AMD Ryzen 9 3950X Review - <AUTHOR> https://www.anandtech.com/show/15043/the-amd-ryzen-9-3950x-review-16-cores-on-7nm-with-pcie-40 <comment><USER3> I noticed yesterday's articles about Intel's upcoming unusually large release of security mitigations. Under serious competitive threat for the first time in a while, I'm curious if Intel may have slowed the release of some mitigations to land after this round of comparison benchmarks.

<comment><USER4> Intel has been cheating their single core performance against AMD for many years, thanks to predictive and insecure algorithms.

Reality is just catching up, AMD is already number one for a long time. Intell's cheating just didn't make it clear.

I've waited for a year to express my opinion, before I could see any evidence.

The time has come that AMD is even beating Intell's fake single core performance, so slowly we will see all of Intell's shit appear. There is no point in hiding it anymore for the consumer/gaming market, if they are not nr 1 in single core. Not if they lose trust of their business clients and profitable server market.

All those gamers that bought Intel for single core performance and OEM's that stick to Intell because of monopolies betted on the wrong horse.

[https://twitter.com/damageboy/status/1194751035136450560?s=1...](https://twitter.com/damageboy/status/1194751035136450560?s=19)

This feels "nice", although I'm affected to :(

Waiting for decent AMD laptops...

Ps. Long AMD, ever since Spectre and meltdown.

<comment><USER5> Do remember that Meltdown and Spectre affected literally everyone else in the industry (including POWER, ARM, and SPARC) and it's only by chance that AMD's branch predictor happens to be relatively difficult to train to follow a predictable path (which is a necessary condition for some of these exploits). Intel isn't cheating any more than anyone else, AMD got lucky.

Cascade Lake and the latest Coffee Lake (and Comet Lake) steppings have hardware mitigations for all the previously known exploits (although there is a new batch) including some for which AMD still requires software mitigations themselves (Spectre V2).

<comment><USER4> So, AMD got lucky 218 times?

[https://windowsreport.com/amd-intel-security- vulnerabilities...](https://windowsreport.com/amd-intel-security- vulnerabilities/)

<comment><USER5> Most of those exploits are software/driver vulnerabilities, and AMD has plenty of their own. Like when Threadripper drivers installed an out-of-date web server running with SYSTEM privileges, or when a series of PSP and BIOS bugs let an attacker escalate from VM guest to control of the PSP and BIOS persistence. If you're not finding vulnerabilities in your software, you're not looking.

Intel is in a lot more verticals than AMD is - networking, storage, etc - <USER2> all of those get their own CVE number. But that's a more nuanced approach than "big number bad" isn't it?

Specifically, Intel is finding a lot because they're doing an enterprise-wide initiative to lock down their IPs. Is AMD making the same effort, or are there more vulnerabilities in those GPU drivers or in the chipset drivers that they're not looking for? After all, a year ago they were at the stage where they were installing an out-of-date Apache instance along with your motherboard drivers... doesn't sound like security is priority #1 for them.

Again, low number sounds good. But if you're not looking, it's actually not good.

And researchers are not looking on AMD much either. AMD is less than 5% of the server market right now, you get the big headlines from finding vulnerabilities in Intel now, not AMD. Give it another 5 years and there will be more scrutiny on AMD's hardware/software.

<comment><USER6> > Specifically, Intel is finding a lot because they're doing an enterprise- > wide initiative to lock down their IPs.

Do they now? Why may that be? Not voluntarily i guess, with all the mess, others have found _first_ , they fear losing ground, and shareholders blood thirst.

</comment></comment></comment></comment></comment></comment><comment><USER7> As a developer I am keen to see some compilation benchmarks. Unfortunately those kinds of benchmarks are almost never included in such reviews. Instead there are many gaming benchmarks which purpose is not exactly clear for me, after obviously gaming is not the primary target market for R9 3950X.

<comment><USER8> I believe that some of the YouTube channels have started including compilation benchmarks. GamersNexus [1] and Linus Tech Tips [2] both do!

[1] [https://www.gamersnexus.net/guides/3460-new-cpu-bench- method...](https://www.gamersnexus.net/guides/3460-new-cpu-bench-methodology- workstation-program-compile-tests-premiere)

[2] [https://youtu.be/stM2CPF9YAY?t=4m49s](https://youtu.be/stM2CPF9YAY?t=4m49s)

<comment><USER9> In addition, Level1Techs is more developer/sysadmin oriented than consumer oriented : [https://www.youtube.com/channel/UC4w1YQAJMWOz4qtxinq55LQ](https://www.youtube.com/channel/UC4w1YQAJMWOz4qtxinq55LQ)

<comment><USER10> And in addition to that, we have Open benchmarking and Phoronix for that. :)

</comment></comment></comment></comment><comment><USER11> I find it interesting how desktop CPUs are essentially coming down to two enthusiast markets, developers/content creators/workstations and gaming.

While the gaming market is (usually) seeking the highest top single core clock speed with respect to CPUs, it also relies on other expensive hardware. Meanwhile the dev/content creator/workstation market is much better served by these multi-core behemoths.

Intel really has their work cutout for them with performance to cost for consumer desktops.

<comment><USER12> Before Vulkan, there were more bottlenecks on multithreaded rendering. Most games pushed everything to a single drawing thread.

Hopefully going forward that will change, but even with Red Dead Redemption 2's Vulkan implementation, a 6 core Intel/AMD chip is competitive with this processor at lower settings/resolutions where the GPU is less of a bottleneck.

Compute bound games like Civilization 6 do scale with processor count however.

<comment><USER13> Factorio is also limited by single core performance, with the developers saying they have no plans to implement multithreading.

<comment><USER14> This is unfortunate, and I'm saying this as an AMD owner and factorio player. Do you have a source for this?

</comment></comment></comment></comment><comment><USER5> GamersNexus really hammering AMD's deceptive marketing around boost clocks. The only time it can hit its advertised boost clocks in when it's in the menu and you have near-zero load, and it barely touches it for an instant. Under even a single-core load it's failing to meet its advertised spec.

There was a lot of hubbub around this with the initial release, AMD released a BIOS which they claimed fixed this, looks like it still has not.

[https://www.youtube.com/watch?v=M3sNUFjV7p4](https://www.youtube.com/watch?v=M3sNUFjV7p4)

The performance is good enough as it is, no need to lie about it being 200 MHz higher than it can actually do. But here we are again 6 months later and AMD does it again...

<comment><USER15> Which is weird because they have the performance.

Showing the perf of the processor does all the marketing it needs, no matter what clock it's running at, and with normal/turbo clocks customers don't even get it anymore anyway, so I don't understand why AMD is handicapping itself like this in the marketing department.

</comment></comment><comment><USER16> Way to go AMD! One of the benefits of competition between the duopoly. AMD has cornered Intel these last couple of years and I don't see this trend changing soon, not with all these vulnerabilities that chipzilla is having ;-)

One thing I'd like to note, is that with all this computing power being available to users at a relatively affordable price, software developers (games - commercial software) won't optimize their code. I've seen it happening where a loop/scanning/sorting algorithm won't be optimized since the user will anyhow have a few cores and GHz to spare.

</comment><comment><USER17> I read that all these new AMD CPUs support ECC, but it's been hard finding verification. Can any one recommended a motherboard that both supports and uses ECC RAM with this new CPU?

<comment><AUTHOR> Some useful links within:

[https://www.reddit.com/r/Amd/comments/cb8tyr/asus_pro_ws_x57...](https://www.reddit.com/r/Amd/comments/cb8tyr/asus_pro_ws_x570ace_paired_with_ryzen_9_3900x/)

ASUS Pro WS X570-Ace seems like the top dog here.

[https://www.anandtech.com/show/14161/the- amd-x570-motherboar...](https://www.anandtech.com/show/14161/the- amd-x570-motherboard-overview/39)

The conclusion doesn't point out ECC-compatible boards, but the comments mention the same Asus.

<comment><USER18> Anyone hopping to have ECC with Ryzen should really read the reddit thread. Wow, what a mess.

</comment></comment></comment><comment><AUTHOR> This isn't the most groundbreaking release - it's not the first 16-core chip you can buy (edited), nor the first 7nm. No new clockspeed records were set. Still, $750 for all that power!

Any professionals shopping for this, or waiting for 24 or 32-core Threadripper?

Anyone trying to upgrade on an older motherboard, or are you getting a matching X570 to ensure maximum boost and PCI-e bandwidth?

<comment><USER19> I'm waiting for 64 core CPU. 32 is nice but still not enough.

<comment><USER20> 64 cores ought to be enough for anybody...

<comment><AUTHOR> Yeah, that's what... 10kb of RAM per core?

<comment><USER21> Funny story. The Vega64 has 8GB of RAM and 4MB of L2 cache (last-level cache) across 4096 SIMD-cores. That's 1kB of L2 cache and 2MB RAM per core.

