strayptr

They need to take that money, break Yahoo up into pieces, sell it, and then whatever money they have they should fund 100,000 startups and see what rises from the ashes.

We're a little crazy. Think of the families of the people who work at Yahoo.

We're also a little overbearing. Who are we to say what others should do with what they own?

Actually not. Here are the rules for Show HN:

Be respectful. Anyone sharing work is making a contribution, however modest.

Ask questions out of curiosity. Don't cross-examine.

Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more.

When something isn't good, you needn't pretend that it is. But don't be gratuitously negative.

Calling someone's startup "headed for the deadpool" is the definition of gratuitously negative.

I prefer that they posted it as an HN comment. Scrolling isn't difficult, and mobile users rarely click on links. I probably wouldn't have read it if it was in a pastebin or linked to a source.

Has there been research into this? That's a really cool concept. It's something I'd like to look into, if anyone knows any references.

Civilizations that have (generally) destructive, punitive, insular, judging, self-righteous, and violent myths don't.

This seems to be the opposite of history. Until recently, violence was one of the only ways for any civilization to persist. The advent of nuclear weapons changed that somewhat (but not if civilizations begin to use them). And most of the myths of a civilization seem to be a byproduct of their actions.

The main problem is power. There's no way to project light into the retina without power, and it's difficult to get power to the lens without using wires. Induction is promising, but the falloff is dramatic. Meaning your inductive power generator would have to be pretty much on top of your eyes for it to power your contacts.

Glasses plus contacts might be a good idea. The generator could sit on the frames. The contacts would allow you to use a small amount of light to get the same effect as an Oculus, which means much smaller power requirements.

Still, to project light, you need some way of projecting light. It's hard to imagine something that can be embedded into a contact lens which is also transparent. And if it's not transparent, it's not really augmented reality.

Fun to imagine. Hopefully someone will come up with something.

Part of the appeal of FF7 is the soundtrack. Make that dynamic, and you would've ruined FF7.

It's a good idea that makes sense for a lot of games. Just pointing out a counterexample.

3 million dollars is nothing. It took a million dollars to make a single very low-quality video game, circa 2008. Salaries are expensive.

The investment model is set up to let founders "burn through" money while they explore new approaches to old industries. The investors don't really care that the money is lost. To be an investor, you have to assume 9 out of 10 of your investments will be write-offs.

So if you're not defending the investors' money, and if the founders are happy doing this, then why are you intentionally being harsh? Let them do their thing. Yeah they might fail, but so what? It's the only path to success.

It's not really productive to try to save people or companies via internet comments. You're more likely to demoralize them than to change their minds. Unfortunately, demoralization is often someone's hidden motive.

And I'm saying, yes, you're right. But have hope. That's something to watch out for going forward, but we can go forward.

This thread's article is interesting, because it's the first step toward a world you describe. But reason has a way of prevailing. Not always, but usually.

One thing that's missing now, that someone here might want to cook up, is a good explanation. The topic of crypto is difficult. Not just because it's hard like calculus, but because there are a lot of subtleties. Old analogies to locks and doors aren't really applicable. What we need is a way of highlighting what's going on, why people should care, and what they can do.

There are a variety of algorithms which are safe in a post-quantum crypto world. Developing and deploying them will take time, but they exist. Making them safe will take longer, but it will happen.

The threat you describe sounds like a race. But in fact, it's more like a switch. Right now the world is pre-quantum. When the switch is flipped, to post-quantum, a lot of algorithms will break. But not all of them.

See http://pqcrypto.org/ for some interesting reading.

Post-Quantum Cryptography, Bernstein, 2009: http://www.e-reading.club/bookreader.php/135832/Post_Quantum...

Regarding your point, I don't think that people here are being dismissive of your ideas. You're quite right. But there are reasons to be positive about the future, while highlighting the negatives. Isn't it so interesting that certain algorithms can be safe in a pqcrypto world?

Notice where the algorithms spring up from. You mention a hackathon, but that's not where these algorithms root. They're from universities. And universities are interesting. If the legislation will face resistance, it will probably be from academics, like in the last crypto war.

Thanks, that worked.

When I download the source and try to open index.html in Chrome, it doesn't work.

