Kanban – The Secret Engineer Killer - bdehaaff
http://blog.aha.io/index.php/kanban-the-secret-engineer-killer/
======
raisinbread
If you just read the subtitles, I'd almost think your article was a piece in
_favor_ of Kanban.

Engineers aren't assembly workers: so why do other methodologies seem to be so
prescriptive on what can be accomplished in a given time frame? New problems
arise, priorities shift, and unexpected news arrives. I appreciate the
flexibility of a pull-type system because it lets me transparently show what
I'm working on.

I've really hated telling people no or watching a manager struggle to change
up something we really need just because it doesn't fit in the right shape
time box or might affect the current sprint's plans.

You can't trust yourself: I always ended up hating sprint planning meetings
where "points" are a constant source of conflict between stakeholders and
estimates are fantastical. These sort of meetings just allow the quality knob
to turn down while scope and schedule remain fixed. Having an entire team
minimizes estimates problems, but for the effort involved I'm not sure the
gains are worth it.

Also, I think you may have inadvertently taken Anderson's quote out of context
as well—Kanban isn't a way to run software. It's merely a way to expose your
current process so you can improve it. Kanban is something that sits on top
and allows you to identify bottlenecks, be realistic about results (instead of
estimates) and provide immediate transparency into what you're working on. It
doesn't specifically prescribe what the steps are.

~~~
bdehaaff
Thanks for the quality comments. I want to pick up the last one in particular
and respond. I think that while you appreciate that Kanban is not a "way to
run software" the folks who I have spoken with do not understand that. They
consider it to be a leaner and more pure form of "agile." So, they do not use
it to improve an existing dev methodology, rather they think it is one -- and
there is the crux of the problem.

~~~
raisinbread
I should say I totally agree with one sentiment from the original post: _don
't blindly pick up Kanban as a magical solution for your problems!_

If your underlying process (or lack of process) sucks, then you'll still be in
trouble. Fix your process first.

------
bhattisatish
I am a fan of Kanban, so whatever I say will be through the rose tinted
glasses of a fan. There maybe various reasons why Kanban has failed for many
companies. I haven't worked in those teams so I have no way to say is it
because of Kanban or is it because of management misunderstanding kanban.

From your article, the main reason touted is that the Marketing loses it's
way. Which to me sounds strange! In fact I have seen it the otherways. We
effectively delink marketing cadence from engineering cadence! Thus resulting
in derisking the whole big bang releases.

For e.g. Marketing decides that they are going to make a big marketing push on
a conference or a tradeshow. So the PM come up with a list of features they
will showcase for the given event. (say 10 features are decided upon). The
engineering team works on these features as a que. Releasing each of these as
and when they are done. But do note an engineering release to production does
not mean a marketing release. This allows the PM to experiment on features,
build up case studies, etc ... for these features.

And as the marketing releases dates come closer, everybody knows that we
always have a working copy with only the pending items in the que. This
results in a high confidence level within the marketing / engineering on what
is being touted about. There are no last minute scramble to get a working
system. etc ... The most valuable feature was heavily tested and used by
everyone before the big bang marketing release.

It also allows the PM to make A/B experiments before the actual marketing
push. Thus adding another confidence layer to the whole process.

In a worst case scenario the least valuable features never get released for
the marketing push.

I see this as an effective way to derisk the whole marketing push and reduce
their dependency on the engineering team to deliver stuff when they said they
would.

~~~
snorkel
Unfortunately not all of us are blessed to work with well organized
stakeholders who are able to plan ahead rather than wait until the last minute
to request whatever they need from engineering. Agile only works when the
entire organization abides by its rules, sure engineering teams can train
their stakeholders to some degree but upper management can just overule the
process and insist engineering should be like a service desk that responds to
whatever is needed today. Sucks, but it's a reality in many workplaces.

~~~
bhattisatish
I agree. That's the reason I love Kanban. It allows us to capture metrics on
what is being done, how long it took and where are we spending most of our
time. This numbers in turn allow us to push the story to management on what
they are doing wrong.

For e.g. We worked on a team where Sales made a feature request (1 day, PM and
design team worked on it and released it to engineering (5 weeks) and
engineering released it to sandbox (2 weeks), qa tested it and released it to
production (1 week).

Guess where the bottleneck is? The whole cadence for the feature was 8 weeks.
Obviously Sales where jumping on us for not getting it done on time. This way
of looking at the whole board, allowed us to identify a bottleneck and push
for changes on how the whole company operates. If you kanban a board only for
engineering then you lose the big picture, How is the system as a whole
operating.

------
jacques_chester
The 95%-of-diets-fail number comes from a single study in an obesity clinic
performed in 1959. Followup studies, also at obesity clinics, found comparably
high rates of recidivism.

But when you take the most pathological cases of obesity in a time before
obesity was the norm, unsurprisingly those cases are ... _pathological_. There
is a _pathology_.

These aren't normal people who grew overweight under conditions of stunning
caloric abundance.

So let's stop quoting this statistic because the sample bias is kindly
_stupidly important_ to its interpretation.

~~~
bdehaaff
Thanks for the comment. I actually spent a considerably amount of time looking
for a meaningful reference. I found the Popkess-Vawter 1998 reference, but
could not find the original text. Do you have a better number for "failure" or
reference that I could use? I would be happy to update the post.

~~~
jacques_chester
Hard to say. Either you rely on clinical studies, which give you
pathologically-skewed sample bias, or you use the National Weight Control
Registry, which will be skewed to people wanting to report successful weight
control.

~~~
bdehaaff
Thanks. I am not an expert in this area (diet success data) and was simply
trying to use an analogy. I guess I will leave it as is. I am not sure what
else to do -- it seems that leaving it with no reference would be worse.

~~~
jacques_chester
Well at least you can join the noble ranks of folk whose writing was
tangentially nitpicked in the very first HN comment.

~~~
bdehaaff
Happens every time. I have learned to expect it. It does make me spend a
little more time though thinking through the counter arguments that are likely
to be fired like spears.

~~~
jacques_chester
Comments like mine are why I always answer "please no" in those hypotheticals
about meeting yourself.

------
bernardom
As an industrial engineer, this is the equivalent of a developer walking into
a factory and hearing about how "the mythical man-month" is a terrible
book/idea because it allows for waste.

Right. The Mythical Man-Month is a great book/concept for creative/engineering
projects. Kanban is a wonderful way of implementing a Just-In-Time
manufacturing system.

Props to the OP for explaining the origin of kanban. May this post help fix
the co-opting of an IE term for something totally different.

~~~
bdehaaff
I appreciate that. I really do. It's rare to receive an ounce of props on HN.
I must admit that I was totally surprised to learn that it was not designed
for software development and that the author of the Lean Methodology has been
trying to convince folks to stop using it.

~~~
agileramblings
What do you mean the author of the Lean Methodology has been trying to stop
folks from using it? Are you suggesting David Anderson wants us to stop using
Kanban for Knowledge Work?

~~~
bernardom
From TFA:

      David Anderson, the creator of The Kanban Method   (discussed above) wrote the following in late 2010.

      “Kanban is NOT a software development life cycle or project management
      methodology! It is not a way of making software or  running projects that make software!”

~~~
agileramblings
Unfortunately, the tendency to overload terms with multiple meanings is
confusing the situation. It is very common for the word kanban to be used
incorrectly because there are three commonly confused meanings for the word.

kanban - visual signal, signboard kanban system - pull-based, wip limited flow
management system Kanban Method - an approach to incremental, evolutionary
process and systems change for organizations

So yes, the Kanban Method is not an SDLC method. It is a meta-method that will
allow for the emergence of an appropriate SDLC within an organization. That
SDLC may be Agile (very good things in Agile mindset), may be waterfall, may
be Scrum or Scrumban-ish, but it should be appropriate for then context.

Please refer to this wikipedia entry:
[http://en.wikipedia.org/wiki/Kanban_(development)](http://en.wikipedia.org/wiki/Kanban_\(development\))

You don't see any SDLC specific tactics or guidance in there. That is true.
You don't see any Agile language in there. It doesn't provide any specific
Agile guidance.

Does the Agile Manifesto have any specific SDLC tactics? Please refer to
[http://www.agilemanifesto.org](http://www.agilemanifesto.org)

You won't find any specific tactics for software development in the Agile
Manifesto either. But out of the mindset comes specific SDLCs that are aligned
to the manifesto like Scrum or XP or any of the million "custom" Agile
methodologies that have no name but are used by IT organizations everywhere.

David Anderson absolutely wants the Kanban Method to be used (as appropriate)
in organizations that do knowledge work (software development is knowledge
work) to help those organizations develop the best workflow and capability for
a given context and to create a culture of learning, growth, and continuous
improvement. I've talked to him many times about these very topics! Many of
the case studies that we quote in our work are from software development
organizations.

The quote used above has been taken out of context, isolated, and used to
create fear, uncertainty and doubt about The Kanban Method and I find that
kind of behaviour negligent at best.

------
arkades
What the heck do kanban have to do with project management? Speaking -as- a
Lean Six Sigma Black Belt (still can't type that with a straight face) in the
healthcare sector, I can't even imagine how someone would set out using a
kanban to run a company.

