XCSSET Mac Malware infects Xcode projects, performs UXSS attack on browsers - wincent
https://blog.trendmicro.com/trendlabs-security-intelligence/xcsset-mac-malware-infects-xcode-projects-performs-uxss-attack-on-safari-other-browsers-leverages-zero-day-exploits/
======
pritambarhate
Does anyone know a good command line malware/antivirus checker for Mac? (Paid
is fine.) I do not want the antivirus to run in the background continuously
(which affects performance) yet want to have ability to run nightly scans to
ensure that the machine is not infected.

Almost all traditional antivirus products want to deeply integrate with the
system and affect the performance a lot. Also some of these companies are know
to make questionable decisions like trying to intercept HTTPS communication,
etc.

~~~
mindfulhack
I use Objective-See's free and open-source BlockBlock:

[https://objective-see.com/products/blockblock.html](https://objective-
see.com/products/blockblock.html)

It picks up background daemon tasks that suddenly are created and allows you
to block them immediately. That's certainly one major way to pick up and block
hidden malware on your computer.

All of the tools by this guy are incredible, they are also recommended, e.g.
tools to pick up and allow you to block access to microphone or camera.

~~~
cgufus
... and definitely read objective-see's blog post from time to time if you are
into security topics. The malware take-apart documentation is extremely
enlightening.

(Intereseting fact: A lot of malware quits immediately if Little Snitch is
installed. So running Little Snitch alone prevents some malware from infecting
your system)

------
sam_goody
Is there a good on-demand antivirus for Mac?

The only two I know of is Malwarebytes and Kaspersky.

The former installs with root privileges, runs on boot and cannot be ever
closed, despite the fact that it is only an on-demand scanner. I've written to
them to request an explanation, and did not get any response.

Kaspersky has had a fair share of rumors against it, and I am not in a
position to evaluate if they are trustworthy.

~~~
hjuutilainen
There’s [https://sqwarq.com/detectx/](https://sqwarq.com/detectx/) which would
fit your needs nicely. They also recently tweeted about detecting this
specific malware in question.

~~~
sam_goody
I never saw this program before.

Closed source, no references, and free (so how do they support themselves?)

Very nice, but why would I trust it?

------
GuB-42
Reminds me of the "Induc" virus.

This virus infected Delphi installations, injecting its code and compiling it
into a system library. All programs using the infected library contained the
virus, including some popular ones.

Because they came straight from the developer, and the virus didn't do
anything unless you had Delphi installed they were often considered false
positive when they weren't. Originally, it had no malicious payload beside its
replication mechanism.

------
btown
> Affected developers will unwittingly distribute the malicious trojan to
> their users in the form of the compromised Xcode projects, and methods to
> verify the distributed file (such as checking hashes) would not help as the
> developers would be unaware that they are distributing malicious files.

To understand why this happens, it's important to know how massive a typical
.pbxproj file looks:

[https://opensource.apple.com/source/CommonCrypto/CommonCrypt...](https://opensource.apple.com/source/CommonCrypto/CommonCrypto-24911/CommonCrypto.xcode/project.pbxproj.auto.html)

Ostensibly it's human-readable, but because it's generated by Xcode and filled
with inscrutable UUIDs, people treat it like a binary file, and they're
trained to do so:

[https://stackoverflow.com/questions/2004135/how-to-merge-
con...](https://stackoverflow.com/questions/2004135/how-to-merge-conflicts-
file-project-pbxproj-in-xcode-use-svn/2007358)

Even the React Native team apparently allowed the file to be treated as non-
diffable for some time: [https://github.com/facebook/react-
native/pull/11047](https://github.com/facebook/react-native/pull/11047)

And note the large number of commits on all types of projects that essentially
say "whoops forgot to update pbxproj" \- there are likely far more.
[https://github.com/search?q=update+pbxproj&type=Commits](https://github.com/search?q=update+pbxproj&type=Commits)

So why does this matter? Because the brilliance of this attack is how it
"jumps the blood-brain barrier" between a developer's machine and their
canonical codebase. Usually, code review and auditing of what goes into a
commit prevents this kind of attack from leaping to VCS. But Apple makes the
pbxproj so inscrutable, and does such a good job at hiding all its complexity
behind (usually well-designed) wizards and dropdown menus, that people take it
for granted. If code shows up there, people _believe Apple intended that to be
the case_ even if, say, your last commit was a small change in Interface
Builder (or whatever they call it nowadays). Your code reviewer might just
skip the file entirely, because they've been trained to expect the same.

And that's scary.

At the end of the day, this is just another way of exploiting the lack of a
mature and centralized CI ecosystem in the modern package distribution world.
There's no organization running a security-minded linter on pbxproj files as a
general rule. But, then again, there doesn't need to be a linter on
package.json or project.clj or Makefiles because there was never a history of
hiding complexity - if that file changes, you'd better darn well know what
you're doing. What we have here is a perfect storm of move-fast-break-things
package management, a file designed to slip through code reviews, and a pretty
creatively designed malware payload.

EDIT: Perhaps another way to look at it is that having one file responsible
for both compilation _logic_ and non-compilation-related IDE-specific _file
status_ can be problematic. It's like your Makefile also needs to be your
.gitignore-but-only-top-level-is-allowed-and-all-files-need-to-be-whitelisted.
Of course, this is very much an Apple thing to do.

~~~
liuliu
Xcode project (pbxproj) is simply ill-equipped for proper code reviews. Any
modest size team should remove their Xcode projects from their codebase and
move to either Bazel, Swift Package Manager or Xcodegen. It is really not that
difficult and the benefit is quite obvious: [https://liuliu.me/eyes/migrating-
ios-project-to-bazel-a-real...](https://liuliu.me/eyes/migrating-ios-project-
to-bazel-a-real-world-experience/)

~~~
andy_ppp
Would you even recommend it for smaller teams or one man teams in my case...?

~~~
jmull
For a single developer I think it works OK to review pbxproj changes like
other source.

You really should understand and recognize what each change is.

It’s when you have the additional dimension of multiple developers changing
the project that it really becomes unwieldy and you are pushed into treating
it as binary.

------
Thorrez
Wow, the way it spreads is fascinating, reminiscent of Reflections on Trusting
Trust.

I'm a bit confused about

>two zero-day exploits: one is used to steal cookies via a flaw in the
behavior of Data Vaults, another is used to abuse the development version of
Safari.

Malware on the local machine can steal data from Safari on the local machine.
Is that a surprise? Does Safari have a threat model that it intends to protect
against locally running malware?

~~~
olliej
Data vaults on macOS are intended to prevent apps running under they same
unprivileged user from accessing files that belong to another app.

Eg, if there is a file/directory that only safari is meant to have access to,
no other app should be able to read it, without at least bringing up one of
the annoying “allow X to access your Y”. For example, the first time you, say,
feel your home directory you’ll get a bunch of TCC requests asking if the host
app (Terminal.app say) should be allowed to access those files.

~~~
xnyhps
To add to this: there are two different types of Data Vaults. For locations
such as ~/Pictures, ~/Documents, Calendars, Contacts, etc. a permission prompt
is triggered if an app tries to access it. Other locations, such as where Mail
and Safari keep their data, can not be allowed from a prompt. Those require
"Full Disk Access" for third-party software to gain access, which you should
give only to applications that really need it, such as a backup tool.

Anything not on those locations is not protected, so there's no Data Vault for
Chrome's cookie file, for example.

~~~
olliej
Is there an API that allows apps to construct data vaults? I assumed that
there would be, but I also generally don't write code at that level in the
stack

------
jayyhu
For those curious, the two Xcode projects they found infected on Github were:

      ragulSimpragma/twitterTask
      yimao009/MVC-MVP-MVVM

Fortunately they look like personal projects so the spread seems minimal so
far.

~~~
vanc_cefepime
You had links to those projects, now removed.

Stupid question. Was it bad that I clicked on the github.com links? This is
not something spread just with viewing the links, right?

~~~
Exuma
You're safe. You have to compile the projects with Xcode

~~~
x86_64Ubuntu
But if I pull that code and compile it, my executable will have the malware in
it? I've never done anything in the MacOS ecosystem at all, so I'm just
asking.

~~~
ayyy
No, if you pull that code and "compile" it with xcode, it will run scripts
that install malware on your machine. I assume once the malware is on your
machine, it can infect other xcode projects on your machine.

------
swiley
Bummer there’s pretty much one set of tools for the mac.


10 profitable business opportunities for women in big cities - sophiamstg
https://www.startupguys.net/10-best-small-business-ideas-for-women-in-big-cities/
======
anovikov
That sounds disgustingly sexist. 'Some innocent and unprofitable things these
sub-humans can do while we make all the money'. Shame!

------
twobyfour
And why are the business opportunities for women any different from those for
men?

This article is disgustingly condescending.

------
Frogolocalypse
? Engineer? Doctor? Lawyer? Scientist? Software development company? Building?
Security? Transport? Restaurant? Produce delivery?

No? Sigh...

------
newsbinator
"Though there’s no such difference between a woman and a man when it comes to
entrepreneurial drive"

[citation needed]


What If the Kindle Succeeds?  - makimaki
http://www.eff.org/deeplinks/2008/08/kindle
======
sh1mmer
I'm surprised (and pleased) that the author doesn't try to rail at the DRM in
the kindle, but does praise the benefits the kindle brings to the market as a
whole.

He happily accepts that DRM will inevitably fail in books, as it has in music.
I absolutely agree that DRM is bad, but I also admire his ability to let the
issue slide at this early stage in the market.

~~~
inklesspen
"Early stage"?

e-books are far older than mp3s and avis. Baen Books has been selling
speculative fiction in non-DRMed e-book formats for years and (disregarding
the fact that almost all of their stuff is shit) it's done very well for them.
Cory Doctorow gives away all his books for free, and it's increasingly a
tactic adopted by others in the speculative fiction business; four of the five
nominees for the Hugo Award this year were released in DRM-free format (for
FREE, even) so Hugo voters could have a better chance of reading them.

So, if this is the early stage of e-books, I wonder what it'll look like when
the market is mature.

~~~
netcan
"Early stage" of the market. That does not necessarily equal in the
technology.

------
kylec
The ease of readability is what will ultimately make or break ebook readers.
If the display is large enough and easy on the eyes and the interface simple
and intuitive I can imagine a device capturing a certain following. Other
things like price of the unit, prices and restrictions on books, and
portability will be addressed if the market is there.

I remember reading ebooks on my Palm several years ago and finding it a less-
than-enjoyable experience. Though I've never actually used a Kindle it seems
to be a large step in the right direction.

~~~
stcredzero
Interactivity will become increasingly important as well. I think we'll
eventually see ways to interact with books that no one had thought of before.
E-ink displays like the Kindle and the Sony Reader will therefore go the way
of the dinosaur. They are great for daylight readability and low power use,
but they are too slow!

