Neural Networks That Describe Images - <AUTHOR> http://cs.stanford.edu/people/karpathy/deepimagesent/?hn <comment><USER2> Presentations like these make me realize how close we are to developing law enforcement (/police state) technology that will be very effective. I figure when the kinks are smoothed out, that we could run this on a video feed, and have crimes prevented right as they're about to happen. It's almost scary. Imagine 20 years from now, some guy pulls a gun on you, and a video feeds identifies his action, and immediately shoots a tranquilizer straight into his jugular with perfect aim.

<comment><USER3> Effective and also scary. That same video feed could be archiving (for eternity) every single citizen's movement, action, or even words:

"Citizen #5135: In 2015, spit on sidewalks 28x this year, jaywalked 49x, etc..."

<comment><USER4> Even if this is not working now, it can still be applied later on video shot today. So we are already en route to being judged by such an automated guardian.

</comment></comment></comment><comment><USER5> At the Bay Area Vision Meeting in 2013 [1], Fei-Fei Li and Olga Russakovsky gave a related talk on, "Analysis of Large-Scale Visual Recognition" [2,3]

[1] [http://bavm2013.splashthat.com/](http://bavm2013.splashthat.com/)

[2] video: [http://www.youtube.com/watch?v=DK6KfUsVN8w](http://www.youtube.com/watch?v=DK6KfUsVN8w)

[3] slides: [http://bavm2013.splashthat.com/img/events/46439/assets/a10b....](http://bavm2013.splashthat.com/img/events/46439/assets/a10b.stanford.pdf)

</comment><comment><USER6> I'm a bit skeptic. They have several very good examples, and those are really impressive. Everything about how often these striking results occur is 'coming soon' though. And since it is neural network-based, being lucky sometimes doesn't say anything about the statistical performance. What percentage of the test dataset was labelled correctly?

<comment><USER7> I'd like to see the worst-case behaviour too - e.g. hilariously wrong results. Seeing the failures (and their rate) makes it more believable and enables a more unbiased evaluation of the capabilities of the system.

It's like those "up to XX% better" claims - " _up to_ ", not " _at least_ " being the key phrase here.

</comment></comment><comment><USER8> Fascinating. Also interesting to see the failure modes. Any human would quickly realize that the "boy doing backflip on wakeboard" is actually playing on a trampoline. Or the "two young girls playing with legos toy". Great stuff!

<comment><USER9> Right - impressive though this is, also the cat isn't black, the woman with the bananas might well not be a woman, the girl isn't swinging on a swing, the construction worker is probably not in the road, and the guitarist is tuning the guitar, not playing it. It's pretty much wrong -in detail- on every count.

The weird thing is how at a glance, it seems pretty much correct. And how some people here are willing to look at that and think 'automated law enforcement is clearly imminently possible'.

<comment><USER10> Wow.. talk about high expectations. This is really well done. Identifying multiple concepts in an image and describe it to a good degree of accuracy. And this will get better further.

<comment><USER9> No no! Don't misunderstand me! I agree: It's _phenomenally_ impressive! It's also still _completely useless at this level of accuracy_.

At this point, this software is as useful at describing photographs as a disinterested teenager who is busy trying to text. "This is a picture of my mom with some dude playing I dunno like tennis or something. Whatever."

Which is really impressive! Seriously!

But closing the gap to accuracy is really important, and it's a hard hard problem.

</comment></comment></comment></comment><comment><USER11> Neural networks are impressive only in that they are able to give any kind of meaningful results at all. In the end, they are only a poor mimicry of real machine intelligence, and not much better, conceptually, than plain old nonlinear regression.

Nobody has been able to determine what the structure of a neural network should look like for any given problem (network type, number of nodes, layers, activation functions), how many iterations of the parameter optimization algorithm are needed to achieve "optimal" results, and how "learning" is actually stored in the network.

Statistical learning methods are obviously still useful, but I think the field is still wide open for something to emerge that is closer to true machine intelligence.

<comment><USER12> Please, try implementing non-linear regression to understand images. Tell me how it goes.

Also, 'nonbody know hows learning is stored'? You very clearly have never worked with neural nets before. Experience is stored in the form of weight values.

<comment><USER9> Okay, you've got a neural net that does a really good job on identifying types of animals in pictures. unfortunately, whenever you show it a picture of a horse, it says 'fish'. Everything else, it's great at - marmosets, capybaras, dolphins, kangaroos; but it's got a complete blindspot for horses.

Where's the incorrect data stored? How can you fix it? It's in the weight values, somewhere, but you can't go and change the weight values to fix the horse/fish cascade without breaking everything else it knows.

Yes, we know 'where' the data is stored. But it's diffuse, not discrete, so we can't separate it from other data.

<comment><USER12> Umm even still, you can train it on more horse photos in order to increase its performance specifically on horses. Furthermore, you can study neron activation levels on said horse training data in order to reverse-engineer the neural "ravines" which the activations settle into. And run comparison tests about those ravines against the ravines for say zebras.

This is something actively being done by nn researches. And it lets us do things like take the low level audio processing part of a neural net trained on english voice data, and use it to train smarter neural nets on Portugese voice data than you couldn've without the English voice recordings.

</comment></comment></comment></comment><comment><USER13> Something doesn't seem right. If we are this good in image recognition, how come we are still using captchas? Are we so good in image recognition that it can identify young girl, bunch of bananas, guitar etc just by training it from an image set of just few thousand image. Whats the catch ? On one hand google says their self-driving car can't understand all the situations on the road while this algorithm can identify so many details from an image like a strong AI would. Feels very strange.

<comment><USER14> Captcha's largely fight the lowest common denominator, my making those who don't care enough (or have the knowledge) to work around them when they can just go elsewhere, so that you can invest your human resources fighting the more sophisticated attackers that actually target you.

They are reasonably successful because spammers have enough other targets that not many see it as worth the extra effort (and clock cycles) to break them, not because most of them are particularly hard to beat any more.

<comment><USER15> Breaking captchas also have an incentive that has been attractive enough to create an three entire industries -- spam, malware and security products to deal with spam and malware.

</comment></comment></comment><comment><USER16> This isn't really a breakthrough in object identification, as much as it is a clever pairing of identification with (mostly existing) language systems, is that right?

Wondering whether there's any merit to sibling comments speculating this is the future of e.g. surveillance

<comment><USER12> well, this is doing more than just object recognition+language labeling. Notice how it understands the the girl is 'in' the white dress. That is a lot more comlicated that identifying a white dress and a girl.

</comment></comment><comment><USER17> This is one of the coolest things i've seen in a while. I'd guess this is super similar to what the folks on the DeepMind team at Google are working on now, with the overall vision of being to classify images that have no metadata and add them to a dynamically learning knowledge graph:

[http://www.newscientist.com/article/dn24946-google-buys- ai-f...](http://www.newscientist.com/article/dn24946-google-buys-ai-firm- deepmind-to-boost-image-search.html)

[http://en.wikipedia.org/wiki/Knowledge_Graph](http://en.wikipedia.org/wiki/Knowledge_Graph)

[http://appft.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=H...](http://appft.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=/netahtml/PTO/search- bool.html&r=1&f=G&l=50&co1=AND&d=PG01&s1=20140019484.PGNR.&OS=DN/20140019484&RS=DN/20140019484)

[http://appft.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=H...](http://appft.uspto.gov/netacgi/nph- Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=/netahtml/PTO/search- bool.html&r=1&f=G&l=50&co1=AND&d=PG01&s1=20140019431&OS=20140019431&RS=20140019431)

</comment><comment><USER18> I really appreciate that the Stanford group is always willing to post mistakes/mislabels. Kudos.

<comment><USER19> The face detection on her research group's front page has one glaring mislabel ([http://vision.stanford.edu/](http://vision.stanford.edu/)).

I always find that quite amusing.

</comment></comment><comment><USER12> Sharing Pre built models are so cool, and definitely important to the advance machine learning science. Especially when you consider how mixing weight layers allows you to do things like understand Portuguese text better through English text.

</comment><comment><USER20> It would be great to have this for image search!

<comment><USER4> It will revolutionize porn search, for sure.

<comment><USER21> unfortunately came to the same conclusion. could be a serious buzz kill though when it is wrong.

</comment></comment></comment><comment><USER22> Before going through on object recognition in images, I'm curious about how they managed to arrange perfect sentence for the caption.

Are we already at the point where NN can arrange perfect sentence when we throw bunch of words into it?

<comment><USER23> Yes, there is a recent trend to use Recurrent Neural Networks to model the structure and semantics of sentences. This used in particular to do research for Machine Translation by people at Google and the University of Montreal in particular: [http://scholar.google.fr/scholar?q=rnn+lstm+machine+translat...](http://scholar.google.fr/scholar?q=rnn+lstm+machine+translation)

</comment></comment><comment><USER24> Idk if this is a daft question, but in the Visual-Semantic Alignment section, are those objects in the colored boxes actually being directly recognized by the software? Or are they inputted in some other way?

<comment><USER25> From the paper: _Our core insight is that we can leverage these large image- sentence datasets by treating the sentences as weak labels, in which contiguous segments of words correspond to some particular, but unknown location in the image. Our approach is to infer these alignments and use them to learn a generative model of descriptions._

<comment><USER26> This gets a little more detailed into the work, but compared to other papers that have sprung up in this area recently, our paper slightly frowns on the idea of distilling a complex image into a single short sentence description. In that sense we are a little more ambitious and we're trying to produce snippets of text that cover the full image with descriptions on level of image regions. I would call our results encouraging, but there is certainly more work to be done here. And I think one of the limitations right now to do a good job is the amount of training data available to us.

</comment></comment></comment><comment><USER27> I'm impressed but skeptic, too. Laypeople might not get an accurate impression on what is possible. Considering the image with the guy in a black shirt playing guitar. What if it was a picture of a naked man standing next to a black shirt that is hanging on a clothes hook, and next to it is a guitar is mounted on a rack: My guess it that the computer will still spit out: Guy in black shirt playing guitar, just because this sentence is very plausible in the underlying language model.