It gets worse: although there are 4096 cores, the Vega64 isn't fully loaded until you stick 4-threads-per-core (Or more precisely, 16-wavefronts per Compute Unit (256-SIMD-cores)). That means you will actually need to run 16384 SIMD-threads before the Vega64 is fully utilized.

That's less than 512kB main-RAM per core, and less than 256 bytes of L2 cache per core. Better hope your threads are sharing a lot of memory...

\</comment></comment></comment></comment></comment><comment>--

AMD addresses this problem with NAVI / RDNA: NAVI is fully utilized at 1-thread per core. So you only need 2816 threads on the 5700 XT to fully utilize the system.

</comment><comment><USER22> Any problems with AMD cpus and containers or virtualization?

 _(Really? Wow. Sorry for asking a question!)_

<comment><AUTHOR> I only have limited experience so far, but I was able to enable virtualization and run WSL on Windows 10 with a Ryzen 7 2700X with no obvious issues. I'm sure more in-depth, longer term container testing would be more useful to you, though!

<comment><USER23> Same with a 3700x. Running an Android Emulator, Docker, and WSL2 on Hyper-V simultaneously with no obvious issues.

</comment></comment></comment><comment><USER24> Been waiting for this for about a year now... pulled the trigger early on an X570 build as my old system (i7-4790K) was acting up and bought early. Been running an r5 3600, but replacing cpu with a 3950X.

</comment><comment><USER25> Can anyone comment on the IOMMU-grouping on typical boards? From what I've just googled, the CPU "lanes" seem to support ACS so it could indeed be working to replace my IGP+GPU-for-the-gaming-VN-Haswell system with a dual- GPU-Ryzen one (contrary to what I believed previously).

Have been eyeing TR for that reason, but as I don't really need this amount of I/O (and cores), I might be well served by AM4.

<comment><USER26> I am finally running a Ryzen 1700 + dual GPU system so I could get rid of dual-booting:

CPU: AMD Ryzen 7 1700

Mainboard: GA-AX370-Gaming K5 (Bios: F25)

GPU (Host): Gigabyte GeForce GTX 970

GPU (Guest): Gigabyte GeForce RTX 2060

OS (Host): Arch Linux

OS (Guest): Win 10

As said it appears to me IOMMU grouping depends a lot on the board used. For mine it looks like all the chipset external PCIes are in one group and the CPU PCIes (basically the 16x for GPUs) are in two seperat groups. So I run two GPUs on 8x on each slot now. I was also able to pass through an USB 3.0 on- board controller as it was also in it's own group.

But there is the ACS patch so you are able to pass through single devices which are in a physical IOMMU group (not only cpu lanes). I don't have personal exp with it tho.

Warning: There are issues with the latest Ryzen gen and bios updates and they break vifo.

<comment><USER27> Have you experimented with things like lookingglass? Is that stuff more streamlined now?

<comment><USER26> Personally I have no use for lookingglass. To make it work you need anyway a display connected (or something simulating a connected display) otherwise it will not render to the shared memory.

In addition to that I use the VM mostly for fullscreen application, either games or some windows only software so I don't get any advantage out of the windowing.

Instead I decided to take an auto-switching approach via CDD and some shortcut menus to switch GPU outputs on my main display, see in action here: [https://gfycat.com/tepidliquidcero](https://gfycat.com/tepidliquidcero)

</comment></comment></comment></comment><comment><USER28> 7nm is about 35 times the diameter of a silicon atom.

<comment><USER29> It sure is, but 7nm in cpu lithography doesn't mean anything, it's pure marketing.

[https://en.wikichip.org/wiki/7_nm_lithography_process](https://en.wikichip.org/wiki/7_nm_lithography_process)

> The term "7 nm" is simply a commercial name for a generation of a certain > size and its technology and does not represent any geometry of a transistor.

<comment><USER30> Yeah, since about 14nm the nanometer number has become kind of like CPU speed (mhz/ghz) became in the early-mid 1990s and for the same reason.

Long ago you could say e.g. a 600mhz CPU was faster than a 500mhz CPU. Then things like instruction level parallelism and other significant optimizations started and you had lower-core-speed CPUs that would in practice be quite a bit faster than higher-core-speed CPUs. Today a 1.6ghz mobile chip is far faster than a 2.4ghz earlier generation Pentium-4 for example, at least for most workloads.

My understanding is that chip fab processes have developed similar numbers of devils in details. It's not just about the smallest feature size but lots of other things like materials, transistor types, layout, power density, etc. I've heard that Intel's 14nm processes are comparable to other fabs' 10nm processes for instance.

Still this 7nm node is better than what Intel is currently shipping.

</comment></comment></comment><comment><USER31> Looking at some benchmarks done by PC Games Hardware it appears that games are still not capable of taking advantage of 16 cores and 32 threads. It's not surprising - why would developers optimize for something that's not yet widely used. But I wonder when we'll get there...

<comment><USER5> Consoles determines how many cores game engines will be coded to use, and consoles are staying with 8C processors for another generation.

</comment></comment><comment><USER32> Went with AMD with my latest build. Last time I went with AMD was back in 1999 with an AMD K6-2 500mhz.

<comment><USER33> I think the last time consumers were swarming AMD for their CPUs was Athlon 64 X2 around 2005.

</comment></comment><comment><USER34> When GPUs became vastly more powerful over the last ~10 years, it made big neural nets practical. I wonder what an equivalent jump in CPU power will unlock.

<comment><USER35> More electron apps.

<comment><USER36> Sadly, I'm afraid you're right.

I love my 1920X for making a modern desktop snappy. I hate Discord, chrome et. al for needing one.

<comment><USER37> Max spec KDE with ALL batteries included on a 12 year old laptop computer with a new cheap Crucial SSD even with the old UDMA-6 is ultra low latency and very snappy.

KDE is an excellent Mac replacement for power users.

</comment></comment></comment></comment><comment> th-miracle-257 Why did Apple not release their new MBP 16 with the 3950X? [1]

[1] [https://news.ycombinator.com/item?id=21523780](https://news.ycombinator.com/item?id=21523780)

<comment><USER38> In addition to the points already mentioned, a good bit of Apple's software depends on Intel-proprietary features, e.g. QuickSync for video encoding. So far, no macOS system ever shipped with an AMD CPU, and porting the OS and user-mode application stack is not trivial.

<comment><USER39> There must be Macs like the iMac Pro and Mac Pro that don't have Quick Sync.

</comment></comment></comment><comment><USER40> I'm very curious how this CPU performs for Elixir compilation.

<comment><USER41> Compilation should profit pretty linearly from more cores thrown at it. Considering the Erlang VM is very concurrency-conscious it should be a pretty natural fit.

But I'm not at all in on the intricacies of it, are there any particular CPU features (instruction set or module) it's known to take advantage of ?

<comment><USER40> You mean like vectorized instructions and such? I don't know, but if I had to guess I'd say no.

Anyway, I'm sure there are some compilation phases that won't benefit from more cores, but the bulk of the compilation seems to do so. Even though Elixir has incremental compilation, due to use of metaprogramming in the Phoenix framework sometimes even changes to a single file will trigger recompilation of hundreds of others, so I was thinking these new AMD CPUs with lots of cores could be very helpful here.

<comment><USER41> Try to ask around Stack Exchange or whatever, I'm certain some people have been running the BEAM on the second generation Threadripper chips (this one being pretty much just a better 16c Threadripper on a consummer socket) since they've been so popular for productivity/compilation.

</comment></comment></comment></comment><comment><USER42> I don't really get how they reached their conclusion. It seems like on most of the tests this new part gets beat by a cheaper one from Intel. It seems like a kinda unfair approach to use handbrake without AVX-512 support? Also not sure why they include the 3-d particle thing without AVX ... I guess because Intel is just too fast on that?

If you look through the results, the things most people want to do with a computer, like browse the web and start their applications, are noticeably faster with the Intel i9-9900K at half the price. And the only game where the CPU makes a difference in these benchmarks is also a lot faster with the Intel part.

<comment><USER43> You could just buy a CPU for a third or fourth of the price if you want to just browse. You don't need a $750 16-core CPU. You can buy a $200 9600KF or a $240 3600x or something even cheaper. For anything multi-core the 3950X blows the 9900k out of the water, and for 1440p gaming the 3950x trades blows with the 9900k. If you want 1080p gaming, or web-browsing, this is not the CPU for you. That said, even for 1080p gaming and single-threaded benchmarks the 3950 is usually within a few percent of the 9900K.

<comment><USER42> Ok but if it's "trading blows with" and "within a few percent of" a CPU costing half the money, why is it rational to prefer it?

I know why _I_ want AMD parts and that is because of ECC memory support but this article doesn't even mention it.

<comment><USER43> First of all, the 9900k doesn't cost half the money. Second, you can also buy a 3900x if you want 12 threads with similar ST characteristics and pricing closer to the 9900k. There are other options.

If you want to game @ 1080p and do mostly single threaded work (without parallelism), this CPU is not for you. If do a lot of single-threaded jobs in parallel (for example, gaming + being a server or gaming and streaming) or anything multi-threaded, this CPU destroys the 9900k, while being just a bit weaker when doing just one or two single-threaded tasks.