~~~
lacker
It would be cool if e-books made it easier to read in foreign languages. In a
language that I mostly but not entirely comprehend, I very often want a
translation or explanation of a word or passage. Reading a real-world book
with a dictionary at hand is a huge pain.

~~~
stcredzero
What about a "translation mode" where every time you pointed at a word, there
would be a pop-up definition. Probably also enable swipe-highlighting a
passage and getting a translation as well.

------
zandorg
One interesting idea is that of printing every book you want, on demand. Using
<http://www.lulu.com/> you can get prices of $8 per copy plus $8 postage, and
you provide a PDF (around 250 pages is ideal). It's $16 per item too - no need
for an order of say 30 books. Multiply that into $300 and that's quite a few
books you can stack on the shelf.

------
mynameishere
Killer feature: Make the kindle completely waterproof. It's so obvious.

------
gamble
I don't think the Kindle is in any danger of shutting down the ink-and-paper
presses yet. 10% of sales, on Amazon, of books available electronically is a
vanishingly small percentage of the market.

Now if you could rent books via the Kindle in the style of O'Reilly Safari,
that could be a game-changer.

~~~
stcredzero
Reference books would be great for something like Kindle but with a more
interactive interface. Being able to search and flip back and forth quickly
between bookmarks would be great for reference. And the great thing about lots
of kinds of reference? People will pay subscriptions for the kind that gets
updated often! People will pay just to have information at their fingertips
and not have to carry 3 or 4 thick volumes around.

------
netcan
What seems odd is that Amazon seems to be trying to avoid a game change.

They want to make reading /book ownership & retail different with as little
effect on what goes on further up the value chain as possible. Prices are more
or less the same, for one.

That doesn't seem to make sense.

~~~
ComputerGuru
Actually, it makes tons of sense.

Amazon is the king of online book sales. They're connected to the world's
publishers and authors and they're really enjoying their position above
everyone else.

If the way we view eBooks were to change, if eBook prices were to reflect
their true costs, the entire online book industry would be shaken.... it most
likely will happen, sooner or later, but Amazon (smartly) doesn't want to be
the one to instigate such an upheaval that would leave them in a risky
situation.

It's very likely that should such an event occur, they would adapt and remain
the kings of online media sales - but it's a risk that they don't _have_ to
take - they're already at the top so it's nothing to gain and everything to
lose.

They're trying to shape the emerging market by their own hands in their own
way, a step at a time, to ensure that they'll always be safe.

~~~
netcan
If what collapses the current industry structure is apple's device, they'll
probably come out in a decent position.

If that's what's going to happen anyway, isn't it better to lead? Especially
if there's a chance of locking users in to a device with DRM. And it seems
impossible that there won't be a change. The whole economics of printing is
built on the realities of.. printing. How long can they keep pretending that
books are being printed?

But I guess you're right. It's not 'no sense' it's 'no cojones'.


Show HN: my weekend project, whatsnerdy.com - hanzenlim
http://whatsnerdy.com/

======
mgurlitz
Very cool site. Looks like you might have a Unicode problem: "Show HN: My
Github rÃ©sumÃ©"

------
brianfryer
Is there something that you can do about the floating social bar?

On iOS, it hovers over some of the content :-(

<http://imgur.com/hwmWN>

Other than that, though... YAY!

~~~
hanzenlim
thnx for letting me know, ill fix it asap :)

~~~
autophil
The floating social bar is still there on my iOS, and it's disruptive. Please
fix. Great site otherwise.

~~~
hanzenlim
fixed it, should work now. sorry it took me a while :O

------
eatitraw
Added to bookmarks! It may become my favourite website for procrastination. :)

What I don't like is two-column layout: it makes title boxes have uneven
height. Even both columns have different weights. It would be nice to see
numbered list for sites with numbered postings - like HN(of course, if it's
not by design, for example, if your project uses custom ranking and selection
systems for publications).

------
mforsberg
I really like the sources and amount of content you picked out. Good choice of
a domain as well.

But like sangupta and amirf I think you should improve the UI a bit; maybe
have a go with twitter's bootstrap?

One thing I really would like is that you skip the two columns and narrowed it
down do one column and worked a bit on the navigation so that it's on one line
or grouped in some shape or form.

~~~
emp_
When we see people complaining of the excess of Bootstrap sites around, they
tend to forget what they would feel/look/be like before such frameworks
existed.

------
railswarrior
Hey nice compilation mate , only thing that it misses is the discussion forum
.Would love to see that :)

Well that's why i keep coming to Hacker News or reddit and keeps you engaged .

Guys at Hacker News discussion forums are one the best people to talk to
regarding technical topics .

~~~
hanzenlim
thnx for the input mate, ill try to add discussion forum in the future.

------
srik
Nice work.

It would be nice to have sortable sources and comments, like popurls does.
(Although popurls doesnt have hn comments, which is painful)

Also, have you considered eliminating links that have been duplicated over
different sources.

------
Sharma
Cool site! My suggestion for more features/changes:

1\. Social share bar for each link. 2\. Finding common links/stories in all
those tech sites. 3\. Probably a tab view? 4\. Search feature!

------
skizm
This reminds me of jimmyr.com which is how I came across
reddit/digg/hackernews in the first place. Not sure how I came across
jimmyr.com in the first place though :\

~~~
johnnymonster
or popurls.com

------
sangupta
Congrats - this is just so awesome! How about adding an RSS feed and tweaking
the UI a bit to make it more usable - for the specky ones like me :)

------
johnnymonster
I've been thinking about doing something like this for a while now. Any
thoughts on open sourcing it, putting it up on github?

------
amirf
Great job! All you need now is a better UI for mobiles and I'm sold :)

What web technology did you choose for this?

~~~
hanzenlim
I used ruby on rails for backend, then xpath to parse through each sites for
links

------
madmax108
Love the idea! :)

Would be even cooler if I could add/remove sites and reorder them ...

------
awef
Fix the encoding, add a favicon and change the font from Times and I'd
probably use it :)

------
snaveint
A simple, yet extremely useful site. Love it; I can see myself regularly using
this.

~~~
hanzenlim
thnx

------
thedudemabry
Haha, that's awesome. I hope you keep it up because it's my new home page!

------
sktrdie
If you keep it ads free I'll use it. Please remove the left sidebar

------
Jaco
Awesome website! Thanks for sharing :-)


Leading Civil Rights Groups Just Sold Out on Net Neutrality - poolpool
http://www.republicreport.org/2014/leading-civil-rights-groups-just-sold-out-on-net-neutrality/

======
samtalks
These groups seem more and more out of touch with the public that they
purportedly serve. Just look at the outcry over their attempt to manipulate
the objective merit-based criteria for NYC's Specialized high schools.
[http://www.city-journal.org/2014/24_3_nyc-specialized-
high-s...](http://www.city-journal.org/2014/24_3_nyc-specialized-high-
schools.html)

While there is a critical need for better racial diversity at the schools, to
try to 'fix' the problem at the 8th grade level (when it's usually too late)
not only seems like a pure PR play, but it also hurts the thousands of
sacrificing low income students who are currently getting accepted into these
schools.

Civil rights in this country needs a disruptive reboot.

------
jaekwon
I'm not a member on any of these groups but I did find one on facebook &
messaged them.


Get Billions of Correct Digits of Pi from a Wrong Formula (1999) [pdf] - drusepth
https://academics.rowan.edu/csm/departments/math/facultystaff/faculty/osler/Billions_pi_digits.pdf
======
man-and-laptop
Sketch of an alternative proof, more DSP:

Use the fact that the approximation in the paper is equal to the inner product
of e^{-x^2} with a Dirac comb [1]. The amazing thing about the Gaussian
function and the Dirac comb is that they're _both_ preserved by the Fourier
transform. So apply the Fourier transform to both of them, observe that the
Fourier transform is unitary (essentially a rotation), and therefore doesn't
affect the inner product; then expand the inner product of the Fourier
transforms.

Essentially, it's the same proof, but not in the language of Theta functions.
In fact, I'd argue it's a better proof, because it generalises.

Generalisation: This technique applies to all Riemann sums, as long as you can
compute the Fourier transform of the function. The thinner the tails of the
function's Fourier transform, the faster its Riemann sums will converge.

[1] -
[https://en.wikipedia.org/wiki/Dirac_comb](https://en.wikipedia.org/wiki/Dirac_comb)

~~~
abenedic
Myself, I would say this is 80% correct. The bigger deal is the spectral
convergence of the trapezoidal sum for periodic entire functions.

~~~
man-and-laptop
I gave my generalisation in terms of frequency, and not in terms of "number of
rectangles" in the Riemann sum, which I conveniently assumed to be infinite.

A better generalisation: if a function is thin-tailed, and its Fourier
transform is thin-tailed, then it's Riemann sums converge to its integral at
an exponential rate. In particular, this applies to the Gaussian function.

I'll check out what you said.

------
xamuel
The formula involves a parameter c=10^10 and initially seems unbelievable
because one's initial inclination is to assume that the 10^10 is particularly
important, like it has to be that particular value in order for the formula to
work. The "trick" is that higher values of c, like c=10^19, give even more
accuracy. Obviously c=10^10 was chosen to optimize the formula's aesthetic
beauty.

~~~
madcaptenor
Even c = 2 works.

      > n = seq(-1000, 1000); #assume 1000 is big enough to be infinity
      > sum(exp(-n^2/2))^2 / 2
      [1] 3.141593

~~~
miduil
Which programming language is that?

Edit: Ah, it's "R".

~~~
madcaptenor
Yes, it's R. Not necessarily the ideal language for this but I had an RStudio
window open.

------
madcaptenor
That "wrong formula" approximates pi by an integral: more precisely, exp(-x^2)
integrated over the real line integrates to sqrt(pi). So the question is, in
some sense, why is that such a good approximation? (My Fourier analysis is
rusty, so I can't answer that question.)

~~~
hammock
[https://en.wikipedia.org/wiki/Gaussian_integral](https://en.wikipedia.org/wiki/Gaussian_integral)

~~~
madcaptenor
I'm familiar with the integral. But why is that sum a particularly good
approximation to the integral? It seems better than one has a right to expect,
although it's been a while since I did any numerical analysis.

~~~
madcaptenor
Replying to my own comment. See (4.4) in the article and the discussion after
it. The error in this approximation is like exp(-pi^2 c). (4.10) in the
article translates this to that we should expect about 4.2c digits of
accuracy, since log_10 exp(-pi^2) is about 4.2. This falls out of Poisson's
summation formula, according to the OP.

