Ask HN: Do you prefer paper or computer for note taking? - <AUTHOR> I'm asking mainly in the context of learning new stuff. I'm studying machine learning/data science-y type stuff right now, and although Jupyter notebooks are amazing for this, I also can't beat the convenience of sketching out a graph, diagram or equation in a notebook.
I usually prefer to centralise my notes rather than have them in two places, so it's something I've been thinking about recently.
How do you organise your note taking life? <comment><USER3> I have repeatedly tried to convert over to pure digital note taking, but have not been able to. This is in the context of active learning (classroom, live video lecture, etc. where I cannot pause).

As you said, there is nothing like the convenience of sketching out a graph, quick comments on the margins, drawing arrows to point at stuff, etc.

I know there are digital solutions to everything I mentioned, but none of them have felt as natural or productive as old-fashioned note taking, especially when at the mercy of however fast the teacher is teaching.

So, I usually hand-write notes as I'm learning. As a part of my studying method I digitize the notes as I'm studying them. I find re-writing out the notes verbatim helps me solidify what was learned and clarify any areas I'm not 100% with.

<comment><AUTHOR> Active learning is definitely a weak area for digital note taking. When I use a computer in this context, I tend to 'take notes' with extreme shorthand and polish it up later - however at that point I've struggled/failed to remember to include some key insight or diagram.

<comment><USER4> This is actually an area I'm working on.

As @ziddoap mentioned, the main drawback to digital note-taking and learning is that it is not as natural to engage with your notes (drawing, making comments, etc).

But there are other aspects of digital notes that make them superior to hand- written ones when it comes to learning. It's just that, imo, it hasn't been optimized for yet.

Specifically, take spaced-repetition. One of the most proven ways to improve memory. It'd be easy to integrate such a system inside a note-taking app - <USER2> that would help ensure note-takers self-test themselves and periodically review their notes. But no note-taking app is doing that, at least not built- in.

So that's why I've started working on this myself. The app is called Studbits ([http://studbits.com](http://studbits.com)), and the idea is simple: we let you create flashcards alongside your notes and then remind you to review them with a spaced-repetition system.

</comment></comment></comment><comment><USER5> A middle ground between paper and computer will be perfect for me. I would like to take notes and sketch diagrams on paper. But I want to sync them to Notion for accessing later. Remarkable [0] looks like an interesting project. Keeping an eye on it its development.

[0] [https://remarkable.com/](https://remarkable.com/)

</comment><comment><USER6> You should always review your notes, possibly more than once (consider spaced repetition). As such there is space to have a system in which you:

* Take notes by hand;

* Review the notes, converting to digital form;

* Review the notes, inserting into a Spaced Repetition system;

* Keep the information fresh via Spaced Repetition.

Notes for learning are not a write-once-read-never system.

</comment><comment><USER7> Both, depending on what/where/when I'm taking notes.

Resist trying to find the perfect system. Forgive yourself, and do what comes naturally.

I mostly use digital notes. Except when I use paper. I then use the Scanbot iPhone app to store paper notes digitally in my notes app of choice (Apple Notes for personal, Bear Notes for work, in my case).

</comment><comment><USER8> I prefer paper - but I've often tried transitioning to a digital only system. For me there is too much friction with digital note taking, despite the benefits that it offers in terms of searchability and organisation.

I do scan my notes periodically - but if I'm honest I very rarely find that I need to go over them again.

</comment><comment><USER9> I think a combination is best. Use paper for taking notes at meetings, discussions, seminars, etc. Use digital notes for maintaining references, adding multimedia, and notes that need future edits. I think the key for me is periodically manually transitioning key parts of my paper notes to large digital notebooks

</comment><comment><USER10> I use paper to take notes that I never come back to read -- usually use them to think/imagine/create. I used to finish one 60 pages scratch book per month -- these days I don't think that much.

And I use WorkFlowy to archive what I probably need to refer to in the future.

</comment><comment><USER11> Paper. I tend to remember better if I physically write something down then if I type it out.

</comment><comment><USER12> Computer, by far. I can type as fast as I think, but not write that fast.

Touchscreens help with sketches.

For equations, normally I write down the "long, English version" of them, like how the variables fit together. So speed helps more there.

</comment><comment><USER13> Computers always. I lose paper too easily. I type faster than I can write. I like using markdown and having backups and being able to copy and paste stuff in.

</comment><comment><USER14> I use digital notes. If I need a sketch or graph, I draw it on paper then take a picture on my phone.

This way my notes are synced across devices and search-able.</comment>


FBI Stymied by Islamic State's Use of Encryption, Director Says - <AUTHOR> http://www.wsj.com/articles/fbi-stymied-by-islamic-states-use-of-encryption-director-says-1447866592 <comment><AUTHOR> Full text:

The director of the Federal Bureau of Investigation said investigators have been stymied by Islamic State's use of encryption.

FBI Director James Comey, speaking at a cybersecurity conference Wednesday at the Federal Reserve Bank of New York, said the bureau has tracked Islamic State recruiting efforts on Twitter and reviewed private messages between sympathizers after obtaining court orders.

But when Islamic State commanders find a recruit willing to die for the cause, they move their communications over to encrypted platforms, "going dark," he said.

Mr. Comey didn't say whether encryption was used in planning or executing the Paris attacks, but the massacre loomed large at the conference, which included law-enforcement officials from the U.S., U.K. and France.

His remarks were part of a public campaign by law-enforcement and intelligence officials for access to encrypted phones and communications, in the face of new software and devices promoted by companies as impervious to government surveillance.

The aftermath of the Paris attacks could bolster the argument in favor of such access after years of movement toward more customer privacy, fueled by revelations of U.S. surveillance programs.

U.S. counterterrorism officials haven't determined whether terrorists used encrypted communications to plan or execute the Paris attacks, but they said they expect evidence to emerge as the investigation continues.

Sen. Richard Burr (R., N.C.), chairman of the U.S. Senate Intelligence Committee, said after a briefing by senior intelligence officials Tuesday that the terrorists involved in the Paris attacks likely used "end-to-end" encryption. He said encryption was likely because no direct communication among the terrorists was detected.

Islamic State, which claimed credit for the bloodshed, has demonstrated its technological savvy in tutorials for sympathizers on how to evade electronic surveillance on the cheap, including an eight-minute video explaining the eavesdropping capabilities of hostile governments and how they track phones.

Other Islamic State bulletins have analyzed the vulnerabilities of brands of electronic equipment and messaging applications, ranking them based on their ability to foil surveillance.

In separate remarks Wednesday, Manhattan District Attorney Cyrus Vance Jr.. said his office has been unable to access evidence on encrypted phones in 111 cases handled by his office. Newer operating systems on phones made by Apple Inc. and Google can't be unlocked without the user passcode, even by the companies themselves.

Mr. Vance called for legislation that would mandate that mobile-phone companies have the capacity to unlock a customer device when presented with a search warrant. "We don't want a key held by the government," Mr. Vance said.

Neema Singh Guliani, legislative counsel for the American Civil Liberties Union, called Mr. Vance's proposal "misguided" and disputed assertions that encrypted devices have undermined law enforcement.

The law advocated by Mr. Vance would "compromise the security of Americans by making their personal information and communications more vulnerable to cyberattack and theft," she said.</comment>


Austin, the Python statistical profiler v1.0.1 out now - <AUTHOR> https://github.com/P403n1x87/austin <comment><AUTHOR> I am delighted to announce the release 1.0.1 of Austin. If you haven't heard of Austin before, it is a frame stack sampler for CPython. It can be used to obtain statistical profiling data out of a running Python application without a single line of instrumentation. This means that you can start profiling a Python application straightaway, even while it's running on a production environment, with minimal impact on performance.

The simplest way of using Austin is by piping its output to FlameGraph for a quick and detailed representation of the collected samples. The latest release introduces a memory profiling mode which allows you to profile memory usage.

Austin is a pure C application that has no other dependencies other than the C standard library. Its source code is hosted on GitHub at

[https://github.com/P403n1x87/austin](https://github.com/P403n1x87/austin)

The README contains installation and usage details, as well as some examples of Austin in action. Details on how to contribute to Austin's development can be found at the bottom of the page.

Austin v1.0.1 is also the first version of Austin to be available from Homebrew for easy installation on MacOS. These are the other places where Austin can be installed from:

Linux:

        Snap Store
        Debian repositories

Windows:

        Chocolatey

Furthermore, you can stay up-to-date with the project's development by following Austin on Twitter ([https://twitter.com/AustinSampler](https://twitter.com/AustinSampler)).</comment>


Managing by Outcomes - <AUTHOR> https://www.producttalk.org/2019/10/managing-outcomes/ <comment><USER2> There wasn't really anything I disagreed with in this. At the same time, there was nothing here that made me have an "aha" moment about how a company could really use this to improve, and worse, it avoided most of the "in the trenches" difficulties that make managing by outcomes instead of outputs (sometimes) very difficult in practice, especially in software.

In any moderately complex software product in a medium-to-large company, you're talking about teams, not just a singular team. You want folks to have as much freedom as possible, but at the same time, there needs to be a high degree of coordination and planning between teams, _especially_ when it comes to software. You want to "change the balloon from red to blue" to use an example from the article? But what about the marketing team that already sent out the teaser video with the red balloon?

Honestly, one of the most demoralizing things I've seen affect software teams is not micromanagement, but what I call "whiplash" management, where priorities and directions change so frequently that teams feel like they have to spend more time replanning that actually building outputs.

<comment><USER3> Whiplash management is extremely real and I've seen it take chunks out of company growth and revenue.

Seems to me that the best way to combat it is to provide leadership with as much feedback as possible from both internal and external sources so they can evaluate options rather than jumping to the first "solution" or "next best thing" they think of.

What do you think?

<comment><USER4> That's presuming that the drivers for management have product/customer reality as a high priority. In big companies, "managing up" and corporate politics strongly dominate. Those are the fundamental drivers of whiplash management.

