its_so_on

For what it's worth, when I heard about the vote, I saw that the voter turnout requirement was absurd (for an online vote on a single service like this) - so it was obviously a fake 'vote' Facebook didn't really want to happen. Just PR so they can say, "Well, regarding the privacy policy we did actually put it to a user vote."

This is the exact result it looked to me like they wanted.

The point was much more specific. He's saying the guy worked slowly, and everything he did took 2x the expected time.

If his rate was $100, it's really now $200. If $200, now $400. (For comparison with another remote worker who works at full speed.)

the actual rate (high or low) wasn't really the point. It wasn't a statement of whether it's expensive or cheap, just an observation that someone who works at $30 "twice as slow" (i.e. half expected speed) is equal - in terms of $/feature - to someone works at $60 at full speed on a like basis - even if that basis is also remote.

(Also, even though $/feature is the same between the two, it's worth bearing in mind that the cheaper guy still takes twice as many days.)

It is obvious what the author means by "unimportant" and they're very important things. Pure clickbait. It's like me writing an article, "work on the worst ideas you have". Care to click to find out what I mean by "worst"? Of course you do.

if it ever turns over, does all the air bubble out of it?

Sorry to hear what happened.

It's interesting that he was at a conference, presumably speaking about what he always speaks about.

This means his bag and things were to advance his mission, which is kind of to advance a 'commons'.

it nicely illustrate's RMS's philosophy (gpl). Even though he was speaking to advance the public good, a private enterprizer took his bag, removing it from the commons he worked so hard to advance.

RMS's philosophy, code, and bags require the protection of law.

The author really hasn't thought this through.

Here's an example of something unimportant: maybe Microsoft C, version 7, which was released in 1992, has a typo in a menu item that was never fixed. (The next version of the software was Microsoft Visual C++ version 1.0). True, nobody has used Microsoft C version 7 to compile a program in many years now, but - there you go. An unimportant problem.

That would be an example of an unimportant problem. Releasing a patch to fix the menu typo right in the binary would be an unimportant solution to an unimportant problem. Maybe if you take the time to release it, literally 0 people ever apply that patch from now until the end of time.

If you want to work on an "unimportant problem" fix bugs in software versions that were discontinued and which nobody used because of a quick migration to the next branch. Work on fixing Windows 2, maybe.

No, what the author really means is work on something very important, that doesn't evaluate as such to everyone, (or to the people you normally pay attention to). That, I can agree with.

what, "hard to get correct"? Are we talking about fundamental computer science that literally consists of implementing an algorithm made out of compare and swap/move elements...?

I can't imagine any sort algorithm for which it can possibly be legitimate to say it's 'hard to get correct' unless it's in the sentence 'it's hard for a first-year computer science student to get correct.'

i mean, what is more traditional and basic than implementing tricky sort algorithms?

you might also find my earlier comment relevant - http://news.ycombinator.com/item?id=3972595

I think that fake reviews (shilling) is a special class of problem. I don't believe it fits any of the normal categories of fraud (i.e. that's why I was happy it kind of was artificially added there) and yet I believe that what we lose by not regulating it is an important enough commons that it should be protected.

Fair enough. Though I do think that 10k is less of a sure thing than 8 million customers. The latter proves the model a lot more efficiently, and probably gives enough data for a better overview of the market.

In my example, you're actually asking the VC to speculate on what you say is the size of the market. Sure you can grow from 10k to 30k easily. The question is the size of the market you're trying to get them to invest into.

Whereas, at 8 million, the question is, do you really have a model that you've proven? Or, have you been spending more on getting the customers than you can ever hope to get from them? (wihout mentioning any names!)

If you're doing a good job being competitive and ensuring high customer satisfaction, it's hard to see how you can quickly grow organically from 8m to a size of market of 700m (say), if that is the size of your market, in just a couple of years.

I mean, you have to be providing these customers something, and at a competitive rate. that has to cost you money. no business just explodes without any marketing or other costs to a size of 700m (say). This is where VC money comes in.

in the concrete example of an 8million user organization, it would be impressive of them to get to 9m, 11m, 12.1m, 13.1m year-over-year all organically. It would be impressive of them to, profitably, get to 20m from 8m in 10 years, all organically.

If, however, the size of the market is more like 200m, this is a good place for VC money instead of that 10-year plan!! Especially if competition might end up better-funded.