<comment><USER42> Look I'm not arguing about which CPU is better. I'm arguing that taking the geometric mean of a bunch of completely unrelated benchmarks doesn't make any sense. There are clearly workloads in this very article where a cheaper part is better, sometimes even a cheaper AMD part.

<comment><USER43> And the article states clearly: "[the Core i9-9900KS] does pull out ahead in a number of ST tests as well as in low resolution (CPU-bound) gaming."

Regarding the geomean, they clearly state that their benchmarks prioritize multi-core benchmarks: "This metric also puts the 3900X above the 9900KS, because despite the 5.0 GHz all-core on 8-cores, moving to 12-core and 16-core at almost the same performance per core gives more of an advantage in our test suite's MT-heavy workloads."

They're not hiding behind anything. Everything is clearly stated.

</comment></comment></comment></comment></comment></comment><comment><USER44> Where is the 9980XE @ $979 coming from in the price vs performance chart? Where can I get a 9980XE for $979??

<comment><AUTHOR> [https://ark.intel.com/content/www/us/en/ark/products/189126/...](https://ark.intel.com/content/www/us/en/ark/products/189126/intel- core-i9-9980xe-extreme-edition-processor-24-75m-cache-up-to-4-50-ghz.html)

Seems like it should be $1979 to match Intel's suggested pricing. (Retail looks like it's $1949 on sale, and typically even higher.)

<comment><USER45> Intel has announced the Cascade Lake-X i9-10980XE coming out later this month for $979. It's slightly higher in frequency,

<comment><AUTHOR> Right - I didn't notice a footnote. I just saw your comment / reply on the article. It's a fair label, just wasn't clear to me!

</comment></comment></comment></comment><comment><USER33> I wish the reviews that included gaming benchmarks would have included Monster Hunter World. Capcom's MT Framework game engine is extremely multi-threading capable.

</comment><comment><USER46> Slight meta, and part of a larger 'rant,' but when are we going to get away from reviews that might as well have been printed on glossy pages in PC Magazine in 1986? Anandtech has been at it since the 90s and hasn't changed their format at all. This is a serious decades-long stagnation of the web. The graphs should be dynamic (able to choose what scenarios and components to compare, and able to search within them), and user contributed. Instead we get feeble excuses like "it doesn't make sense to compare a two-year-old- generation to this one," well yes it does if I'm considering an upgrade.

Only a few sites support these options. Storage Review was an early leader but hasn't much moved much, Notebookcheck is another, and of course Phoronix.

<comment><USER47> I mean, there are plenty of options to compare new cpus to old ones.

0\. CPUBoss 1\. CPUBenchmark 2\. UserBenchmark

And if you're considering an upgrade, it's almost always the case that you should be comparing latest generation offerings to arrive at a purchase decision.

Don't call the web stagnant because they decide not to flood the page with JS libraries.

<comment><USER48> But if you're deciding whether or not to upgrade, a comparison between your current hardware and newer hardware is relevant.

<comment><USER47> That's why I suggested the first three websites.

The role of Anandtech/TomsHardware and the like is not to do this. It's to give news about new CPUs and where the fit in current offerings. They are news sites after all.</comment></comment></comment></comment>


Questions you have to answer correctly to get funding for your startup - <AUTHOR> http://whoapi.com/blog/439/26-questions-you-have-to-answer-correctly-to-get-funding-for-your-startup/ <comment><USER2> > "Why don't you sell your house/company/whatever if you believe that much in > your product?"

How is believing in your product an excuse for not trying to minimise risk.

Especially if you know that most startups fail, there's no good reason not to hedge your bets when it comes to stuff that's at the base of the Maslow triangle.

edit: logic error :)

<comment><USER3> "How is believing in your product an excuse for not trying to minimise risk. Especially if you know that most startups fail, there's no good reason not to hedge your bets."

Would you agree that this would not be a good answer even if it is the reason?

Some gentler ways to answer:

\- Keeping my house gives me a feeling of security so I can devote all time and energy to the startup.

\- My heavily mortgaged house is not nearly enough to fund the startup.

\- Keeping my house is not unreasonable when I am already investing an enormous amount of my time and energy and my life into this.

\- I might indeed sell my house but I don't think I'll need to. I feel that this startup is a great investment, and I think investors will agree.

Anyone got a better response?

<comment><USER4> How about: the security provided by an unconditional roof over my head and food on the table allows me to use my abilities in problem-solving and creativity, according to Maslow's hierarchy. [1]

[1] <http://en.wikipedia.org/wiki/Maslow%27s_hierarchy_of_needs>

</comment></comment></comment><comment><USER5> " _Why should I invest in you instead of hiring 1/2/3 people and outsource the whole project?_ "

Most of the questions seem sensible but the one above seems really out of place (and would put me off whichever 'investor' asked it). Has an approach like this ever worked?

Having said that, it's nice to be reminded that there's a world outside SV/London where people can actually get started (and funded).

<comment><USER6> I came to comment on that exact same question - so not only will VC's not sign confidentiality agreements, but they can ask something like this? I'm curious if there are instances of this happening?

<comment><USER7> So the right answer to that is "because you are a professional and honorable business man, and not a sleazy bastard". ;)

<comment><USER8> I'd say the right answer is something like this : 'Because if you do that we will kick that other team's ass and you will regret it. We are the best people for this project and we will kill ourselves to make this product the best in the world.' I guarantee you he would invest in us at that point. :)

</comment></comment></comment></comment><comment><USER8> You forgot the most important question > 'WHY? Why are you guys doing this that will probably fail, take you 10 years to realise it failed and cause you gastric ulcers of massive proportions?' If they fail to convince me here, I'd turn them down.

<comment><USER9> gastric ulcers - ouch! Is that all I can look forward to?

<comment><USER10> Gastric ulcers are caused by a bacteria (Heliobacter pylori), not the stress of running a startup.

<comment><USER8> bacteria are caused by a lack of immunity that is caused by the stress of running a startup :)

<comment><USER10> They're still easily treated with antibiotics. I'd hate for someone to quit their startup because they thought that stress was the primary cause.

</comment></comment></comment></comment></comment><comment><USER11> @amirmc Actually we were asked that question (outsourcing your project) couple of times. There are few more than tricky questions. You really have to think hard when someone asks you "What if someone copies your service, and offers it half the price?". Every question is a different test.

@ofca I totally agree! If you don't know the "WHY" there's no point in starting anything! There are lots of other important questions as well.

<comment><USER7> I once read a great comment that when a VC asks "what would you do when Google enters your field", the best answer is "what would you do when Google enters yours"? <http://www.googleventures.com/> ;)

</comment></comment><comment><USER12> > "Can you see your company becoming a 10 million dollar company?"

This number is much, much too low. 100M or 1B is the common question in North America.

I've been told by a number of early investors that they seriously worry about investing in companies that get to 10M or 20M and then plateau.

</comment><comment> B-Scan This guys are a great example of how to create a startup and get funding in countries like Croatia where the access to VC/angel money is limited. To start globally (when you are outside of US) is much harder then many think.

<comment><USER13> My small business has always been global and now I am starting to look at expanding quite quickly. Now I am in a position where I may even be able to execute some ideas that might be of interest to investors.

The question of whether to go global at first is really a very hard question. I think it absolutely depends on the business. Many businesses would benefit by starting locally and working closely with customers at first before going global. Many other businesses would benefit by going global right away. Making the right decision here is sort of tricky.

Now, one thing to note is that this isn't an all or nothing question either. A smart business will globalize where it makes sense and localize where that makes sense. For example, if I am going to go and provide (or send someone to provide) training, I am not going to send someone half-way around the world for a short-term training contract. On the other hand, sponsored development on LedgerSMB is easily global. Payroll subscription services will naturally be a series of local offerings, while technical support for PostgreSQL can be more easily a global one.

</comment></comment><comment><USER14> Also look at the Sequoia's "Writing a Business Plan" page, it's the best "checklist" to keep in mind, even if you don't actually write a business plan:

<http://www.sequoiacap.com/ideas>

</comment><comment><USER15> I particularly like the reinforcement that there are at least 17 other questions that need to be answered (whether asked directly or addressed by you proactively) _before_ they even want to see the Executive Summary.

</comment><comment><USER16> i looked at the questions, and said to myself, "oh shoot, i dont know the answer to many of the questions!"

honest question, anyone care to share their answer especially for question: why not sell your house, why you're better, what if somebody (startup/big guy) copy your idea with less price, why cant i pay somebody to do it (outsource), without sounding cliche or boasting?

<comment><USER17> \- Why not sell your house? \-- "We're really focused on the business and are trying to limit outside distractions, like where is my family going to live, or how am I going to drive to meetings. But liquidating some assets is always an option"

\- Why are you better? \-- This is going to be different in every situation, especially if you're entering a crowded market. This is your secret sauce. Ideally team expertise should be a part of your response as well.