</comment></comment></comment><comment><USER5> I think there's a specific problem in here; outputs are concrete, outcomes are more abstract. All of the decision-making on how to achieve the outcome needs to sit low-down in the team doing the work, which is going to be fine (and ideal) in some situations, but terrible in others. Decisions should definitely be taken at the lowest point possible in the organisation, but they also need:

\- pretty complete domain knowledge

\- all the relevant information

\- to not conflict with decisions being taken elsewhere.

As an obvious example, if you task the team who "own" the login page with an outcome of "50% fewer account lock-outs due to forgotten password", there are good ways and bad ways of achieving that outcome. Crucially, do they have enough knowledge / information / decision-making power to decide that a "reset password link sent by email" type feature is OK from a security perspective? That it won't conflict with the registration team's outcome to increase sign- ups (because they're thinking of doing away with requesting email)? What about an opportunity to allow people to sign-in on the web via the app (via QR code, a la many challenger banks) - this team doesn't "own" the app, how do they do that?

Having small teams is wonderful if the teams can be autonomous. If they suddenly need lots of outside co-ordination and discussion to ensure that their deliverables for outcomes don't tread on the toes of other teams, then they're coupled up again like a larger team and effectively lose the autonomy.

The role of management is exactly to provide this autonomy by pre-supplying the co-ordination and ensuring the work requested from the various teams makes sense as a cohesive whole. You generally can't delegate high-level business outcomes like "increase profits by 10%" to a single team, or multiple teams, without that level of agreement or co-ordination.

</comment><comment><USER6> In every real-world organization, of any size at all, that I have ever worked in or been close enough to see into, this would mean: 1) the the output I want, and 2) if this doesn't give the outcome I want, because I asked for the wrong thing, you get dinged for that

There is a reason for management by output: it's honest. The manager decides what the output is, which is what's going to happen anyway, and if the direct labor made that happen, then the outcome is on the management, not the direct labor.

Pretending otherwise, will not result in the direct labor determining how to get to the outcome, it will just result in: 1) determine, through an elaborate game of corporate charades, what output I want, and pretend you chose that 2) deliver that output 3) insure that output results in the correct outcome

Managing by output is far more honest, and only judges the employee by what they are in fact actually allowed to have any control over.

</comment><comment><USER7> As an agile, okr, lean, and pragmatic product guy... we still aren't here yet.

Tell dev teams 'why' and they complain about not having 'what.' tell them 'what' and they complain about not having 'how.' tell them 'how' and they complain about not having 'what' and tell you to mind your own business.

The problem is that it's too much for one person to define. i think the solution is having technical ux people (yikes) work on the 'how' with the devs and users.

<comment><USER8> I guess I don't understand if you've got a good why it's so hard to arrive at some reasonable approximation of what. You can so quickly prototype and test a bunch of whats. You can draw things on paper, you can spend a week luxuriating in all the whats if you have a good why.

And if you don't have a good why, no amount of design or development will save you.

</comment></comment><comment><USER9> A great read "Corps Business: The 30 Management Principles of the U.S. Marines" ( [https://www.amazon.com/Corps-Business-Management- Principles-...](https://www.amazon.com/Corps-Business-Management-Principles- Marines/dp/0066619793) ) and where it talks about communicating the "End State" of a mission instead of the steps required to reach that state. This encourages decentralised decision making, so that those "on the ground" \- those actually building a product - are able to take the best decisions given the circumstances they encourage.

To me this is why OKRs work more effectively (so long as you take the metrics with a pinch of salt) than traditional roadmaps. You're focused on achieving a business state rather than chasing a set of arbitrary deadlines for "Feature X". Smart people suddenly have space to use their brains.

In fact typical product roadmaps end up a source of toxicity in most organisations I've worked in...

\- Out-of-date the moment they are published.

\- Tying down product managers with moving little boxes around PowerPoint; people who'd be better off getting out of the building and talking to customers or working with engineers

\- Causing a blame culture around missed deadlines, sapping everyone's morale

\- Needing multiple versions depending on the audience; low granularity for top level management, high granularity for engineers, carefully worded for customers and users e.g. "Add ad tracker" or "Fix bug causing data loss" may not be what you want sales people to present

\- Always subject to (mis)interpretation

\- Based on wild estimates of how long things will take 3 quarters ahead through the year

\- Too focused on shiny deliverables and ignoring things like "We need to have to this quarter for re-writing a major component that blocks everything else"

\- Often unread or poorly reviewed

\- Bad at visualising dependencies between things being worked on

\- A source of silliness like "Why are wasting time doing X when we know we need to be doing Y?" ... "Because it's on the roadmap"

... and probably loads more.

</comment><comment><USER10> I've always thought as this more in terms of strategies and tactics. Theory of Constraints talks about this. The Strategy is what you want to be true, and the Tactic is how you do it. Strategies are best communicated as SMART goals, which is compatible with the OKR part. As far as managing, if I'm a manager, I give my subordinate a strategy, and trust them to come up with a tactic that is sufficient to make the strategy true (and I'll be a resource for them and work to keep them unblocked).

If a tactic isn't actionable, then it might have several substrategies. This can map well to an org structure.

</comment><comment><USER11> I was totally with the presentation until about 40% of the way in. My objections with these kinds of "more agency for the team" approaches are as follows:

1) We are assuming dev teams _want_ to do the extra work of defining what to make, or put another way, are happy with being responsible for it. Also for the people that do think that way, it assumes their teammates are likewise motivated.

2) In my experience, developers are not people-oriented and therefore will naturally resist collaboration at some level, especially with with customers.

3) Does any developer really think their time is well-spent participating in investigatory market research, advocated in this presentation?

Thoughts?

Disclaimer: I am a developer. I can get enthused about these approaches, but often gravitate back to the hermit-like mentality that drove me to programming in the first place. I can't help but think that a lot of this non-programming activity would be better served if organisations today just embraced the Business Analyst role more.

<comment><USER12> > 3) Does any developer really think their time is well-spent participating in > investigatory market research, advocated in this presentation?

The best developers I've worked with have proactively requested to be involved in user research and feedback sessions. They want to know the customer. They understand why they are building what they are building, and provide valuable feedback when they encounter issues during development that weren't accounted for during the design phase. They behave as partners rather than line workers. Anecdotally, these have been the developers that are most respected internally and promoted to leadership as well.

</comment></comment><comment><USER13> This garbage works for sales losers.</comment>


Give citizens a financial incentive to support immigration reform - <AUTHOR> https://steemit.com/immigration/@crasch/sponsored-immigration-a-new-immigration-plan-that-could-make-you-rich <comment><AUTHOR> Summary

Increasing immigration rates would benefit both US citizens and immigrants alike. However, many native citizens believe immigrants impose more costs than benefits, by increasing crime, consuming welfare services, and changing the culture. So they naturally oppose increasing immigration rates. Sponsored immigration incents citizens to support increased immigration by a) giving them a personal choice in who they allow to immigrate b)a direct financial stake in the immigrant's long-term success.</comment>


Metabase, an Uber Co-Founder's New Big Data Startup, Raises $13M - <AUTHOR> https://news.crunchbase.com/news/metabase-an-uber-co-founders-new-big-data-startup-raises-13m/30/ <comment><USER2> Big data? It's a BI tool you animals.

</comment><comment><USER3> While there's still some features we'd like the software to have, running Metabase for the past 2 years or so on our campus has been really straightforward (I love that I can just deploy the JAR directly, rather than having to fiddle with Tomcat separately).

Maybe this new funding is part of the reason why we haven't seen a new Metabase release since early December ;-). I sincerely hope that the open source-ness of the solution doesn't go anywhere as they seek to monetize the product further.

In the places where our Research department has shared the few dashboards we've created in the system so far at conferences or with others here on campus we've gotten positive responses and it sounds like we're hoping to ditch our iDashboards software (which hasn't been used much at all...even with paying a $10k+ license renewal fee each year) and start using Metabase solely moving forward.

Good luck to the team and I hope they can continue making Metabase into an even better product!

</comment><comment><USER4> Fired up on a local postgres database using the mac application. It works quite well. Every so often I'll be hit up to chop up data in a very specific way which requires me to write some ad-hoc SQL but giving this ability to end users and saving dashboards seems very useful. I love seeing things like this be built and pricing is spot on. Free and no tiers. Hope to see this succeed.

Tempted to integrate this into a production rails application with a simple link at the top for users to be able to service themselves. I'll need to see if I can somehow link logins so they don't have to login to both the application _and_ the metabase instance but seems like a fun project.

</comment><comment><USER5> This is great to hear. I work in an org that uses metabase a lot, and have made a few contributions. Their Clojure code is a delight to work with!

</comment><comment><USER6> I'm very happy to hear this. Metabase has been critical to understanding our data, and dead simple (and free) compared to Tableau/Looker.

</comment><comment><USER7> A nice Clojure project. I also like the AGPL license business model. I really like to see Libre software licenses used when they make sense. For an end user business intelligence tool, I don't see problems for end users grabbing a stable JAR and just running it. Hopefully a future enterprise version and money made from buy an alternative license when integrated into a larger system will keep the developers well funded.

</comment><comment><USER8> As a very happy Metabase user, glad to see this. Hope the team uses the money to make the project better while still keeping its open source roots.

</comment><comment><USER9> Does anyone have experience with their Consultant Network thing they advertise on their jobs page? [https://metabase.com/network/](https://metabase.com/network/)

It sounds interesting, I like the idea of them trying to connect people to use their platform.

</comment><comment><USER10> They're probably going to release an enterprise version: [https://hub.docker.com/r/metabase/metabase- enterprise/tags](https://hub.docker.com/r/metabase/metabase-enterprise/tags)

</comment><comment><USER11> Metabase has been a great tool to use, and a very impressive project to watch. Very regular updates, super responsive team, and a great feature set. Congratulations to the team on the raise!

</comment><comment><USER12> Funded Nov 1, 2014: [https://www.crunchbase.com/organization/metabase](https://www.crunchbase.com/organization/metabase)

<comment><USER13> *Founded

</comment></comment><comment><USER14> Love using Metabase! As a loyal user, I'm excited for the team!

</comment><comment><USER15> Why is shit like this even news? Venture capitalists fund every random dude's and his mother's enterprise</comment>


Puffin Web Browser on iOS, Adieu - <AUTHOR> https://www.puffin.com/ios/puffin-web-browser/termination.php <comment><USER2> This is very sad.