(also see my cousin comment here - http://news.ycombinator.com/item?id=4085660)

sorry, I was not putting as much thought into the specific numbers as you are - or into my particular phrasing - I just tried to make the numbers round, specific, and illustrative. Use different numbers by all means.

I think it's fair to say you must spend something on customer acquisition and infrastructure to service them: it's impossible to spend $50,000, get to 10k customers, and not spend another nickel but three months later you have two hundred million of them. There are a lot of variable costs and acquisition costs, even though they get factored into your total expenditure.

I mean, what fixed costs does a 3-person startup actually have? 3 times 160 hours @ $0.00 per hour, i.e. the founders' time, sure, and then what? If you get to two hundred million customers, every item in your budget is much greater. I can't think of a single service that can get those customers for free, and on a paying-for-conversions rate a few bucks seemed realistic (rounded to factor in all your variable costs broken down to customers).

I think though that pretty much any numbers you pick you will see that if a startup is 'taking off' it needs more money to address the money left on the table (from the rest of its proven, addressable market) if they want to do it fast. (Whiile the iron is hot, while they have momentum and maybe press coverage, while they're young and hip and new, while market conditions don't change due to unforeseen external changes, and finally before well-funded competition arrives on the scene, including from big companies who will enter if the growth holds out. Big companies don't just enter any market that has 10k customers, they might not even do market research yet, which you already have. Etc etc etc.)

What startup can you think of in which if you bootstrap to $100,000 in revenue from 10k customers, and let's say miraculously have the complete $100,000 to spend, you can magically address the whole 600million person market your 10k customers are in by the end of the following year?

I think that's what I meant by the word 'all told' - factor in every cost into those 10k customers. (Except your fixed costs of 3 x 160 hours @ $0, of course! And a $10 domain name.)

I'm not spending a lot on this story or comments, only skimmed yours too (sorry) but I notice that you object to an emphasis on rote learning.

although it's nice to have history and background the truth is that the math that's most useful to us is pure rote - things like the multiplication table, adding and subtracting numbers.

when people go into a subject, like 3d game design, and 'wish they paid more attention in (that part of) math' they don't wish they had a finer appreciation for the background: they wish they would just know the formulas when they need them so they don't have to stop and think.

it's like logical arithmetic. if it's second nature to you you can refactor or's and and's and xor's and not's into and out of parentheses in code faster. who cares about the finer stuff behind it.

I am not saying this as someone who has a great deal of rote in me. But the part that I do have has served me well. I bet if I had been forced to memorize a 100*100 multiplication table and addition, and subtraction table (10,000 members each) and did my multiplication, division, addition, and subtraction, two digits at a time instead of how I do them (like everyone else) it would have served me quite well in life.

not saying that that's a good use of the precious little time kids have between 6 and 14, but just saying that rote is extremely useful for a lot of key things. set-theoretical logic, probably not so much.

because there are six hundred million people worldwide in your target audience, you have convinced 10,000 of them to pay you, and all told you need to spend $5 on a new customer, and make $10 from a customer in a year.

What, do you expect to grow organically from 10k users one year to 40k, then 160k, then 640k, and so on, hoping the market stays EXACTLY THE SAME FOR THE NEXT 8 YEARS? (Oh and you can't spend anything on development because you're rolling all the gross profit into reaching new customers.)

Or, you know, do you want to speed up the process and try to get as much of the six hundred million this year as you can, while the iron is hot - and stay ahead of your competition, who will be vc-backed?

There is no past for this type of thing. In 1857, 40,000 people could not sit in the woods of Russia and (potentially, just possibly) ruin worldwide communications, much of commerce, trade and banking, etc, for everyone just by invalidating some mathematics and sending a few letters out stating their findings - with no other direct or indirect manipulation of anything. That's what I meant by saying it's a "public good."

This is unprecedened. I chose $800B as an absurdly large sum that I believe is more than Academia would spend on this question in a few years. (I could be wrong though.)

Downvoter: I know you think it's not secure if a trillion dollars of research can break it - but guess what: there is a nonzero chance that between here and 800 billion dollars from here there is a quantum device. that doesn't mean it actually exists. it means it could exist if one of the world's biggest economies throws that much military R&D at it. I'm saying they shouldn't. at least, not with that goal (breakig crypto for everyone; quantum computing itself is a welcome advance). Please be more practical.

stupid.