"Unhandled promise rejection DOMException: Failed to execute 'texImage2D' on 'WebGLRenderingContext': Tainted canvases may not be loaded."

Does anyone know how to get it working? Thanks!

If that's true, then it should be easy to name some startups that fell into technical mediocrity and recovered. Are there any?

I saw the opposite happen firsthand: a company that was about to get steamrolled by a competitor, and they knew it. There was nothing they could do, even though they had over two years to prepare. The reason they couldn't do anything was because their team was mediocre. Last I checked, that company no longer had any job listings.

How many people here have similar stories? It's tempting to believe that mediocre programmers can be mentored, but it doesn't seem that simple.

And yet, if you proceed as if it were correct, you'll be amazed at what you'll accomplish. The comment I was replying to was essentially asking, "What would've helped you back when you were in my position?" Ten out of ten times, I'd choose to tell myself, "Stop trying to read about how graphics engines work. Figure out how to get triangles up on the screen, without copying someone else."

The best I can say is that my career began from that method. And by asking a lot of questions on IRC.

Mmhm. As with everything, it's a balance. It's important to understand that reading is one of the most effective forms of procrastination that has ever been invented. It's also the prism through which your entire future passes, but everyone already knows that.

For example, Carmack was able to "invent" BSP because he was (as far as I've heard) an avid reader of medical journals. Specifically, journals and papers about the graphics techniques they used at the time. The field of medicine turns out to be very lucrative for an ambitious graphics programmer, because they're often at the frontiers of what's currently possible. So apparently BSP was used in accelerating medical renderings, and Carmack was able to see their potential for realtime graphics. The only reason he was able to do that was by reading pretty much every possible thing.

None of that will help you unless you force yourself to do and not read, though.

This domain is unique in that it's not a good idea to read. The most effective way to navigate this territory seems to be: Think of a simple goal, then force yourself to solve it. Don't look up how to solve it until you're so frustrated that you want to throw your monitor across your room.

Actionable advice: Set up a program such that you have an array of pixels. Say, 512x512. Now write a while loop which randomizes those pixels. Finally, figure out some way to "create a window and put those pixels on the screen."

You now have a game loop. This is roughly how every game works at a basic level.

The next step is to realize that a triangle is the fundamental way to draw shapes quickly. Want to draw a square? That's two triangles. Want to draw a humanoid? Sounds complicated, but artists approximate humanoids with a combination of spheres, cylinders, cubes, etc. And all of those can be divided up into triangles.

So a triangle is therefore the first place to start in understanding graphics in general. What's the goal? "Create a data structure to represent a triangle. Now try to draw a white triangle into your little pixel array."

It's going to be tough. But tough work is good. I remember how difficult it was for me to even get a basic white triangle up on the screen. But the rewards are worthwhile, because at this point a lot of other things will start to click. A "vertex buffer" will no longer be mysterious, for example, because you'll immediately see that your triangle structure (whatever you came up with) was really just "a vertex buffer with three vertices." And then you'll start to wonder why graphics programmers came up with such complicated words to describe such simple concepts...

At this point, you'll have the ability to go in one of two directions: "Notch" or "Carmack." It depends entirely on what you find interesting. If you like the idea of making games, concentrate on creating Pong. (You have everything you need, because you just got a triangle up on the screen, after all.) If you like more along the lines of what the article talks about, then concentrate on creating a software rasterizer. "Software rasterizer" is another one of those terms that turn out to sound scary, but is way easier than you'd expect. It's hard in the same way that learning to ride a bike is hard: it'll take awhile, but you'll never forget it. After that, nothing else you ever do (in graphics) will ever seem even slightly mysterious. I have some thoughts on how to learn the latter, if anyone's interested.

This is a great breakdown even for a novice who doesn't know much about how rendering engines typically function.

What would you like to know? I have some time, so if anyone was hoping to learn more about this, ask me.

When I targeted asm.js, the result wasn't much faster than plain js. Also, asm.js recently made it into Node, but Node doesn't tell you when your asm.js code is valid or not. And when it's invalid, it doesn't produce any errors.

I decided to check back in a couple years.

It's more common nowadays for an 18 year old to have 10 years of experience programming.

