strayptr

We're a little crazy. Think of the families of the people who work at Yahoo.

We're also a little overbearing. Who are we to say what others should do with what they own?

Be respectful. Anyone sharing work is making a contribution, however modest.

Ask questions out of curiosity. Don't cross-examine.

Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more.

When something isn't good, you needn't pretend that it is. But don't be gratuitously negative.

Calling someone's startup "headed for the deadpool" is the definition of gratuitously negative.

This seems to be the opposite of history. Until recently, violence was one of the only ways for any civilization to persist. The advent of nuclear weapons changed that somewhat (but not if civilizations begin to use them). And most of the myths of a civilization seem to be a byproduct of their actions.

Glasses plus contacts might be a good idea. The generator could sit on the frames. The contacts would allow you to use a small amount of light to get the same effect as an Oculus, which means much smaller power requirements.

Still, to project light, you need some way of projecting light. It's hard to imagine something that can be embedded into a contact lens which is also transparent. And if it's not transparent, it's not really augmented reality.

Fun to imagine. Hopefully someone will come up with something.

It's a good idea that makes sense for a lot of games. Just pointing out a counterexample.

The investment model is set up to let founders "burn through" money while they explore new approaches to old industries. The investors don't really care that the money is lost. To be an investor, you have to assume 9 out of 10 of your investments will be write-offs.

So if you're not defending the investors' money, and if the founders are happy doing this, then why are you intentionally being harsh? Let them do their thing. Yeah they might fail, but so what? It's the only path to success.

It's not really productive to try to save people or companies via internet comments. You're more likely to demoralize them than to change their minds. Unfortunately, demoralization is often someone's hidden motive.

This thread's article is interesting, because it's the first step toward a world you describe. But reason has a way of prevailing. Not always, but usually.

One thing that's missing now, that someone here might want to cook up, is a good explanation. The topic of crypto is difficult. Not just because it's hard like calculus, but because there are a lot of subtleties. Old analogies to locks and doors aren't really applicable. What we need is a way of highlighting what's going on, why people should care, and what they can do.

The threat you describe sounds like a race. But in fact, it's more like a switch. Right now the world is pre-quantum. When the switch is flipped, to post-quantum, a lot of algorithms will break. But not all of them.

See http://pqcrypto.org/ for some interesting reading.

Post-Quantum Cryptography, Bernstein, 2009: http://www.e-reading.club/bookreader.php/135832/Post_Quantum...

Regarding your point, I don't think that people here are being dismissive of your ideas. You're quite right. But there are reasons to be positive about the future, while highlighting the negatives. Isn't it so interesting that certain algorithms can be safe in a pqcrypto world?

Notice where the algorithms spring up from. You mention a hackathon, but that's not where these algorithms root. They're from universities. And universities are interesting. If the legislation will face resistance, it will probably be from academics, like in the last crypto war.

"Unhandled promise rejection DOMException: Failed to execute 'texImage2D' on 'WebGLRenderingContext': Tainted canvases may not be loaded."

Does anyone know how to get it working? Thanks!

I saw the opposite happen firsthand: a company that was about to get steamrolled by a competitor, and they knew it. There was nothing they could do, even though they had over two years to prepare. The reason they couldn't do anything was because their team was mediocre. Last I checked, that company no longer had any job listings.

How many people here have similar stories? It's tempting to believe that mediocre programmers can be mentored, but it doesn't seem that simple.

The best I can say is that my career began from that method. And by asking a lot of questions on IRC.

For example, Carmack was able to "invent" BSP because he was (as far as I've heard) an avid reader of medical journals. Specifically, journals and papers about the graphics techniques they used at the time. The field of medicine turns out to be very lucrative for an ambitious graphics programmer, because they're often at the frontiers of what's currently possible. So apparently BSP was used in accelerating medical renderings, and Carmack was able to see their potential for realtime graphics. The only reason he was able to do that was by reading pretty much every possible thing.

None of that will help you unless you force yourself to do and not read, though.

Actionable advice: Set up a program such that you have an array of pixels. Say, 512x512. Now write a while loop which randomizes those pixels. Finally, figure out some way to "create a window and put those pixels on the screen."

You now have a game loop. This is roughly how every game works at a basic level.