</comment><comment><USER28> I remember doing something like this without the neural networks that is, but my results were very very bad. If i find that project in old laptop i'll post it to github.

</comment><comment><USER29> I am pretty sure some of those examples are correct only by a chance. "little girl is eating piece of cake."? Only thing that marks her as a girl is hair clip, did the software really saw that?

"woman is holding bunch of bananas." hell, I (hopefully a human) would recognize her as a male at first glance.

</comment><comment><USER30> It is interesting how the neural network labeled the woman in the lower right photo with the rectangle that includes the body only, without the head.

</comment><comment><USER31> They forgot to put the link to the npm module ;)

</comment><comment><USER32> this is unsettling and amazing. not too far when we'll have robots that will be aware of what's going on around it.

</comment><comment><USER33> Fascinating that we've come this far, also: [http://xkcd.com/1425/](http://xkcd.com/1425/)

<comment><USER34> Well, five years probably already passed since the comic release, so it isn't surprising.

<comment><USER35> This comic is from this year if I'm not mistaken</comment></comment></comment>


Why are there no new photos of Snowden? - <AUTHOR>

Why are there no new photos of Snowden? <comment><USER2> Because vanity is a sin?

<comment><AUTHOR> Haha

</comment></comment><comment><USER3> Because he's probably travelling in a Roy Orbison wig and sunglasses.

</comment><comment><USER4> because he's not in Russia

<comment><AUTHOR> So his whereabouts are completely unknown?

<comment><USER5> Hanging out with Jimmy Hoffa.</comment></comment></comment>


Steps for writing an operating system - <AUTHOR>

dear friends, I have gone through the following websites with respect to os development:
http://www.linuxfromscratch.org/lfs/index.html http://www.linuxfromscratch.org/lfs/view/6.5/
http://www.acm.uiuc.edu/sigops/roll_your_own/ http://www.brokenthorn.com/Resources/OSDevIndex.html
I just wanted a list of steps written in plain english, to be followed for writing an operating system, then one by one i can do self-research on each one of them,
I am an efficient c/c++ programmer, but i just don't know where to begin writing an os,
kindly help !! <comment><USER2> Well there is the Minix which is a Unix like os that predates and inspired Linux which exists purely to teach operating system design and coding.

<http://www.minix3.org/>

Source code included :)

<comment><AUTHOR> Thanks for the suggestion, I have started studying Minix.

</comment></comment><comment><USER3> Disclaimer: I'm by no means an operating systems expert. I am simply a computer engineering student who has recently written my own OS, from scratch.

First things first, limit your scope! All of those links seem to want to tell you how to write an OS to run on a standard PC. That is going to be a huge nightmare. Presumably, you'll want to be able to access some (or all) of the peripherals on your PC, so you'll have to write drivers for them, which is incredibly time-consuming and error-prone. Instead, write for a smaller platform with simple peripherals. Something like a Gumstix, or ARM development board. You should be able to easily get documentation for each hardware component.

Second, don't try to mimic Linux. It may seem appealing because Linux is great, but its underlying architecture isn't. Linux has a monolithic kernel, meaning that there is a lot of functionality in there. If your display code gets into a bad state, it can bring the entire system down. It's also not very fun to manage the interface when you have 250+ system calls.

Instead of a monolithic kernel, use a microkernel structure. In a microkernel, you essentially have basic scheduling, inter-process communication, and memory management. Everything else lives outside of the kernel in separate processes, which communicate via message passing. This makes it much more stable, since there's a smaller chance of the entire system being taken down. It's also a lot easier to have your OS certified (essential if you want to use it in industrial or safety-critical scenarios) when it's broken down into small pieces.

Third, you'll have to read up on scheduling algorithms, context switching (this will require knowledge of assembly for your chosen platform), memory management and concurrency. Those are just the bare minimum for a working OS!

Fourth, get some partners for your project. Writing an OS is a lot of work, and your friends will help to encourage you. They'll also help to prevent you from making silly design decisions.

Good luck!

<comment><AUTHOR> Thanks for informing me regarding the monolithic kernel of linux. By the way, I ve already studied the topics like scheduling algorithms, context switching, memory management and concurrency during my MCA, but you know colleges in India do not impart much of the practical knowledge. I think a Minix system with a microkernel will be great to start with.

Thanks again!!

</comment></comment><comment><USER4> There is an old(er) book called "Developing Your Own 32-Bit Operating System" that does a good job (assuming you're targeting the x86 platform) of laying the foundation and explaining the typical layers of code you'll need to write to build an O/S from scratch (as opposed to just a new Linux distro, etc.).

It's a bit dated, but so is the x86 platform :) I think most of it is relevant, especially someone asking these sorts of questions about OS development.

Here's a link to the book on Amazon:

[http://www.amazon.com/Developing-32-Bit-Operating-System- Cd-...](http://www.amazon.com/Developing-32-Bit-Operating-System-Cd- Rom/dp/0672306557)

If you get somewhere be sure to update us on your progress!

<comment><USER5> I have used this book. It's a good introduction but uses a rather non-*nix sysAPI. I have found Minix to be a better way to get started and it too has a great book as well as significant number of sites that have excellent additional material. Haiku is a very cool OS that is very clean and in early stages of development. Plan9, Inferno and L4 (Pistachio) have their strengths.

If your goal is to learn about OS design, etc then you might want to look at some CS texts that go into lots of detail. The key thing to remember is that most OS concepts (but not the implementations) have matured.

You'd probably learn more by implementing some missing functionality in an existing OSS OS.

Regardless of what you decide to do, I do recommend using QEMU as your development environment rather than running development versions on bare hardware. What I like about QEMU is that it supports ARM, etc. So as other respondents have pointed out, you would be targeting a far cleaner platform than your PC based system with three decades of backward compatability crud.

<comment><USER4> _"I have used this book. It's a good introduction but uses a rather non-_ nix sysAPI"*

I think the only reason this would be a down-side would be if you were trying to implement a unix-like operating system (not that there's anything wrong with that).

It would do up-and-coming designers good to avoid Unix only because it's becoming sort of a "standard" way of architecting an OS and studying only unix-like systems can have an effect on creativity, innovation, etc.

I love BeOS/Haiku but even it is a bit too "unixy" for my taste.

I definitely agree with the previous post that going back to CS texts is the way to go, and it would be instructive to look at the operating systems once used by mainframes in the past as this is where allot of the "contemporary" technology we use today came from.

Ultimately the goals you have for the system you are designing should drive your architecture but I think a rich diet of various different operating systems is a good way to prepare for the journey.

</comment></comment></comment><comment><AUTHOR> dear friends,

On the basis of your suggestions, Ive concluded the following: 1\. Studying Minix as an operating system will be a great deal as its source code is just around 4000 lines. 2\. Minix being a micro-kernel based OS will be easier to tackle. 3\. The OS book written by tennanbaum with respect to Minix [describing each aspect of Minix along with source code] is available to us. 4\. Though Minix is immature yet, it will help us to get started at least. 5\. The book on the link '<http://www.amazon.com/Developing-32-Bit-Operating- System-Cd-> is bound to be a great deal of help [I skimmed through it yesterday]

I shall come back to you again if I run into trouble again Thanks for your valuable time.</comment>


BizTeen.net—Looking for alpha testers - <AUTHOR> http://www.bizteen.net/ <comment><USER2> What does your site do exactly? People might want to know that before they decide whether or not to test your site.

</comment><comment><USER3> I would not recommend using a .net address. You're probably better off just finding another name.

<comment><USER4> just out of interest why is that?

I've had fair success with .net addresses in the past. They dont seem to lose out on traffic over .com or .co.uk. But that experience has been limited to small audiences.

<comment><USER3> This is the kind of site people will go to by typing the url into the browser, and if it becomes popular, they will expect to find it at the .com.

</comment></comment></comment><comment><USER4> 2 things.

Firstly wow, you put this together in, what, a week? Im sure I saw a paper draft this time last week you posted :D well done.

Secondly give us some indication of what it's about ;)

Oh got a third: you might want ot have a simple form on the page to submit and email address too - sending an actual email to get in on the alpha might put people off!</comment>


Celery 2.3 released - <AUTHOR> http://www.celeryproject.org/news/celery-23-released/

<comment><USER2> What is Celery?

 _Celery is an asynchronous task queue/job queue based on distributed message passing. It is focused on real-time operation, but supports scheduling as well._

 _The execution units, called tasks, are executed concurrently on a single or more worker servers using multiprocessing, Eventlet, or gevent. Tasks can execute asynchronously (in the background) or synchronously (wait until ready)._

<comment><USER3> Ask described it to me as "a library for discovering bugs in the multiprocessing library".

<comment><USER4> Yes, but note that multiprocessing rocks. It's just that celery uses it so extensively :) (and now also eventlet/gevent if that suits better)

<comment><USER5> And someone here has commit privs to fix those bugs too :) (ask does)

</comment></comment></comment></comment><comment><USER6> Maybe it is just me, but I can never bring myself to setting up Celery and RabbitMQ and all for some Django apps that could sorely use it. There seems to be so many moving parts, last I checked there were like 3-4 different services to tie everything together...

Anyone know of a simpler system or technique for achieving the same thing? Or perhaps, a better way to go about using Celery.

<comment><USER7> IMHO, setting up RabbitMQ and Celery, especially with django-celery, ends up being much simpler and less painful than rolling any kind of custom queue/async processing. In terms of moving parts, for most setups, you can put Celery and RabbitMQ under supervisord and almost never have to worry about them.

If you don't need all the features of RabbitMQ or just don't want to deal with it, you can use any of the other broker backends: Redis (if you don't need persistence) or even with your default DB through the Django ORM.