That's just so wildly divorced from what it is or what it's for that that
article made no sense to me.

~~~
bdehaaff
This is somewhat the point. Engineering managers have started to reach for
Kanban -- and it does not fit.

------
throwawaykf02
I'm loath to take this on faith without better description of the dataset. 150
companies sounds impressive, but, where are they based? What areas do they
work in? How long have they been doing it? Have other factors, such as the
health of these companies, been considered?

Still, many of these points resonated with me.

I started recently on a team that follows kanban-ish practices. Fortunately
nobody here is that process-focused that we follow it exactly. Also, there is
nothing that says you have to work on only one thing at a time, and we
typically don't. In fact, I work part-time on _another_ team, and the other
one does not do kanban.

But I don't much like the kanban system: Give me a satisfyingly large
component, and let me work on it entirely.

So for kanban in general, here's another facet to consider, and one that
probably explains why engineers are "leaving in droves": As TFA says, you end
up working on many small pieces of a larger whole. The good part is, you could
end up becoming aware of all parts of the system that you touch.

But! When you interview elsewhere, or heck, even when you're updating your
resume, and it comes to answering the inevitable question, "What did you work
on in this project", the honest answer is, "Uhh, many parts but nothing
_overarching_ as such..."

And right then, even to yourself, that sounds like such a weasel-wordy answer.
You could go on and explain, "Well, I wrote method A of component X, and
feature B of webpage Y and an implementation C of interface Z for cases where
Q is R." But to an interviewer, I'd guess it all sounds like "I worked on
nothing worthwhile."

On the other hand, since you have better awareness of the project as a whole,
you could say you worked on _all of it_ , and make up more impressive-sounding
responsibilities as you go along.

But I find it much easier if I just do something impressive and be
straightforward during interviews.

~~~
bdehaaff
Thanks for the comments. The companies have been distributed across the
country (with a few outside of the US as well). They have been of different
shapes and sizes, but I did not do a good job tracking all of their
characteristics. The purpose of the calls was to discuss Aha! -- not different
engineering methodologies. A few trends jumped out at me and this was one of
them, so I decided to write about it and try to be fair that the ideas are
based on qualitative research (discussions). I appreciate your thoughts and
the idea that engineers should own large components of a project or entire
projects resonates with us. We think it creates real pride of ownership and
interest in customer success and it has been how we have organized our
engineering teams at three different companies now. It's clearly better for
individuals (as you mentioned) and the companies they work for.

------
mdehaaff
Really interesting piece. It is amazing that a technique used to optimize shop
floors has been applied to the engineering field which I believe to be so
creative versus "industrial."

~~~
bdehaaff
That surprised me as well. I think engineering managers are willing to try
just about anything to regain some control and deliver software more
predictably. My sense from talking to many companies is that it is
unfortunately having the opposite effect.

------
parasubvert
This is a confusing argument.

Kanban/lean is a pretty simple idea (not always easy to execute): eliminate
waste in your work by smoothing the flow of requirements/changes. This treats
your end-to-end delivery capability as a syatem and one that should not be
overburdened.

The clearest sign of being overburdened is when you have a lot of work in
progress but nothing to show for it. So instead of a genius PM/business
analyst/product owner handling out a tome of requirwments from on high with a
thud, you break the work down into a minimally useful / marketable chunks,
minimize work in progress, deliver according to some priority, and iterate and
learn from the results.

This is the philsophical foundation of lean Startups (customer development),
lean development, and much of the work on Devops.

So the article rails against Kanban ... And almost seems like its advocating
for the same thing with its goal-driven approach to delivery (?).

Any methodology or process framework is subject to misinterpretation or abuse.
This is why "agile" and "scrum" are dirty words to many - it's hard to tell
what you're getting, as the term has been twisted to suit vested interests. It
looks like it is Lean and Kanban's turn to be trashed due to ersatz versions
being forced on teams.

But articles like this aren't helpful unless they explain what they mean
Kanban, and what aspects are ineffective - clichés like "software is
different" don't illuminate.

~~~
bdehaaff
I tried to clearly define Kanban as a "Kanban (meaning signboard or billboard)
is a scheduling system for lean and just-in-time production. It’s a system to
control the logistical chain from a production point of view. Kanban was
developed by Taiichi Ohno, at Toyota, to find a system to improve and maintain
a high level of production. The Kanban Method was later added to as an
approach to incremental, evolutionary process improvement for organizations."

The point is that it is a mistake to take a methodology that was created for
incremental process enhancement along a manufacturing line and apply it to
software development.

~~~
parasubvert
So, I've had the opposite experience: lean-type incremental process
enhancement has had dramatic improvements on the end-to-end results of more
than one company I've been involved with.

I look at a book like The Phoenix Project, written by some fairly respected
software industry folks like Gene Kim, and they also recommend the opposite:
that software development and IT operations actually are a lot like an
industrial shop floor and benefit from being organized in an end-to-end pull
flow like Kanban.

I look at Four Steps to the Epiphany by Steve Blank, or Lean Startup by Eric
Ries, while they aren't specifically dictating a Kanban board in their work,
they're clearly philosophically in the camp of a pull-based approach to
organizing work and limiting work-in-progress.

So, what I haven't determined from your article is, what specifically is
flawed with these authors views and my experiences? Am I being over-broad in
their inclusion? My interprtation of your article this far is a well-meaning
but under-argued philosophical aversion to being lumped in with other
industrial engineering practices.

Edit: clarity

~~~
bdehaaff
From my experience and from what I am hearing it (meaning Kanban) does not
work for most folks or companies. That's it. It might work well for you and
that's great too. I don't think Kanban and Agile philosophies are the same
though - but that's at least another long blog post.

~~~
parasubvert
Fair ball. I'd say if its being latched onto as a panacea, almost all
approaches to process will fail if you lack the basics: a good market, an
insightful product owner/manager, good engineers, and at least an adequate
morale in the company.

I've seen companies/projects with all of those things still fail because of a
poor process. This is where something like Kanban can help, IMO. Not trivial
to implement though.

------
mczepiel_
As others have noted the definition of kanban comes too late in your article.
Also, I think a citation to wikipedia is in order if you're going to copy it
and simply expand the initialisms.

Regardless, it's not a particularly helpful definition for anybody that's
never heard of kanban, and certainly doesn't help anybody familiar with kanban
to know what specifically you're evaluating; you need to get everybody on the
same page from the outset.

Given lack of concrete examples and your previous posting history I would
consider this more of an advertisement for your product, to which I've now
applied for an invitation, but you seem to be genuinely responding to comments
here and nobody else has complained. I suppose either way, well played.

I have other comments but I'll hold them until I find out exactly what you
mean by kanban, because I've been admittedly self-identifying the process I'm
using as kanban and maybe it's not.

I will say this much though, the practices of kanban (visualization, limited
work-in-progress, managed flow, feedback loops, etc.) are all valuable in my
opinion and I wonder which of these you see leading to, or how you see them
leading to, the problems you've cited. Also, I wouldn't mind some more
concrete metrics to back up such an inflammatory title.

------
forloop5150
Pick the right tool for the right job. For a product team Kanban does not make
much sense. I agree with your comments in general. But for a PS or Custom
Development team, where most projects are integration type projects or custom
reports and tend to take 2-3 days to complete, it is a good way to go.

------
jasonlittle
Summary of this article: Kanban sucks, use our tool to make roadmaps! To me,
this is clearly a case of trying to stir up controversy to get people to sign-
up for his tool.

------
tantalor
Why wait until the sixth paragraph to define the term?

~~~
bdehaaff
Fair point. I was not certain where to add it. My belief, based on my
conversations was that many have heard about it -- so I did not want to bore
those in the know.

------
rparet
tl;dr: author of the article is laboring under many false assumptions about
Kanban (and lean software development in general) likely due to a combination
of inexperience using such methods personally and unfamiliarity with the
available literature. The following is a rather long attempt to correct the
base misunderstandings in the article, with pointers to relevant source
material. Enjoy!

First, an operational definition: Kanban as it's used in lean software
development is 1. visual representation of the work that's in the system and
what state it is in and 2. an opportunity to limit the amount of work that can
be in each state.

That's it.

Almost every organization that writes software uses something to keep track of
the work, and what state it is in - by this logic the title of the article
could be "spreadsheets - the secret engineer killer", or "JIRA - the secret
engineer killer".

According to the article though, Kanban is ruining engineering teams in
"nearly every company" that has adopted Kanban out of the 150 companies the
author talked to in the last 60 days. (Some numbers on how many of them are
using Kanban, and for how long, would have been nice facts to include, btw.)

So, let's unpack some reasons why this is:

"Engineers are not assembly line workers" \- Implying Kanban and pull-based
systems only work for "widget producers" and forces engineers to focus on the
individual trees, not the forest. I think this sort of highlights the author's
misunderstanding of Kanban (and to an extent any pull-based system) and what
role it serves in an organization. Kanban isn't magic - it not an
organizational design, it's not a product development strategy, and it's
definitely not a substitute for leadership. It's a chart on a wall that shows
what the work of the product development organization looks like, right now.

For an example of an overall software product development strategy that
incorporates pull-based systems as one component, I recommend checking out
"Principles of Product Development Flow" by Don Reinertsen.

"It teaches you that you and your engineers cannot be trusted to estimate work
or handle complex multi-faceted projects." \- How does it do this? Nothing
about Kanban implies no estimates. In fact if you use Kanban and measure cycle
time, you will be doing evidence-based scheduling which will allow you to make
_better_ estimates. As for "complex multi-faceted projects" \- I don't know
what the author is talking about. Please read "Scaling Lean & Agile
Development" by Craig Larman and Bas Vodde for some actual evidence and
lessons learned on lean / agile approaches being used on huge software
projects. Also "Scaling Agile at Spotify" by Henrik Kniberg is worth a read,
as Kanban features there (by team choice!) as one small component in a lean
software development org design / product development strategy.

"Kanban forces a 'one work item at a time' mentality and resists milestones."
This is simply not true and such a basic misunderstanding I have to wonder if
the author of the article has taken the time to read any of the introductory
literature. If not, I suggest the aptly titled "Kanban" by David J. Anderson.
Kanban wants you to limit work in progress, which is one of the basic goals of
any product development system. It doesn't say how much it should be limited,
or where it should be limited. Every system, everywhere, already has limited-
WIP in the form of bottlenecks. The hopeful goal of pull-based systems in
general and lean software development specifically is that you'll use these
simple tools to look at your process and eliminate wasteful activities and
streamline those bottlenecks that must exist to deliver maximum value to your
customers. In this sense, you can use Kanban as a tool to maximize the whole
of the product development process which is certainly a macro (org level) goal
and outcome that stands in stark contrast to the claims in the article that
Kanban in general promotes micro optimizations and misses the big picture.