The next step is to realize that a triangle is the fundamental way to draw shapes quickly. Want to draw a square? That's two triangles. Want to draw a humanoid? Sounds complicated, but artists approximate humanoids with a combination of spheres, cylinders, cubes, etc. And all of those can be divided up into triangles.

So a triangle is therefore the first place to start in understanding graphics in general. What's the goal? "Create a data structure to represent a triangle. Now try to draw a white triangle into your little pixel array."

It's going to be tough. But tough work is good. I remember how difficult it was for me to even get a basic white triangle up on the screen. But the rewards are worthwhile, because at this point a lot of other things will start to click. A "vertex buffer" will no longer be mysterious, for example, because you'll immediately see that your triangle structure (whatever you came up with) was really just "a vertex buffer with three vertices." And then you'll start to wonder why graphics programmers came up with such complicated words to describe such simple concepts...

At this point, you'll have the ability to go in one of two directions: "Notch" or "Carmack." It depends entirely on what you find interesting. If you like the idea of making games, concentrate on creating Pong. (You have everything you need, because you just got a triangle up on the screen, after all.) If you like more along the lines of what the article talks about, then concentrate on creating a software rasterizer. "Software rasterizer" is another one of those terms that turn out to sound scary, but is way easier than you'd expect. It's hard in the same way that learning to ride a bike is hard: it'll take awhile, but you'll never forget it. After that, nothing else you ever do (in graphics) will ever seem even slightly mysterious. I have some thoughts on how to learn the latter, if anyone's interested.

What would you like to know? I have some time, so if anyone was hoping to learn more about this, ask me.

I decided to check back in a couple years.

Certainly it's uncommon, but the set of all 18 year olds who've been programming for 10 years are a subset of those who'd benefit tremendously from a YC program for young adults. And YC has shown that even though money is a focus, it's not their primary focus.

Is there value in such a program? I think so. Even if the program serves as nothing more than a reminder to young people that there are those in the world who believe in them, it would be a win. Getting young people to consider "What are some strategies for me to change the world?" before "What type of job do I want?" might yield a better world.

The success of an endeavor is proportional to the number of shitty hacks that have come before it. Sometimes this it true in a literal sense -- sometimes a project consists of shitty hacks. But the astute reader will notice that a hack is only known to be shitty because someone did it, and had the courage to make their example public.

Do we reward their courage? No. We act like cliquish teenagers and rip them apart.

I don't mean to single you out. But this subthread consists of a developer at Amazon, an unknown, and a founder -- the very types of people I wanted to respect -- yet the content is little more than "Look at how stupid these people are." What kind of example are we setting here?

Be excited about X! Whether X is FOAM, Javascript, COBOL, C++, Python, Erlang, Scheme, NPM, ASDF, Vim, Stallman, or a song. Be happy. Be amused. Be anything but bitter.

In this instance, FOAM shows what's possible. Is it necessarily a good idea? Who cares! We've learned something new! Be excited!

How certain are you that an idea that strikes you as bad is actually bad? For every possible circumstance? What about with a slight tweak? In fact, "An idea that seems bad" is the short definition of "startup."

Most ideas that seem bad are, in fact, bad. But it's important to fully explore the problem space before dismissing them, else you'll dismiss Facebook.

This subthread is about a software technique, not a startup idea. But is it really such a different domain? Would the idea of Python have survived if it had been introduced in the era of Multics? It wasn't a compiled language, so it couldn't hope to survive back then. Yet its time was coming, whether or not it would have been dismissed at the time.

"Under what circumstances could this be a good idea?" That's the valuable question. And if you also have a good answer to "Why now?" then you may be onto something. In fact, you might be one of the first people to notice that an idea has flipped from bad to good. Seems like a pretty powerful position.

It seems like most influential work started as a hack. (TeX is a notable exception.) So if you want to do influential work, be delighted by hacks. It'll make them easier to explore, and you might end up in a position few others realize is valuable.

Actually, HMAC-MD5 is secure.

Yet averages are precisely the problem. You throw your achievers together with the average, giving them nowhere to go and no outlets to explore. Programming is one of the few outlets, as it isn't compulsory, yet here we're talking about ripping that one away too.

I figured out what the original comment reminded me of:

https://www.maa.org/external_archive/devlin/LockhartsLament....

"We are helping our students become more competitive in an increasingly sound-filled world."

