking.

Something I find helpful is to have sessions where the goal is to come up with the _worst idea_ you can about a specific topic or problem. This can be for both fun or profit. The key benefit of this is really opening up the field for a free and open discussuion. When a friend and I did this recently (for fun, not profit) and asked ourselves what is the worst "uber for x" we could imagine, we came up with Stork: an app that matches children as they are born with optimal parents, exchanging newly-born babies if the naive approach, having your own kid, would be bad match based on measurable variables. This is an awful, awful idea. But is it the seed of something interesting in adoption, babysitting, matching children to the right school, helping small children who have difficulty making friends find them? Maybe.

I thing good ideas rarely become great ideas, whereas great ideas frequently have some seed of initially being horrible ideas contained within them, e.g. en app that lets you sleep in strangers' homes on air mattresses, sending dvds via usps in paper envelopes, etc.

Something else I frequently do is preface a wild idea with "This is a horrible idea, but: " which I find helps lead to an open discussion, without people feeling challenged, or overly seriously approaching a conversation that is meant to be open. It can help signal that you want their thoughts and comments, and aren't explicitly issuing a challenge, trying to have a debate, or making a statement you already believe to be true and they might feel obliged to disprove.

<comment><USER7> So I write humorous stories and design games in my spare time. While writing one story a couple of months ago I tried coming up with the most boring ideas for games I could think of to add to the story, because at that point having a few dumb games in the scene would be funny.

One of the three "bad ideas" I came up with was basically just putting numbered cards in order. But apparently my brain isn't content to just leave it at that, and it started whirring, and thought of a bidding system to add to it...and now it actually sounds interesting and I made some cards and some chips and I'm planning to playtest it with a couple of friends tonight.

Oops. It was supposed to be a terrible game, but it might actually turn out to be fun.

<comment><USER6> Sounds fun, would love to give it a try.

<comment><USER7> Playtest went extremely well. My friend is going to playtest one of his designs with a well-known designer in a few weeks and suggested I tag along. If he likes it, it might get published pretty quick. If not, I've got a meeting with a publisher in a few months, and I'll show it to them then.

</comment></comment></comment></comment><comment><USER8> >But how to persuade creative people to do so? First and foremost, there must be ease, relaxation, and a general sense of permissiveness. The world in general disapproves of creativity, and to be creative in public is particularly bad. Even to speculate in public is rather worrisome. The individuals must, therefore, have the feeling that the others wont object.

Absolutely true. Brainstorming only works if anything goes.

<comment><USER9> Truer Words were never spoken.

What particularly annoys is also that every idea must have a creation story, aka a logical explanation how it came to be in a logical,incremental, analytical step by step way. Even if it never was born this way.

I guess, "I stuffed strange stuff and books into my brain- and one sunny day my sub-conscious gave birth to this. It can invent a how-its-made-story too, if you need that." scares a lot of people, because the process cant be learned, not be controlled, not refined or quantified.

<comment><USER10> Agreed. The process is spontaneous and natural. But it can be _and usually is_ damaged, that is confined to smaller and smaller areas of one's life or worldview.

</comment></comment></comment><comment><USER11> If you work at or are otherwise involved in a startup, here is your key takeaway: _cross connections between fields is fundamental to creativity_. If you eat, breathe, and sleep software, you will only look at your problem space from the perspective of a software engineer. Startups already nail pre- requisites like informality, permissiveness, and relaxation

</comment><comment><USER12> It's not unknown for the ingestion of chemicals to "help" with this, especially on the 'making cross-connections' front.

<comment><USER13> Also people tend to use certain substances to lower inhibitions, to generate an environment where creativity is allowed and enjoyed and stupid mistakes can be laughed off later -- if you say something dumb then tomorrow you can all laugh because it's not that you're dumb, it's the substance talking.

It felt like Asimov spent the whole essay just at the brink of suggesting they open bottles of wine at these sessions without quite saying it.

But you don't need much for this effect (even a placebo would likely do) and too much tends to be detrimental.

Certain deeply creative fields really lend themselves to this sort of 'help' be it from alcohol or the more mild drugs like marijuana or hallucinogens for whatever unexplained reason -- music, comedy, writing, art. It's not unheard of even in those fields which are a little more technical, though it's much less common, though there are some very vocal well-respected examples. Jobs and Sagan to name a few are really the poster children for this sort of 'enhanced-creativity'.

</comment></comment><comment><USER14> Love the article but disagree on a couple points. First, the ideal is two where both are creative as they work off each other. You can NOT do the creative part with non creative it is too hard. Tons of miss understandings. If they talk about the session they will explain wrong and cause a lot of angst in the group, division, company, etc. Or explain but not provide the reasons as they might not understand the bigger picture.

A huge issue is if the creative person is not the boss or have very strong Influence it is very difficult to get a non creative on board.

With that said I really enjoyed the article. Plus would not be surprised if others disagree with me based on their own experiences. Think parts could be very individual and dependent on external factors.

<comment><USER6> I think there is some responsibility on the part of the "non-creative" here. It's very important to communicate when you are challenging someone directly and believe something to be true vs. throwing around ideas for comments and to generate new ideas. When a key business decision is being made, points of disagreement are exactly that, something to be debated and decision to be made. For someone who is less creative, it's easy to see everything this way. For a creative trying to come up with ideas and have a discussion, communicating clearly and upfront the purpose of your thoughts can go a long way. "I think we should..." frames a conversation very differently than "Hey, this is is a little crazy, but what would happen if..."

Also, I don't think the world is cleanly split into "non-creative" and "creative", but completely accept this simplification for brevity here :)

</comment></comment><comment><USER15> Actually, ideas often comes up when you do not seek them, during sleep, while driving, while meditate (although meditation is meant to help us managing our brains and thoughts), etc...

I tend to create into my calendar all these spaces to allow me to think about new ideas and to always have a pen or an iPhone to note everything I think about!

Individuals and Groups create value, make sure you create your value from your side.

</comment><comment><USER16> >My feeling is that as far as creativity is concerned, isolation is required.

And it isn't too hard to imagine, in this age of perpetual connectivity and distractions and mandatory use of a mobile phone (by social pressure), creativity has dwindled to almost nothing...

</comment><comment><USER17> His suggestions at the end for how to structure such a thing are glaringly similar to DnD. This is maybe why DnD remains so popular yet small and intimate.