Generally I'd expect a numerical integration scheme to have an error like h^k
for some constant k - for example for Riemann sums the error goes like h^2 and
for Simpson's rule like h^5. h is the distance between the sampling points and
so is analogous to 1/c. So this doesn't just follow from Riemann summation.

~~~
tanderson92
Trapezoidal rule quadrature is better than you would expect (2nd order) for
periodic (even better for analytic and indeed entire, in this case)
integrands. See this paper:
[http://eprints.maths.ox.ac.uk/1734/](http://eprints.maths.ox.ac.uk/1734/)

------
xyzzyz
Seems like the formula is simply a fine enough Riemann sum for calculating
Gaussian integral int_-inf^inf e^(-x^2) dx = sqrt(pi). It makes it much less
surprising, though the exact estimation of error is still quite ingenious and
worth following.

------
messe
Spoiler alert: It's just a Riemann sum. This is like being surprised that
(1+10^-100)^(10^100) approximates e astonishingly accurately.

~~~
WhiteSage
What is surprising is how small the error term is. For the sake of comparison,
(1+10^-5)^(10^5) only gets five digits of e right.

~~~
saagarjha
And this one gets fewer than a hundred.

------
anonytrary
Interesting article, but I found the title a bit funny. I'd like to see an
article about Newton's laws titled "Getting to the Moon from a Wrong Formula".

------
gesman
This formula is worthy to be printed on T-shirt :)

------
preparedzebra
For any pattern, constant, irrational, etc, in math, there exists a set of
formulas that models it up until n. It still is a cool little Riemann sum in
this paper

------
amelius
There's still the hypothesis that _any_ finite sequence of digits appears
_somewhere_ in pi.

~~~
saagarjha
Ah, the normality hypothesis. It seems like it should be true, but apparently
this is something that's really hard to prove.

~~~
mamon
I might be ignorant here, but wouldn't it suffice to prove that digits of Pi
are random? Just check whether the distribution is uniform, the same way you
would validate pseudorandom sequence generator for a programming language.
Once you proved that Pi digits are random the normality hypotesis becomes
trivial: as number of known Pi digits approaches infinity the probablity of
any finite sequence to appear approaches 1.

~~~
pitaj
The distribution wouldn't even need to be uniform, right? As long as one or
more digits never stopped appearing at any point, the infinite sequence would
include every possible sequence of numerals.

~~~
v_lisivka
I'm 100% sure that Pi doesn't include e.g. 0.(3) sequence, or e sequence, or
many many other sequences, or even just million of zeroes in the row.

~~~
billforsternz
Why would you be sure it doesn't include a million zeroes in a row? If the
digits are random, as appears likely, it definitely will include a million
zeroes in a row. The problem is even if you could turn every atom in the
universe into a supercomputer, and somehow get them all cooperatively working
on calculating the digits, you'd still never get to the million zeroes
sequence in a million universe lifetimes. But they're still out there
somewhere.

~~~
billforsternz
I cannot reply to the reply from v_lisivka (for some reason) but I don't know
why you'd think a temporary run of decimal digits in pi would have any effect
on the geometry of a circle. It all comes down to whether pi is Normal or not.
Repeating the quote above, it is thought likely but not proven at this stage;

Quoting:

> It is widely believed that the (computable) numbers √2, π, and e are normal,
> but a proof remains elusive.

~~~
v_lisivka
My rough understanding is that Pi is representation of certain curve: circle.
If we skew sequence too far to one side or another, then curve will lost it
shape.

~~~
billforsternz
I hope it is becoming apparent that you need more than a rough understanding
of one of the properties of pi to contribute usefully to the discussion.

------
dajohnson89
Wouldn't a better title be, "An accurate approximation of pi"? Not as
clickbaity though....

~~~
jack6e
> _" Not as clickbaity though...."_

Not as accurate, either, given that the title of the paper is "Get Billions
and Billions of Correct Digits of pi from a Wrong Formula," and it was
published before "click-bait" was a thing.

~~~
djmips
Click-bait has long existed as headlines and movie and novel titles.


Ask HN: What does Google pay? - realodb
I am currently interviewing for a director (not senior) of software engineering position at Google. I'm wondering if anyone on HN has held such a position at Google before, or currently, and what it pays.  I realize all positions will have ranges based on experience, etc, but what ballpark can I expect for a base salary, bonus, and equity?  For a positon based in SF Bay Area, or possibly Seattle?
======
throwaway1500
Maybe ask that question over at teamblind? According to a somewhat recent
discussion of Sep 2018 at teamblind the TC (total compensation in one year,
usually not counting any perks) should be at least $750k+ TC, source:
www.teamblind.com/article/Engineering-director-at-Google-uaJEgaho

Another reference might be: www.levels.fyi/SE/Google/Facebook/Microsoft

Levels does not have L8 estimates yet, but L7 is already beyond $600k+ TC.


Why we are not satisfied with the personal work - iduuck
http://write.visualcake.org/why-we-are-not-satisfied-with-the-personal-work/

======
scotth
> “Hey! You can do this better than this faggot!”

Wow. Dominik, if you're reading this, you should know that this is
unacceptable language.

~~~
iduuck
Changed it. Sorry for this!

------
spacemanaki
The more general phenomenon was analyzed and described far better (and without
calling some other designer a faggot) by This American Life's Ira Glass,
summarized as "your taste is why your own work disappoints you":

<http://www.youtube.com/watch?v=BI23U7U2aUY>

------
gte910h
iduuck you should be ashamed for your casual bigotry, and additionally your
pushing your casual bigotry out to the HN Community.

> “Hey! You can do this better than this faggot!”

I am sorry if beavis and butthead are still your role models for acting like a
decent human being to everyone. There is no acceptable "fag means bad" meaning
anymore. It's all bigotry

------
peter_l_downs
I'd say, staying unsatisfied is a trait of a great person. The smartest people
I know don't settle for being however good they are at whatever they do.
Instead, they're constantly striving to improve.

------
MaxGabriel
Dominik, when you zoom in on an iPhone the top-right mountains logo and text
covers the post.

~~~
iduuck
Will fix this tomorrow. Thanks for reporting!


The P programming language - msoad
https://github.com/p-org/P
======
qznc
Finally, a proper "P". I only had P'' and P# on my list.
[http://beza1e1.tuxen.de/one_letter_proglangs.html](http://beza1e1.tuxen.de/one_letter_proglangs.html)

~~~
klibertp
Nice list! There's also F* under "F": [https://www.fstar-
lang.org/](https://www.fstar-lang.org/)

~~~
qznc
Thanks! Added that as well.

------
acjohnson55
This sounds a lot like the actor model (e.g. Erlang, Elixir, Scala + Akka).
It's a great primitive for concurrency and distributed computing.

Is there a big difference here, or is this basically just an alternative
language for that model?

~~~
tekacs
Well at the top of the manual, the list of constraints[1] reads the same as
the actor model[2] (it explicitly uses local state ('store') to model
behaviour changes), with the word 'machine' substituted for 'actor'.

If anything it reads like the restricted form of the actor model produced by
using only Erlang's gen_fsm or Akka's FSM mixin.

(to be clear, using a restricted form with more constraints is a great thing -
even better here, where one of the domains they're serving seems to be fairly
restricted execution environments)

[1]:

        > Each operation either updates the local store, sends messages to other machines, or creates new machines.
        > In P, a send operation is non-blocking; the message is simply enqueued into the input queue of the target machine.

[2]:
[https://en.wikipedia.org/wiki/Actor_model#Fundamental_concep...](https://en.wikipedia.org/wiki/Actor_model#Fundamental_concepts)

------
nickpsecurity
This is really neat. The synchronous languages like Esterel have been doing
great in real-time, safety-critical systems. As paper notes, the common
problems in distributed and operating systems are more asynchronous in nature.
Plus, modeling/verification and programming usually use separate tools. They
tackle both jobs with one tool for asynchronous programming that proved itself
out finding hundreds of bugs in a USB3 stack that's shipping to a wide
audience.

Programming languages rarely get better introductions and early results than
that. Props to the Microsoft Research team on this.

~~~
pjmlp
As mentioned the other day, it is this kind of efforts why I consider
Microsoft and to certain extent Apple, the ones driving for innovation in
safety on mainstream OS stacks.

Maybe Google as well due to their reluctance to improve NDK beyond being a way
to implement Java _native_ methods and port code into Android.

~~~
nickpsecurity
Right now they're focusing these efforts mostly on the drivers and hypervisor.
I'm not sure how much the kernel gets in terms of stuff like VCC. Just wait
till the Midori stuff starts flowing into their stack. It will probably be at
the app level for .NET in safety or performance improvements.

------
taneq
The manual is here (linked from github readme):
[https://github.com/p-org/P/blob/master/Doc/Manual/pmanual.pd...](https://github.com/p-org/P/blob/master/Doc/Manual/pmanual.pdf)

Calling a core language keyword "goto"? They're brave.

And I'm not convinced of the utility of baking their own C-like imperative
language when they could have actually used real C. There are already too many
C-like languages out there that are just different enough from C to be
annoying.

~~~
tinco
Did you read the manual? They use their own little language which is
imperative, but unlike C side effect free. To execute side effects it offers a
way to implement machines in regular C. This is for example how 'Timer' is
implemented in the manual.

~~~
bbcbasic
> imperative, but unlike C side effect free

Sounds like a dream language :)

------
Nullabillity
What's with all the single-character name programming languages? It's almost
as if they're trying to make it a pain to search for.

~~~
unsignedqword
Usually you can just search for languages with weird unsearchable names as
"*lang".

[https://en.wikipedia.org/wiki/S_(programming_language)](https://en.wikipedia.org/wiki/S_\(programming_language\))
(Not really sure how you'd search for this language in particular, though...)

~~~
i_cant_speel
It's pretty easy to find with "p programming language".

~~~
Camillo
What if you have a stutter?

------
mahyarm
Is this used in the Windows 10 USB driver, like the windows 8 driver?

~~~
justanotheratom
To be clear, P is used for validating the asynchronous state machines used by
the Windows USB drivers, and not for implementing the drivers, which are
written in C.

And the USB driver stack implementation is same for both Windows 8 & and
Windows 10, so the answer to your question is - yes.

~~~
Camillo
The README says: "P has been used to implement and validate the USB device
driver stack that ships with Microsoft Windows 8 and Windows Phone". It's not
clear from your answer. Does Windows ship with a "USB device driver stack"
written in P, yes or no?