For more general reading on why limiting work in progress is a good idea, I
suggest "The Goal" by Eli Goldratt or more recently "The Phoenix Project" by
Gene Kim. As far as milestones go, nothing in a pull-based system is
incompatible with milestones of fixed date or fixed scope. If your idea of
milestones is chucking arbitrary dates on a calendar based on an estimate
before work begins and then stubbornly refusing to adapt those milestones when
the situation on the ground changes (i.e. milestones of fixed date and fixed
scope), then I could see the potential nature for conflict, but surely you're
not out there doing that in real life, right? (Right???) If you are, and
that's the issue - Kanban isn't the problem, the problem is the assumptions
you are operating on are faulty - nothing will work for you. Smarter folks
than me have written about the perils of fixed date and fixed scope
development, I suggest googling for Neil Killick's thoughts on the matter.

"High performance individuals and companies are goal and date driven."
Citation needed. I know many people really, really believe this but you should
really verify. Also, see Fred Brooks "Mythical Man Month".

"Kanban was never intended for software development" \- What? Again, the guy
you quote actually wrote a book on using Kanban with software development
teams. You should read it, as it would probably correct 90% of the
misunderstandings in your article.

Those are the key arguments in the article about why Kanban is "the secret
engineer killer". Hopefully by now it's clear that these arguments aren't very
good and it certainly wasn't any trouble for me to refute them along with a
bibliography for further reading. That doesn't mean Kanban or lean are perfect
though - there still is no silver bullet. Hopefully this inspires some folks
to launch a more throughly-researched critique of lean, kanban, or pull-based
systems in the future as I think that kind of discussion can be really
beneficial.

~~~
curiouscats
Well said. I find it is very common to use the straw-man criticism technique
[http://en.wikipedia.org/wiki/Straw_man](http://en.wikipedia.org/wiki/Straw_man)
about bad management practices. The quality of management is often bad. The
quality of management, even of good practices, is often bad.

Criticizing those implementation of the practice is perfectly fine. But
claiming that the practice is suppose to be something different than it is, is
not fine. I agree with you here, that is the biggest problem. If you
understand how kanban for software is suppose to be done, the criticisms don't
make sense.

------
kneu
I agree. It doesn't allow the engineer to really own a project from start to
finish. Thanks for a great post.

~~~
bdehaaff
Thanks. I appreciate the thought. It's rare on HN to have someone write
something nice.

------
fleitz
Like 'fad diets' most of the reasons that kanban fails is because the
organization was sick to begin with and kanban would have helped if not for
the structure of the organization in the first place.

Fad diets mostly fail because people go back to eating the same shitty way
they did before, just as when a team adopts kanban marketing and product go
back to the same stupid way of doing things they did before.

The sad part is that in the vast majority of organization engineering actually
knows more about the product than product or marketing.

The core of it is that most engineers don't want to work on the stupid fucking
ideas that product and marketing come up with instead preferring to make the
product 'good' instead of creating feature parity with some competitor.

If product and marketing were actually good at their jobs they should at least
be able to convince the engineers in their own fucking company that what they
are thinking is a good idea. Right now I'm picturing the eye-rolls at Porsche
when product and marketing announced the idea for the Panamara.

[http://blogs.cars.com/kickingtires/2012/09/of-course-we-
need...](http://blogs.cars.com/kickingtires/2012/09/of-course-we-need-a-
porsche-station-wagon.html)

~~~
bdehaaff
I agree with your thoughts around dysfunction as it relates to fad diets and
poor habits. I also think that many engineers think they know best, but in a
well functioning org PM actually knows the customers and market and has a
collaborative relationship with engineering. Do you think that PM has no role
or that in most cases they just don't do it well?

~~~
bhattisatish
On the contrary in the Kanban process, PM is the pivotal role. They control
the que, the cadence of feature releases, etc ... Without an effective PM, the
whole thing will fall as a pack of cards.

~~~
bdehaaff
True. But PM needs to pick its head up and think more broadly. A "one in one
out" queue is contrary to delivering winning product.

~~~
bhattisatish
As I have said below
([https://news.ycombinator.com/item?id=6119175](https://news.ycombinator.com/item?id=6119175))
You need to delink engineering releases from marketing releases. Where is it
written that when the engineering releases a feature you need to make a
marketing push? When you have a collection of features ready which as a whole
makes sense for marketing, then you make a marketing release with all the
related PR, hype cycle, etc ...


Show HN: ChatPage.io – Private chat for sales and client communication - going_to_800
http://chatpage.io
======
iqonik
Looks good, the only thing I hate is the 'Free during BETA'. It makes me
wonder how you're going to keep going, I'm worried you'll become a key part of
my sales process but then one day, disappear.

Take my money straight away, seriously, I don't care that it's BETA, take my
money! Don't be scared, you're creating value for me.

~~~
going_to_800
Awesome feedback. Thanks a lot. You are right, the free beta looks un-pro. I
consider charging but let the beta badge somewhere.

------
jjoe
Something about chatting with clients or prospects on someone else's
page/domain bothers me. I think your pro plan should have an option to brand
the chat page with your client's own sub/domain.

~~~
going_to_800
Thanks for checking it out. Yes, it has the option to use your own url.
Currently we're using full page iframe. We'll also add subdomain support soon.


Human-Powered Helicopter Team May Have Won Sikorsky Prize - grannyg00se
http://www.wired.com/autopia/2013/06/human-powered-helicopter-won/

======
bertm
There is not a video included in the article, but one can be found here:
[http://vimeo.com/51320244](http://vimeo.com/51320244)

------
jared314
From the latest pic[0], it looks like the AeroVelo Atlas[1]. Some details on
their design can be found on their site[2], although the info looks to be from
2012.

[0]
[https://twitter.com/AeroVelo/status/345219802262036481/photo...](https://twitter.com/AeroVelo/status/345219802262036481/photo/1)

[1]
[http://www.youtube.com/watch?v=jcFyor9Gl0Q](http://www.youtube.com/watch?v=jcFyor9Gl0Q)

[2] [http://www.aerovelo.com/projects/helicopter/tech-
info/](http://www.aerovelo.com/projects/helicopter/tech-info/)

------
ulrikrasmussen
So there doesn't seem to be a video of the helicopter, but I found this,
apparently by the same team:
[http://www.youtube.com/watch?feature=player_embedded&v=eW9Xs...](http://www.youtube.com/watch?feature=player_embedded&v=eW9XsjllM6A)

I didn't know what an "Ornithopter" was, so at first I thought it was just
some form of glider. That is, until it started flapping its wings - pretty
cool! :)

------
kristianp
Heres a short post from them: [http://www.aerovelo.com/2013/06/14/take-a-deep-
breath-and-ho...](http://www.aerovelo.com/2013/06/14/take-a-deep-breath-and-
hold-on-2/)


Does Fatherhood Make You Happy? - raju
http://www.time.com/time/magazine/article/0,9171,1202940,00.html
======
david927
Fatherhood makes -me- happy. I don't care about how others feel about it.

Unfortunately, this is a horrible article on a fascinating subject: hedonistic
psychology. If you haven't read Dan Gilbert's "Stumbling on Happiness", you're
missing out. A better introduction to what he has to say can be found here:
<http://www.ted.com/index.php/talks/view/id/97>

------
Electro
This has to be in the top 10 dumbest things I've read online, written by a
professional of course. I studied psychology, sociology and I carried on
reading on them both well past finishing my college courses on them. This
article is flawed and the reasons are three-fold:

Firstly, they discuss hedonistic pleasure. This is essentially the pleasure of
getting fat, lazy and dying of hardened arteries. It isn't happiness, it's a
base instinct well below our consciousness that is designed to enjoy sugars,
sex and laziness programmed into us as a survival mechanism. Essentially the
more you eat, have sex and do nothing, the better chance you -had- of
surviving; now not so much.

Secondly, they poorly evaluate the pleasure of accomplishment. Your higher
brain is designed to dump a load of endorphins into your system, because some
minor pain/discomfort has been rewarded. Breaking down into tears at your kids
graduation ceremony is artificial, it isn't programmed into people like
feeling happy when they see their kid. You get so overly joyed when your
children accomplish something because it is something that is a hell of a lot
better for you than all the hedonistic pleasures combined, hence why they -do-
wipe out all the minor feelings that led up to the accomplishment, essentially
because it was worth it!

Thirdly, heroin blocks endorphin (the happy chemical, as well as 3 other
chemicals') production. This is completely the opposite of kids, who can
amplify the production. Heroin is a drug that literally disables your ability
to be happy, I somehow don't see the similarity to kids here. He's comparing
delayed gratification with instant gratification and immense delayed
suffering/death...

I believe my three points are sufficient, however I must add that hedonistic
psychology is an amazing subject. Although that being said, it is fascinating
in a way that should educate you to do everything -BUT- the hedonistic
pleasures.

~~~
david927
Read his book "Stumbling on Happiness". He addresses the first two of your
concerns, and it's a fascinating book. (As for your third point, I think you
missed what he was trying to say: that if you create a myopia around any one
thing, it tends to exaggerate its effects.)

And you're right that there's more to life than happiness, such as fulfillment
and love. Being a Dad is, like the Marines, the hardest job you'll ever love.
I wouldn't change it for the world.

------
Mistone
yes parenting is hard and quite different from self indulgent activities such
as shopping and taking heroin - but does it make you less happy? duh

the smile and sound of little feet running to the door when you walk in the
door is better than any thing you can buy or inject.