\- What if somebody copies you at half the price \-- "It's true others will always try to copy us if we are successful, but we have a 2-year product roadmap. If they do copy us, we will always be a step ahead in our roadmap. Our roadmap is so important because our team has "X" experience in "Y" customer pains." And if your product isn't core to the "Big Guys" business you could always mention that and say that they won't be able to focus on the specific problem the way you will.

\- Why can't I outsource? \-- You should definitely boast about why you are the team to solve this problem. Investors are pretty optimistic and they get super excited about awesome teams. You want to give them reason to believe that you have experiences relating to the problem you're solving that others won't have. This will also allow them to boast to their friends/other investors about team/product they just invested in. And can help you round up others for your round.

Just a few examples. Hope some of this helps!

<comment><USER16> wow, thanks man! your answer about not selling the house is very diplomatic :)

</comment></comment></comment><comment><USER18> In the US, for Web 2.0 projects, mostly can boil down to just one question: Do you have traction that is significantly high, say, over 100,000 unique visitors a month, and growing rapidly?</comment>


HurtLocker App Thwarts Unwarranted Police Cell Phone Searches - <AUTHOR> https://market.android.com/details?id=com.featureproof.hurtlocker&feature=search_result#?t=W251bGwsMSwxLDEsImNvbS5mZWF0dXJlcHJvb2YuaHVydGxvY2tlciJd

<comment><USER2> Sounds like a good countermeasure.

Though its a problem if they take your phone without asking for your password.</comment>


Pioneers of web cryptography on the future of authentication - <AUTHOR> https://spectrum.ieee.org/tech-talk/telecom/security/pioneers-web-cryptography-future-authentication <comment><USER2> When I founded Gliph, which ultimately became focused on privacy, secure message and bitcoin, I was actually after identity. I even tried pitching it as an "identity management platform."

Identity felt like hot idea back then ~2011, this concept of owning your own. There was another company that raised a lot of money that was working on it, Personal.com.

I was able to meet with Larry Drebes at the time who was involved early with OpenID, and at the time was growing Janrain which was helping big companies handle user federation.

That year, Chris Poole of 4Chan controversially said Facebook and Google had it wrong: "Google and Facebook would have you believe that you are a mirror, that there's one reflection that you have; one idea of self," Poole added. "What you see in that mirror is what everybody else sees. But in fact, we're more like diamonds: you can look at people from any angle and see something totally different." [0]

Anyhow, a decade has passed and it feels like very little has happened with identity, the ability to control identity away from centralized structures.

My advice to any of them would be that "identity" is not a product. Authentication and federation to specific systems, useful features (i.e. sharing photos of grandkids), these can be made into products.

[0] [https://mashable.com/2011/10/18/chris-poole-4chan- web-2/](https://mashable.com/2011/10/18/chris-poole-4chan-web-2/)

<comment><USER3> What are your thoughts on [https://3box.io](https://3box.io) ? It's built on Ethereum, but sounds like it might be similar to the vision for Gliph.

<comment><USER2> From my personal viewpoint, I think this is a cool idea and I like the ethos that it seems to come from.

However, anything that does not delight a user is a mistake to build for a startup.

"Reducing the risk" and "building trust" with users means nothing to users when there is no useful product. So instead of integrating this and trying to use this choice to market your product, you should be building a better product and marketing that.

Because this won't sell any product.

Only a fraction of a fraction of people care where data is stored.

So if you have VC capital you should not be spending your time integrating stuff like this you should be building something that people want to use.

Apple is able to play the long game on security and privacy cause they have the cash and market position to do so. It is also the right thing to do, but again they are in a special position to invest in these areas.

See also "choose boring technology" [https://news.ycombinator.com/item?id=23444594](https://news.ycombinator.com/item?id=23444594)

Also, this is perhaps not directly related but more context for my parent comment, Larry Drebes' email in 2013 about shutting down Janrain's openID service: [https://news.ycombinator.com/item?id=6328182](https://news.ycombinator.com/item?id=6328182)

</comment></comment></comment><comment><USER4> Worked on this precise root of trust problem some years ago. Basic issue is, fragmentation in the device marketplace means you can't have an endogenous hardware root of trust on each device. Apple can do this because they own the whole device stack. Providing this outside that closed ecosystem will have hard limits foreseeably. That said, the only tech I am aware of that could conceivably change the balance of this device fragmentation equation is FHE that is sophisticated enough to perform nested standard encryption operations for authentication.

Otherwise, your options are a separate yubikey-like token that you buy and "personalize," with new keys and linking identity attributes to it, or some weak variation of obfuscated code to store and process your root of trust key.

Business wise, the threat model has a catastrophic failure mode, where a compromise likely exposes all users simultaneously, which becomes both worse and more likely as you scale. Then there are the use cases for strong identity proofing and authentication, where they all reduce to some powerful party wanting someone else to adopt sufficiently strong identity to use as recourse against them. Strong identity is for institutions to manage populations interchangeably, and nobody signs up for that, it's regulated down onto them.

The conceptual test I use is, if it interferes with your ability to consume drugs or pornography, it's not a viable consumer product.

Strong identity proofing without commensurately strong anonymity fails that heuristic. Self sovereign identity is only viable if it's either anonymous and disposable, or enforced downwards by a de-facto monopoly.

When I looked at the related startup company's site, I thought, "clearly the VC investment triad decision was based on 'team+market', with 'product' to be figured out later." I'm definitely not smarter than anyone involved there, but the product hurdles in front of them are expensive, political, and complex.

<comment><USER5> I may be very dumb but are you suggesting that Fully Homomorphic encryption (FHE) could perform client authentication _in the cloud_?

Is it possible that I FHE-wrap my own private key, send it to you, and you can sign with my key without the plain text? that sounds crazy? Am I missing something?

<comment><USER4> The reason I suggested FHE might change this was the a few of the solutions people have tried so far fall into the so-called "white box cryptography," bucket of key based obfuscators on your mobile/endpoint device. Depending on the authentication scheme or security protocol, you need a secure place to store your private key, a shared or derived secret, key encryption keys, or a certificate, etc. We have to assume that the OS of that client device is going to get rooted at some point and the security of those keys is gone - and with it, the identity assurance they provided. (again, the secure element and diversified initialization keys on apple devices is different, think of it as a little client side hsm)

Instead of using WBC, in this hypothetical case FHE becomes the scheme for performing a verification step without yielding information about the key to an attacker with root on the device. It's another handwavey blackbox, but it's a such a change in how we do security protocols that it's worth mentioning as plausibly having consequences for authN. It's a hard problem that gets addressed in areas like authenticated encryption, direct anonymous attestation, and other more use case specific protocols. Someone working in the field today would have more insight into it.

<comment><USER5> Hmm, I was asking as a few days back the IBM FHE release provoked me to ask what were the use cases for FHE? This seems to be, tantalisingly, the most interesting so far.

<comment><USER4> If FHE has a practical internal xor operation, the idea of iterating a key and diversification component/counter, e.g. like a FHE implementation of HOTP or OCRA becomes really interesting. Even if it's slow, you could probably stack the slow operations into the initialization/personalization phases.

Security and authN protocols are really just about using crypto to diffuse and distribute risk, so it's conceivable there are use cases where FHE facilitates shifting risk for key security onto the end user, like payment cards, etc.

<comment><USER5> So, just checking in case I am being dumb, HOTP (like TOTP) works where both parties have shared secret key (common in corporate remote logins).

The value here being that I can make my own secret key, and via FHE send the server a "cloaked" key that they will get the right answer without knowing my secret.

So apart from the initial key sharing, it's down to me to keep the key safe (as you say, pushing risk into the consumer like debit cards)

Feels like it where FIDO goes next.

</comment></comment></comment></comment></comment></comment><comment><USER6> They give little regard to the actual history of "secure enclave" devices in encryption. Smart cards with private keys generated on-device have been around for decades. This is either the present or the near-past of authentication, not the future.

</comment><comment><USER5> >>> What is authentication going to look like in 10 years?

>>> Jermoluk: Full sovereign identity. You should be in charge of your own identity.

Yes. I mean this seems so obvious but it is refreshing to see someone, anyone, say it.

Even I have a plan for a gravataar-like service for client certificates, so it's not like this is hard stuff.

</comment><comment><USER7> As internet users we are provided with a folder or a file full of "certificates" by some item of software, e.g., an operating system, a web browser, etc. In some cases, we have the choice of removing certain certificates if we do not trust them or adding certificates that we choose to trust. People online like to make assertions and argue about a so-called "chain of trust". What if that "chain of trust" began with the user, not a third party? In other words, the user created her own certificate (the root), then selected and signed the "trusted" ones provided to her that _she_ deemed trustworthy? The software would not be able to bypass the user's trust. Just because an "approved" third party signed a certificate does not in and of itself consitute trustworthiness by the user.

<comment><USER8> Basically that's called web of trust and was implemented by GPG for decades. It seems that even geeks don't really use that.

<comment><USER9> The Web of Trust approach can only scale by treating Trust as Transitive.

If your trust is confined to a few dozen co-conspirators it all works fine.