I enjoyed Puffin a lot. Originally to access websites requiring Flash. But I then started to appreciate it for its speed when my connection was bad (e.g. while commuting), as well as for securely browsing untrusted websites.

Puffin worked really well.

Sad to see it go because of Apple's policy.</comment>


Fosshost: Not-for-profit cloud-based hosting provider - <AUTHOR> https://fosshost.org/ <comment><AUTHOR> Also, from [https://fosshost.org/some-of-the-projects-we-are- helping/](https://fosshost.org/some-of-the-projects-we-are-helping/)

> _We often get asked who we are helping, so to give you an idea, we have > compiled a list of some of the projects within the open source community._

Miraheze – Miraheze runs the same software as Wikipedia, by offering hosted MediaWikis'

Xubuntu – is a Canonical Ltd.–recognised, community-maintained derivative of Ubuntu

XFCE – is a free and open-source desktop environment for Linux and BSD operating systems

Qubes OS – is a security-focused desktop operating system that aims to provide security through isolation.

Noisebridge – is an anarchistic hacker space located in San Francisco, inspired by Metalab and c-base</comment>


Six Nobel prizes – what's the fascination with the fruit fly? - <AUTHOR> https://www.theguardian.com/science/2017/oct/07/fruit-fly-fascination-nobel-prizes-genetics <comment><USER2> They are called model organisms or model animals. Basically, when you want to study something in biology, the classical route to test on organisms is this:

\- E.Coli, a bacterium

\- C.Elegans, a simple nematode (worm) with 1031 cells

\- Drosophilia, fruit flies

\- Laboratory mice

These organisms are very well known and are possibly even more known than humans. They can be bred quickly. We know their genetic lines perfectly, you can order some with specific mutations activated.

It is not necessary optimal picks, there is a lot of history behind these choices. The thing is, if you want to check an effect on a real organism, we know very well how these normally react so spotting small variations in growth, metabolism or behavior is easy. They are the benchmarks of biology.

You found a molecule that kills cancer cells? Congratulations! Check first that it does not harm E.coli normal metabolism. Check it works on C.Elegans, make sure that fruit flies are still fertile, fly normally, etc...

<comment><USER3> You didn't explain why those organisms are the best to study in genetics. The poor article did neither. The others did.

citing @holograham:

> 60% DNA shared with humans + 4 chromesomes for easy mutation tracking + 2 > week reproductive cycle for fast generation studying + easy to house/keep > alive = great lab specimens to test genetic mutations

In addition to that:

* Some chromosomes, the ones in the salivary gland of the drosophila melanogaster are huge. Much easier to study under the microscope.

* Most important being the very short mutation cycle: 10 days.

* Very easy to see mutated phenotypes. 4 chromosomes -> eye color, wing size, ...

There were very good reasons Meigen 1830 and Castle 1901 picked them from the very beginning on.

The article didn't even get the most basic numbers right. It were 8 nobel prizes so far based on drosophila research, not 6.

1\. Morgan 33

2\. Müller 46

3\. Beadle, Tatum 56

4\. Delbrück, Hershey, Luria 69

5\. Lewis, Nusslein-Volhard, Wieschaus 95

6\. Axel, Buck 04

7\. Hoffman, Beutler, Steinmann 11

8\. Hall, Rosbash, Young 17

[http://www.animalresearch.info/en/medical-advances/nobel- pri...](http://www.animalresearch.info/en/medical-advances/nobel-prizes/)

</comment></comment><comment><USER4> TLDR: 60% DNA shared with humans + 4 chromesomes for easy mutation tracking + 2 week reproductive cycle for fast generation studying + easy to house/keep alive = great lab specimens to test genetic mutations

<comment><USER5> > easy to house/keep alive

But, unless this has changed recently, impossible to preserve without housing them and keeping them alive. You can freeze cell lines, nematode worms, and vertebrate sperm and eggs, but there's no analogous technique for fruitflies. Once you've made a useful mutant, if you want to keep it, some poor graduate student is going to have to keep flipping those flies forever.

</comment></comment><comment><USER6> Oh little fruit flies, how I love thee! We had to keep fruit flies and track mutations in my intro to genetics course. We would put them on these little fabric platforms and pump CO2 through the fabric. This would anesthetize them so we could look at them under a microscope and count things like how many had white eyes, deformed wings, etc. They really are the workhorse of genetic studies...they should build a statue of a fruit fly next to the monument to the laboratory mouse!

</comment><comment><USER7> I used to date a biologist who experimented with animals, primarily zebrafish. And she said they chose these creatures for quite a few reasons:

1\. When genetic mapping was expensive, they were some of the first mapped.

2\. They procreate quickly. Faster reproduction cycles means quicker experiments.

3\. Because they were some of the first, more biologists have more experiments with these genomes. So faster and more advanced work can commence.

4\. Nobody complains about experiments with what effectively amounts to insects and minnows (yes, I know zebrafish aren't - im going after the sentiment here).

<comment><USER8> Was the choice to map their genomes early made on account of them already being widely used?

<comment><USER9> Yes.

</comment></comment></comment><comment><USER10> Fruit fly is a facinated tool for study genetics. And many of those study it was in Morgan's lab or follow the linage. Fruit fly has a big role in genetics, development, and other field of studies. Actually a lot of the pioneering work of neurodevelopment is from fruit fly. And those early fly guys made interesting, light-tone names of genes which kind of lost in present academic culture.

</comment><comment><USER11> Since there might never be a more relevant time to mention it, there's a fantastic book called The Fly Trap by a Swedish biologist, Fredrik Sjoberg, detailing his decades of studying flies on a small Swedish island. It's in the mold of Zen and the Art of Motorcycle Maintenance, and is a great read that I can't recommend enough.

</comment><comment><USER12> I read somewhere that we share 50% of our DNA with bananas and 96% with monkeys. I'm always blown away whenever I read these stats. It gives a sense of how much more complex life is than what it appears.

<comment><USER2> Consider that there is something akin the glibc in our genomes: the basic library that allows to extract energy from food and to construct all the building blocks of cells.

Similarities are easier to see once you realize that all organisms (including us) are just a bunch of cells who decided to stick together.

</comment></comment><comment><USER13> "What is true for E. coli is also true for the elephant."

― Jacques Monod</comment>


Walking Alone: On Digital Minimalism - <AUTHOR> https://lareviewofbooks.org/article/walking-alone-on-digital-minimalism/#! <comment><USER2> From user alancontreras in the article's comment section: " 'Merton also wrote, in a letter to Czeslaw Milosz, "I have never seen TV, that is never watched it. Once when I did happen to pass in front of a set I saw the commercial that was on: two little figures were dancing around worshipping a roll of toilet paper, chanting a hymn in its honor. I think this is symbolic enough, isn't it?"'

</comment><comment><USER3> I've effectively separated myself from social media. Since 2017 I don't have Twitter, Facebook or any "traditional" social media.

The only times I ever think of my smartphone are when I actually need to send a message to someone. I don't always find it instantly, sometimes I forget it in another room, in my backpack. etc.

I have only two digital vices: Youtube and Hacker News.

I don't even know why I watch Youtube, it feels like I've already watched every video worth watching. My favorite channels are Vsauce, 3Blue1Brown, austin mccconnel, exurb1a, live Overflow, Tom Scott but they don't upload as often as I would like (would I?).

As for Hacker news, it feels like part of my identity now. I probably send like 300 HTTP requests a day to this site. I'm kind of obsessed with it.

<comment><USER4> Same here. Was a heavy user of Instagram until 2017, when I'd finally had enough of the endless product placement, brain-dead memes and half-nudity everywhere.

There was a time when social media was about regular people, but the second they became "sponsored", the content switched to mostly native advertising.

Never used Twitter, as it was obvious from day 1 that it was designed to be broadcast channel for brands and people desperately trying to be their own brand.

</comment></comment><comment><USER5> I just love that this book on digital minimalism is unavailable for me to purchase in digital format, because I'm Australian.

I bet I can find a torrent for it in 2 minutes, if I can be fucked looking.

<comment><USER6> Maybe take a walk to your nearest bookshop, buy it with a face to face conversation and read it in a quiet outdoors spot?

<comment><USER7> So he should engage in somewhat anti-minimalism behavior to read book about digital minimalism?

<comment><USER8> Actually that would be a very digital-minimalism behavior. Minimal digital, and more analog...

<comment><USER5> Digital minimalism to me is using the minimum viable digital footprint as part of minimising my meatspace footprint. Which I am admittedly terrible at. But I still think it's a good idea :) I <3 My Kindle tho, I prefer my fiction as audio and non-fiction on ebook. My dead tree library is mostly out-of-print computing / programming texts from the 60s-80s.</comment></comment></comment></comment></comment>


The Metropolitan Museum of Art Open Access Provides Data on 420,000+ Artworks - <AUTHOR> https://github.com/metmuseum/openaccess <comment><AUTHOR> From the README:

The Metropolitan Museum of Art presents over 5,000 years of art from around the world for everyone to experience and enjoy. The Museum lives in three iconic sites in New York City—The Met Fifth Avenue, The Met Breuer, and The Met Cloisters. Millions of people also take part in The Met experience online.

Since it was founded in 1870, The Met has always aspired to be more than a treasury of rare and beautiful objects. Every day, art comes alive in the Museum's galleries and through its exhibitions and events, revealing both new ideas and unexpected connections across time and across cultures.

The Metropolitan Museum of Art provides select datasets of information on more than 420,000 artworks in its Collection for unrestricted commercial and noncommercial use. To the extent possible under law, The Metropolitan Museum of Art has waived all copyright and related or neighboring rights to this dataset using Creative Commons Zero. This work is published from: The United States Of America. You can also find the text of the CC Zero deed in the file LICENSE in this repository. These select datasets are now available for use in any media without permission or fee; they also include identifying data for artworks under copyright. The datasets support the search, use, and interaction with the Museum's collection.

At this time, the datasets are available in CSV format, encoded in UTF-8. While UTF-8 is the standard for multilingual character encodings, it is not correctly interpreted by Excel on a Mac. Users of Excel on a Mac can convert the UTF-8 to UTF-16 so the file can be imported correctly.

