The 64 Milliseconds Manifesto - <AUTHOR> https://64.ms/ <comment><USER2> The most popular website in the world, known for incredible speed, google.com, took me 197 ms to load, with 139ms spent waiting.

A search for "hacker news" took 186 ms, with 111 ms spent waiting.

64.ms itself takes 3 ms for DNS lookup, 39 ms for the initial connection, and 29 ms for the SSL - total of 71 ms before any content download happens.

I'm on 802.11 AC WiFi seated about 5 feet from my router.

Apparently, users are quite willing to wait longer than 64 milliseconds.

I'm no web developer, so I don't claim to have expertise, but it really does seem like an unreasonable expectation. As soon as you have any sort of complex functionality the idea falls apart:

"Wait for the credit card payment to process"

"Download a high resolution image" (that counts as a page of content right?)

"Start watching this 4K video"

"Download a CSV of your 100,000 row data set"

<comment><USER3> There are about 20 different things that happen on screen while google.com is loading in my Chrome browser, starting within 16ms.

<comment><USER2> But when can I interact with it?

To be honest, I have no way of knowing or testing, because ~180 ms is already faster than I can see or react to.

64.ms itself takes 3 ms for DNS lookup, 39 ms for the initial connection, and 29 ms for the SSL - total of 71 ms before any content download happens.

Then my browser waits for 250ms (slower than Google).

<comment><USER3> You can interact with it immediately. You can hit the X to cancel the page load, you can close the tab, you can quit the browser or use another tab. Browser devs already adhere notoriously and fiercely to the ideas in the manifesto.

Whether the app/site you requested can be interacted with depends on whether the app/site devs care about interaction latency.

Talking about network response times is irrelevant to the point here. Clients can, and do, make changes on-screen before the network response.

<comment><USER2> For me, neither Google nor 64.ms complete the SSL handshake by 64 ms, so I'm not sure which content I'm supposed to be interacting with, assuming my body is physically capable of doing so by that time.

And really, even offline interactive apps have no chance of reacting this fast.

Try opening TextEdit or Mail - they don't even draw the window frame in 64 ms.

Performance _is_ important but normal users only care about it when it's getting in the way of functionality. If we chose our preferences by performance alone, Windows Phone and webOS phones would still be here and Android would be gone, Microsoft Office would be the least popular office suite, and Steam would be the least popular PC game store.

<comment><USER3> > And really, even offline interactive apps have no chance of reacting this > fast.

What do you mean? Lots of games run at 60Hz, and lots of games are considered unplayable if they render frames slower than 64ms. You might consider your terminal broken if it took more than 64ms to respond by displaying your input. [https://danluu.com/term-latency/](https://danluu.com/term-latency/)

> Try opening TextEdit or Mail - they don't even draw the window frame in 64 > ms.

The OS shows you the app is loading. This seems like you're intentionally trying to prove some point and not listen, rather than being open to understanding. Arguing that an app doesn't respond quickly when the app isn't running seems obtuse.

> If we chose our preferences by performance alone,

Nobody said that, so this is another straw man. The post is suggesting that UI & frontend devs use generally accepted interaction principles, and nothing more.

</comment></comment></comment></comment></comment></comment><comment><USER4> Is this an example of the kind of reactive, interactive design you're advocating? I don't see how this is helpful: it's dogmatic and doesn't address the actual tradeoffs that might be at play. Why 64 ms? And 32 and 16? What studies are you relying on to suggest that 65 ms is too slow or that 30 ms is too slow for initial feedback? How does it affect user behavior? What is advised when these rules, especially the "full screen of content" cannot be met because of things like external dependencies out of the site's control?

<comment><USER3> Yeah it's simplistic and doesn't explain the rationale, but having studied human perception a bit, I know without further explanation that this is targeting the time frames of our human ability to see change. The numbers here are similar to the reasons most movies are 24fps.

> What is advised when these rules, especially the "full screen of content" > cannot be met because of things like external dependencies out of the site's > control?

This is missing the point, and many people here seem to be attempting to pick the same nit. You _never_ have to wait for external dependencies to show changes on screen. This is how browsers and well designed high traffic websites like YouTube already operate. When you take action, you are shown UI changes on-screen that indicate the action is in progress. The manifesto is saying to acknowledge the user action so the user knows the application received the request. It is not saying everything in the world needs to be done in 64ms. Applications can _always_ acknowledge the request immediately, and yet some still don't.

<comment><USER5> > It is not saying everything in the world needs to be done in 64ms.

Well, most actually could be. And a snappy "acknowledgement" only impresses me the first time. The second time I stare at the loading indicators in disbelief, while waiting for the not-so-snappy action to execute.

<comment><USER3> What are you suggesting as alternatives that will impress you? Would you prefer to have no indication on screen that something is loading, and no indication that acknowledges you even clicked on something? Do you see a better way to show that megabytes of data are on the way but not here yet?

Loading indicators are simply one single example of how to respond to user actions on-screen. The idea is more broad than this, the idea is for clients to respond immediately to any inputs. This is true for opening menus, clicking buttons, typing, pushing on the D-pad, waving the Wiimote, pressing on your MIDI controller, waving your arms for the camera... it applies to any and all input devices for all applications.

This idea is not in the least bit controversial, I'm surprised by the amount of push-back here in this thread. Devs of games and interactive apps have always done this. If the machine doesn't acknowledge user input immediately, the user doesn't know if the input was captured, and very quickly decides the machine is slow or buggy.

<comment><USER5> > What are you suggesting as alternatives that will impress you?

In contrast to "not-so-snappy actions"? Snappy actions.

As I tried to say before: Instantaneous feedback is great (even necessary) for first time users. But once I get used to an app, waiting for the termination of a loading indicator is just as annoying as waiting for {page|script}-{load|parse|eval}.

Edit: > This idea is not in the least bit controversial.

I agree that content generation in one-digit milliseconds is not controversial.

<comment><USER3> The post's entire point is to say make all actions snappy. That doesn't mean you can finish loading a video instantaneously, it means you can acknowledge the user's request to start loading a video instantaneously.

Waiting for termination of a loading indicator on a web page is irrelevant to this post, it's a tangential topic completely.

"content" in the post is not referring to web page content, it's referring to UI content. We're not talking about content generation in the web page sense.

</comment></comment></comment></comment></comment></comment><comment><USER6> It's impossible. Lightspeed doesn't allow for that on websites if you're far enough from the servers.

If you add intermediate network gear, it's hard enough to get across half the globe in under 180ms (I'know, I live in Argentina and that's my ping time to almost anywhere non local).

You could fake it somehow in some scenarios or with an awful lot of money.

<comment><USER7> > It's impossible. Lightspeed doesn't allow for that on websites if you're far > enough from the servers.

Your second sentence explains why the first is wrong. Yes, you can't have the entire world using a single server but it's never been easier to get servers around the world and the new edge compute services are further improving that.

<comment><USER8> > around the world

Only if your «world» means «developed countries only»…

<comment><USER9> Cloudflare's got POPs almost everywhere (though densities vary with population of heavy internet users), and has a very good free plan which I use. Have a look: [https://www.cloudflare.com/network/](https://www.cloudflare.com/network/)

Akamai's coverage is better still; they've got just about the entire world covered: [https://www.akamai.com/us/en/resources/visualizing- akamai/me...](https://www.akamai.com/us/en/resources/visualizing-akamai/media- delivery-map.jsp)

Cloudfront, Google, Fastly, etc. all have pretty good coverage, though you're right they're spottier when it comes to S. America, Africa, and a few other places. Their POPs are, from what I understand, have higher capacity but are less dense. Good for cost savings, though probably worse for latency.

There's also the consideration that most web sites have most of their users in the developed world (though that equation is shifting quickly for a some).

Out of curiosity, what is the significance of "<<" and ">>"? I'm assuming they're not bitwise shift left and right. I've seen them more often as of late, and they seem to come mostly from non-Americans. I ask because they're quite difficult to run an internet search on without knowing what they are called.

<comment><USER8> > Have a look: > [https://www.cloudflare.com/network/](https://www.cloudflare.com/network/)

This is a really good example. Did you look at Africa? For the record, 1.2 billion people live there nowadays ;)

> Out of curiosity, what is the significance of "<<" and ">>"

Oh, you mean '«' and '»'? They are French quotation marks[1], I try to use the English ones '"' and '"' when I'm writing English, but sometimes I forget. Same for the space before the question and exclamation mark (there is a space in French, but not in English).

[1]: [https://fr.wikipedia.org/wiki/Guillemet](https://fr.wikipedia.org/wiki/Guillemet)

<comment><USER10> > Did you look at Africa?

Yeah, I looked at it. There are datacenters within 2000km of everywhere, and that's including the Sahara. About 1500km outside of the Sahara.

1500km as the crow flies, so let's say 2400km of fiber. At the speed of light in fiber, that's 11.5 milliseconds. Double it, add time for ten routers, that's 27 milliseconds to go from any ISP line to a Cloudflare data center.

Sounds good to me. If there are infrastructure problems that's a separate issue from whether Cloudflare has enough POPs.

</comment></comment></comment></comment></comment></comment><comment><USER11> Too vague, not actionable, no context.

More useful:

People can often respond to things within a few frames (1/60 second = 16ms). For some interactions, it's useful to respond within one frame. For others, more latency is acceptable. For yet others, sub-frame latency is required (e.g. VR/AR). Light can move ~3,000 miles in that time, which is a hard limit on latency.

</comment><comment><USER12> They missed the remaining portion of the manifesto:

* Websites making controversial claims should state clearly the claim in the first paragraph

* Controversial claims should be backed up by at least a summary of a well reasoned argument within the first 5 paragraphs.

* Controversial claims should be backed up by citing sources.

<comment> loup-vaillant Controversial? Really? What's written there is basically what's required for interactive speed. What's described here is basically what's required for interaction to feel instantaneous. Why should we settle for anything but immediacy?

Sure, with all those laggy applications we have right now, we tend to become desensitised. That's not an excuse, though.

Also note that in some cases, we're not even _close_ to acceptable latency. Finger tracking on touch screens for instance, require a _one_ millisecond response time to feel perfect. Otherwise the objects we drag will lag behind our fingers.

</comment></comment><comment><USER10> If I'm going to have a full screen of content after 64ms, why do I care about having something incomplete but 'actionable' after 32ms? And the policy of showing some feedback before then is useful in some circumstances but not very important in others.

The 64ms goal by itself is clearer and more useful than this combo of three goals.

