Help me Hack the Lottery or, the worst $90 investment ever - <AUTHOR> http://ssikes.com/post/19800951554/hack-the-lottery-or-the-worst-90-investment-ever <comment><USER2> You're making the (probably) false assumption that your lottery is as broken as the Ontario one.

I question your detachment if you are calling gambling an "investment" at all. If you want to win at probability games, look at what any professional gambler does and stick your money down only when you can prove or reasonably expect to see a positive expected value given your odds. That's how basic strategy in blackjack and most of poker math works.

Also, I assumed ticket generation for the simple games was something brute- force-ish akin to:

1\. Create your winning tickets. Fill in the rest of the numbers with things that won't cause duplicate wins on the same ticket pseudorandomly.

2\. Make a random ticket. Check to make sure the ticket is not solved. If the ticket doesn't solve, add it to the stack of tickets.

Randomly shuffle all tickets. Print to rolls and cut. You could probably even get away with duplicate random "losing" tickets if you had enough of them because most people likely won't end up with the same losing ticket.

<comment><USER2> Also: Can we really call this a "regressive tax" like the Wired article states? There is no obligation to play the game. You are obligated to pay taxes.

Numbers games (lotteries) are run by governments now because organized crime was running them in inner cities. People still played then. See Wikipedia: <http://en.wikipedia.org/wiki/Numbers_game> At least the "tax" from lottery proceeds often goes to benefit social goods like public school systems.

<comment><USER3> Calling state lotteries a regressive tax highlights the irony of the socioeconomic system. The non-lottery-playing cohort tends to have more political control and uses that power (unconsciously, perhaps) to structure the market to induce lottery-playing behavior among the poorer cohort.

In other words, there are varying methods of obligation.

<comment><USER2> Can I get something to read on this premise? This type of "unconscious influence" stuff reeks of conspiracy theory or an irrelevant conclusion from sociological data. (Not calling you wrong, but I'm skeptical of this conclusion.)

</comment></comment></comment></comment><comment><USER4> I don't think it is a given that every lottery can be hacked.

I would also like to recommend this PG essay: <http://paulgraham.com/wealth.html>

<comment><USER5> These things are rarely about the money itself, but about taking on an established system, questioning it, and finding a way to beat it.

</comment></comment><comment><USER6> My sister-in-law found a winning bet for the New York Lottery.

There was a special promotion at the racino she goes to -- you could take your loser scratch tickets in a certain game to the casino, they'd put them in a big jar, and then whoever won the drawing got a trip to Las Vegas.

She saw there weren't many tickets in the jar, so she bought about $150 of these scratch tickets (she won $80 back so these only cost her $70) and submitted them. Her mom did about half as many.

A few days later her mom gets a phone call and she won a trip to Las Vegas worth $2000. Then she goes there and does some tricks with her loyalty card and now she's on an $800 junket.

I worked it out with decision theory and found that they had played the raffle almost optimally -- it blew my mind since I figured anyone who messed with scratch tickets and video slots would have to be completely impervious to probability theory.

Raffles, in generally, are good for people who play to win. My family regularly wins multiple prizes when they have raffles at the school because we're smart enough not to put tickets in for the Battleship game all the boys want or the hula-hoop all the girls want.

There's always some prize which is cooler than the muggles think that it is, and I'll walk home with it.

Now, you never see books about "how to win at raffles" because unlike Poker and Stock Trading, there's no motivation to suck in players who are just a little bit worse than you.

</comment><comment><USER7> <http://www.wired.com/wiredscience/2011/07/broken-lotteries/>

Here's a great article on lotteries, particularly Cash Winfall. CWF was a particularly broken lottery. In a certain season it was possible to purchase enough tickets (say, $100,000 worth) to (almost) guarantee a profit.

[https://en.wikipedia.org/wiki/Massachusetts_Lottery#Cash_Win...](https://en.wikipedia.org/wiki/Massachusetts_Lottery#Cash_Winfall)

<comment><USER8> If I remember that article correctly, I think it's arguable as to whether the lottery was "broken". The lottery commission was aware about the increased odds, but they created a higher odds game due to user feedback. Massachusetts still made money off of the game (though a smaller margin than other games).

I would argue that a lottery's goal is to make money while providing entertainment, and not necessarily create an "unbeatable" game.

The game was shut down because public outcry at what the public deemed "unfair" and not because it was losing money.

<comment><USER9> Changing the odds isn't the same as changing the expected value. Cash Windfall modified the EV of the lower prizes by increasing the value.

<comment><USER8> You're absolutely right, I misspoke.

</comment></comment></comment></comment><comment><USER10> In france some lotteries are broken since forever [1], "everybody" knows it, and nobody cares. Friends of bar tenants gets the gains. "La française des jeux" get the overall gains. The general public is generally fucked more than it should.

[1] tickets are not random but comes in batch with nearly constant amount of various outcomes: the seller, who you tipically ask for your gain, can take note of what happened in each batch and predict if its remaining part is worth being buyed by a friend. Very easy.

</comment><comment><USER11> People who design these games think about security. Sometimes (rarely) exploits get unnoticed and go into production.

I'm confused about why we are supposed to believe that there is anything exploitable about this particular card?

<comment><USER10> Look at all the horror stories of badly written programs or moronic CEO or things like that.

The other parts of the world are fucked up as well. There are probably a lot of "secure" lotteries, but there are probably also a lot of insecure ones.

</comment></comment><comment><USER12> I know of only one guaranteed way to win from a lottery: don't play it.

<comment><USER13> No, the guaranteed way to make money from a lottery is to be the guy selling tickets.

<comment><USER14> Selling lottery tickets can be a losing proposition. In many states, the vendor has to pay for the whole roll as soon as tickets containing half the prize money have been sold. So if I have a roll of 500 tickets costing $5 each, and the first ticket is a $5000 winner and the rest of the tickets only cumulatively win $4999, then I have to pay for the entire roll even though I've only sold one ticket.

<comment><USER15> They tell you when that happens? Sounds like something that could be easily abused by collusion among a few shopkeepers.

</comment></comment></comment></comment><comment><USER16> There's another story you have to read: _The luckiest woman on earth: Three ways to win the lottery_ (<http://harpers.org/archive/2011/08/0083561>). It's for subscribers only, but it's far more interesting than the Jonah Lehrer piece. It's about a woman who's won the lottery (scratch tickets) 3 or 4 times, winning millions each time.

It's been a while since I read it, but as far as I recall, one of the hypotheses about her good fortune (other than luck and some form of inside information) is that she had analyzed how winning tickets are distributed among batches (by cracking the pseudorandom number generator), and tracking which stores are likely to get packages containing winning tickets by the shipping routes.

<comment><USER17> I find it disturbing that some poeple find it so hard to belive that it might just be chance. It's way more likely to be that. The serial number on the cards are either generated in series (1, 2, 3 ...) or just pseudorandom, but they are not tied to any winnings, it's just a series of numbers so that they can keep track of what goes where.

If it's a serie of numbers you have to find out what the chances of a winning ticket in X-amount of tickets, meaning that you statistically have a chance of a price within the range of X-amount of tickets. But the way they have made it, you statistically have to spend more money than you can win in order to do so, or just about break even.

Now, the fun part is that most of these tickets (atleast where I live) come with pseudorandom serie numbers, so even finding the system in how the numbers are generated is going to be hard, if not even down-right impossible given the sample-size you will be able to buy.

And last but not least, lottery makers are not stupid. They've known about this since the dawn of time. Actually some credit the math behind statistics to gamblers. And you have so many level of pseudorandomness to crack, so, when you're done, statistically we can say that the lottery made it's money anyway, and you probably spent more than you won. And the lottery agency just have to change one constant and they are, from your point of view, totally random again. It's a cat and mouse game you cannot win.

<comment><USER18> It would be so trivially easy for them to obfuscate the numbers beyond any reversibility. Seeing the general belief on HN that you can hack any arbitrary lottery with some trivial math is pretty disappointing.