~~~
nickpsecurity
The way these normally work is that they do the state machine in the domain-
specific language, verify it, auto-generate code in something like C, and
compile that. That's almost all of them since it's easy to go from models to
code automatically for state machines. The Github page says:

"Not only can a P program be compiled into executable code, but it can also be
validated using systematic testing. P has been used to implement and validate
the USB device driver stack that ships with Microsoft Windows 8 and Windows
Phone. "

That indicates they modeled it in P with their tool compiling the P specs into
some executable. The individual functions the state machine calls would be
other C or assembly functions. Microsoft as tools like VCC, Verifast, SLAM,
etc to verify C in drivers. I'm curious what combo of them they used on it if
any.

~~~
Matthias247
For me it's a very interesting question whether they directly used the
generated C code from the P toolchain in the driver or whether they only used
P for verification of the state machines and reimplemented them in C.

Directly using the code would be a huge achievement and can help to avoid a
lot of issues that will come with reimplementing it. However it has also quite
huge requirements for the code generation. E.g. the scheduler must fit the
target system and must be performant for the use-case, the infinite-queue
semantics that the state machines seem to have are not ideal for a constrained
environment and of course there's questions regarding memory allocation and
garbage collection (which should mostly be avoided in drivers).

------
doublerebel
The event model is great. Forces inputs and outputs to be simple. I really
like that P reads like English. The use of goto, on, in, send all read well.
They use monitor but abbreviate function to fun, why not just write function?

I think it would be nice to drop the braces entirely. They seem to only
function as decoration. Also I would really miss ++, P has many convenience
methods including += but no ++.

------
crudbug
Interesting, is this used in production ?

States & Events provide a right model for async programs. SCXML [0] provides
some additional tools for creating abstract finite state machines.

[0] [http://commons.apache.org/proper/commons-
scxml/](http://commons.apache.org/proper/commons-scxml/)

~~~
tinco
Apparently it is used to implement the Windows 8 USB driver. I can't think of
a higher bar of 'in production' than that.

------
nickpsecurity
I found out there's been a new language, P#, with even more benefits than this
one:

[https://www.microsoft.com/en-us/research/wp-
content/uploads/...](https://www.microsoft.com/en-us/research/wp-
content/uploads/2016/02/paper-6.pdf)

~~~
akashlal
Its available alongside P:
[https://github.com/p-org/PSharp](https://github.com/p-org/PSharp)

~~~
qznc
Hm, there is another P#:
[http://homepages.inf.ed.ac.uk/stg/research/Psharp/](http://homepages.inf.ed.ac.uk/stg/research/Psharp/)

------
wybiral
What is the support for streams like in P?

~~~
darawk
I can't tell if this question is intended to be a joke or not, but either way
i'm in support of it.

~~~
wybiral
Where's the flush method?

------
noselasd
What does this implementation target ? Does it produce .NET assemblies ? Is it
an interpreter ? Compiles to native ?

Edit: [https://github.com/p-org/P/wiki/Creating-a-P-
Program](https://github.com/p-org/P/wiki/Creating-a-P-Program) indicates it
compiles to C code.

------
cosinetau
Interesting. When I was studying Group algebra and machine organization, I
felt there was a strong intersection between these two schools, and I think P
is addressing that.

------
geon
How does it compare to Ceu?

[http://www.ceu-lang.org](http://www.ceu-lang.org)

------
lewisj489
Is there a CFG spec I could look at?

------
nephrite
I hate languages with single letter names. They're impossible to google.

~~~
yoodenvranx
Yes, there should be some sort of RFC about programming language names. The
main requirement would be to choose some combination of letters which return
less than 1000 results on Google.

~~~
DonaldFisk
The most important thing in the programming language is the name. A language
will not succeed without a good name. I have recently invented a very good
name and now I am looking for a suitable language. - Donald Knuth


Speech Recognition Is NSA’s Best-Kept Open Secret - etiam
https://firstlook.org/theintercept/2015/05/11/speech-recognition-nsa-best-kept-secret/

======
kordless
I can't fathom why this didn't get bumped to the front page.


Volatile is Evil - indy
http://www.bluebytesoftware.com/blog/2010/12/04/SayonaraVolatile.aspx

======
alextingle
It is very annoying that 'volatile' means different things in different
languages. Inexcusable that Microsoft should unilaterally change the meaning
of 'volatile' in their C++ compiler, adding yet another #ifdef into everyone's
code.

~~~
dfox
Both C and C++ defines volatile as something like "Access to volatile objects
are evaluated strictly according to the rules of the abstract machine." (exact
wording from some old draft of C++0x I have here) with C explicitly noting
that "What constitutes an access to an object that has volatile-qualified type
is implementation-defined." (ISO 9899 6.7.3.6). So there is not many to say
about what volatile means without knowing exact implementation (and
implementation should document what volatile exactly means).

I don't see what Microsoft could do to unilaterally change meaning of
something that is almost completely implementation-defined.

~~~
JoachimSchipper
I'm not so sure that your reading of the standard is correct. From n1256.pdf,
the essentially unchanged and freely available draft of the C99 standard:

(5.1.2.3.2): Accessing a volatile object, ..., or calling a function that does
any of those operations are all side effects...

(5.1.2.3.3): In the abstract machine, all expressions are evaluated as
specified by the semantics. An actual implementation need not evaluate part of
an expression if it can deduce that its value is not used and that no needed
side effects are produced (including any caused by calling a function or
_accessing a volatile object_ ).

It does not look like this allows an implementation complete freedom in
deciding what constitutes an "access". In fact, I'm pretty certain that
'volatile int i; i;' is required to access i _exactly_ once. (There are plenty
of optimizer bugs in this area, but these are _bugs_.)

(Note that the above has _nothing_ to do with threads and everything with
memory-mapped devices. Perhaps you were thinking of threads? These are not
part of the C standard, though.)

~~~
dfox
(6.7.3.6): What constitutes an access to an object that has volatile-qualified
type is implementation-defined.

That seems to me like giving 'complete freedom in deciding what constitutes an
"access"'. Or almost.

Actually, chapter 4.10 of GCC 4.4 manual documents how is this defined by GCC
and explicitly states, that discarding result of read of volatile object does
not always cause access to such object.

------
kikibobo69
Java defines it in a very useful way. It's identical to an AtomicReference,
but without any test&set semantics. Anything other than that seems pretty
dangerous.

Personally I find the issue with volatile is that it's quite subtle unless
you're looking at the declaration. I tend to use AtomicReference even if I
don't need test&set, unless it's extremely performance critical, but it almost
never is. The inner loop variables don't need to be volatile.

------
Symmetry
From "Nine ways to break your systems code using volatile" at
<http://blog.regehr.org/archives/28>

"You can find various rants, screeds, and diatribes against volatile on Linux
mailing lists and web pages. These are largely correct, but you have to keep
in mind that:

Linux often runs on out-of-order multicores where volatile by itself is nearly
useless. The Linux kernel provides a rich collection of functions for
synchronization and hardware access that, properly used, eliminate almost all
need for volatile in regular kernel code. If you are writing code for an in-
order embedded processor and have little or no infrastructure besides the C
compiler, you may need to lean more heavily on volatile."

------
dkersten
" _It used to have a very specific purpose - to enure memory operations with
external side-effects did not get reordered_ "

Prevent reordering? I thought thats what memory fences are for.

\--

I admit to having a (single) volatile varibale in my C++ codebase, used
similarly to the pseudocode below:

        volatile global bool flag = false; // [1]

        thread1 {
            while (whatever) {
                do stuff
            }
            flag = true;
            thread2.wait();
        }

        thread2 {
            while (!flag) { // [2]
                do stuff
            }
        }

[1] The variable itself is global, because I read someplace that the C/C++
standard does not allow local volatile variables to be passed to other
threads. Logically, this makes sense, if a local goes out of scope before the
second thread is finished with it. In my code this cannot happen, but I still
make it global anyway.

[2] The important part is that this read is very fast unless the flag has been
set (at which point I no longer care about efficiency). I don't mind if this
is unsynchronized - if the loop runs an extra few iterations, that is
perfectly fine, as long as the flag change is seen eventually (realistically,
within a few iterations of the loop). I know that volatile only makes sure the
compiler doesn't cache the value in registers and does not mean that the value
will be synced or flushed or otherwise ensure it is visible by the other
thread. On x86 at least, it will be, eventually.

My logic for using it in this way is as follows:

I do not care about synhronization - if the reader sees a stale value of flag,
that is fine, as long as it sees the real value _at some point in the future_.
I use volatile, because otherwise the compiler could simply cache the flag in
a register completely isolated form the other thread. I also don't mind if the
read is reordered, as long as it is within the loop and the value is used as
the loop temrination condition (from what I read on the Intel site[3], the
above code guarantees this - but the read may be reordered to appear elsewhere
WITHIN the loop instead. This is perfectly fine in my case). I do need the
write to appear AFTER the loop in thread1 and before the wait, however -
again, afaik I don't need to do anything here, or should I put an sfence
before the flag=true to be safe? Since I don't care about performance in the
flag is true case, I don't mind adding memory fences in this case.

I wonder if somebody can let me know if my logic is off here (though it works
on x86 and x86-64 and, accoridng to something I read on the Intel site[3], is
a reasonable approach - however, I may port to ARM at some stage, in which
case I will need to re-evaluate this code). My aim here is that the reader
always reads the flag from the processor cache, so that its fast, but when the
writer sets the flag, the cache is synced over the core interconnect and the
second thread will, at some stage, see the new value.

Is this approach reasonable? Is it safe? I believe it is, but..

[3] [http://software.intel.com/en-us/blogs/2007/11/30/volatile-
al...](http://software.intel.com/en-us/blogs/2007/11/30/volatile-almost-
useless-for-multi-threaded-programming/) Tenth comment down, posted by "spud".

~~~
tedunangst
[1] Neither the C nor C++ standards mention threads at all, so I don't think
they disallow doing anything with them.

[2] volatile was never strictly about memory ordering, but that's definitely
implied. It was really originally for "this variable is really a hardware
doodad. make sure you poke it in exactly the manner the code says to."
reordering writes to a hardware device can be disastrous. The standard of
course, came quite a bit later after the hardware.

~~~
dkersten
[1] I can't for the life of me find where I saw that the standard considers
passing local volatile variables to other threads (I suspect it didn't say
threads, but rather something else under which threads can be implied).

[2] Implied by the original usage of volatile? It certainly isn't implied now
(or at least, people think it is, even though, according to the standard, it
really isn't).

------
redpill27
This article describes how a volatile variable can be useful when dealing with
excess floating-point precision:

[http://blog.jagpdf.org/2009/07/avoiding-excess-floating-
poin...](http://blog.jagpdf.org/2009/07/avoiding-excess-floating-
point_17.html)


How to Deploy .NET Apps to Private PaaS - tophw47
http://www.activestate.com/blog/2012/07/how-deploy-net-apps-stackato-20

======
Pythondj
Stackato v2.0 now supports *nix and .Net applications - here are the release
notes for everything that V2.0 includes
<http://docs.stackato.com/reference/release-notes.html>


Ask HN: I'm a front end dev looking for a back end language. Which one? (No JS) - MarvelousWololo
======
kjksf
I can tell you what I do: backend work for all my projects
([https://blog.kowalczyk.info/software/](https://blog.kowalczyk.info/software/))
is in Go.

Highly recommended.

I wrote a longer explanation at
[https://blog.kowalczyk.info/article/uvw2/thoughts-on-go-
afte...](https://blog.kowalczyk.info/article/uvw2/thoughts-on-go-after-
writing-3-websites.html)

~~~
MarvelousWololo
Jesus I can't believe I'm talking to the author of Sumatra PDF. I love that
software! Thanks for stopping by. I'll definitely read your blog post. If you
don't mind to answer another question, I'm also a bit interested in desktop
development. Would you recommend learn C or C++ for that purpose in 2018? I'm
taking a look at Gtk3 too. Thank you very much!

