Norilsk: Otherworldly Photos of an Arctic City - <AUTHOR> http://www.bbc.com/culture/gallery/20190321-norilsk-the-city-where-the-sun-doesnt-rise <comment><USER2> I find this city fascinating for some reason. It's something about the fact that it's so harsh, but humans are still able to live there. Here's a YouTube video of it that makes it look almost artistic:

[https://www.youtube.com/watch?v=ks9E9XQp_2k](https://www.youtube.com/watch?v=ks9E9XQp_2k)

<comment><USER3> Make no mistake - humans are only able to live there while burning copious amounts of hydrocarbons to stay warm and/or generate electricity. And they don't live particularly well.

Also at the massive cost to the surrounding environment.

I guess Inuits live in the extreme cold as well, but their entire world population is smaller than the city of Norilsk.

<comment><USER4> Trust me, global warming does not sound like something bad for citizens of Norilsk.

<comment><USER5> Their buildings are collapsing due to permafrost disappearing :) Also it will release lots of pollution from the ground which will even further worsen environmental situation. So on one point yes, it will be warmer but it will make their life more difficult than it is now :(

</comment></comment></comment></comment><comment><USER6> I recommend watching the documentary "A Moon of Nickel and Ice" about some of the varied inhabitants of this city. Interesting interviews and great cinematography. Free for Prime members: [https://www.amazon.com/Moon-Nickel- Ice-François-Jacob/dp/B07...](https://www.amazon.com/Moon-Nickel-Ice-François- Jacob/dp/B07592GDWN)

</comment><comment><USER7> My favorite Norilsk trivia is that the topsoil is so polluted that it'd be profitable to mine it for heavy metals. [1]

[1] [https://www.newscientist.com/article/mg15120490-300-rich- pic...](https://www.newscientist.com/article/mg15120490-300-rich-pickings- from-russias-polluted-soils/)

</comment><comment><USER8> Wow. I find these places amazing. I don't understand how they can "work".

Like in... why do people stay?! Russia's a huge country and with free movement you'd imagine such places would get depopulated quickly...

<comment><USER9> "free movement" \- false.

Why did people stay in Detroit when it was down? Moving is not as easy as it seems. Only very few have courage to leave their nest. But that's a whole different story.

In Russia, besides the fact that movement is not "free" because of propiska ( [https://en.wikipedia.org/wiki/Propiska_in_the_Soviet_Union](https://en.wikipedia.org/wiki/Propiska_in_the_Soviet_Union) ), general conservative propaganda highly encourages pin-pointed "nationalism". You leave your city - you are a traitor, how could you leave your friends and family.

<comment><USER10> Well, "propiska" in Russia is a dying institution, actually no one is really interested where your "propiska" is. In recent past there were some troubles finding job without "propiska" in region, but it passed. We have fees for people, who do live outside of their "propiska" region and do not tell government where they live, but these fees applied to people extremely rarely.

About "traitor" thing - well, usually everybody understand that there are better places to live than small city in Siberia. People move very often. For example, after school 20% of my classmates moved outside of Siberia and almost everybody left my small city and moved to a bigger one. I were born in Siberia and moved to Saint-Petersburg a year ago -- no one called me a traitor. They even come as guests, stay in my apartment and sometimes think about moving too.

I've met a couple of people from Norilsk - they are glad they moved out, but proud of the place of their origin. Which I consider pretty healthy position.

</comment></comment></comment><comment><USER11> Sudbury Ontario is farther south and has a warmer climate. However, it is of a similar size, fairly isolated, and has severe environmental problems due to a history of nickel mining and smelting.

</comment><comment><USER12> Shame that this is yet another website that requires Javascript to simply to display some static images.

</comment><comment><USER13> Much less cyclopean than I expected!

</comment><comment><USER14> Its amazing what unfettered socialism can lead to.

<comment><USER15> Actually, it's unfettered state capitalism in this case. Stalin mandated Norilsk's development to enrich the state. Similar to the modern Chinese model. So socialism has little to nothing to do with it.</comment></comment>


IPhone 5 sales behavior on the second hand market - <AUTHOR> http://blog.movaluate.com/2012/11/05/iphone-5-sales-behavior-on-the-second-hand-market/ <comment><AUTHOR> The iPhone 5's sales behavior on the second-hand market through the month of October. After analyzing about 100,000 transactions, we found that:

· AT&T's iPhone 5 is by far the most popular variant · Sprint was the least popular and had the highest depreciation · White versions tended to be more expensive · Storage value is depreciates significantly, especially with the 32GB models.

All of our findings can be found on our blog post at [http://blog.movaluate.com/2012/11/05/iphone-5-sales- behavior...](http://blog.movaluate.com/2012/11/05/iphone-5-sales-behavior-on- the-second-hand-market/)

* The price reports are generated using data from completed transactions on eBay and other online merchant sites.</comment>


Ask HN: How do you learn web design? - <AUTHOR>

I'm constantly amazed with graphically stunning new websites that pop up every day on HN. I'd love to learn the process required to get better at web design from someone who's been there.<p>I know HTML and Photoshop inside out but beautiful designs still elude me. Are there any good books, tutorials, or articles I should get my hands on? <comment><USER2> W3school.com is great of beginners. Youtube is a great way to see development in action, it really comes together that way. Blogs, I like blogs because you get the lastest of everything. All you have to do is check the date of the blog. Find people that you like and follow their blog. Finally, friends, if you can make friends with a descent developer that you can call when you get stuck that's the best resource you can have to becoming a good web developer.

Oh and dont forget firebug. Firebug is a tool that allows you to look at the html, css, and javascript layout of most sites. So if you see a site that you like and you wonder how they did it. Click the firebug button and it opens up the layout of the site. Then you can look and learn how they did it. Just firebug and download it. You can miss it.

I turn to books more as like a dictionary then anything else. Usually, you can find what you need online for free. Stackoverflow is a good site too.

</comment><comment><USER3>
      Copy Websites.

      Copy Layouts.

      Copy Pallets/Colors.

      Copy Design.

      Copy Grids.

      Copy Styles.

      Copy Spacing.

      Copy Typography.

Slowly learn to replace "copy" with "get inspirations from".</comment>


Chronic Buckyball Administration Doubles Rat Lifespan - <AUTHOR> http://extremelongevity.net/2012/04/16/chronic-buckyball-administration-doubles-rat-lifespan/

<comment><USER3> Article: [http://extremelongevity.net/wp- content/uploads/C60-Fullerene...](http://extremelongevity.net/wp- content/uploads/C60-Fullerene.pdf)

The part getting the attention has to do with longevity; for that part of the article, data comes from "[t]hree groups of 6 rats".

This was a single experiment in which n=6 rats received the C60 ('buckyball') composition, n=6 received just the oil, and n=6 received water (which can cause adverse effects in rats). Interestingly, a protective effect of oil gavage in some rat strains has apparently been observed before ( <http://www.ncbi.nlm.nih.gov/pubmed/3591539> ) but that's a bit of a distraction since the focus is on the C60.