But when you try scale up it breaks badly because human trust is not actually transitive.

PGP tries to fix that by asking you about two things, in the process further worsening the UX. PGP asks Alice if she believes this key is Bob, and then also if she _trusts_ Bob to decide who other people are for her.

Very quickly Alice will discover that unless she agrees to allow multiple such transitive trust steps the "Web of trust" doesn't do much for her. Hopefully she gives up at this point.

But if she keeps using it, then eventually the other shoe drops. Alice sends a message to "Frank" which she intends to keep secret. But unfortunately it doesn't actually go to Frank, the "Frank" identity was vouched for by Edgar. Alice trusted Bob, who trusted Carol, and Carol trusted Dana, and unfortunately Dana is a poor judge of character and trusted Edgar who isn't very reliable.

<comment><USER7> Human trust is not actually transitive.

Is this like saying human trust cannot be 100% delegated?

If so, that seems to be the model of the third party CA system. As a user I really have little say in "who", e.g., the web browser, should trust. I have (unintentionally) delegated trust to third parties. They decide who I should trust. As a user, I am not supposed to care about or understand this process. This really does not sound like "authentication" to me because I have not authenticated anything. Everything is being handled by third parties.

<comment><USER9> A conventional PKI ("the third party CA system") separates out this authority. You trust Trent to discern who Bob, Carol, Dana, Edgar _and_ Frank are.

In choosing to engage in conversation with Dana, or even Edgar, you are not obliged to accept their word as to the identity of Frank, that's always Trent's job. And so Edgar's unreliability and Dana's poor character judgement aren't a problem.

<comment><USER7> What if I already know "Carol"? Should a web browser block me from "conversing with Carol" because I did not get "Trent's" approval first? Seems like I should be the one who decides whether I approve of Carol or not. I am the one taking the risk of "having the conversation".

</comment></comment></comment></comment></comment></comment><comment><USER10> Maybe they should next interview, Daniel J. Bernstein, Jason A. Donenfeld and Ross Anderson on the recent developments and the future of authenticated encryption.

</comment><comment><USER11> From this:

        Spectrum: Where do we go next? What is authentication going to look like in 10 years?
        Jermoluk: Full sovereign identity. You should be in charge of your own identity. It is yours after all.

I have a new startup idea "My Identity" (or something like that), which would work like this:

\- This needs a mobile app, which stores identity information.

\- A website shows it's QR code for registration.

\- Users scans the QR code with the mobile app, and checks which information is requested and Approves or Deny.

\- When pressing Approve, the identity is sent to the website, which use it for registering the user.

\- User should be able to fully control logins from the app, e.g. show a list on logged in websites, force logout.

<comment><USER12> > the identity is sent to the website

So it's more or less glorified autofill? It should at most give the site a token. Imagine how signing in with Apple, Facebook, or Google works right now but instead of having your identity with those 3, you have it in that app (or somewhere) and it's all your own. Which means you have to replicate on the user side some of the functionality that they offer and package it in a "fit for a user" format. I mean in the end you're holding on to your whole online identity so extra caution is needed.

</comment></comment><comment><USER13> Handshake.org is a another project that's giving users control of their identity — specifically web identity. It's an experimental new DNS protocol that uses private keys to determine ownership of domains. This lets users truly own their domains instead of renting names from TLD owners as the existing system requires.

When users have completely sovereign identity they'll also need some way to share it. I could see Handshake being the solution here (keybase was another viable alternative but they sold to zoom...)

</comment><comment><USER14> Related to [https://news.ycombinator.com/item?id=23459815](https://news.ycombinator.com/item?id=23459815)

</comment><comment><USER15> I'm bummed that authentication wasn't discussed until the last 2 paragraphs. And then only topically.

> We figured out how to make a personal certificate authority on your own > computer,

This isn't entirely true. I can make a self-signed cert, but there's no root of trust exdcept my computer: someone else can make their own self-signed cert claiming to be me.

I recently bought an SMIME cert from Sectigo for $20. There needs to be a personal CA and commensurate tooling, but it is still not widely available for non-miliatry.

Is there a way for me to get a personal cert that can be authenticated with a CA? Because I've been looking for some time. MozillaZine has a page on SMIME certs, but 80% of the names are crossed off.[1]

> muse of cryptography

Definitely Melpomone. ;)

[1] [http://kb.mozillazine.org/Thunderbird_:_FAQs:_Get_an_SMIME_c...](http://kb.mozillazine.org/Thunderbird_:_FAQs:_Get_an_SMIME_certificate)

<comment><USER8> My country (Kazakhstan) issues certificates to its citizens. They are signed by a government CA. So if you want to authenticate a Kazakhstan citizen, you can ask him to sign something and check his certificate. I've heard that many other countries are issuing similar certificates. So it's possible to build an universal service which would work for many countries.

<comment><USER16> Sounds like a great hammer to hold over any/all citizens. That government can invalidate your cert any time. You won't be able to conduct any action which requires it. I bet they aim for it to be required for everything sooner or later, and merely _today_ it's probably not yet needed to buy milk.

<comment><USER8> It's not any different from any other government ID.

</comment></comment></comment></comment><comment><USER17> ... How many things could you think of in technology that 40 plus years later are still being used in essentially exactly the same form as it was created? It's not some niche thing that nobody has touched. It's the heart of the entire way the Internet works ...

That about says it all.

</comment><comment><USER18> The "one identity key management system to rule them all" seems like a problem in search of a solution.

Why does every app have to use the same key management system?

What's the problem with identity, exactly?

I already own my identity on every app I use. I know the password (or my password manager does).

Take HN for example. There's no significant difference between HN asking for a password on a form, and asking a browser API for a certificate. Except the latter is more complex and prone to error.

<comment><USER19> There is also the question of multiple accounts on the same service for compartmentalization purposes. Right now you can do that in most places, although it might require multiple phone numbers and might violate TOS. Obviously, this could either provide privacy benefits or potential for abuse depending on service.

It's not clear whether the "one identity" system is meant to prevent or empower that. Looking at beyondcorp I'd guess it's meant to prevent.

</comment></comment><comment><USER20> Sounds like something related to passwords? [https://beyondidentity.com/blog/sorry-about-all- passwords](https://beyondidentity.com/blog/sorry-about-all-passwords)

<comment><USER21> [Meta] god damn it why is scrolljacking still a thing?

( And if they fail at this, why would I trust them with anything else? )

Shame!

</comment></comment><comment><USER22> meh. this is an ad (after all, it's spectrum) for a new high profile passwordless company. by focusing on the technology (certs) instead of the user-visible benefit (passwordless), they are doing ... something.

if it were someone ordinary, i would write it off as another poorly conceived and poorly run wannabe startup. but given the people involved, instead i find it puzzling.

</comment><comment><USER23> Not sure if I'm missing something, but have they interviewed two people who were extremely influential in cryptography and a third guy who... once worked at Bell Labs and is the CEO of a startup company?

<comment><USER24> TJ Jermoluk used to be CEO of @Home Networks, President and COO at Silicon Graphics and General Partner at KPCB.

<comment><USER25> So why is he relevant to "the Future of Authentication"?

I could see Martin Hellman being relevant, maybe. But there's no real substance in this piece, certainly not from Jermoluk. What I got out of it is that PKI is the answer. As I think DNS-based PKI is the answer, I think he's not too far, but he's probably selling something I don't need or want.

<comment> nick-garfield What do you mean by DNS-based PKI? That sounds interesting, but I can't quite visualize what that is.

<comment><USER25> There are two options:

      - registries and registrars run name-constrained CAs

      - DNSSEC/DANE (RFC 6698 https://tools.ietf.org/html/rfc6698)</comment></comment></comment></comment></comment>


Feel Guilty About Taking a Vacation In Your Startup? Here's Why We Don't - <AUTHOR> http://www.groovehq.com/blog/vacations <comment><USER2> Some free advice I learned the hard way -- for whatever it's worth...

Never, ever feel guilty about taking time off, especially if you have a wife and children. It's your moral duty not only to them, but to yourself as well. If you're single, you still need to spend more time away from work than you do at work.

The American notion of the American dream is just that -- a dream. Spend more time with family and friends than you do at work. Limit yourself to 40 hours only. If you can't do it in 40, it doesn't need doing. Don't work nights or weekends unless your business is geared to those hours, e.g. restaurant-based IT, hotels, you get it.

When you go home at night, you're unemployed. Set up emails and texts to reply you are busy. I set the expectation with my bosses that I am unavailable nights and weekends. My family come first. Full stop. Money can be made anywhere, my family is more important. I have one family and one life. I cannot hit the rewind button. You choose your legacy: time spent with loved ones or time making money for people that don't love you. You choose. This is not an attack on hard work, it's an attack on obsessiveness to get ahead. It's not required to have a good life. France is right. Work after 35 hours sucks, as do unwanted email and text missives after COB.</comment>


Nasty Gal is expected to file for bankruptcy - <AUTHOR> http://www.recode.net/2016/11/9/13578718/nasty-gal-is-expected-to-file-for-bankruptcy <comment><USER2> There's a lot of dismissive hate in this thread, but this was a genuinely successful company before things went sour. I've heard about it many times from my wife. Amoruso has a very scrappy tale about how she launched the company, and she created a brand that many people loved. The site was well designed, and the company had very rapid growth.