<comment><USER18> Could you please expand "DnD"? It is not obvious to me

<comment><USER19> Dungeons and Dragons</comment></comment></comment>


Nokia Introduces Bicycle Charger Kit - <AUTHOR> http://www.newsider.com/story/nokia-introduces-bicycle-charger-kit

<comment><USER2> Not sure what nice safe European city this was designed in but it would be stolen in about 5 minutes after I locked my bike somewhere here.

Just give me a mini-USB compatible charge port instead, the industry should have standardized on that by now. All my emergency Nokia cellphones use a different sized charger hole!

 _ps. the end of that plug in the picture does look like mini-USB at least - maybe Deal Extreme can make a $5 clone of this so when it gets stolen I won't feel so bad._

<comment><USER3> > Just give me a mini-USB compatible charge port instead, the industry should > have standardized on that by now.

They have, in Europe anyway: <http://www.itu.int/newsroom/press_releases/2009/49.html>

<comment><USER4> As has China, for that matter: [http://english.peopledaily.com.cn/200612/19/eng20061219_3340...](http://english.peopledaily.com.cn/200612/19/eng20061219_334047.html)

</comment></comment></comment><comment><USER5> Sounds cool. It'd be nice if it could run off an existing dynamo. I wonder if it uses the standard voltage for these things (6V/3W)?

<comment><USER6> Exactly, I'm thinking of Schmidt at the very least: <http://www.peterwhitecycles.com/schmidt.asp>

Those are insanely good hubs and output a nice consistent amount of power. If the chargers were compatible with these hubs it would be extremely easy to use them on a wide range of bikes immediately.

<comment><USER7> They already have them:

<http://www.peterwhitecycles.com/ewerk.asp>

</comment></comment></comment><comment><USER8> You can get electric wind-up torches with a mobile phone power socket. You just wind and the phone charges (in minutes?)

</comment><comment><USER9> My bicycle charger kit is a good night's sleep, followed by a nutritious breakfast. :)</comment>


Show HN: oculus - a logging, web-based SQL client for teams (open source) - <AUTHOR> http://oculusapp.com

<comment><USER2> Very cool. Reminds me of Heroku's Data Clip [1] service released as part of their Postgres as a service offering.

[1] [https://postgres.heroku.com/blog/past/2012/1/31/simple_data_...](https://postgres.heroku.com/blog/past/2012/1/31/simple_data_sharing_with_data_clips/)

<comment><AUTHOR> Yeah, that's a neat project. I was already thinking about building this before they launched, and their positive reception spurred me on.

If you're already using Heroku Postgres there's a ton of overlap between the services, but I'm hoping to provide a decent open source alternative for the rest of us. :)

</comment></comment><comment><AUTHOR> Author here. I do a lot of analysis each day and am constantly sharing it with my team by taking screenshots of Sequel Pro. I built Oculus so I could keep a centrally available repository of my research, that everyone could access and collaborate on. It definitely has a ways to go, but I would love feedback!

Also, this is my first attempt at providing a live demo of software that can execute arbitrary SQL. I'm probably crazy for doing this, but I thought it was a lot more interesting than doing a video. If the demo suddenly disappears, you'll know I wasn't able to harden it enough... :)

</comment><comment><USER3> Great idea, and very well executed! I ran a few queries and got this: <http://demo.oculusapp.com/queries/204>

<comment><AUTHOR> Thanks! (Sadly I think the demo cron job will delete that after an hour or so :))

</comment></comment><comment><USER4> social sequel pro - very innovative!

</comment><comment><USER5> If only there was something like this for SQL Server =(

<comment><AUTHOR> If you can run Rack apps in your environment, it would be pretty straightfoward to add a SQL Server driver to Oculus. Right now it supports MySQL and Postgres.

<comment><USER5> Our environment is self-managed and flexible, so I should be able to throw something together to run this.

If I get it to work, I'll pass along whatever info I learn in the process.

<comment><AUTHOR> Cool! I'm happy to provide guidance, and I'll take a pull request if you can get it working with some unit tests.

</comment></comment></comment></comment><comment><USER6> I would be fascinated to find out how you protect against SQL injection.

<comment><AUTHOR> It's designed to be used within a team environment, where you trust everyone. (Although even then, I highly recommend using it with a readonly SQL account!) I would be skeptical of any situation where you could run raw untrusted SQL without any risks, at least without reimplementing MySQL's AST parser.

As for the demo, it's isolated, and locked down as well as MySQL will allow. (For starters, just SELECT privileges.)</comment></comment>


Show HN: docker-run.com enables to "docker run" in the clould with a subdomain - <AUTHOR> https://docker-run.com <comment><USER2> I presume the domain name is a violation of the Docker trademark, seeing as it could potentially be confused for an official product (as it uses the Docker name)

<comment><USER3> Given that they warned against using it in repos and even Twitter handles [1], it'd be a wise choice to use some other name.

[1] [https://www.zopyx.com/andreas-jung/contents/dont-use- docker-...](https://www.zopyx.com/andreas-jung/contents/dont-use-docker-in- github-repo-names-or-as-twitter-handle)

<comment><USER4> Not allowing people to call their custom docker tooling "docker-custom- tooling" on eg. Github seems like they're shooting themselves in the foot. Of course, it might be bad and damage their brand, but it could also enable a great ecosystem of surrounding tooling, some of which they could bless if they wanted to. Imho a poor PR move.

<comment><USER2> By no means am I a lawyer but I did a quick skim of their trademark agreement for fun:

 _Our Marks consist of the following registered, unregistered and /or pending trademarks, service marks and logos which are subject to change without notice: Docker, Docker "Moby Dock" whale logo and the stylist representations of a container, octopus, and other entities in our original works of authorship, DOCKER HUB, RUNHUB, LIBCONTAINER, LIBTRUST, LIBCHAN, LIBSWARM, LIBPACK, DOCKER SWARM, DOCKERIZE IT, CLAY_

In this case, "Docker" is the trademark we're looking at, and specifically registered with a capital D it appears

 _Any permitted use must not falsely imply or suggest a sponsorship or endorsement by, or a partnership or affiliation with Docker._

I don't think the author is being malicious in any way of course but from a quick glance, I couldn't say for sure that it's not a Docker product (design guidelines aside)

 _The Docker mark is used only in a referential context or for naming Docker or to indicate compatibility, and not in a title of a program, domain name, website, product or service_

This is essentially the key distinguisher between the parent comment and the OP's site

\---

Anyway, it's not so much that I'm pro-Docker or anything, it's more that they don't really have a choice legally. If companies don't protect the use of their copyrights/trademarks etc, they are diluted and risk the chance of becoming "generic". Having said that, it can definitely go overboard and lead to frivolous DMCAs, lawsuits etc etc

All this aside, while I'm not sure I have a use for the site (most things I dockerise use a compose file w/ multiple containers), it seems like a neat project so keep it up :)

</comment></comment></comment></comment><comment><USER5> There is no way I'd trust that with my containers. Most of the website is fake (as in just text rather than links).