~~~
softwarejim
could not have said it better myself

------
ckuehne
It's funny how every response in this thread confirms the three reasons
mentioned in the article - in particular reason one: cognitive dissonance.

------
goodgoblin
I am really looking forward to going sledding tomorrow morning.

------
dgabriel
I don't think anyone should take this article as a personal affront to their
life choices. It's an interesting tangent in the broader field of psychology,
just as Freakonomics is interesting the context of the broader field of
economics.

Of course the greater part of caring for young children is unpleasant; it is
not news that changing diapers sucks, that trying to get a 4 year-old to put
on his shoes when you're running 10 minutes late is infuriating, etc. But the
shining moments of bliss are so profound, so stunning.

I hear running marathons can be largely unpleasant, as well, but the feeling
of crossing the finish line is unparalleled.

------
ekanes
Very tired. Very happy.

------
noonespecial
Worthwhile en devours have hard parts that might not be as enjoyable as
watching a movie or a trip to Cancun!? Holy cow, give that guy a Pulitzer!

Next week he's got an article planned about how people often don't find their
jobs as much fun as DisneyLand!

------
greendestiny
Measures of happiness studys seem to be one of the key areas for nonsense
research and journalism. I think the thing to take from this is that small
increases in long-term average happiness aren't something we desire. Which
isn't very surprising because the way to maximise that kind of happiness is to
remove all struggle and conflict.

------
mercurio
I think this says something about the issue (it's the top link on Reddit right
now): <http://www.paralleldesign.com/mckinney/kevin-01.htm>

------
mynameishere
And the punch-line of what appeared to be the phoned-in disjointed ramblings
of a hungover journalist trying to hit his deadline:

 _Harvard psychologist Daniel Gilbert._

------
paulhart
It was my daughter's first birthday today. Yes.

------
mathogre
Yes it does make me happy. With any luck, those who wouldn't find parenthood a
source of happiness and joy won't breed.

------
undees
Hell yeah!

------
sanj
YES!


Tips for Difficult Conversations - alrex021
http://blogs.harvardbusiness.org/dowling/2009/03/7-tips-for-difficult-conversat.html?cm_re=homepage-031909-_-body-left-r1-_-recession

======
yummyfajitas
Most important: actually have the conversation.

Difficult conversation: "You are highly unlikely to ever finish your Ph.D."

Net result of postponing: student spends 8-12 years in grad school, 5-9 years
more than necessary. 3-5 years of support (approx $60k) are wasted. Multiple
students who might succeed are rejected from grad school.

You are not doing anyone any favors by avoiding difficult conversations.

------
tezza
Maybe worth mentioning again:

* Try using the personal pronoun "I" as much as possible.

This is used in the 7 rules itself "I... and I... and I..."

* Try to have the difficult conversation 1 on 1 and face-to-face

Avoid situations where there is more at stake for the person you are having
the difficult conversation with.

~~~
firebug
True. Helping someone to save face should never be underestimated.

------
villageidiot
->"Adopt the "And Stance". Take control of the conversation by pre-empting distractions, objections and blame by using "and". "I know you worked all night, and I know you want to do well, and I know you just joined the company, and I know the graphics people sometimes get the data wrong, and I know I could have been clearer in my directions to you...." And, and, and."

Interesting strategy but (1) because I'm a stickler for sentence construction
even when I'm speaking I would not find this natural to do and (2) if you make
a list of points that are part of that "And Stance" and just firmly plough
through them, blocking any interruptions, you can achieve the same effect. A
better approach might simply be to say something like: "Let me make a couple
of points first".

->"Paraphrase. To create clarity and to let people know you're genuinely listening, summarize what they're telling you -- and ask them to do the same."

Paraphrasing is a technique that's used extensively in counseling psychology
but its uses are unlimited. By simply mirroring something that someone says
you can improve communication in a whole range of situations. It increases the
perception that the speaker is being listened to and neutralizes emotions in
difficult situations by making people who are upset feel empathized with. It
actually increases the feeling of connection on both sides.


Xkcd - A Bunch of Rocks - nickb
http://www.xkcd.com/505/
======
sammyo
This crowd should be familar with rule 34: <http://xkcd.com/305/>

~~~
MaysonL
<http://wetriffs.com/>

------
jeroen
That guy should pay more attention when I'm coding!

------
Oompa
I hope this isn't the start of a new trend…

------
pchristensen
Wolfram's rule 34?

~~~
jcl
Wolfram's Rules are, as I understand it, a sequential enumeration of cellular
automata. Rule 110 was found to be universal -- i.e. it could be used to
implement a Turing-equivalent machine as the narrator of the comic does. "Rule
34" is a 4chan meme.

<http://en.wikipedia.org/wiki/Rule_110>

<http://wiki.answers.com/Q/What_is_rule_34>

~~~
tocomment
How do I program rule 110 in Python? It shouldn't be too hard, right?

~~~
zitterbewegung
See <http://code.activestate.com/recipes/343386/>


Ask HN: Should Apple Buy Duck Duck Go? - mack1001
======
gaspoweredcat
someone should if only to rename it. why they chose that clumsy name and why
they continue to hang on to it is beyond me, i can only imagine its like the
first season of silicon valley where the guy who makes the decisions loves it
while everyone else rolls their eyes on hearing it

------
mack1001
Considering the privacy focus that Apple brings, Duck Duck Go could be an
interesting play to reduce Google’s presence from the Apple ecosystem.

~~~
greenyoda
Why would Apple need to _buy_ DDG to do this? Why not just make DDG their
default search engine?

------
bradknowles
Hell no. That would be about the worst thing they could do to DDG.

Please, let it continue to fly under the radar for a lot longer.

------
emayljames
No.


Ask HN: Machine learning risk and control framework - ryeguy_24
I'm working on building a risk framework for machine learning models to mitigate the risks of machine learning going wrong.<p>What are the risks of machine learning and what are the corresponding controls that can be used to mitigate those risks?
======
ryeguy_24
Poster comment here. I spent time in the banking/finance world where "Model
Risk Management" is a huge thing. I think some of that can be used to think
about the risks/controls. It focuses on all the things that can go wrong - a)
model doesn't produce an expected result and b) model is used inappropriately.

So, they do things like, performing a model validation which includes rigorous
qualitative and quantitative tests, setting limitations on use, testing the
sensitivity to inputs and boundary conditions, among many others.

In the traditional sense, a machine learning model is a new beast. In most
cases, these models don't have an agreed upon "methodology" (i.e. neural
networks) and therefore don't have an "expected" result that can be tested
(especially for unsupervised learning models). So, curious to know what others
are thinking?

------
mindcrime
_Superintelligence_ by Bostrom is a decent treatment of some ideas related to
this.

Beyond that, there have been a number of stories in the news over the past few
years that touch on various risks related to ML.

Things like: automated trading systems causing economic problems. Facial
recognition systems not recognizing the faces of black employees. "Predictive
policing" creating a "Minority Report" type environment. Etc.

I doubt there's any comprehensive list of "risks of machine learning" though,
since there's not really a corresponding comprehensive catalog of
"capabilities of machine learning".


Video analyzing demo - anfroid555
https://developer.ibm.com/openwhisk/2016/03/07/openwhisk-and-watson-video-app/
======
otoburb
Now if they can combine this object tagging capability with audio-track tag
extraction (speech-to-text), mash the two meta-index-tracks together and
expose this as another Watson API they'll be able to tap into a more media-
savvy and less technical audience.


Zenify meditation and mindfulness app is on Product Hunt - onvel
http://www.producthunt.com/tech/zenify

======
onvel
Zenify mobile app has been launched on Product Hunt. Zenify is aimed to take
meditation and mindfulness globally to everyone with a smartphone. It's
available in 10 languages and trains mindfulness through very simple
meditation assignments delivered to the phone. It takes only several minutes
to complete those assignments which can be done anywhere anytime. No need to
remember about the meditation practice - Zenify will remind you several times
per day to take a few minutes for yourself and become aware of the present
moment. There are numerous benefits of meditation but in general it changes
the lives and the world to the better. So why not make this happen together?
Tune in to your senses, and help us spread the word :) Check out web-site and
find us on top of Product Hunt today. Much love, Zenify.


Ask HN: Good forum for hobbyish ARM(industrial) design discussions and advice? - trotsky

Have some embedded, board level integration experience, nothing really - getting simple boards masked for low density shit. Broadly interested in learning about the next level in ARM board level design (call it cubbie board esque). But I've zero luck finding such a place - it's either raspi/arduino folks (not a diss), folks mostly repurposing android mobile or net tops for software, or the people who are really on the supply side - either they are talking about building the newest open mobile designs with the cheapest bom in chinese i can only half follow, or they are the real deal talking about modular soc components and electronic interface issues with off soc component count vs oem ability to implement. And high cost IP.
I am hoping to for something in english (ha! I'll survive) or just anything that might be suitable.  An HN sorta thing where people often have a clue would rock, but the big missing piece is picking soc->minimal reference board revisions->build or source some custom stuff to give the arm some supervoisor like qualities on the x86.
To balance a zero content post, I provide my rough plan to amuse to reader. Basicially I want to combine a SFF server (think HP microserver or so slash less for mini. Most are essentially low end x76 roll your own nas that make do with 150w and 4 sata bays, 2 dimms and 1 eth.
I want to see what I can do if I meld that kind of platform together with a few low poer arm linux servers all in one case. I imagine the arm sections being able to utilize some kind of pci/pci or similar bridge as well as monitoring, reset, ipkvm etc that could leave them as super programmable debuggers more or less, that could always easily act as low power satndins for much of the traffic that wakes up your typical low use server - ntp, ping, mild file serving, ldap, etc. Anything harder and they could provide a superior holding pattern as the main box woke up from deep sleep.
======
mschuster91
Actually, the idea of coupling together a ARM SoC, a Ethernet switch, a USB
audio interface and a bit of power-monitoring circuitry (and some relais) to
make a dead-cheap desktop remote management solution has hit me too. Maybe
even add a battery to provide a buffer against +5VSB outages (due to "real"
power out); after all, a tiny ARM doesn't suck really much power.