"There were mathematicians doing new science to make Flame work."

the government thinks that this is just like normal weapons research.

what they don't realize is that "secure-enough" crypto is far more important to the world economy than their small use in breaking it.

if a government could spend $800B and prove/create a machine that makes asymmetric cryptography impossible - and will be reverse-engineered and known to the world within 3 years of when they start using it, they probably would.

meanwhile, the world loses a lot more than $800B if you can't do anything secure over the public Internet anymore, or have to have previously exchanged a one-time pad to anyone you want a secure connection with.

this isn't just another weapon. mathematics is a public good. Of course, if you can spend $800B on new math and then break it, then in some sense it was "always broken." In another sense, however, that's not true at all. Quit messing it up for everyone.

Sorry if this is a stupid question, but are these just slides without any voice or commentary?

Also, you might be interested in this video, http://www.youtube.com/watch?v=i6Fr65PFqfk "Why I hate Django" by Cal Henderson then of Flicker. 2008 though - I'd love to know about an update about the things addressed.

Could you summarize your suggested best practices (Specifically what you suggest is a good way to avoid at least some of the problems you list in your last sentence.)

Just a guess, but I'd think the most common cause of broken links is the original administrator retiring that whole branch of the site (or the site itself). Often the domain still works but that old stuff has been thrown away.

Often it's clear that what's there now is a lot better or more professional, so you can see why the person didn't feel like messing up the site with the old stuff - but that old stuff is still gone.

Other times the domain is gone, since the person or people have moved on to doing a lot better stuff and stopped maintaining that old site - "why bother." People change - a web site isn't something you publish once, it's something you publish every time your server answers an http request. Would you keep publishing everything you wrote 10 years ago?

But... a convenience to do what?

Sorry, I don't mean to be harsh, but this concept is pretty much dead on arrival.

"Check if your hash is still private and secure by sending us your hash."

Well, even if the hash was secure, it isn't now!

(Unless you:

O get the whole database into the client

O ask the user to:

o reload the URL in PRIVATE browsing mode

o DISCONNECT from the network

o test the results with javascript

o close the whole browser

o reopen the browser

o finally, clear flash cookies (how do I even do that?)

o Only then reconnect to the network

All to prevent you from either reading the results afterward or, as regards instructions to disconnect from the network, somehow changing or making a mistake in the javascript, perhaps after we or others have verified and ok'd it.)

If the only answer to the objection against giving you the hash is that you don't ask for the username, you might as well ask for the password plaintext.

Sorry, the concept is pretty much dead on arrival.

Still, way to ship. (or 'nice shipping.' Should be our secret handshake :). Good luck on the next concept.

well this coincides nicely the the confirmation that Stuxnet was state-sponsored. This is Google taking a stand. (Not against the creators of Stuxnet, just in general.)

And your objection to the OEM model?

I think facebook should charge 75 cents per month to use it.

This will weed out users who just don't care; it will give more information to advertisers as well.

Oh and what's that? 75 cents per month actually ends up tripling their income! (if they now get $9 per year off the seventy-five cents, plus the same four in ad revenue.)

Anyway if even 75 cents per month is too much, then they can go ahead and make OEM deals etc for a facebook sticker and do like Microsoft did. Or give it away with cans of coke. One in twenty wins a year of facebook.

Or, you know, do what people expect and roll into the price of a cell phone.

Just some thoughts...

This has to be one of the biggest leaps of logic I've ever seen in my life.

it's like, "Why I stopped working on crypography." sentences 1-5: author introduces the theory behind cryptography (interesting) sentence 6: he says he stopped working on it for ethical reasons (um, okay) sentence 7: because cryptography would prevent batman doing his detective work. (batshit insnae)

I thought the article was excellently written, one of the best, with clear screenshots and explanations of what he's doing. (I do code though.)

others here have easily replicated his procedure to compare with alternative ones (e.g. just based on the word 'password'), and attacked his methodology (he should have compared with twitter searches unrelated to the military to show what he's claiming, the effectiveness of targeted twitter searches).

this is great. it means his methodology is easy to understand/follow, to verify, attack/question, modify, and reproduce. it's extremely clear what he's doing, and what he's saying. what more could you ask?

I swear one day we will see.