<comment><USER6> I think the developer launched the product too soon.

<comment><USER7> I don't think it's launched. It's a demo.

</comment></comment></comment><comment><USER8> The sub-domains you are assigning doesn't work for me. Lookup fails.

Eg: [https://zeyxnt8hs40zr2.docker-run.com/](https://zeyxnt8hs40zr2.docker- run.com/) [https://qazf5k4ow7gpz2vq.docker- run.com/](https://qazf5k4ow7gpz2vq.docker-run.com/)

<comment><AUTHOR> Thank you for your interest.

sub-domains would works, but the container will be destroyed after 120 seconds for this demo. Of course it persist in production environment (soon).

<comment><USER8> I think 120 seconds is really short, say 10-15 minutes would be better for demo.

<comment><AUTHOR> Thank you!

</comment></comment></comment></comment><comment><USER9> Didn't work for me either. First time I tried nothing happened - just hung, the second time it started to build an nginx container but failed with a permission denied error. Also the only link that works is the link to Github.

<comment><AUTHOR> Thank you for trying!

The system is down when you tried because of disk space. I fixed it so could you try again? Sorry for the inconvenience.

</comment></comment><comment><USER10> It's a bit like [https://zeit.co/now](https://zeit.co/now) without the CLI that builds and pushes the images.

<comment><AUTHOR> Yes, but they are migrating their own FaaS to v2. In some case docker based PaaS is useful.

</comment></comment><comment><USER11> Can you talk to the problem Docker-Run is trying to solve? It's already relatively easy to deploy docker containers today (AWS/Azure/GCP/DigitalOcean/etc) and even have them pipe to the browser like this.

Without an ecosystem of services to integrate (Identity/Storage/DB/Queue/DNS/LB/Network/etc), containers aren't awfully useful.

What is the differentiator?

EDIT: grammar

</comment><comment><USER12> Maybe it's just the avalanche of HN traffic but I can't get to your pricing tab (or the others)

<comment><AUTHOR> Thank you for pointing out.

Pricing is not decided. However, current ui is sucks so will show a message soon.

</comment></comment><comment><USER13> I dont understand what provlem this service would solve?

Also, nginx:latest doesnt work with error WebSocket connection to 'wss://api.docker-run.com/' failed: Error during WebSocket handshake: Unexpected response code: 502

<comment><AUTHOR> Thank you for trying and researching.

Sorry, in that time server is down due to disk space. I fixed it, so please try again.

This service will try to implement simple container management in production. Mainly for small start-ups, like Heroku.

</comment></comment><comment><USER14> Doesn't seem very sustainable, what's the business model?

<comment><AUTHOR> Thank you for the question.

The same as Heroku, provide docker-based PaaS and users would pay for their containers.

</comment></comment><comment><USER15> Next thing you'd want is docker-compose support for multiple containers running together

</comment><comment><USER16> Is "Docker _D_ un (beta)" the intended page title?

<comment><AUTHOR> Thank you for your response. That was just a typo, fixed it!

</comment></comment><comment><USER17> Nice, it worked for me.</comment>


RAMCloud: Storage entirely in DRAM - <AUTHOR> http://www.stanford.edu/~ouster/cgi-bin/projects.php

<comment><USER2> Previous HN discussion: <http://news.ycombinator.com/item?id=887999></comment>


Microsoft Confirms Windows 10 New Monthly Charge - <AUTHOR> http://www.forbes.com/sites/gordonkelly/2016/07/14/microsoft-confirms-windows-10-new-monthly-charge/#43af8d45dfab <comment><USER2> Let me address two things: the content of the article and Forbes in general.

First, the article doesn't really cite anything-- but if you dig around you find that what MSFT is doing is setting up a subscription model where if you want to license Windows in enterprise as part of a subscription you can. MSFT has world's most complex enterprise licensing schemes and this is just another option.

Second, Forbes basically lets anyone contribute. They are cashing in on the name recognition of Forbes with click-bait articles. Is it to much to ask for professional articles? Perhaps one where facts are outlined and some amount of research is gathered? Instead, the author seems to have grabbed a headline from the Internet and then extrapolated that MSFT is on their way to charging everybody-- with no evidence.

I'm sick of low-effort, crap journalism. It's not even journalism-- it's a blog post under the guise of journalism.

</comment><comment><USER3> More accurate title: "Microsoft adding a monthly-charged tier to Windows enterprise licensing options."

Horse's mouth source: [https://blogs.windows.com/windowsexperience/2016/07/12/annou...](https://blogs.windows.com/windowsexperience/2016/07/12/announcing- new-subscription-options-for-windows-10-and-surface-for-businesses/)

<comment><USER4> Yup, just like Office 365, or even the new subscription model to effectively lease Surface tablets. This article takes a minor announcement of Windows Enterprise being offered the same way, then spins into full-time FUD about the notion that they'll do it to consumers. (Even if they did, people who got the free upgrade already have their license, they'd never need to subscribe.)

</comment></comment><comment><USER5> Moderators: Could we add "Enterprise" to the article title here on HN?

Subscription options on the Enterprise side are not new and not surprising in the least. Windows has essentially always been a subscription for Enterprises of certain sizes; this points to an expansion down to a next lower tier. Again, not surprising.

The clickbait would have you believe this may eventually in some presupposed future Microsoft may roll this out to consumers, but the article is supposition at best and misdirection at worst.