All treatment stopped after a few months when the first control rat died. Given that the half life is 14h for peritoneal injection of this particular substance, there should have been nothing left of it after ~70h. How it continued to affect rat lifespan for several months afterward would require explanation.

<comment><USER4> Could be that it's a fluke given the small groups involved.

<comment><USER5> Not likely, since statistical tests were performed to ensure that the results seen were not due to random chance. The sample size they used is actually pretty large for studies like this.

However, the study is complicated since rats are sensitive to abdominal gavages and it tends to reduce their lifespan. Similarly, there are studies that show chronic administration of olive oil increases life span.

So you have a situation where one control (water only) leads to decreased lifespan and another control (vehicle - olive oil only) tends to increase lifespan. Neither of these are ideal controls since they are known to affect the rat.

That said, they did fancy stats and presumably accounted for this fact.

<comment><USER6> Those tests for statistical significance aren't very strong in this case. It might be that the study in question only had a 5% chance of giving this result by chance, but given that this particular study was selected to our attention for news-worthiness the actual chance of it being a valid result are far less than 95%[1]. Also, a sizeable minority of published papers have statistical errors, even in good journals[2].

[1]<http://xkcd.com/882/> [2]<http://www.economist.com/node/2724226>

<comment><USER7> You are right in general, but the study in question actually claims 99.9% significance, not 95%. That's pretty strong.

<comment><USER6> Ah, thank you for pointing that out. It changes things quite a bit.

</comment></comment></comment></comment></comment></comment><comment><USER8> I find myself a little sceptical of articles on a website called "extreme longevity", to be honest...

... also, skimming the linked paper, the largest sample I see is "sixty rats randomly divided into 10 groups of 6 rats". I'm not sure if that's really large enough to draw any solid conclusions, and I don't see any P-values for the lifespan data -- but I freely admit I'm neither any kind of biologist nor a stats expert, so I may be talking rubbish.

<comment><USER5> Well, it was published in a real journal (Biomaterials) with an impact factor of 7.882. So the research is theoretically peer-reviewed and solid, in that the paper itself isn't just making things up.

</comment></comment><comment><USER9> So what might be going on here?

[http://www.fightaging.org/archives/2012/04/a-puzzling- fuller...](http://www.fightaging.org/archives/2012/04/a-puzzling-fullerene- study.php)

The average life span of the Wistar rats used is 2-3 years (24 - 36 months). This was a small study size, but that's no so important in determining whether you have an actual means of life extension if you can show that any of your study group lived much longer than usual - but it is important when it comes to the degree of life extension. If the study group is small, as it is here, using only a handful of rats, then the size of the effect can be much more readily distorted by chance. This line in the paper jumped out at me: "Before C60 administration, the rats were fasted overnight but with access to water." If they failed to fast the control group, then we're looking at yet another study that failed to control for calorie restriction, and this is actually largely an intermittent fasting study - which has certainly been shown to extend life in rats.

This would explain how the olive oil administration also apparently extended life significantly...

<comment><USER7> This is not it. Fasting was done for pharmacokinetics study, not for chronic toxicity study. That two studies were separate is evident from the description, e.g. rats were acclimated for 7 days for pharmacokinetics study and 14 days for chronic toxicity study.

<comment><USER9> That is also a plausible reading of the paper. It doesn't look like they go into any great detail as to the protocol for administration in the longer term study.

I'm skeptical of significant antioxidant effects in vivo from a naturally occurring compound given that antioxidants in general haven't done much for longevity without being heavily designed substances (like SkQ1, for example). Simply flooding the body with antioxidants is usually slightly worse for longevity or a null effect - they don't get to the mitochondria where they might do some good.

More information from the authors would be good. All things considered, I'm sure we'll be hearing more on this in the years ahead; people will try to replicate it, the researchers will be grilled on their work, etc.

</comment></comment></comment><comment><USER10> Be careful when looking at lifespan studies. A huge increase in lifespan vs. control does not mean much if the control is badly treated and short-lived compared to max lifespan for that rat strain. Some rats normally live to 42 months. The C60 could be making up for bad conditions without extending max lifespan. If so, many compounds have been shown to do this. This exact scenario was the cause of the resveratrol craze.

</comment><comment><USER6> Well, given the title I was expecting to be snorting dismissively, but this actually does seem interesting and I hope there's followup work. In particular, the fact that this was a group investigating C60 toxicity makes me less immediately suspicious of fudging, but then again if their funding were coming from someone making something with C60 in it they might have subconsciously treated the C60 rats better.

What I'd really like to see is a duplication with a larger sample size and some sort of blind setup with the people caring for the rats. And even then, there are good reasons to expect that this won't carry over to humans, given that humans already live so long for an animal of our body size.

</comment><comment><USER11> Interesting -- there are plenty of articles on fullerene administration to rats over the past 10 years [1], but no mention of longevity effects.

[1]: [http://scholar.google.com/scholar?hl=en&q=fullerene+rats](http://scholar.google.com/scholar?hl=en&q=fullerene+rats)

<comment><USER12> I just took a look myself and it turns out that there is evidence: <http://www.ncbi.nlm.nih.gov/pubmed/17079053>.

The thing is, you can't patent fullerene so it will never ever make a great deal of money as a supplemental treatment, and so likely won't get that much attention.

</comment></comment><comment><USER13> Just discovered that google can convert long series of units.

Say you wanted to do this, at the obvious risk of some undiscovered toxicity, and say you weigh 200lbs.

At a cost of fullerene-c60 of $592 for 5 grams, at 1.7mg/kg, you're daily dose costs $18.26 [http://www.google.com/?q=1.7mg%2Fkg+x+200lbs+x+592%2F5+dolla...](http://www.google.com/?q=1.7mg%2Fkg+x+200lbs+x+592%2F5+dollars%2Fg&oq=1.7mg%2Fkg+x+200lbs+x+592%2F5+dollars%2Fg)

Even worse, however, is the olive oil you have to eat each day, with the C60 disolved into it is 39 teaspoons! [http://www.google.com/?q=1.7+mg/kg+/+0.8+mg/ml+x+200+lbs+to+...](http://www.google.com/?q=1.7+mg/kg+/+0.8+mg/ml+x+200+lbs+to+tsp&pf=p&sclient=psy- ab&oq=1.7+mg/kg+/+0.8+mg/ml+x+200+lbs+to+tsp)

Which is 4/5ths of a cup of oil per day.

EDIT: I guess they didn't actually get a daily dose.

        we treated the rats daily only during 7 days and weekly
        during the first two months, then every two weeks until
        one control rat died.

Nor did they get dosed their entire lives, as earlier in the paper, we find that

        After five months of treatment (M15) one rat treated with
        water only exhibited some palpable tumours in the
        abdomen region. Due to the rapid development of tumours
        (about 4 cm of diameter) this rat died at M17. As rats
        are known to be sensitive to gavages, we decided to stop
        the treatment for all rats and to observe their
        behaviour and overall survival.