But I'm a software guy, not a hardware developer - I can get a basic circuit
board done, but no BGA or SMD mounted stuff...

I think the market for such a card - especially if built in half-height to fit
into existing servers - is very very great. Wake on LAN just isn't enough for
managing thousands of desktop computers, and "true" IPKVM systems come at a
hundreds-of-$ price tag, and they're an external box nonetheless.

~~~
trotsky
Hey, glad to hear from a like minded soul. It's true they'd likely make quite
good ipkvms as long as you're OK with having CVE's pop on your ipkvm gear. I
guess they probably already do.

I think even just embracing it as an ipkvm++ opens up a lot of potential
additions to the current approach. There's no reason why you wouldn't want to
build in remote power and triggers to go into S3/S4 powersave. There are still
plenty of shops that prevent sleep to make maintenance easier. And It'd be
super easy to hook a usb port up as a usb client and software fake whatever
dvdrom you happened to want to boot.

If you ever feel like shooting the shit, i'd be down to hear what parts of it
does it for you or whatever else was on your mind. I have the same nick on
github.

~~~
mschuster91
Actually all of the bigger SoC families bring USB gadget support with them...
the Linux kernel has at least support for USB mass storage and networking (of
course, networking is useless, because of low speed) - so it should be
possible indeed to internally connect the USB jumpers to the ipkvm board to
provide HID and storage.

The only thing is now to get a cheap way to adapt VGA (or better yet, DVI) to
an SoC. Video encode is supplied with the chips, the real difficulty will be
getting the signals to the CPU, though.

------
ippisl
Maybe there are some guys at reddir: /r/electronics or /r/ece that do high
density pcb's and arm.

~~~
trotsky
Thanks for the tip! I really appreciate the response. While they're probably
not the spot, I'm pretty sure it's a way batter place to ask the same
question. Cheers,


Show HN: ReadRatio – Real time web analytics for blogs - tsileo
https://readratio.com/?showhn

======
erikbigelow
Congrats and good luck. I thought about building something similar about a
year ago. It's an interesting and petty simple test for a bit more accurate
tracking of reading. Never thought about trying to monetize it like this,
however, so I'll be paying attention to how you do.

~~~
tsileo
Thanks!

------
Adams472
Nice job on this. This is a feature that expensive enterprise products have,
but almost everyone should use something like this. Keep going!

~~~
tsileo
Thanks!


Microsoft Support for Windows 7 Is Ending Next Month - eXpd8
https://expd8.com/microsoft-support-for-windows-7-is-ended-soon/
======
aphextim
From the article:

>The first option is to buy the Windows 10 upgrade. The second option is to
purchase an Office 365 subscription, which comes with a Windows 10 upgrade
included.

I am not sure if this still works so I would not use this in a business
environment without consulting a Windows licensing expert. Also someone who
deals with licensing on Windows devices could probably clarify why this option
shouldn't be done.

With all that said, as of 2 months ago I ran the windows 10 media creation
tool on a personal computer with Windows 7 Pro installed. This allowed me to
upgraded the PC to windows 10 and retain all apps/personal files for free. Now
the computer has Windows 10 Pro, and the license activated and appears valid.

I do not want to advocate doing something illegal or get someone in licensing
problems, I just wanted to make people aware that running the Media Creation
tool on a PC with a valid Win 7 install will upgrade it to Windows 10 and
appear valid/activated when finished.


I Use GitHub.app and You Should Too - bbaumgar
http://bbaumgar.svbtle.com/githubapp

======
bradleyland
I too find Git to be the kind of tool that works well through a GUI. However,
I went one step further and bought Tower [1]. In addition to the many things
that GitHub.app does, Tower takes things one step further. If you tried using
GitHub.app, but ran up against a Git activity that isn't exposed through the
app, then you should take a serious look at Tower.

One specific example is partial commits within a single file. Tower shows a
diff view of edited files that breaks edits from different regions of a single
file in to chunks. You can stage/un-stage these chunks right through the GUI.
This is very similar to `git add -p filename.ext`, but with a very nice GUI.

1: [http://www.git-tower.com](http://www.git-tower.com)

------
tiquorsj
It still has major issues. But, for many things it is absolutely better to
have a GUI.

------
mcmillion
I use SourceTree for most of these same reasons.


Why CloudFlare can never satisfy Tor die-hards, and shouldn't try - jgrahamc
http://www.zdnet.com/article/cloudflare-can-never-satisfy-tor-core-and-shouldnt-try/
======
jgrahamc
I posted this just so I could comment that the analysis there is wrong headed
and I disagree with this article.

~~~
mtmail
Can you elaborate your disagreement?

~~~
jgrahamc
The article implies that we should just not bother trying to handle traffic
coming from Tor. I believe this is a mistake because we become stronger by
dealing with difficult situations.

For example, we've build a tremendous chunk of technology for handling massive
DDoS attacks because we invested in dealing with them.

Tor is difficult because the users want anonymity and are aggregated across a
small number (~1,500) IP addresses. But CloudFlare will be much stronger if we
are able to reliably detect malicious use of Tor and allow through normal use.
It's worth solving these problems precisely because Tor is so challenging. We
have a whole bunch of technology for detecting and blocking attacks, making
them work really, really well for Tor is something I'm investing in.


Bruce Schneier: The US government is coming for Your code, techies - jupp0r
https://www.theregister.co.uk/2017/02/14/the_government_is_coming_for_your_code/?mt=1487190219159
======
majorarcher
imagine if they patented the loop for example.

~~~
benchaney
A bunch of stupid interview questions would suddenly become very relevant.


Reading iOS app binary files - msbenighted
https://blog.smartdec.net/reading-ios-app-binary-files-2c9e63a381ad
======
favorited
Objective-C was the first language I used where I looked under the covers and
tried to understand the machinery of the language, and its extremely dynamic
nature makes it a great place to start to understand language runtimes.

It's so conceptually simple, and (aside from objc_msgSend) you can implement
the whole thing in C. libobjc2 has (if I'm counting correctly) 23 .c files,
and it includes things you can totally ignore as you're learning, like an ObjC
garbage collection implementation that no one uses anymore.

The only tricky part is the message-sending routines, since they have to be
written in assembly. But as long as you understand _what_ they're doing
(rather than _how_ they're doing it), you don't even need to look at those if
you don't want to.

~~~
hypervis0r
> The only tricky part is the message-sending routines, since they have to be
> written in assembly

Why? (context: never touched Objective-C)

~~~
_red
Disclaimer: I may be completely wrong, but I don't think OP is saying that
while writing normal ObjC that you need to write the message passing in
assembly. Instead, that you could recreate ObjC in regular C but you would
have to use assembly to construct the message passing portion of the language.

~~~
slrz
Sure, but what's the property of ObjC-style message passing that makes it hard
to implement in C?

Like when you implement coroutines/threads in your language runtime, you're
going to implement the context switching part in assembly because you just
don't have access to the relevant information (registers/stack/...) from
portable C (aside from using setjmp/longjmp maybe).

~~~
exikyut
A parent comment says it's due to variable number of arguments.

I thought it was about speed, heh.

~~~
saagarjha
To be honest, it's probably both. The runtime gurus at Apple do a great job
hand-optimizing objc_msgSend for each platform since it's such an important
factor in the overall speed of an Objective-C program.

------
ericand
"Therefore, except for the lost data on exact types of Objective-C objects in
arguments, it’s possible to get the complete reconstruction of an interface."

That's more than I expected. Great work!

~~~
saagarjha
Well, you lose the return type as well. Generally in these cases the app is
fired up in the debugger and stopped on one of these methods, then dynamically
introspected to figure out what it is. Since all Objective-C objects carry
around a representation of their class, it's possible for the runtime to
provide this to us.

------
saagarjha
Another interesting resource is class-dump, which will do much of this work
for you and give you a "header" from an Objective-C binary:
[http://stevenygard.com/projects/class-
dump/](http://stevenygard.com/projects/class-dump/)

------
swolchok
see also
[https://swolchok.github.io/objcperf/](https://swolchok.github.io/objcperf/)


Ask HN: Anybody know if supermarkets collect and sell your receipts? - williamle8300
I'm a huge fan of buying top shelf bourbons and started seeing ads for Knob Creek bourbon on Instagram recently. It's led me to think that Von's (my local grocer) sells my purchase history to ad networks.<p>Anybody ever have this experience?
======
bobwaycott
Based on what limited experience I have with FB ad targeting[0], there is
quite a lot of data purchased from credit card companies. There may be
aggregated receipts funneled into one of their sources, though I haven't yet
seen a specific grocery source called out anywhere. Nonetheless, it's pretty
trivial to identify purchase behavior via CC data and target people who are
known to buy/consume alcohol—e.g., bars, liquor stores, etc.—and push my
product.

0: FB ads run on instagram by default


Show HN: Bitcoin Wallet-as-a-Service - nvk
http://blog.coinkite.com/post/91848147526/bitcoin-wallet-as-a-service-coinkite-api

======
nvk
Ping us here connect @ coinite . com if you need help with integration.


Partial password usability sucks - gaevoy
https://gaevoy.com/2019/03/06/partial-password-sucks.html
======
inetknght
> _The idea is good it gives you an extra layer of protection against password
> theft (link 1, link 2, link 3)._

That sounds obnoxiously insecure on the back-end. Notoriously, the most broken
authentication mechanisms used plaintext (or reversibly encrypted) storage.
The answers to the three security questions that the article links to also
point this out.

Sounds like ING Poland needs to be called out by some security researchers.