(Everything I've read, including the Windows 10 EULA, seems very apparent that Microsoft is "right sizing" the consumer Windows experience by making the de facto experience [You buy a license Windows for the lifetime of a computer with the purchase of that computer], because consumers didn't pay for upgrades, into the reality of the experience, aligning it with other operating systems, in that [You buy a license for the lifetime of a computer with the purchase of that computer and that includes updates for the lifetime of that computer].)</comment>


Suez Canal Fires Back: Vast Majority of Ships Not Taking Cape of Good Hope Route - <AUTHOR> https://gcaptain.com/suez-canal-fires-back-vast-majority-of-ships-not-taking-cape-of-good-hope-route/ <comment><AUTHOR> I would guess this is a response to [https://news.ycombinator.com/item?id=11227230](https://news.ycombinator.com/item?id=11227230) [http://www.bbc.com/future/story/20160303-cheap-oil-is- taking...](http://www.bbc.com/future/story/20160303-cheap-oil-is-taking- shipping-routes-back-to-the-1800s)</comment>


Ask HN: Should we be concerned with the Nexus 6P from Huawei? - <AUTHOR> I just recently found out that Huawei has a long history of not so honest practices and the US government at least heavily warns against using their telecom products. More about this specific concern can be found here http://www.cbsnews.com/news/huawei-probed-for-security-espionage-risk/
I actually learned this from a comment here on HN from rl3 -  https://news.ycombinator.com/item?id=10297879#up_10300668
As somebody who ordered the 6P I was very concerned and wanted to see what the community thought of this.  Further thought doesn't have me much concerned about backdoors for the chinese government.  Why would they be interested in me, an American citizen.  But what does have me more concerned is the NSA's ability to find and exploit that backdoor.  In fact I believe the Snowden docs showed this was the plan.
I don't know if this is even worth worrying about considering the baseband.
What do you folks think? <comment><USER2> If you're worried about Huawei Phones, don't use ones with their EMUI ROM. Considering the 6P has been developed and is sold by Google, I trust that it is as safe to use (if not safer) than most mainstream devices. It is beyond doubt that google's engineers and lawyers have checked everything before even partnering with Huawei, since discovering any backdoor would be a huge lawsuit on their own door.

</comment><comment><USER3> I have a Huawei phone (Ascend P7), and I'm pretty happy with it.

If I were to be concerned, I'd be more worried about them fudging the performance data. As others posted, if you're worried about spying, don't own a mobile device.

I posted this before:

"I have a Huawei Ascend P7. It's miles better than my last phone (LG G2 mini). I find the build quality to be very good. I had it survive a very bad fall. The performance is decent, not as good as modern flagships, but an awesome price to performance ratio (I got it for 180 dollars, it goes for 250 unlocked these days). They did do a Volkswagen-style cheat on the FutureMark benchmark: [http://www.anandtech.com/show/8403/examining-huaweis- benchma...](http://www.anandtech.com/show/8403/examining-huaweis-benchma..). so yes, they might be on the "sketchy" camp. But I've found most of the premium stuff from China to be as good or better than equivalents from other countries, my girlfriend has a Lenovo phone and it's excellent too."

[https://news.ycombinator.com/item?id=10300656](https://news.ycombinator.com/item?id=10300656)

</comment><comment><USER4> > I don't know if this is even worth worrying about considering the baseband.

Yup. If you are worried at all, don't own a mobile device.

</comment><comment><USER5> You can't do anything in case of an hardware backdoor but software backdoors are more likely than hw ones and you can prevent them using a trusted custom ROM.

</comment><comment><USER6> You care about a given piece of hardware's status on backdoors, so that you can run Android and use Google services?

ayy</comment>


CitiBike launch: Bikeshare will be great for New York. - <AUTHOR> http://www.slate.com/blogs/moneybox/2013/05/27/citibike_launch_bikeshare_will_be_great_for_new_york.html <comment><USER2> Hailing from Boston, I'm a big fan of Hubway. Easy and cheap access to rides across the city. Faster and far cheaper than a cab. Every city should have a similar set up.

<comment><USER3> Agreed.

Cyclists also greatly reduce congestion, at least when compared to cars.

<comment><USER4> I would be curious to hear statistics regarding how many of the bikes being used had actually saved someone from driving a car. From what I know of how burdensome car ownership is in New York, I would suspect that the majority of BikeShare users would be people that would have been on foot otherwise.</comment></comment></comment>


Is Betelgeuse about to blow? - <AUTHOR> http://blogs.discovermagazine.com/badastronomy/2010/06/01/is-betelgeuse-about-to-blow/ <comment><USER2> A better headline would be, "Is Betelguese about to blow, 500 years ago?"

<comment><USER3> Or better yet "Betelguese might blow in the near future" <http://unixronin.livejournal.com/763082.html>

<comment><USER4> I thought about submitting that post earlier today, but, well, sourcing doesn't get much sketchier than that.

My best hope was that some science journalist would actually contact observers at Mauna Kea, as a gut check, but Dr. Plait's dénouement is probably good enough for me.

</comment></comment></comment><comment><USER5> A man from Mauna Kea says this is false.

<http://i.imgur.com/tAJpy.png>

<comment><USER6> Sad. I like thunderstorms, but stars blowing up could be even cooler.

<comment><USER7> Funny, but there could be people living there ... billions or trillions !

</comment></comment></comment><comment><USER8> Well the article doesn't really dismiss the idea as false, rather that it's unlikely.

<comment><USER9> Because its not false. Its just unlikely. I think he got it spot on.

You expected him to say "It's not going to explode this year." then look like an idiot when it does? When someone doesn't know something, I expect them to say "I don't know," rather than try to pick up as many ad impressions as possible by saying something outrageous.

Disclaimer: I'm a huge fan of Dr. Plait, the author of this blog.

</comment></comment><comment><USER10> Science is so boring.

</comment><comment><USER11> If it does blow soon, and it turns out to be as bright as the sun, which is possible according to the article, might this have some impact on climate?

<comment><USER6> It's a good idea to read the entire article, not just the forum posting it's mocking. Towards the bottom:

 _At that distance, it'll get bright, about as bright as the full Moon. That's pretty bright! It'll hurt your eyes to look at it, but that's about it. The original post says it may get as bright as the Sun, but that's totally wrong. It won't even get 1/100,000th that bright. Still bright, but it's not going to cook us. Even if it were going to explode soon. Which it almost certainly isn't._

<comment><USER12> This visualization shows how bright it may become: [http://mesic.hvezdarna.cz/2009/06/az-exploduje- betelgeuse.ht...](http://mesic.hvezdarna.cz/2009/06/az-exploduje- betelgeuse.html)

On the one hand it looks pretty cool, on the other such bright star would make the other stars invisible.</comment></comment></comment>


Ask HN: What do you use Python for? - <AUTHOR> <comment><USER2> Knowledge management ([https://contextualise.dev/](https://contextualise.dev/) and it's GitHub repo: [https://github.com/brettkromkamp/contextualise](https://github.com/brettkromkamp/contextualise)).</comment>


Show HN: Passbox – Another password manager using Bash and GPG - <AUTHOR> https://github.com/RobBollons/passbox <comment><USER3> related:

 _pass - the standard unix password manager_

      Password management should be simple and follow Unix philosophy. With pass,
      each password lives inside of a gpg encrypted file whose filename is the
      title of the website or resource that requires the password. These encrypted
      files may be organized into meaningful folder hierarchies, copied from
      computer to computer, and, in general, manipulated using standard command
      line file management utilities.