This wasn't an VC investment born out of the bubble. Retail requires more money than a startup that makes apps, and this one had a great growth trajectory. Obviously, things went south, but that does occasionally happen to a VC investment.

Similarly, I don't think it's fair to dismiss Amoruso out of hand just because the company has now failed. Many startup founders are great at launching companies, but not so good at running them once they reach a certain size. This seems to be what happened here. There definitely is something to be learned by how she built the company and brand.

<comment><USER3> I bought her book as a gift for my teenage sister, who is smart but also kind of a rebel. She loved it. Amoruso went from freegan anarchist going dumpster- diving to running a successful business, and so had lots of unique insights and perspectives. My sister would never read a standard life-advice book, but Amoruso is someone she could relate to.

For people saying business books are all nonsense -- why is business seen as a uniquely luck-based activity? No-one says, oh, some bridges collapse and some don't, so books about civil engineering only reflect survivorship bias. Business can't be reduced to a formula, but it can be broken down into smaller areas, each with its own principles (sales, marketing, recruiting, product development, etc). Amuroso learned these areas very quickly when she was getting started, but made some mistakes when things got bigger and the challenges increased.

<comment><USER4> Most business books are nonsense because they present a case study of how a single organization succeeded and are written by a single executive or consultant trying to put a positive spin on the experience. But they present no evidence as to whether the success was caused by or in spite of their actions.

One business book that actually applied hard data analysis to look for causality across multiple companies is "Good to Great" by Jim Collins.

[https://www.harpercollins.com/9780066620992/good-to- great](https://www.harpercollins.com/9780066620992/good-to-great)

<comment><USER5> Good to great has a big problem with survivorship bias. It's fairly low- investment to read, but I wonder how much value there is in adhering to the principles it recommends.

<comment><USER3> Tony Hsieh of Zappos was a big fan, and recommended it to all his execs.

</comment></comment></comment></comment></comment><comment><USER6> Wow, these VCs blew $65 million dollars on an online clothing store.

Wozniak and Jobs funded their Apple I by selling an old car and an electronic calculator; probably a few thousand dollars at most. The Apple II was launched for $250K, or $996K in today's dollars. These are actual computers they _designed_ , _built_ , and sold. That's ICs, circuit boards, firmware, device drivers, cases, real engineering, programming, manufacturing, and selling -- all for less than a 1/65 of the money that an online retailer blew through selling clothes.

To put it another way, instead of one clothing retailer, these VCs could have funded 65 ( _sixty five!_ ) hardware tech companies at $1 million each (at the Apple II level of funding).

<comment><USER7> That wouldn't work today, though. People have a much higher expectation of what a piece of hardware can do and looks like.

<comment><USER8> Not necessarily, look at all the projects on Kickstarter. There are still a lot of products that can be designed and build for less than $1 million.

<comment><USER9> Yeah, but those projects stand on the shoulders of giants. They are building on top of already existing open source hardware and software.

<comment><USER10> That's true of everything, though?

I mean a shitty $2 shirt wouldn't exist but for the power looms of the 19th century...

</comment></comment></comment></comment></comment><comment><USER11> As a user of Nasty Gal, Ideeli before that, and any of the various other sites that are currently flooding the marketplace, some thoughts:

\- Way too much money on targeted advertising.

I can't remember the name of the site, but I was looking for something in particular and so had some pretty specific search terms. I didn't find what I was looking for, but saw ads for the things I looked at for the next several weeks on _every page load_. Imgur, Facebook, news sites, Twitch. If the host had ads, I was seeing ads for this clothing site. A massive waste of money.

\- Searchability is atrocious.

Good inventory search for women's clothing is an incredibly hard problem. What's teal to one person is aqua to another. What's the difference between off-shoulder and off-the-shoulder? What the hell is bodycon? Why am I seeing tee shirts when I'm looking for turtle necks?

\- Quality is obviously bad.

When I was an Ideeli user (things have changed), I was never disappointed by anything purchased. Many of the items on these sites are either visibly low quality or massively overpriced. I was looking for a good pair of leather boots, and I was looking at either spending $80 on something that was clearly low quality or $250 on something that wasn't quite what I was looking for.

\- The bait and switch is real.

This is just a general statement on the tactics of these sites. I click on an ad because I see something I like, either that item is out of stock, or I can't find it in the store. But here's thirty other items that no one is ever going to buy.

<comment><USER12> except for the last item, you pretty much described amazon.

</comment></comment><comment><USER13> Interesting how she pushed hard her book GirlBoss while her business was alreafy floundering. And now it's filing for bankrutcy. Can you trust any of the advice from her book?

If anything, she knew her business was in trouble so she hatched a backup plan: turn herself into an authority on how to be a successful businesseswoman while Nasty Gal still existed.

<comment><USER14> >Can you trust any of the advice from her book?

This is pretty much the norm for business books. This time it just isn't backed by survivorship bias.

</comment></comment><comment><USER15> Worked in ecommerce for a decade, knew innards at NG through a few sources.

They overspent on tech which they always thought would last forever. "Yeah, let's spend $11M on a redesign. It'll last forever"

They bought way too much stock, and never worked with size curves, just flat ranges.

These are common problems in small/young retailers - just most of them don't fail quite so spectacularly on other people's money.

<comment><USER16> Ouch. I worked in ecommerce for five years myself and thought the companies that spent 20-50k on a site we could knock out with prebuilt components in a week or two was rough. Apparently we should have been tacking some zeros on there.

<comment><USER17> Yes, you should have been! I worked for a company that had this problem. The directors founded the company straight out of university and consequently had no experience of the industry to draw on.

<comment><USER15> I'm wondering if you worked for me, but with hindsight I realise this is a common problem. We underpriced ourselves by orders of magnitude for years.

</comment></comment></comment></comment><comment><USER18> I wonder what went wrong. Sounded like a pretty good concept overall. My guess is underestimating the volume of returns and generally margins in clothing retail. Possibly combined with a growth strategy that was too aggressive?

Amoruso and her previous work/network/following makes up a good bit of the value of the company imo...could she just start anew with a smaller/more niche shop?

Also curious...how would one go about buying the brandname/website etc. from this company once it's in bankruptcy (assets will be sold eventually, right)?

</comment><comment><USER19> When I hear about stuff like this, it takes me back to the Fucked Company days and the bubble bursting.

<comment><USER2> Which bubble are you referring to? I'm not familiar with one in the retail clothing space.

<comment><USER20> The late 90's dot-com bubble. The idea that any business vertical can be converted into a .com and it will just work by default. We were supposed to have learned from that era but this is not always the case.

</comment></comment></comment><comment><USER21> Did VC tank the company? As I recall from her book and interviews, she built her business on revenue and only took on capital much later.

</comment><comment><USER22> Wasn't she in the news a few days ago as some kind of up and coming billionaire?

<comment><USER23> "Nasty Gal's Sophia Amoruso Hits Richest Self-Made Women List With $280 Million Fortune" – [http://www.forbes.com/sites/clareoconnor/2016/06/01/nasty- ga...](http://www.forbes.com/sites/clareoconnor/2016/06/01/nasty-gal-sophia- amoruso-richest-women-net-worth/#46dce5bd44e1)

</comment></comment><comment><USER24> I created a womens ecommerce site with some friends, took $1M in VC, grew it to several million in revenue per year, then the business fell apart when we realized scaling would not solve our net income issues. Online womens fashion is a hard nut to crack. I'm not surprised to see Nasty Girl file for bankruptcy. I am surprised that someone can put out 2 books about success and not be successful themselves.

</comment><comment><USER25> This is Chapter 11. It means that they get time to figure out their finances. It isn't chapter 7 where they are liquidating.

</comment><comment><USER26> These were always cheaply made clothes that were not well designed. Good riddance!

</comment><comment><USER27> Next up StitchFix...

<comment><USER28> What makes you say that, out of curiosity? I feel like Stitch Fix is targeting a whole other subset of fashion needs, and I've personally been really impressed with their operation.

<comment><USER29> It is because Stitch Fix isn't doing anything new and fashion is incredibly fast, Stitch Fix has to depend on a supply chain (whole sellers) that lag behind in terms of trends and styles in terms of weeks, seasons are measured in weeks. It is also going to be incredibly hard for them to drive growth and their market position is dependent on their ability to match clothes for people.

<comment><USER30> Fashion doesn't actually change measured in weeks. There is a fairly predictable flow from the next-season designs approved by the fashion elite (think Devil Meets Prada sort of stuff.) The not-too-risky designs there are quickly incorporated by the just-behind-the-curve brands to still make it into the next season and only a year (or more) later the aspects sufficiently palatable for the masses end up at regular retailers.