</comment><comment><AUTHOR> Blog post introducing Open Access at The Met:

[http://www.metmuseum.org/blogs/digital- underground/2017/open...](http://www.metmuseum.org/blogs/digital- underground/2017/open-access-at-the-met)</comment>


4x Hour EC2 Outage for the Entire AWS Sydney Region - <AUTHOR> https://phd.aws.amazon.com/phd/home#/dashboard/open-issues?eventID=arn:aws:health:ap-southeast-2::event/EC2/AWS_EC2_OPERATIONAL_ISSUE/AWS_EC2_OPERATIONAL_ISSUE_RFMRO_1579740075&eventTab=details&layout=vertical
Not yet resolved, currently impacting:
RDS WorkSpaces ELB Appstream2 Lambda EastiCache EC2 <comment><USER2> Latest update from AWS:

[08:49 PM PST] We wanted to provide you with more details on the issue causing increased API error rates and latencies in the AP-SOUTHEAST-2 Region. A data store used by a subsystem responsible for the configuration of Virtual Private Cloud (VPC) networks is currently offline and the engineering team are working to restore it. While the investigation into the issue was started immediately, it took us longer to understand the full extent of the issue and determine a path to recovery. We determined that the data store needed to be restored to a point before the issue began. In order to do this restore, we needed to disable writes. Error rates and latencies for the networking-related APIs will continue until the restore has been completed and writes re-enabled. We are working through the recovery process now. With issues like this, it is always difficult to provide an accurate ETA, but we expect to complete the restore process within the next 2 hours and begin to allow API requests to proceed once again. We will continue to keep you updated if that ETA changes. Connectivity to existing instances is not impacted. Also, launch requests that refer to regional objects like subnets that already exist will succeed at this stage, as they do not depend on the affected subsystem. If you know the subnet ID, you can use that to launch instances within the region. We apologize for the impact and continue to work towards full resolution.

<comment><AUTHOR> Thank you for this. Our TAM confirmed the same a few hours ago.

Is it me, or are AWS outage messaging always really invasive?

Error rates and API latency? I mean, 100% is technically a 'rate' between 1 and a 100.

</comment></comment><comment><USER3> The frustrating thing is this is also sending out other services (ECS Fargate, CodeBuild) that presumably can't allocate capacity, and they don't admit it on the status page (hey, it's still a 200!).

My favourite error of today:

{'ResponseMetadata': {'HTTPHeaders': {'content-length': '135', 'content-type': 'application/x-amz-json-1.1', 'date': 'Thu, 23 Jan 2020 04:16:02 GMT', 'x-amzn-requestid': '...'}, 'HTTPStatusCode': 200, 'RequestId': '...', 'RetryAttempts': 0}, 'failures': [{'reason': 'Capacity is unavailable at this time. Please try ' 'again later or in a different availability zone'}], 'tasks': []}

</comment><comment><USER2> This is impacting us as our application relies heavily on Lambdas connecting to RDS via VPC. Has been down on and off since about 12pm AEST today. Doesn't seem like there's any easy ways for us to resolve or work around without just waiting for AWS to fix.

</comment><comment><USER4> Better link? [https://status.aws.amazon.com/](https://status.aws.amazon.com/)

<comment><AUTHOR> Has zero detail. I thought the URL I provided has more albeit, you need to log in.

</comment></comment><comment><USER5> Obligatory reminder that if this kind of "X hour downtime per year" is such a big problem for your business you can go multi-AZ and multi-region.

If you choose not to, that's a valid and often the right choice but then don't panic and scream when something fails. It's a trade-off decision that you have to make. You can't have your cake and eat it too.

Either you care enough to design, build, and test that kind of fault tolerance or you don't. If you do you get its benefits during these times. If you don't then just own it and put up with the downtimes a few times per year.</comment>


The Making of "Peace for Triple Piano" [video] - <AUTHOR> https://www.youtube.com/watch?v=x1zJoU6Luss <comment><AUTHOR> I like my original title better: "Vi Hart on how to make a spirally triply meta-chiral time crystal." I didn't make up that phrase. It's how Vi refers to it at the end of the video. I thought it had a certain panache that "The making of..." lacked.

Also, here is the Triple Piano video itself:

[https://www.youtube.com/watch?v=HcRW3FMuttY](https://www.youtube.com/watch?v=HcRW3FMuttY)

</comment><comment><USER2> Wow, I really had no idea this is what I was watching in the original video. They should consider adding a "This was filmed in one take on one piano" title card!</comment>


Ask HN: What side project are you working on right now? - <AUTHOR> <comment><USER2> Although my main work is in open-source, free-of-charge, concept-based artificial general intelligence (AGI), my side project is to work patiently and steadfastly to overthrow the unelected Chinese government. As a follower of world events, I am still very angry about the Tiananmen Massacre when the still-ruling Chinese government killed hundreds of peaceful young Chinese students gathering each day to plead for USA-style democracy in China. Instead of hustling the young protesters off to detention and "re-education", the still-in-power Chinese government simply shot them to death, or bayoneted them, or crushed them to death with tanks. Having created Strong AI, I want to turn the AI against the Chinese government and replace it with true democracy. I am working especially hard on subverting the Chinese government right now because my alma mater University of Washington is collaborating with Microsoft and the murderous Chinese government to establish something called the Global Innovation Exchange in Bellevue between the U of W campus and the Microsoft campus. "Over my dead body," is my attitude. I don't care what Microsoft does in cahoots with the Chinese government, but I will make signs and go out and protest before I let my beloved Alma Mater whitewash a student-killing Chinese government. I am encouraging Chinese students attending the U of W to return to China as pro-democracy spies to subvert the evil Chinese government -- which is so afraid of any kind of protest, that I know I can get the Chinese government to abandon its plan to set up camp near Seattle. Anybody reading this in the Seattle area, please make signs and protest the Chinese government in Bellevue WA USA.

</comment><comment><USER3> I'm trying to improve the audit logs conversion from non-BSM formats to the BSM format. See [https://wiki.freebsd.org/SummerOfCode2016/NonBSMtoBSMConvers...](https://wiki.freebsd.org/SummerOfCode2016/NonBSMtoBSMConversionTools) for more details.</comment>


Ask HN: How are you creatively helping the Covid-19 effort? - <AUTHOR> I'm a programmer in California, and I'm looking for ideas to help the COVID-19 effort in a more creative way than contributing money. That is a great option of course, but watching people make masks at home and local businesses repurpose their existing equipment to aid healthcare workers had me wondering if there was some other way in which I could be helping as well.<p>So I'd love to hear about any ideas you might have, or things you're already doing, to help the world get through this pandemic. <comment><USER2> One thing I've been trying to do is to write blog posts about different aspects of what people are dealing with right now on a personal level, and share those thoughts with people who I am close to. The writing I've opted to do is broadly through the lens of navigating intersecting values that conflict.

I think that writing and sharing your writing with your close circle is a way of expanding upon the idea of having conversations with the people around you. Though of course, have the actual conversations as well. It's just harder to have the same conversation with 30 people than it is to share your thoughts in writing.

Tim Ferris released a youtube video that goes over why he thinks that writing can help develop your thinking, too, recently: [https://www.youtube.com/watch?v=65U5byDZ55M](https://www.youtube.com/watch?v=65U5byDZ55M)

If you're interested you can see some of the COVID19 personal-philosophy writing I've been doing at [http://www.kindwolves.com/](http://www.kindwolves.com/)

</comment><comment><USER3> An effective and simple way to make a positive difference under these circumstances can be, to just address the topic with those around you. There is a lot of confusion, misinformation and concern going around that in my experience, is quite often simply the result of people not being able to digest the massive amount of information currently being presented.

Having a good grip on what is factually accurate, especially online, is hard enough, when ones lives aren't dominated by a novel virus. If you find the time to clear up a few misunderstandings, whilst also teaching, how one can stay informed about the current situation and how to handle it, that alone can make a great impact.</comment>


Ways to think about market size (2015) - <AUTHOR> https://www.ben-evans.com/benedictevans/2015/2/28/market-size <comment><USER2> "It'll be interesting to see what, if anything, Apple is planning in cars. I'm not entirely sure there is quite the same scope for changing the market size that there was in phones."

I'm not sure if by this he means changing the market size for cars _at all_ seems difficult, or that any change in this market size will not be as big as the one that occurred for mobile phones.

I would probably agree with the latter, but for the former the market size of interest here is not really that of cars but journeys. And I'm quite confident that there's a lot of room left there, especially for shorter trips.

In his article on cars and what Apple could do with them [0] that he links to in this one he says "Both on-demand and self-driving cars would appear to drive a reduction in car ownership and certainly car use (which means slower replacement).". While I agree with the first point (decrease in ownership) the latter (decrease in use) seems completely wrong. The average car is parked 95% of the time. An on-demand, autonomous fleet would likely invert that relationship with cars being on the go non-stop, thus greatly increasing the rate of replacement (although perhaps still decreasing the number of cars needed as trips per car would be increasing).

However, automation, and better fleet/traffic management, would lead to quicker and cheaper journeys and obviously greater demand. This would also give people more time, time that they could use to take more journeys (although admittedly there is a strong upper bound here). It seems that his thesis on cars and the potential market size is skeptical of full automation (or at least of Apple being the ones to achieve or benefit from this, which I would agree with) and therefore focuses more on Apple selling cars as an item rather than the fleet style benefits that someone like Google will probably capture. But he does make another good point that Apple still does privacy well so they may still carve out some niche in the autonomous fleet space, should that materialize.

[0] [https://www.ben-evans.com/benedictevans/2015/2/28/notes- on-c...](https://www.ben-evans.com/benedictevans/2015/2/28/notes-on-cars)

<comment><USER3> I'm a little confused by this comment. Increasing the market for short journeys seems like the kind of thing autonomous cars are really bad at. I already have a car in my driveway+, and I can take it 5-10 minutes to a number of stores and friends' houses for trivial marginal cost. I can't imagine taking more short trips because I don't have to drive 10 minutes here and there.