------
eindiran
I think what you should try out depends on what you want to accomplish and
what language you think is most likely to be useful to you again.

With that said, I would cast my vote with Python 3 and the latest Django. I've
found that if I go with a lighter framework, eventually I just end up writing
out big chunks of the missing functionality myself and I end up with a poor-
man's Django.

~~~
MarvelousWololo
Django is actually quite nice. I like Python 3. I only wish it could have auth
and rest support built in. Having to install apps for that kind of turns me
off. I guess Laravel shines here in this regard.

------
MarvelousWololo
I've been looking into Java and Go. I don't I like Go very much, it looks too
"simplistic" I guess (I don't have much experience with static typed languages
though) also its ecosystem seems too young and I didn't like the way it
manages dependencies and errors. I've heard good things about C# and it looks
cool indeed but I'm afraid I'd have to resort to Windows somewhere down the
line and, I'm sorry, I think Windows us unbearable. What else could I look
into? Is Java really that bad? I'd like to write Rest APIs, GraphQL servers
and stuff with websockets mostly. Also does anyone here have tried that
Micronaut Java web framework? It seems cool but everybody talks about Spring.
Thank you all.

------
nperez
Any of them, unless you have specific goals that may be served best by one
language or another.

For general purpose, I'd suggest writing a hello world app in every backend
language you can think of. See what clicks with you.

~~~
MarvelousWololo
That's a cool idea, I'll try that. Thanks!

------
mindcrime
I suggest that you give Groovy a look, especially with the Grails framework.

~~~
MarvelousWololo
Thanks! Does it still under active development? I thought it was kind of dead
to be honest.

~~~
mindcrime
Huh? The last new release was less than a month ago.
[https://blogs.apache.org/groovy/entry/groovy-2-5-3-released](https://blogs.apache.org/groovy/entry/groovy-2-5-3-released)

~~~
MarvelousWololo
That's great news. Sorry, I didn't know. What about its adoption? Do you see
companies using around your area?

~~~
mindcrime
I don't really pay much attention to what other companies are doing, TBH. So I
really couldn't say. To the extent that the Tiobe index means anything, Groovy
was #28 last time around. [https://www.tiobe.com/tiobe-
index/](https://www.tiobe.com/tiobe-index/)

~~~
MarvelousWololo
I see. That makes sense. What do you particularly like about Groovy?

~~~
zmmmmm
I'll chime in as well: in general it's just the most versatile and practical
language I've ever come across. I can write it almost like Java if I want so I
can do solid engineering with it and it performs almost the same. Then I can
write scripts at the command line that get interpreted and they are more
concise and powerful than shell scripts. Any time I need to play with or
understand a Java API, I can fire up the Groovy REPL and just fool around with
it.

So it's just an extremely useful language to have in my "tool belt", so to
speak.

~~~
MarvelousWololo
Should I start with Grails or is there any other nice web framework I could
try?

~~~
vorg
Grails is on version 3.x but not many people upgraded from version 2.x or are
starting new projects in it, and the Grails 2 plugin ecosystem is dead. I
don't know of any other web framework which uses Apache Groovy for its
scripting. Groovy is mainly used in industry to script Gradle and write glue
code for Java. If you want static typing, best skip Groovy and use Java,
Kotlin, or Scala which were statically typed from the ground up, instead of
having it bolted on in version 2 as did Groovy.

~~~
MarvelousWololo
Thanks for the info. I'm totally ignorant about Java so it might be a dumb
question. But Digital Ocean's 1gb droplets are enough to run some Java Restful
APIs? I heard that Java is really heavy on memory consumption but I know
nothing about it.

------
3KQgt0Cl
Golang.


The FBI’s Massive Facial Recognition Database Raises Concern - ghosh
http://singularityhub.com/2014/04/27/the-fbi-has-a-massive-facial-recognition-database-but-is-it-ready-for-primetime/
======
lifeisstillgood
I feel this is the least worrying database around, because of a the simple
check on its accuracy and the biometric used.

Facial recognition is what we humans are all about - we have surprisingly
strong taboos about covering up this very useful and universal biometric
already and any flaws in the algorithm or software are much much easier to
challenge than DNA tests (I can stand up to a jury all day and say it was not
me, and they will most likely believe a DNA expert. show them a picture of
someone who just looked like me and they will all use millions of years of
evolution to set me free)

Yes it is worrying that any mass databases are being compiled, and yes we must
debate as a civilisation how we are going to mitigate the downsides and
promote the upsides, but this is not a disaster. not like PRISM.

~~~
pessimizer
If the only thing you're worried about concerning mass surveillance is that it
could be inaccurate, I can see why you aren't worried.

~~~
lifeisstillgood
That's a little disingenuous no?

There are many things to be concerned about, but it is worth having a fuller
discussion about the problem.

I think we are all talking about passive surveillance - My views are that mass
passive surveillance has always been with us. We are surveilled by our
neighbours and strangers all day everyday. Until recently that was entirely
based on the facial biometric recogniser "Human Eyeball v1.0".

Generally our neighbours do/did nothing with their metadata collections -
maybe some salacious gossip, occassionally criminal behaviour.

Privacy has till now been the politeness of our neighbours.

However on the Internet everyone is now a neighbour. A Good Thing mostly but
it has implications for that metadata store. PRISM shows what a meta-metadata
store looks like, and history shows us what will be done with it.

It is worth noting that what in civilian circles is called "private" most
governments see as "secret". They are going to freak when we really start
handling Big Data. Even now I would be surprised if the Chinese / Russian
intelligence services have not hoovered up all Facebook and LinkedIn.

Those PhD Students from MIT 10 years ago will be doing some interesting work
for the government now, and thier connections will map the halls of weapons
researchers and government quite well. OpenMapping, satellitte and UAVs, a
flood of data will pierce everyone's privacy.

Anyway, people now are able to monitor others not physically close to them.
Some like NSA are going for total knowledge, others like Tesco or Walmart have
a more narrow focus but deeper focus (I am pretty sure the NSA will not know
my wife is pregnant before I do. Or that Gen. Alexander is really in for it!)

But we have no framework for dealing with this, no laws or even ideas of laws
we want. The idea of Big Data will give us such benefits that "stop progress"
is not a viable response. But what is? Data cannot be labelled. So ...

------
forrestthewoods
"may include as many as 52 million face images by 2015"

Huh? If you've had a drivers license or passport photo taken then it's in a
federal database. Maybe they aren't shared well across all federal
organizations yet but that's only a brief matter of time.

------
chrischen
What about Facebook's massive facial recognition database? Any concern for
that, especially since we voluntarily contribute to it?

~~~
pron
Oh, it's far worse, and there's nothing voluntary about it (just as there's
nothing voluntary about GMail). And even if it were voluntary, Facebook (and
Google, which is far, far worse, IMO) tries not at all to make it clear to the
public how they pay for Facebook's services. The massive spying and data
collection by Google and Facebook is probably the largest , and possibly most
dangerous, surveillance campaign in history. Worst of all, unlike the FBI (or
the NSA), Facebook and Google constantly analyze and use any piece of personal
data they can get their hands on.

~~~
meowface
I don't necessarily disagree, but intent plays a role here too. Google's
intentions and the FBI or NSA's intentions differ quite strongly when they
have your personal information in their system.

~~~
pron
Well, the FBI's intentions are to catch criminals with the information, while
Google's and Facebook's are to sell it for profit.

~~~
gr3yh47
And the FBI NEVER would abuse their power or use their access for other
purposes. Same as the NSA.

~~~
pron
_Of course_ they might. But so would Google and Facebook. And in either case
it doesn't even have to be an order from above, but an action by a single
employee. At least I'd like to hope that the FBI performs more thorough
background checks on its employees than Google or Facebook.


Our startup Body Boss getting street cred with the NFL's Carolina Panthers - D-Train
http://blog.bodybossfitness.com/post/48697659311/hello-carolina-panthers-were-body-boss

======
chiph
Why no individual plan?

Can I tell it what equipment I have available (and the exercises it lets me
do) and have the software suggest workouts?

~~~
D-Train
Right now, we're focused on the B2B market. That is, our target market include
sports teams and organizations. So we're working with several high schools,
colleges, and now an NFL team! We've also got good traction with training
camps and big box retail gyms.

We looked at the consumer-driven apps, and realized that we would rather work
with coaches and players or trainers and clients. So for individuals, we may
go there, but it's not in immediate strategy.

What are your thoughts?

~~~
chiph
I believe that most people quit going to the gym because they get bored.

So if there were an app that takes several factors into consideration¹ and
generates workouts for them, and that would change it up, people would stay
interested and gain fitness.

Which works against the business model of many of the chain gyms -- they
actually want people signed to yearly contracts that then don't show up.

¹ Perhaps it would consider available equipment, desires of the person (some
ratio between speed/endurance/strength/stability), when they last did an
exercise, what their feedback was from previously doing it, what muscle group
it most effectively works, what the opposing muscles are and when they got
worked, and so on.


Ask HN: Keeping track of support requests/emails/tickets - jason_tko

The last discussion on applications to keep track of support requests seems to be around 2 years ago.  I wonder if there have been any new companies or applications that have sprung up since then.
I'm looking for a clean application to keep track of issues and support requests with good reporting capabilities.
What are you using for this?
======
megaduck
My startup is currently developing a new ticket tracking system named Tracker,
and it might be exactly what you're looking for. Tracker's focus is helping
you do email support for external customers, but it also works well for
internal company support.

Tracker is lightweight, fast, and has exceptional search and email
integration. The web interface is quite quick and has some nice features, but
you can also perform most functions (replying to customers, creating tickets,
commenting) straight from your mail client.

We're currently in private beta, but if you're interested you can email me at
dave AT madwombat DOT com, and I'll set you up with an account.

------
jason_tko
I've had <http://tenderapp.com/> recommended to me - anyone with experience
with this app?

~~~
shadow
We are on tender.app hooked up with lighthouse.app It works great. Your
support tickets can be flagged to the lighthouse issue tracker.

------
sumeeta
I’ve heard of people using a shared Gmail account for support tickets and
handling ownership with labels.