<comment><USER8> Fyi, redis has an appendonly option to provide persistence:

<http://redis.io/topics/persistence>

<comment><USER4> Yes, but I think what he was referring to was message acknowledgements, which Redis doesn't have. If a worker reserves a message, and is abruptly killed, then the message is lost.

</comment></comment></comment></comment><comment><USER9> One of the best releases so far!

</comment><comment><USER7> Great work as always asksol!

</comment><comment><USER10> I have no idea when I would need to use it. Can someone give examples of when I might want to think of using it?

<comment><USER11> We use it extensively, essentially for anything that doesn't need to happen "just this second". It's also replaced everything we used to do in cron, as it easy to carry around in source control.

Most of our emails, calculating expensive things (we have some match-making algorithms that run as tasks), sending notifications and all sorts of fun things are all done in tasks. By moving as much of our code into celery as possible it's been much easier to scale (adding a new node is trivial) and our pages are much more responsive.

That Celery makes it all so very easy to do is icing on the cake.

<comment><USER12> I've set it up for a project where incoming HTTP requests can trigger outgoing HTTP requests, something I found useful was a wrapper function that attempts to execute the task asynchronously (the_task.apply_async) but falls back on running it in-process (the_task.apply). This way if RabbitMQ isn't running everything still basically works. The downside is that if RabbitMQ is running but celeryd isn't, all the tasks just pile up in the queue.

</comment></comment></comment><comment><USER13> Anybody here use Celery on their production system? Is it reliable/stable? Any weird problems?

<comment><USER14> We run it for mixcloud.com its awesome, saved us hundreds of hours of dev time easily.

</comment></comment><comment><USER15> Great news! Awesome software!</comment>


Google's nightmare: Facebook 'Like' replaces links - <AUTHOR> http://www.cnn.com/2010/TECH/04/29/cashmore.google.facebook/index.html

<comment><AUTHOR> Facebook's Like button allows the company to mechanical turk content rankings which could challenge PageRank's authority. Facebook could (and probably will) combine this Like data with their own PageRank-like link analysis, adding another layer of relevance, one which they would solely own. Facebook web- search feature coming out soon?

</comment><comment><USER2> _Facebook Optimization may be the new SEO_

A death sentence for the "like buttons", if I ever heard one.

(If the 'darkside' SEO turn their attention to it, I'd guess the buttons will be gamed into uselessness in six months flat, with no recourse in sight.)

<comment><AUTHOR> Excellent point. There are too many opportunities to use the Like buttons for evil (see: [http://www.readwriteweb.com/archives/how_to_trick_users_into...](http://www.readwriteweb.com/archives/how_to_trick_users_into_liking_facebook_pages_theyre_not_on.php)).</comment></comment>


Apple, Facebook to Women Employees: Keep Working, We'll Pay to Freeze Your Eggs - <AUTHOR> http://www.forbes.com/sites/chanellebessette/2014/10/14/apple-facebook-to-female-employees-keep-working-well-pay-to-freeze-your-eggs/

<comment><USER2> I can't decide if this is incredibly liberating or oppressing.</comment>


Physicists consider reviving the SSC - <AUTHOR> http://arstechnica.com/science/2014/02/physicists-start-thinking-beyond-the-lhc-consider-reviving-the-ssc/

<comment><USER2> To summarize the article, the advantage of restarting the SSC instead of rebuilding the LHC is that the original setting in Texas offers more room for expansion than the present location of the LHC. The bad news is that the revived SSC would need to host a large number of scientists in a state noted for its philosophical proximity to a scientific stone age.

<comment><USER3> "Houston, we have a problem." That famous NASA location is Houston, Texas. So, I'd say that your dig is unnecessary. Texas is a big state so I'd bet there's a healthy segment of highly educated people.

<comment><USER2> That's true, but it doesn't contradict my original claim. Texas was selected for political reasons, not practical ones. Had pragmatism and convenience ruled the day, the SSC would have been sited immediately adjacent to Fermilab.

There's a reason NASA programs, and big science projects, are scattered across the country, and it's not efficiency, it's politics -- congress must slice the pie into as many pieces as possible.</comment></comment></comment>


Ask HN: Who is Hiring" still has a bunch of "ONSITE" positions; Why? - <AUTHOR> As I peruse through "Who is Hiring" to get an idea of the current market, I see that is is a surprising amount of "ONSITE" or "Onsite after shelter in place is lifted". Am I the only one who expected to see many more Remote positions this month? <comment><USER2> Your expectations do not match the market.

Businesses have rental agreements. Some company leaders have a hard time allowing people to work from home while they still pay for a building.

When leaders do their work by collaborating with others, it can be very difficult to understand that some work is best done in isolation.

So just because people are forced to work from home and some people like it, it doesn't mean it's a magic recipe for all companies to open up remote positions.

Final note: the market is turning down so there will be less hiring overall.

</comment><comment><USER3> I think it'll take a little while for that to trickle through. The main issue I'm seeing when talking to companies about this is that they don't have any process in place for remote work of new hires, so we are talking about interviewing to training to ongoing 'how to fit into the workplace' and meet their colleagues etc. But I think once companies try out a few ways to do this, it'll become more normal.</comment>


The Open Technology Institute Releases Commotion 1.0 Mesh Networking Toolkit - <AUTHOR> http://www.newamerica.org/node/99668

<comment><USER2> Is it just me or is there no link to the toolkit?</comment>


Reflections on S3's architectural flaws - <AUTHOR> https://medium.com/@jim_dowling/reflections-on-s3s-architectural-flaws-71f14c05a5fa#.4dcfd3z6l <comment><USER2> S3's eventual consistency is easy to understand and hard to digest. It's way too easy to create data quality nightmares by overwriting, deleting, or relying on prefix listing. I've personally seen separate major data quality issues caused by each of those.

If you care at all about deterministic data quality, never overwrite anything in S3, and never rely on object listing. Read-after-new-write _is_ consistent in S3. If you need to list objects but don't want to sync additional metadata in e.g. DynamoDB, then a common pattern is to write a file listing ("manifest") in another S3 object.

<comment><USER3> The same guarantees also apply to OpenStack Swift, which is basically S3-on- your-own-cloud. Since more and more internal teams are now using the Swift clusters that I administer at $work, I can see a lot of people struggling with the concept of temporary inconsistency and the practical ramifications thereof.

Last year, I spent two full months hunting temporary inconsistency bugs in the Docker Registry's Swift driver. I added several heuristics that reduced the frequency of inconsistency-induced errors by about two orders of magnitude, but in the end, we still ended up switching to Quay, which has gotten the memo that you mentioned: "never overwrite anything, and never rely on object listing". They put metadata in an RDBMS instead, just like s3mper which was mentioned in the submission.</comment></comment>


Clever ideas that failed - <AUTHOR> http://sites.google.com/site/yacoset/Home/clever-ideas-that-failed

<comment><USER2> Wow. This is brilliant. Especially the sins committed, as I am also guilty of a number of them.

This has inspired me to begin looking back at my projects and compiling a similar list of things that I have learned by doing it wrong.

</comment><comment><USER3> A refreshing change to the general level of hubris today. Thanks.

</comment><comment><USER4> If you haven't already, check out this guy's growing treasure trove of writing:

<http://sites.google.com/site/yacoset/>

Many of his articles have been posted on HN and elsewhere already.

<comment><USER5> A gem from that site:

      <Shipments>
        <LineItem LineNumber="1" SKU="123456">
            <Order Number="555444">
                <Package ShipMethod="UPS" Tracking="1Z123467WW53631"/>
            </Order>
        </LineItem>
        <LineItem LineNumber="2" SKU="654321">
            <Order Number="555444">
                <Package ShipMethod="UPS" Tracking="1Z123467WW53631"/>
            </Order>
        </LineItem>
      </Shipments>

      The designer of this schema was on crack.

[http://sites.google.com/site/yacoset/Home/an-open-letter- to-...](http://sites.google.com/site/yacoset/Home/an-open-letter-to-all-those- about-to-commit-edi)

<comment><USER6> That entire article is a treasure chest, almost strikes me as he wrote it during a therapy session.

</comment></comment></comment><comment><USER7> Hey what a coincidence! I dunno why he failed with the 4th one.

We maintain a leasing administration system here, and one of the most important/critical features is doing the thing he describes. You can know the exact state of any leasing contract (or a group, or all of them) by chosing a date of the future and past. That way you can compare the expected result vs reality. It is implemented fully inside a SQL DBMS (and works fine)....

<comment><USER8> Yeah, that bit made me cringe a bit too, since you have to do the something similar for storing insurance policies (track when things become effective, including forward-dated changes, storing past versions, etc.). No predictions necessary in our case. I'm guessing dealing with the time dimension is a general property of any system that needs to store anything that qualifies as a legal contract.

It is true, however, that adding in that time dimension makes everything a much, much harder problem.

</comment></comment><comment><USER9> Good lessons, except for 1, without doing that there'd be no Google map-reduce and Hadoop. Of course, this means you should be using Hadoop now.

</comment><comment> nick-dap I got to the end of the entry and felt inclined to click "Report abuse" at the bottom of the page. =D

Loved it. Looking back, I have sinned as well.

</comment><comment><USER10> Great article. It's a pity that over-engineering is often the path to failure, because over-engineering is so terrifically fun to do!

</comment><comment><USER11> @clarencewenham, you should have a nice blog and move your content there. Doesn't matter whether you update it frequently or not.

<comment><AUTHOR> I dislike the blog format, I've tried it several times and it doesn't work for me. I found that I prefer the Wiki style where you focus on a TOC. Hopefully Google will figure out how to implement RSS for GSites one day.

</comment></comment><comment><USER12> Makes me think of that quote from Spinal Tap. You know, that there's a fine line...

</comment><comment><USER13> Is there a way to access this without having to login to google docs?