[http://www.passwordstore.org/](http://www.passwordstore.org/)

<comment><USER4> Downside of pass is that the filenames are in the open. Thus, metadata (which sites you have account on) is not secured. Linked one seems to store everything in a single encrypted file.

Upside is that it has ton of implementations readily available - <USER2> integration, mobile apps, etc. Linked one (passbox) is just a bash script at the moment, if one wants to use it across multiple devices and platforms, the experience may be quite rough.

Another upside is that with a single file model you have to invent your own conflict resolution scheme. For pass, git just does the trick. And this one doesn't seem to have anything in this regard.

<comment><USER5> > Downside of pass is that the filenames are in the open.

The "entry" names (which I think would correspond to filenames in `pass`) appear to be passed on the command line here; they'll likely get swept up in your shell's history file, unless you're careful. (And thus, are essentially in the open, just like pass.) That said, I think most shells make their histfiles 600, so they're not directly readable. (And I think `pass`'s directory is 700, similarly.) And you have to trust the machine you're running on, of course; otherwise, I can just dump the memory as soon as your keyring is decrypted.

I think it was when `pass` was on HN that I mentioned this; I have a terminal keyring manager myself[1], but one of the design decisions I made in it (aside from a single-file archive) was to not pass entry names on the command line, specifically so they won't get swept up in histfiles. It's easy, though, it make it optional, and let the user decide what they want to do. Of course, your

[1] which is way not ready to be looked at… also seems like we as a crowd enjoy this topic (keyrings) as a side project.

<comment><USER4> There is HISTIGNORE for a reason ;)

But, yeah, if one forgot to add pass there, the metadata will be leaked.

<comment><USER5> I did not know about HISTIGNORE! Very interesting. I knew about HISTCONTROL=ignorespace, though I did not know it was a variable; I just thought that was a hard-coded feature.

</comment></comment></comment></comment></comment><comment><USER6> How do you work with these terminal-based password managers? Request the password (à la `passbox get facebook`) and then copy 'n' paste it into the website?

Are there any security concerns of the password being in the clipboard/memory (beyond the obvious of accidentally pasting it)?

<comment><AUTHOR> That's definitely a way of using it, another is to just manually type it in as you see it and clear the terminal buffer afterwards. If you do use your clipboard it does require a certain amount of due diligence in making sure you empty it afterwards if you're concerned about that as a security risk. It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay.

It would be possible to construct an attack using Flash to access a users clipboard form a web browser.

I know a lot of people like to have browser plugins for password managers but i always feel uncomfortable using them because i don't understand enough about the technology to trust that it wont be vulnerable.

<comment><USER3> _It would be easy enough to create a simple script that could copy it to your clipboard and then clear the clipboard after a time delay._

pass [0] (see comment above [1]) claims to do that:

      show [ --clip, -c ] pass-name
           Decrypt and print a password named pass-name. If --clip or -c is specified,
           do not print the password but instead copy the first line to the clipboard
           using xclip(1) and then restore the clip‐board after 45 (or
           PASSWORD_STORE_CLIP_TIME) seconds.

[0] [http://www.passwordstore.org/](http://www.passwordstore.org/)

[1] [https://news.ycombinator.com/item?id=10190719](https://news.ycombinator.com/item?id=10190719)

<comment><AUTHOR> Clipboard integration probably isn't something i would look to add to passbox myself, but if someone can find a way to get it to work nicely cross platform and submit a PR then i would likely merge it.

</comment></comment></comment></comment><comment><USER7> This looks very nice, but I would need browser extensions and mobile apps to go along with it.

1Password is honestly the one app that has kept me from switching to Linux from OSX. Would love to see a decent open source alternative.

</comment><comment> UK-AL Has anyone build a hash style password manager.

hash(website name + global password + increment) = password to use?

or something like it

<comment><USER4> That's a _very_ popular scheme.

The major downside is that site saying "your password must [not] contain blah- blah-blah"/"be N to M characters long"/"may contain only digits" when the generated one just happens to not conform to such restriction. In my personal experience, one out of dozen sites tries to be smartass about the passwords, so the scheme is a PITA in the long run.

Without the increment you also can't rotate password, while with the increment you need to store the increment value (and if you do keep the notes and the master secret, why not just remember the password already?)

The password managers are more flexible than password generators, because they don't have such limitations.

<comment><USER8> I wrote my own hashing method [1] that given a correct spec for password restrictions would always generate a valid password. It does it by taking the hash in base64, then translating those a new set of base64 characters chosen to increase the likelihood of getting a valid password. If one generated is not valid, it then iterates until a valid one is found (by cycling the bits).

I have used this personally since I wrote it. Given the downsides, I agree that password managers are probably better for most people.

[1]: [https://github.com/onionjake/doh](https://github.com/onionjake/doh)</comment></comment></comment>


The quantum computing era is coming  fast - <AUTHOR> http://www.theguardian.com/commentisfree/2015/dec/13/the-quantum-computing-era-is-coming-qubits-processors-d-wave-google <comment><USER2> This article is pretty inaccurate in a number of ways.

The whole D-Wave thing is mostly irrelevant for cryptography, which the article doesn't mention. Even if the D-Wave devices turn out to be useful for some special algorithms, they can't run Shor's algorithm, which is what endangers crypto.

Also calling 1024 bit a "really long key" is a bit strange. They are already endangered by classical computers, no need for quantum computing here.

That said: The call for postquantum crypto is right.

<comment><USER3> 1024 bit keys are endangered? Only in some broken encryption schemes. You can't even break 256 bits, as the number of possibilities exceeds the number of atoms in the universe.

<comment><USER4> You're comparing keys from two different cryptosystems, which is a mistake. A RSA key ("1024 bit keys") needs to be longer than a AES key ("256 bits") to provide a given amount of security, since more conditions are placed on an RSA key in order to get its favorable properties.

In 1999 you could break a 512-bit RSA key with a supercomputer, in 2015 you can do it with 4 hours and $75 on EC2: [http://arstechnica.com/security/2015/10/breaking-512-bit- rsa...](http://arstechnica.com/security/2015/10/breaking-512-bit-rsa-with- amazon-ec2-is-a-cinch-so-why-all-the-weak-keys/)

A 768-bit RSA keys has been factored in a large academic effort: [https://eprint.iacr.org/2015/1000.pdf](https://eprint.iacr.org/2015/1000.pdf)

When you pick a key length, you want it to be long enough to provide security for your communications as far into the future as practicable, and the classical efforts to break RSA are getting uncomfortably close to 1024-bits. Maybe in a few decades it would be practical for some adversaries to break even perfectly made 1024-bit keys.