~~~
nikz
We do the same thing, with a simple label system ("Follow Up", "Request for
Feature X", "Request for Feature Y") to give us a little more overview
visibility.

I'd certainly recommend this approach, especially if your workflow is well
defined (we answer, then archive - Follow Up and start a ticket in Lighthouse
if it needs to fixed. Unread == unanswered).

Have looked at ZenDesk and Tender, but we feel like they force people to jump
through too many hoops in order to ask a question. For a logged-in user, it
should really just be a "what do you want to ask us?" field, and for a logged
out user just email/question. In my humble opinion, of course. ;)

~~~
imagetic
That's something we definitely need to market better in Tender then or talk
with user about. I hope that's not the under understand most people have. One
of our main focuses was to allow for anonymous submissions of issues and
implement a straight forward email option so people do not have to register
for accounts. Implementing a Single Sign On system was our very first priority
to avoid all need when coming from another web applications, so you can go
straight to the form and ask what you need to without any hassle.

------
johns
I've been using Zendesk at the company I work at for about a month and at
first I didn't like it, but after getting used to it, it's not that bad. We
don't use the public forums however, so I can't speak to that. But reply via
email, iPhone app, and the macros are all nice touches.

~~~
chrisbolt
Switched over to Zendesk a few months back. Our support people love it, and
their API is a pleasure to work with. Best integration I've done in a long
time.

~~~
sachitgupta
Haven't used it myself, but a company I interviewed with mentioned using
Zendesk too. It's gaining quiet a following!

------
jrnkntl
<http://getsatisfaction.com/> or <http://lighthouseapp.com/>

~~~
jason_tko
Thanks for your comment.

I'm talking more about when users register an issue about your
startup/site/service that you need to track and resolve. Lighthouse seems to
be more about internal project management, and I'm confused about how
Getsatisfaction relates to this?

~~~
imagetic
GetSat and Lighthouse are two totally different things. While Lighthouse has
been used for support in the past, it's a privatized ticket tracker and not a
support system.

We built Tender out of what we learned from dealing with Lighthouse support,
which is why we added some pretty cool Lighthouse integration.

------
blados
Trellis Helpdesk - <http://www.accord5.com/trellis> at the moment it does not
have a good reporting, but v2 is going to be released soon (aplha available
now at <http://www.accord5.com/trellis_desk_v2_alpha_1.zip>)


Fun human computation games to produce high quality language translations. - amichail

Although automated language translations are often sufficient to get a rough understanding, it would be better to use high quality translations to localize your site/app.
So the question is whether you can get high quality translations as the output of fun human computation games.
As an example, one can have a two-player ESP Game-like service where each player is shown a web page and a specific sentence to translate.  The game would check that all words used are indeed words from the target language.  The score obtained would be based on the similarity between the translations submitted by the two players.
A variant on this idea only requires players to know the target language.  The idea is to use Google Translate say as a first step to produce a rough translation.  The two players would be shown an automatically translated web page with a sentence whose translation is to be improved.  The game would check that each player submits a translation that is sufficiently different from what Google Translate produced.  Again, scoring would be based on the similarity of the translations submitted by the players.
======
wallflower
The game method sounds like a shady way. If you want to enlist the help of
multi-lingual users, why not reach out to them?

"But while MySpace plans and launches its international sites in a more
traditional way -- setting up local offices, getting entrenched in the culture
and then launching, -- Facebook is building out its foreign language versions
with the help of its vast and committed user base. Instead of setting up an
office and a staff before launching in new countries, Facebook is putting its
audience to work with an online Facebook application that allows translation
by the Facebook community. To participate, Facebook users add a Translation
Application to their account that they can use to translate, review and vote
on translations in their language. Once the language translations are
completed and quality has been verified by the community, the Facebook site in
the new language is launched for all Facebook users.

Facebook is currently working on 22 more language translations, and many
hundreds of users have left suggestions about other languages that they would
like to see translated -- and have volunteered to help with the work."

[http://www.thestandard.com/news/2008/04/16/facebook-vs-
myspa...](http://www.thestandard.com/news/2008/04/16/facebook-vs-myspace-
battle-global-social-network-dominance)


Why Geese Fly In A V Formation - zackattack
http://www.myuniversalfacts.com/2005/11/why-do-geese-fly-in-v-formation.html
======
jacquesm
Because it puts each bird in the most favorable position with regards to the
slipstream of the bird in front of it.

That's also why geese will 'rotate the leader'. So everybody gets to rest a
bit.

Other birds (such as the Albatros) that fly long distance on their own use the
ground effect for much the same reason, to conserve as much energy on long
distance flights as possible.


300 million year old fossilized forest discovered under coal mine in China - yogrish
http://www.zmescience.com/research/studies/300-million-year-old-fossil-forest-china-906854/

======
nhebb
It's too bad they just show a reconstructed image of what the forest looked
like. I would really like to see what the fossilized remains of an _"almost
perfectly preserved 298 million year-old forest"_ looks like rather than an
artist's rendering.

~~~
jws
The journal article supporting information has pictures.

[http://www.pnas.org/content/suppl/2012/02/15/1115076109.DCSu...](http://www.pnas.org/content/suppl/2012/02/15/1115076109.DCSupplemental/pnas.201115076SI.pdf)

… don't despair at the little line chart, scroll down.

~~~
libraryatnight
When they described it as being like Pompeii my imagination might have gotten
the best of me and expected too much :) Very cool photos nonetheless

------
Mithrandir
Here's the direct link to the original article in case you're interested:
<http://www.pnas.org/content/early/2012/02/14/1115076109>

------
itsmequinn
I guess researchers dubbed it, "the whole of the article from line 10, word 7
through the end?

~~~
Shanewho
Ha, I know.. I couldn't tell if it is "Pompeii" or "Pompeii of the Permian
period". I hate that professional articles have so many typos in them these
days.

------
shingen
300 million years...

now that's an impressive timeline


MySpace replaces all server hard disks with flash drives - Flemlord
http://www.computerworld.com/s/article/9139280/MySpace_replaces_all_server_hard_disks_with_flash_drives
======
seiji
The article is a blatant advertisement. Let me counter-advertise with my
experiences here.

We did evaluations of a Fusion-io ioDrive card and a Texas Memory Systems
RamSan card [1] recently. The ioDrive had strange performance characteristics
(but nicely designed packaging). We ended up going with a few RamSan cards
(though, they have much uglier packaging).

We have a few high throughput MySQL instances that needed to perform better.
The database in question is only a few hundred gigabytes in size, so it's a
perfect fit for the current generation of server flash cards.

Our path for improving improving performance went:

      - Started off with 32GB RAM and RAID-10 on SAS disks.
          - iowait sat between 10% and 15% constantly.
      - Moved up to 64GB RAM.
          - iowait cut in half.
      - Installed RamSan card and moved mysql with all databases to it.
          - iowait became negligible.

Now the server sits there with a few hundred gigabytes of flash, 64GB RAM, and
it looks completely idle on usage graphs, but it's serving data faster than
ever.

They are nice devices if you can afford them (and tolerate their quirks like
needing to be completely formatted during firmware upgrades).

[1]: <http://www.ramsan.com/products/ramsan-20.htm>

~~~
angusdavis
Curious, did you get these performance gains with off-the-shelf Mysql+myisam,
or did you consider YC company rethinkdb (<http://www.rethinkdb.com/>)?

~~~
seiji
It's MySQL with the Percona patches using InnoDB (not XtraDB yet).

I've looked into rethinkdb, but it's not quite yet ready for a bet-the-
company-on-it install. We didn't order any extra $10k+ flash cards just to
play around with.

The RamSan flash cards took a while to get ahold of too (the government (NSA
if I recall correctly) buys them by the thousands).

~~~
pmorici
Is this worth the cost premium? It seems like you could get similar
performance using 4 standard SATA SSD drives in a stripped RAID and the cost
would be a bit less than 2k.

------
timdorr
This is the most interesting bit:

      MySpace's new servers also replaced its high-performance
      hosts that held data in large RAM cache modules, a costly
      method MySpace had been using in order to achieve the
      necessary throughput to serve its relational databases.
      MySpace said its new servers using the NAND flash memory
      modules give it the same performance as its older RAM
      servers.

Given Facebook's dependence on memcached (look at some of the work they've
done at optimizing the Linux network stack) I wonder if this is something
they're considering. This is a pretty big leap in terms of performance. I just
wish the cost wasn't so insane.

And the longevity of these drives is a concern. What happens when you run out
of good bits in the drive?

~~~
eru
It's there some kind S.M.A.R.T. check with those SSDs like their is with hard
drives, to give you a clue when the thing will fail?

~~~
Hoff
FWIW and per Google and CMU retrospectives, the vendor-published MTBF rates
appear very optimistic, about 36% of large HDD populations failed with no
SMART data logged, and only about half of impending HDD failures were
reasonably predicted by SMART. I'd expect the predictive values of various of
the SMART data points to be (very) different with SSD, too.

Until we get a population of these SSDs in the field and better studied, then
we'll have a better idea of the failure rates, and whether SMART needs to be
considered or reconsidered.

------
easp
James Hamilton referenced this in a blog post today. He was pretty skeptical.
He's been a proponent of SSDs in some applications, but he can't see how their
cost can be justified yet on the basis of power efficiency alone.

The power efficiency + higher overall iops justify the up front cost in
applications where there is a high ratio of iops/GB stored, but most data is
not accessed frequently, and Im sure that social nets are no exception. It
totally makes sense though to reduce the need for RAM caches, since it is both
cheaper per GB than RAM, and draws less power.

------
gojomo
I'm surprised no virtual hosters are yet offering SSDs (as far as I know).

I suppose there's some risk one customer could burn out the SSD write-cycles
then discard the node. Solution: charge for writes.

~~~
sadiq
SoftLayer have Intel SSDs.

~~~
gojomo
I only see it as an option on their dedicated servers -- not the CloudLayer
computing instances. Am I missing something?

------
dryicerx
Conventional Drives or Solid State Drives, it's still the Internet's ghetto.

~~~
mahmud
_Conventional Drives or Solid State Drives, it's still the Internet's ghetto._

Here is the racial implication of that statement :-)

[http://www.cnn.com/2009/TECH/science/10/13/social.networking...](http://www.cnn.com/2009/TECH/science/10/13/social.networking.class/index.html)


Thoughts on pushing for equality: Shoving Matches - Mz
http://www.novemberwest.com/blog/2011/11/30/shoving-matches/

======
Mz
I happen to be the author. That may not be obvious but it is also not a
secret. I submitted a similarly themed piece a couple of days ago as my
contribution to the ongoing HN discussion of issues like gender equality. I
thought a few folks might find this piece of interest as well.