</comment></comment></comment><comment><USER19> Well, there's definitely some that aren't perfect. But how many and which? That's for guys like you to find out.

There are professional "cashers" that have figured out how to hack a small percentile of games in MA. They take advantage of a few things, but if you have $100k you are guaranteed to make a profit. Source: <http://www.wired.com/wiredscience/2011/07/broken-lotteries/>

Now this guy is a trained statistician from MIT and Stanford and has put math behind it. He figured out the tic tac toe game. Source: <http://www.wired.com/magazine/2011/01/ff_lottery/all/1>

So as you can see all games aren't entirely fool proof. Good luck!

<comment><USER20> I remember reading the second wired article in print. I highly recommend it — interesting story, good writing.

</comment></comment><comment><USER21> You don't want theoretical help. You want real-world help. Hang out at the counter where tickets are sold. You're bound to encounter someone who asks what serial numbers the tickets end in. Take that guy out for a drink and find out what he knows, how he knows it, and if it ever worked for him. I've seen several people ask about the ticket serial numbers and not buy, but scratch- offs aren't my thing, so I didn't bother to pursue it. But there's clearly knowledge out there that people have about this. [typo edit]

Also edited to add: Even ask the dealer. He might know something -- although it'd probably be against the rules for him to say anything, even what he's seen. But maybe he can point you to customers who know.

<comment><USER4> Could be those people are just superstitious and only want tickets including their lucky number, or something like that.

<comment><USER22> When I worked at a gas station, it was 50-50 between those with lucky numbers and those with theories about where the prizes fell (i.e. higher tickets were less lucky )

</comment></comment></comment><comment><USER23> I think you need to look up the regulatory bodies for lotteries. They care a lot about this type of stuff, and making sure there is not statistically predictable pattern (essentially the sample size required to find the pattern would be larger then the number of tickets printed). If you do find a pattern, a lot of people will get into trouble because it was their job to make sure that was not one.

</comment><comment><USER24> I confess to trying this myself after reading the Srivastava story. If you step back from the fact that it's a lottery, there's plenty of money involved, "what are you a gambling idiot?" etc it's actually a really fun problem to tackle. I picked out a similar style of ticket and for $20 I kept myself entertained doing analysis and testing hypotheses for the better part of a weekend. Sadly I was defeated on this occasion having found no obvious weaknesses. The main thing I learned from it all was that while a single scratch ticket is fun and exciting, 5 or more get very boring very fast. I was groaning every time a 'free ticket' showed up.

(Also: in Australia you usually see the next 4 tickets on the roll behind a clear display, so if you ended up with a good trick, even if it required running a script on your smartphone, you could have fun with it)

</comment><comment><USER25> Interesting read; I was playing with similar thoughts over my lunch break a couple of days ago.

The base of my sample program [implemented in ruby] was based (in theory) of Proportional Betting "The Martingale" - <http://www.bjmath.com/bjmath/progress/prog1.htm>

The game I picked was "Casino War" [ <http://wizardofodds.com/games/casino- war/> ], as it was very quick to implement in a few lines of code. I selected the base rules as played in Garden City Casino [Bay Area] (50c drop per every $100), and came up with the following:

Game/House Rules: \- 6 deck of cards. \- Played until 1/2 is gone. \- 50c drop for every $100 [Example: $200 bet costs $1, $300 $1.5.]

Betting Rules:

\- Base Bet is always 1% of current wallet, at starting point - $10. \- If the proportional bet can not be covered by wallet, the round is surrendered and the player waits until re-shuffle. [Example: Lost up to $500, next bet is $1000, wallet has $700, game ends/waits and the player accepts a loss of $300.] \- Bets are doubled on loss as defined in the Proportional betting link.

Here's my data, though I believe something is wrong due to its results:

\- I ran the initial program, as is, expecting the player to play one round every day for 10 years. \- Losses and earnings were added together. \- The average win % went to 58.4%. \- The average cash win [the times the player didn't go bankrupt] was $1590. \- Max loss [consecutive] cash $2980. [Bankroll covered over multiple sessions]

* A key point here is the average cash win. It was highly consistent and never below 1500.

I then added a factor that stated in the software:

\- If winnings are at $1500, the player stops, takes the winnings and waits for a re-shuffle.

* Win percentage went up to 64.8% !

If anyone is interested, I'd be happy to share/pastebin the code or similar. Overall, due to the percentages I'm assuming something is wrong with my assumptions/gameplay, but so far an interesting experiment.

[Edited for clarity on betting strategy]

<comment><USER2> That same site has an interesting article on Martingale betting systems: <http://wizardofodds.com/gambling/betting-systems/>

IIRC, a martingale strategy will eventually destroy you because it requires an exponentially sustainable bankroll to maintain the same risk of ruin.

Also, 3,650 hands is far too small of a sample size for a game with such a small edge and you are probably just witnessing positive variance. See where the law of large numbers leads you and run your simulation for 500,000 hands.

<comment><USER26> Yes, Martingale's doesn't raise your expected value above zero/negative for any games of chance. Towards infinity, it won't change your outcome -- you will still eventually loose all your money.

If you factor in the times the player went bankrupt, your win percent probably won't look so hot.

<comment><USER25> Though it did (in the simulation). The accumulated winnings with the limits on bankrupt and cashing out at 1500 created a over time win percentage in a otherwise negative-biased game?

<comment><USER26> By definition, if there is negative expected value, simply changing your betting strategy won't help. Any short term fluctuations would be from "luck".

The famous MIT black jack team was able to 'take down the casino' by counting cards and waiting for expected value to swing positive, and then placing large bets at that time. If the game is truly random and negative (like all well- constructed casino games should be) then there should never been an opportunity for positive expected value.

</comment></comment></comment></comment></comment><comment><USER27> Googling gave me <http://www.scratchoffcodes.com/> I have no idea how legit it is. Never played, but it would be cool to figure out if there was a system.

<comment><USER28> Looks like those are for (three character) codes under the revealable area of the card. Kind of like a checksum for what was won.

Based on the comments it looks like the reliability is a little bit sketchy.

</comment></comment><comment><USER29> Many states publish historical winning numbers from various lottos. No need to buy tickets to do statistical analysis on winning numbers.

</comment><comment><USER5> Hope you get some traction with that project. Would love to see some math wizards look into that.

</comment><comment><USER30> Your sample size is ridiculously small. Also, the fact that lottery companies are well and alive contradicts the very theory.

<comment><USER3> Let's be a little more helpful: the sample size is small relative to the feature space. We even have more variables than observations.

A sample of 43 observations might be reasonable if there were few independent variables and these variables had relatively few possible values.

</comment></comment><comment><USER31> 100 is not a sample set. It is a joke.</comment>


Feminine math, science role models do not motivate girls - <AUTHOR> http://ns.umich.edu/new/releases/20355-my-fair-physicist-feminine-math-science-role-models-do-not-motivate-girls

<comment><AUTHOR> Here is the direct link to the study:

[http://sciencewithart.ijs.si/pdf/Do%20female%20and%20male%20...](http://sciencewithart.ijs.si/pdf/Do%20female%20and%20male%20role%20models%20who%20embody%20STEM%20stereotypes%20hinder%20womens%20anticipated%20success%20in%20STEM.pdf)

I think it brings a negative perspective on the propositions of several people here that assured us that creating role models was the way to go to increase the number of women in science and programming (which would definitively be an awesome thing ).</comment>


I ruined my credit. Will VCs count this against me? - <AUTHOR> (Throwaway account). I have been working on my bootstrapped "startup" for almost 10 years. During those 10 years we have had many ups and downs. We switched business models 3 times - and each time we did this we cut off all revenue streams and started over. The result was personal financial disaster (when I knew we were going to cut off revenues, I took out as many credit cards as I could so my family and I could live). The good news is that our 3rd pivot actually worked out really well. We are now doing about $1M in revenue and growing pretty fast. I am now making decent money ($8-10k/mo gross)...but not enough to pay back all of my debts (I don't even know where to start). My wife has her check garnished (because of my issues) but I have been able to avoid it.
Basically, I decided a long time ago that if the ship went down I was going down with it. I also decided that I would never let that happen...kind of the classic "you don't lose if you never quit" mentality. I have worked my arse off for 10 years and persevered through it all. I have been able to compartmentalize my credit problems and drive my company forward.
I would like to hear from some people "in the know" if my credit issues are going to hurt my chances of getting my company funded. We are ready to take it to the next level and I am afraid that my credit score may be an anchor. <comment><USER2> No.