Agreed. Why bother? In fact, forcing children to learn these topics often harms them so irreparably that they not only don't retain the knowledge, but can't bring themselves to be interested later in life.

Make it optional. Make the topics available for children who want to know. Make it self-selected, just like every other aspect in life.

(It's still an important point for individuals though.)

If you want to affect the world through business, the type of business you'll start is a startup. Counter-intuitively, it may be true that sustainability doesn't necessarily matter for a startup. If so, then sustainability in business doesn't matter for affecting the world.

That seems like dangerous thinking, and I've been trying to escape the conclusion. But since the home runs are how VCs make their returns, why is it a bad thing if 9 out of 10 startups eventually fail? And if it's not a bad thing, then why decry companies for being unsustainable, or the valley for funding them?

What's an algorithm for figuring out a pretty good guess of any random application's hosting costs? Also, is there a way to figure out how large the expenses could become over time? Is there some way to relate number of users to cost?

There's no upper bound for how much money one could spend, but let's use the midpoint between "extremely frugal" and "money isn't really a concern."

I'm extremely interested, and the question isn't meant as anything but an inquiry. Finding a gap in one's knowledge is one of the more exciting aspects of life.

There's no basis to attack Hawking or anyone else. Even the article's author should be relatively immune, because WaPo isn't in the business of writing scientific articles.

If you insist on attacking, then let's aim for the central argument. For example, a decent attack on Einstein in the 1940s would be to remark that if quantum electrodynamics agrees with experiment, then Einstein's goal -- to demonstrate that probability wasn't a fundamental component of the universe -- would be in trouble.

An excellent attack would be to cite the research, and to explain why if X is true then @physicist is wrong.

Are you sure that being mistaken is such a terrible thing? The mistakes are often more illuminating than the discoveries, as they provide a framework upon which to learn how to improve the process of discovery.

I've heard the fully-loaded cost of an employee is about 2x their salary, but I'm interested to know what the fully-loaded cost of a startup employee is. At the minimum, an employer would probably need to pay for health insurance, for example. Even if the benefits aren't very good, the cost is higher than someone's salary.

The article says the cost with overhead is 1.25x, but is that realistic?

Hiya! I started at Matasano/NCC back in February. Part of the reason I joined was to find out whether or not everything tptacek has been saying for years is true. Turns out it's pretty much all true. Some of that is awesome, like the hiring process. Some of that is scary, like the fact that someone of moderate skill level can usually break into most production apps.

My experience is limited. That said, put me on an audit and the first thing I'll check for is XSS and SQLi. The second thing I'll check for is authz: log into an admin account, note a URL to perform an admin action, log in as a normal user, try to access that URL. Third thing I'll check for is if there are any upload forms, because that's a common way to get RCE: upload a file and try to trick the app into executing it. Etc. Stuff that matters.

It's a point of pride to ensure that our assigned app has been pentested thoroughly by the conclusion of an audit. A thorough pentest doesn't necessarily mean finding every possible vulnerability, because time is often limited, but it does mean finding the serious ones.

If we include any findings in the final report which could be called "trivial" (there are occasionally some), they're marked as informational findings, i.e. their severity level is less than low. The reason we include them is because even though the finding doesn't necessarily pose any security risk, a client will often get another pentest from another security firm and diff the results. If the other firm points out something we thought was too trivial to include, the client will rightfully ask why we didn't find it. (We try to be pretty clear in the report about each finding, though, so you're not going to come away with the impression that we're saying you need to address something trivial.)

I don't know enough about your experience with that security firm you worked with to comment directly, but communication is one of the most important aspects of the job. If we find some flaws but don't communicate well to the client, then nobody was served by the audit. So if you're feeling like the whole process was a waste of time, you might want to shop around. There are several good security firms, not just Matasano/NCC, so you may want to give it another shot.

For what it's worth, the fact that you had a bad experience with one of the firms is actually painful to me. It's only recently that people started to care about security in a significant way, and it's a tenuous position. The more people who get a "security audit" and end up feeling like it was a waste of time, the more likely we are to end up back in a situation where people know there are probably serious security problems but feel like there's nothing they can do to find or fix them. There is: Give us a test environment and two weeks. We'll find what matters, and we'll give you a report explaining each issue and how to fix them.