However, I'm not a cryptographer, so someone please correct me if I'm wrong.

<comment><USER5> > 1024 bit keys are endangered? Only in some broken encryption schemes.

He didn't compare anything.

<comment><USER4> > He didn't compare anything.

No, he did:

>>> 1024 bit keys are endangered? .... You can't even break 256 bits

1024 bit key = most likely something like RSA

256 bit key = some symmetric algorithm or ECC

He's implying a 1024 bit RSA key should be safe because a 256 bit key from some other algorithm is.

<comment><USER5> > Only in some broken encryption schemes

RSA 1024 is a broken encryption scheme (2010). In Jan 2010 there was already the concern it was broken or quickly to be broken. [http://arstechnica.com/security/2010/01/768-bit-rsa- cracked-...](http://arstechnica.com/security/2010/01/768-bit-rsa- cracked-1024-bit-safe-for-now/)

in March 2010 [http://www.techworld.com/news/security/rsa-1024-bit- private-...](http://www.techworld.com/news/security/rsa-1024-bit-private-key- encryption-cracked-3214360/)

<comment><USER4> I mentioned your first link, the factoring of a 768-bit RSA key, in my first comment. RSA isn't a "broken encryption scheme": it's a perfectly fine one. It's just that you need to use key lengths long enough to defend against the computing power available to current and expected adversaries. That paper is just a demonstration of modern computing power, which just shows that you should use longer keys.

I took his statement of "Only in some broken encryption schemes" to be a misunderstood reference to stuff like this: [http://arstechnica.com/security/2015/10/how-the-nsa-can- brea...](http://arstechnica.com/security/2015/10/how-the-nsa-can-break- trillions-of-encrypted-web-and-vpn-connections/) or a side channel attack.

Your second link has garbage sensationalized headline. It actually describes a side channel attack that has nothing to do with cryptography algorithms. It's basically equivalent to a clever way of looking over someone's shoulder.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> What should a dev do to stay current, given this is happening? Say you have an interest in algorithms in general, what do you need to read / what can you read that connects to existing knowledge?

<comment> semi-extrinsic TL;DR: if you're not retired before QC becomes useful (which is likely), the "API" will have changed so much from now till then that you shouldn't worry about it.

Think of this as an algorithm on specific hardware for solving a specific problem. You can encode other problems into the specific problem, at a cost. Currently this algorithm on specific hardware is not as fast as state-of-the art algorithms on ordinary hardware (namely Selby's). But the people making this special hardware claim (no proof) that when the special hardware (and the problem size) is scaled up, the special hardware will be much faster than ordinary hardware. So far no-one has disproved this assertion, but no-one has proven or demonstrated it either.

Meanwhile, many other scientists and some companies, who refer to this type of special hardware as "dirty QC", are working on another class of special hardware they call "clean QC". This is mathematically proven to be much faster than ordinary hardware when it is scaled up, but it's very very very difficult to scale it up. But they're working on it and showing progress.

Right now, no-one knows if the "dirty" or the "clean" special hardware will be the first to be actually useful in the real world. It's likely the first useful real world application is more than ten years away. We don't know exactly what the application will be, or how the special hardware then will be programmed. It's also quite likely that most the people commenting here will be retired before access to the special hardware will be given to anyone but scientists.

<comment><USER7> What do you mean dirty vs clean QC? Do you mean adiabatic vs gate based?

<comment><USER8> Yea, that must be what he's referring to. I know a lot of folks who work on this stuff and they never use "clean"/"dirty" terminology (although it's reasonably apt).

<comment> semi-extrinsic Yep. Picked up the clean/dirty terminology from Scott Aaronson: [http://www.scottaaronson.com/blog/?p=2555#comment-963747](http://www.scottaaronson.com/blog/?p=2555#comment-963747)

<comment><USER8> FYI, Scott was using the quotes to try and indicate that he was making those terms up on the spot (so it's not accurate to say that "many other scientists and some companies" use those terms). But I can see how it might not be clear from reading his comment.

<comment> semi-extrinsic Thanks for pointing this out. (As you might have inferred, my original post tried to keep the language simple.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> An impending arms race between quants on Wall Street could also provide a colossal impetus for driving QC innovation:

Quantum Computers Entice Wall Street Vowing Higher Returns:

[http://www.bloomberg.com/news/articles/2015-12-09/quantum- su...](http://www.bloomberg.com/news/articles/2015-12-09/quantum- supercomputers-entice-wall-street-vowing-higher-returns)

</comment><comment><USER10> according to John Martinis, the quantum computing era is coming, but it is a slow and gradual process like most research

</comment><comment><USER11> Where are the discussions on this topic?

[https://hn.algolia.com/?query=quantum%20google&sort=byPopula...](https://hn.algolia.com/?query=quantum%20google&sort=byPopularity&prefix=false&page=0&dateRange=pastMonth&type=story)

I would expect, of all places, people on HN to be smart enough to help me understand these news stories. I have no idea what quantum blahblah really means and want to know if this is a real breakthrough or just a news story.

<comment><USER12> My understanding is that it is both.

This really is a real breakthrough in quantum computing. Specifically for an approach called 'quantum annealing' which is one of many (there is at least one other) possible approaches to quantum computing.

This result is a breakthrough in two ways.

1: It demonstrates real quantum effects in the D-Wave computer. It had been hotly debated, by experts in quantum computing, whether the D-Wave actually used quantum effects in its computations. 2: It shows a real speedup for a very specific instance of a very specific algorithm. This is great news, and a very good result, for the people working on the D-Wave.

This is just a news story because

1: The D-Wave is much, 100 million times!, faster than the same algorithm running on a conventional computer. But there are algorithms you can run on a conventional computer which are equivalent (If someone could clarify how equivalent they are that would be great) which are as fast as the D-Wave. So they chose an algorithm which is good for the D-Wave and terrible on a classical computer. 2: The problem instance they chose is very artificial and it isn't clear that the speed up wouldn't disappear if they tried to run actual real world instances of the problem.

I would conclude that this is a great result. It increases the understanding of quantum computing. That is very exciting. The D-Wave doesn't appear to be practically useful. Yet.