So, it looks like they only treated for 7 months, for the most part, once every two weeks, and then no further treatment. The treated rats, after only 7 months of treatment, achieved the benefit.

<comment><USER14> Human dosing is different than animal dosing. It doesn't translate straight mg/kg.

</comment></comment><comment> Tim-Boss Obviously not everything studied in Rat models scales well or is even effective at all in Humans, but the potential applications of this will surely raise a few eyebrows!

Interesting to note a daily diet of olive oil increased their average lifespan by 4 months alone! The Omega-3 fatty acids in it at a guess... but I wonder what the exact methods of action are for C60!

<comment><USER15> If nothing else, I'm sure the thought of extending the life of their favourite pet would make a few rat owners happy!

</comment></comment><comment><USER16> "Buckminsterfullerene" is named after Buckminster Fuller, who popularized geodesic domes. He had a word commissioned for him, "Dymaxion", and he used it for lots of his projects: Dymaxion Map <https://en.wikipedia.org/wiki/Dymaxion_map>, Dymaxion House <https://en.wikipedia.org/wiki/Dymaxion_house>, Dymaxion Car <https://en.wikipedia.org/wiki/Dymaxion_Car> .

</comment><comment><USER4> This doubles median lifespan, not absolute lifespan, it's still impressive but would be much more so if it was doubling max lifespan.

edit: Checked the data, interestingly there's a fairly wide range of death in the non-buckyball population (more than 1 year) but the buckyball population all died within 3 months, oddly enough none of the groups overlap, the data looks almost perfect. Will be interesting to see what the results are with more subjects.

Full Study: [http://extremelongevity.net/wp- content/uploads/C60-Fullerene...](http://extremelongevity.net/wp- content/uploads/C60-Fullerene.pdf)

<comment><USER17> The median is more robust than the average, and the average that is more robust than the maximal or minimal.

* One strange case/rat can modify the maximal or minimal a lot (For example, some kill a rat with a gun or you are "lucky" and get a Methuselah rat.)

* A strange event also can modify the average a lot (If someone kill a rat immediately at the beginning of the experiment, the "new" average is approximately (n-1)/n times the "original" average.

* But some unusual problem doesn't modify the median too much. The median changes from the value of a rat to the value of the next/former rat, which is usually very close. But it doesn't matter how small or big the strange case is, the median is essentially fixed between two values, so it is difficult to modify too much.

The real problem is that 6 is a small number and it is difficult to get good statistical result with only 6 cases.

<comment><USER7> The study is not using median, it is using EML(estimated median lifespan), which is calculated by Kaplan-Meier estimator. This actually seems to be standard in lifespan studies.

<http://en.wikipedia.org/wiki/Kaplan-Meier_estimator>

</comment></comment></comment><comment><USER18> When I read headline I thought of those buckyball desk toys. I thought playing with them would help me live longer.

</comment><comment><USER19> Choose a random compound X, feed it to rats and see what happens. Could somebody explain how does one choose X?

<comment><USER20> Most likely "anyway that is able to obtain grant money."

</comment></comment><comment><USER21> Have they done this experiment with any other configurations of carbon?

</comment><comment><USER22> But how much of that effect is explained by the olive oil?

<comment><USER23> They had a plain olive oil control that increased the lifespan from 22 to 26 months, compared to 42 with the C60 + oil.

<comment><USER24> but, it also sez the following : "They also demonstrated that the compound is fully absorbed via the GI tract and totally eliminated from the body in 10 hours." so, not sure what _causes_ the increase in life-span. although, the cryptic "attenuation of age-associated increases in oxidative stress" does hint at _something_ , probably the _effect_ that this combo causes as it is moving through the GI tract ?

<comment><USER25> "qwe sdawrqre sdzaamik3432 mkl" -> that's cryptic.

This is not, it's simply a bit vague. If it attenuates age-associated increases in oxidative stress then it probably has an anti-oxidant effect. Alternatively, it affects the systems responsible age-related oxidation - <USER2> other words, an indirect anti-oxidant action.

</comment></comment></comment></comment><comment><USER26> at the risk of sounding strange, is this or anything similar available to buy anywhere?

<comment><USER27> I wonder if this is found in any foods?

<comment><USER6> Normal ash does contain some C60, but only in small quantities compared to the amount of horrible stuff-that-will-kill-you present.</comment></comment></comment>


Project Management for PhDs - <AUTHOR> https://rachitnigam.com/post/project-management/ <comment><USER2> The title of this article should rather be "How I approach project management as a PhD student in a computer science research group". In my experience, there is no silver bullet for PhD projects. It really depends on the field, the advisor and the student.

<comment><USER3> My strategy was to have a kid. Really lights a fire under you and motivates you to finish before you rapidly go broke.

<comment><USER4> Do they have deadlines in the US?

I've heard about US PhD students going on for seven years, ten years, fourteen years, and so on.

In the UK I had to submit before four years. If I didn't do that I literally just failed the degree.

I worked twenty-hour days for about a month at the end and then submitted with one day to go. Not even exaggerating.

<comment><USER5> Brian May, started 1970, submitted 2007. [https://ewikipedia.org/wiki/Brian_May#Scientific_career](https://ewikipedia.org/wiki/Brian_May#Scientific_career)

They may have made an exception.

<comment><USER6> The hard time limit on UK PhDs is a recent-ish thing, which started coming in around 2010ish from memory (as is usual with such things, there was a fairly long phase-in, which messes with my memory). Broadly speaking, anyone who started in the old system could still carry on for as long as they wanted.

[It's also possible to "suspend regulations" \-- which is University speak for "something happened which the rules don't deal with sensibly" \-- and extend a PhD's length, though this is generally accompanied by weeping and gnashing of teeth by administrators. It's much harder to do than it used to be.]

</comment></comment></comment></comment></comment><comment><USER7> This is really helpful article, and I think the concrete questions they lay out are ones all PhDs should answer explicitly when starting a new project.

That said, I think the biggest risk to PhD research is not just project, but product management. That is, many PhDs will set up meetings, TODOs, and communication channels, but they won't explicate...

* why the project is being done

* an ordered list of desired outcomes

* acceptance criteria

* who they'll communicate with, how, and how often

* some kind of list of risks

Not locking down acceptance criteria with an adviser is, IMO, the biggest thing that keeps people from graduating (and is generally what a dissertation proposal is for).

<comment><AUTHOR> Author here. Acceptance criteria are hard to lock down, especially in new projects. The whole point of research is to explore domains and to expect a lot of dead ends.

I'm unsure what a concrete acceptance criteria will look like given that we want to encourage researchers to explore.