</comment><comment><USER14> an interesting article in similar vain: niklaus wirth's "good ideas, through the looking glass".

<comment><USER15> [http://www.cs.inf.ethz.ch/~wirth/Articles/GoodIdeas_origFig....](http://www.cs.inf.ethz.ch/~wirth/Articles/GoodIdeas_origFig.pdf)</comment></comment>


Exit the Haunted Forest - <AUTHOR> https://increment.com/software-architecture/exit-the-haunted-forest/ <comment><USER2> I love this metaphor for working with legacy systems, along with "load bearing skeletons:" [https://twitter.com/iamwithnail/status/1052300832371351553](https://twitter.com/iamwithnail/status/1052300832371351553)</comment>


Show HN: OctaveWealth – Smart, flat-fee 401k - <AUTHOR> https://octavewealth.com/ <comment><USER2> Great to see more competition in this space! (Aside: Can you comment on why this is happening now? ForUsAll, Captain401k, Betterment's 401k, now you, etc.)

Who is your third-party custodian? Wealthfront uses Apex Clearing and makes this explicit.

What ETFs do you allow employees to choose from? Again, others (e.g. Captain 401k) make this explicit.

Can employees choose their options in a fine grained manner, or does everyone need to opt-in to your rebalancing and changing of ETF options?

<comment><USER3> Hey, thanks for the questions! I'm Rikin, also a founder.

We actually have relationships with several custodians - depending on the investment options the company wants to make available in the plan.

We don't explicitly list the ETFs because we're not tied to a single fund family (e.g. Vanguard). We pick the best of breed funds for each asset class quarterly - our portfolios currently have ETFs from iShares, Vanguard, Schwabb and PowerShares. We can accommodate requests if employees are after something in particular.

And finally, yes, employees can build custom portfolios. Investment flexibility was one of drivers of us starting this, but we make our portfolios/rebalancing the default to encourage participation from inexperienced employees. We don't have any restrictions on the ETFs/funds or even single-stocks that can be added - but we are careful not to unlock funds that aren't risk appropriate.

</comment></comment><comment><AUTHOR> Founder here, happy to take any qs. We started this because we were sick of percent based fees eroding our investment growth. We also wanted access to more sophisticated investment options which until now have not been available via high end personal wealth managers.

</comment><comment><USER4> This makes me wonder: Why do 401k plans exist? Wouldn't it be easier to allow people to put money directly into an IRA of their choice?

It looks to me like a direct subsidy to the financial sector and in addition employers have the burden of choosing a plan manager.

<comment><USER5> I'm not familiar with the US, but in the UK, generally pension contributions seem like a total scam to me.

As an individual, there is no possible reason why I would want my money to sit in a retirement fund over just having it now.

I am perfectly capable of investing it as I please, in housing, in stocks, in gold, in starting a business, without having it artificially withheld from me.

There seems to be this idea that I'd just be spending it on booze and fags or something. Individuals generally don't waste all of their money unless they feel saving is hopeless.

Pension funds are an arbitrary restriction on that.

I can much more readily leverage my intellectual and social capital if I have cash in hand and that will almost certainly result in a better outcome at retirement.

<comment><USER5> Replying to all below posters:

Yes, I know that there exists a tax deferral. Sometimes employers even match funds.

The statement I am making is that this seems like a complete scam by the Government - forcing you to perform suboptimal manoeuvres by withholding your cash otherwise.

Is it worth participating to reduce taxes? Possibly.

Does it outrage me that I'm treated like a child in this respect? Certainly.

(Why age 55? What if I want to retire at 50? What if I'd rather take a year out now and work 55-56? What if I want to leave the country? What if tax rates change?)

<comment><USER6> That's a good question actually. In Canada you can withdraw from your RRSP early if you want, but you get hit with something like a 25% "don't do that" fee. What's the reason for this lock-in? I can't see one other than to try to encourage you to keep your money in the plan for the long run.

</comment></comment></comment></comment><comment><USER7> You state the problem space clearly -- many employees don't choose to take advantage of tax-deferred retirement plans.

To whom do you have access for investment? DFA has a great portfolio of so- called "unmanaged" index funds. They have a low burden, much of it not front- loaded. And they've been around a long time. There are other similar funds.

How do you avoid the Zenefits craziness as you grow?

<comment><AUTHOR> re investments, we can include several fund families, including Vanguard and DFA. However most customers prefer our Octave portfolios which are built using best of breed funds from multiple providers, using a sophisticated optimization process.

re craziness, our team already has tons of experience managing billions of dollars at scale. I wrote a large part of the portfolio management system that manages BlackRock's iShares, and my cofounder was responsible for trading $6B/day of flow for large pension funds.

</comment></comment><comment><USER8> Only slightly related but why is 401k chosen by the employer in the US? In Australia your Superannuation (basically the same thing) is chosen and controlled by you.

After moving to the US it seems to be that each employer you have will give you a 401k plan with a different company and any time you leave you should roll it over to either another 401k or an IRA or something.

Is it just me or does this make no sense?

</comment><comment><USER9> For what its worth, the whole idea of giving you all, a team none of my employees know discretion over their 401k seems like a terrible idea. You had my interest until that part. Maybe others are interested but as a CFA Chartholder and someone who manages institutional money to me discretion is often used at precisely the wrong time no matter who is doing it (especially worse when its not your own money or dont have skin in the game).

It is interesting though, dont get me wrong. These type of services the country needs more of as the current model is more than broken.

<comment><USER3> Thanks for the feedback. To clarify, we are not an active investment manager. We follow a strict investment process and aren't making changes on a regular basis. Our portfolios have a long term investment objective and are matched to each employee's personal risk profile. We do not try to time the market. The IRS/DoL requires plan sponsors to monitor plan investments, so we take discretion over this to reduce the burden on the employer and reduce their liability.

Our team used to manage institutional money at the largest asset managers, and includes a CFA charter holder. Our portfolios are built using the same quantitative methods used by institutions, and seek efficient, low cost diversification.</comment></comment>


Class-based views in Django 1.3 - <AUTHOR> http://www.caktusgroup.com/blog/2011/12/29/class-based-views-django-13/

<comment><USER2> really neat. any plans to create a patch for the official docs.</comment>


Grand Theft Auto 'cheats' homes raided - <AUTHOR> https://www.bbc.com/news/technology-45891126 <comment><USER2> Title came from the article, and it is rather poor. To summarize the article: 2 properties were searched in connection to a cheat called 'Infamous' that was taken down half a year ago. The cheat was supposedly made by the 5 people in question whos assets have been frozen.

While interesting, I don't think this will become a norm. This is an edge case where these people were pushing this monetized cheating program hard to a lot of people. You have to really disrupt a games online system to warrant targeted investigation like this. As a serious gamer, I wish cheating and cyber attacks were taken much more seriously, but companies don't have the means to investigate and pursue every single infraction.

</comment><comment><USER3> How normal is it to freeze someone's assets so they can just barely pay their daily expenses? It seems like it hinders you from paying a lawyer to protect yourself.

I can see if someone is suspected of being an organised criminal, such that everything he has is derived from crime. Then maybe.

But generally it sounds open to abuse. If you can just get a court to freeze the guy, then whatever your beef is you have a good chance of winning.

</comment><comment><USER4> Duplicate submission with more discussion: [https://news.ycombinator.com/item?id=18239521](https://news.ycombinator.com/item?id=18239521)

</comment><comment><USER5> This will be the new normal. Society/people have evolved to a point where abstract thought is valuable. Protection of that intangibleness will only increase in time as the risks become greater.

<comment><USER6> What? Abstract thought had been valuable for a very long time. People and companies have been gaining a competitive advantage from abstract ideas pretty much from the dawn of time.

In this particular case the issue is regarding the control of a virtual currency, where its power (as with any other currency) depends on its scarcity. Not much new here either, what they've been doing is very similar to counterfeit printing of bank notes.</comment></comment>


Lawsuits Surge Over Websites' Access for the Blind - <AUTHOR> https://www.wsj.com/articles/lawsuits-surge-over-websites-access-for-the-blind-11550415600 <comment><USER2> Are websites allowed to make remedial changes when slapped with one of these lawsuits, or are they forced to submit to the cash grab?

</comment><comment><USER3> I am sure the fines currently cost less than keeping the accessibility features.

<comment><USER4> Not in a class action</comment></comment>


Functional Programming: Is It Worth It? - <AUTHOR> http://www.slideshare.net/AndrewRollins1/functional-programming-is-it-worth-it <comment><USER2> Most of the interesting work I do is in C, so probably not the very top commenter on this, but I have some business in Java. I've seen some functional programming and I agree mostly on the point: "isolating side effects". All the other advantages are yet not very clear to me:/

<comment><USER3> Add pattern matching to the list. You combine function call, unpacking the result, and branching based on its structure and/or value in a single statement, without otherwise unnecessary intermediate variables.

Then add working with single-linked lists and pervasive recursion, which somehow gives much higher level code and the right amount of friction to cause functions to be shorter.

Callbacks being natural and obvious is a cherry on the cake (functions as first-class objects is not that big of a deal, but it still helps a lot in overall landscape).

It's not a single killer-feature of functional programming that make this paradigm so loved by its practitioners, it's all the little things combined.</comment></comment>


Bond's number is up: black female actor 'is the new 007' - <AUTHOR> https://www.theguardian.com/film/2019/jul/15/lashana-lynch-new-007-james-bond-daniel-craig <comment><USER2> I don't see the point of it. Even if it's good, it's not going to be a Bond film, it'll be a film about some sort of special agent, not a James Bond film. Why not create a new original thing, where the lead character played by a female and build on top of it. Why do they need to mess with the existing working formula... I just don't get it. But at the same time, can't say few latter Bond films where all that good, so maybe it'll shake some things up in a good way, although at this point, I don't really believe they can make a good Bond film.