[0]
[https://security.stackexchange.com/a/194818/47800](https://security.stackexchange.com/a/194818/47800)

[1]
[https://security.stackexchange.com/a/7479/47800](https://security.stackexchange.com/a/7479/47800)

[2]
[https://security.stackexchange.com/a/196430/47800](https://security.stackexchange.com/a/196430/47800)

~~~
ajuc
What's more likely - that the bank gets hacked, or that you install a
keylogger?

Also there are ways to implement this without keeping the whole password in
plaintext/reversibly encrypted. One example I just thought of:

Ask for 75% of the password each time, remember random 1/3rd of that (25% of
full password) till the next login together with the hash, and on the next
login ask for all the letters you haven't remembered (and fill the ones you
remembered, then hash everything and compare).

You can adjust the percentages as needed if having 25% of the password in
clear text is too insecure.

~~~
inetknght
> _What 's more likely - that the bank gets hacked, or that you install a
> keylogger?_

Given the (apparent) lack of security for the bank, I'd say the former. IF the
bank was actually secure, then sure it'd be more likely for me to have a
keylogger.

> _Also there are ways to implement this without keeping the whole password in
> plaintext /reversibly encrypted_

Maybe.

> _One example I just thought of: Ask for 75% of the password each time,
> remember random 1 /3rd of that (25% of full password) till the next login
> together with the hash, and on the next login ask for all the letters you
> haven't remembered (and fill the ones you remembered, then hash everything
> and compare)._

I challenge you to really think about what you're proposing to do. I think
it's far more convoluted: it does _not_ solve the keylogger problem and adds
complexity to both the client and the server. If you think I'm wrong, then
write it up in a spec and show us.

~~~
ajuc
> If you think I'm wrong, then write it up in a spec and show us.

Sure. It's fun.

On password creation:

0.0. demand 25% longer passwords from users than considered safe

0.1. along with the hash of the whole password remember a randomly choosen 25%
of the characters of the password and their positions (in clear text or
reversibly encrypted)

On each login:

1.0. ask only for the characters in positions you haven't remembered

1.1. server-side fill the positions you remembered

1.2. hash the result and see if it matches

If hash matches:

2.0. randomly choose 1/3rd of the freshly provided positions and remember them
in clear text on server replacing the previous ones

2.1. give access

If hash doesn't match:

3.0. deny access, don't change anything on server

If I understand correctly - to get the whole password keylogger must be
specific to this bank site (to understand which characters are provided), and
must be active on at least 4 logins. In my book that's a big improvement.

And I can imagine writing the login page in a way that makes parsing it in
keylogger to understand which characters are masked.

~~~
vkou
> If I understand correctly - to get the whole password keylogger must be
> specific to this bank site (to understand which characters are provided),
> and must be active on at least 4 logins. In my book that's a big
> improvement.

The difference in difficulty of keylogging 4 logins, and 1 login is, in
practice, small. Once your computer is pwned, all bets are off.

~~~
dTal
I think there's a big difference between capturing the whole password at once,
and having to reconstruct it contextually - it may be difficult to recover the
typing context. Even if the context is known 100% reliably, it will take far
more than 4 logins to scrape enough information to reconstruct the password -
you need overlap to match the fragments. It the user visits any other site
that uses a similar scheme, it gets harder. If a a site chooses to 'salt' the
password by making the user retype random characters, it gets much harder -
now you need enough logins to apply statistical analysis. If the site makes
the user type the characters in the wrong order, you can't reassemble the
password at all - all you can do is guess the order.

To gather enough contextual information to defeat all this reliably, the
keylogger would also need to be a screen scraper, internet monitor, etc.
Straight away, this defeats the not-uncommon case of the inline USB keylogger.

~~~
vkou
Someone breaking into my apartment, and putting an inline USB keylogger on my
computer, that is incapable of doing anything but recording keystrokes, to
steal my banking login, is both seriously overthinking their crimes, and, at
the same time, seriously underachieving.

------
Matterrr
> Open partial-password.github.io & copy-paste your password there.

Sounds like a great idea, let's all paste our bank passwords in this website!

Banks have peculiar ideas about security sometimes, I don't think this partial
password business will have a net positive effect (especially if people use
"solutions" like these and potentially send their password to a third party)

~~~
deepspace
Exactly this. I have the misfortune of occasionally needing to deal with an
online banking portal (located in South Africa) that uses this stupid scheme.
Every time I log in, I wish an eternity of torture on the idiots who came up
with it.

I just cannot imagine the thought process of the people who though that
partial passwords could be better in any way than classic passwords.

~~~
WorldMaker
Banks especially seem heavily "invested" in finding the biggest/laziest
loopholes in security laws that they can and driving forklifts through them
for as long as possible.

In the 90s, laws in multiple countries asked banks to research and implement
Two-Factor security. They invented all of these stupid, stupid Wish-It-Were-
Two-Factor things that _are not_ Two-Factor but "feel Two-Factor enough" to
avoid actually deploying proper 2FA, but avoid security fines: "Security
Questions" (bonus passwords, still 1FA), multi-step login with "user selected
pictures" (not an extra factor, just a silly memory game to potentially cut
down on phishing), "partial passwords" (still 1FA).

(Then other idiot sites copy these "security best practices" because Banks use
them, rather than actual security best practices.)

It is starting to seem like a lot of the money spent on the development effort
of these "not 2FA" workarounds and portal workflows could easily have just
paid for sending every bank customer a YubiKey or three by now.

------
tedunangst
Make your security policy difficult enough to comply with, and people will
find workarounds like pasting their passwords into strangers' websites.

~~~
fjeuplos
Or people will just pick short passwords so its easier to count along the
chars in their head. Again, not a thing we really want to encourage.

------
_asummers
Perhaps I'm misunderstanding the security model behind this, but why should
the site be storing my password's length at all? Why does it know I have a
10th character at all? The site should just have a hash of my password
(normalizing the length).

~~~
john-radio
I guess (hope) they just have a collection of patterns that they apply (like
(3, 9, 11, 12, 15) from the OP), and when they store your password's hash,
they also store the hash of those several characters so that they can present
the pattern to you later and check whether you matched the pattern correctly.

~~~
Vendan
5 characters is "pretty simple to bruteforce" area, and now you've got 5
characters, replicate that for the other patterns, and you can probably crack
the whole password pretty easy

------
jdashg
"Please enter your password in this mutable github pages page." Eek.

I have a real desire for a document firewall mode where nothing can enter or
leave.

~~~
franky47
Nor be stored for later retrieval.

Such a firewall, when disabled, would essentially have to restore the whole
page memory to how it was when it was enabled, and block access to
localStorage / IndexedDB / Cookies / Cache.

------
munk-a
Partial passwords are a terrible idea for a multitude of reasons but one in
particular stands out to me. We have come to the general conclusion that
humans shouldn't remember their passwords, they should remember one
complicated pass key that is linked to a number of otherwise inaccessible
secret keys used to interact with servers but, let's step back for a moment
and assume people are remembering their passwords (which most people not on HN
still do)...

A password has an entropy n, a higher n yields more security but comes at a
cost in terms of memory power, I think it's reasonable to state that very high
entropy passwords exhaust our memory quite quickly which is why password reuse
is so common, this particular authentication is requiring the user to have a
high entropy password n, and then is reducing it to an entropy m where m is at
most as large as n (usually much smaller) and using that for authentication.

We, users and tech people, don't care about the cost to transmit bits over the
wire or the cost to verify those bits on the far end (in this scenario) we
care about the cost on the user's memory more than anything so why are we
optimizing this puzzle to be least efficient for our most valuable resource.

When I first read this article I thought this practice was silly, now it
strikes me as stupid... it is a transformation that simply discards some of
the potential security of the system for no reason.

(Also, banks love ease of use, which is why up here in Canada they love to
send out password dongles to customers that make it even easier to log in to a
site than this while still requiring possession of a physical thing - and many
of those dongles require additional authentication to activate whenever using,
though not all)

~~~
NotAnEconomist
Advice and tactics for passwords have been bad for a long time, perhaps even
comically so:

[https://imgs.xkcd.com/comics/password_strength.png](https://imgs.xkcd.com/comics/password_strength.png)

~~~
munk-a
I agree, and a concise response to this article can pretty much be summed up
as "Don't roll your own security" for... the fun of it I suppose, I wanted to
take a swing at one particularly (IMO) good tear down of why it's stupid for
technical reasons, but simply rubber stamping "Don't roll your own security"
is pretty acceptable on any of these proposals.

This stuff is complicated, if you're a professional at it good on you, it's a
tough job, otherwise... just listen to the professionals/best practices and
don't feel the urge to be creative, you'll probably break something. It is
possible that everyone is wrong, but it's unlikely... and when everyone is
wrong (for example Dual_EC_DRBG) if you're using that system it'll be hard not
to be aware of the issue when it comes to light.

------
waltbosz
That's such a strange UI. I couldn't tell you the fifth letter of most words
without writing them down, let alone that of my 20 character passwords.

~~~
ajuc
You just spell it in your mind going through all the letters and only press
keys where asked.

I'm recently switched from a bank that uses regular passwords to a bank that
uses partial passwords, and it took me a week or so to get used to this, and
it is a little slower (takes me like 10 seconds instead of 1), but it's
nothing significant.

~~~
fjeuplos
You have made the assumption that everyone who uses strong passwords can
remember them in their head :-)

------
kazinator
Coming soon to a Poland near you: partial fingerprint authentication at ATMs:

"Please put these tiny stickers in the correct locations on your thumb, and
then press it against the sensor ..."

~~~
diminoten
How about "Spit on this sensor to see your checking account balance"?

~~~
kazinator
With a collection gutter at the bottom, from which your yearly interest will
be derived.

------
ggggtez
I'd love to run some math on the entropy this actually gives you... If you
assume people are using common dictionary word passwords, you could even
develop special tables based on common letter positions or substrings.