<comment><USER2> Acceptance criteria in the CS department of my alma mater is on a scale of 3-4 peer peer-reviewed papers, accepted in some journals. I would also be careful about what the point of research might be. The most important purpose of a PhD student is to produce a thesis in a foreseeable future, to qualify himself for scientific work. The success of the thesis depends on the advisor(s), and later the department and the reviewers. Thus, it's important to choose a topic, which is NOT an ultimate dead end. Even if your topic leads to a successful thesis, it might be a dead end later on. Because your advisor has no network, or because nobody is interested in your results etc. And even if you can continue with research, you are rather occupied with fund raising, networking and marketing. If I had to do a PhD again, I would try to figure out as fast as possible what is expected to do in the specific configuration I'm in, and then try to minimize all obstacles and distractions which might be in the way (teaching, assistance for the prof, fund raising, conferences etc). After that, if your're are lucky, you have 1-2 years left to write down your stuff.

</comment></comment></comment><comment><USER8> I think PhD project management should explicitly tie everything back to the actual research goals, so that effort can be justified / prioritised against these.

Source: I didn't achieve a PhD (I bailed early with an M.Phil) because our group project devolved into a poorly structured software development that contained numerous software rabbit holes. Once we'd gone down these, we never converged on a useful research output, as opposed to a massive codebase. That said, with the tools described here, our codebase would have been cleaner.

</comment><comment><USER9> This says "for PhDs" but then I found that it's more geared at PhD students working in research groups. A different type of PhD is the tenured professor who has to deal with a large number of projects at the same time. There's research, but there's also teaching, service projects, reviewing/editing, students asking for letters, and dozens of other things. At that scale, it's tough, and I still haven't found a complete solution. I use Todoist, email, Basecamp, version control (Fossil) and a few open source apps/apps I've written myself. I spend about 60 minutes on project management each day - that's organizing projects, not working on them.

<comment><USER10> And it's not just research, but several different research projects in various stages. I would feel lucky (but also a bit panicky) if I had just one research project to worry about at a time. It's extremely hard to stay organized and focused at the same time.

</comment></comment><comment><USER11> My school required 16 credits to graduate with a PhD. Also, MS and of course, PhD theses. I worked on an MS in dataflow distributed system security for 1 year before my advisor bailed out on the topic. No credits for thesis work, 2.5 classes per term for 3 years. 3 accepted journal papers is the standard graduation yardstick. Under these circumstances it was impossible to finish in 4.5 years (brilliant + lucky) or 5 years (very smart) I guess I made the mistake of sleeping (6.5yrs). My dad did it in 3 years but he went to a #1 school that wasn't insecure (Princeton, math) so not so many damned courses.

</comment><comment><USER12> > Chat apps, on the other hand, make it really quick and easy to communicate > with the team but are usually bad at maintaining separate threads of > conversations cleanly.

I disagree with the author. Most modern chat applications like Slack, Microsoft Teams, Skype etc allow separate threads of conversation cleanly.

IMO email is the worst platform for having conversations about a project.

<comment><AUTHOR> Author here. I do recognize that slack has thread by that doesn't make it easy to refer to an exact thread like email does.

I'm looking for something like a "named thread" which the Twist Chat app has, but is unfortunately not the preferred means of communication in my group.

</comment></comment><comment><USER13> Hire a project manager for your lab.

<comment><USER4> I think a big part of doing a PhD is managing your own research.

<comment><USER13> Yeah, since the article specifically is titled project management not research, I assumed this was about project management for people who already have their PhD, i.e. are working as faculty or in a research lab. And in that environment, there are definitely project managers employed. Managing your own research is one thing -- managing projects, grant applications, dealing with institutional and funding agency paperwork are all things that most PhDs would absolutely flounder at.

Should have read more closely.</comment></comment></comment>


New e-mail verify growth hack - <AUTHOR> http://hiandrewgale.com/e-mail-verify-growth-hack/

<comment><USER2> Or, I am a user who clicks the first link no matter what so long as it doesn't look like the link to say "I didn't request this"</comment>


HTML5 canvas globalCompositeOperation demo - <AUTHOR> http://beej.us/blog/2010/11/html5-canvas-and-globalcompositeoperation/

<comment><USER2> This appears to be the same guy who wrote that ancient "socket programming in C" tutorial that every aspiring "I want to make a multiplayer game" programmer has read in college.</comment>


Ask HN: Best security practices for startups - <AUTHOR> Hi,
My partner and I plan to launch a healthcare-related web app in the coming months. We'll be hosting on AWS, with the database on an encrypted EBS volume, all conncetions over HTTPS and we should have two-factor authentication by SMS. We're mostly using the MEAN stack.
I'm not technical, so I'd appreciate some guidance on best security practices that are relevant and feasible for a startup. I doubt we'll have anything financially useful to steal, but my main concern is avoiding leaks of private patient data, of which we might store a limited amount.
1. Is there a checklist/best practices guide somewhere? I'd like to avoid making obvious mistakes that would be embarassing in retrospect, though I know it's hard to defend against someone skilled and determined.
2. Any experience with hiring a firm (like Matasano) for penetrating testing? Rough estimate of cost? When is the right time to consider this?
3. How and when to start a bug bounty program? Is there a standard way to determine severity and payouts?
Thank you! <comment><USER2> FWIW - even inside a VPC on AWS traffic isn't encrypted by default so if you're dealing with PHI traffic between servers also needs to be encrypted. Many databases support this out of the box, but if you're using something like redis you either need to use ipsec or stunnel. Google's Compute Engine platform does support encrypted network traffic so that' s nice plus (we're multi-cloud so we're currently using stunnel and moving to ipsec).

Lock out the root AWS keys as much as you can (ours requires a MFA token that's stored in a safe) and only use IAM users with restricted permissions for day to day operations.

Everything should have an audit trail, preferable with all the logs shipped off the servers to a centralized store (that way if a server is compromised the attacker can't also edit/delete the logs)

Script all your boxes through config management so that you can handle updates/security patches in a uniform manner and quickly.

Restrict who has access to root/DB in production. When you grant access keep an audit trail of why they have access and revoke it if it's no longer necessary. Have a good development environment setup so people don't develop the habit of developing against production.

Pentest + bug bounties are good. Once you get to a certain point you'll probably also need to have a general security/HIPAA audit as well.

<comment><AUTHOR> Great advice, thank you- will make a note of these things for when we start deploying. At the moment, I think we will only need one EC2 instance attached to an encrypted EBS volume with the database on it. We're not using RDS. When you say encrypt PHI traffic between servers, you mean like EC2<\-->S3?

<comment><USER2> EC2 <-> S3 yes (this should be easy as S3 has ssl support out of the box). The bigger issue is stuff like redis (which purposefully doesn't support encryption) which means you either need to be careful not to put PHI in redis (e.g., use object IDs rather than the object themselves, don't cache things that might have PHI) or use something like stunnel (which doesn't play lovely with redis), ipsec, or use GCE.

I'd recommend encrypting from the boot volume up and not just your EBS volumes. Otherwise you have to worry about things like PHI in logs, core dumps, etc. being put onto unencrypted storage.

</comment></comment></comment><comment><USER3> It's hard maintaining great security because, security and speed are usually in direct opposition.