<comment><USER3> I've never really understood the common concern that arises when some established character's race/gender/other-intrinsic-trait is changed (even if it's a different person in canon), where the proposal is "now it's not the same, just make it something new and leave the existing brand name unchanged." I totally understand not wanting a beloved character to change that dramatically, but after enough decades it just seems like a rational thing to try as a story writer. Why start a new universe when we have an existing one that, while quite worn, still has loads of great pre-existing characterisation, lore, and recognition?

<comment><USER4> It's not an issue...so long as the replacement is worthy. But many times it's used as a marketing gimmick to prop up a bad story.

</comment></comment></comment><comment><USER5> more accurate headline: black female actor is the new 007 (code name, not Bond). assuming she's using the number in the movie until he comes out of retirement and either she's killed (cliche) or relents (better) or otherwise.

</comment><comment><USER6> I appreciate gender-bending. It is a time-honored tradition in the theatrical arts.

</comment><comment><USER7> I'm curious why they didn't just retire it.

<comment><USER8> You're curious why they're not retiring a film franchise that consistently pulls in hundreds of millions of dollars of profit with every installment? :)

<comment><USER9> It will be worth it to see if they'll still pull that much after this change. Can't wait

<comment><USER10> Yeah, is a female 007 going to retain the same borderline "me too" hyper- sexuality of the traditional James Bond character? It would be a strangely empowering move, I think: portraying a male 007 as 'slutty' has been accepted, would audiences accept a female version of it? What's the opposite of "womanizer?"

<comment><USER9> Thats an interesting point. I suppose the female variant of womanizer is a "maneater". It will be cool to see what directon they go with her. But it wouldve been even cooler if she made a name for herself with a name or code that hasnt been used before or isnt as ubiquitous. The way it is presented it seems like a low effort way to raise up minorities for social justice.</comment></comment></comment></comment></comment>


Solidfire offers unlimited SSD wear guarantee, punts software at market - <AUTHOR> http://www.theregister.co.uk/2015/02/25/solidfire_splits_afa_sw_hw_for_hyperscalers/

<comment><USER2> Well I know people had trouble with SSD wear early on, but lately SSDs have performed better than expected.

The book "Normal Accidents", however, talks about how people will often consume a safety margin in the name of lower cost, higher speed, better performance, whatever, and there may well be some short-lived SSDs that hit the market over the next 20 years as a result.</comment>


Twitter removes two Bolsonaro tweets questioning virus quarantine - <AUTHOR> https://today.rtl.lu/news/world/a/1492491.html <comment><USER3> If they delete tweets like that, Twitter gets shit for censoring foreign officials. If they don't delete tweets like that, they get shit for not intervening when the public is obviously put in harm's way. I think they chose the lesser of the two evils. Now, on to censor that umpalumpa you call president.

<comment><USER4> It's worse than that. He's making a reasonable argument that the public will be put in the way of greater harm by letting the economy collapse. I'd find it pretty hard to say whether he's right or wrong.

However, even if you think he's wrong, this is not an argument being made in bad faith. Censorship is a simply bad way to handle it.

<comment><USER5> Is it reasonable? In Italy and Spain they have so many bodies that they are running out of space to put them. These people are not dying of economic effects.

<comment><USER6> Italy and Spain are quite developed countries and part of one of the most prosperous economic blocs in the world. Of course people aren't dying of the economic effects, the state can support them through this.

Do you think every country can just pull out trillions of dollars worth of support for their population when stuff like this happens?

<comment><USER5> What are you actually suggesting will happen? That there would be a major famine in _Brazil_? That Brazilians would freeze to death in the harsh Brazilian winter? How are these people going to die exactly?

</comment></comment></comment></comment></comment><comment><USER7> Is it not a little bit patronising that American companies think they can regulate political speech in Brazil? It's quite clear they don't think they can regulate political speech in the US. What exactly is the difference?

<comment><USER8> They are not regulating speech in brazil, they are regulating speech on their platform. Bolsonaro can still say whatever he wants in brazil, he just can't do it on twitter.

<comment><USER9> I guess the question is: why don't they censor Trump / Pelosi / etc for example?

<comment><USER10> > I guess the question is: why don't they censor Trump / Pelosi / etc for > example?

[https://en.wikipedia.org/wiki/Whataboutism](https://en.wikipedia.org/wiki/Whataboutism)

<comment><USER11> This is a fair question.

Once upon a time, I was aware of a similar problem on another social network.

The trouble was, a senior elected official in the US was violating the terms and conditions of the site.

The solution: create an exemption for them.

Let's be honest, doing this in Brazil is pretty low-risk for Twitter, doing it in the US could be existential.

</comment></comment></comment></comment></comment><comment><USER12> Will they eventually come for the WHO/CDC/Surgeon General anti-mask tweets? That's the most interesting case for me, when the expert authorities disagree with the facts (and in a very dangerous way) how does twitter decide?

</comment><comment><USER13> Something so orwellian about a tech company censoring the speech of an elected president of a major country.

Political speech should not be censored. Especially of elected officials. It should be regarded as part of the historical record at the very least.

<comment><USER14> Wouldn't it be Orwellian if it was the elected president censoring/redacting people's tweet ?

I'd be on board with Twitter on this one, hoping they use it as a precedent for dealing with the other living policy infringements they have on their platform.

<comment><USER15> No, they're both Orwellian. Censorship doesn't magically become OK just because it's done by a global megacorp instead of a govermnent.

<comment><USER16> It's their platform. They own it. It's not a public space and he's not entitled to use it for free to further his political agenda.

</comment></comment></comment></comment><comment><USER16> I wonder how much it takes for him to get his account suspended.

</comment><comment><USER17> Is there a world where twitter can remove any of the Trump tweets?

<comment><USER16> This one. They just don't want to.

<comment><USER18> We must help them want to, as a matter of life and death.

<comment><USER16> I wholeheartedly agree. I just don't know how.

<comment><USER18> One piece that may be useful for the puzzle: Approaching this from the perspective of psychology and familial trauma has helped me understand and discuss. Someone close to me had a clinically diagnosed narcissistic sociopath parent. Literature on working with trauma and how to work with the consequences of psychologically hostile parents helps to understand the model.

The narcissist-sociopath model is very simple and there's kind of always the same underlying base behavioral script. This is fortunate, because it can be easily simulated by a normally working mind once we are trained to do it. It's very unintuitive if we are caught unaware.

</comment></comment></comment></comment></comment><comment><USER19> A positive aspect of the coronavirus is that it allows you to determine which politicians are sociopaths and which aren't.

<comment><USER20> Because putting entire nations under forced house arrest based on the output of computer simulations isn't even slightly sociopathic? It's literally got "social" in the word.

Argue that it's the right choice by all means. To argue that politicians caring about the economy - that thing that also keeps us alive - <USER2> "sociopathic", just shows a complete loss of perspective.

<comment><USER19> Ordering quarantine is quite obviously not sociopathic to anyone who understands exponential growth and can do basic calculations.

> _To argue that politicians caring about the economy - that thing that also > keeps us alive - is "sociopathic", just shows a complete loss of > perspective. _

It's hard to see how someone who directly weighs deaths against economic benefits in such a situation (before the pandemic has even peaked) could not be a sociopath, and by "sociopath" I really mean the personality disorder, not some subjective sentiment. It's a hypothesis, but one that would be easy to confirm empirically with standard personality tests.

You have to bear in mind that politicians in those positions have good scientific advisors. They were attempting to delay measures in order for the economy of their country (or their personal stocks) to come out better in the end. They were willing to risk this gamble, even though they knew that this results in many more deaths, because no country's health care system can deal with so many patients at once. Except for Bolsonaro, all of these sociopaths have backed off by now, because most sociopaths are also narcissists and they realized the many deaths would make them look bad.

That's the sad truth, whether you like it or not. The good news is that there are less sociopathic heads of states than one might think and the vast majority of all decision makers have reacted wisely. Let's not forget that.

<comment><USER20> _Ordering quarantine is quite obviously not sociopathic to anyone who understands exponential growth and can do basic calculations._

Lots of people understand both yet are sounding the alarm as loudly as they can about over-reaction, the poor track record of epidemiology and the poor quality of the data. For instance it's not even clear COVID-19 is spreading exponentially. The percentage of positive results from tests done is not scaling exponentially, but only the raw numbers are being reported usually so an exponential increase in the number of tests can make it look like an exponential increase in spread.

The world does have experience of bad policy initiated by governments who were following what they perceived as scientific advice (of the kind politically acceptable to themselves). The worst one being Lysenkoism. And of course abuse of psychiatric evaluations to declare anyone politically opposed to the government as mad or bad has a terrible history as well.

You should really think a lot more carefully before declaring anyone who disagrees with you as having a personality disorder. Shutting down the world indefinitely will cause _everyone_ to die: that is a fact. COVID-19 will not approach even a fraction of that, not even under the worst case projections. Obviously at some point the "sociopaths" as you put it have to win the argument or else we're all reverting back to stone age times.

 _You have to bear in mind that politicians in those positions have good scientific advisors_

Having read the output of such scientists, I don't think that's at all obvious. You're assuming it, maybe hoping it, but scientism is a real problem in academia.

 _They were willing to risk this gamble, even though they knew that this results in many more deaths, because no country 's health care system can deal with so many patients at once._

So far not a single countries healthcare system has come anywhere even close to collapse. All stresses have been highly regional and could have been handled by inter-region transfers, yes, even in Italy and China. In fact in Italy a politician wondered the other day why they are transferring patients to Germany when nearby Veneto the ICU is 2/3rds empty.

[https://www.tagesspiegel.de/politik/die-verlangsamung-ist- da...](https://www.tagesspiegel.de/politik/die-verlangsamung-ist-da-in- italien-zeichnet-sich-die-wende-in-der-coronakrise-ab/25698124.html)

And a significant source of the pressure on healthcare systems is in fact the quarantine measures placed on staff, many of whom are self isolating without symptoms.