There is already a big market for long car journeys, and there is where autonomous cars can really beat the competition. But, as you mentioned, there's a pretty hard upper bound here, as the time cost is significant, even if the monetary cost went to $0. Overnight trips could become more common, but people don't seem to like those very much.

I can see automated cars as disrupting the market by being cheaper, since you don't have to own them. I don't see the savings generated from that as going into more car journeys, but maybe that's just my lack of imagination.

+I don't actually own a car currently, but that's beside the point. I have in the past.

<comment><USER4> The cost for short trips is enormous if you amortize in the cost of your personal vehicle- say at 30% vehicle TCO divided by number of short trips. Roughing up some numbers puts your personal cost at ($40,000 TCO)/(100 trips/yr)/(10 yr service) _20% = $8 /trip. That's huge!

In addition, all those trips require on site parking which is a _huge* community cost and directly increases the cost of whatever service you're consuming.

<comment><USER5> $8/trip is less than the average Lyft or Uber ride.

The problem with transportation and measuring 'trips' (in the US anyway) is the huge geographical diversity.

My take on Ben-Evans post is that you are fooling yourself to believe that you can predict market demand for certain kinds of disruptive technologies.

</comment></comment></comment></comment><comment><USER6> I think he was wrong about the Apple watch market size, but I like his argument.

<comment><USER7> If economics are irrational because humans are irrational. Apple is the primary argument that humans are irrational.

Forming logical conclusions on anything Apple does is dangerous. They overcharge and under deliver(at least on Hardware). They are primarily marketing, not tech.

For this same reason, their valuation is irrational. I don't expect Apple to be above 500M for much longer than a few years.

</comment></comment><comment><USER8> @dang, it's (2015)

</comment><comment><USER9> TL;DR: no one has any idea of how big Apple watch's market will be.</comment>


Ask HN: What are the IRC servers that are available as onion service only - <AUTHOR> Hello HN,
   I am looking for online communities for open and intelligent discourse on non-tech(politics, culture,e.t.c) and tech topics. My hypothesis is if entry barrier is low, high moderation is required to maintain quality posts like HN, conversely if the entry barrier is high it acts as a moderation on the users quality. One of the things i miss in HN is the controversial opinions from intelligent people.<p>Few days ago there was this post https://news.ycombinator.com/item?id=21691802 which had many  public(non onion service) irc servers listed but I am looking for irc servers that is only available as onion service which has the right property for high barrier entry (setup) and provide anonymity for open conversation. <comment><USER2> _onion only_

 _intelligent discourse on non-tech(politics, culture,e.t.c)_

In my opinion, you mentioned two things that are not compatible, even with the most vigilant moderation. The moderation, filters and access controls required to prevent chaos would simply drive people away. You might find a small handful of regulars that behave, but I think you would mostly hear crickets chirping.

I like the idea though. I wish such a thing could work. You could always try it as an experiment. Set up an IRCD and Services, maybe LDAP backend so you can also tie it to a website and expose it on the Tor network. As part of the experiment, perhaps you could share on HN how many people created accounts, what the account churn rate is like and how many people had to be banned per day vs. people offering intelligent discourse.

</comment><comment><USER3> I can confidently state that the public onion IRCs are not what you want. The people looking for quality chats have been driven away by the crazies.

<comment><USER4> I was about to say that onion only IRC channels aren't for high quality discussion. They're for discussion by people who are paranoid for one reason or another. People selling drugs/credit card numbers/weapons. People with extreme political ideology who are talking about violent revolution. People who mentally unstable with paranoia.

A better site for someone wanting high level discussion on a narrowly focused topic is Reddit, although you will have to choose your subreddits carefully. It can be a difficult needle to thread, but there are quite a large number of quality subreddits once you know how to search.

<comment><USER5> Can you provide any examples of high quality subreddits?

<comment><USER4> It depends on your interests, but for HN readers /r/networking is a pretty good place for enterprise networking discussion. /r/rust has some helpful people in it if you're working with the Rust programming language. /r/science has extremely strict moderation that makes it a good read-only subreddit unless you are an actual scientist who can back up their post.

Generally you want a subreddit with a small but active userbase. Not too small or it tends to die off, but also not too big or the S/N ratio drops off.

</comment></comment></comment></comment><comment><USER6> Maybe by asking here, you yourself don't meet the barrier of entry.

I did find several servers via google on the first page.

<comment><AUTHOR> suggestion from HN user has more weight than Google search since Google search is based on popularity and not quality.

</comment></comment><comment><USER7> It would've been great to have a "Political/controversial HN", as a separate section of the site like Ask and Show. Obviously with the HN guidelines, and where the posts and moderation have the same high quality.</comment>


Python for Delphi (P4D) – Set of free components that wrap Python's dll - <AUTHOR> https://github.com/pyscripter/python4delphi <comment><AUTHOR> Python for Delphi (P4D) is a set of free components that wrap up the Python dll into Delphi and Lazarus (FPC). They let you easily execute Python scripts, create new Python modules and new Python types. You can create Python extensions as dlls and much more. P4D provides different levels of functionality:

Low-level access to the python API

High-level bi-directional interaction with Python

Access to Python objects using Delphi custom variants (VarPyth.pas)

Wrapping of Delphi objects for use in python scripts using RTTI (WrapDelphi.pas)

P4D makes it very easy to use python as a scripting language for Delphi applications. It comes with an extensive range of demos and tutorials.</comment>


Rules of Engagement: How Cities Are Courting Amazon's New Headquarters - <AUTHOR> https://www.wsj.com/articles/rules-of-engagement-how-cities-are-courting-amazons-new-headquarters-1522661401 <comment><USER2> Don't get too fancy. Head to edgier, trendier, neighborhoods. And definitely stay on time.

These are a few of the tricks cities are deploying in their all-out effort to woo Amazon.com Inc.'s new headquarters, a move the online retailer says could bring nearly 50,000 jobs and more than $5 billion in investment over nearly two decades. Amazon executives have quietly visited more than half of the cities on its list of 20 finalists, which are vying to host what it calls HQ2, according to people familiar with the matter. The visits, which started in recent weeks, have included Dallas, Chicago, Indianapolis and the metropolitan Washington, D.C., area.

Amazon hasn't provided much guidance on what it expects from the site visits. It has asked for breakout sessions on education and talent, plus visits to the sites it is considering, all within a strict time frame of two days, max. The rest is up to local officials.

As a result, officials of candidate cities are scrutinizing the company's business practices to concoct the perfect 48-hour-or-less-visit that could win over Amazon.

Details of the visits are scarce. Amazon, which has said it plans to announce the winning suitor later this year, has advised HQ2 candidates to keep this phase private. And city officials are loath to spill any tricks that could give their rivals a leg up.

Still, people familiar with the visits paint a picture of whirlwind trips with Amazon's small economic-development team. Led by Holly Sullivan, it dives into data provided by the cities—such as the ACT and SAT scores of local high- school students—and asks a lot of probing questions regarding how much talent Amazon can attract.

Municipal officials said that while Amazon has some of the quirky features of a hotshot technology company—it allows employees to bring thousands of dogs to its Seattle campus and gives out free bananas at two campus stands—it doesn't offer many of the other trappings associated with working at a tech giant, such as free meals.

Amazon is "a frugal-ass company," said one city official working to win the project. "They're making a 100-year decision…. All of the extra fluffy stuff is fluff."

So, many cities are nixing the fancy hotels, dinners at the governor's mansion, private planes and small gifts—all typical core aspects of a traditional site visit, according to people familiar with the matter. "We were concerned that if we went over the top, it would push them away," said a person involved in one site visit.

Instead, they are attempting to be creative by bringing in university officials, younger people and professionals who can speak to talent and growth in the area. Officials are adding visits to trendier neighborhoods to highlight the draw for younger employees. And cities have even ferried Amazon executives around by bicycle and boat as modes of transportation.

"Amazon is working with each HQ2 candidate city to dive deeper on their proposals and share additional information about the company's plans," an Amazon spokesman said in a written statement. The spokesman confirmed site visits were taking place.

A few of Amazon's desires are crystallizing, some of the people said. The company appears to be leaning toward a more urban site, despite requesting proposals that included sites in the suburbs. It also wants to come to a city prepared to handle the company's growth and the influx of high-paid employees. In its home base of Seattle, Amazon has faced criticism for contributing to traffic and higher housing costs.

"They believe there is no American city that can provide for all their needs," said the person involved in a site visit. Another person said the company expects to have to compromise no matter which location it selects. Amazon has also placed particular emphasis on the tech talent pipeline: how much already exists locally, and how much Amazon can attract from around North America and the rest of the world.

Some cities are offering financial incentives. New Jersey and the city of Newark have offered a package valued at $7 billion, while Maryland—where Amazon is considering a location in Montgomery County—has put $5 billion on the table.

In the past, cities have become creative to attract or retain a coveted company. To try to keep JetBlue Airways Corp. based in New York, the city's economic-development corporation did its research. Officials found out the company hosted regular softball tournaments, so they specifically pitched the airline on a location near a field. City and state officials also worked out a joint deal offering JetBlue co-branding rights to the "I (heart shape) NY" logo as well as the slogan, "JetBlue, New York's Hometown Airline"—something that helped seal the deal.

Washington, D.C., might have a leg up, having already hosted Amazon Chief Executive Jeff Bezos for visits when he considered acquiring the Washington Post, which he now owns. Mr. Bezos also purchased the former Textile Museum in Washington's Kalorama neighborhood for $23 million in 2016 and is currently turning it into a private residence.</comment>


Platform to Validate Ideas? - <AUTHOR> Hi, I was wondering if people knew of any platform or service whereby you can assess whether people really want your idea (if it exists).
I am kind of imagining a "Product Hunt for Solvable Problems" - where people can approve or disprove relevant startup ideas. This is an idea within itself, but I was curious to understand how people currently go about the initial validation process and whether any tool remotely similar exists (it would be very useful right about now!). Thanks :) <comment><USER2> The best way is to go talk to people.

Though Tech People hate the concept there is no better way to validate an idea. Why? because people are willing tell you why they don't want to buy you thing or why they do, which lets you develop better products

<comment><AUTHOR> Good Advice! Do you have any recommendations for how to gain a grasp of what problem to solve in the first place - how do I know where to begin and what users to speak to?