(I am not even the beginning of an expert in this, everything I wrote above comes from the link below)

[http://www.scottaaronson.com/blog/?p=2555](http://www.scottaaronson.com/blog/?p=2555)

<comment><USER13> My understanding: The D-Wave machine isn't general quantum computing, but hardware supporting one specific algorithm: quantum annealing. Quantum annealing is similar to Simulated annealing, and if you compare the D-Wave machine to simulated annealing implemented on normal, non specialized, hardware, the D-Wave is 100,000,000 times faster.

In principal, even if the hardware only supports one algorithm, this could tell us something about whether quantum computers are really better than normal computers. Unfortunately the D-Wave machine/algorithm is still not much better than simply simulating a quantum machine in normal hardware (Quantum Monte Carlo) and worse than the conventional algorithm by Alex Selby.

It's interesting, but it still doesn't shed much light on the important questions.

<comment><USER14> One more thing that you didn't mention, which I think is important: if you run simulated annealing on specialized hardware and compare it to the performance of D-Wave's machine, there is virtually no speedup for D-Wave's machine.

</comment></comment></comment></comment><comment><USER15> People are not convinced that D-Wave is really quantum yet. I've seen not D-Waves presentations at the annual Supercomputing Convention and I am not convinced yet.

</comment><comment><USER16> We have quantum safe encryption now, just not pki quantum safe, although that is possible. We also have quantum key distribution which could be a route to patch things if quantum pki is beaten out by quantum computing.

<comment><USER2> qkd solves no problem that quantum computers generate. At best you could replace a symmetric cipher with it (though huge costs and very impractical), but we don't have a problem with symmetric ciphers.

<comment><USER16> We have a problem distributing the keys for symmetric ciphers, which is why qkd would be useful if we can't do pki. I'm interested in the huge costs and very impractical part of your comment - why do you think that?

<comment><USER2> You can only use qkd if you already have a shared key. If you already have that you can also use that to distribute your keys.

Impractical and expensive because:

* You need a glas fiber line. That means no copper, no wifi, no crypto on mobile phones.

* You are limited to some tens to hundreds of kilometers. No transatlantic encrypted qkd. It doesn't work.

* Complex physical tasks with high accuracy like sending and detecting single photons - not cheap.

</comment></comment></comment></comment><comment><USER17> > The quantum computing era is coming… fast

No, it's not coming. It will stay there where it is now - huge corporations that rule the world and governments. This will just build huge precipice between small companies and people who will run AMD64 for next 20 years and corporations that in 20 years will already have something that will replace quantum computers. We all will be ruled by a few computers. Google technologically runs away from their competitors. Google will gather more data, process it faster, more accurate, will gather more data... Poor will become poorer and rich will be richer. It's not coming fast, not in our direction.

<comment><USER18> We are not limited to run AMD64 cores. We can also have GPU cores and when some problems are really important to solve, we can run them on FPGA or create an ASIC for it.

Also we can expect that there would be computing centers what resources the mere mortals can access as a service as they can access the resources of the computer clusters today.

Very likely universities fill have their own quantum computers. Bigger ones first, then smaller ones.

I think that the situation is not that depressing but it definitely will create some disparity in the beginning.

<comment><USER17> In 20years we will have AMD128 and some ASICs for personal usage, Google will have something what will be 100M faster than quantum computer, it will be 100M * 100M faster than quantum computer. It will contain more computing power than rest of the world together. Every next generation of computers will be produces in shorter time than the last one, and will be more powerful than the last one. Cost of producing next generation computer will be cheaper then producing ASICs for us. Are bitcoin miners the more popular ASIC?

>Very likely universities

I don't mean no one else won't have or rent any, sure they will, there are a lot projects that will need it, we people won't have any. I think I presented my opinion too negatively :<

<comment><USER18> _I don 't mean no one else won't have or rent any, sure they will, there are a lot projects that will need it, we people won't have any._

If we look at the history of computing, then yes, one could be so pessimistic, but would it be really true?

If there will be a breakthrough in the QC, then there will be sudden economic motivation for people (companies) to use quantum computers.

This will generate the need for people who could work with such computers. This will again generate motivation for universities to train such people and the need to access quantum computers.

I think that this will happen much much faster than it happened with the classical computing.

Of course I also believe that there would be no personal QC any time soon if this is what you had in mind.

Edit: I also do not understand why you are down voted. I think that it is an important perspective.

<comment><USER19> Not a downvoter, but I think there's a practical limit to how useful the data collected by Google is - and the company is probably close to that limit already.

I'm not sure QC can change that.

The only way to get more value would be total 24/7 Orwellian surveillance, and I don't think that's going to be a popular option.

QC for crypto is a no-brainer. QC for anything else, including data mining/ML, is a much fuzzier prospect. I'm not sure anyone really understands what the practical applications could be, never mind how to use QC to make them possible.

Any suggestion that you can take a warehouse full of web logs and tracking stats, give it a quantum shake, and have a few million pre-qualified addicted customers fall out is likely nonsense.

<comment><USER18> _QC for crypto is a no-brainer. QC for anything else, including data mining /ML_

Problems in ML can be mostly proposed as an optimization task and if QC would works out, ML would be likely its main application.

It would likely make an huge difference in solving a classification problems as you could train your ML model with much more data much faster. I t would also make the clustering problem much faster too as it also can be expressed as an optimization problem.

Also there are many other optimization problems that would benefit a lot from the speed up (regardless if it is huge constant speed up or an asymptotic one).</comment></comment></comment></comment></comment></comment>


Ask HN: 'Do what you want'... Does it really matter what you want? - <AUTHOR>

This is perhaps the most stated advice, the fall back, in many instances, of giving some advice, the first thing that comes in mind when one asks as to what they should do. Do what you want most, what you have a passion for, absent of any consideration that most people, if not all people know not what their passion is.<p>My question is the simplest, and I hope you will engage in debating it. Does it matter at all what you decide to follow in the absence of any clear knowledge of what you want or what your passion is? Is there such a thing as passion and want when deciding how to spend your life and choosing your career, or is instead our path paved by circumstances and events, our passions formed by our experience rather than carved by our own controlled paving of the future? <comment><USER2> It's sufficiently difficult to answer your question(s) so I'll offer a different perspective.

Consider this question: are you enjoying your time? If the answer is no, are you working towards something that will allow you to enjoy your time? If the answer is still no, then you may want to reconsider what it is that you want.

</comment><comment><USER3> Find something that you think is worth doing, and do it. The more you do it, the better you'll get at it, and the more you'll enjoy it.