The belief in totally collapsed healthcare systems comes entirely from simulations of questionable utility (because attempts to simulate prior epidemics have failed).

<comment><USER19> The exponential spread of SARS-CoV2 in the early phase (without containment measures) is a fact. You will not find an expert who thinks its R0 without any measures is <=1, since no data would support this thesis. Look at the curves. Estimates are currently between 2 and 4. As for health care systems not collapsing: _All countries have reacted with drastic measures_ and that is the reason why their health care systems have not collapsed. Some have also better health care systems than others (e.g. Sweden, Netherlands). If you think any country could have done without quarantine or equivalent measures such as constant testing, temperature measurement, forced quarantine of infected, and very stringent case tracking, then you really do _not_ understand exponential growth and how the disease spreads.

I'm not declaring anyone who disagrees with me to have a personality disorder, I have laid out reasons why it is very likely that a certain small percentage of politicians has one. It can be inferred fairly well from what they say. In fact, a certain small percentage of the general population has them, so it would be a miracle if politicians where somehow exempt from personality disorders. Sociopaths lack empathy, so they have no problem weighing other people's lives against any other factor. That is a fact, too. As I said, it would be easy to confirm my claim with personality tests. It's not an outlandish view at all.</comment></comment></comment></comment></comment>


How to Get Funded or Acquired - <AUTHOR> http://www.building43.com/videos/2010/04/13/how-to-get-funded-or-get-acquired/

<comment><USER2> This is a long video, but it has good content. I liked it, thanks for posting this.</comment>


Google Adds New Notification Center To Chrome Code - <AUTHOR> http://techcrunch.com/2013/01/31/google-adds-new-notification-center-to-chrome-code-could-grow-into-full-google-now-desktop-support/

<comment><USER2> Am I the only one who doesn't think Google Now is the best thing ever? I've never seen anything useful in it. What do you use it for?

<comment><USER3> Let me give you one example that felt like magic. I was taking a trip to New York on business. At 4pm I come off the train at Penn Station and pull out my phone to look up the hotel confirmation I got two weeks before so I can get directions. When I turned it on, a Google Now card was there saying "Carlton Hotel, you're checking in today." I click it and up come directions.

Now, I performed absolutely NO action to make that happen. I just had a confirmation by email that it had picked up. Now maybe that's creepy to some people but it saved me a lot of fiddling around with the phone to find the confirmation and it knew exactly what I wanted, when I wanted it. Isn't that what computers are supposed to do for us?

<comment><USER2> That seems great but how do you get it to show you a notification like that? The only way for me to see the cards is to manually go into Google Search and scroll down to them.</comment></comment></comment>


Shark and ray vision comes into focus - <AUTHOR> https://phys.org/news/2020-01-shark-ray-vision-focus.html <comment><USER2> _" Sharks and rays do contain both rod and cone photoreceptors; however rays possess two cone opsin genes whereas sharks have only one cone. Sharks therefore were found to have lost the ability to see colors."_

Surely if you have both rods and one type of cone, you do still have some degree of colour vision, from the difference between the rod and cone response curves? Either the rods and cones both respond (one end of a colour spectrum), or just the rods respond (other end of the spectrum), and colours in between can be distinguished to some degree by the relative differences as the cone response progressively drops off.

<comment><USER3> > Sharks therefore were found to have lost the ability to see colors.

I've heard that bright color bathing suits might intrigue sharks as it could resemble some type of colorful fish. Is this just an urban myth?

</comment></comment><comment><USER4> The paper expands on "disadvantages of color vision":

[https://academic.oup.com/mbe/advance- article/doi/10.1093/mol...](https://academic.oup.com/mbe/advance- article/doi/10.1093/molbev/msz269/5625936)

> Color vision requires opponent neural mechanisms that compare the output of > different spectral photoreceptor types. Inhibitory interactions between > photoreceptor channels can decrease the signal-to-noise ratio and, > therefore, may degrade the ability to detect subtle differences in image > contrast (Kelber and Roth 2006); in dim light, a monochromatic visual system > may be capable of discriminating a greater number of distinct reflectance > spectra than a di- or trichromatic one, purely based on intensity > differences (Vorobyev 1997). Color vision also degrades spatial acuity, > especially when the spectral peaks of the photoreceptor channels are widely > separated, because the signals from different cones types will reflect both > spectral and intensity differences in the image (Roorda et al. 2001). For > this reason, many animals rely predominantly on a single spectral channel to > convey high-resolution achromatic spatial information (Lind and Kelber > 2011), but of course any other spectral cone types are then taking up > valuable retinal "real estate" that could otherwise be used to improve > resolution in bright light (i.e., more receptors per degree of visual angle) > and/or reduce noise in dim light (i.e., through neural summation). Due to > absorption, reflection, and scattering by the water itself and any dissolved > or suspended substances, most aquatic habitats are characterized by low > visual contrast. Moreover, many sharks are active both night and day and > must therefore operate under a wide range of light intensities. It is likely > therefore that sharks are often operating close to the threshold of their > visual capabilities where the disadvantages of color vision circuitry might > be detrimental to survival.

<comment><USER5> IIRC color blind people were recruited to do reconnaissance photo analysis during the war in the UK.</comment></comment>


Ask HN: What are some red flags for you when interviewing software engineers? - <AUTHOR> <comment><USER3> Consistently describing things imprecisely or in a hand-wavey manner.

<comment><USER4> This a million times, in my experience I noticed a very strong correlation between "describing things imprecisely" and "I'll be disappointed working with them".

One example that is stuck in my mind is this ex coworker who during the interview kept messing up orders of magnitudes for some quantities during a simple back of the napkin calculation: specifically, he didn't have a clear pulse on the difference between nanoseconds and milliseconds, which is essential in the domain I'm working (system engineering - <USER2> systems).</comment></comment>


When Threatened by Worms, Bacteria Summon Killer Fungi - <AUTHOR> http://phenomena.nationalgeographic.com/2014/12/19/when-threatened-by-worms-bacteria-summon-killer-fungi/

<comment><USER2> Absolutely amazing. I had no idea nematodes were so common, or that they fed on bacteria; I pictured them to be much larger somehow and feeding on bigger prey.

I also love that ngc is taking scientific papers and making them available to a wider audience, so to speak.</comment>


Ask HN: Why do companies still not let you choose your security questions? - <AUTHOR> Like for example, Apple with their Apple ID setup? These old cliched questions don't help anything, and are stupidly easy to defeat for anyone wanting to socially engineer your account details.
So why don't these companies just give you a few text boxes and let you set them yourself? That way, they'd at least be somewhat secure for thos who know what you're doing, and those who use them for impromptu passwords could just use them as that.
P.S. Why do we still have these silly things in general? <comment><USER2> > P.S. Why do we still have these silly things in general?

One possibility is a belief that having a security question allows for users to reset a forgotten password without having to involve a help-desk person on a phone call to do a password reset.

> These old cliched questions don't help anything

If your answers are the output from this:

      $ sort --random-source=/dev/urandom --random-sort /usr/dict/words | head -5
      spindled
      antiquities
      tumblers
      teasing

Which makes (for this example) the answer "spindled antiquities tumblers teasing halter". So you have words for the times you are talking to the human on the phone when they want you to give the answer, but you have random words that joe-hacker is not likely to guess while trying to do social-engineering on the same help desk human.

With a password manager, storing these "random" answers to security questions along with a randomly generated password, is trivial. And if these are your answers, you don't really care what the question happens to be, because the answer you give will have nothing to do with the actual question anyway.

</comment><comment><USER3> Storing custom questions requires a larger persistence footprint.</comment>


Proposal to Change the Default TLS Ciphersuites Offered by Browsers - <AUTHOR> http://briansmith.org/browser-ciphersuites-01.html <comment><USER2> Is (NIST) P-256 secure enough? I might be wrong, but I think DJB is suggesting it's not, and that Curve25519 is preferable because it meets all the needed security requirements:

[http://cr.yp.to/talks/2013.05.31/slides- dan+tanja-20130531-4...](http://cr.yp.to/talks/2013.05.31/slides- dan+tanja-20130531-4x3.pdf)

And why just 128-bit AES? AES-256 is not much slower, is it? I think I read it's only 30 percent slower than 128-bit encryption. Either way PFS should become the default for all encrypted communications.

Companies need to start setting their own minimums _years_ ahead of what NIST is recommending. NIST recommended the use of RSA 1024-bit until 2010, so that probably means companies should've moved away from RSA 1024-bit at least 3-5 years _earlier_. Yet here we are, with most companies today still using RSA 1024-bit 3 years _after_ what even NIST recommended. Time to put security over profits first.

Also, as Ptacek is saying, it's time to implement TACK for certificate pinning:

[https://twitter.com/tqbf/status/375742847485358081](https://twitter.com/tqbf/status/375742847485358081)

<comment><USER3> Bernstein's big problems with the NIST curves are that they turn out to be difficult to write fast constant-time point multiplication for them (bear in mind that they were chosen before this was a well-known concern), and that they're easy to screw up in implementations. Those are real concerns, but so to would be fresh implementations of Curve25519 in all new software.

If one good thing comes of this most recent debacle, though, it'll be an industry reconsideration of the concepts that didn't manage to become NIST standards, like modern stream ciphers and faster curves.

<comment><USER4> The difficulties with fast constant-time point multiplication seem to be precisely the type problem the NSA might know of earlier. I.e. it's possible they contrived the standards to something they knew people could easily get wrong. Not a reason not to use them, just food for thought.

</comment></comment></comment><comment><USER5> This site uses the 'Globalsign Organization Validation CA - G2' certificate, which I've removed from my trust list. It's is a certificate that can be theoretically used to sign any domain (i.e., it's MITM-capable).

I semi-regularly see it on Cloudflare sites because their customers haven't bothered to send their own keys to Cloudflare.