In terms of hardware/OS: Turn off everything incoming except for HTTPS, SSH, and ping (optional). Make sure everyone uses SSH keys (no passwords)

In terms of programming, focus on security roles is tricky at first. So you want to be careful in describing how user roles or user permissions work in your site.

Create a staging server with test data that mimics your production site (nearly exactly). Any penetration company company will ask you to sign a "This won't hurt anything", when smashing up your server.

Another place to focus is how backups are copied, who can access the data, etc..

This is a really big topic. Your insurance company when you apply will have an excellent check list.

<comment><USER4> > Turn off everything incoming except for HTTPS, SSH, and ping (optional).

OP mentioned using AWS, in which case Amazon's built-in "Security Groups" feature can be used for restricting access to the instance by port or possibly by protocol. Naturally, however, one would not want any dangerous outbound traffic, such as unencrypted/unauthenticated automatic updates, so there also is merit in controlling which services and programs are running.

</comment></comment><comment><USER5> Sithu,

Here are a couple of resources that I tend to hand out to startups that we do work for at Matasano. No charge :-)

Not trying to be a salesperson, but I feel like most startups get more value out of sitting down with a security consultant for a couple days and talking about architecture and dev processes then they do getting a full penetration test. Like the presentations say, the big risk in the early days is lack of interest, not security. I feel like a startup's big security concern it doing something that's going to make them have to rewrite _everything_ later on.

[http://chris.improbable.org/2009/9/24/indie-software- securit...](http://chris.improbable.org/2009/9/24/indie-software- security-a-~12-step-program/) (old presentation from tqbf. We might one day put it back on our blog. Don't hold your breath. Anyway, the slides and presentation aren's great IMO, but the blog post is!)

[http://firstround.com/review/Evernotes-CTO-on-Your- Biggest-S...](http://firstround.com/review/Evernotes-CTO-on-Your-Biggest- Security-Worries-From-Three-Employees-to-300/)

</comment><comment><USER6> I'm not too familiar with the field, but I'd also assess whether or not the data you're acquiring needs to be encrypted/handled in a certain way due to HIPAA-related compliance. That's potentially the most relevant worry you should have if your developer(s) are decent enough.

<comment><AUTHOR> HIPAA is surprisingly vague about the minimum standards for compliance, calling encryption "addressable" instead of "required"[1]. I believe this goes for both data in transit(HTTPS), and data at rest. I've seen some say that HTTPS is required but I can't find this on the gov site. My understanding is that if you choose not to encrypt, the burden of proof is on you should anything bad happen, to prove that implementing it was not "reasonable and appropriate". Since I can't think of any circumstances where sending plain text patient info over the internet is reasonable, i'll choose to encrypt. The other things for HIPAA compliance are complete audit logging so you can see who has accessed anything, and training of staff who have access to protected health info.

Most HIPAA recommendations seem to be a good idea to do anyway.

[1] [http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2001.h...](http://www.hhs.gov/ocr/privacy/hipaa/faq/securityrule/2001.html)

<comment><USER7> Hire someone who has done HIPAA before.

</comment></comment></comment><comment><USER8> Checkout aptible [[https://www.aptible.com/]-](https://www.aptible.com/\]-) they do hippa compliance as a service.

</comment><comment><USER9> Hey Sithu, my name is Dylan. I work at Accuvant, a security firm like Matasano. We work with a lot of the top tech companies and Fortune 500.

I sent you an email, and I'd be happy to answer any of your questions or help you out (no charge). Down the line, if you decide you'd like to explore a security audit, we can help with that too.

For now, I'll answer your questions:

1\. I wrote a basic checklist for startups looking to improve their security. You can find it here: [http://breakingbits.net/2015/02/28/security-for- startups/](http://breakingbits.net/2015/02/28/security-for-startups/). It's not comprehensive, but I tried to cover the most common issues I saw with startups. Ryan McGeehan also wrote a wonderful checklist for incident response after something _does_ happen. They're two sides of the same coin - preparation and damage control. Check that out here: [https://medium.com/@magoo/security- breach-101-b0f7897c027c](https://medium.com/@magoo/security- breach-101-b0f7897c027c). Your specific company will have more to do for each of these based on the context of your team, product and size.

2\. It's difficult to give a good estimate of cost, and I'm not trying to be a salesman here. It depends on length and scope of work. Are we doing code review or just blackbox testing? Five days or 10? The entire application attach surface or just a few critical pieces of functionality? Budget about $10,000 for a white label pen test lasting a week, but it could be more or less. I'm summoning 'tptacek here in the hopes he might have more nuance to contribute to this answer.

3\. How and when to begin a bug bounty program is similarly variable. I have a lot of experience working with Series A companies, and bug bounties are a personal specialty of mine (I have research directly on the subject). In my opinion, you should not have bug bounties until you have at least one full time security engineer. You don't want to pay out a bounty for someone reporting that your cookies lack an HttpOnly flag. On the other hand, server- side request forgery usually warrants a payment. If you have developers who could tell you the difference in those two in terms of both definition and severity without looking it up, you're okay to have a bug bounty. If not, don't pay people for their reports just yet. (This is personal philosophy from my experience - many people will have different opinions).

On the other hand, _always_ have a responsible disclosure program. It is perfectly okay to not reward people for reporting security vulnerabilities. I'll repeat this: _it is perfectly reasonable to not give out payments for reports._ Don't let financial rewards enter the program until you have reached a certain level of internal security maturity.

And no, there is no standard way to determine severity and payments. Google and Facebook pay a lot for bugs that some companies wouldn't even accept. It totally depends. That said, as a general guideline, if a reported bug 1. is valid, 2. compromises users, it's worth something.

Like I said, I sent you an email. Let me know if you have any questions, I'd be happy to help you with anything you need to know.

<comment><AUTHOR> Thanks for your reply! Very helpful. Got your email, and will be reaching out to you.</comment></comment>


Start A Design Firm? A How to Guide By Forrst Users - <AUTHOR> http://udiudi.com/2010/12/12/start-a-design-firm/

<comment><USER2> "Create a document explaining why bakeries need websites". Jeez, that's just really bad advice.

If you start a new design firm (and particularly if you're inexperienced), you need to go where the money and the work is already, not try to create new markets.

<comment><USER3> Though it's not a great example, I think the assumption is that bakeries ARE an existing market for web design. Replace by "car sales" if it makes more sense to you. In my opinion there is something to getting to know specific small business markets and going after them with tailored info. Verticalising your offer if you like.

Then again, even bakeries can be fun. This UK design agency actually built a piece of countertop hardware for a bakery which, by the press of a button, would tweet that fresh bagels are ready.

<comment><USER2> Sure, niche is good. But if you want to start a new design firm, this is just not very good advice. I would say that 99% of new design firms that succeed go where the work is, not try to convince a bakery they need a 100$ website.

<comment><USER3> While I'm at it, here's that bakery tweet thing: [http://www.eatmedaily.com/2009/04/baker-tweet-service- alerts...](http://www.eatmedaily.com/2009/04/baker-tweet-service-alerts-you- to-whats-fresh-from-the-bakery/)

Maybe there's more to that niche than we're giving it credit for.