Try not to let other people's evaluations have any effect, other than to point out possible ways to improve.</comment>


Ask HN: Advice when patent app pending for similar product? - <AUTHOR> My team has been working on a software product in an established market for some time. We're marketing and iterating, and we are optimistic about hitting product/market fit. A US patent application for a similar product has come to light. The product is implemented quite differently based on the application, but the result looks similar to the end user. We fear the application's existence will reduce our ability to raise money and/or lead us to eventual bet-the-company litigation if granted. How practically difficult is it to prove design differences in a software patent context? We think we're clear technologically, but will the burden be on us to expose our code to a judge or adversary in litigation? Assuming the market is big enough, can we steer clear of the US without worry? Are we dead in the water from a VC perspective? As no counsel will likely give us an opinion that it's okay to proceed, we're asking, what do you think HN?<p>Any insight appreciated. <comment><USER2> > We're marketing and iterating, and we are optimistic about hitting > product/market fit.

Keep worrying about this. You're almost certainly spending cycles on a non- problem, particularly if your implementation is different.</comment>


Show HN: Redis/ruby-based realtime event-tracking - <AUTHOR> https://github.com/paulasmuth/fnordmetric/blob/master/readme.rdoc

<comment><USER2> This is really cool and I might have found a very good use for it just by looking at it.

One thing though: IMHO it should also be possible to dispatch events over UDP as often times you don't care that much whether the event is actually logged or not.

You do however care about the responsiveness of the application that's doing the logging and you really don't want it to hang while the logging server is being slow with its tcp handshake.

Thankfully, this is open source and n github, so I can fix this. Expect a pull request tomorrow-ish

</comment><comment><USER3> How do you even go about making a UI like that? It's beautiful.

</comment><comment><USER4> Looks good. I'm noticing it uses highcharts, so there may be licensing costs under some scenarios, correct?

<comment><USER5> Here are the prices, <http://shop.highsoft.com/highcharts.html>

</comment></comment><comment><USER6> Awesome! At Fileboard we use lots of third party tools (Mixpanel/KISSMetrics) to keep track of user metrics and stuff but there are always things where these tools just can't provide us with answers. Especially since we are an ipad app and most of these things are designed for web app usage.

I didn't want to roll my own solution for keeping track of the "extra" stuff but having seen this I am definatly going to give it a spin and see wether it helps us get more grip on user behavior.

Thanks for sharing!

<comment><USER6> Hmm was just thinking. Could I also use this for tracking internal transactions? I am still looking for a good solution to get insight into the statistical/live transactions that my system is handling.

User behavior is great but since our solution spans multiple servers I would love to be able to see what happens say for ex. when somebody wants to send a e-mail message with dropbox attachment through our system.

Also tracking the nr of errors being raised would be mighty interesting. I know there are third party solutions out there that solve part of the equation but having this data in one place sounds pretty interesting.

Any thoughts?

<comment><AUTHOR> Yes, thats exactly what we do with it. We use it to track (among other things) sent/read messages, created ratings, , signups and sales. You can define your own metrics/gauges very easily. Have a look at "doc/ulm_stats.rb" or contact me on skype ("paulasmuth") if you run into any questions or issues :)

</comment></comment></comment><comment><USER7> I'm a product manager/developer and find myself wanting to know the real-time and historical usage of the products I manage so that I can proactively address issues and prioritize future development. Some kind of combination of google analytics for the client side and NewRelic (or <http://amon.cx>) for the server side.

I'm going to play with this over the holidays to see if it would help me with that.

</comment><comment><USER8> Really clean design, love it. I can imagine this would be really cool with something like a chat application displaying messages/sec, users online, messages read, stuff like that.

Also an excellent showcase of a use of redis.

EDIT: And in case you missed it first time around like I did, here's a link to a screencast of it in action: <http://www.screenr.com/KiJs>

</comment><comment><USER9> Let's build a product out of it. Marketo e.g. is a horrible piece of software + way to expensive for startups.

</comment><comment><USER10> I only took a quick glance through the source, but what's with the MongoDB dependency? Is there a chance that what you're using it for could be replaced with Redis? I already use Redis, but I'm hesitant to introduce yet another database into my stack unless it's absolutely necessary.

<comment><AUTHOR> Oopsiedaisy, the mongoid-reference in the Gemfile is obsolete. I'll remove it right away. Thanks for the tip :)

</comment></comment><comment><USER11> I don't have much to say other than, as far as analytics and tracking goes, I'm going to play with a copy of this and see what I can do.

The screenshots played quite a big part in selling me.

<comment><AUTHOR> Cool :) We've actually been using it in production for a few months now. You should have a look at "doc/ulm_stats.rb" - that's the configuration from the screenshots and screencasts.

If you have any issues or questions you can always contact me on skype ("paulasmuth")...

</comment></comment><comment><USER12> This is great. I see that namespacing of events is on the TODO list and this would allow us to provide analytics to our customers.

Great work and very nice UI.

</comment><comment><USER13> Beautiful! Precisely I was talking today with a friend about the need of a tool like this one.

</comment><comment><USER14> Your GUI (graphs, visualization) are amazing. What graph library did you use?

<comment><USER8> It looks like highcharts.js to me.

</comment></comment><comment><USER15> Great job guys. Will be looking to implement this as soon as possible.

</comment><comment><USER16> Any demo server running somewhere?

</comment><comment><USER17> This is great. Thanks for sharing!</comment>


The Path to Hell: React's Context API - <AUTHOR> https://codethrasher.com/post/2019-08-02-the-path-to-hell/ <comment><USER2> This is the reason why I often tend to use Redux, even tho it's overkill. The redux devtools are an amazing tool to see whats going on and who changed what.

But maybe someone give me a better solution than using Redux? I mean, if you provide data and an api to modify it, you ultimately end up in this scenario where you ask yourself "Why has it been changed? And where?"? I don't see how you could prevent that.

<comment><USER3> Mithril.js has global redraws by default. This turns out to solve practically all React's "local redraws only" problems & solutions, and requires less written code in the process.</comment></comment>


The next hot job in Silicon Valley is for poets - <AUTHOR> https://www.washingtonpost.com/news/the-switch/wp/2016/04/07/why-poets-are-flocking-to-silicon-valley/ <comment><USER2> The facts presented don't imply the title.

"Teams traditionally consisting only of coders now include a few communication specialists" is rather less catchy. The next hot job in Silicon Valley is for programmers.</comment>


The Beginning (Google) - <AUTHOR> http://online.wsj.com/article/SB10001424052702304911104576444363668512764.html#printMode

<comment><USER2> Thanks, I really enjoyed this - gives great insight into the brilliance of the google brain, and it's flaws i.e. Google's misunderstanding of normal serfs that just 'use the internet' ...</comment>