Thanks.


HTC Facing Possible Ban In US For Apple Patent Infringement - techiediy
http://www.techieinsider.com/news/13057
======
Mediocrity
This is likely one of those articles I'm going to print out and show to
people/keep in my drawer.

The sheer amount of patent suits lobbied against android distributors is de
facto proof (In my opinion) that they are inherently frivolous.


Ex-NSA Hacker Finds a Way to Hack Mac Users via Microsoft Office - SQL2219
https://www.vice.com/en_us/article/jgxamy/hacker-finds-a-way-to-hack-mac-users-via-microsoft-office
======
kryogen1c
apple, microsoft, hacking, and the nsa all in the same headline. this editor
deserves a raise.

------
mikece
I don't know about everyone else but it's the _first_ part of that title that
catches my interest. "Executed a hack via MS Office -- yeah, great but tell me
more about the role of 'NSA Hacker'..." Notwithstanding the "What? No way..."
revelations in Edward Snowden's book about the United States' SIGINT-via-
internet abilities I suspect Snowden didn't even know the half of it.

~~~
save_ferris
> I suspect Snowden didn't even know the half of it.

Obviously, we’ll never know exactly how much he knew relative to the entire
scope of the intelligence community, but he pointed out multiple times that he
had pretty broad access to a range of tools and KBs based on his work
integrating various tools for the government.

He’s said himself that he doesn’t know everything, but given his ascent in the
government contracting world due to his technical skill prior to his
departure, I think it’s fair to take him at his word when he said that there
wasn’t a whole lot he didn’t have access to in terms of IT systems and
databases.

------
hollander
So if I create an test.slk file on my desktop, then rightclick > open with,
and select an app like Sublime (to be sure no other office apps like
LibreOffice), to open all files like this in the future by default, will that
solve this problem?

------
chris_at_lum
Patrick Wardle is a well-known security researcher focused on macOS, and
founder of Objective-See which provides free (as in beer)"simple, yet
effective OS X security tools."


Happy 25th Birthday ThinkPad - cenanozen
http://news.lenovo.com/news-releases/happy-25th-birthday-thinkpad.htm?ww:lenovosocial:nsmpz6
======
vkuruthers
Is there any less expensive way to get the original Thinkpad style keyboard on
a more modern motherboard?

I really like this retro machine they're releasing but it's just too costly
for me.


No Exits. Liquidity Dries Up Even More For VC-Backed Startups In Third Quarter - jasonlbaptiste
http://www.techcrunch.com/2008/10/02/no-exits-liquidity-dries-up-even-more-for-vc-backed-startups-in-third-quarter/
======
spolsky
Whine whine. I have an idea. Why not make a product to sell to consumers,
instead of making shares to sell to the public?

~~~
alecco
Well said.

How about downscaling the size. Sites like Twitter could be done by one person
and a bit for subcontracting. Sites like Facebook by a team of 10 to 15.

Too much money and too much megabuck sponsored hype. Simple micro startups are
still left out even though they are more than viable.

~~~
colinplamondon
There seems to be an almost pathological bias against profitability with a lot
of startups.

~~~
sown
So I heard that some think that is because for a long while the R/D effort was
outsourced to other companies, away from larger ones. I dunno if that is the
case but in the company I worked for got acquired and did some pretty serious
R/D. It could have been profitable but acquisition was obviously the easier
way out so the investors took it.

I'm sure something like Twitter is useful but only to a large company,
perhaps? I dunno.

------
jamongkad
Good! now startups will be forced to restructure their business and actually
find a way to make real revenue.


Email Storm - polm23
https://en.wikipedia.org/wiki/Email_storm
======
chatmasta
We had a few of these in college. My favorite was when someone replied "you
know, you can just press M in gmail to mute the conversation." What followed
were hundreds of messages saying just, "M". College kids really are the
greatest trolls.

------
ilkkao
Saw these storms couple times at Nokia years ago. By far the funniest replies
were those that explained correctly what's going on and then concluded that
their message should be the end of the thread.

What they didn't realize was that the email server was overloaded and that
their message would be delivered several hours later together with dozen
similar messages from the other people.

The next round of people then complained why these people are not stopping.

------
_nalply
I saw an email storm on a mailing list for lawyers. Due to a misconfiguration
out of office notices weren't suppressed and forwarded to the mailing list.
Soon several lawyers who were taking off were contributing to the storm. I
immediately saw the self-reinforcing avalanche and told the operator to shut
down the mailing list server.

------
stygiansonic
I think almost everyone at a big company has experienced at least one of
these. Big email lists should typically have only a set of approved senders.

~~~
protomyth
Its actually fairly easy to setup a decent mailing list without having to have
approved senders, but Exchange and its built in functionality is probably the
root cause of a lot of these.

The ones I have setup are pretty easy to stop since we do some basic checking
of the e-mails sent anyway (e.g. attachment too large).

------
Powerofmene
When I was with the government if you were on workgroups or had to attend
meetings, you could count on 30-40 reply all emails when just trying to
schedule meetings or coordinate calendars. For me I received easily 175-225
emails on any given week that should not have included me because of people
replying to everyone rather than the one person who needed their info. It
drove me crazy and was such a time waster.

------
angelofthe0dd
I was hoping to see something in the Wiki article about "Amazon Wallet".

~~~
lorrin
I had the same thought! Anyone recall the details well enough to add an entry?
IIRC, it knocked out the Exchange servers entirely for a while.

~~~
angelofthe0dd
I met the developer who was responsible when I was employed by Amazon. He was
trying to reply to an email, but I believe it was a "reply all" (if I recall
the details of the story correctly) and the list was massive. Meanwhile,
people on that same massive list were also doing a "reply all" to submit their
feedback or reply that the email didn't apply to them. Massive email storm
resulted. He didn't give all the details but he was ear-to-ear grinning as he
told us the story.

------
asah
Edited the wikipedia page to mention Gmail mute, which solves this in
practice.

------
porjo
Wouldn't a simple mitigation be to limit the number of recipients allowed in
the 'to' and 'cc' fields? 'Bcc' can be used for the mega mailouts. That way, a
user hitting reply-all sends to a much more limited set of addresses.

------
mantalk
"The resulting storm of 'unsubscribe', 'me-too' requests, sarcastic facepalm
images and recipes for broccoli casserole resulted in (by the time the list
was closed) over 4 million emails and generating over 375GB of network
traffic."

------
DKnoll
Why couldn't the sysadmins just kill it with a Transport Rule (silently delete
all messages containing the original subject) or temporarily reject messages
to the DL? Takes a couple mins.

~~~
eXpl0it3r
That's most likely what happens after the sysadmins get notified of the issue.
Take the NHS incident as an example. Within 1h and 15min the generated emails
were around 500 million. A one hour response time is still relatively quick.

The more important question is, why email systems don't have default rules to
prevent such an email storm?

When emails go to tens of thousands of people, a system should probably only
allow it with special credentials or at least ensure that it's a read-only
mailing list.

Other measurements would be to detect growing email chains and block emails
when the chain has reached some threshold.

~~~
DKnoll
True enough, but it is fairly easy to restrict use of distribution groups in
Exchange, which I would bet most of these orgs use.

I'd argue 1hr response is pretty slow for the NHS, since they require 24/7
support availability of even their vendors. I imagine they responded pretty
quickly but nobody had a plan in place for situations like this and a large
public sector organisation isn't a place conducive to one person taking charge
and fixing the problem immediately.

------
starbuxman
This is similar to a group text in iOS/iPhone. It drives me crazy!

~~~
ihuman
If everyone is using iMessage, you can leave the group [0]. Unfortunately, you
can't leave if someone is using SMS.

[0] [http://osxdaily.com/2014/09/23/leave-group-message-chat-
ios/](http://osxdaily.com/2014/09/23/leave-group-message-chat-ios/)

~~~
protomyth
Yep, its also a pain when you are waiting for a legitimate needed text and
cannot leave the group. I guess you can mute a group but I think its named
something funny like "Hide Alerts". It is a tad bit beyond the average user
because of a poor UI.

A friend of mine was in a business meeting on the same day UND announced its
new logo and his phone went crazy. The person he was meeting with asked if he
should answer it and he said "no, its a lot of bitter, bitter people and UND
has no taste.". He did get the contract though.

------
nancyp
Watch out for those out of office notifications replying to group messages and
causing flood of out of office replies.

------
tomphoolery
Those examples are definitely cringe-worthy. I wouldn't want to be any of
those people!

------
_Codemonkeyism
Remember one in a company with 35k employees.


Ask HN: What's with the C++17 Special Math? - cjhanks
Looking through CPPreference I found the `special_math` targeted for C++17 [1].  Most of these functions look very specialized and I would expect there to be fairly non-generic optimized implementations.<p>What makes these functions generally useful enough for inclusion into the STL?<p>[1] http://en.cppreference.com/w/cpp/numeric/special_math
======
cratermoon
Machine Learning


DeepPCB: Pure AI-Powered, Cloud-Native Printed Circuit Board Routing - chakerb
https://deeppcb.ai/
======
gorbachev
I exhausted the 3 project limit trying to see how it would route open source
mechanical keyboard PCBs.

Every single one failed with an error.

The first one failed with an error that didn't specify the reason, the second
one because it had more than 200 wires, though I wonder how that's possible on
a 3x3 macropad PCB, and the final one failed with "Sorry, we do not support
non 45° rotation for this beta version".

The errored projects count towards the limit of 3 projects you can create.

Doesn't seem to be working all too well.

~~~
BubRoss
Yeah, but that failure was the result of advanced pure AI cloud native deep
learning neural networks. The future is now. In a few more years you won't
even be able to tell if a person gave up and quit a trivial task or if it was
just a sophisticated machine.

~~~
panpanna
> In a few more years you won't even be able to tell if a person gave up and
> quit a trivial task or if it was just a sophisticated machine.

We have that already, we call it GAN.

------
ultrasounder
Don’t mean to undermine the effort but “ what is the problem being solved
here”? I have used Altiums auto router and it’s like Tesla AP version 1. Also
like someone mentioned below, the hardest part of PCB routing is Placement.
There are Tons of variables that goes into consideration for getting placement
correct. Routing follows placement and routing can’t fix placement problems.
If cost of routing is what the OP is after then they are mistaken as you could
get a 12 layer PCB routed with analog, mixed and high speed DDR and RF within
a week by an army of PCB designers in Taiwan and PRC.checkout Palpilot if you
need references.

~~~
raxxorrax
> within a week by an army of PCB designers in Taiwan and PRC.

You could also (ab)use electrical engineering students, might take a bit
longer though.

But routing has indeed become very cheap. I still could see this service as
useful, especially for the amateur prototype market. There are a lot of
software devs that immediately die if they come in contact with electricity in
any form.