</comment></comment></comment></comment><comment><USER4> My advice would be to work for a design firm FIRST, and once you grow out of it, go on your own. It takes years to build relationships with clients and accounts people who will authorize $100k projects to you. Going door to door is a waste of your time and talent and not the best way to approach building business, unless you're starting from scratch, in which case, I reiterate working at a design firm first.

Also, don't fool yourself. "Design firm" is just a sexy and sophisticated title. What you're really doing is research 80% of the time and execution 20%.

<comment><USER5> I worked this way since I was 15 years old, and The first time I worked for a design firm was at 18.

I truly believe there is no need to work for a design firm before starting on your own. There is no good reason for that. I made more money when I worked by myself than working for a "sexy design firm".

</comment></comment><comment><USER6> > Do more then promised

Tip number 1: Proofread your *&^% copy!

<comment><USER5> English isn't my native. Sorry if you had hard time to understand my writing.

<comment><USER6> Fair enough. And I was just waking up, and probably -- certainly -- a bit curt. But... I hesitate when I see grammatical mistakes, whatever the site design may be.

There is a subset of sites/designs that put great emphasis into a graphical appearance, but do not write well.

In this specific case, you want to use "than" rather than "then". "Than" is a comparison. "Then" denotes a sequence or position in time. :-)

P.S. I guess I should add that "native" does not work here as a noun. In the context you are using, it would be an adjective -- a modifier. "English isn't my native language." That would work.

"Native" as a noun is used to identify an indigenous person. I believe this latter use is mostly considered a bit dated or "politically incorrect", these days, as it has historically often expressed or implied a hierarchical relationship and a negative judgment of the indigenous culture.

<comment><USER5> Wow.. thank you for the English lesson! I'll take your corrections into account next time I'm writing something :)</comment></comment></comment></comment>


Giant python powered robots. - <AUTHOR> http://entitycrisis.blogspot.com/2009/01/giant-python-powered-robots.html

<comment><AUTHOR> pygame ( <http://pygame.org/> ) was also used for a control interface.

I wish I could control giant robots.</comment>


Ask a Hostage Negotiator: What's the Best Way to Get a Raise? - <AUTHOR> http://www.theatlantic.com/business/archive/2015/04/ask-a-hostage-negotiator-whats-the-best-way-to-talk-about-a-raise/391943/?utm_source=atlfb&single_page=true <comment><USER2> Do what Dennis hoppers character did in speed!</comment>


Ask HN: How do you get paid for the design / requirements phase? - <AUTHOR> I'm curious how other software developers or teams handle the uncertainties of scope at the beginning of a new project. I end up doing a lot of "free consulting" helping clients define exactly what it is they want before signing a contract with a solid estimate.<p>What is your strategy - separate consulting contract, build a consulting phase into the contract, other ideas? <comment><USER2> It's not unusual to have a "discovery" phase in a contract. Since usually you won't know the scope of work well enough before the discovery phase, it's also not out of the ordinary to wait until discovery is complete to add the statement of work and dollar amounts to the main contract - or to have separate discovery and implementation contracts. Note that the latter allows the client to take the work done in discovery and hire someone else to implement; but at least you get paid for the work done on discovery.</comment>


Rump: Hot-sync two Redis databases using dumps - <AUTHOR> https://www.stickermule.com/blog/introducing-rump <comment><USER2> So this gets a list of keys from the server A via the SCAN command, gets their value via DUMP, and sequentially runs RESTORE on server B to load the value?

If so then there's zero transactional consistency between the keys themselves. If each key is independent then that's not really an issue, but if you have multiple keys that make sense only in context of each other, it'd be possible to get values for each that corresponding to different moments in time (each reflecting when the DUMP command was invoked for that particular key).

I get that this is meant to work around limitations in AWS's Redis offering (namely the lack of BGSAVE, direct access to RDB, or SLAVEOF) but I'd suggesting highlighting that inconsistency at the top of the docs.

</comment><comment><USER3> This is one of those cases where I wonder what the benefits are of Amazon vs running your own instance and just using the commands the way they were intended (by Redis in this case). The Amazon version of Elasticsearch has similar disadvantages with some blocked commands (understandably for security reasons).

<comment><USER4> As someone who runs our own instances, these limitations seem very insane. what if the redis server goes down? That means there's no failover whatsoever?

It also seems like such a waste of open source work just to overcome a proprietary, third party limitation.

<comment><USER5> I believe elasticache has its own internal HA. Your client must disconnect and reconnect if the Redis suddenly becomes read-only (due to a failover).

[https://github.com/mperham/sidekiq/blob/master/lib/sidekiq.r...](https://github.com/mperham/sidekiq/blob/master/lib/sidekiq.rb#L97)

<comment><USER4> so its manual failover and you cant use redis sentinel?

<comment><USER5> If the master fails, your app gets a READONLY error due to the failover, you disconnect and reconnect the connection. Their network magic ensures you get the new master.

<comment><USER6> > Their network magic ensures you get the new master.

DNS with a very short TTL.

</comment></comment></comment></comment></comment></comment><comment><USER7> Elasticache disabling SLAVEOF is the main reason why I don't use it in production.</comment>


Ask HN: Any examples of shadow-testing in production environments? - <AUTHOR>

Lately I've been curious about shadow-testing code in production, by which I mean if I have a v1 build in production, I'm interested in capturing and replaying api calls on a v2 build in production on a box taken out of rotation from being discovered by load balancers. This could be enabled by having a proxy that "re-dispatches" the request to the v2 build after getting the v1 build response and essentially diffing the results. One of the limitations that comes to mind is that this may not work for non-idempotent api calls (ex: making a payment) but for the rest, it seems like a valuable addition to a CI pipeline to effectively test your code in production in a safe controlled way.<p>Have any HNers here use such an approach in their work? Any words of advice/caution that I should be aware of before investing some time into building something like this out? <comment><USER2> Our proxy may simplify the capture for you: [https://www.runscope.com/docs/debugging](https://www.runscope.com/docs/debugging)

You can then access the data via API or edit and retry from the web interface.</comment>


The importance of honoring pro-rata agreements - <AUTHOR> http://www.aaronkharris.com/the-importance-of-honoring-pro-rata-agreements <comment><USER2> I've seen this a couple times where the onus is mostly on the later-stage investors. They know the terms, and they know exactly what they need to say to lock out the earlier stage investors and take over a bigger portion of the round, so they start pushing levers to see what they can get to move, playing on the FUD of the founders that they might not be able to raise from somewhere else.

What a terrible place to be put in as a company: A big opportunity you're incredibly excited about, but contingent on you screwing over the people who have helped get you to where you are in a small way.

I would encourage any founders who are put in this type of scenario to fight back _hard_. Investors that are worth their while will respect your loyalty and your refusal to go back on your word. If I were a later-stage investor who proposed something like that and the company came back strong saying, "That's not even on the table, because we're not going to do something below the belt" I would gain additional respect for that company.