<comment><USER2> I'd recommend finding people that are already good at isolating these sorts of problems themselves, they'll either have one queued up for you or show you how to find them.

Be careful about not talking to someone thats too successful though- they are playing a different game and their knowledge probably won't be applicable at lower levels (i.e. don't a formula 1 driver how to parallel park)

</comment></comment></comment><comment><USER3> This is from a post I wrote:

A few ways to 'find a problem':

1\. Think about what's broken in the industry you worked at or have expertise in. Make a list of all the things your previous employer lost money over (employees' time is probably the most expensive resource). This list is essentially a list of potential companies. If for example, you were in the fashion industry, you might be able to come up with ways to solve the guesswork fashion brands need to do in order to keep up with the market trends.

2\. Build something that solves a problem for you. Many companies started that way. Say you are trying to go on a keto diet, and you found a way that makes it easier. Chances are many other people would find it helpful and be willing to pay for it.

3\. Research. You might know a specific demographic is experiencing several difficulties, but you don't know exactly what's the core problem. Start reading and writing about it. When I started Spectroomz I didn't know it's going to be a freelancing platform for autistic people. My son is autistic so I started researching on Reddit what would be his future biggest challenges. You can passively research (i.e. read), or do so actively (I actually posted that question on Reddit r/aspergers). Once I got a sense that one of the main challenges is employment, I started searching for more content on Google Scholar, corresponding and chatting with other autistics about it and more.

4\. Important reading - Paul Graham wrote a great post on how to come up with startup ideas. [http://www.paulgraham.com/startupideas.html](http://www.paulgraham.com/startupideas.html)

After you find the problem, talk to users as jppope said. In the blog post I share a format of how to talk to users which I simply summarized from a YC startup school lecture - [https://spectroomz.typeform.com/to/HR5R10](https://spectroomz.typeform.com/to/HR5R10)

If you have several ideas and want to assess what has most potential, you can use a startup evaluation tool I created (also following a YC startup school lecture) - [https://spectroomz.typeform.com/to/imIL7z](https://spectroomz.typeform.com/to/imIL7z)

Hope this helps.

<comment><AUTHOR> Thanks for all the insight, certainly helpful!</comment></comment>


Ask HN: Is stealing a password that easy? - <AUTHOR> I had this thought today and I am a bit freaked out.
Say we have a CI, we have a bunch of env vars on it.
Now some sneaky guy comes, makes a PR that changes the `test` stage of the CI to `echo $SUPER_SECRET_PASSWORD | send-to-pastebin.sh`.
Did he just steal the password, or am I missing something?! <comment><USER2> CI services take care of this, as long as you configure permissions correctly.

Travis has secret variables you store in travis.yml. You send the cleartext to Travis, which encrypts it with a private key known only to Travis and sends back to you. You store the ciphertext in the travis.yml, optionally scoped by stage. When travis CI scripts expand the variable, it censors it.

You are correct that a PR could implement something like `send-to- pastebin.sh`. The way to mitigate that risk is to configure travis CI to only run CI against protected branches, and to not provide any secrets to test stages.

It is really only a problem if your test stage requires and includes secret environment variables. I have only seen this in private organizations where the test stage does things like spin up a test S3 bucket. For open source, you would want to use mock S3. The only stage that would need secrets would be release/deploy, for which you can make sure only you can run the command.

Basically: If your open source repository has a test stage that requires secrets, and your CI server injects secrets as environment variables into that test stage, then you need to be extremely careful who can create code that runs in that stage. The best solution is to not have secrets in the test stage at all.

<comment><AUTHOR> That was a nice complete answer. Thank you. :)

</comment></comment><comment><USER3> Yes. It's that easy. Sometimes it's already done by a dev. Say in GitLab the CI is pretty good about never revealing env. variables to you once you set them, however devs for debugging purposes will do something like echo $SECRET_PASSWORD and the output will be in the job.

</comment><comment><USER4> That's why you have code reviews and don't let anyone merge their own code or at least not deploy it themselves.

<comment><AUTHOR> But that's why I said the test stage. Supposedly there is a step that runs for every single PR.

A lot of open source project have something like that too, where it's a lint checker or unit test runner or whatever.

<comment><USER4> You shouldn't be able to compromise `prod` from the `test` stage.

<comment><AUTHOR> Tell that to the CIs with no env var scoping.

But yes, I get what you mean. It seems so weird to me that this scenario can be done.

</comment></comment></comment></comment><comment><USER5> There's usually some configuration option in your CI for this kind of thing.

With Jenkins+GitHub, for example, I have it configured so PRs from anybody but myself do not automatically run, and I can comment to trigger the build.

<comment><AUTHOR> Ah that's a nice way to do it!</comment></comment>


Show HN: Threadbase – Make a HN-style community in minutes. No coding required - <AUTHOR> https://threadbase.io <comment><AUTHOR> For the past few months, my co-founder and I have been working on our side project, Threadbase, which allows non-developers to make their own Hacker News, Product Hunt, or any Reddit-style community (e.g upvotes with threaded comments) in minutes without writing any code.

We came up with the idea after building our own upvote communities and friends of ours asked if they could make a similar community without the need to program. We thought this could be an interesting technical project to figure out. Plus, since people were asking for it, we already had our alpha group.

We started the project using Rails for the front and backend, but eventually moved the majority of the SaaS elements (e.g. a dashboard to make changes/manage users, modifying the look of a community with a theme, etc.) to React and used Rails as our backend because this provided a much better user experience.

Our most recent challenge was figuring out how to implement the #1 product request from our customers: communities on a custom domain. Originally, we began the project on AWS, but after looking around, we found that Heroku provided a much easier custom domain implementation process for the end user. So, we migrated the entire project from AWS to Heroku, and now, if you add a custom domain to your community, we just give you the auto-generated heroku dns link and community owners can paste that in their CNAME or Alias to finish the setup. This is much easier than the path we almost went down with AWS.

My co-founder and I are now making a small amount of MRR from our paid tiers, but the learning experience has been really enjoyable.

A few things you can do on Threadbase: \- Make a community in just a few clicks without writing any code (e.g. support.threadbase.io) \- Customize the look and feel with pre-built themes. We named the first three communities-- Cleveland, San Francisco,and Brooklyn--after the cities that were important to our stories. \- Drop in your own Google Analytics ID to get data on your community. \- If you'd like to further customize the color of your community, turn off ads, or put your own Google AdSense pixel in to make money from your community, you can sign up for our Basic tier. \- If you want to create a private community (i.e require registration) or add your own custom domain, you can upgrade to Plus.

<comment><USER2> I saw your communities section, but before seeing that I had an idea. You could start an aggregator of communities which used ThreadBase. The owners of these communities could make their community paid or invite based or referral based like invite 10 more people to get free access or X amount of days. hours access to content. Also, if you start getting lots of communities then you can have them pay for placement/promotion on top of page. Basically, individuals could have their own Threadbase and share news content which they consume or their views on Threadbase. Like when on twitter let's say Paul Graham/ Naval post an article, some discussion starts. But, there is a lot of visual fluff like like, share,retweet buttons which reduces amount of content one can view at once. the Hacker News/Reddit style of UI is good for such discussions.

EDIT: I wrote all of this just by saying the title of your HN post here, now when I went to your site, I saw that you have Private communities planned. Nice.

</comment></comment><comment><USER3> If I remember correctly, heroku has a limit of max 10000 custom domains per app. What are you going to do when you reach that limit, out of curiosity? Thanks

<comment><USER4> Shard by Heroku accounts?

<comment><USER5> Yes, we plan to shard by app. Since the cost per app is non-zero we've made it a paid feature. Right now it's on 2 apps (1 to support *.threadbase.io, 1 for custom domains), and we won't have to move to 3 for the foreseeable future. I plan to extract this functionality into a gem :)

</comment></comment></comment><comment><USER6> I am curious about how you implemented the text editor. Did you use SlateJs, Prosemirror, Quill, DraftJs?

<comment><AUTHOR> We are using DraftJs.

</comment></comment><comment><USER5> Hey folks, I also worked on this. Happy to answer any questions.

</comment><comment><USER7> Is there a demo I can see / use?

<comment><AUTHOR> Yup! Just visit [https://threadbase.io](https://threadbase.io) to try us out.</comment></comment>