</comment><comment><USER13> ...and on my browser [Firefox ESR 60.8.0esr (64-bit)] it takes 241ms to load this plain HTML website.

<comment><USER14> You also see the background flash as it "renders". The whole website concept is just rotten and dead if you want to even get close to as smooth as Doom in 1995 on computers with less computing power than a shader processor in my mobile phone. Cue the discussion on "speed of light" in this thread while people applaud getting your website to display in _under a second_.

</comment></comment><comment><USER15> It takes 250ms to curl this website. Ping time to the site is less than 64ms though and it is cached by Cloudflare and still can't seem to serve it that fast. Maybe HTTPS can't get under 250ms or so? Only way for me to get under 250ms is to use HTTP...

<comment><USER16> Depending on how your environment is configured...

Curl will do one round trip to your resolv.conf configured resolver

Then you have one round trip for tcp.

Then another for TLS hello (presuming TLS 1.3 or false-start)

Then one last round trip for HTTP.

Assuming cached DNS, you need a ping to the server of about 21ms to get content via https in 64ms. And that's assuming you can get enough content for a screens worth in the initial congestion window (10ish packets, so let's say 15kb). Good luck!

Oh, and my DSL connection adds at least 20ms to the path, and that's not unusual.

<comment><USER17> HTTPS requires a bunch of redundant roundtrips. We need adoption of QUIC/HTTP3 to reduce that.

</comment></comment></comment><comment><USER18> By the numbers it sounds like this is built around an assumption of 60fps. The rounding is wrong, but let's roll with it. That's a noticeable change by the next frame, actionable information two frames thereafter, and a full screen worth of content four frames thereafter.

My intuition says that's steep. Noticeable change 1 frame later might be doable with a web app, if the app is structured well and focuses on fast response times. However, I don't think actionable information two frames later, or a full screen of content four frames later is feasible for a network-based application, especially given the fact that just crossing local layer 3 network segments can add 10s of ms to your latency, depending on the router's load.

Really, these numbers strike me as only achievable by an application where all data and processing is done locally on the computer that controls the display. Even then, these target numbers still feel steep.

<comment><USER19> In a networked app where your latency is too high for these figures, or if you need to do some large number crunching etc, you should instead focus on giving the user feedback that progress is occurring. A progress bar, a spinning ball, etc are far better than nothing. Just as long as you acknowledge that the user has requested an action, and give the user confidence the action is proceeding.

<comment><USER18> That, I don't disagree with at all. There's been more than one time I've clicked on something, and then waited for the computer to do something that lets me know it's received my command and acted on it. It can be damn frustrating.

</comment></comment></comment><comment><USER20> Meanwhile major news sites take 45 seconds to load content randomly accross the page so the text jumps around and is unreadable.

<comment><USER21> I kind of want web browsers to give a budget of layout changes. Once a page does enough things to exceed the budget, too bad, your layout is stuck there.

If the user does something interactive to warrant further layout changes, then you're allowed to start changing things again.

The idea is to make it cost something to change the layout. Then people will have to actually try not to do it excessively.

<comment><USER20> On many sites the layout isnt even relevant, and all people actually want is to read the plaintext and locate any relevant images amongst the chaos. Im wondering about a browser extension or something that extracts this information directly and re-renders it in simple (like year 2000 era) html. I would kill for this on my phone.

</comment></comment></comment><comment><USER22> I enjoy that it gives no rationales. Without reasons/research/sources, these are just arbitrary numbers.

</comment><comment> wait-a-minute This manifesto's website takes longer than 64 milliseconds to respond though.

</comment><comment><USER23> As nice as this goal is, I think the RAIL model's benchmarks are a bit more realistic:

[https://developers.google.com/web/fundamentals/performance/r...](https://developers.google.com/web/fundamentals/performance/rail#ux)

</comment><comment><USER24> >In an interactive software application, any user action SHOULD result in a noticeable change within 16ms

In many cases the Input Lag ( Especially Touch Screen ) in itself is more than 16ms. That is excluding the processing from CPU to GPU rendering and your Display Lag.

<comment><USER25> Apple IIe managed 30ms total[0]. There's no reason why modern computers, which are thousands of times faster, shouldn't manage 16ms. The slow response of modern systems is the result of a deliberate choice to prioritize ease of development over user experience. We can do better.

[0] [https://danluu.com/input-lag/](https://danluu.com/input-lag/)

<comment><USER26> The mechanism that gave the Apple IIe such low latency has little to do with processing power - the keyboard had an exotic setup that you likely won't get over something as generic USB.

<comment><USER10> Exotic how? Just being 533Hz isn't; you can get very cheap chips that are capable of polling the keys at 1000Hz or higher.

If you really want to minimize latency on a modern system, and can choose whatever commodity hardware you want, you can get the input+rendering+scanout delay below 10ms. At that point it's a matter of how often your screen accepts new frames. And with a high-end, frame wait plus pixel response time can also be under 10ms.

20ms for local end-to-end latency is a completely achievable goal.

[https://www.blurbusters.com/gsync/gsync101-input-lag- tests-a...](https://www.blurbusters.com/gsync/gsync101-input-lag-tests-and- settings/3/)

Their best combo here achieved an end-to-end latency of 12-15ms, on a 200/240Hz screen with counterstrike running at 2000+ fps.

At a more mainstream 144Hz to the screen, running the game at 'only' 288Hz, end-to-end latency was 13-19ms.

Even at 60Hz they could easily keep the latency below 30ms.

<comment><USER26> Exotic in the sense that pretty much all gear that is polling 1000Hz nowadays is gaming gear. I never implied it was unattainable - I have a 240Hz monitor, G903, and still use the ps/2 port and the games. However I wouldn't doubt the fact that my 240Hz monitor is exotic.

As for touch screen technology, the Apple Pro Pen I believe is only 20ms and is state of the art. While I do believe that developer ux has contributed to lazy resource management, it's also clear that sub-60hz latency has regularly required exotic hardware.

<comment><USER10> It's still "generic USB". When we're talking about the _difficulty_ of it, it's entirely fair to pull in a $30 keyboard.

Touch is hard to keep ultra fast. But with physical buttons it's mostly apathy.

</comment></comment></comment></comment></comment></comment><comment><USER27> I really like this, even though if it is impossible with today's microservice architectures...

A couple of years ago I was thinking about this either and someone suggested a study defined 0.1, 1 and 10 seconds as limits: [https://stackoverflow.com/questions/17138585/what-is-the- max...](https://stackoverflow.com/questions/17138585/what-is-the-maximum-time- a-web-application-or-website-should-respond-to-a-requ)

<comment><USER28> The interface isn't necessarily related to backend services (i.e. you don't _need_ backend services to drive every change in the interface)

</comment></comment><comment><USER29> For reference that's about this much:

16 ms → 62 Hz

32 ms → 31 Hz

64 ms → 16 Hz.

</comment><comment><USER30> [https://webpagetest.org/result/190924_7C_b9373b51a084f69f1bc...](https://webpagetest.org/result/190924_7C_b9373b51a084f69f1bc50f5f7f9c2679/1/details/#waterfall_view_step1)

</comment><comment><USER31> It seems as though relying on something a bit more verbose, such as the guidance from Nielsen Norman Group [1], might be more effective in helping people building software.

In particular:

> _0.1 second is about the limit for having the user feel that the system is > reacting instantaneously, meaning that no special feedback is necessary > except to display the result._

[1] [https://www.nngroup.com/articles/response- times-3-important-...](https://www.nngroup.com/articles/response- times-3-important-limits/)

</comment><comment> arch-ninja I love this. Software developers too often focus on the final end state and this distracts from the state changes in the middle of any process.

By focusing on UI responsiveness you vastly improve discoverability and interoperability because it naturally decouples the problem into a model/view/controller design. Best of all you can't mis-design: the responsiveness is your constraint, and if the design doesn't give you responsiveness you KNOW it is a poor design.

This is the ultimate quality litmus test.

</comment><comment><USER32> The fastest I can view and respond to information is maybe 2 times per second if I'm not really viewing anything. So I'd say 512ms makes more sense or maybe 256ms if you want it to "feel" snappier (assuming we are sticking to powers of 2 for some reason). Any higher is looking more for animation speed than usability speed.

</comment><comment> loup-vaillant Half the comments here seem to assume this manifesto is about web sites. Can I remind everyone that many applications run _locally_?

<comment><USER33> They do? The web is the future!

</comment></comment><comment><USER34> I just want at least a _filler_ response within ~150ms when I tap a button on my phone. Occasionally I will miss a touch target. If I haven't seen a response, I will assume I missed the touch target.

</comment><comment><USER35> Too vague. Isn't moving caret in a text field "any user action"? Then why should it invoke a full screen of content?

</comment><comment><USER36> Meh.. sure. Any reason behind these specific figures?

<comment><USER37> They're powers of 2, so clearly they are significant for deep technical reasons.

</comment></comment><comment><USER38> 64ms? Without any context or reasoning? Wrong all ui should load in 100ns and anyone who disagrees is an idiot.

</comment><comment><USER39> People must learn some patience instead of wasting our time and talent on optimizing stuff for those milliseconds.

<comment><USER40> Ah yes, ye olde "my time as a developer is worth more than that of mere _users_ ". That kind of thinking is the reason modern computing sucks so bad.</comment></comment>


Elite Dangerous Ship Assistant Powered by Alexa [video] - <AUTHOR> https://m.youtube.com/watch?v=ScE4ky6_U5k <comment><USER2> It's mentioned briefly in the article but take a look at how much has been achieved already on controlling Elite via voice without needing Alexa: [https://www.youtube.com/watch?v=W6SECeLL3hE](https://www.youtube.com/watch?v=W6SECeLL3hE)

And with Mr Shatner himself providing the voiceover.

More here: [http://www.hcsvoicepacks.com/](http://www.hcsvoicepacks.com/)

Disclaimer: I just bought this. I'm waiting for my HOTAS flightstick to arrive then I'm donning my Vive to spend some quality time with Kirk in VR.

(Voice control is of particular relevance to VR as you can't see the keyboard. Any games with complex control schemes suffer greatly. Elite, War Thunder and DCS spring to mind but it probably applies to some RTS games too. Voice seems like the most obvious addition as it maintains the sense of immersion. Strangely - it's currently very underutilized in VR)

<comment><USER3> The video you linked; the voice assistant sounded faster than Alexa.

<comment><USER4> Gamers typically use VoiceAttack[1] for voice control in gaming. It uses the built in Windows 10/8/7? speech recognition system and layers macros and basic programming on top of it.