I thought it was ironic than article about SSL security was doing something that is less secure than possible (from the end user's point-of-view).

Just to be clear, yes, I understand that the operator of brainsmith.org isn't gaining any more security by sending CF the private key to their own cert vs. using CF's G2 cert. With the first approach the _end user_ of brainsmith.org has better security since he can view the site without having to trust an MITM-capable certificate.

<comment><USER6> In Cloudflare's case "haven't bothered to send their own keys" implies "haven't seen the need to pay Cloudflare $200/month or $3000/month for the ability to upload a certificate+key". AFAICT only the Business and Enterprise plans allow custom certificates.

<comment><USER7> Why the fuck would anyone want to use them then? Even the shittiest shared host or VPS offer that for pittance.

<comment><USER8> It's a CDN... comparing to a VPS is not even close to being fair.

I've never seen a CDN that will let you load an ssl cert for less than a few hundred dollars. SNI isn't supported widely enough yet, so they have to dedicate an IP to you.

</comment></comment></comment></comment><comment><USER9> So, Mr Smith wants to add a bunch of elliptic curve options (using the NIST curves, weakest P-256 first), while removing the widely used TLS_RSA_WITH_AES_256_CBC_SHA256 due to "concerns" about "performance" and an unsubstantiated argument that ephemeral key exchange is somehow always better. Hmm.

<comment><USER10> Beware of random cryptographers bearing suggestions? #HUMINT

<comment><USER11> I really hope TLS crypto standards won't be set (or changes rejected) based on _who_ proposed a particular change.

Changes should stand on their own merits. I don't see why we should trust anyone, random or not. It's not about trusting people, it's about trusting algorithms. So it doesn't really matter who in particular proposes changes.

<comment><USER10> In a ideal world, but if you get a lot of "contributions" some might slip through. Remember, no one can match NSA's budget, manpower and maybe brainpower.

</comment></comment></comment></comment><comment><USER12> This proposal prefers AES-GCM. Interestingly, Adam Langley (Chrome) is against AES-GCM. [https://www.imperialviolet.org/2013/01/13/rwc03.html](https://www.imperialviolet.org/2013/01/13/rwc03.html)

<comment><USER3> I think Adam Langley doesn't like GCM because its normal software implementation requires secret-dependent table lookups for speed. It's thus thought to be easy to produce a naive GCM implementation that will suffer from side channel attacks. That concern is rapidly being mitigated by newer CPUs which can do the multiplications for GCM in hardware.

From a theoretical perspective, the polynomial MACs (like GHASH) are very well understood.

But, much more importantly, the TLS GCM construction is the only modern stream encryption standardized and widely available to TLS. The block constructions in TLS suffer from being created before Encrypt-then-MAC was proven secure; they do the operations the other way around, and thus require extremely fiddly code to quash side channels that have (unlike GCM) already been shown to admit plausible attacks.

The author of this proposal probably isn't so much making a statement about GCM so much as he is suggesting that we need to deprecate the 90's-crypto parts of TLS, which is something that is hard to argue with.

</comment></comment><comment><USER2> The author seems to worry a lot about ARM performance. If this "proposal" is going to take 2-3 years to be implemented in browsers, then I wouldn't worry too much about it.

The ARMv8 architecture is supposed to come with hardware optimized AES and SHA-1/SHA-2 encryption, and be "up to 10x" faster than on ARMv7. ARMv8 chips should start coming out next year. So if we're planning "for the future" here, then I'd start with ARMv8 in mind, rather than ARMv7 or even ARMv6 (which really should stop being supported already).

If better and more optimal security means that older phones and lower-end ones will experience a setback in performance on some sites for the next few years (until they get upgraded), so be it.

<comment><USER13> The author works for Mozilla (he's their security module peer), and is therefore focused on Firefox OS - which aims for low-end smartphones. Hence the reason for focusing on older ARM. Hope that helps.

<comment><USER2> I know that's one of the reasons he's saying it, but that's not really everyone else' concern, too, and as I said security should come first. Firefox OS is coming to ARMv6 phones right now, so at the very least they shouldn't start with that in mind when establishing the minimum of performance for encryption.

There's the ARMv7 Cortex A7 chip for low-end now, and ARMv6 chips are terrible for performance anyway. They should not be used as a starting point for very low-end phones anymore.

<comment><USER14> ARMv6 is very similar in all regards to ARMv7 and there are very fast implementations available. Are you talking about ARMv5 perhaps, which has a terrible memory model making fast multitasking implementations with memory isolation very hard to implement? ARMv7 just adds some new instructions which are while usefu, does not give the performance benefits.

</comment></comment></comment></comment><comment><USER15> Why not adopt the goal of deprecating all ciphersuites but one? Let's have a debate about the best ciphersuite and settle on a single one. That would decrease the attack surface and would allow the crypto community to focus on getting the implementation bug free. It would also give attackers a tighter focus, so we'd better pick the right ciphersuite! To Brian Smith's list of criteria, I would add implementation simplicity as a very important requirement.

<comment><USER3> For the past 5 years or so, we've managed to take good advantage of the fact that we had a diversity of ciphersuites, even though each of the pre-1.1 ciphersuites had problems. Trying to lock down a single known good ciphersuite would be drawing exactly the wrong lesson from recent history.

<comment><USER15> If the latest Greenwald/Schneier revelations are true, then the past 5 years of TLS have underwhelming to say the least, so I don't see what advantage has been obtained from diversity.

Going forward, how are site admins to know what ciphersuite to use? This needs to be made very clear. And how are web users to know what the green lock in their browser means, if it can mean anything at all? The current state of affairs is incomprehensible to all but a very few.

There needs to be a big public debate about what ciphersuite is the best. And there should be very careful scrutiny of the implementation. Choosing ciphersuite(s) is a political as well as a technical problem -- the goals should be as clear and simple as possible.

<comment><USER3> That's what this post was about.

</comment></comment></comment></comment><comment><USER16> Does ephemeral key exchange protect against MITM ? I don't think so. Checking for that would be difficult I think for a standrad protocol.

<comment><USER17> No, the DHE/ECDHE (ephemeral key exchanges) don't protect against MITM, it protects against passive dragnet decryption. But the RSA/ECDSA/DSS part (certificate signing) does. All TLS ciphersuites include certificate signing to protect against MITM, but not all include ephemeral key exchange.

</comment></comment><comment><USER18> _Prefer faster over slower._

Would any security expert give a critique of this section of the article? That line seems counterintuitive: faster sometimes means easier to break. Shouldn't the goal to be as slow as possible (but no slower than a user will tolerate)?

Also, who is Brian Smith? His personal page doesn't give any info, just an email address. Searching for "brian smith cryptographer" yields a stackoverflow user page, some comments by Brian Smith on various security- related newsgroups, and a linkedin profile[1] with very strange job history -- overlapping timelines, and no entries after 2004 ... I'm assuming that's the same Brian Smith because of his interest in "Cryptography and Information Security."

If that is him, I wonder who he's worked for since 2004? (Should we even be asking these kinds of intrusive questions about people who are proposing new security standards?)

While I'm at it, I may as well ask: who is the submitter, fejr? His account is 5 days old with just one comment but 11 submissions, all related to the NSA or security. I'm curious how they came across this Brian Smith proposal in the first place, because that would give us some information about his background at least. This proposal seems new, because Wayback Machine has no record of that Brian Smith proposal URL[2] so fejr seems to be the first one to post this to any news website.

[1] [http://www.linkedin.com/pub/brian- smith/6/6b3/9a7](http://www.linkedin.com/pub/brian-smith/6/6b3/9a7)

[2] [http://web.archive.org/liveweb/https://briansmith.org/browse...](http://web.archive.org/liveweb/https://briansmith.org/browser- ciphersuites-01.html)

EDIT: This article deserves a better top comment than mine. When I wrote this, the submission had zero comments and raised a whole lot of questions: Who is this person? Can we trust them? Why haven't we heard about this proposal till now? The answers came swiftly: Brian Smith works for Mozilla. Yes, we can trust that this proposal has no hidden agenda. We hadn't heard about it because it was originally posted to the Mozilla Crypto list two days ago.

Now that those questions are settled, I find myself in the top comment spot and entirely undeserving of the honor. It may have been necessary to at least consider the questions I raised (trust and identity of the author), but my comment addressed none of the substance of the article. I wrote it in order to get some discussion started until tptacek comes in and writes a thorough critique of the proposal's strengths and any possible weaknesses.

So please, someone, write up a good topcomment analysis of the proposal so we can upvote you. :)

<comment><USER19> > Also, who is Brian Smith?

Are we moving from a state that can know everything on us, but at least might be too busy, to a mob that insists on knowing everything about us, because it's too idle?

I'm pseudoanonymous on here, deleted my LinkedIn account years ago because I despise the site with an utter passion. And, fuck me, I've probably said something stupid about cryptology online because even though I _love_ practical math, crypto is _really hard_ , and IANAC.

I could explain that I'm pseudoanonymous here because I actually am an attorney,[1, 2] and I don't want anything I accidentally say online to be associated with any of my clients. But while that sounds very serious, it's actually pretty unlikely, so no, there's another secret reason that's utterly selfish. I'm going to reveal it here for everyone.

I don't use my true name all the time because I don't want my online reputation in every community tied to stupid shit I said online when I was 15. And when I'm 35,[1] I might not want to tie my online reputation to the stupid shit I'm saying right now. I like the freedom online communities provide to earn respect from nothing, without people relying on any preconceived notions based on how your name sounds, or even what you did last year. I take comfort in the realization that if it all doesn't work out, I can always walk away from a profile and start from scratch. It's social bankruptcy protection. Or maybe, the summer before your freshman year anytime you need it to be.

I feel like in 2002 we wasted a lot of time trying to figure out who in the sphere of public thought was a secret terrorist. I don't think we got anything out of those conversations, and I'd hate to see us repeat the same mistake digging for secret bureaucrats.