That means that if you stay in touch with the newest developments it's actually pretty easy to still be sufficiently ahead of the masses to justify a service like this.

And if that sounds remarkably similar to how tech works: I agree with you.

</comment></comment></comment></comment><comment><USER31> Lol I thought the article was about Hillary</comment>


Global Music Sales Fell 7% in 2008. (Is this business dead?) - <AUTHOR> http://www.nytimes.com/2009/01/17/business/media/17music.html?ref=business <comment><USER2> I think total revenue is a poor way to measure the demand for music. The delivery of music recently became a lot more efficient now that songs can be downloaded online. It only makes sense that revenues would decline because a lot of the overhead that was built into the price has disappeared. It also doesn't help that for years the music industry conspired to keep the price of CDs artificially high.

</comment><comment><AUTHOR> No industry could survive with this kind of decline. This is untenable. Something revolutionary needs to happen, and it can't come from within because they're too busy protecting the current, failing system.</comment>


Amazon Cuts Struggling Phone's Price to 99 Cents - <AUTHOR> http://www.nytimes.com/2014/09/09/technology/amazon-struggling-fire-phone.html?_r=0 <comment><USER2> Not sure why this phone wasn't $399 off contract in the first place.

Amazon is repeating HP mistake of thinking they have product that is the same level as Apple and pricing it the same. The Touchpad was released at $499 the same as the Ipad 2 at the time.

For a company that is well known to have thin margins were they thinking $649 is something people were going to pay? Get the phone out with a lot of people using it and then sell the Fire phone 2 for $499 next time.

</comment><comment><USER3> Still not interested in signing a 2 year contract with AT&T or owning an Android phone that doesn't include all of the reasons I still own an Android phone (Maps, Now, etc) instead of some other Linux variant phone or a Windows Phone.

</comment><comment><USER4> Kindle is Amazon's best consumer brand. I don't know why they made a Fire phone. They should have made a Kindle phone, and positioned it as the phone for "Readers".

Positioning matters the most, of course, but I think they could have actually put in some features designed specifically for reading on a smaller screen: 1) scroll wheel that you can use with your thumb to easily flip or scroll through windows of content, with precision. Sort of like the scroll button on a mouse, but on the side of the phone, positioned so you can use your thumb on it, while the phone is held one-handed. 2) Maybe an e-ink screen and an insane battery life. Might suck for videos, but it would definitely be a differentiator and might attract people that love to read on their phones. 3) Cut down on the apps and other features. Go the opposite direction from other phone makers and make a very basic phone. I'm talking about just phone calls, calendar, calculator, browser, email, text, camera. Nothing else. And in exchange for that, the consumer gets a very cheap phone, and insane battery life.

I think some people would like that. I would. I have enough devices to do my media consumption on. I would love to have a phone that last 2-3 days on one charge again ... like my old Nokia used to. I love how my Kindle reader lasts the whole month. I don't expect that out of a phone ... but if you gave me a week long battery, and an e-ink reader built into that ... you have me as a customer. I'll watch my Youtube and Facebook when I get home.

I might be too old to be relevant. But I'm sure there are a few snowflakes like me around.

<comment><USER5> They are mainly interested in the phone as sales devices. To sell stuff you need color.

<comment><USER6> Making the phone something people genuinely want, first, then adding features to support sales, would probably better accomplish that.

</comment></comment></comment><comment><USER7> They could offer the phone for free, plus two years of free Amazon Prime, plus free $100 gift card to Amazon, and I still wouldn't get it.

Getting locked up with AT&T is not worth it.

</comment><comment><USER8> It's interesting how the dynamics work these days, and how Amazon just doesn't seem to be getting it. People are perfectly happy to sign a 2-year contract on a well-designed fully-rounded functional phone, they do that by the tens of millions. They even pay $200 to get the phone. The phone has become personal, and also a necessity as you go through the day. Going through 2 years on a badly designed phone just because somebody gave it to you for free doesn't really makes sense anymore.

<comment><USER9> This may seem weird in Silicon Valley, but even in the US, a lot of people don't have $200 to pay for a phone.

<comment><USER10> Then they probably don't have enough money for a subscription service, and if they do, they're better off with a non-smart (dumb?) phone.

<comment><USER9> There are some subscription services that are quite affordable and not having a cell phone in the modern world is not really an option.

<comment><USER10> You need to compare "quite affordable" with the $200 price of a smart phone. Because $200 seems "quite affordable" for a smart phone that can do pretty much anything and everything. And I never suggested not having a cell phone.

</comment></comment></comment></comment></comment><comment><USER11> I suspect Amazon is in the space for the long haul and the Fire Phone is an open beta. They got phones out into the world; they found out to whom their brand on a phone is appealing (0.2% of mobile use is still a lot of people in terms of raw numbers); Amazon is able to collect live data on real use; and they can correlate all of this against the Kindle and Fire and their sales of physical goods.

To put it another way, they couldn't get this data any other way. It's not dissimilar to Microsoft and the Pre - real field testing is expensive but the only realistic way to come up with a long term strategy. And like Microsoft mobile phones are an important space for Amazon, but not necessarily core critical.

Apple doesn't have warehouses full of shoes and appliance parts and used books and neither does Google. Amazon's core is selling things that aren't on the cloud.

</comment><comment><USER12> In case anyone at Amazon is reading: I own a Kindle Fire and the only thing I don't love about is the nav. I wish I could turn off the carousel style nav and just use a normal tablet/phone style nav with icons.

Not sure if the phone has that UI but if so it would be a reason I would not consider buying one.

(It's possible that with some UX improvements the core idea would work, the problem is that it doesn't work now).

<comment><USER13> I bought a Kindle Fire used for 65, and am contemplating buying a full price iPad next instead. The little things add up.

</comment></comment><comment><USER14> Perhaps I am missing something, but I don't understand the appeal of this phone. Its only real differentiator seems to be the "instant customer service" feature.

<comment><USER15> I think the glasses-free 3D through gaze tracking is what they expected to be the selling point... I also think that Bezos made a big mistake with this, and that he's such a hard-nosed jerk that he'll do a lot of damage to Amazon trying to force this to succeed before he will admit he was wrong. The phone market is totally saturated, why even bother with it?

<comment><USER16> I was really disappointed with the 3D when I tried it. Yes, the eye tracking is interesting and works reasonably well, but it's not in any way paradigm- shifting. I definitely didn't feel anything like I was seeing a historically significant innovation.

Most importantly, as far as I can tell, it doesn't make any existing smartphone activities easier or faster, nor does it make possible any new category of activity. Games are neat, but who is going to make games for a platform no one is on?

I agree with the other commenter, however, that Amazon is mostly interested in gathering detailed data on how people use their phones, and even a small percentage of the market is still a lot of useful data. They may learn something interesting (those eye-tracking cameras aren't there just for the sake of the UI), in which case they will be better positioned to increase their market share if they want to.

</comment></comment></comment><comment><USER17> Amazon doesn't depend on these devices like Apple or other manufacturers do. They can afford to take their lumps on this iteration and come out with better versions over the years. Not to deny that this phone appears to be a serious flop.

</comment><comment><USER18> The phone I got for $99 OFF contract is better than that phone.

</comment><comment><USER19> Article content notwithstanding, calling it the "Amazon Fizzle" is a great burn.

As a prime subscriber, I'd feel that I get more value for my subscription if they finally made their streaming work on Android devices (I'm not sure if it works on iOS). There is no app and the last time I checked, firefox on android also wouldn't play the content. This phone just reinforces in me the idea that I shouldn't renew my subscription, because the free streaming is elusive because it doesn't play on my platform of choice, only that of amazon's choosing

<comment><USER20> Amazon just launched the Prime Instant Video feature on Android.

<comment><USER19> Wow, what a major disappointment. Apparently available for phones, not for tablets, which is what I'm waiting for

</comment></comment></comment><comment><USER21> Not sure why they got in the phone business. Seemed like a bad idea to me.

</comment><comment><USER22> I'd buy that for a dollar!

Oh wait. No I wouldn't.

</comment><comment><USER23> How does news from three days ago get up-voted to the front page?

<comment><USER24> with the arrows at the side

<comment><USER25> I've been scanning my monitor and sending the articles via mail to my friends and family in order for it to gain traction. I think I'll try your way from now on!</comment></comment></comment>


Mozilla Game On - <AUTHOR> https://gameon.mozilla.org/en-US/

<comment><USER2> Fair warning: participate for the fun, not for the prizes. Mozilla ran a competition like this in 2010. My game "Favimon" won the "Most Original" category. I never did receive most of the prizes they claimed all winners received, including a copy of Adobe Dreamweaver Creative Suite 5, a guest post on the Yahoo! Games blog, a Think Vitamin sponsorship, and John Resig's "Secrets of the JavaScript Ninja" book. This was despite many polite inquiries to the competition organizer. Overall I thought the competition was excellent, but Mozilla's lacklustre follow-up afterwards was disappointing.