<comment><USER3> PG, that is a great response; here's a followup: How can he use his company's good standing to restore his credit, if at all?

Or is it just the typical path for him?

Assuming he is doing $1mm in revenues and VCs are interested in investing, is there anything that this investment can be leveraged for to restore credit?

<comment><USER4> Isn't the whole point of the company being a separate legal entity that its credit cannot affect yours and vice versa?

</comment></comment></comment><comment><USER5> This is an amazing interview with Chris Sacca and Kevin Rose: <http://www.youtube.com/watch?v=Q6NpHbMFaQ8> Chris talks about being $1 million+ in debt at one point. Keep going!</comment>


Building on Rock, Not Sand - <AUTHOR> http://robert.ocallahan.org/2017/10/building-on-rock-not-sand.html <comment><USER2> We run high-load web services in something-other-than-c with managed memory and checked array access. It is native, 8/9 as fast as C, and it works. We will never have the budget to pay for the additional 1/9th that C would afford us, in terms of security concerns.

Yet, everyday, I have to field questions about why our low-level, network- facing system code is not written in C... old prejudices die hard.

<comment><USER3> How do you mesure performance against C ? Did you implement a rival unsafe C version to compete with, or is this just a guess ? If so, what makes you believe C would only yield a 10% improvement?

I'm asking because my own gut estimate of the cost of automatic memory management is significantly higher.

<comment><USER4> isn't this exactly the sort of line of questioning that the OP is complaining about?

In my experience of managed software 99.9% of performance problems are due to stupids and 0.1% are due to marshalling and GC costs. An average unmanaged developer seems to assume the opposite.

<comment><USER5> Some managed languages can have pretty good performance, but at significant memory usage cost. Performance is not a single dimension.

It's a very legitimate question to ask how it was measured.

Obviously they're happy with their performance and we can't comment on that, but the other claims regarding speed vs. C were more general.

<comment><USER6> Look at the cost equation. Whatever additional resources they need to spend is a payment for improved safety / security.

It's like saying that a reinforced door with a lock is more expensive and heavy than a regular cardboard-and-planks one, and is slower to open. It is! But is has _other_ advantages, not attainable otherwise.

<comment><USER5> By managed languages I understand memory managed, aka GC languages.

It's not correct to say that they use additional resources to provide memory safety or security.

Python for instance uses additional resources because it simply doesn't have a performant implementation and Java uses additional memory to gain execution speed.

Swift and Rust are memory safe, but don't need a GC, so those memory safety advantages are in fact attainable otherwise.

</comment></comment></comment></comment></comment></comment><comment><USER7> If you really want to build on "rock", check out Bedrock: [http://plv.csail.mit.edu/bedrock/](http://plv.csail.mit.edu/bedrock/) . Don't just prove your program is memory safe, prove it satisfies arbitrary properties! (A bit tongue in cheek, but the tools are really cool). Check out [http://adam.chlipala.net/cpdt/cpdt.pdf](http://adam.chlipala.net/cpdt/cpdt.pdf) for a nice introduction.

<comment><USER8> Very formal sorts of languages are super interesting. They might tend towards striking the wrong balance, though.

Rust is super interesting to me because it prevents the most common vulnerabilities w/regards to memory safety that show up time and again, but it's accessible enough that it's got a big community and a ton of high quality libraries. I think that's a pretty awesomely potent combination.

<comment><USER9> For the short term and mid term yes. However I do hope that in the long term the ideas from ATS, Liquid Haskell, Idris, F*, etc. will be iterated on in order to make them more accessible and usable. In the mean time we'll probably start to see Rust graft on more and more correctness tools like dependent types and SMT solvers, and it will begin to get a little ungainly, like dependently typed Haskell is. But there's only so many ideas you can try out in a new language, and Rust has made the right decisions on that front in the interests of getting into production this decade. :)

</comment></comment></comment><comment><USER10> Note that you _can_ write safe C code. seL4 is written in C! (And verified in Isabelle.) If that is too hard core, PolarSSL is a normal looking C code, which still has been proved to lack any buffer overflow. [https://trust-in- soft.com/polarssl-verification-kit/](https://trust-in-soft.com/polarssl- verification-kit/) has details.

On the other hand, it probably is less effort to rewrite PolarSSL in Rust than doing that proof.

<comment><USER11> I think the seL4 kernel rather proves that you can write safe haskell, verify it, and then transpile that to C.

That's different from directly writing C...

<comment><USER12> in the end the idea is that if you are semantic aware, then everything is safe; it's just operations from exp -> env -> store to env -> store etc etc

<comment><USER6> Indeed! You can write safe programs for e.g. the original Turing Machine.

But I _bet_ you'll end up writing tools to make creating a safe program of any non-trivial size feasible. A large class of these tools is usually called "programming languages".

</comment></comment></comment></comment><comment><USER13> I'm always confused by the "safe language" evangelism. Reducing cognitive load is a Good Thing TM; I get that. But aren't we just trusting the Rust compiler and JVM to not have subtle bugs that introduce memory management errors into our programs?

Centralizing the memory management code to some well tested core---like the Rust compiler or some C lib---sounds to be the crux of wiring memory safe code, not the language.

<comment><USER14> > But aren't we just trusting the Rust compiler and JVM to not have subtle > bugs that introduce memory management errors into our programs?

Empirically, programs written in memory-safe languages produce multiple orders of magnitude fewer memory-related bugs than C and C++ codebases do.

> Centralizing the memory management code to some well tested core---like the > Rust compiler or some C lib

That isn't practical in C (or in C++). "Memory management" here means "pointers", and you can't program in C or C++ without pointers.

<comment><USER15> How many buffer overflows were involved in the Equifax leak?

The ultimate solution to the problem is formal verification. Rust solves this for buffer overflows, but nothing else. It's a one trick pony. Someone posted this interesting nugget on HN the other day:

      https://www.youtube.com/watch?v=zt0OQb1DBko

Aside from some of the awkward ergonomics, its mechanism for formal specification looks brilliant. And you get to keep C's bag-of-bytes object manipulation and pointer arithmetic (when you want it) without having to resort to unsafe{}.

For projects where it's worth the effort to carefully declare precise typing semantics (because safety, performance, whatever), I want a wholistic solution. Otherwise my time and money is better spent throwing Javascript or Python at the problem, which solve the buffer overflow problem just as well.

<comment><USER14> > Rust solves this for buffer overflows, but nothing else. It's a one trick > pony.

Completely false. Rust's design prevents all memory safety problems (that's what "memory safe" means). Buffer overflows aren't even the most pernicious kinds of memory safety problems anymore. Use after free is worse, and Rust spends most of its complexity budget on preventing that.

<comment><USER15> I spoke poorly. My point was that memory safety is but _one_ issue of a far larger problem. And Rust indeed solves it, or at least Rust provides an ergonomic environment for writing solutions that are memory safe. Which is different than saying it's easy to do this in an absolute sense. But certainly writing a program in Rust without using unsafe{} at all is still easier and more ergonomic than using other systems (e.g. annotation based frameworks which weren't baked into the language from inception) for equivalently safe behavior.