[1] [http://voiceattack.com/](http://voiceattack.com/)

<comment><USER2> Yep. The Kirk thing is based on VoiceAttack if that wasn't clear.

</comment></comment></comment></comment><comment><USER5> Elite is the galactic time sink. I used to play it on Amiga when i was younger. Reached Elite, lost childhood. Then as I got older I used to play it on my Palm V. Got very far, lost productivity. Today I play dangerous and try to adult myself into limiting my sessions into one mission a sitting. Ok, maybe two, sometimes three. I fear having something like this will disconnect me from the world too much. Nonetheless, great job!

<comment> J-dawg I was the same with Elite as a kid (although I never actually reached 'Elite'!). There was something about that game that made it so immersive. I wasn't just playing a game, for a few hours a day I was a hard-bitten space trader.

When I first heard about Elite Dangerous I was fascinated. Everything from the original game but with modern graphics to make it look the way it always deserved to. I genuinely feared how much of time sink it could become, and decided to stay away. I still watch the videos on YouTube sometimes!

<comment><USER6> My personal gripe with Elite Dangerous is that the initial learning curve is a pain in the ass. I'm all for escalating challenge -- especially if it means that the jump from "hey, this is fun to play around with" to "I'm out in the border regions, alone, looking for adventure" is intense -- but with Elite Dangerous, I felt like the starting experience dropped me WAY into the deep end of the galactic pool, without much in the way of explanation about the "why" or "how".

</comment></comment></comment><comment><USER7> How many years off are we to truly conversational computer talk? The prompt 'pings' get in the way of the flow.

When will I be able to just talk to my computer and have it know I'm done and respond, with a 'ping' 'pong' system?

I don't even use my car's voice commands because it's really slow to use while driving. I would love to just say: "Hey text my wife I'll be home in 10 minutes" and have my car respond.

<comment><USER8> "Okay Google, text Marianne and say I'll be home in ten minutes". "Sending a message to Marianne, saying I'll be home in ten minutes. Send?" "Yes." "Sending."

I love Google voice assistant. My phone's mic is unusually bad though, so if you imagine all of the above with me learning forward and shouting at my phone... ;)

<comment><USER9> On the flip side it can be maddeningly stupid. I have two Tom's in my contacts. one is regularly texted and called and other very, very rarely so. When I try to use voice to text Tom, it asks me which one. Every time. This adds a lot of interaction and time and honestly makes using the phone touchscreen faster and more pleasant.

I have the Google Home and my kid loves the Ghostbusters song. For whatever reason if you ask Home to play Ghostbusters you need, first, to specify the song not the movie, even though I have no Netflix integration setup. Then when it gets it correct it will only play the instrumental version for some bizarre reason. Weird, its clear the Home engineers are Ghostbusters fans as you can ask Home "Who you gonna call" and it gives some humorous canned responses, but somehow they can't get playing the Ghostbusters song correct.

Worse, because I have Google Play Music, there's some kind of licensing limit with Home. If I have Home playing music then my desktop PC refuses to play any youtube content, not play music, but unrelated videos. I can't watch any youtube videos unless I log out. Its incredible how bad the usability here. Buying a device for your kitchen shouldn't make all your computers be unable to play videos.

<comment><USER8> Have you thought of renaming the less-called one to Thomas? :D It's a bad solution, sure, but it _is_ a solution...

<comment><USER9> That's what I ultimately did. I just named him Tom2 or somesuch.

</comment></comment></comment></comment></comment><comment><USER10> I hope Amazon picks up on this. Alexa and Sci-Fi Games are a match made in heaven!

Great hacking OP! well done!

</comment><comment><USER11> That's a fantastic idea. Actually, Alexa could serve as a built-in voice assistant in a lot of games if it fits the setting. To me it seems like an impressive and actually useful feature, not just a gimmick, to developers and users alike.

From the top of my head it would shine in games like Metal Gear Solid 5.

Does Amazon advertise a use-case like this? I think they should. Considering that they are involved with the Cryengine it even makes more sense.

<comment><USER12> Hmm. Interface it with Kerbal Space Program and a mod like MechJeb.

"Alexa, launch to orbit at 120km."

"Alexa, deploy all solar panels."

"Alexa, match planes with target and plot an intercept."

"Alexa, orient the ship in a Sun reference frame facing down, zero degree roll." (Can I call that "reference frame Sun-Down-Zero for short?)

"Alexa, switch to atomic engines and plot a bi-elliptic transfer to Moho at the next window where total delta-V is under 6 kilometers per second. Then aerobrake to an equatorial orbit at 60km, plot rendezvous with Fuel Depot M50, and dock."

> "I'm sorry, Dave, Moho doesn't have an atmosphere so I can't aerobrake." ( > _ship flies off on an impact trajectory with the Sun_ )

hmm ... okay maybe that's just a little _too_ complex :b

<comment><USER13> The problem with that is it requires information from the game (some of those commands), i was working on something similar for star citizen and was setting up screen scraping to get data (but insufficient interest, beta testers and 0 sales after 6 months kinda killed that project).

Basically think of these types of systems (that's voice attack i believe, i saw this video a while ago) as macros triggered via voice - useful for space combat (shields forward, slide left(for 6 degree of freedom flight) etc).

<comment><USER12> It's mostly there. The MechJeb extension does 95% of that stuff already. It won't plot aerobrakes except for landing, and it only does Hohmann transfers and not bi-elliptic (but unless you're going Eeloo to Moho there's really no advantage to be had) and it doesn't really manage different _sets_ of engines, but it easily could be extended to do so.

It _can_ launch to specific orbits, compute orbital transfers with specific delta-V budgets through a GUI interface with a time/dV heatmap, and it will gladly deploy your solar panels (but not retract them), and it can orient your craft.

(Oh, and you need to explicitly pick out which docking ports to use.)

If only it did a better job at auto-tuning its PID parameters to match the available control authority, you'd be set. :b

<comment><USER13> Huh, i'd love to see how their doing that - question though - is it from a specific place only? or are they screen scraping?

I've gotten a lot more into this sort of tech lately, after a started getting requests for it :D

<comment><USER12> It's not screen scraping, certainly. Here's some of the code; if you can figure out where vesselState is coming from, you'll know: [https://github.com/MuMech/MechJeb2/blob/master/MechJeb2/Mech...](https://github.com/MuMech/MechJeb2/blob/master/MechJeb2/MechJebModuleAttitudeController.cs)

<comment><USER13> Hey thanks, ill look into that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> This title is rather less confusing game when you realize there's a game called Elite Dangerous. I had no idea what this was about but was curious...

</comment><comment><USER13> I made a couple of replies to some comments, but i thought i would do a little post of details about something like this.

I worked on a similar system for star citizen, using the inbuilt windows voice recog system.

At it's core, systems like this are primarily voice activated macro's. They are a lot more useful for twitch/combat based games (specifically flight simulators).

I would listen to microphone input, do a comparison for a specific string and emulate a keyboard press(or a combination of them for x amount of time) based on what was said. (Mouse too some times - although i spoke to tech support for star citizen, and had to be careful of how complex some commands could be, to ensure i did not break the eula).

Side note: I have stopped production of mine until star citizen gets a little further along (and i am also working on a natural speaking system, to detect what you mean for the system to do, instead of specific strings - eg if i said show shields, show me the shields, lets see the shields it would differentiate between that and say putting the shield power forward).

</comment><comment><USER15> The how to link in the description doesn't seem to be working but it's here:

[https://www.hackster.io/mathwuy/elite-dangerous-ship- assista...](https://www.hackster.io/mathwuy/elite-dangerous-ship- assistant-04e2cd)

Neat hack! It's awesome that Amazon have opened there API to the degree that you can implement these kinds of things. Hope Siri does the same someday (though I think it's unlikely).

</comment><comment><USER16> Very cool, yet surprisingly boring to watch.. ;)

</comment><comment><USER17> Sounds like a great project: Implement this for Star Citizen.

<comment><USER13> I did, i couldn't get enough beta testers, and zero purchases after 6 months. Now i just use it for myself (also mine had on screen overlays and other advantages).

</comment></comment><comment><USER18> grabs the mouse: hello computer.

</comment><comment><USER19> A real pleasure to watch, great job!

</comment><comment><USER20> I like the part where Alexa asked him what's next

</comment><comment><USER21> OK. That's cool.

<comment><USER21> Seriously. I think its cool.

</comment></comment><comment><USER22> this is depressing

<comment><USER2> Why?

<comment><USER22> Space makes me feel super insignificant in the universe.

Then add Alexa's pretty much soulless monotone voice.</comment></comment></comment>


Ask: how much do you make in Australia - <AUTHOR> The Google and Amazon threads show salaries that would simply be amazing in Sydney even if working for a hedge fund!
So I wonder what people are earning down under?
I am a senior .net dev 13 yrs exp earning 140k AUD plus super and no bonuses or shares. <comment><USER2> I was _the_ Web Developer for a well known environmental charity for 2 years. ~10 years experience. Was earning 63k AUD plus super (no bonuses).

As I discovered later, the average salary for the same role in the for-profit sector is around 80k AUD plus super in Tasmania.

</comment><comment><USER3> My previous company was paying senior C++ devs in Brisbane about AUD140k plus super, plus (worthless) options in 2013.

I'm contracting now, so nothing more current.

</comment><comment><USER4> Java + HPUX / AIX with Oracle / SAP => $130k</comment>


Ask HN: Are You Interested in Solving a Really Complex Problem?  - <AUTHOR>

Hey HN, You are always amazing at helping me finding solutions for my startup so here is my problem tell me if anyone can help. I started a startup with 2 other doctors and we have been working for couple of months coming up with solutions to problems we think we can fix in consumer healthcare in the US. We have finalized something and it's very exciting. My issue is that I am a front end guy (PS, HTML, CSS, JS) and to make this work well I need an awesome coder that really likes to work on complex problems to help me part-time making it happen. I will give founder equity to who ever can help and like I said it can be part-time if your busy. You can read my story here: http://news.ycombinator.com/item?id=2312566 and what I went through health wise that made me so passionate about making a change in this industry.
You can email me at: firstname.lastname@example.com
Thank you very much :) <comment><USER2> Clickable: <http://news.ycombinator.com/item?id=2312566>

</comment><comment><USER3> What are you looking to do?

</comment><comment><USER4> Why part-time?