Assuming a character is 5 bits of entropy...

An 8 character password gives you 8 choose 4 = 70 possible variations it could
ask. Each variation is 4 characters (20 bits of entropy). So, that brings it
up to 20+log2(70)=26.1 bits of entropy for an 8 character password... Compared
to 40 bits of entropy normally...

And that's not even accounting for using common words/phrases. This scheme
seems to lose about 1/3 the entropy.

12 character password gives only... 28.9 bits of entropy instead of the
expected 60 bits.

And that's not even including more obvious attacks like stealing the plaintext
from the server, since it obviously isn't salted on the server side (and it
reveals the length of your password on the front end too??)

Edit: I noticed I used "choose 4" instead of "choose 5" but the math is
similarly bad. I leave it as an exercise for the reader.

~~~
ggggtez
And an 12 character password only giving you ~500 possible subselections means
if the 4 character string was stolen, you could brute force in within a few
minutes. This is hardly better than than just leaking the entire password.

------
springogeek
This sort of thing needs to be built into password managers.

~~~
Leace
Agreed but I'd rather they allow normal passwords where you can use the
"password you can't remember" and U2F token like civilized people.

------
kazinator
Jawdrop ... that is the most idiotic thing I've been made aware of in quite
some time.

First of all, never mind all the gaping usability problems and obvious
decrement in security.

The system must be storing passwords in plain text in order to make this work.

I can think of ways that don't require plain text storage (like pre-computing
various partial passwords and hashing them separately), but (1) people who
came up with this idea would be too stupid to have implemented that, and, (2)
in practical terms, it significantly reduces the possible number of partial
passwords: we can't hash all of the subsequences of the string, because there
are vastly many, so we have to rather generate some reasonable number of
canned subsequence positions. Such a reduction in itself is a security
compromise.

------
snorremd
The solution to keyloggers is not partial passwords. The solution is requiring
two factors! In Norway there is a shared authentication infrastructure used by
banks and other services called BankID:
[https://www.bankid.no/en/private/](https://www.bankid.no/en/private/) They
facilitate second factor auth either with an OTP device or via your cell
phone's sim card. It just works.

All Norwegian banks use a password + second factor. And these days I think
most of them have liberal password rules, in that you are allowed quite long
passwords. Schemes like the one described in the post seems like a poor
attempt at improving security.

------
diegorbaquero
So they are storing length and hashes of subsets of the password?

You could brute force a subset of 4-5 characters way easier than a 20
characters password.

How is this secure? Anyone care to explain how this adds security?

~~~
munchbunny
It doesn't. It's theater.

------
jakub_g
For the context: partial passwords have been the default and a de facto
standard for Polish banks since early 2000s. They are not "cutting edge novel
idea" but more a common legacy.

I think people got used to them, so changing this now for everyone would feel
weird (and would probably annoy many).

In some banks you can opt-out in settings and have regular password instead.

I guess it's an equivalent of swipe cards in USA.

------
jotaen
> If you don’t trust partial-password.github.io consider to save the page
> locally and run it from there

This doesn’t really make it safe per se, there still can be a script running
that triggers an AJAX call in the background, sending the password to some web
URL.

~~~
ithinkthimgs
I think the assumption is that you would check the source code before
executing it.

------
dzek69
My solution to this:

i use password that contains only 5-letters words

so each new word starts at 1, 6, 11, 16, 21 etc

it's easy to scan the password for specific letter in memory this way

funny thing: i didn't do that on purpose. I just came up with a password that
happend to have such words only.

~~~
dzek69
PS. If author reads that maybe:

saving a webpage on disk can still be considered unsafe. you can send a
password to the internet via various way, like insering an image with url:
evil.com/pass.jpg?pass=enteredpassword

------
buboard
i m sure someone was promoted for this 'security innovation'

------
deanalevitt
Convenient 2FA is the answer, not weird UX.

------
rad_gruchalski
Lloyds TSB used to do the same. No idea if that’s still the case.

~~~
fjeuplos
Halifax does it still. All the same bank really ;)

------
scarejunba
This is a retarded feature and I hated it when I had to use it.


Set Theory and Foundations of Mathematics - bschne
http://settheory.net/
======
bubble-07
What is the first diagram on this page supposed to depict? Seems like a bunch
of unrelated topics with random arrows drawn between them.

Also, the author seems more than a bit arrogant and deluded:
[http://settheory.net/life](http://settheory.net/life) \-- I would _not_ touch
any of this stuff with a 40 foot pole.

~~~
DyslexicAtheist
the whole thing you linked reads like he is going through some existential
crisis triggered by spending too much time in his own head, or he is
struggling to find himself. he calls others stupid but that might just be due
to feeling misunderstood and a symptom of his alienation.

one thing I learned is that knowing more doesn't make us happy. knowledge can
be the key that opens a door to insanity.

whether he is a lunatic or genius is hard to say without evaluating the
quality of his work.

~~~
onemoresoop
> But there are still many well-placed people who will never listen, cannot
> grasp this and that keep denying the right for young geniuses to decide for
> their own life.

This obsession with I am a genius is bordering on pathological narcissism,
excluding oneself from the society because one's too smart to be understood by
the world is a very dangerous slippery slope. On the other hand, while in a
healthy way, I applaud when one sticks to their own ways. I just wish humility
was mode widely practiced. We are not gods, we're just some creatures that
have varying degrees of intelligence, but nothing special.

Good luck to you young thinker but remember we are to enjoy this life and the
people around us. Don't be lonely and miserable trying to prove everybody
wrong, it's pointless.

~~~
DyslexicAtheist
yeah it goes on and on. the Dunning-Kruger seems strong. I got the impression
he is extremely isolated. sad really.

------
LeanderK
I had a seminar on set theory and the foundations of mathmatics. It was very
fun! But, coming from a computer science background, i found the foundations
via set-theory unintuitive and a bit ackward to work with.

I know there are some type-system based approaches, how do they turn out in
practice? How nice are they to work with "on a low level"?

~~~
gylterud
Type theories, especially dependent type theories a la Martin-Löf, are quite
natural to work with. They are easier to implement on a computer, and there
are active communities around several such implementations (Agda, Coq,
Lean,⋯).

Most computer verified proofs are implemented in systems based on type theory,
not set theory. Most of the time you do not need sets of sets of sets… You
want types whose elements are the mathematical objects you care about.

In fact, if you want to do set theory, you can do that inside type theory as
well. You can define the type of iterative sets and define a membership
relation on this. The resulting stucture will satisfy set theoretical axioms.
This was first done by Aczel in the 70s.

~~~
0815test
"Set theory" itself is a bit of an overloaded term; most practical uses of
naïve set theory in math do _not_ make use of properties like extensionality
or the global membership relation, that characterize axiomatic set theory over
TT. Thus, one could also describe the sort of "more natural" systems you
reference in your comment as 'structural set theory'
[https://ncatlab.org/nlab/show/structural+set+theory](https://ncatlab.org/nlab/show/structural+set+theory)

It's true however that one can do material-set theory _inside_ structural-set
theory or type theory, by defining a type of material sets (not necessarily
"iterative" however, that's a matter of whether you want to model the axiom of
foundation!) and a membership relation on them.

~~~
gylterud
Structural set theory, which as you say throws out the iterative structure, is
more like type theory than set theory (this is pointed out in the nlab page
you linked).

Naïve set theory as practised in say a course in discrete mathematics
certainly uses the iterative structure to construct say a pair. You will
typically find the definition 〈x,y〉 ≔ {{a},{a,b}} instead of defining it
through a universal property.

All the axioms of material set theory take this iterative approach, not just
foundation. In fact foundation is not very critical (The Axiom of Anti-
foundation is just as workable), as you can always just use the class of well-
founded sets and work with those.

------
markkm
"The set theory formalism presented here differs from the traditional ZF
system"

Do not, I repeat, DO NOT study nonstandard theories before familiarizing
yourself with the standard theory. The standard set theory (ZFC) survived for
over a century for very, very good reasons. Without an exposure to the
accepted standards, you will not be able to tell what is reasonable and what
is not in this set of notes.

It should also be noted that the author's field of concentration (geometric
analysis) has nothing to do with set theory. A typical mathematician knows
very little about axiomatic set theory and is prone to making imprecise
statements about it.

~~~
gylterud
While I agree that one could take caution when studying proposed alternative
foundations of mathematics (there are a lot of dysfunctional theories out
there, and the link may be one of them for all I know), I think it is unfair
to presume incompetence based on the fact that the author has another field as
his specialisation. ZFC is also not the one true way, there are many sensible
ways to formulate set theory, and even valid criticisms of ZFC.

------
sridca
Related: Category Theory for Programmers

[https://github.com/hmemcpy/milewski-ctfp-
pdf](https://github.com/hmemcpy/milewski-ctfp-pdf)

------
korpiq
To me this looks like an interesting attempt to holistically give some
overview of mathematics to lay people and could be improved if eg. those with
correction proposals here would have some way to contribute back.

I might immensely enjoy such a wikipedia of mathematics.

~~~
joe_the_user
Honestly, I would suggest looking at Wikipedia proper. It's coverage of
mathematical topics seems to be currently quite good. You can generally easily
google the proofs and the details for topics presented without these. The web
altogether is goldmine of mathematical knowledge today imo.

Most things aren't explained "down to the elementary level" but anyone who
spends significant time on this stuff will reach a higher level and appreciate
not having the same elementary explanations repeated over and over.

------
The_rationalist
One should read about standard logic, propositional logic, term logic and nth
order logics before, because set theory is founded by them.

~~~
fnrslvr
Set theory and logic are too interdependent to venture far in one whilst
steering clear of the other. For instance, you'll only really skim the surface
of model theory without a basic understanding of infinite cardinals.