"Unfortunately time and again we have come to observe the inability of employees to follow simple rules during password creation. For example, despite our warnings, employees often create a password containing more than one consecutive non-numeral; other employees attempt to createa a password consisting only of numbers, only of letters, or an insecure mix of numbers and letters - e.g. 5:1 - with no special characters.

This is unacceptable.

Henceforth, new passwords must be one of the following five possibilities, as described below:

s$sVC!{IV{wG:|9 (Employees with last name beginning with A-F)

bE#40,$&T@V}266 (Employees with last name beginning with G-L)

U>~7nw*,55{][%H (Employees with last name beginning with M-R)

EL8$v{4#L8482 5 (Employees with last name beginning with S-X)

or

1^_4s"x&T3pB,%% (All other employees).

You may not use a password you have ever used previously. In two weeks, the new possibilities will be posted to the web site, and you must change your password immediately to one of the new possibilities.

You have brought this on yourselves, and if you begin to show an ability to use secure passwords, you may get to pick your own in the future. Until then, they will be assigned to you.

HR."

Hi,

You might read this first:

http://news.ycombinator.com/item?id=4057912

you can reply to that as well here if you want.

I think we're in very general agreement. Although you yourself did not say "it is likely to fail" or "you should expect that it will fail", this is exactly the sentiment I was replying to was.

Regarding your "all hardware possibly failing" and the example of a starter motor to imply that I am trying to disappear a technical problem with a semantic argument, I think I am (especially in that cousin reply) being quite a bit more specific.

Basically, when it comes to safety mechanisms that exist as a layer on top of a process and aren't necessary at all, I simply shouldn't have to even think about reinventing another safety mechanism on top of the safety mechanism. Get one that isn't defective.

A hard-drive isn't defective just because it fails: it's expected to. A RAID controller is also expected to fail...JUST NOT SILENTLY.

In the seatbelt example: should you even think about having to tie your seatbelt to the buckle with sturdy rope, for real safety in case the seatbelt just doesn't buckle when it seems to, or comes undone like a ripped shirt button at the slightest firm tug?

No. You should get an actual seatbelt.

Basically, the standard you hold a control layer to is different from the standard you hold an underlying process to.

It would be like the difference between your brake failing and your (for added safety) handbreak failing, which you only engage on top of the motor's brake anyway. If the motor brake fails you would start rolling (if you're on a bit of an incline). But you shouldn't even have to think about a hand-brake 'just failing' in the same condition.

Sure it can fail if you are being towed without being lifted, or whatever, in an extreme situation. But in a normal situation?

Basically, it is a difference of both category/kind AND of degree.

I am certainly not saying that a parking brake can never fail. I am not saying a raid controller can never fail.

I am saying that both of these, when they are layers on top of a normal process, should be out of sight, below your threshold of having to control for it. If they're not, you need to get a different one.

You don't get six insurance policies against the same earthquake possibility, hoping that they won't ALL decide to out-lawyer you or go bankrupt. You get real insurance that's properly reinsured. Check up on them. Find a real one.

Raid failure is fine. Silent raid failure is not fine.

(checksum failure with an exception is fine; checksum failure with no exception, warning, or error, just a random checksum produced - or a check randomly passing when the checksum doesn't match the one you provided, is not okay. fix your checksum, get a real one - don't build another layer on top, for the cases that your checksum is a randomized print statement or your insurance policy a monthly donation from you to a non-charitable organization that puts aside a portion to out-lawyer you with if you try to make a claim, with the rest spent on advertising or being their profit. That's not an insurance policy, that's a scam.)

(potentially more interesting edit below, set off with ----)

1. general explanation

Guys, the key to understanding this article (in which the point was not mentioned very explicitly) is that in at least the American court system, jurors find facts, and the judge finds law. These two things are distinct. ("what happened"; "what is the legal implication.") Technically, Jurors don't need to know any law at all. Practically though, they need to know enough to decide how finely to slice the fact.

in other words, on some abstract level the jury doesn't even have to know what the law says; they only have to decide what happened. Practically though, for example in first, second, etc, degree murders, it's not enough information for the judge to hear "Yes, he killed the guy." The judge really needs to know the facts more precisely, i.e. compared with some definitions/demarcations the judge provides. (And which the jury frequently asks for clarifications on, so that they can report on their findings of what happened in terms of those definitions.)