<comment><AUTHOR> Because I realized that telling people to jump head on into a startup as a co- founder usually doesn't work (it's like asking for a girl you just met lets get married), it's better to first test each other and see how we work part- time then once good things happen (funding, launching a solid site etc.) then he/she can decide to join full time.</comment></comment>


AI by Novelty Pump, Trade Cycles Turning Noise to Mind - <AUTHOR> http://critterding.sourceforge.net

<comment><AUTHOR> <http://sourceforge.net/projects/critterding/forums/></comment>


Enough About HTML5 Video Already - <AUTHOR> http://www.streamingmedia.com/Articles/Editorial/Featured-Articles/Enough-About-HTML5-Video-Already!-78047.aspx

<comment><USER2> He may as well say, "Enough of supporting iPhone and iPad users. I'm sick of it." Good luck with that.

</comment><comment><USER3> What's the problem with encoding in two or three different formats? How many gigabytes of videos are we talking about?

It's not like you have so sit an manually shuffle bits around. Just leave the encoder running, no need to bill your client for that time.

<comment><USER4> He's a consultant who helps tune encoding parameters for various use cases. So yeah, multiple scenarios to plan for means multiplying his fee.</comment></comment>


Debian Wheezy release schedule - <AUTHOR> https://lists.debian.org/debian-devel-announce/2013/04/msg00006.html

<comment><USER2> I'm getting a Chrome warning: "The site's security certificate is not trusted!"

<comment><USER3> You're probably missing SPI's root certificate, which is available from <http://www.spi-inc.org/ca/>, or if you're using a Debian system, from the ca- certificates package.

There is also the HTTP version available at: [http://lists.debian.org/debian- devel-announce/2013/04/msg000...](http://lists.debian.org/debian-devel- announce/2013/04/msg00006.html)</comment></comment>


Ask HN: Why should I not start a VPN business? - <AUTHOR> Seeing as Chairman May looks set to retain her role as PM of the UK, and pressing on with her anti-open-internet legislation, VPNs seem like a business that are going to only become more and more popular.
I'm a 9-5 DevOps/SysAdmin, and I run personal projects on Digital Ocean. I could setup something on DO or AWS to automatically spin up servers and could write the site up in Laravel. I've been looking to start up a paid site/service for a while.
What I want to know is, why shouldn't I start? I'm based in the UK, servers would be global (DO or AWS regions). Is it a messy thing to get involved with, or can I protect myself with terms and conditions? Obviously I don't hold any logs etc. If someone used the service and did something illegal (child porn or terrorism), would I be getting raided?
I've got the tech side mostly covered, but I'm a little unsure about the legalities. <comment><USER2> I wouldn't sign up for a VPN based out of the UK. Frankly, May scares the shit out of me - her ideas about regulating communications comes across as more than slightly fascist.*

* My head of state is He-Who-Must-Be-Impeached; so I'm getting more familiar with fascism on a day-to-day basis. (I won't even use an email provider located in the US due to the way the government over here behaves).

<comment><USER3> I agree and would extend it to be not trusting a VPN company or a director of a company operating on the UK, even if all the servers are in overseas locations.

There is a large provider based in Gibraltar. I'm not sure how trustworthy they could be but from what I remember it's all about the law and applicability and where an individual lives. IANAL

</comment></comment><comment><USER4> I thought about it but the thing is that anything like this is probably going to be used for undesirable things by undesirable people and although my moral compass isn't exactly strong I didn't really want to be involved in that.

</comment><comment><USER5> You can start your VPN business, but you may run into issues and cause your customers to conduct chargebacks, refunds or sue for not being able to reliably offer services. If blocking/disrupting/unauthorized decryption of their encrypted traffic occurs in the future you should inform your customers of this issue so none of them are unaware.

Now if it becomes illegal in the UK to offer any encryption services, require backdoors or lower grade encryption you may need to migrate your residence and business to another country to legally continue business operations.

<comment><AUTHOR> I think one of the biggest things swinging it are legality, I'm almost certain it won't be illegal to offer encryption services, but then there's a lot of things I didn't think would happen in politics lately...

</comment></comment><comment><USER6> Unfortunately, the proposed encryption ban is still very much alive. If that proposal becomes a law any kind of useful VPN service will be illegal.

If May and her three Brexit stooges have their way with the UK you might rather want to provide relocation and off-shoring services ...

</comment><comment><USER7> There's no shortage of vpn services. How would you get customers? Next to legal issues, that would be my primary concern.

<comment><USER8> This. There's a ton of VPN services and while it is in theory a good business model (I know somebody who has a niche VPN business which makes tens of millions of dollars per year), getting customers might be hard.

<comment><USER9> And it has to be said that while some people want a VPN for "good reasons" a lot of VPN users will be the abusive kind - you'll need to deal with them too. Hard if you don't have logging, but if you keep logs you'll get fewer clients.</comment></comment></comment>


The Best Equity is Sweat Equity  - <AUTHOR> http://blogmaverick.com/2008/01/02/the-best-equity-is-sweat-equity/

<comment><USER2> The money quote -

      These investors, including myself, know what you don't, and they are not telling
      you. The minute you ask for money, you are playing in their game, they aren't
      playing in yours. You are at a huge disadvantage, and it's only going to get
      worse if you take their money. The minute you take money, the leverage completely
      flips to the investor. They control the destiny of your dreams, not you.

<comment><AUTHOR> But if you've done all the hard work of building your business, proving your market, and crushing revenues or hitting profitability, then talking to investors becomes more like a partnership discussion than it does one where you're a poor, starving founder begging for money (you bring zero value to the table).

Github is my favorite example. They bootstrapped themselves all the way through, and in the process, they maintained their own identity and culture, built a great product and killer team, and were minting $$$. Then when the right time came for them to scale up to the enterprise and move fast, they decided to take VC money.

</comment></comment><comment><USER3> This post sounds like a lot of hindsight bias and confirmation bias. There are companies that raised money and went on to become Google and Facebook, too. Namely, Google and Facebook.

<comment><USER4> Right, but I think Mark's point was that great companies can also be built slowly. These may not be the "best" companies but great one's can be built brick-by-brick. I feel that most startup founders today strive for a large funding round before focusing on building a solid business foundation.

For some businesses, it is not possible to create value until you have a large amount of capital in-hand (e.g., Aerospace, Automobiles) but for most it is and we shouldn't lose sight of that. People solve problems, not money; and it is unlikely that a large pile of cash will be the solution to your problems if you don't first start with a good business model.

<comment><USER5> Reminds me of this article. <http://www.joelonsoftware.com/articles/fog0000000056.html>

<comment><AUTHOR> Thanks, that was a great read.

And therein lies the big risk-reward decision as an entrepreneur. I think that decision rests most heavily on whether you've got product-market fit or it's very clear to you that this is a land-grab opportunity, and you must move quickly.

Either way, funding should always be looked at as a huge accelerator. Sometimes you could start off slowly, then once the model's figured out and growth necessitates it, pull out the big guns with lots of funding to scale up (e.g. Facebook, Github, Zynga), or you make a really high risk-reward bet from the get-go like Amazon did (then again, that was also during the 90s, and it was smart since it filled a huge hole and everyone was moving fast towards dominating the internet space).

Very different environment today... I think we're going to see more and more Github scenarios in this recession. And a lot of bloodshed for startup founders trying the Amazon model today.

</comment></comment></comment></comment><comment><USER6> I think the real calamity is that VCs are a clique and they all talk to each other in all kinds of inappropriate ways. They're like high school girls in the sense that if a few like you, they all do. That gives them a shocking amount of power for a supposedly "meritocratic" industry. VC-istan is still more meritocratic than most other industries, but only because the competition in that dimension is ridiculously soft.

If you had a few hundred _independent_ decision makers, you'd probably have something that looks like a legitimate market. Instead, you end up with something where the VCs hold all the cards (because they can turn off supposedly unrelated interest with a phone call) and _still_ don't do well financially. The financial underperformance exists because of the morale problems inflicted by their disproportionate power; startups are staffed with enormously competent people, but the good ones are viciously careerist-- and why shouldn't they be?-- and you get evaporative-cooling problems if you don't have an well-above-normal (~1%) ability to lead in such an environment.

We revitalize the startup world by moving power away from active, power-hungry investors focused on making their careers and back in favor of passive investors interested in making money.

So, I'd like to see Kickstarter or something like it succeed. Right now, average people with $0.1-2.5M net worth ("mom-and-pop investors") can only invest in securities related to massive corporations, in which case the only good option is to invest in a broad-based index fund (90+ percent of "stock pickers" leave you worse off than an index fund; and these companies are just too complex for individuals to get a consistent advantage by "knowing the company") or they can invest in individual small businesses (restaurants started by people they know) but that's extremely risky. Some diversified way for average people to invest in small-business talent and get the potentially well-above-normal returns available in doing it would be great.</comment>


Why an empty sum is 0 and an empty product 1? - <AUTHOR> https://www.johndcook.com/blog/2015/04/14/empty-sum-product/ <comment><USER2> Alternatively you could require that the product of the products of two sets should be equal to the product of their disjoint union. In particular the product of any set multiplied with the product of the empty set should remain the same, hence the product of the empty set is the identity.

This avoids some problems you get when you try to generalise the categorical the notion of product, as it's not immediately clear (to me anyway) how to get a category where products correspond to an arbitrary group/monoid product.

</comment><comment><USER3> The relevant chapter from 'Category Theory for Programmers.'

[https://bartoszmilewski.com/2015/01/07/products-and- coproduc...](https://bartoszmilewski.com/2015/01/07/products-and-coproducts/)

</comment><comment><USER4> Because Sum_{i=0}^{k} a_i = a_0 + Sum_{i=1}^{k} a_i.

When k = 0, the left side equals a_0, while the right side equals a_0 plus the empty sum.

Similarly for products.</comment>


In Defense of DNSSEC - <AUTHOR> http://shorttext.com/63084847 <comment><USER2> I read this thing so you don't have to. Here's a summary of what I believe this person's arguments to be. If I've failed to be charitable enough, please do call me out for that.

1\. With DNSSEC, SPF, DKIM, and DMARC enabled, email is secure enough to authenticate requests for TLS certificates. Without DNSSEC, it isn't.

2\. DNSSEC zone owners control their keys, so DNSSEC doesn't imply that the DNS roots control keys.

3\. There is nothing wrong with older cryptosystems and anyways, DNSSEC supports elliptic curve now.

4\. The code to make DNSSEC deployable is underway and so it's not valid to suggest that it's too expensive to support.