But if you watch the video, the presenter makes a great point: Rust's borrow checker is an amazing piece of technology, but it's inaccessible to the programmer. It's an implementation detail used to provide proofs for a narrow constraint--memory safety. Imagine if Rust provided syntax and semantics which not only allowed you to effectively implement the borrow checker yourself using a more general declaration system, but implement any other kind of formal specification needed to prove the higher-level semantics of your code.

In other words, imagine if a more general formal specification system were as first-class as the ownership- and mutability-oriented syntax are in Rust; a language that unifies the annotation model of solutions like Ada SPARK and Frama-C, but which is properly integrated into the language.

And that's what ATS is exploring. As the presenter says, ATS might be ugly as a systems language (because misallocated complexity--some easy things are too complex, some complex things are too easy--increases cognitive load and reduces efficiency), but its mechanism for formal specification is brilliant. Improve ATS, or apply it's novel approach to a language designed as a daily driver, and you'd finally have a realistic answer to the plague of buggy infrastructure software.

I realize this sounds like I'm making perfect the enemy of the good here. But I stand by my point: major failures like Equifax rarely involve memory safety, per se. Arithmetic issues are far more common, and even those are on the long tail of a much larger issue; namely, an inability to [efficiently] provide verifiable specifications for higher-level semantics. We hyper focus on buffer overflows, arithmetic overflows, etc, because we understand them and we know (at least in principal) how to fix them. But those are psychological blinders that cause us to miscalculate relative risks. We tend to overestimate the cost of problems we can fix relative to the cost of problems we're unsure about how to fix.

<comment><USER16> Full verification is extremely expensive, not just to create the proofs, but also to maintain them as the software evolves. Telling C programmers to go directly to full verification is, indeed, making the perfect the enemy of the good.

And you are missing an important point here. Once you have a reasonably sound and rich type system, you can leverage the type system in library API design to eliminate classes of higher-level bugs. For example, Rust crypto libraries can leverage Rust's affine type system to ensure you don't use a nonce more than once. The Apache Struts vulnerability was about failing to distinguish trusted vs untrusted input; that distinction can be expressed and checked in type systems.

</comment></comment></comment></comment></comment></comment><comment><USER5> What if there is just not enough interest in improving C++'s safety? Or in improving safety at all? That's the scary thought.

I also have to point out that these pesky C buffer overflows are trivial to avoid in C++: just use std::vector::at.

</comment><comment><USER17> If someone thinks that compiler for their favorite programming language provides safety they have no idea what safe code is.

C/C++ is used to write safe code for medical and aerospace applications every day. The compiler for the languages like C, C++, Ada, Rust or whatever, is not enough.

You can get better static and dynamic code analysis and test coverage analysis tools for C/C++/Ada than you can for Rust.

<comment><USER18> > C/C++ is used to write safe code for medical and aerospace applications > every day.

How comes we still catch lots of errors in reviews there? How comes that the best paying gigs for c/c++ coders are all code review? Best practices and an excellent toolchain don't help if they are not used. A compiler/language that enforces those is a giant leap forward.

> You can get better static and dynamic code analysis and test coverage > analysis tools for C/C++/Ada than you can for Rust.

Of course, but comparing the toolchain of a relatively new language with those of languages into which - literally - billions of dollar were put does only make a temporary point. And with lessons learned from those billions incorporated into the design of the new language, closing the gap will be much, much less expensive and time consuming than the initial development for the languages you mentioned.

<comment><USER5> What makes you think that a team which doesn't follow practices or uses their excellent toolchain will use Rust properly (without unsafe at any step) or even at all?

Not sure what you mean about code review. Security reviews? I guess that's because C and C++ are easy to misuse and most programmers, teams and companies aren't that good at writing correct or safe code.

But we already knew that and the solution is not as easy as switching to a different programming language.

<comment><USER14> > What makes you think that a team which doesn't follow practices or uses > their excellent toolchain will use Rust properly (without unsafe at any > step) or even at all?

Rust tends to push you away from using unsafe all the time. Unsafe is a pain to use, because you don't have all the nice pointer operators you do in C and C++, so programmers naturally default toward working in the safe language. Even if you use unsafe more than you should, Rust tends toward much safer code than C and C++ in the aggregate. (This has been observed empirically.)

> I guess that's because C and C++ are easy to misuse and most programmers, > teams and companies aren't that good at writing correct or safe code.

If you replace "most" with "virtually every" (i.e. everyone who isn't writing avionics/defense/aerospace/etc. code), I agree.

> But we already knew that and the solution is not as easy as switching to a > different programming language.

Programs written in C and C++ empirically have far more memory safety related problems than programs written in memory safe languages do.

</comment></comment></comment></comment><comment><USER19> Nothing comes for free. I expect to have to trade something for security. It seems we have to trade speed and size. Ok, it shouldn't matter to us: this should not be developers' call. Instead it should go into a costs benefit matrix with plenty of other technical and not technical stuff. Developers will advise on their part of the matrix, marketers on their own, etc. Managers will make the decision and be held responsible for security breaches (or plauded for the lack of) as much as for every other feature of the product.

<comment><USER10> > It seems we have to trade speed and size.

Why do you think so?

<comment><USER19> I might be wrong but it seems that the new safer languages don't run as fast as C and create larger binaries. But that's OK if safety is valued more than speed and size.

<comment><USER10> You might be wrong. Rust is as fast as C and creates binaries as small as C.

</comment></comment></comment></comment><comment><USER20> Talk is cheap; show me the code. There's a lot of talk about rewriting some crucial pieces in Rust but no actual work to follow it.

<comment><USER21> [https://github.com/bluejekyll/trust-dns](https://github.com/bluejekyll/trust- dns)

<comment><USER22> Fyi... that Rust project doesn't actually cover the functionality of dnsmasq.

Dnsmasq also includes a _DHCP server_ and the ability to read a blacklist to act as an _ad blocker_. In contrast, the "trust-dns" project is more of a replacement for the "bind" program instead of "dnsmasq".

If your intention was to only show that "non trivial Rust code exists", that's fine. However, some others might get the wrong impression that it's a Rust version of dnsmasq.

</comment></comment></comment><comment><USER23> Getting rid of C is like gun control. There are irrational, emotional attachments.

<comment><USER24> Foot-gun control. Ha!

</comment></comment><comment><USER25> It would be nice to have more healthy competition in this space. Any suggestions?

Would it not be great to have a language as powerful as Rust but with the ease of Go?

Anyhow, must be like CAP. You can't have everything in a language.

<comment><USER26> When Mozilla first sponsored Rust, it was with the goal of being the fastest memory-safe language around; at the time, it was thought that that required garbage collection. Only later (2011 or so), with the application of some comparatively recent research, did it progressively become apparent that it was in fact possible to have a practical memory-safe language without garbage collection; Rust progressively lost its garbage collected types (the @ sigil), and steadily settled down to its current model, which requires strong ownership to make it memory-safe and references + lifetimes to make it useful (otherwise you have a straightforward linear type system, which while functional is not very useful for fast code—you need references for that!).

The hard part of Rust is strongly tied to ownership and lifetimes. You can't get rid of them and keep memory safety without introducing garbage collection on at least _almost_ everything. And thus you're roughly at Go.

<comment><USER8> Happen to have a link to the research that relates to this? I've been trying to up my CS-paper-reading game.

<comment><USER26> A quick search based on certain keywords I remembered yields [https://www.reddit.com/r/rust/comments/2d94tu/is_there_any_a...](https://www.reddit.com/r/rust/comments/2d94tu/is_there_any_academic_background_for_rusts_static/) which may help. Regions is the key thing. But right now I'm going to bed.

<comment><USER8> Thanks :)

</comment></comment></comment></comment></comment><comment><USER27> Novice question: isn't rust fatter?

<comment><USER9> Great question. There's and FAQ on that: [https://www.rust-lang.org/en- US/faq.html#why-do-rust-program...](https://www.rust-lang.org/en- US/faq.html#why-do-rust-programs-have-larger-binary-sizes-than-C-programs) \- tl;dr is that it is by default but you can slim it down to the same size as a C executable if you need to.