But they might still need some hardware. And maybe they could offer some
templates where you can just add the chips you need right now.

~~~
unlinked_dll
> You could also (ab)use electrical engineering students, might take a bit
> longer though.

It would take longer to train them, PCB design isn't taught in much depth to
undergrads at least in the US.

------
metafex
That's human powered for sure. Routing isn't the hardest problem, everything
is quick once all the components are placed where they belong. E.g. TopoR
already does quite a good job at the routing part.

But if you only take a schematic, and the design is sufficiently complex, it's
already difficult if you hand it to another engineer who's not too familiar
with what is being done, let alone a machine learning model.

~~~
gitgud
It also states " _We harness the power of advanced AI and deliver results in
less than 24 hours..._ ", which is a red flag...

~~~
Fordec
Agreed, Altium's autorouter takes, what, 10 seconds?

24 hours? That's an East Asian subcontractor.

------
msds
I guess I don't spend enough time laying out tedious-but-straightforwards PCBs
to appreciate this. Almost everything I do has some important layout
considerations like "this loop inductance should be tiny" or "this section
needs guard rings" etc. Also, placing components is non-trivial, if you're
doing anything dense, fast, or sensitive. I find that's like 90% of layout
work: guess where the components should go, try to route the tricky bits, move
the components around a bit, route again, etc...

~~~
leoedin
This is the part that all the autorouters seem to miss. A board design may be
represented in the computer by a schematic, but in reality it's a schematic +
a huge amount of engineer knowledge. The person laying out the PCB needs to be
able to look at the schematic and know that the switching regulator has very
precise layout requirements, but that status LED can be at the end of a long
trace.

That information simply isn't captured in current schematic software. Until it
is I can't see autorouters being effective.

I can see a world where every schematic includes simulation models, and the
autorouter uses simulation data to know exactly what frequencies are moving
down each net and in each location. That requires detailed spice models of
every component on your circuit though - so it probably wouldn't save the
designer any time anyway as they're just doing different work. I'm not even
sure how you'd simulate the signals coming out of a microcontroller - how does
the autorouter know that one PWM IO is producing a 500kHz clock into a high
current switch and the other PWM IO is producing a fixed 3.3V?

So then maybe you need to incorporate not only simulation models, but your
actual CPU code. Which then means you need high quality microcontroller and
FPGA emulators. There's a new problem!

There's probably a middle ground - a designer could annotate each net with a
waveform which would be fed into the spice simulation - but even then we're
talking significantly more work than just laying it out yourself.

~~~
sitkack
What you have outlined is a combination of feedback directed optimization,
sensitivity analysis, iteration to a fixed point, cosimulation and
configuration spaces.

[https://en.wikipedia.org/wiki/Profile-
guided_optimization](https://en.wikipedia.org/wiki/Profile-
guided_optimization)

[https://en.wikipedia.org/wiki/Sensitivity_analysis](https://en.wikipedia.org/wiki/Sensitivity_analysis)

[https://en.wikipedia.org/wiki/Fixed-
point_iteration](https://en.wikipedia.org/wiki/Fixed-point_iteration)

[https://en.wikipedia.org/wiki/Co-
simulation](https://en.wikipedia.org/wiki/Co-simulation)

[https://en.wikipedia.org/wiki/Configuration_space_(physics)](https://en.wikipedia.org/wiki/Configuration_space_\(physics\))

------
etaioinshrdlu
It looks like a mistake to target KiCad. Pros generally use Altium.

2 layers is super limiting!

24 hour turnaround is actually quite slow... I would bet they have a human in
the loop.

~~~
DivisionSol
Just want to counter this sentiment and say I love the fact they are targeting
KiCad. A good way to incentivize the free, open source tool. Most hobbyists
don't need more than 2 layers, and that seems like something that can be
eventually expanded in the future.

24 hours, however, is a little bit long.

It would be nice to see exactly what they are offering before uploading a
file, right on the front page. Some components absolutely need to be in a
fixed position, some can be moved around... Some have RF requirements... Does
it minimize size? Does it brute-force the traces?

~~~
new299
From what I can tell, you need to position all the components and then it
routes between them...

~~~
DivisionSol
That's a shame... There is a bit of fun figuring out routing, but, I don't
think that is an opinion that applies to most.

~~~
ComputerGuru
It’s not about whether or not there are people that enjoy it; it’s the fact
that the market they are serving doesn’t exist (people that don’t enjoy or
don’t want to route themselves but have already placed the components
correctly).

------
hthtegr
Not terribly positive comments here, but I think people are missing the point.
This is an unsolved problem, or at least a problem not solved well. Any
efforts in this space should be encouraged. I'm not sure we can trust the main
vendors to innovate, and starting off with Kicad makes 100% sense to me at
this stage.

If this is the first rung of the ladder and it's all up from here, good luck -
I'm sure we all hope you nail it.

A good comment here about placement - I hope that this approach can grow to
adjust placement to some degree, even if not complete placement control.

~~~
wanderingjew
> This is an unsolved problem...

Yes, this is the point. It's NP-Hard. If you solve this problem, you can make
far, far more money doing something besides routing mechanical keyboards and
Internet of Things sensor cruft.

Autorouters have been in development for the last fifty years, starting with
wire-wrap machines at Digital, and going on to the work of very, very smart
people at Altium and Autodesk. The smartest people in their field have been
working on autorouters for decades, and this company wants to solve it with
'the cloud' and 'AI'. Sure, buddy.

150 pairs and 2 layers is abysmally limited for anything but the lowliest
hobbyist (read: poorly designed) boards, and there are no examples whatsoever
of what this product produces. Like, really, great job for producing a demo to
show to investors but you might also want to _demonstrate_ your demo.

Oh, and if you're using machine learning on PCB design, that means you need to
train your models somehow. That means your training data is absolute crap,
because most designs for Open Source hardware are objectively crap. You would
be better off paying someone in China $40 to lay out your board, which would
also have a 24-hour turnaround. Which brings me to my next point...

~~~
gaze
I just don't understand how deep learning is amenable to this problem. It's
just a straight up optimization problem. How is deep learning appropriate?

~~~
IshKebab
I think it is probably appropriate. Chess and go are just "straight up
optimization problems", but they're too difficult for traditional optimisation
algorithms to work. You need something to do some fast pattern recognition to
cut down on the search space. This is similar.

I expect if you search the literature you'll find a ton of work on this.

------
yitchelle
It is interesting that on the front page, they show a SMT pick and place
machine. It only has a small tangible connection to auto routing. It would
have been much better if there is a short video showing the routing in action.

------
_pmf_
Layouters hate auto routers.

------
kbeguir
Hi everyone, Karim the Co-founder & CEO of InstaDeep here, first thank you for
the interest and comments we did not expect we would appear in HN so quickly
:) We’ve reviewed carefully the different points made, comments below:

“This is an unsolved problem… Yes, this is the point. It's NP-Hard”: "We
harness the power of advanced AI and deliver results in less than 24
hours...", which is a red flag” InstaDeep has built credibility in AI circles
by innovating in Machine Learning and Reinforcement Learning (RL) specifically
on how to find good solutions to NP-Hard problems with AI. For example, you
can check our R2 paper
([https://arxiv.org/abs/1807.01672](https://arxiv.org/abs/1807.01672)) about
AI for combinatorial optimization which was accepted at the NeurIPS 2018 in
the Deep RL workshop. More recently we’ve just published joint AI-research in
RL with Google DeepMind that earned a top 2% global ranking at NeurIPS 2019
([https://arxiv.org/abs/1905.12941](https://arxiv.org/abs/1905.12941)). We
also have specific domain expertise in Hardware: some of our team members have
worked for more than 15 years in this field in companies such as STM, NXP,
Dialog, etc. We believe it’s an exciting time to be working on PCB Routing, an
NP-Hard problem.

“ I would bet they have a human in the loop”: No our system is fully automated
(which is why it’s a first) so bear with us as we are in beta :) Automation is
possible because we use RL, which is very useful for decision-making problems
like PCB Routing. At InstaDeep, we deploy RL systems in the real world and
work closely with hardware partners such as Nvidia (we’ve recently been
upgraded to preferred partner) and Intel (we’re part of the AI Builder
Program). In our opinion, having no-human in the loop is critical to
accelerate PCB development cycles, and that’s a key feature of DeepPCB.

“Shitty auto routers have existed for 25 years, at least.”: that’s the whole
point, autorouters don’t get the job done properly, which is why many boards
are still done manually. It makes sense that AI could improve things here.

“the hardest part of PCB routing is Placement”: totally agree here, and our
goal once DeepPCB routing is out of beta, is to tackle placement. Routing is
an important first step, but we don’t plan to stop there. In our livestream
([https://www.youtube.com/watch?v=Ea5i-l8YKQo](https://www.youtube.com/watch?v=Ea5i-l8YKQo))
a few days ago we clearly mentioned that Placement is our key goal for next
year.

“I exhausted the 3 project limit trying to see how it would route”: we hear
you and have decided to increase the limit to 4 credits per week. We’ve also
regenerated the credits for everyone already registered! We will periodically
review credits based on demand to accommodate as many users as possible. If
you would like more credits please contact us!

On a final note, keep in mind we’re in early beta and our goal is to hear from
you to iterate and improve the product better. Things might break from time to
time and we’ll certainly make mistakes but what matters to us is to keep
working hard and make progress on this exciting problem. We believe it’s the
combination of Hardware domain expertise and advanced AI know-how that yields
strong results. If you agree, don’t hesitate to reach out at
support@deeppcb.ai we’d love to hear from you!

------
madengr
It will be interesting to see how this handles signal and power integrity.
What design rules is it actually following? If it’s just tossing down routes,
AI is not needed for that. Shitty auto routers have existed for 25 years, at
least.

~~~
dboreham
I was reading comments here musing that it must be 30 years since I last
routed PCBs on a daily basis: auto routers were useless back then and it looks
like not much has changed. Not too surprising when you consider how hard a
problem it is. Anyone else have the experience of waking up in the middle of
the night with the solution for how to get "that last trace" through?


The Guardian launches open API for all content - but they still control the ads - zen53
http://uk.techcrunch.com/2009/03/10/the-guardian-launches-open-api-for-all-content-but-they-still-control-the-ads/
======
willphipps
I've been using webmynd recently, hopefully this means it can include guardian
content now. Cool if it does.


Windows 10 S is crippleware - CrankyBear
http://www.computerworld.com/article/3197446/microsoft-windows/windows-10-s-is-crippleware.html
======
ungzd
They are dissatisfied by OS that can run only limited set of programs so they
recommend OS that can run only one program — Chrome browser. Where's logic in
that?

Another 'gadget press' article.

~~~
CrankyBear
They're also not happy that Windows 10 S is a subset of Windows 10.