I know the recent news makes this hard, but maybe go back to "Is this guy Bruce Schneier, or someone I've never heard of? If I've never heard of him, I'll provide extra scrutiny to the proposal, not because I'm necessarily presuming malicious intent,[3] just because his reputation is not established, and it's a better use of my time to scrutinize the proposal than to scrutinize some random guy's life."

You can waste a lot of cycles trying to confirm or deny if someone has a secret life, something that's probably unknowable, and none of that work actually improves the crypto.

[1] Head start on the doxxing for anyone playing along at home.

[2] I am not _your_ attorney, so don't get any funny ideas.

[3] Well, arguably in crypto, you should always assume malicious intent, constantly ask how any little bit could aid an adversary. But that's not all we're talking about, is it?

EDIT: Formatting (mostly footnote numbering)

<comment><USER18> Yes, my apologies. My comment was overly blunt.

The reason paranoia is important in post-2013 crypto is because the NSA's knowledge of crypto is very likely ahead of academia / public sector knowledge. They've historically used that advanced knowledge to influence past standards. In one case, they seem to have secretly enhanced the security of DES.[1] But in another case, evidence suggests they may have secretly put a backdoor into their Dual_EC_DRBG proposal.[2]

This raises the question: Should we worry about NSA tampering with proposals? If that's our goal, then it seems to me that our most powerful tool is trust: the fact that we can almost always trust tptacek, cperciva, the Mozilla Security team, and other established names. It's not that they're infallible --- rather, it's that they've always been genuine with their intentions, and have spent years building up that level of trust, so it would be a huge risk for them to be willing parties in NSA tampering.

Therefore, if someone is proposing a new standard, scrutinizing their reputation would seem to be a necessary first step. If their knowledge is secretly ahead of the public sector's, and their proposal contains a secret flaw, then no one will be able to spot it. What else is there to examine if not our level of trust in their established reputation?

So if we choose to believe that the NSA is ahead of public sector knowledge, then it seems like it's valid to be concerned about identity and reputation, because it's inherently impossible to rely on the public sector to spot any hidden influences in the proposal, unless the public sector happens to make the same sort of cryptographic breakthroughs that we presume the NSA to have made.

I apologize for bringing it up in a disrespectful way. I didn't mean to dig into Brian's life. The LinkedIn profile just happened to stand out in a quick google search.

For what it's worth, all I'm trying to do here is ask the community: should we be concerned about NSA tampering? If so, should we assume their knowledge is ahead of the public sector's? If we assume that, then what else can we do except scrutinize identity/trust (since if we assume advanced knowledge, then we can't rely solely on scrutinizing the content of their proposal)? I honestly don't know whether those are valid concerns going forward, or whether they should be taken so seriously. I'm hoping the community will decide.

[1] [http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27...](http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design)

[2] [http://en.wikipedia.org/wiki/Dual_EC_DRBG](http://en.wikipedia.org/wiki/Dual_EC_DRBG)

<comment><USER19> Eh, I was probably too hyperbolic.

I agree it's a difficult situation, one with a lot of really hard challenges.

I don't envy the standards communities that will have to figure out the best next steps forward.

</comment></comment></comment></comment><comment><USER2> So far I haven't seen anyone question the SHA algorithms. Both SHA-1 and SHA-2 were designed by the NSA. Is everyone okay with that?

SHA-3 wasn't designed by the NSA.

[http://en.wikipedia.org/wiki/Secure_Hash_Algorithm](http://en.wikipedia.org/wiki/Secure_Hash_Algorithm)

<comment><USER3> Probably. The SHA-1 and SHA-2 hashes are straightforward extensions of hash designs from academia, and the constants in the hashes are derived from the first N prime numbers; they aren't mysterious in any way.

</comment></comment><comment><USER20> This proposal is too aggressive at deprecating ciphers that are the _only_ option for some browsers (e.g., IE8). It would be useful to add an icon to the address bar that indicates the security level of the crypto used (PFS or not, etc.)

<comment><USER12> Removing ciphers is aggressive, but what's wrong with deprecating ciphers?

</comment></comment><comment><USER21> And... Why would Google ánd Microsoft do this? They are the biggest assets on the NSA list remember?</comment>


Ask HN: Should I jump to OpenJDK 11 now that support for 8 is running out? - <AUTHOR> My understanding is that OpenJDK 8 will no longer receive updates after January 2019. Most of my Java code targets Java 7 and some Java 8. What would be the consequences for me of jumping to the OpenJDK 11? How does it do with lower source levels? Are there any gotchas I should be aware of? <comment><USER2> It is a good time to jump to Java 11. It may not be too difficult getting the code to run per se, unless you are using CORBA and some really old tech. It would also be a good idea to invest some time into the launcher scripts and modular packaging in your application.

However, it is high time you consider taking up a non Oracle distribution if you are looking for support. Rely on any distribution you can build yourself than going for a vendor downloadable distribution like Corretto. No vendor lock ins, even the benevolent ones.

My current favorite is [https://github.com/AdoptOpenJDK](https://github.com/AdoptOpenJDK)

I'm keeping a watchful eye on if any of these repos close/lose support. If anything of that sort happens, I'm ready to drop Java and rewrite it.

</comment><comment><USER3> Amazon have committed to providing security updates to their build of OpenJDK version 8 (called Corretto) a until "at least June 2023"

[https://aws.amazon.com/corretto/faqs/](https://aws.amazon.com/corretto/faqs/)

So things aren't as dire as "support stops in 3 weeks!!!". But moving to 11 isn't a bad idea anyway, since you're going to have to do so sometime anyway. (interestingly Amazon have (so far) only committed to updates for Corretto 11 until August 2024...)

</comment><comment><USER4> It depends on the application -

are you using app servers? will you need to migrate/upgrade those? Are all your dependencies J11 compliant?

Its a reasonably big jump from JDK8 -> post-9 with modules. But should be doable

</comment><comment><USER5> yes, jump to 11 (nearly approaching the 12)</comment>


Get a co-founder - <AUTHOR> http://sacstarts.com/2010/01/30/get-co-founder

<comment><USER2> _Freelancers or outside firms can't possibly deliver what you want because they don't actually care about the product or the outcome_

Actually that's not true. A lot of freelancers I know are very proud of and attached to the projects they work on.

Might be true for some others, like some of the overseas firms you'll find on elance who crank out insane amounts of code, but for individual freelancers my experience has been that they care a great deal about what they work on.

<comment><USER3> Certainly with any generality, there's exceptions. But if you are a guy with an idea and don't have the ability to build it, you're unlikely to be satisfied with the outcome of hiring a freelancer.

Freelancers are not employees. They're not attached to the business on a full time basis, and while they may get excited by the business and be happy to be working with the entrepreneur, in the end they are mercenaries.

Further, when the project is over and they walk away, the knowledge behind your product and technology walks away with them. This is true of employees as well to some extent, but at least with employees there's an expectation that they will be involved for a long term. For them it's not just another contract.

Contractors can be used to augment your development staff, but should never be your entire development staff.

Sure, you CAN have a success with a product built by freelancers (Digg is an example of this) but it is very, very rare.

</comment></comment><comment><USER4> He suggests to give only 30% to the guy who's going to build the entire product? Sounds cheap.

</comment><comment><USER5> Wouldn't it be awkward to use the dating analogy if the two founders were of the opposite sex, or homosexual? It feels as if people assume startups are for guys looking for other guys, and this way of thinking further discourages girls from getting into the game. So I dunno, good idea to stop using dating analogies?

<comment><USER3> A business partnership is a relationship. It's certainly not a romantic relationship, but it can be just as intense and emotional as a romantic relationship.

No one is suggesting that potential business partners take each other out to the movies. But it's a good idea that they spend a lot of time together and get to know each other well before jumping into a partnership together.

That's why the analogy works. You don't meet someone at a party and marry them the next day. You shouldn't meet someone at an event and make them your co- founder immediately either.

<comment><USER5> I know it works, but I'm saying isn't it a bit awkward to use on a guy and a girl if they aren't dating?

<comment><USER3> No one is saying the two people ARE dating and marrying. They're saying the process of finding a co-founder is LIKE dating and marrying.

That's what an analogy is. "a⋅nal⋅o⋅gy - a similarity between like features of two things, on which a comparison may be based"

<comment><USER5> And the awkwardness comes in because not everyone is keyed in to the analogy. It can be easily misconstrued as the two people are dating. For two guys however it's less awkward because people naturally seek another explanation for the term dating first. But for some people they could jump to the romantic term for dating, and knowing this is why it can be seen as awkward even to just some people.</comment></comment></comment></comment></comment>


Interview with Patrick McKenzie & Keith Perhac about their new podcast - <AUTHOR> http://tosbourn.com/2011/12/web-stuff/interview-with-patrick-mckenzie-and-keith-perhac-about-their-podcast/

<comment><AUTHOR> Would love some feedback from anyone on this.</comment>


Uncovering the brutal truth about the British empire - <AUTHOR> https://www.theguardian.com/news/2016/aug/18/uncovering-truth-british-empire-caroline-elkins-mau-mau <comment><USER2> > "Who is controlling the production of the history of Kenya? That was white > men from Oxbridge, not a young American girl from Harvard"

A lot of this reminds me of the self-censorship that Orwell talked about ([http://orwell.ru/library/novels/Animal_Farm/english/efp_go](http://orwell.ru/library/novels/Animal_Farm/english/efp_go))</comment>


Ask HN: Looking to understand the high level architecture of a map app - <AUTHOR>

I am trying to work/study a maps application (like google or apple maps). Before I get into that I would like to have a high level yet technical idea of what happens on both the server side and client. Can some one point me to any resource? Specifically, I am looking to understand all the data formats involved end-to-end and how data flows. <comment><USER2> Any luck? Been looking for the same thing but nada</comment>