~~~
The_rationalist
They can indeed be used together and are interdépendant in practice at "high
level mathematics" But set theory is made of a lower level primitive (first
order logic) itself being an extension of zeroth order logic. I was saying
that in the context of learning the foundation of mathematics where set theory
is not the first place to begin.

------
tempodox
This contains some falsehoods, e.g.

      (A⇔B⇔C)

is not the same as

      ((A⇔B)∧(B⇔C))

and the former doesn't imply

      (A⇔C)

either, but the latter does.

~~~
gylterud
Interpreting A⇔B⇔C as (A⇔B)⇔C is utterly non-standard, but admittedly
interesting.

A⇔B⇔C is usually not a valid expression in any mathematical formalism. But if
used informally, A⇔B⇔C is usually meant to mean (A⇔B)∧(B⇔C), just as when you
say A=B=C when you actually mean (A=B)∧(B=C).

~~~
rrobukef
[https://en.wikipedia.org/wiki/Logical_biconditional](https://en.wikipedia.org/wiki/Logical_biconditional)

(A⇔B)⇔C has more in common with the other logical operators: due to it's
associativity an interpretation that is, in my opinion, closer than A=B=C.

Edit, removed: Note that (A⇔B)∧(B⇔C)) is not one of the two ambiguous options:
either (A⇔B)⇔C or (A∧B∧C)∨(¬A∧¬B∧¬C) this is wrong.

~~~
Diggsey
What? `(A⇔B)∧(B⇔C)` is exactly equivalent to `(A∧B∧C)∨(¬A∧¬B∧¬C)` which is
equivalent to `A = B = C`

~~~
rrobukef
So it is.

------
fesoliveira
I wish someone could give this a beauty treatment to make it look like
Immersive Math, for instance
([http://immersivemath.com/ila/index.html](http://immersivemath.com/ila/index.html)).
This typography and formatting makes it very hard to read these notes,
although the content seems to be very interesting.

~~~
meuk
There are links to pdf files near the headers of the chapters, although the
pdfs are called "obsolete", so I guess they are not the latest version or miss
content.

------
formalsystem
Seems like it's hit by the HN hug of death. Am wondering is there any way for
me to help out random people who I think have good content by mirroring their
content and increase scale on their behalf?

------
crimsonalucard
Category theory is an alternative view on the foundations of mathematics that
literally gets rid of sets.

~~~
rocqua
Well, there is the rather prototypical category Set. So I would not say it
gets rid of sets.

~~~
IngoBlechschmid
It's more subtle than that.

True, given any reasonable well-behaved notion of "set", there is a category
Set of all sets. (Its properties will depend on the specific notion of "set"
chosen.)

But this observation isn't really relevant to issues of formalization.
Mathematics can be formalized in lots of systems, set theory being one, type
theory being another, and category theory (more specifically ETCS) providing
yet another alternative.

All of these foundations are interesting, enjoy unique features, and are
interrelated. In particular, ETCS and set theory are very similar from the
point of view of foundations: Basically, ordinary set theory and ETCS are two
different flavors of set theory: ordinary set theory rests upon a global
membership predicate ∈, while ETCS rests upon the notion of a morphism.

Closest to mathematical practice is probably type theory. (But keep in mind
that the points above still stand, and that most mathematicians work
informally, not knowing any details about set theory, type theory or ETCS.)

------
thomk
Question: Would you use 'set theory' to find patterns of sets in a hierarchy?


Chase Adam at Startup School 2013 - floetic
https://www.youtube.com/watch?v=WlT3UhC7NwQ

======
floetic
This is by far the best presentation at StartupSchool 2013. I was in awe when
I saw it from the 9th row.


Creating a low-latency high-availability network for voice calls - moxie
http://www.whispersystems.org/blog/low-latency-switching/
======
Scramblejams
Not enough detail here, but I'm surprised when I see the terms "voice" and
"TCP" together. Do they use TCP to set up the call, then UDP to handle the
audio?

Edit: Yep, they use UDP for the audio:
[https://github.com/WhisperSystems/RedPhone/wiki/Signaling-
Pr...](https://github.com/WhisperSystems/RedPhone/wiki/Signaling-Protocol)

~~~
bradleyland
With the traditional VoIP stacks, yes. There are two components to making
phone calls: messaging and media. The messaging part sets up and tears down
calls. The media part passes the audio.

I'd imagine they're doing the same.

~~~
dkhenry
but typically you use something that can have at least some intelegent
behaviour like RTP not UDP. Why did they choose that when literally every
other pure VoIP service uses RTP ?

~~~
moxie
We use RTP (actually SRTP and ZRTP), but the transport is still UDP.

------
jpollock
The next problem will be when they get to having large numbers of servers in a
region.

Then two problems will manifest themselves.

1) The client will take long enough to work through the list of servers that
the wrong server is chosen simply because the connection is initiated first.

2) This design has all servers seeing all calls. The load represented by all
the TCP connections hitting all of the servers will consume more and more of a
server.

Neither is a problem you can solve by adding more servers. In fact, they are
made worse by adding servers!

However, if you're charging per call, that's what they call a "good problem to
have".

Nifty solution to the problem though.

~~~
moxie
Agreed. We haven't run into this yet (and aren't charging at all, this is an
OSS project), but I think that would be the point where you have to do one of
two things:

1) Architect your DNS response to include a small sample of the total result
set for the region, where the sample includes at least one switch from each
micro-region.

2) Break down and introduce load balancers, so that there's on load balancer
per micro-region, which fronts all of the switches within that micro-region.

Fortunately an individual switch doesn't really do much (just shovel packets
around), so the number of simultaneous calls a switch can handle is high
enough that redundancy is more about availability than load.

~~~
JshWright
I don't see how the license the software is released under is related to how
much you charge to use the service...?

~~~
moxie
Fair enough, I should have been more specific.

I was trying to imply that this is not a for-profit project, but you're
correct, that's not what a software license communicates.

------
gz5
The server architecture is nice but my favorite part is the simple signaling
protocol, as opposed to SIP or any other overly complex (for this use case)
telephony signaling protocol. Nice work.

------
andrewcooke
i'm confused (which is not too surprising as i am no expert on this). why
can't they hole-punch through nats? then they would avoid the extra bounce-
through-server latency and would hugely reduce the load on servers. i thought
that was how skype worked, for example.

(i realise this doesn't stop their "fastest first" idea being useful - i got
kind of sidetracked by the explanation of how servers are used near the start
of the post).

[ah, ok. thanks for the explanation.]

~~~
moxie
Your NAT traversal strategy is limited by the type of NAT being employed.
Traditionally, the worst case scenario for NAT traversal is "symmetric NAT."

Symmetric NAT means that each tuple of (source_ip, source_port,
destination_ip, _destination_port) gets its own unique (external_ip,
external_port) tuple. This is bad because it means that STUN is ineffective:
your STUN server will see a different external port than what your actual
destination would see.

Mobile data networks are actually _worse_ than symmetric NAT. Not only will
your external port change based on your target, but your external IP likely
will as well.

This makes NAT traversal, AFAIK, basically impossible.

~~~
vy8vWJlco
And there's no real reason to do it either given the availability of global
IPv6 addresses and any of the free tunnel brokers/teredo/etc, other than the
simple lack of adoption/momentum. Most ISPs will need a push, but from an
infrastructure perspective it just boils down to a new gateway router or a
firmware upgrade. It doesn't even need replacing the end-user equipment if
ISPs simply set up a tunnel server for their own customers as a transitional
measure.

------
mtrimpe
So it's basically a very pragmatic tradeoff for getting 80% of the value of
geo-based DNS with only 20% of the effort.

Nice work ...


NVIDIA to Acquire AGEIA - pmattos
http://www.dailytech.com/Update+NVIDIA+to+Acquire+AGEIA/article10573.htm

======
ivankirigin
Two cheers for dedicated hardware pushing progress while Moore's law for
silicone circuits approaches a wall!

After a graphics processor, you'll buy a physics engine, and then vector math,
AI, and Vision engines.

Graphics card makers know this, and will just put all those chips on a single
card.

~~~
wmf
I think most people will skip the step of buying the physics card and just
wait for it to be integrated into the GPU. It will be an interesting marriage,
though, since the Nvidia and Ageia architectures have some significant
differences.

~~~
pmjordan
They are somewhat different, and I suspect the Ageia PhysX line as it is now
will be discontinued. It's not exactly been selling like crazy, and I suspect
nVidia are buying them out for the software, not the hardware side.

If you look at benchmarks, SLI isn't exactly what they make it out to be: it
scales very badly in many games, presumably because of render-to-texture and
vertex feedback rendering, which either have to be duplicated or copied
between the cards.

Those types of effects are getting more common not less, so I suspect it'll
become commonplace for games to do physics calculations on one GPU and the
actual rendering on the other. Right now, driver support for this kind of
thing isn't great, and nVidia don't have their own physics engine.

------
dawnerd
I just can't wait until our video cards match the speed out our cpu. That will
be the day...


Show HN: port-to-process, a sysop script to show what's running on a given port - jph
https://github.com/sixarm/port-to-process
======
jph
I'm seeking hacker advice for this sysop script, to make it more useful on
more systems. Currently handles ss, lsof, netstat, fuser, on macOS and Linux.
Thanks!

~~~
zzzcpan
Why is this a shell script? Shouldn't it be just a few documented ways to get
such information with mentioned tools? Script is just too much for this, you
have to trust the author, trust the source, install it, learn it, run it.
While you could've just read few lines of text and run appropriate commands in
the terminal.

~~~
jph
> Why is this a shell script?

So this can run.

Also, so I can run one command that works on a range of systems.

> Shouldn't it be just a few documented ways to get such information with
> mentioned tools?

You're welcome to do that. The README.md file is documentation. I welcome
constructive feedback.

> you have to trust the author

I am the author, so that's covered. :)