Certainly it's uncommon, but the set of all 18 year olds who've been programming for 10 years are a subset of those who'd benefit tremendously from a YC program for young adults. And YC has shown that even though money is a focus, it's not their primary focus.

Is there value in such a program? I think so. Even if the program serves as nothing more than a reminder to young people that there are those in the world who believe in them, it would be a win. Getting young people to consider "What are some strategies for me to change the world?" before "What type of job do I want?" might yield a better world.

Let's stop trashing on people's work.

The success of an endeavor is proportional to the number of shitty hacks that have come before it. Sometimes this it true in a literal sense -- sometimes a project consists of shitty hacks. But the astute reader will notice that a hack is only known to be shitty because someone did it, and had the courage to make their example public.

Do we reward their courage? No. We act like cliquish teenagers and rip them apart.

I don't mean to single you out. But this subthread consists of a developer at Amazon, an unknown, and a founder -- the very types of people I wanted to respect -- yet the content is little more than "Look at how stupid these people are." What kind of example are we setting here?

Be excited about X! Whether X is FOAM, Javascript, COBOL, C++, Python, Erlang, Scheme, NPM, ASDF, Vim, Stallman, or a song. Be happy. Be amused. Be anything but bitter.

In this instance, FOAM shows what's possible. Is it necessarily a good idea? Who cares! We've learned something new! Be excited!

How certain are you that an idea that strikes you as bad is actually bad? For every possible circumstance? What about with a slight tweak? In fact, "An idea that seems bad" is the short definition of "startup."

Most ideas that seem bad are, in fact, bad. But it's important to fully explore the problem space before dismissing them, else you'll dismiss Facebook.

This subthread is about a software technique, not a startup idea. But is it really such a different domain? Would the idea of Python have survived if it had been introduced in the era of Multics? It wasn't a compiled language, so it couldn't hope to survive back then. Yet its time was coming, whether or not it would have been dismissed at the time.

"Under what circumstances could this be a good idea?" That's the valuable question. And if you also have a good answer to "Why now?" then you may be onto something. In fact, you might be one of the first people to notice that an idea has flipped from bad to good. Seems like a pretty powerful position.

It seems like most influential work started as a hack. (TeX is a notable exception.) So if you want to do influential work, be delighted by hacks. It'll make them easier to explore, and you might end up in a position few others realize is valuable.

MD5 is is broken and should not be used for anything anymore.

Actually, HMAC-MD5 is secure.

I'm not sure if the elites of HN have spent much time among today's average youth, but they certainly aren't learning a common memetic foundation. They barely graduate from high school. And in fact, the average youth are what drag down today's achievers. The achievers are made to feel there's something wrong with them, and that it's a sin against the collective to try to be better than average.

Yet averages are precisely the problem. You throw your achievers together with the average, giving them nowhere to go and no outlets to explore. Programming is one of the few outlets, as it isn't compulsory, yet here we're talking about ripping that one away too.

I figured out what the original comment reminded me of:

https://www.maa.org/external_archive/devlin/LockhartsLament....

"We are helping our students become more competitive in an increasingly sound-filled world."

unless I'm pursuing engineering or some computation-heavy career, when will I need to care about calculus? Or for that matter, why ever learn about cell biology in elementary school? Not everyone is going to be a geneticist, and most pharma patents are completely off limits, so why bother?

Agreed. Why bother? In fact, forcing children to learn these topics often harms them so irreparably that they not only don't retain the knowledge, but can't bring themselves to be interested later in life.

Make it optional. Make the topics available for children who want to know. Make it self-selected, just like every other aspect in life.

This might be true for individual creators, but ad revenue powers companies. Can Patreon do that?

(It's still an important point for individuals though.)

It's sort of interesting that the inescapable conclusion is that VC funds power tech. What I mean is, if a business isn't sustainable, and the fact that they're sustainable doesn't matter, then it's thanks to the VC funds.

If you want to affect the world through business, the type of business you'll start is a startup. Counter-intuitively, it may be true that sustainability doesn't necessarily matter for a startup. If so, then sustainability in business doesn't matter for affecting the world.