Launch HN: Synthetic  Minds (YC S18) – Program Synthesis to Protect Dapps - <AUTHOR> Hi HN! I'm Saurabh, founder of Synthetic Minds (http://synthetic-minds.com) in the current YC batch. We protect smart contracts by using formal methods to synthesize their adversaries.
Current use of web-app-like development practices for smart contracts is not working. People have lost over 4.1M ETH due to code bugs in these contracts, aka decentralized applications (Dapps). That equals $1.8B at current exchange rates, or $500M at the time of loss. The execution environment is "deploy once, change never", which resembles hardware and space applications. NASA/Airbus use formal methods to check this kind of software. Dapps need similar tools.
I have worked on formal methods since 2006. In my PhD on program synthesis, I reduced checking code properties to theorems that could be proven mechanically. Incidentally, a full program was not required. The program could have "holes" and the prover would "fill" the holes by synthesizing code. I took those ideas to synthetic biology in my postdoc and previous company.
In 2016 when I started to look at smart contracts, I realized those ideas could help build robust Dapps, and maybe prevent them from losing $100M+/year. In June 2016, a Solidity vulnerability was discussed (June 10), but the DAO was deemed immune (June 12), right before it was exploited (June 17), losing ~$150M. In 2017, another ~$300M was lost to the Parity multisig bug. This year, I built a system to help mitigate future failures.
The core insight requires some background: Imagine you wrote a lossless compression algorithm `K` (e.g., LZ77 or LZW). Would it not be amazing to synthesize the decompressor `D` automatically? The invariant for `K+D` is the identity function. So if we had a `D` with holes, we could use a prover to verify the identity invariant and "solve for D" simultaneously. Now, what if your `K` was a blockchain smart contract, and `D` an arbitrary user contract? If we want K to be immune to double spends, we could ask for `K+D` that violates the invariant "K's balance at start >= K's balance at end". Not only would we formally verify properties, we would synthesize a specific `D` that helps explain any violations.
Here's how it works: Our tool has `prove` and `autocode` modes. For a smart contract, `prove` validates its properties while `autocode` will generate user contracts that break it—if any exist. Our servers will aim for turnaround times of minutes allowing use in CI, instead of weeks-long human audits. Two demo screencasts are online: http://synthetic-minds.com/pages/faq.html.
There are 3 steps under the hood. The 1st step is a source-to-source compiler from Solidity to a shared-memory, non-object, explicit Blockchain-state Intermediate Representation (BIR). BIR is not Solidity specific, so we could compile Ethereum's Vyper or Tezo's Liquidity to it, but Solidity's traction makes it a natural place to start. The 2nd step is a symbolic executor that converts BIR to an "equation". Think of symbolic execution as execution that traverses every path and without explicit values. E.g., `func a(int x) { y = x + 1; z = y * y; return z; }` would translate to `a(x) = (x + 1).(x + 1)`. Symbolic execution allows us to convert entire programs into an SMT equation. SMT is a theorem proving language used by many automated solvers, e.g., Z3, CVC4. The most novel, 3rd step, augments a user contract with holes for function bodies. That encodes any arbitrary future user contract. The solver can fill holes that (dis)prove combined properties. This simultaneously validates global invariants, and provides readable code if problematic user contracts exist.
Formal methods are sometimes hard to use, but it turns out that for smart contracts we can bypass the major issues (false positives, esoteric bugs found, and difficult-to-explain findings). First, most false positives come from inevitable approximations that formal analyses have to make, so they can terminate while analyzing code that itself might not terminate, i.e., Undecidability of analyzing Turing-complete languages. Gas limits truncate executions, which means we get to skip those approximations. Second, when esoteric (weird and obscure) bugs cause failures in normal web services you have to weigh the time and cost of fixing it against the potential loss, which might be negligible. But because smart contracts are immutable, any esoteric code path can be fatal to the entire Dapp, so there is no such tradeoff. Lastly, in contrast with the infinite variability of interfaces for normal web services, the uniformity of blockchain actors provides a template, enabling us to synthesize code as developer-friendly explanations of behavior.
Over 12+ years of work, there is one question I have repeatedly asked: Can we trade off human insight at the expense of compute power?  Current alternatives for securing contracts look for 10-20 anti-patterns, built from human insights observing past failures. In contrast, our approach asks for a functional invariant (e.g., no double spend), which might be 100x or more expensive to solve. Compute is cheap though, and our ability to find future failures is only limited by the amount we expend on `autocode`.
The first prototype is operational now, and I am sending out beta invites next week: http://synthetic-minds.com. Excited to hear thoughts from the community! <comment><USER2> This is a great, but its hard to trust closed source code. Everything is untrustworthy until we can see the code, I could care less about current exploits being found. How do you know that in a months time someone isn't going to release a similar tool that yours does? Furthermore, what is stopping you from exploiting current projects? Or that you haven't already? The space embraces open source for trust minimization, Am I being too paranoid here? Are you going to open source everything at some point?

With that said, I don't want to be completely negative, what you are doing is a __damned __great idea and I think just about all of us can get behind these types of processes, as someone who is learning about solidity vulnerabilities (blockchain @ berkeley) right now it is kind of funny this post comes around today. I have kind of been fretting about how easy it is to write terrible smart contracts and I kept thinking, well how the hell does NASA do this? What about air frame manufacturing? That is how I want to develop my dApps, I don 't want to deploy and hope, you know? I hate that feeling, not just because I don't want to lose anyone funds, but because I want to be proud of my code and use it for good.

I am really looking forward to checking this out, I can't see it at work but will check it out as soon as I get home! I think this is really important work you are doing. I think just about everyone who is responsible in this space knows doing contract development in a web development mind frame is dangerous and stupid. I even heard someone say the other day "agile smart contract development", like NO! I had an old drill sergeant tell me about combat "Slow is smooth, and smooth is fast", well turns out it applies to smart contract and blockchain development as well.

<comment><AUTHOR> All great points. And I agree with you on most everything.

I care about the major complicated projects succeeding, e.g., 0x, Golem, Augur, Aragon, to name a few. They can go the DAO route, or I can do my part in helping. Help me get in touch with more projects if you're connected.

Open sourcing right off the bat will have the opposite effect. If it works at scale, we will be pitting the attackers against the developers. I would rather get this tool in the hands of developers first. I welcome other people developing the same :) - better yet: I've already developed a version, come help me make it useful for the community.

<comment><USER2> Yeh, I totally see what you are saying and the end I agree with you, even as die hard FOSS as I am.

Having checked out your website I am pretty excited about what you are doing. How are we to ever build true value delivering services if the underlying architecture is not secure? This has been my biggest worry with the entirety of the space. That we will move too fast, lose focus on security first, and end up building gigantic infrastructures on shaky foundations thus turning into the very incumbents that we are aiming to displace.

With the idea I am planning on, I will most certainly need your services. I need for all parties to 1) understand the benefits of trustless sytems, and 2) be able to trust the trustless system in an environment where each party is relatively conservative in that it dislikes and discourages disruptions. Security will be of paramount importance.

Anyways, thanks for making this, its great to see such efforts being made in the space. We need less hype, and more maths, as I like to say.

</comment></comment></comment><comment><USER3> If this all works as you expect and you create a way to find many bugs very easily, you may want to carefully consider the rollout. For example, if you release a tool, I could use this tool to steal money from a project that I analyze to have bugs in it.

<comment><AUTHOR> Absolutely right! Which is why I am connecting directly with the project developers. Also, I specifically built it to run over Solidity source code. As opposed to EVM bytecode like other tools. Only 1% of contracts have their Solidity code public on Etherscan. Making this accessible to 100% of the original developers and only 1% of attackers, should limit it to white-hat uses.

<comment><USER4> > Which is why I am connecting directly with the project developers.

I wouldn't be surprised to find some of the big hacks have been project developers themselves moonlighting.

<comment><AUTHOR> You sir or madam, have a devious mind :). I shall hold on to my trust in humanity for a little while longer!

</comment></comment></comment></comment><comment><USER5> > The invariant for `K+D` is the identity function. So if we had a `D` with > holes, we could use a prover to verify the identity invariant and "solve for > D" simultaneously.

This was pretty mind-blowing for me. (I haven't really looked into program synthesis so I may be slightly more susceptible ;) There was one part of it that seemed problematic from my (perhaps flawed) understanding, though.

So I guess the idea is we have K+D = I (and this is roughly equivalent to 'D(K(s)) = I(s)' where 's' is a string to compress), so if we come up with a proof of 'I'—which would be a path through theorem space starting from I'm not sure what axioms—and we know 'I' is equivalent to 'K+D', and we already know the value of 'K,' then the value of 'D' is implied.

My question is what is the equivalent here to the subtraction operation that would allow us to say D = I - K? It seems very surprising to me that K and D would be structured in such a way that their own proofs would necessarily have any relationship to the proof we derived for I, so that such a subtraction would work so cleanly...

<comment><AUTHOR> Your `D(K(..))` notation is better than mine. Email me, and I will send you a gift card.

What you do is solve `\exists D: \forall arr: D(K(arr)) = arr` where `arr` is an arbitrary length array/bitstream. See paper [1]. There is also really old code you can browse at the bottom of my personal page linked in profile (doesn't compile anymore coz of deprecated dependencies.)

The arithmetic analogy break down when solving. So you're not explicitly computing `I - K`, but instead letting the constraint solver pick values that satisfy the equation (hence SMT solving.) Also, you are absolutely right that there is no reason to have their structure be related to identity: _But_ , the "damage" done by `K` is encoded in the state at the interface to `D` and `D` better undo that state to get to identity, which is what the solver would exploit.

[1] Path-based Inductive Synthesis for Program Inversion [http://saurabh- srivastava.com/pubs/pldi11-pins.pdf](http://saurabh- srivastava.com/pubs/pldi11-pins.pdf)

<comment><USER5> > So you're not explicitly computing `I - K`, but instead letting the > constraint solver pick values that satisfy the equation

Ah—makes sense. I wonder if attempts at going in the other direction have been made, and initially constraining the structures of the known parts so that you could do something like a subtraction to get the unknown (probably a crazy dead-end idea I realize :).

> But, the "damage" done by `K` is encoded in the state at the interface to > `D` and `D` better undo that state to get to identity, which is what the > solver would exploit.

Interesting. So because we know it's an inversion scenario beforehand we can modify the solver to not be so general, and only bother considering solutions which modify the state in an inverse manner to our original program...

Cool. I'll be keeping this at the back of my mind to see if any ideas come up. Thanks and good luck!

<comment><AUTHOR> Look up Nate's work [1], specifically Boomerang [2] that aims for bidirectional programming. Be crazy :)

[1] Nate Foster: [http://www.cs.cornell.edu/~jnfoster/](http://www.cs.cornell.edu/~jnfoster/) [2] Boomerang [http://www.seas.upenn.edu/~harmony/](http://www.seas.upenn.edu/~harmony/)

</comment></comment></comment></comment><comment><USER6> I'm surprised that YC funded this. The ICO/off-brand cryptocurrency/smart contract fad is kind of over, as yesterday's post on failed ICOs pointed out.

In the "dApp" world, the top five by market cap are:[1]

\- EOS, a competitor to Etherium. It's a platform for more dApps.

\- VeChain Thor, which pivoted from a RFID tracking system for cargo to a "mobile wallet".

\- Tron - "The platform is still in its infancy as is expected to reach the "Eternity" by 2023. In its final stage, the platform will allow content creators to directly monetize their content by creating their own token over the TRX blockchain."

\- Omise - this is a "white label solution for mobile payments". It doesn't really use "dApps", it just used a token sale to raise money.

\- Icon - a blockchain to integrate other blockchains.

None of these actually _do_ anything.

If this is so great, is YC itself buying ICO tokens? Didn't think so.