5\. All that's required of DNSSEC deployers is to generate a couple of DNS records, and so it can't be expensive to to deploy.

6\. It's specious to criticize DNSSEC for only securing server-server transactions and not browser-server DNS lookups.

7\. Nobody ever said DNSSEC would provide end-to-end encryption. DNSSEC reveals hostnames now, but there's something called NSEC5 that's going to make that better.

8\. Nobody ever said DNSSEC was going to provide end-to-end security so it's not valid to criticize DNSSEC for not doing that.

9\. DNSSEC isn't a replacement for the CA system, but rather a security improvement for DNS, so comparisons to TLS and CA aren't valid.

<comment><USER3> Well, about #2, people are defending the status quo (where any governemnt anywhere on the world can compromisse a site's key) by arguing that with DNSSEC there'll always be one government able to compromisse any site's key. Calling that a falacious argument is too charitable, it's an outright lie (and I wonder why that piece of propaganda is so pervasive).

About #3 the article simply points that there's nothing wrong with DNSSEC, unless you choose to use bad crypto algorithms. Guess what, any cryptosystem works the same way, TLS included.

About #6, yes, it's specious to criticize DNSSEC because browsers choosed to not support it (unless you are talking from the point of view of a site master wondering how you'll configure your host today - but even then, that's not a valid criticism of the algorithm, it's just reason to not deploy it now).

About #8, yes, that's not valid. DANE is the main end-to-end encryption algorithm that used DNSSEC, so one must either criticize DANE (if able) or shut-up.

Anyway, what a badly formated page. Points #1, 4, 5 and 7 are flaws. Point #7 is a big flaw, and don't hold your breath waiting for it to be solved. I'd say about point #9 is that DNSSEC is exactly a less broken CA system. I can't see where the author is going...

<comment><USER4> > I'd say about point #9 is that DNSSEC is exactly a less broken CA system.

I'd say DNSSEC is _more_ broken than the current CA system. At least with the current system you can more or less choose a CA to trust (or, more interestingly, a bunch of CAs), that you can change anytime you want. The only thing preventing you to do it is the lack of tools to actually do it, which is why tools such as TACK/HPKP, or Convergence/Perspectives, are needed.

With DNSSEC, there is only one realistic root ever possible (call it ICANN or NSA as you want, that's yet another problem)

<comment><USER3> > At least with the current system you can more or less choose a CA to trust

Blind illusion. You must trust all of them. Any of them can attest somebody is you any time they want.

The good thing about DNSSEC is exactly that it only has one root. And people can pin second and third level domains, completely escaping it - for some other org, controlled by some other agency, but one can choose what agency to submit their identity.

</comment></comment></comment></comment><comment><USER5> Page seems down; cached version: [http://webcache.googleusercontent.com/search?q=cache:_q7stvY...](http://webcache.googleusercontent.com/search?q=cache:_q7stvYH64MJ:shorttext.com/63084847+&cd=1&hl=en&ct=clnk&gl=us)

</comment><comment><USER6> _jocluteseh:_ Can DNSSEC be re-directed to incorrect public keys? Sure.

 _jocluteseh:_ DKIM signs the message and provides a body hash which is validated against the public key in DNS.

 _tptacek:_ SMTP email isn't end-to-end secure with DNSSEC, SPF, DKIM, and DMARC. It isn't even close. It is unsafe to authenticate CA certificate requests via email before DNSSEC and remains so after DNSSEC. SMTP is insecure.

in short: DNSSEC and SMTP hang together by threads. cut one thread and the whole thing collapses. "It's better than what we have right now" isn't an argument because we actually don't have it anyway. tptacek is 100% correct.

<comment><USER7> > jocluteseh: Can DNSSEC be re-directed to incorrect public keys? Sure.

Please explain how. The whole point of DNSSEC is to provide a cryptographic validation that the material put into DNS by the operator of a zone is the same information you get out of DNS when you perform DNSSEC validation.

I'm quite tired of seeing the assertion that "DNSSEC can be re-directed" without people actually walking through HOW that redirection can occur. (Thank you in advance for doing so.)

<comment><AUTHOR> I'll try to post a comment, but my IP address may be rate limited -- I keep getting "You are posting too fast" errors.

In any case, you've made my case for me much better than I could have made it myself. The problem with the 'redirect DNS' argument is that -- it seems -- most people misunderstand that in order to redirect a DNSSEC signed domain, you need to control the 'root' key AND re-sign every domain under that key.

So, _can_ it be done? Yes.

Is it _likely_ to happen? No.

I would argue that the re-direct DNSSEC argument is nearly vanishingly small. But it can't be claimed to be zero.

<comment><AUTHOR> > Fair enough.. but if you're talking to a MITM anyway, would you agree that > it's game over?

Don't think: 1/10,000 chance. Think: 1/1,000,000,000,000,000,000,000 chance.

You are much more likely to die by getting run over by an airplane while walking down the road while also holding a Dalmatian over your head, than to have your DNSSEC signed domain redirected.

The edge case that's being argued about NSA taking over DNSSEC is rather over done.

However, if the argument is denial of requests, so as to block traffic, DNSSEC or not matters not - so the argument again -- is not about DNSSEC as a specific service or architecture.

<comment><AUTHOR> > You are assuming that your client OS/browser DNS resolvers have the pre- > shared trust anchors for whichever root zone. That's kind of a big > assumption.

First: There are two arguments to be had. One is the server side, and one is the browser side. The server is going to know about the key problem if it happens. The client side browser can know, if the client is using plugins like this one:

[https://www.dnssec-validator.cz/](https://www.dnssec-validator.cz/)

Second: Here is the root key: [https://www.iana.org/dnssec/files](https://www.iana.org/dnssec/files)

<comment><USER6> Yep.. in a typical MITM scenario (say, at a coffeeshop or a hotel in a firesheep sort of attack), server side checks won't help you at all since the MITM recursive server could just keep spouting those lying lies :)

</comment></comment></comment></comment></comment></comment><comment><USER8> It's a bit pointless to argue for or against DNSSEC. It exists, and if you are fishing for larger customers in the hosting business, you already have had to relate to that. It is, for better or for worse, infrastructure.

You can have informed opinions on how to change it, just like you can argue for changes in the TLS protocol to extend it or modernize the crypographic primitives. But a fundamentally different protocol would need a clean start, and would need to offer enough advantages to get people to switch. These global systems takes a decade to change, at best, and it can be done. While I would love for both TLS, IPsec and DNSSEC to have been designed differently from the start (i.e. without X509), that's not where we are today.

As for the basic idea, it is wise to ask yourself: Would it be useful for registrars to prove domain ownership cryptographically? If you think that could be put to good use, you will understand the basic premise and what the protocol was designed for.

</comment><comment><USER9> Before I pick apart the obvious points, keep this in mind: do you ___need___ DNSSEC right now? Not would it be helpful or nice or make things a bit more secure, but do you _need it_?

\--

> 1\. DNSSEC is better than no DNSSEC.

You can't use your argument to defend your argument; this is circular reasoning and therefore illogical.

Also, the commenter has no idea what protocols use crypto in what way as many of them are proprietary.

> 4\. [...]There may need to be some software adjustments to fully accommodate > DNSSEC. However, there currently exist several DNSSEC plugins, extensions, > or modules for several end user browsers. Thus, the code base has already > been started, making improvements and merging code bases is the next step.

This is like saying "Replacing cars with driverless cars just requires a software update". Yeah. On every car and road. No biggie. I'll put it all on my Visa.

> In short, if a devops can type a few characters in a DNS record, a devops > can deploy DNSSEC within a few hours depending on the domain complexity.

You don't need to be "a devops" to make a DNS record change, but ideally you would call this person the domain name record owner or DNS administrator. This shows little understanding of how DNS is deployed in the real world.

> Generally #6 is specious.

If you consider "we have to upgrade our OS on all our systems - which may range from 1 to 100,000 depending on the organization - to gain a marginal amount of security we didn't need before" to be specious [assuming Windows comes with a validating stub resolver now].

> There is a vulnerability in DNSSEC, that is openly listed in the RFCs, that > indicates subdomains are enumerated. [..] However, for simple domains with a > few hosts, enumerated architectures should be a minor problem if a problem > at all.

"Please ignore this information leak."

> This sockpuppet Anti-DNSSEC rant is inaccurate, incomplete, and presents a > picture of DNSSEC that is unsupported factually, mathematically, and > architecturally.

"I can't argue the point that we don't need DNSSEC, so let's just throw some hyperbole around and hope nobody notices I don't even try to prove my claims."

</comment><comment><USER10> Ask HN:

I am asked would I prefer 1. to have a pre-generated cryptographic "signature" of every www page that can be checked against some centralized repository for "authenticity" or 2. to encrypt every www page before transmission or at least have it encrypted in transit?

"Both" is not an valid choice. I have no idea why not; as far as I can tell, they are not mutually exclusive.

Because I mindlessly support SSL (let's encrypt!) I choose option 2 over option 1.

Now I am asked the same question regarding DNS packets. 1. Sign the packets or 2. encrypt them?

Do I still choose option 2 over option 1?

If I choose 1, those DNS requests will be unencrypted plain text like unencrypted HTTP.

Maybe DNSSEC has nothing to do with privacy regarding DNS requests?

<comment><USER7> > Maybe DNSSEC has nothing to do with privacy regarding DNS requests?

DNSSEC has _nothing_ to do with privacy.

DNSSEC is entirely about the _integrity_ of DNS requests.

DNSSEC is focused on ensuring that the information you get _OUT_ of DNS in response to a query is identify to the information that was put _IN_ to DNS by the operator of the domain you are querying DNS about.

That's it.

DNSSEC is a focused mechanism to ensure the DNS records have not been modified in transit between the authoritative DNS server for a domain and whatever DNS client is performing the DNSSEC validation.

<comment><USER11> DNSSEC is probably better described as a mechanism to prevent cache poisoning; which is different from the "modified in transit" case.

DNSSEC isn't very useful for defending against a MITM:

1\. If the MITM goal is to block your domain, they still can by dropping the queries or replies.

2\. If the MITM goal is to intercept your content, they don't need to rewrite DNS; they can do it at TCP level. TLS/SSL is the effective mitigation here.

Additionally, if the MITM is between you and your resolver: for example in the Café wifi case - DNSSEC is no help at all. Since stub resolvers and clients do not validate.

<comment><USER7> colmmacc - I was thinking more of a case where the attacker is doing a MITM on your DNS info, i.e. getting between you and the DNS server authoritative for the domain you want to connect to in order to redirect you to another site. My use of "modified in transit" was to the DNS query.