</comment></comment><comment><USER28> Another rust proponent lecturing the world on how they should rewrite everything in rust. _yawn_

<comment><USER26> Robert is an expert C/C++ programmer, but understands the problems with those languages, which has led to articles like [http://robert.ocallahan.org/2017/07/confession-of-cc- program...](http://robert.ocallahan.org/2017/07/confession-of-cc- programmer.html).

Robert is now a Rust proponent _because it works_.

From today's article, I think this is the money quote:

> My sincere hope is that people will at least stop choosing C for new > projects. At this point, doing so is professional negligence.

<comment><USER5> I don't doubt they're a competent programmer, but I do have some doubts that they're an expert in C++. Two reasons why:

1) They made incorrect claims about C++ in relation to Rust before: [http://robert.ocallahan.org/2017/02/what-rust-can-do-that- ot...](http://robert.ocallahan.org/2017/02/what-rust-can-do-that-other- languages.html?m=1) and [http://robert.ocallahan.org/2017/04/rust- optimizations-that-...](http://robert.ocallahan.org/2017/04/rust- optimizations-that-c-cant-do.html?m=1)

2) The Mozilla C++ code base is old and very raw pointer/reference heavy and it doesn't seem to be written with safety in mind.

Their wikis also don't have any particularly good security guidelines. Maybe the good stuff is kept private, who knows.

Saying that someone was a distinguished engineer at Mozilla is not saying much about their abilities of writing modern or safe C++.

<comment><USER16> Hi!

Yeah I made a mistake once. It happens.

If having a PhD in computer science (programming languages), being reasonably smart, and using the language for 20 years (up to and including most C++14 stuff) doesn't make you an expert in that language, then your language is far too difficult.

In fact, C++ _is_ far too difficult and there are very few genuine experts in it. For example, who can explain why using push_back on a vector<map<T,unique_ptr>> is not conformant to the Standard, without looking it up? (I'll save you some time: [https://bugs.chromium.org/p/chromium/issues/detail?id=683729...](https://bugs.chromium.org/p/chromium/issues/detail?id=683729#c25))

There's also a definitional bait-and-switch going on here. C++ proponents use "C++" to mean "the language that lots of projects have been using for 20 years and lots of programmers know" when espousing its popularity. But when necessary, the meaning changes to some "'modern', 'safe' subset of C++" ... that few programmers know well and few projects stick to rigorously. The exact definition of that subset changes depending on the situation, too.

<comment><USER5> Hi. In the linked "confessions" blog you've taken the path of making some claims about a topic and supported them through who you are, instead of facts. People who disagree with your claims will question if who you are is relevant.

C++ is difficult, and there are few experts. My thesis is that one doesn't need to be an expert to write safe C++ code, but they do need access to quality libraries focused on safety, and good practices focused on safety. Banning some unsafe C functions, saying "use smart pointers" or making a list of UB is useful, but not enough.

C++ can be written much more safely than it normally is, but it seems that's not happening. I'm not sure why, it could be that the performance loss of additional runtime verification is not acceptable, that the adequate learning resources are not available or that it's not an important topic for the C++ community.

P.S: I'll gladly have the kind of error you linked to. It's at compile time, I will try to figure it out and worst case rewrite my code. UB is the problem.

</comment></comment></comment></comment></comment><comment> anon-123 C++ is not C. They are two totally different languages. Boundaries and overflows are not an issue in C++ like they are in C. I have no idea why people can't understand this.

<comment><USER10> Because it is not true. C++ is not memory safe. Especially, C++ is not very good at handling use-after-free.

<comment><USER5> It's not memory safe, but with some good practices and library support it's in a different league of safety compared to C. Just the availability of smart pointers, vector array and string puts it waaay ahead of plain C.

The bugs in dnsmasq were buffer overflows. In this case, the good practices would be always use std::array and std::vector and index with "at".

Tackling UAF is more complex. It involves using smart pointers exclusively with a runtime-check on dereferencing. This will result in some performance loss.

P.S: I'm not saying it trivial to secure C++ code, nor that every project out there is using these techniques. It's a worthwile task to try to make existing C++ projects as safe as possible, and that's an effort parallel to Rust which should have very beneficial results.

</comment></comment></comment><comment><USER29> _Contrary to the quote, given a finite "amount of budget", dnsmasq could have been Rewritten In Rust and these problems avoided._

Ah, I see the Rust evangelism strike force is back. n-gate.com is right, as usual.</comment>


What if we were all Uber drivers? - <AUTHOR>

I just had an idea. What if there existed %50 of the cars that exist in US today, but they were freely available for everyone. What's the catch? You have to pick up people on the way to where you are going. There will be a cloud system that similar to Uber, where people input where they need to go. If they see a car standing, they can just start driving it. If there's someone who needs picking up on the way, they do it. Each person will have a card they scan when the get in the car or drive it. This way you identify cheaters (those who didn't pick up appropriately). What do you think? <comment><USER2> Here are some of the things that can go wrong:

1) some teen drivers are not allowed to drive at night. Some people have a suspended license and are legally restricted to only driving to/from work or to/from school. These people might not be able to participate. How are the restrictions added to the system?

2) My timing is tight. Work ends at 4:00 and I have to pick up the kids from day care by 4:15. It's a 10 minute drive. Do I schedule a pickup every day or do I chance that I might be required to detour for someone else?

3) I live in the countryside about 10 minutes drive from the nearest neighbor. Do I get to have my own car? If not, how long does it take to get a ride?

4) I live on an island where the ferries to the mainland only run during the day, and I want to take the first ferry of the morning. How do I arrange a 5am drive if there are no cars on the island, or none close to me? What if there was a storm that prevented the ferry service from running the previous day?

5) Does the scheduling system know the ferry schedule well enough to know if a pickup is even possible? What if I and the car are on the ferry going from A to C, with a stop to load/unload at B, and there's a notice for a pickup at B. It's not possible to unload, pickup, and load in the short time the ferry is at the harbor, and the next ferry is an hour later. Am I penalized for declining the ridiculous assignment?

6) I do social work and visit 12 residences each day. If I partake in this system, will it introduce enough variability that I have to reduce the number of home visits I make?

7) I am moving and the car is full of boxes and luggage. (It took an hour to load everything.) Do I still have to pick up other people?

8) I suffer from social anxiety disorder and have difficulties dealing with strangers, including as a driver or as a passenger. Do I still have to participate or is there an ADA exception?

9) I have a restraining order on me which prevent me from being within 1,000 feet of my ex-spouse. I'm scheduled to pick up someone from next door to said spouse, and that address is well within the exclusion range. What do I do?

What is the resolution process should there be a conflict between what the system expects that you can do, and what the reality is?

<comment><AUTHOR> While you are correct, Many of the points apply to mass transportation in general, and society might no have a choice due to environmental/growth/resource problems.

<comment><USER2> I don't understand your statement.

Mass transit is a different issue. A good mass transit, which holds to a schedule, does not have the same built-in variability that an "everyone is an Uber driver" scheme has.

My ferry example, for example, _is_ mass transit. If I live in the countryside, and have an hourly bus or even twice daily bus, then that's both a maximum time to wait, and a schedule I can plan on, while Uber for that case will be highly variable and therefore difficult to plan around.

Other issues are only specific to the Uber case. If there are no personal vehicles then there's no need to worry about teen drivers with a sunset driving curfew or people with a restraining order who are nevertheless obligated to pick up a passenger.

I am hard pressed to think of a future where "society might no have a choice", but where your proposal makes any sense.

<comment><USER2> In any case, the examples I gave were lead-up to "What is the resolution process should there be a conflict between what [your proposed] system expects that you can do, and what the reality is?" Your followup didn't address that point.

</comment></comment></comment></comment><comment><USER3> This will happen with Uber + self driving cars. Car capital will just concentrate, and we will all rent it went we need it from well organized network of company cars.