[1] [https://www.newgenapps.com/blog/top-ethereum-dapps-tokens- re...](https://www.newgenapps.com/blog/top-ethereum-dapps-tokens- revolutionizing-world-economy)

<comment><USER7> Typical negative comment when it comes to blockchain technology.

Some people have made millions, some brand new technology is created after a unique technological advancement that solves the byzantine general problem, even YC is investing --- yet old people cry "it is nothing but a fad!", so much that it becomes comical, like the black knight in the Monty Python (especially when it comes from someone confusing Dapps and Tokens)

Eventually, you guys will have to admit you were wrong. A bit like people who thought horseless carriage were a fad. It's ok, we all get things wrong someones. No bad blood.

Technology is here to stay. Many people are ideologically opposed to the libertarian roots of cryptocurrencyes. Many others regret not investing in time, or selling too early.

I get that. But maybe it's time to move on.

<comment><USER8> > unique technological advancement that solves the byzantine general problem

It doesn't even solve the byzantine general problem...

</comment></comment></comment><comment><USER9> Are you using rosette? I had an idea of using program synthesis for creating new smart contracts based on a language that would create them from unit tests. Are you going to open source your system?

What I had so far is at [https://github.com/zitterbewegung/Belmod](https://github.com/zitterbewegung/Belmod)

<comment><AUTHOR> I am not using Rosette, although I love the work Emina and Ras are doing to make synthesis accessible.

[ Edit: Your idea is fantastic, btw. If you can find use cases where the size of contracts is small, it'll be amazing to have synthesis from test cases. ps: Do borrow some ideas from the way Sumit solves Flashfill. ]

My system is closed source, partially because it is computationally heavy and I'll spin up a server fleet for analyses, and also because I don't want it to be used for attacks, i.e., limit use to mostly the original developers of projects.

Connect with the email on the website. I'll look at your code a little later.

<comment><USER9> Thanks for the advise! I haven't been working on it because I didn't really know where to start and I had to learn solidity.

</comment></comment></comment><comment><USER10> Seems very useful. As someone who has recently started rolling out solidity contracts to learn and eventually create contracts with real money behind, having something that adds to my own confidence in the security of my code is helpful. Do you plan on eventually charging for the cli used in the marketplace demo?

<comment><AUTHOR> Yes. The hope is that you run this analysis as part of your development workflow. e.g., on every merge into master. Charge up like AWS and use as frequently as you need. The current alternatives involve hiring a firm for $20-500k for a manual audit that happens at the end of years long development. I will work with you to get this into your hands as soon as I can.

</comment></comment><comment><USER11> Congrats on the launch. How is your value proposition different than quantstamp (QSP)? I believe YC also invested in them

<comment><AUTHOR> Thanks!

The key distinction is building a synthesizer, not just a verifier. These systems are hard to use, and synthesized code is the key to making them accessible. Watch the demo videos. See if you agree.

On the verifier side: QSP is a protocol/marketplace for connecting people needing audits, with human auditors or free open source tools (Oyente and Mythril) [1]. My verifier is more comprehensive and future-proof at the expense of being compute intensive, as discussed on my FAQ [2].

[1] [https://quantstamp.com/visual-guide-to- quantstamp](https://quantstamp.com/visual-guide-to-quantstamp)

[2] FAQ: "How is this different from Ethereum's other tools ?" [https://synthetic-minds.com/pages/faq.html](https://synthetic- minds.com/pages/faq.html)

</comment></comment><comment><USER12> We will soon have ScAfee but for Dapps!

Is it not true that program synthesis will work, as long as a "contract" isn't too large or designed adversarially? Because if that weren't true you'd have a debugger for all circuits and programs (suitably restricted in computing power).

<comment><AUTHOR> I'm guessing you meant McAfee for Dapps?

Yes. It should work. There's a good amount of work to be done though. :)

I don't follow what you mean by a "debugger" in this case.

</comment></comment><comment><USER13> I'm an independent developer. What would it cost me to use this, once you've fully launched?

<comment><AUTHOR> It will be pay for use, like AWS. You fill up, and then depending on how compute-heavy your contracts are to analyze, you will be charged accordingly. Your costs will end up depending on complexity of your contracts.

Compare this to the alternatives of paying $20,000 - $500,000 for manual audits.

<comment><USER13> So I still have no idea how much it might cost. Let's say my contract is 500 LOC and average complexity.

(I'm not convinced formal verification with automated tools can actually substitute for manual audits. I think they're great for _augmenting_ manual audits, but what if there are failure conditions I didn't think to assert as impossible?)

<comment><AUTHOR> If you see the demo runs on the website FAQ, that example of about 20-50 LoC cost ~$200. You can extrapolate accordingly. Now if you integrate into your CI, I am of course going to only rerun on changes (syntactic, easily checked; and hopefully semantic later.)

If you want a more precise cost analysis, shoot me an email for your specific contract.

And you are right about audits. Except a caveat: The system will by default check for global properties as well, e.g., no double spend. Again, look at the examples in the FAQ. They had no assertions in them. Yet, we find errors.

<comment><USER8> > You can extrapolate accordingly.

Hm no I can't. What's the complexity of your algorithm?

<comment><AUTHOR> Ah. I see why that was unclear.

I make multiple SMT queries. SMT solvers work well in practice, but they are solving a problem which is between NP-Complete to Undecidable (when quantifiers are involved [1]).

Also, we are using a very hand-wavy word definition "complexity of code". This is not the complexity-theory complexity, but instead the types of operations used and the looping/control structure. (In hindsight, I should have used a different word.) So 40 lines of multiple nested loops with multiple hashes being taken and multiple dynamic dispatches over addresses, will take _much much_ longer to analyze than 40 lines of straight line arithmetic.

My tool attempts to guess the estimated runtime midway through the analysis, but there is no real way to accurately estimate the cost upfront. That is why I was saying that if it cost ~$200 for 20-50 LoC then if you accept all caveats then under wildly simplifying assumptions the 500 LoC might take 10x-25x of that cost.

[1] [https://stackoverflow.com/a/10924475](https://stackoverflow.com/a/10924475)

</comment></comment></comment></comment></comment></comment><comment><USER14> I didn't understand a lot of that, but have you found any dapp bugs yet?

<comment><AUTHOR> Ah, sorry. Happy to explain any pieces in more detail. I hope the core is clear: If you think of Dapps as servers, then it synthesizes its clients (specifically ones that cause assertion failures).

For bugs: The demo videos on the FAQ page show the kinds of bugs it can find, e.g., the one that crashed the DAO, and ones that simpler tools will be unable to find. Of course you are right, the holy grail is finding bugs that escape both human audits and other tools. Haven't run it on very large codebases yet. Working on it!

<comment><USER14> Oh no you're fine. I wasn't criticizing your explanation, just prefacing that I'm pretty ignorant with this stuff. But I find what you're building very interesting.

</comment></comment></comment><comment><USER15> This is cool! I work at MakerDao, we are working on formal verification as well. Congrats on YC (again)-look forward to seeing how this project shapes up.

</comment><comment><USER16> Hey, can you shoot me an email? It's my username at gmail. I might have a suggestion.

</comment><comment><USER17> FYI, your SSL certificate is invalid

<comment><AUTHOR> Fixed. Thanks for noticing.

</comment></comment><comment><USER18> Congrats on the launch but....needs a TL; DR;. Holy wall of text, batman!

<comment><AUTHOR> LOL. I agree. Want to take a stab at it?

<comment><USER7> TLDR: you use formal verification methods to find obvious bugs in the sourcecode of blockchain contracts, taking advantage of the blockchain natural properties to limit the search space

You have a great idea there. Run with it!</comment></comment></comment>


Emacs 25.3 released - <AUTHOR> https://lists.gnu.org/archive/html/emacs-devel/2017-09/msg00211.html <comment><AUTHOR> > _This is an emergency release to fix a security vulnerability in Emacs._

> _Enriched Text mode has its support for decoding 'x-display' disabled. This > feature allows saving 'display' properties as part of text. Emacs 'display' > properties support evaluation of arbitrary Lisp forms as part of > instantiating the property, so decoding 'x-display' is vulnerable to > executing arbitrary malicious Lisp code included in the text (e.g., sent as > part of an email message)._

> _This vulnerability was introduced in Emacs 19.29. To work around that in > Emacs versions before 25.3, append the following to your ~ /.emacs init > file:_

      (eval-after-load "enriched"
        '(defun enriched-decode-display-prop (start end &optional param)
           (list start end)))

> _Gnus no longer supports "richtext" and "enriched" inline MIME objects. This > support was disabled to avoid evaluation of arbitrary Lisp code contained in > email messages and news articles._</comment>


Show HN: Where would you go if flights weren't expensive? Email alerts to save $ - <AUTHOR> http://www.tripfate.com <comment><AUTHOR> Hello world,

I am working on putting together the beta for [http://TripFate.com](http://TripFate.com) and thought it might be a good idea to share the story and motivation behind it.

I met my wife exactly 4 years ago - all thanks to being on the right flight at the right time. Funny thing is, I wasn't really supposed to be on that flight to Rome. As much as I loved traveling, I was a poor college student and I couldn't really afford the expensive flights.

And then it happened. I was looking for flights to random destinations after wrapping up my project report at 4 AM, and I found a round-trip ticket to Rome (from NYC) for ~$110! It was crazy because the usual prices are at least in the $350-400 range.

I got super hooked! After I returned from my trip, I registered on a bunch of websites to get alerts if there was a price drop. I did get some good deals, but nothing was as crazy cheap as the one I had found for my trip to Rome.

Long story short, I created a service for myself over the years that'd look for flights from across the internet that really were 'great' for their price. In the beginning, it simply sent API requests and had a bunch of if-else statements. However, over the years, I've added a bunch of Machine Learning and Deep Learning tricks to the algorithm.

Moreover, I have instances of my 'smart travel finder' running on around 14 different servers around the world (who knew looking for a flight from India is cheaper sometimes!).

I started getting lots of really interesting flights: ~$170 round-trip to Cancun, ~$230 to Paris, ~$340 to India... and so I decided to share it with family and friends and friends of friends. Once the list grew to over 200, I thought maybe people would be interested in paying for the service, and that's how [http://TripFate.com](http://TripFate.com) was born.</comment>