Yes, "cache poisoning".

Agree with your last point. DNSSEC only helps provide integrity validation down to the point of wherever the actual DNSSEC validation occurs. In the most secure form, that validation would occur on your actual device (i.e. the stub resolver) or in your application (some now are building DNSSEC validation in, ex. the Jitsi softphone). I know some folks who run Unbound (or DNSSEC- Trigger) on their laptops to have the validation occurring there.

If you rely on the DNSSEC validation to occur at your ISP (ex. Comcast in the US) your zone of attack exposure is then your local network and the connection to your ISP... so yes, and attacker could potentially inject bogus responses there.

If you rely on DNSSEC validation out at a public server such as Google's Public DNS... well... then your zone of exposure is much greater.

This is where the work going on within the DPRIVE working group within the IETF is so important. They are developing mechanisms to secure the confidentiality and integrity of the connection between your stub resolver / client and the recursive resolver you use. With DPRIVE covering your connection, you _could_ use a DNSSEC-validating resolver that was farther away from you.

<comment><USER10> Thank you for the answers.

More questions:

If I run my own DNS cache on 127., 172.16. or 10. then do I have to worry about "cache poisoning"?

Do I still need to verify authenticity of the answers to my DNS requests?

What if I can verify the authenticity of the authoritative DNS servers?

If we were somehow able to encrypt the DNS packets between my resolver and authoritative servers on the internet, and I have verified the authenticity of those authoritative servers, should I still have concerns that the answers I get could be forged?

</comment></comment></comment></comment></comment><comment><USER7> jocluteseh - your site seems to be down now (perhaps buried under HN traffic). Perhaps post it as a gist on Github or something like that? [https://gist.github.com/](https://gist.github.com/)

<comment><AUTHOR> Done... enjoy... or not, but just make sure the beer is cold.

[https://gist.github.com/anonymous/3f36dfeb3297e184417b#file-...](https://gist.github.com/anonymous/3f36dfeb3297e184417b#file- poorly_formatted_dnssec_rubuttal)</comment></comment>


Bill Budge posts Pinball Construction Set source code on GitHub - <AUTHOR> https://github.com/billbudge/PCS_Atari800

<comment><USER2> Although it's the source code for the Atari 800 version of PCS, it seems to have been built on an Apple II. From MAKE1 [1] for example:

        CALL -151
        3F2:69 FF 5A
        BLOAD GPAK.OBJ,A$1300
        BLOAD CDRAW.O,A$2480
        BLOAD PCSA800.PIC,A$2B00
        BLOAD DLIST.O,A$4910
        BLOAD SWAP.O,D2,A$4A00
        BLOAD TST.O,D1,A$4B00
        BLOAD GOATARI.O,D2,A$4B45
        BLOAD BOOT.O,D2,A$8E00
        BLOAD BOOT2.O,A$8E80
        BLOAD ZAP1.O,A$8F00
        BLOAD DOWNLOAD.O,D1,A$300

The first line invokes the Apple II "System Monitor", the second writes 3 bytes to memory at address $3F2 (the effect of which is to tell the computer to enter the Monitor whenever someone resets the computer from the keyboard), and the rest load binary files into different memory areas. I'm guessing it's all to build an image to be written to disk. (See [2] for more on the System Monitor.)

[1] [https://github.com/billbudge/PCS_Atari800/blob/master/Disk1/...](https://github.com/billbudge/PCS_Atari800/blob/master/Disk1/MAKE1)

[2] [http://apple2.info/wiki/index.php?title=System_Monitor#Gener...](http://apple2.info/wiki/index.php?title=System_Monitor#General_Intro_to_this_reference_and_System_Monitor)

EDIT: added additional details

<comment><USER3> It looks like he used an Apple II as the development environment, which is straight forward since both machines use the same CPU. The .S files are assembled to 6502 object files. The "makefile" loads each object file to a specific area in RAM, then Download.o transfers the contents of RAM to a waiting Atari 800 via serial connection.

<comment><USER4> And a development session would have looked somewhat like this:

<http://www.youtube.com/watch?v=CDPlfqpgW8c>

(I may miss the Merlin assembler, but I don't miss disk ][ drives at all.)

<comment><USER5> Wow, that brings back so many memories: thank you for posting this.

I loved Merlin.

</comment></comment></comment></comment><comment><USER6> This is spectacular. I really wish more great old game developers would do stuff like this. Not having the source code to the greatest games of our time is like having only half of the bible, or War and Peace. Or only half of Snowcrash or Neuromancer. Imagine!

Bill's also not the only developer who has this stuff in the garage. I think the IP rights are just tricky to deal with, so few developers are comfortable dumping this stuff into github yet.

<comment><USER7> I totally agree! I'd love to see the source code for the original Rollercoaster Tycoon, for example. From what I understand, it's 99% assembly with a few parts in C to handle media. It would be awesome to try to grok that!

<comment><USER8> Well, uh, you can view that alleged 99% with a disassembler ;) (missing labels, comments, etc. though.)

<comment><USER6> Well, without the comments, it's almost not worth it. They're like directors commentary.

<comment><USER9> For assembly, comments are more like the audio track for a drama, rather than directors' commentary. Sure, without them, you can see when entities are happy/sad/angry, but you have no idea why those things happen.

<comment><USER8> I don't think I agree with that.

Reading foreign assembly isn't that bad unless it is being intentionally obscured. It definitely takes time to decipher things but at the same time you really learn what's going on :)

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> According to his latest Tweet, he's planning on going through the code and adding comments. <https://twitter.com/billb/status/301403958415618049>

<comment><USER10> There's some nifty tricks that Budge did in the code. Just looking at this, for example:

               LDA (PARAM),Y ;JUMP TO SELECTION
               STA DOMNU6+1
               INY
               LDA (PARAM),Y
               STA DOMNU6+2
        DOMNU6 JMP $FFFF

Instead of creating a 16-bit lookup table and doing an indirect indexed branch (which I can't even remember if you can do on a 6502), Budge just modifies the code inline and lets the jump happen naturally. Very nice.

<comment><USER11> This is probably the most common way to handle jump tables on the 6502. If you're writing ROMable code you'll have to use indirect jmp (vector) instead of selfmod. It's more efficient to split the jump table into two halves though, with the LSB in one table and the MSB in another, and access it like so:

            lda param_lo,y
            sta vector
            lda param_hi,y
            sta vector+1
      vector = * + 1
            jmp $5e1f      ; dummy address, written with selfmod

</comment></comment></comment><comment><USER12> The awesome blog The Digital Antiquarian had a piece on Bill Budge and PCS two weeks ago:

<http://www.filfre.net/2013/02/01/>

</comment><comment><USER13> Here's Bill demoing this game in 1984:

[https://www.youtube.com/watch?feature=player_detailpage&...](https://www.youtube.com/watch?feature=player_detailpage&v=h-evE4a6crg#t=780s)

</comment><comment><USER14> Wow, I spent a lot of time with this game when I was eight or so. Brings back the memories. I'm pretty sure my Atari 800 is still in my parents basement. Just need to find a TV I can hook it up to...

<comment><USER15> Same, but on the Apple II version. I remember making Rube Goldberg like pinball layouts where the ball would be guided through all sorts of paths and down to where you'd only have to hit it with the flipper every once in awhile.

Pinball Construction Set, Spy's Adventure in North America, Robot Odyssey. So many classics on the Apple II that were fun and educational.

I basically learned college level circuit design by playing Robot Odyssey as a child. For those curious, here's a part of a Let's Play trying to solve one of the earliest puzzles in the game:

<http://www.youtube.com/watch?v=uNa4wivnjgs>

</comment></comment><comment><USER16> What language is this project in? Github doesn't seem to know what the ".S" files are...

<comment><USER17> That definitely looks like assembly :)

<comment><USER16> Some googling tells me it's assembly, but it's nothing I recognize...

Thanks! you beat me to my edit.. ;-)

<comment><USER18> Looks like a MOS Tech 6502? Seems pretty similar to a Zilog Z80. 8 bit processor with a 16-bit PC, though seemingly without the 16-bit paired 8-bit registers.

Machines from when assembly was still fun.

<comment><USER19> It is 6502.

(I'm not sure the 6502 counts as particularly much like a Z80?!)

<comment><USER20> Agreed, I had a Z80 card in my Apple II and they are very different. I found assembly on the 6502 a little easier but the Z80 allowed me to run CP/M and that opened the door to a tone of SW.

</comment></comment></comment></comment></comment></comment><comment><USER21> This is cool. Not so sure about the practice of committing object files to source control, but I guess it makes sense in a "the more, the better" kind of way, at least.

As a side note, I must say that as a former (contracting) developer at an EA studio, it's a very interesting feeling to see the programmer ( _the_ programmer, as in "the one") of a recent release sit next to EA's boss and talk about the title.

Things have certainly moved on a bit, since then. :)

</comment><comment><USER22> This is great! I really wish there were a developer commentary track that you could listen to as you read the source code. Would be really cool to hear what they thought about with specific routines, or neat hacks they used to make things work in small memory footprints like that.

</comment><comment><USER23> I wish that someone would find Stuart Smith and get him to do the same with Adventure Construction Set.

</comment><comment><USER24> I'm thankful the author did this, but there's no copyright notice or license.

Obviously I can assume it's copyrighted, but it would be nice to have the explicit declarations.

<comment><USER25> Just for whatever it's worth (I assume you know this, but for the class): with no explicit statement, the default in US and EU is "all rights reserved".

<comment><USER26> True. And yet: the author has overtly placed it in a public place normally understood to be for sharing.

At the very least, people can reasonably assume an implicit permission to do the usual things that are done with Github public repositories: fork at Github, create local copies, create derivatives with the intent of sharing back to the original, etc.

And, if he's using Github's free plan, that's only available for projects that are "open source", a term with a fairly well-understood meaning in our profession. So he's likely also implicitly represented to Github that whatever the formal license, it qualifies as 'open source'.

The author could be confused. It could be a trap. He could probably withdraw any of these implicit permissions by taking the right explicit future steps.

But in the meantime, people don't have to fear normal copying and sharing based on a default 'all rights reserved' assumption. It's probably OK, and even if the author changes his assertions later, penalties for copying during this 'implied consent' period are unlikely.

<comment><USER25> Is there something in the Github TOS that suggests that? Because otherwise I think your beliefs about people's reasonable assumptions are the opposite of true.