<comment><AUTHOR> Will we be picking people up on the way? like uber drivers? because that would be the real value.</comment></comment>


New US synthesizer company with first rechargeable analog synth - <AUTHOR> http://playsuperlative.com <comment><USER2> It's a product on kickstarter (Funded. At time of posting it has 197 backers and 35 hours to go):

[https://www.kickstarter.com/projects/superlative/sb01-analog...](https://www.kickstarter.com/projects/superlative/sb01-analog- synthesizer-of-the-future)

Neither the website nor the kickstarter is particularly forthcoming about who Superlative(TM) are. Curious.

</comment><comment><USER3> This looks a lot like a X0XB0X with better case design and a battery. Which is pretty nice. The 4-Pole OTA filter is the Roland TB-303 one that people seem to like, again, like the x0xb0x. Hmmm. I hope they are giving credit where its due.

<comment><USER2> The TB-303 uses a diode ladder filter, not an OTA filter.

[http://www.timstinchcombe.co.uk/index.php?pge=diode2](http://www.timstinchcombe.co.uk/index.php?pge=diode2)

[http://www.timstinchcombe.co.uk/index.php?pge=diode](http://www.timstinchcombe.co.uk/index.php?pge=diode)

I'm pretty sure that the Jupiter 6 and Jupiter 8 filters use OTAs. Perhaps that's what you were thinking of.

<comment><USER4> you're both in the right realm insofar as thinking of 1980s Roland gear, but this is very much a modernized tribute to the SH-101 to the point that it more or less shares not only the functional side but also the control layout and aesthetic of the SH-101.

It seems like this could be a very nice unit, although far from the first modern thing to recreate the SH-101 (for a very recent example, see Behringer's attempt)

That being said I find it a bit odd to make such a fuss about rechargeable batteries as the original Roland unit already had battery power (as did the TB-303 and TR-606). You can simply put rechargeable batteries in them.

Worth noting that you can still buy the original Roland SH-101 for less than even the "early bee" price on kickstarter.</comment></comment></comment>


Are App Developers Gullible? Response to Mobile Dev Economics Report  - <AUTHOR> http://www.mobileinternetrevolution.com/visionmobile-mobile-developer-economics-report-some-thoughts/ <comment><AUTHOR> there's a couple of questions here I'd love to get opinions on: a) is android really winning 'developer mindshare'? b) if so, why?</comment>


What the heck is an xrange? - <AUTHOR> http://late.am/post/2012/06/18/what-the-heck-is-an-xrange

<comment><USER2> Nitpicking, but this statement doesn't work with large numbers (which xrange() is supposed to handle correctly):

        self._len = int(ceil(float(stop - start) / step))

Python supports arbitrary-length integers; you can't just cast those to (fixed-length) floating point numbers without losing precision. It's better to use integer division here, for example:

        self._len = (stop - start)//step + bool((stop - start)%step)

(A variant like (stop - start + step - 1)//step works only for positive numbers; I guess it could work if you put it in the earlier if-clause and put a corresponding assignment with +1 at the end in the other branch.)

<comment><AUTHOR> Great catch. If you want to submit a pull request on github you can get the credit -- github.com/dcrosta/xrange

<comment><USER2> Thanks for the consideration, but I don't really use github, so you go ahead and take the credit yourself.

<comment><AUTHOR> OK, thanks. Updated in github and on the blog.

</comment></comment></comment></comment><comment><USER3> Nice.

As a side-note, here's a related article on implementing a Python generator "for real" using the C API: [http://eli.thegreenplace.net/2012/04/05/implementing-a- gener...](http://eli.thegreenplace.net/2012/04/05/implementing-a- generatoryield-in-a-python-c-extension/)

</comment><comment><USER4> I didn't expect to learn much when I started reading this, but I was wrong. Excellent post. Thanks.

</comment><comment><USER5> I had a _very_ similar question during my Google interview. In the course of the day I was tasked with implementing a generator (although answering with `(x for x in foo)` got a smile I did have to build a class) and later in the day was asked how a sequence manager can maintain constant time.

This is an excellent post and every Python hacker should read it. Kudos to the author.

</comment><comment><USER6> This is cool. I know this isn't how they actually do it, but seeing it in a language I can understand (Python) and not in C is really pleasing.

You can do tons of examples, but until you figure out how the machine works inside, you'll be completely lost (you could get it with examples, but you won't necessarily know WHY you got it, so you'll be useless in helping other people learn).

</comment><comment><USER7> Does anyone know how this is implemented in Pypy?

<comment><USER8> [https://bitbucket.org/pypy/pypy/src/default/pypy/annotation/...](https://bitbucket.org/pypy/pypy/src/default/pypy/annotation/builtin.py#cl-53)

</comment></comment><comment><USER9> Not worth a pull request, but personally I'd replace:

            if len(args) == 1:
                start, stop, step = 0, args[0], 1
            elif len(args) == 2:
                start, stop, step = args[0], args[1], 1
            elif len(args) == 3:
                start, stop, step = args
            else:
                raise TypeError('xrange() requires 1-3 int arguments')

with:

            map = [
                    lambda args: (0, args[0], 1),
                    lambda args: (args[0], args[1], 1),
                    lambda args: args,
                  ]
            try:
                start, stop, step = map[len(args)](args)
            except IndexError:
                raise TypeError('xrange() requires 1-3 int arguments')

It's more DRY, and it conveys the intent better.

I would _not_ do such a change to the _if step_ block since its pattern feels noticeably different: "open" checks fit well in a _if/else_ , whereas bunch- of-equalities fit a dispatch map better (plus you can actually modify the map at runtime).

<comment><USER10> To me your version is less clearer than the explicit if calls:

* Name 'map' for a variable is a poor choice (as it has same name as the python builtin function map)

* Your version has off by one error, it doesn't give correct results when called with a single element list or if the list has three elements:

      >>>mymap = [
                    lambda args: (0, args[0], 1),
                    lambda args: (args[0], args[1], 1),
                    lambda args: args,
                  ]

      >>>args = [5]

      >>>mymap[len(args)](args)
        IndexError
        Traceback (most recent call last)
        ....
       # This shouldn't be the case, a list with a single
       # element is a valid input

      >>>args = [1,6,1]

      >>>mymap[len(args)](args)
        IndexError   Traceback (most recent call last)
        ...

       # This shouldn't be the case, a list with a three
       # elements is a valid input

<comment><USER11> If only lambda's allowed statements :(.

      >>>mymap = [
                   lambda args: raise IndexError,
                   lambda args: (0, args[0], 1),
                   lambda args: (args[0], args[1], 1),
                   lambda args: args,
                 ]

That aside, this approach would be much slower too.

</comment></comment></comment><comment><USER12> Answers to [http://stackoverflow.com/questions/1482480/xrange2100-overfl...](http://stackoverflow.com/questions/1482480/xrange2100-overflowerror- long-int-too-large-to-convert-to-int) contain several implementations of xrange() in pure Python

<comment><AUTHOR> Thanks, hadn't seen this.

</comment></comment><comment><USER13> I cried a little bit on the inside when he said that that the iterator should not be implemented using generators, etc. Writing iterators by hand forces one to turn the iteration code inside out and it can be a painful experience if the logic is anything nontrivial.

<comment><USER14> But there's a good motivation here: (x)range objects are supposed to be index- able, while a generator (expression) cannot go back once an element has been consumed.

</comment></comment><comment><USER15> I feel that this kind of combination of lazy evaluation for sequences, together with eager evaluation for imperative code hits a particular sweet spot. Python and Clojure have very nice lazy sequences.</comment>


Breakthrough in understanding time - <AUTHOR> http://www.designerscience.com/ObjectiveRelativity/time-what-it-is-how-it-works-2/

<comment><AUTHOR> Stephen Hawking, Brian Greene, Alan Guth, Sean Carroll all talk about what seem to be phenomena related to "time" but all seem baffled by what time is at the most fundamental level.