<comment><USER3> I'm not sure this is such a terrible place for founders to be put in. It's pretty straightforward, as ethical dilemmas go. "Excitement" comes nowhere close to justifying breaking your word.

<comment><USER4> I wonder how straightforward an ethical dilema it is. When signing a contract, are you ethically obligated to follow the terms of the contract, or are you merely agreeing to something which can be enforced by the terms of the contract, including penalties and lawsuits. Most people do business in the latter way: a contract is only as good as the "teeth" that make it unprofitable to violate it.

<comment><USER3> You are ethically obligated to follow the terms of a contract that you carefully and deliberately sign.

How could it be otherwise? Virtually nobody is in a position to casually and efficiently use the courts to enforce contract terms.

A contract documents a promise. Promises must be kept.

</comment></comment></comment></comment><comment><USER5> I am currently on the other side of the table. I have a startup that is doing well in traffic, but running out of money quickly. I want to sell the company, and I have several buyers, but my investors who have common stock are threatening to kill any deal I bring unless they get above and beyond their pro-rata shares.

At least the investors in this article have the option of not signing whatever paperwork the new investors push on them. Much harder situation for me as I risk walking away with nothing unless I give more than our investors are entitled to.

<comment><USER6> Can you share the rough deal size and investor payback? Most investors have 1x liquidation preference, and I can totally see them getting at least that, even if they didn't write it into the contract; but if they are asking for more than 3 or 4x on a short term deal, then they're just being greedy.

<comment><USER5> I would like to keep it confidential, since my investors likely read HN. Deal size was above 5 million but less than 10 million. They are pure common, no liquidation preference or anything like that. For all intents and purposes they hold the same shares and rights as myself.

They invested more than they would receive in a sale under pro-rata terms, so they would have a loss, but still a partial return on investment. You say I should honor terms not written into a contract and give them a 1x preference? Seems silly to me. If they wanted those terms, they should have negotiated it. I do not feel entitled to give them more than what they negotiated for. These guys are a professional fund and this is the name of the game.

Unfortunately, it looks like unless I cave they will just let the company die. They ultimately know that the sale means much more to me than it does to them. All the pressure is on me, to end up with 'fuck you' money. They likely do not care about the money as much as not having to write down a loss or something. If I was to give them what they want, I would walk away with close to nothing after having spent significant time working for almost no salary.

<comment><USER6> Well here is the truth of the matter: If your investors get their money back you'll probably get investors again. If your investors do not get their money back, it will be much harder to raise next time.

</comment></comment></comment></comment><comment><USER7> Pro rata is most important in the case of a down round. Your ownership really dilutes in that situation.

For what it's worth, I've definitely been asked nicely if I would consider not taking my prorata because space is needed. When things are THAT tight I am often asked to sell shares to the new investor as well.

<comment><USER8> What do you say in those situations?

<comment><USER7> I will do what the founders tell me to do. If I am making their lives more difficult then I am failing.

Sometimes they ask me to please do take the prorata for optics' sake, too.

</comment></comment></comment><comment><USER9> In some cases this could be angel investors simply not doing what's in their best financial interest, either short-term or not at all.

If one gets the reputation of always giving up one's pro-rata rights, then you might as well not have them, right?

It's interesting to consider in what circumstances consenting to surrendering their pro-rata might be rational behavior.

The surrender is financially equivalent to doing the round at a lower valuation -- as angel investors have effectively sold their pro-rata rights back to the founders, who give them to the new investors. However, compared to simply doing the lower-valuation round, this approach saves more face for the angel investors.

<comment><USER7> This is somewhere between wrong and irrelevant.

</comment></comment><comment><USER10> This behavior of the VCs towards angels is as old as the hills. They want control and will screw with anyone who stands in their way. In fact, I have long speculated that a requirement to make partner at some firms is how smooth you are when screwing over a founder or angel.

The truth is that the smaller investors don't have leverage. And so they swallow hard and sign the paperwork. I applaud YC trying to stand up for the little guy, but I fear they will be unable to fight the seduction of founders of hotshot companies by big-name big-money VCs whispering sweet nothings into their ear.

</comment><comment><USER11> Forgive me if this is a naive question, but why are pro-rata rights considered standard? It seems like it's essentially the right to dilute founders in the future to maintain your ownership. Yes you're investing early, but that's priced into the valuation. I suppose the right has value, so perhaps a lower valuation would be justified. But why do pro-rata rights always elicit this moral outrage when called into question?

<comment><USER12> You're conflating two very different sources of moral outrage. One is that, _prior_ to investors and founders memorializing their agreement on pro-rata rights in a contract, some investors feel like they're entitled to them because they're a standard term. One reason why they're standard is detailed below.

The present controversy is that _after_ investors/founders committed to pro- rata rights, later investors convinced founders to _not honor those pre- existing commitments_.

 _Yes you 're investing early, but that's priced into the valuation._

Many investors would say "If you're investing and not getting pro-rata rights, the valuation you've negotiated is not a meaningful number, because it can be retroactively renegotiated by parties who do not necessarily have to include you in that conversation. It is thus not conveniently possible to award investors with, nor desirable for investors to seek, an attractive valuation for taking on extra risk by investing early _unless_ that attractive valuation comes with pro-rata rights."

<comment><USER11> Agree, you're right on honoring the term once it's been agreed to. Lazy conflation on my part.

I'm not sure I follow how the valuation is retroactively renegotiated. Later investors can't dilute an angel unfairly without diluting the founders unfairly too. In cases where the investor dilutes the angel but issues new shares to founders, the angel can simply veto the financing, right? Or are you saying a 5MM premoney valuation with pro-rata rights would be worth vastly less without pro-rata, so much so, that it's a nonstarter?

</comment></comment></comment><comment><USER13> Would it be worthwhile to name-and-shame VCs that are pushing for this? Knowledge that some VC demands the startups they fund be willing to break their word should mean startups they fund aren't worth our trust, which should destroy a lot of their value.

</comment><comment><USER14> Why would a fund want to participate in a series A with an entrepreneur who screws their investors? Wouldn't the logical conclusion be to screw the series A investors when they go to raise a series B?

<comment><USER15> Because the series A investors have clout and standing with (and may be the same parties as) the series B investors.

</comment></comment><comment><USER16> Let us give the super angels the benefit of the doubt. They probably know that their pro-rata rights are not always enforceable and price this into the valuation. Good for them if they can keep them but they are probably at all surprised if they don't. It is a numbers game for investors.

</comment><comment><USER17> Startups are disrupting everything these days.

</comment><comment><USER18> laughing at the default variables in the spreadsheet. ludicrous the idea that you can get a 50x return by owning a 1% of a company that was seeded at a $10m valuation.

....and lets just assume a $1B exit for arguments sake! haha, this guy must be raising money for a seed fund or something.

\--

oh yeah, and the fact that prorata shares actually cost you something, you don't get them for free as Aaron seems to think.

<comment><USER7> Indeed.