<comment><USER3> Hey there,

I was responsible for the 2010 version of Game On. We screwed up your price (long story) and will make good on it now. I know. It's late. Like in: Too late. I am sorry. Trust me - it was not done on purpose or out of neglect (well, I guess you can argue about that).

Anyway: Short of it is - I am sorry. And we will make good on it. Expect an email today (if you haven't already received it).

<comment><USER4> > (long story)

I hope I'm not being a dick by commenting on this but the subthread is getting fairly long with 'me too's. Can you give any kind of explanation as to what's been going wrong?

Also, this is the first I've heard about Game On 2010 so I went to find out more[1] and it looks like all of the links (winners list, game gallery) have been stomped by this year's site. I can still see Google's cached screenshots but no info.

And ninethly: loved Browserquest. Competitors, get your MMO on!

[1] <https://www.google.com/search?q=mozilla+game+on>

<comment><USER5> So, as a Game On 2010 contestant, my entry is now gone from their site? I prefer to participate to js1k which does not erase entries. Also the reader should be aware that he will be in competition with games in development for years, some run by companies. (edit: not to mention the sudden urge to send prizes now instead of in due time)

<comment><USER6> Gah. The old site and old pages will come back -- part of the shift that pmoz mentions above is that different teams ran the 2010 site and the 2012 version, and so we're learning (a bit late) how to build in permanence into the site structures).

</comment></comment></comment></comment></comment><comment><USER7> Hey there! I'm Chloe, the organiser for this year's Game On competition. I wanted to let you know that changes have been made this time around to ensure _all_ the prizes are delivered on time. We hope to see you join us this year!

</comment><comment><USER8> I've seen competitions like this before, but I've never had the time to commit to submitting anything. The rules and guidelines for this particular competition seem simple, straight-forward enough. I fear I, again, won't find the time to participate.

I will have to remember to check back in on this, to see what everyone came up with.

</comment><comment><USER9> Anyone on HN want to cooperate with me on a game for this competition? I've created some HTML5 games previously, also participated in the previous Mozilla Gameon (with Freeciv.net), and think this sounds like a lot of fun! Feel free to post game-proposals in this thread.

Twitter: @andreasrosdal

</comment><comment><USER10> Apologies for the shameless plug:

If anyone is interested in making a game for Game On, you might be interested in using PlayCanvas (<http://playcanvas.com>) to do so. Our CEO, Will, spoke at the Mozilla Game Jam in London at the weekend.

We're making a HTML5 game development environment in your browser. Features: 3D engine, real-time collaboration on scenes; game-scripting in javascript; art-pipeline for Blender, 3DS Max, Maya. Demos here: <http://playcanvas.com/demos>

Email support{at}playcanvas{.}.com and mention Game On or email me directly if you are interested.

</plug>

</comment><comment><USER11> Sounds fun. How do I start making games (tutorials, useful libs)? Can anyone please help. I know JS and CoffeeScript but have no idea about Sprites, Collisions, Physics etc.

[Edit] Sorry just saw this - <https://gameon.mozilla.org/en-US/resources/>

</comment><comment><USER12> If someone wants to team up with me to produce a game for this compo, find my contact in my HN profile. I participated in the github game off this year and was one of the winners - <http://khele.in/pappu-pakia/>

</comment><comment><USER13> I think this is a smart way to promote HTML5. Good job Mozilla.

</comment><comment><USER14> I'm rounding up people to get a Game On event going in Berlin.

Get in touch with @hdragomir on twitter if you'd like to help us.

</comment><comment><USER15> A really nice initiative. Well done, Mozilla.</comment>


Ask HN: 2016 Best Coding Resources? - <AUTHOR> <comment><USER2> [https://enlight.ml](https://enlight.ml) is a site I made to teach people to code by building projects. Let me know what you think of it!</comment>


Show HN: Yet another Sublime Text plugin for C++ completion - <AUTHOR> https://github.com/niosus/EasyClangComplete <comment><AUTHOR> Hello HN, I couldn't find any plugin for Sublime Text that would autocomplete C++ code and would be easy to setup, so I have written one. It is not fully polished, but works for me and a bunch of people, so I thought it was a good idea to expose it here.

The reason I post it here is two-fold.

First, I wrote it to make it useful, so I wanted to test it in real world,

Second, I tried to use libclang for autocompletion, but it works only for Linux currently. OSX and Windows for now resort to parsing the output from `clang -code-complete-at` command envoked in a subprocess. I would really love to make the plugin use libclang everywhere. So I would really like to get some help from people who are more familiar with OSX or Windows than I am and to generally spawn discussions on design desicions taken by me in this plugin.

Hope you guys like it. I am open to discussions and to your suggestions!

<comment><USER2> I very much want something like this. I'm skeptical as to how useful it will be on large projects. Every project I've ever worked in Visual Studio intelligence has eventually died. I have no hope this would work. But oh how I wish it to be true! :)

I wonder if a Sublime plugin could piggyback Visual Studio generated data. I believe VS now has the ability to compile via clang. Could you let VS manage all compilation and projects and dependencies? Use PDBs or some such to generate sublime intellisense? I've no idea. But something along those lines seems like it would be most likely to work.

<comment><USER3> We've got some pretty hairy legacy C++ and all versions of VS prior to 2015 fell over it. 2015 handles it just fine, it's worth trying again.

Regardless, clang just uses the headers - at least that's the story with clang-autocomplete. It seems to parse them much faster than VS does, so reusing the VS cache me might cause perf impediments.

<comment><USER2> I'm currently on a unity project but I'm sure at some point I'll work with UE4. I very much look forward to seeing how it performs.

<comment><AUTHOR> Please let me know when you know more. I am also interested.

</comment></comment></comment></comment></comment><comment><USER4> There's also SublimeClang for SublimeText2. The most active fork as of late is [https://github.com/ensisoft/SublimeClang](https://github.com/ensisoft/SublimeClang)

<comment><AUTHOR> There is a bunch of plugins that do essentially the same, but are all subtly different. the one you reference uses python bindings, but only works for Linux.

I will do a brief list of all that I know of: [https://github.com/quarnster/SublimeClang](https://github.com/quarnster/SublimeClang) \- discontinued

This one is pretty close to what I want: [https://github.com/lvzixun/Clang- Complete](https://github.com/lvzixun/Clang-Complete) It uses libclang and should work on all systems. It didn't work properly for me under Linux, but feel free to use it if it does.

There is also a plugin [https://github.com/griebd/clangHelper](https://github.com/griebd/clangHelper) which shares the purpose with what I have written, but was never updated after the initial commit, which is a pity. I probably wouldn't have written mine if it would be alive.

Then there are [https://github.com/LuckyGeck/YcmdCompletion](https://github.com/LuckyGeck/YcmdCompletion), [https://github.com/glymehrvrd/CppYCM](https://github.com/glymehrvrd/CppYCM) and [https://github.com/ivankoster/SublimeYouCompleteMe](https://github.com/ivankoster/SublimeYouCompleteMe) that use ycmd server to complete code. Ycmd is well-known to those who are vim users under the name YouCompleteMe. Unfortunately all these plugins are not fully in line with Ycmd server developments, e.g. the HMAC auth often mismatch and sometimes there is even no setting for that. These all are really great! And I do like the server-client architecture of this, but I could not make any of these work reliably for me. Believe me, I have tried. Also, again, it is harder for the user to separately setup a server and then register a client to it with multiple settings. Also there is a need for a .ycm_extra_conf.py file that has non-trivial syntax (as a python file)

And then there is [https://github.com/pl- ca/ClangAutoComplete](https://github.com/pl-ca/ClangAutoComplete) which is a really nice plugin and I started off my forking it. It uses only clang binary and is written in a simple, easy to grasp way, so it was perfect to hack around. However, I wanted to have a more modular structure and to make is unit tested and to use libclang when possible, so we have diverged.

Correct me if I did any wrong statement please and point me to the ones I may have forgotten.

</comment></comment><comment><USER5> Have you seen this for indexing ? [https://github.com/Andersbakken/rtags](https://github.com/Andersbakken/rtags)

<comment><AUTHOR> Yep, but I have unfortunately not managed to make it work for me. Also, I wanted to achieve really low-effort setup. I believe that my plugin, while maybe has less features is easier to setup. The user doesn't need to compile anything and generally can avoid opening a command line completely.

I would say these two plugins serve different purposes. rtags seems to be a machine that requires some setup and knowing what you want, but can do a whole lot of different things, while mine is simpler both in setup and architecture, but is of course less functional.</comment></comment>


Magnitude 7.1 earthquake hits off northeastern Japan coast - <AUTHOR> http://earthquake.usgs.gov/earthquakes/recenteqsww/Quakes/usc0004sg6.php <comment><USER2> Japan has a lot of earthquakes. Very few are newsworthy. Even fewer are hnewsworthy.

</comment><comment><USER3> [http://www.forbes.com/feeds/ap/2011/07/09/general-as- japan-e...](http://www.forbes.com/feeds/ap/2011/07/09/general-as-japan- earthquake_8557208.html)

No damage reported, nuke plants are safe, officials estimate one-meter tsunami.</comment>