That seems like dangerous thinking, and I've been trying to escape the conclusion. But since the home runs are how VCs make their returns, why is it a bad thing if 9 out of 10 startups eventually fail? And if it's not a bad thing, then why decry companies for being unsustainable, or the valley for funding them?

How expensive would an application like this be? I don't know much about this, but I'd like to learn.

What's an algorithm for figuring out a pretty good guess of any random application's hosting costs? Also, is there a way to figure out how large the expenses could become over time? Is there some way to relate number of users to cost?

There's no upper bound for how much money one could spend, but let's use the midpoint between "extremely frugal" and "money isn't really a concern."

Fascinating. May I ask, how does one predict the behavior of an electron without using probability amplitudes?

I'm extremely interested, and the question isn't meant as anything but an inquiry. Finding a gap in one's knowledge is one of the more exciting aspects of life.

The article is a filtered version of Hawking's words, which themselves were probably a filtered version of his research. The parent commenter was talking about the quality of the article.

There's no basis to attack Hawking or anyone else. Even the article's author should be relatively immune, because WaPo isn't in the business of writing scientific articles.

If you insist on attacking, then let's aim for the central argument. For example, a decent attack on Einstein in the 1940s would be to remark that if quantum electrodynamics agrees with experiment, then Einstein's goal -- to demonstrate that probability wasn't a fundamental component of the universe -- would be in trouble.

An excellent attack would be to cite the research, and to explain why if X is true then @physicist is wrong.

Are you sure that being mistaken is such a terrible thing? The mistakes are often more illuminating than the discoveries, as they provide a framework upon which to learn how to improve the process of discovery.

Does it cost $150k/yr to hire someone you're paying $75k/yr?

I've heard the fully-loaded cost of an employee is about 2x their salary, but I'm interested to know what the fully-loaded cost of a startup employee is. At the minimum, an employer would probably need to pay for health insurance, for example. Even if the benefits aren't very good, the cost is higher than someone's salary.

The article says the cost with overhead is 1.25x, but is that realistic?

After their weeklong "penetration test" concluded, I found some serious XSS (public user->admin, which could easily turn into system takeover) with about 5 minutes of looking. Are most audits this useless?

Hiya! I started at Matasano/NCC back in February. Part of the reason I joined was to find out whether or not everything tptacek has been saying for years is true. Turns out it's pretty much all true. Some of that is awesome, like the hiring process. Some of that is scary, like the fact that someone of moderate skill level can usually break into most production apps.

My experience is limited. That said, put me on an audit and the first thing I'll check for is XSS and SQLi. The second thing I'll check for is authz: log into an admin account, note a URL to perform an admin action, log in as a normal user, try to access that URL. Third thing I'll check for is if there are any upload forms, because that's a common way to get RCE: upload a file and try to trick the app into executing it. Etc. Stuff that matters.

It's a point of pride to ensure that our assigned app has been pentested thoroughly by the conclusion of an audit. A thorough pentest doesn't necessarily mean finding every possible vulnerability, because time is often limited, but it does mean finding the serious ones.

If we include any findings in the final report which could be called "trivial" (there are occasionally some), they're marked as informational findings, i.e. their severity level is less than low. The reason we include them is because even though the finding doesn't necessarily pose any security risk, a client will often get another pentest from another security firm and diff the results. If the other firm points out something we thought was too trivial to include, the client will rightfully ask why we didn't find it. (We try to be pretty clear in the report about each finding, though, so you're not going to come away with the impression that we're saying you need to address something trivial.)

I don't know enough about your experience with that security firm you worked with to comment directly, but communication is one of the most important aspects of the job. If we find some flaws but don't communicate well to the client, then nobody was served by the audit. So if you're feeling like the whole process was a waste of time, you might want to shop around. There are several good security firms, not just Matasano/NCC, so you may want to give it another shot.

For what it's worth, the fact that you had a bad experience with one of the firms is actually painful to me. It's only recently that people started to care about security in a significant way, and it's a tenuous position. The more people who get a "security audit" and end up feeling like it was a waste of time, the more likely we are to end up back in a situation where people know there are probably serious security problems but feel like there's nothing they can do to find or fix them. There is: Give us a test environment and two weeks. We'll find what matters, and we'll give you a report explaining each issue and how to fix them.