Although I agree with you that his intentions are probably not at this point to take advantage of his copyright on the code. :)

<comment><USER26> If the author is using the free plan, Github's 'plans and pricing' indicates that's for 'open source' projects.

As far as I can tell, there's no way to turn off a 'public' Github project's download, fork, and pull request functionality. Indeed, those functions are emblematic of the service, and they're meaningless without grants to make copies and republish derivatives far beyond the legacy all-rights-reserved defaults of legislative copyright law.

IANAL, but placing code on Github, where those features are mandatory and expected, looks like an overt act authorizing related copying and modification — an 'implied license' — even without the explicit grants provided by a formally-expressed open source license.

<comment><USER25> That is definitely not how the law works.

Surely we agree though that it doesn't much matter here. I don't think Bill Budge is going to sue you for porting Pinball Construction Set.

<comment><USER26> You are definitely wrong in your 'definitely' assurance.

Someone absolutely can get _implied_ permission, from either a physical property-holder or IP rightsholder, when the owner's actions (or even non- actions) are reasonably interpreted to have indicated mutual assent. or created a 'constructive agreement'. or simply waived some rights (modifying the 'all rights reserved'). Some examples of relevant legal principles:

<http://en.wikipedia.org/wiki/Implied_license>

<http://en.wikipedia.org/wiki/Usufruct>

<http://en.wikipedia.org/wiki/Implied_in_fact_contract>

<http://en.wikipedia.org/wiki/Estoppel#American_law>

<http://en.wikipedia.org/wiki/Laches_%28equity%29>

It gets murkier in copyright law, because legislation has often been crafted to supercede common law and court precedents.

But these are still potent issues; for example, Google's lawyers sought a summary judgement against Oracle on many of these 'equitable' grounds, based on Oracle's public statements and actions.

Also, the idea of an 'implied license' was a central defense used by those sued by copyright troll Righthaven. (The Righthaven entity has now lost cases right and left, and is facing sanctions for its legal misconduct: <http://righthavenlawsuits.com/.>)

So it's not just that Bill Budge _won't_ sue. It's that if he did, and asserted that his intent was always 'all rights reserved', he'd almost certainly lose. Defendants would have a strong, perhaps ironclad argument that upload to Github was implied permission for lots of copying/reuse/modification. (That is, you can't put something into a world- readable folder that by custom means "download, share and improve me" – and then assert that's not what you wanted people to do.) And that goes doubly if Budge is on the free plan, that's reserved for 'open source' projects.

When informing people about _the letter_ of copyright law, and the maximal interpretation often asserted by rightsholders and literalists/authoritarians, it's important to also communicate how copyright law is really practiced and interpreted by the courts, and reasonable people. Many of our era's emblematic companies and services -- including Github, Google, YouTube, and blogging -- absolutely depend on the more liberal, fuzzy, implied-permissions and reasonable-balances practice of copyright law.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> This is a masterpiece of early programming. I am very grateful he is posting the source.

</comment><comment><USER28> It is cool that people are doing this (Karateka, etc.)</comment>


Ask HN: How FULL is the stack? - <AUTHOR> I consider myself to be a full stack developer in that I can write backend code (node.js,Java Spring, PHP) and frontend (Backbone.js, Ractive.js). I am not really good with CSS though.<p>In the future, do you think a full stack developer would be expected to be familiar with machine learning too in Python or something else? <comment><USER2> Machine Learning, as it is practiced today, is a field with a huge amount to know -- just as you could make webapps with plain HTML or write them in C and compile them to Javascript you could choose a huge number of algorithms and specific implementations of algorithms.

A big part of the future is systems like this

[https://aws.amazon.com/machine-learning/](https://aws.amazon.com/machine- learning/)

which let you get machine learning done without even choosing an "algorithm" such as neural network, decision trees, support vector machine, whatever. The thing either has a very flexible algorithm in it, or it chooses an algorithm.

That kind of thing is an "expert system" which is an expert on machine learning -- it tries a bunch of things, evaluates them, and shows you the best one.

A better tool would engage you in a dialog over the data and not be such a black box.

</comment><comment><USER3> in the future, a full stack engineer will be required to do _everything_.

\- Invent/discover new materials to replace silicon, copper, gold, etc

\- Create CPU using above materials

\- Create Kernel to run on above CPU

\- Create Software language(s) for application

\- Create Software libraries for above language(s)

\- Create application using above libraries and laguage(s)

\- Design interface

\- Create new interface rendering language

\- Create new image format

\- Create above interface using above rendering language and image format

\- Create new network transfer technology

\- Create new Ultra Quad Super Duper HiDPI physical screens to take advantage of new interface

\- Create new GPU to drive said screen

\- Create new batteries to power above devices

\- Create new OS to use and manage above devices

\- Create new humans with eyeballs capable of appreciating Ultra Quad Super Duper HiDPI screens

\- Create pancake stack for above humans to eat for breakfast.

Seriously though - if a project has the same person writing Database queries and Media queries, run. Run like the wind and do not look back.

<comment><AUTHOR> your about reads "Ops/infrastructure and web app development" :D

<comment><USER3> Yes, it does. Also, I was once employed primarily to write HTML/CSS/JS.

</comment></comment></comment><comment><USER4> "Full stack engineer" is the new "Coding Ninja". It doesn't mean anything. It is most often used by non-technical founders who just want to hire one guy to do the work of 3.

As you said "How full is the stack?" Do you need to know how to setup and administer servers? Do you need DevOps skills? Do you need to be able to write backend/frontend code? Do you need to know how to design the UX as well?

I systematically ignore all positions for "full stack engineer" because in my mind it translates to "we don't know computers but we have a Great Idea(tm) and we just want some nerdy guy to handle all these computer thingies for us".

<comment><USER5> > "Full stack engineer" is the new "Coding Ninja". It doesn't mean anything.

> Do you need DevOps skills?

Certainly, as the "DevOps skills" means the same as "full stack engineer": nothing.

<comment><USER4> Well, DevOps is definitely an over-used buzzword, but I think it's a good term to use as an umbrella for technologies like Chef, Puppet, Ansible, etc. It is definitely a different skillset than the one required to write software.

I think DevOps gets a bad reputation mostly because of companies who just use it to look cool without really embracing the "infrastructure-as-code" philosophy (a bit like Agile/Scrum "we do Scrum, but...")

<comment><USER5> > I think it's a good term to use as an umbrella for technologies like Chef, > Puppet, Ansible, etc.

No. Those already have their umbrella term: infrastructure as a code. You even mention it yourself.

<comment><USER6> That clearly takes too long to say.

DevOps covers more than just "infrastructure as code", though.

<comment><USER2> I would say it is a viewpoint I attained from doing web projects for various "startups" and "internal startups" starting in 1999 or so.

In these cases you have very small teams so you can't afford to have separate DBA, Sysadmin, Network Operations, and Development people -- at least not entirely.

When you've had experience doing everything yourself I think that makes you a better team member. For instance I write very solid server code because I hate being woken up at 3AM.

<comment><USER6> Sure, knowing all the things makes you a better team member.

But all this is orthogonal to what was being discussed. DevOps is a thing, and the skillset(s) are not _necessarily_ the same. Similarly anecdotal; I'm a pretty decent dev. I'm _not_ a decent ops person for a variety of reasons, the biggest being a complete lack of interest. Would knowing more about ops make me a better team member? Maybe marginally, but we have devops people that don't have to concern themselves with application code, and apps people that don't have to concern themselves with (almost any) of deploy/ops details.

 _That_ makes us more efficient, because we don't _have_ to know all the things, and can actually have time to focus.

<comment><USER5> Oh, so you have devops people and dev people. How strange, given what's typically behind devops buzzword.</comment></comment></comment></comment></comment></comment></comment></comment>


Solar energy companies in California deploy batteries to homes to stablize grid - <AUTHOR> https://qz.com/1288623/solar-energy-companies-are-using-california-homes-as-batteries-to-power-the-grid/ <comment><USER3> If you get one of these batteries with the main goal being backup power for your own home in case the grid goes down, why would you ever join such a program? Presumably, if you tie your battery to the grid, and there's some sort of issue with main backbone generation, the grid would pull from your battery for what it thinks is a temporary issue, after which all power would be gone, and now your backup has been drained.

This effectively means that the only people that would join are people who would be paid to do so, but then that introduces the question of whether it isn't simply cheaper and more efficient for power companies to just deploy larger scale batteries that they control, rather than pay random people to put them in their own - much more uncontrolled - homes.

<comment><USER4> It sounds like these companies are providing frequency modulation, and smoothing our the renewable power signals with the batteries.

So the user still enjoys - and pays for - the storage component while the utility enjoys and pays for the frequency reg.

</comment></comment><comment><USER5> I like the european ancillary services model. In Switzerland for example (It's the one I know quite well), it's the TSO role to keep the grid stable; in this case Swissgrid.

Swissgrid then passes on the costs of this stabilization to the consumers.

This stabilization is made by 3 main services: primary, secondary, and tertiary control (the level indicates the response time: instantaneous, 10s, 15 min). Anyone can be a ancillary services operator if they are big enough (5MW of control), and if they respect certain rules (must be audited, etc.).

Then, when there is a need of control, a bid is created and the cheapest operators win the bid, effectively earning money (as a rule of thumb, you can earn ~20kCHF/year if you offer 1 MW of tertiary control power). It's much more for secondary.

This model effectively makes the industries want to stabilize the grid either by consuming more, or consuming less when there is a need of grid stabilization. I would really want to see how much tesla will earn with their site in belgium, because their marginal cost of control must be quite small.

PS: sorry for the english

</comment><comment><USER6> as a potential owner of a solar home with large (DIY) powerwall type storage: I am not a fan of this idea. I know how cycle life and cycle depth affects the overall lifespan of LiIon, LiPo and LiFePo4 type batteries. I want to control how many times my home cycles its batteries from full down to 10-15%, how deeply it can discharge, etc.

I do not want some remote agency controlling the discharge of my home battery, except in a miraculous future scenario where we invent batteries that are good for 20,000 deep cycles with <5% degradation over 20+ years.

<comment><USER7> Once off grid solar battery tech is mature it will transform the housing market. Hoping the utility bureaucrats and their captive politicians don't destroy this opportunity by commandeering our batteries

<comment><USER8> I have a hard time believing this. There's simply not enough lithium in the world to support every house having its own battery, let alone support all of the EVs coming into production.