I often pass on my prorata simply because it would be too expensive to keep up with, and it would mean not investing in new companies. Since that's the fun part, I am happy to do that instead.

<comment><USER19> Theoretically, you could form special purpose vehicles with the intention to exercise your rights without putting a lot of your own money in. But yeah, I am with you, on the most successful companies, valuation ends up being too high for a seed investor anyway

<comment><USER20> Maybe pro-rata would be more palatable if it was not assignable? It makes sense to me that early investors get a shot in later rounds. Whether they should be able to maintain percentages is a different topic. Without ability to assign, I suspect many might not maintain percentage anyway.</comment></comment></comment></comment>


Ask HN: How to get ideas from people - <AUTHOR>

So, we are supposed to "get out of the building", ask real people what their problems are, and find a technological solution. Easy. Except...
Concretely, how do you go about "asking people"? Let's say you have an interest in travels, do you go to a travel agency asking if they want to talk to you about their problems? You ask boring work questions to strangers at a party?
Also, what kind of questions do you ask? I tried to ask people I know the question: "so what's frustrating you at your job?". But it's often quite hard for them to point out inefficiencies. How can you facilitate the process? <comment><USER2> As someone who would actually prefer to be able to _stop_ getting ideas, I think my best advice would be to try to become the "real person" you're looking for.

Using your example, someone who is interested in travel will not necessarily _be_ a travel agent, but a person who uses travel websites (of providers, travel agents, or whoever) to plan their trips. More often than not, these sites have easily identifiable spots for improvement. Page layout, search functionality, mapping...the usuals. About as common is for these sites to also be cookie-cutter sites that are either webservice or some PHP (or whatever) package that they run themselves on a webhost.

This state of commodity makes it easy to design an entire site pretty much instantly that would be an order of magnitude easier to use, because eliminating any one frustration with using a commodity and you can take entire swaths of the marketplace. In travel it's going to be _all about_ conversion, so anything that cuts down find-and-pay time is user-friendly. I don't know how attached the inventory (destination providers, cabin landlords, etc.) gets to these sites or if they'll sign up for anything that can be explained as an improvement over the status quo, but that's easy enough to research: the next time your interest in travel takes you to a travel agent, all you have to do is wait for them to say, "Gonna take a sec, the web thingy is slow," and the conversation can flow from there. "Is it better than what you used before that?"

Furthermore, I'd bet people at (e.g.) FlyerTalk are likely to describe their frustrations with site providers in some detail, which would be another "real person" vector: go to where the customers are. If you can find people who pay money to others despite having to do it via a flawed (to the customer) solution, you might be able to find out what would constitute an improvement in _the market's_ eyes. The company/agent/provider (inventory) side of this equation is always going to be relatively dumb.

I guess I should have a second-best advice, too: Let people tell you. They will, if you're listening. Try to speak their language rather than hunting for people who can speak yours ("it's often quite hard for them to point out inefficiencies").

So anyway, as someone who gets ideas all the time, that's a little time-lapse snapshot of my thought process when loosed upon a hypothetical.</comment>


Dutch households trial using servers to heat their showers for free - <AUTHOR> https://www.theverge.com/2017/6/2/15728232/using-servers-to-heat-homes-nerdalize <comment><USER2> Look up Drain Heat Recovery, you'll love it. Power pipe and Ecodrain are examples.</comment>


Show HN: My Node.js weekend project – HN History - <AUTHOR> http://hnhistory.net

<comment><AUTHOR> Any suggestions/comments/questions are welcome :)

</comment><comment><USER2> Are these ordered by post time? I've always wanted that option on HN :)

<comment><AUTHOR> No these are simply a reflection of the top 30 links of HN captured every hour. It's pulling them from HN's rss feed.

The point here is to find something that was at the top a number of days ago.

I sometimes also find that I like a bunch of the posts on HN that I want to read at a later time, and then I don't refresh HN for a while, because I'm scared to lose those links. With HN History I don't have to :)</comment></comment>


Right Brain vs Left Brain test - <AUTHOR> http://www.news.com.au/perthnow/story/0,21598,22492511-5005375,00.html

<comment><AUTHOR> It seems like many Engineers will most likely be left-brain dominant. If you are left brain dominant are you doing anything to make your offering to the user/customer more right brained friendly, and vice versa?

Also, do you think that this should even be a factor when designing user interaction, or do you think everyone will interact with your apps pretty much the same?

Have you given any thought on how to capitalize on this right-brain, left- brain subject?

</comment><comment><USER2> FWIW: I've seen this little test before and even shared it around. And the ultimate conclusion is that it probably means absolutely nothing.</comment>


Quiztionary - <AUTHOR> http://quiztionary.com/

<comment><USER2> What bothers me is how you can find a lot of common words with many contrived definitions listed: things like _" dog: a member of the genus Canis (probably descended from the common wolf) that has been domesticated by man since prehistoric times"_, _" table: a piece of furniture having a smooth flat top that is usually supported by one or more vertical legs"_, etc. I really hope there aren't any schools making kids memorize these definitions.

My first thought was that these might be sets for English language learners, but the language used in the definitions generally uses a pretty diverse vocabulary. I doubt it's meant for beginners.

<comment><USER2> Another thing: you get lots of interesting results for names, such as [http://quiztionary.com/search?q=thomas](http://quiztionary.com/search?q=thomas)

</comment></comment><comment><AUTHOR> GitHub Repo - [https://github.com/tejasmanohar/quiztionary](https://github.com/tejasmanohar/quiztionary)

</comment><comment><AUTHOR> Crowdsourced dictionary powered by Quizlet</comment>


Nvidia RTX 2080 Ti Review - <AUTHOR> https://www.anandtech.com/show/13346/the-nvidia-geforce-rtx-2080-ti-and-2080-founders-edition-review <comment><USER2> Are there any deep learning/AI specific reviews out yet? Searching for such is complicated by the fact that these cards use a deep learning component for upsampling or something. I'm really just waiting to see price/performance ratios on deep learning training tasks, specifically with regards to FP16 and Int8.

<comment><AUTHOR> I don't think you need reviews to see that these are the cards to get for DL. We already know the performance of Titan V and 1080Ti cards. 2080Ti is a lot more cost efficient than Titan V, and 2080 is a lot faster than 1080Ti due to tensor cores.</comment></comment>


Fake? - <AUTHOR> http://www.freepatentsonline.com/8941513.html

<comment><USER2> "Fake?" is not a very descriptive title. From the guidelines:

> _Otherwise please use the original title, unless it is misleading or > linkbait._

I think this is not "fake", only "wrong" and very "misguided".

It's a common mistake to mix some anagogic parts and forget to use the counting argument to "invent" a new compression scheme. The problem is that all the legalese and the lack of a working prototype (or at least something remotely similar to a blueprint of an implementation) doesn't make obvious that this won't work.

</comment><comment><USER3> Nonsense that won't work and was written by someone with no understanding of how wireless data modulation schemes actually encode.

</comment><comment><USER4> Isn't that already done via modulation?</comment>