This is also why sentencing is always done by the judge, not the jury: only the judge knows the law, the jury can only find facts.

it's also why "jury nulification" is kind of a hack of the system. If the jury doesn't like a marijuana ban, they can "nullify" by finding that despite the video tape of the guy smoking a joint, which is now in front of them, they find that the guy did not smoke pot. This supposedly circumvents a judge's ability to apply the law for it, since the jury says they find it didn't happen (wasn't proven.)

This is likewise kind of a "hack" in that the judge, knowing that the law is his to interpret, just told the jury the implication up-front, similarly as if they had heard that sentence after their verdict. But then he did not pass that sentence (actually make that interpretation of law).

This would be like telling the jury that if a bystander knowingly let you die (you're watching the case from the heavens - the bystander is on trial), that's manslaughter by negligence. The jury finds that the bystander was, in fact, guilty of negligent manslaughter for the reason of failing to rescue when he could and was in no danger.

Then the judge finds (which was his plan all along) that in the US there is 0 duty to rescue in this situation and the bystander is completely innocent of any negligence for not rescuing you, which he had no duty to do.

This way, according to the article, if another court disagrees with this interpretation of law, they already have the jury's findings and can just overturn the judge's interpretation.

----------------------------------

EDIT.

2. an interesting theory of the past few weeks' news.

I just thought of an interesting additional theory. The article says that both the Prosecution and Defense were OK with this approach. (Presumably, the prosecution, because that's what they were suing for in the first place, and the defense, because it thought the law was on its side and could appeal on those grounds if the judge actually sentenced per his request for the jury to assume). Now you remember how the jury was hung on whether it was 'fair use'? Given that neither defense nor prosecution tried to argue with the law, perhaps one or more members of the jury simply saw that this was a case of using copyright like a patent is normally to be used for - even though the judge told them to assume that it was copyright infringement if it happened in this case - and thought that it was therefore unfair and inappropriate. Even the defense didn't argue the point that it was not actually copyright infringement (we just found out why) so maybe one or more members of the jury said to themselves: Well, we are told to assume that this - mimicking work-alike functionality - is copyright infringement. But unless there's a patent, we just don't think it is! So, it HAS to be fair use.

If there were even a couple of jurors who were perplexed why the defense wasn't arguing that the work-alike functionality constituted copyright infringement, they might have been the ones who helped hang on whether this is fair use. The jury was perplexed, because they were given a definition of the law that is wrong!

It does show the danger of a judge taking this approach. (e.g. in my example in point 1, if a single juror knows that there's no duty to rescue in general, then maybe the jury will get hung on whether the 'negligent manslaughter' was in fact 'in self defense.' This is an ABSURD thing to actually get hung up on - but they are doing so (maybe, according to this theory of mine) because of the wrong reading of the law that they were given.)

So, with this interpretation, the past few weeks of this case are: "Jury finds bystander guilty of homocide for not helping! Jury still hung on whether homicide was in self-defense. (later..i.e. today.) Judge reveals that he told the jury to assume, in making their finding, that failing to rescue when this would pose no risk to the rescuer constituted negligent homocide, and that both the defense (sure of the actual law or grounds for appeal if this is the actual finding of law by the judge in the end) and prosecution went along with this.

If this theory is correct, it gives a VERY different reading to the way the jury acted and found. In fact, it paints them as downright reasonable, within the constraints of their (manipulative, hypothetical) instructions.

I don't think the opinion, as the other poster actually expressed it, is generic at all. Turn back a few years to the Google IPO and try to read the two sentences with the word "Google" (of the time) and see if either the first or second sentence still reads the same. Or pick another company of that period and try it.

The post just doesn't seem general enough to cover a different climate (which you might not have been active in, and which I personally hope we will return to eventually.)

That's all I have to say. I don't mind the current climate as much as the OP does. You're still free to disagree, but the sentiment as expressed is pretty clear and specific.

Still, glad you shared your thoughts.

Don't know why you're getting downvotes, I'd rather people reply to you as you're pretty specific.

Personally, I prefer SV when it's leaner. I'm actually working on a project that is actually innovative, and I'd much prefer to raise money later, hopefully when all this madness has dried up and VC's have time to evaluate something new.

The thing is, it's not a resume-sorting problem at all. Most people aren't even qualified to be who they are.

In general, people aren't qualified to do their jobs. That doesn't mean they shouldn't be doing them, or be hired to do them. It means the qualification system is broken.