Besides, there's genuine benefit being hooked up to the grid. I'll gladly pay the $10/month interconnection fee just to have that as a backup to my battery.

<comment><USER9> There is plenty of lithium. Reserves are low because until recently demand was low and so no one bothered to go and look for more. And then there is virtually unlimited lithium in the ocean, which costs more to get, but would still be a small part of battery costs.

The bigger problem is cobalt,but from what I understand people are working on various alternatives.

</comment></comment></comment></comment><comment><USER8> Because of SGIP[1], you can basically get a powerwall for free right now in CA depending on the circumstances. However, the requirements for the program all but guarantees it will use up the life of your storage system.

Tesla's powerwall at least allows you to do things like set reserve levels to 15% or 30% to make sure you're not cycling your battery too aggressively, but if you don't meet the required 57 full discharges a year they'll disable features like this automatically. In other words you own it, but you don't control it.

1\. [http://www.cpuc.ca.gov/sgip/](http://www.cpuc.ca.gov/sgip/)

</comment><comment><USER7> Hawaii is the place to watch, they just changed utility law to recognize how much their grid use models have changed [https://www.solarpowerworldonline.com/2018/04/hawaii- reforms...](https://www.solarpowerworldonline.com/2018/04/hawaii-reforms-how- electric-utilities-get-paid-opening-options-for-home-solar-and-batteries/)

Battery tech is still very immature though, and a significant persistent fire risk if damaged, as is the case with electric vehicles.

</comment><comment><USER10> Why aren't the electric cars being tapped as a battery for the house/grid while plugged in?

<comment><USER8> Some cars (such as the Leaf) already supports this in a "vehicle-to-the-home" type system. I think the problem is largely bureaucratic and not technical.

Besides, I want my battery to last a long time, not necessarily be sacrificed to the grid.

</comment></comment><comment><USER11> So once all batteries are set up, what happens if some hacker discharges them all at once?

<comment><USER12> The exact same thing that would happen today if some hacker ramped up production from a natural gas plant. Either the rest of the grid would respond by ramping down production or voltage/frequency would go out of whack.

<comment><USER11> Makes sense. The one difference is see is the speed which you could ramp up the power and the amount of current you can draw.

Even the fastest gas plant presumably needs a few seconds to power up - <USER2> time for the network to react. Additionaly, the maximum power and current it can deliver is generally known.

In contrast, the plan linked here basically proposes to build a giant distributed capacitor bank - with ever-growing capacity.

From what I understand, purpose-built large capacitor banks are used to generate very short pulses of enormously large currents - e.g. to power experimental lasers, railguns or similar.

Maybe my imagination runs wild here, but I see no reason a hacker with appropriate access couldn't do something similar - e.g. command all batteries to unload with the largest possible churrent at once and setup switches in such a way the current from all batteries is directed to a particular location.

I'm don't know what you could do with the resulting pulse but probably nothing good.</comment></comment></comment>


Ask HN: What is the best way to setup medicine reminders for my dad? - <AUTHOR> My dad is 70 years old and has a whole bunch of pills that he needs to take. He keeps forgetting to take his medication and I've been trying to come up with the best reminder system for this. I've tried installing a whole bunch of apps on his phone which do this but nothing has worked very well. He has an iPhone and the Apple Watch, and I am looking for a system that works across both these devices. If it also integrates with the Google Home then thats a bonus. He has poor vision so accessibility on the app is super important. Is this a problem that any of you have solved for your parents? <comment><USER2> Does he have a pill box?

If not, get a transparent pillbox with compartments for every day of the week (you can also get them with separate compartments for morning / evening).

Then put it in a place that he will always see it (eg. kitchen table).

No need for an app, and it's easy to check if he already took his meds or not.

Apps or other things are kinda bad, because you can silence the alarm and then forget to take the meds, or he can accidentally take the meds twice.

If all the doses for the week are prepared ahead of time, these mistakes are not so easy to make.

<comment><USER3> What about an app that forces you to take a photo of the pillbox before and after taking the pills?

Perhaps you can skip the "before" photo, but it may help to reduce double doses.

If the contrast is high and you can calibrate the app using photos of an empty pillbox somehow, it doesn't look imposible. On the other hand [https://xkcd.com/1425/](https://xkcd.com/1425/)

<comment><AUTHOR> Haha you also forget that if he could remember to do all of this then I wouldnt be posting this in the first place!

<comment><USER3> IANAMD, im just wandering if something like this may work:

* The app has an alarm (like a clock). You can configure the time, let's say 9am.

* When it rings, the app put a message in the screen "Time to take your medicine. Please pick the pillbox and take a photo".

If he doesn't take the photo, make the app sound and show the message again after 2 minutes. After a few tries, send a message to some relative that is the guardian.

It will need some calibration to recognize the pillbox.

* After the photo of the pillbox, show a message: "Great. Today is Monday. Open the Monday slot and take another photo".

Repeat if there is no photo, and send a message to the guardian after some time. I'm not sure if in case of failure it is better to go to the previos step or not.

* After the photo of the open pillbox, show a message: "Take your medicine and then and take another photo"

It will need some calibration to distinguish the pills and the empty slot.

* After the photo of the empty pillbox, show a message: "Close the pillbox and store it. Great. See you tomorrow."

Something like this will need a lot of testing and perhaps FDA approval, but it doesn't look impossible.

(Perhaps it is easier to start with contraceptives pills, that have younger users that are more use to apps and don't have memory problems.)

</comment></comment></comment></comment><comment><USER4> Most pharmacies will prepare his meds in day-packs, some times more than one, that he takes at the A.M./P.M. etc. There is a fee for this, but they are setup for it and it should be manageable. That means he only has to deal with 1 or 2 events daily instead of opening many vials and taking out one pill and putting it into a pill holder that he will take. As it is the reminder now tells him to go to his meds and assemble his daily regimen of morning pills - this is time consuming. With aggregated pills it is easier. here is one, there are many [https://www.pillpack.com/](https://www.pillpack.com/) Still not fool proof, he must be well watched. There are some pill mangers that will phone you of he misses his pills?

</comment><comment><USER5> Carezone has a app that might be helpful, but what seems to work best for my parents is to have them get a physical system in place with those full week pill organizer boxes. [https://carezone.com/home](https://carezone.com/home)

</comment><comment><USER6> For older people, there's nothing better than face to face interaction and someone to guide them through things. You could consider hiring a caregiver to stop by every morning for 30 min.

Another option would be to call him every time he needs to take his pills and talk him through it. If that works, where the reminder apps don't, you could gradually switch to having someone else, like a caregiver, call him.

Another possibility is he doesn't like taking the pills because of how they make him feel but he's afraid to tell anyone.

</comment><comment><USER7> Could you attach a paper calendar and a pen to his fridge, and then put the pills into a pill box with a container for every day of the month?

He can check off each day on the paper calendar after he takes his pills.

If his calendar gets out of sync with his pill box, it's easy to re-sync. There's no single database.

I assume that while he probably looks at his phone every day, he definitely looks at his fridge many times a day.

If you want to get really high tech, you could add a $20 Wyze came and hang it near his pill box so you can check up on him.

<comment><USER2> We tried the calendar to check off days for my son, and that didn't work. We'd check off days and then forget the pills, or give him the pills and not check the dates.

Pillbox with pills for every day of the week works better.

<comment><USER7> Maybe throw in a once-daily, low-tech alarm, and you have both the timely reminder and the unambiguous record.

</comment></comment></comment><comment><USER8> You need something like what these folks are building: [https://apothewell.com/](https://apothewell.com/)

</comment><comment><USER9> If you want to use some kind of automated reminder, you could put together something pretty quickly on AWS. Use a combination of step functions and lambdas to send texts via Twilio. I'm not sure of the pricing on Twilio but the AWS stuff will be free.

I would say use this in combination with a well labeled pill box would be a good solution.

<comment><AUTHOR> I actually like the idea of using Twilio instead of an alarm. A phone call is more likely to get him to act on it rather than a reminder on the phone. Thanks!

</comment></comment><comment><USER10> Do you use the calendar? I always set reminders in my calendar. The reminders are synced to my phone so they show up both on my desktop and on my cell phone. It's also synced to my gmail so my Google calendar is also able to notify me.

When you set the calendar entry, set both the reminder and click the repeat to choose 'daily'

</comment><comment><USER11> I got this for my wife:

[https://www.amazon.com/gp/product/B004BRXI2U/ref=ppx_yo_dt_b...](https://www.amazon.com/gp/product/B004BRXI2U/ref=ppx_yo_dt_b_search_asin_image?ie=UTF8&psc=1)

It's pill box combined with an alarm clock.</comment>


Ask HN: Why YC companies don't raise money after Demo day - <AUTHOR> Looking at this link: http://www.seed-db.com/accelerators/view?acceleratorid=1011 a lot of companies seem to not raise any money beyond the initial 120k from YC...what's the story behind these companies?  I would expect all of them to raise substantial money at least a few months after Demo Day... <comment><USER2> Most pre-series-A funding isn't announced, so they don't appear in Crunchbase or seed-db.

<comment><AUTHOR> Sure, but you have the option of saying "Undisclosed" right? Seems like a lot of startups use funding rounds for PR. I wanted to know if 120k is sustainable for more than 6 months or these startups have something else going for them...some could be profitable right away, but not half of all the startups...

<comment><USER2> "Undisclosed" would be the answer for nearly every startup. All public databases can do is add up the reported fundraising to provide a lower bound.

It's rare for a young startup to be profitable, but many have some revenue which extends their runway.

Founders who live cheaply can stretch $120k well beyond 6 months. 24 months isn't uncommon.

</comment></comment></comment><comment><USER3> That is not a good expectation. _Most_ startups don't raise money, but accelerators like YC improve the odds.</comment>


South Africa introduces first e-police station - <AUTHOR> http://www.techcentral.co.za/sas-first-e-police-station-launched/54014/

<comment><USER2> Ok, I was wondering what was meant by "e-police station", basically that's their first police station with computers.

So basically, it means they'll be able to take statements on computers, making them harder to "loose".

Also, the police cars will get tracked, making it harder for police officers to go about their business.

On a brighter note, there are 111 taverns in the area, so they'll never long for a free drink and it should be pretty easy for them to fill their quotas.</comment>


Britain has no idea how close it came to ATMs flooding the streets with money - <AUTHOR> https://www.theregister.co.uk/2020/05/04/who_me/ <comment> nappa-leon It seems they were not close at all, as the bug was found in prototype testing and then fixed immediately, but that doesn't get clicks.</comment>