Einstein said "God is subtle but He is not malicious." Time falls into the subtle category, but when you "see it" its as obvious as the wheel.</comment>


New demand for old farm tractors because they're low tech - <AUTHOR> https://boingboing.net/2020/01/06/new-demand-for-very-old-farm-t.html <comment><USER2> Discussion: [https://news.ycombinator.com/item?id=21971545](https://news.ycombinator.com/item?id=21971545)</comment>


Send all of your garbage to Sweden, please  - <AUTHOR> http://dvice.com/archives/2012/10/send-all-of-you.php <comment><USER2> "Let this be a lesson to you, American voters: when you live in a highly developed ultra modern welfare state like Sweden, with excellent healthcare and many other public benefits, the system is secretly so unstable and broken that the entire country is desperately trying to import trash."

Utter inanity laced with superfluous balderdash...

This article reeks of an ill-informed (probably way right of center) American who has never set foot on Swedish soil. Instead of an intelligent discourse around how the Swedes are more efficient with processing trash, or how technology has been developed to make refuse processing more productive, the writer says something like

"Clearly, the takeaway for the rest of the world should be this: recycling leads to an energy crisis, socialism means that there will be no more heat or electricity ever, and Sweden is a weird, weird place."

Huh? Really? While I was in grad school in Sweden (the Royal Institute of Technology, KTH), as an American, I was struck by how much Swedes value preservation of the environment. Even at the university level, you can see how many research dollars went into studying green technology and directly applying environment-friendly best practices in society and industry.</comment>


Easiest path to $2000 a month? - <AUTHOR> http://discuss.joelonsoftware.com/default.asp?biz.5.820663.27

<comment><USER3> I wonder if people are being unnecessarily negative on this discussion thread. It seems to me that his best bet is to start something that he can manage in his spare time that solves a problem. That's not easy but it's not horribly difficult either. I was able to bring a product to market in my spare time and recruited sales people to sell it. I have even lined up speaking gigs at conferences in my vertical (no idea if I'm actually going to be any good at this).

I realize that this person is different than me but I did it for a similar reason: I have to make extra money to provide for my family in the long term. Consulting actually seemed harder to me because you need to put in a consistent amount of time and if you have a family that's very hard to do. I still work a job during the day but my evenings are spent largely improving my product and writing marketing copy for the website I'm having designed.

<comment><USER4> Yes, they are overwhelmingly negative because they have all struggled and mostly failed.

Taking years to get to $2,000/mo revenue as some of the commenters say? That is truly sad. Somebody seriously needs to teach these guys some business skills.

Hopefully it will be me.

I wrote a positive comment - I've made gobs of money and my SaaS made $1300 its very first month, after the first round of trials ended. And the reason is because I created a truly different product in a category proven to make money, and used my blog/twitter audience to spread the word as I was launching (and before).

It's really, really, really not that hard.

<comment><USER5> What was your SaaS? (I didn't see a link in your profile)

<comment><USER6> She recently posted about it here that led to a very interesting (and useful) discussion: <http://letsfreckle.com/>

HN Post: <http://news.ycombinator.com/item?id=1366862>

</comment></comment></comment></comment><comment><USER7> You need $2000 per month? You must add at least that much extra value into the world to get it. The reason people who responded to the original post suggested consulting is because consulting is value creation that is very well defined by the person requesting it. If you want to create value in software, in either desktop, iphone OS, or web apps, you have to look where there is pain in some market, and see if the pain is worth $2000 to solve. It's not a question of platform, but a question of market and value.

<comment><USER8> With mobile "games" it's not about pain, it's about pleasure. If you can show someone a good time for 24 hours, you can get $2 from them.

Therefore, in the app world, you are in the "I'll tickle you for $2 business" and you just need 1000 customers a month.

<comment><USER9> Now that we have mobile games, people have begun to experience "boredom at the train station" as pain, and "getting tired with old games" as pain too.

People will try harder to get themselves from pain back up to baseline than to get themselves from baseline to happiness. And once they reach happiness for long enough, that becomes the new baseline.

</comment></comment></comment><comment><USER10> One comment in thread stood out for me: "Since your problem is medical bills, it seems extremely obvious that you need to switch to a job that has a better benefits package."

The poster simply stated she needs an extra $2,000 a month for medical reasons. Why? Medication? Visits to a specialist? If the extra $2k is needed because what she needs isn't covered under her current employer's benefits, job shopping is probably a better way to spend her free time.

<comment><USER11> Good point, but maybe the money is needed for a relative that won't be covered anyway?

Anyway, how about a move to a country with socialized health care? (Canada?)

<comment><USER12> Socialized health care is not the same as having money to pay for treatment. Some Canadians go to the US to get treated for cancer.

In Denmark there is also government healthcare, but some people, including politicians, still pay private hospitals for treatment.

<comment><USER13> Canadians go to the US for treatment because they either want to get treated faster than it is possible in Canada or they want or need a method of treatment which is not available in Canada. (The latter is not terribly surprising if you consider population sizes.) Nobody would go for US treatment because of money issues.

</comment></comment></comment></comment><comment><USER14> They are right in that it just does not happen that fast. Furthermore, trying to make cash when you are under pressure to make cash rarely works - <USER2> who need cash quickly usually don't have the time or the patience to successfully bring a product from conception to release.

One first has to solve the cash issue before trying to build a product. Building a product from dire straits rarely works.

</comment><comment><USER15> $2000 a month? Find a large quantity of text that isn't on the Web that people might search for, put it online, and put AdSense ads on it.

<comment><USER16> I really hope you're kidding...I would venture a guess that there are no more than a handful of people in the world making more than $100/month in adsense, even with a lot of content sites

<comment><USER17> I'm smallfry and do $3-4k/month through AdSense for about 10 minutes/week effort tops from a handful of sites.

<comment><USER16> Well you sir would then be a member of that handful. The income on the Adsense network is just like the income distribution of America: 1% control 80%.

<comment><USER17> I think you're underestimating the number of people who'd be doing OK out of it.

You said, "I would venture a guess that there are no more than a handful of people in the world making more than $100/month."

A handful would be fewer than a dozen, surely? There'd be thousands making more than $100/month. Actually, there'd be thousands making more than $10k/month IMO.

<comment><USER16> meh, I guess my idea of what I thought a handful of people meant was lower than everyone elses opinion. By handful, I mean a small percentage. Since there are so many publishers on Adsense, a small percentage of that is still a good amount of people.

<comment><USER17> Saying "small percentage" would've removed that ambiguity.

Now, regardless, the majority trying AdSense make bugger all because they're clowns, half-arsed, give up early, don't know what they're doing, etc. Anyone with either some luck or a half-decent plan, some ability and persistence can build up some passive income or at least give it a shot for free.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I've done it. I consistently make over $2.5k a month selling iPhone apps. At my peak I made a little under $5k. It kinda sucks at times as it's not just one app. To be honest, most people would consider them shovelware, but if you actually download them you'll see that they provide value. You can read my story here: <http://techneur.com> I should mention though, it didn't happen overnight and it took about five months or so to get to this point.

</comment><comment><USER19> Consulting in a hot area like iPhone apps or something, I'd say. Creating and selling some products is much more risk-prone.

</comment><comment><USER20> I've thought about this some more, and I've come to the conclusion that by the time you need $2000/month more, it's almost too late.

The problem is that by aiming for such a small amount you're going to be looking at marginal solutions to marginal problems.

You're better off, in my opinion, aiming for 10 or 20,000 a month and hitting 2,000 than trying to max out at 2,000, and probably hitting 200.

</comment><comment><USER21> 30 hrs/week * 4.3 weeks = 130 hours in a month. $2000/130 hours = $15/hour

You can take on freelance writing gigs that pay the equivalent of $15/hour pretty easily. And these have the extra benefits of being incredibly flexible in regards to work hours, can start pretty much immediately, with no real sales effort required.

<comment><USER22> Where would one find these freelance writing gigs?

<comment><USER21> There are dozens of postings here: <http://sfbay.craigslist.org/wri/>

And don't limit yourself to your local city, look in all the major cities in North America. At any given time you'll see a few dozen freelance writing/editing gigs in the San Fran, NYC, Toronto Craigslists.

You also have sites like Associated Content, Hubpages, etc. And actually, in its heyday Mahalo was probably a pretty good place to make decent money for the right people.

I don't think sites like Squidoo, Knol, and the new Mahalo that do rev share are good sources of income. I mean, they can be, but it's probably almost as difficult to make money on those sites as it would be to start up your own content site. Being paid per article/report is the best way to do it - from a writer perspective. Rev share is the best way to do it from the site's perspective.

If you're in Canada: <http://apply.productwiki.com>

</comment></comment></comment><comment><USER23> >Hard work doesn't scare me but consulting is off the table due to restriction at my workplace.

What "restrictions"? You have a (most likely verbal) contract with your employer to provide your effort in exchange for money. They don't own you and any clauses they have that restrict what you can do when you're not there or don't even work for them anymore are probably not enforceable. Especially when this dubious claus is holding you back from money you need.

Just because a contract says something, even if you _signed_ it, doesn't mean it can actually be enforced.

<comment><USER19> "a (most likely verbal) contract" => most likely he actually has a signed contract, no? Why do you think otherwise?

<comment><USER23> The US goes mostly on verbal contracts for permanent employees. I don't personally know of any non-executive exceptions, but there must be some.

EDIT: P.S. Even if it's a signed contract, that still doesn't mean it's enforcable.

<comment><USER22> The US also goes on at-will employment, so regardless of how legally enfoceable his contract may be (in that they can't sue him for violating it), they can fire him for violating it.

<comment><USER23> Some states are at-will employment. I would avoid working in those states, they give the employer way too much power over the worker.

<comment><USER24> LOL. All states except Montana have at-will employment, albeit that the nature of exceptions varies across states. Where do you live?

<comment><USER23> I always lived in an at-will state, but I wouldn't ever go back there to work. I was under the impression that the states were either Union (California?) or "Right to work".

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> If he absolutely needs the extra $2000 _this_ month, consulting may be the wrong way to go. Say you bill for 20 hours at $100 an hour to a company and they pay invoices 45 days after submission. Now you're SOL.

I'd look for a part time job, or pick up work on the weekends from a Craigslist job where you'll get paid that day.

</comment><comment><USER26> Does this story help the quest to $2000/mo? Making Money Online in your Spare Time: 50 Ways & 150 sites [http://bighow.com/news/making-money-online-in-your- spare-tim...](http://bighow.com/news/making-money-online-in-your-spare- time-50-ways150-sites)

</comment><comment><USER27> [http://www.itworld.com/offbeat/109756/7-strange-ways-make- mo...](http://www.itworld.com/offbeat/109756/7-strange-ways-make-money-online) Its another Hacker News article on the main page. Don't know how to copy the HN link.

</comment><comment><USER28> Start with a product that's earning $4000 a month.

</comment><comment><USER29> > > Success in business is rather like pregnancy.

> Because you get screwed a lot at the beginning?</comment>


Ask HN:  Should I list Mensa on my resume? - <AUTHOR>

I'm a non-active member of Mensa.  I passed the test when I was in high school (almost 20 years ago) and the extent of my involvement ended was paying my dues and receiving the newsletter for a while.  My membership has lapsed, but I could reactivate it at any time.<p>Should I list it on a resume?  It's all the way at the bottom among some other 'extracurricular' activities.  Is it pretentious or impressive or neither or both?<p>(Edit:  Mensa is the international high-IQ society.  Membership means I'm in the top 2% of IQ, for whatever small thing that is worth) <comment><USER2> No one gives a shit about mensa. It will just make you look like a jerk. Definitely leave it off unless you want people who receive your resume to yell "hey check this guy out" and pass your resume around the office for laughs.

</comment><comment><USER3> When someone tells me they're in Mensa (which thankfully never happens, except on the Internet), I wonder what they're trying to compensate for. It's a completely meaningless society, and presumably if you have such a high IQ, you should have applied it by now and have some results to show for it.

</comment><comment><USER4> Only if you know for a fact that the hiring manager is also a member of Mensa.

[http://greencomplianceplus.markenglisharchitects.com.s3.amaz...](http://greencomplianceplus.markenglisharchitects.com.s3.amazonaws.com/wpb/wp- content/uploads/2011/05/mensa-dilbert.jpg)

</comment><comment><USER5> Why not just bring up the supporting evidence that was required for you to join Mensa? With 2 out of every 100 people qualifying for membership, you could swing a dead cat in a crowd and be pretty likely to hit someone who is qualified. OTOH, how many of them would choose to join an organization that celebrates exclusion and superiority? Being a member says something about your disposition and personality.

Among the most important adaptive techniques for exceptionally smart people in a crowd of averageness is inclusiveness. With the current emphasis on team building during the hiring process, listing Mensa risks making you look like an exclusive arrogant ass unless you know the hiring manager is also a member. If that's the case, I would specifically mention that you included your membership in Mensa on your resume for that very reason.

</comment><comment><USER6> I'd leave it off. The stereotype of Mensa members is rather negative.

</comment><comment><USER7> It's probably fine if you throw it in that category. Although it's kinda meaningless for most people, it could help with networking if you ever run into another member.

</comment><comment><USER8> No. Mensa is a joke. If you have had a real, psychologist applied, IQ test you might want to mention that but some people would see it as a worrying flag.

<comment><AUTHOR> It's been a long time, but I believe it was a real IQ test.

</comment></comment><comment><USER9> I would leave it off. Taken over all the position you may apply to, my guess is that it will have more negative than positive effects.

</comment><comment><USER10> While it's a little old, the commentary on this Ask A Manager post is responsive to the question: [http://www.askamanager.org/2009/04/dont-mention- your-mensa-m...](http://www.askamanager.org/2009/04/dont-mention-your-mensa- membership.html)

Notably, the readership of that site leans towards management and HR types.

</comment><comment><USER11> Here's an amusing article on Mensa> The first thing you need to know is that no one has a good reason for joining Mensa... [http://www.washingtonian.com/articles/people/talk-nerdy- to-m...](http://www.washingtonian.com/articles/people/talk-nerdy-to-me-my- year-in-mensa/)

</comment><comment><USER12> What kind of job are you applying for?

If you were applying for a software development job, I would not. It's likely to be seen as a sign of an unhealthy ego.

Also if you're applying anywhere with a good reputation, most people that you're working with could also probably be in Mensa if they wanted to.

</comment><comment><USER13> I would also recommend not mentioning if you're a diagnosed psychopath or not.

</comment><comment><USER9> I think the sentiment of the comments gives you the answer.

</comment><comment><USER14> I'm in the exact same boat. Non-active, former member. In my experience, while I've never listed it on my resume, the few times it's ever come up, from interviews to casual conversation, it's only served to bias folks against me.

This experience is only anecdotal, and there may be a case where such membership is valued (e.g., Google, maybe?), but it's never been a positive benefit for me.

</comment><comment><USER15> Id you are so smart you should be able to figure it out for yourself. ;)</comment>


Second Analysis of Ferguson's Model - <AUTHOR> https://lockdownsceptics.org/second-analysis-of-fergusons-model/ <comment><USER2> Wow, that's some terrible code (even just from a "state flow" perspective, let alone stylistic choices).</comment>


How We Really Read Job Ads - <AUTHOR> http://blogs.wsj.com/atwork/2013/05/02/how-we-really-read-job-ads/

<comment><USER2> This could have been boiled down to:

People don't spend very much time reading job abs. They focus on title, company, and salary. Additionally, companies could be clearer in their descriptions.

This sounds like common sense, but throw a heatmap tracking where people look and it's news.</comment>