Usql – A Universal CLI for Databases - <AUTHOR> https://github.com/xo/usql <comment><USER2> I was really hoping for \dt but looks like they haven't implemented it yet. The number one most common thing I look up when I'm using a SQL variant is how to show the tables. I suppose there would be complications with NoSQL but you could just show available collections or whatever else it maps to in that case.

<comment><USER3> Yes, and since "show the tables" isn't in SQL itself, each CLI ends up having a different command for doing it, which makes a universal CLI appealing to me... if it can do that.

<comment><USER4> > since "show the tables" isn't in SQL itself,

Actually

        SELECT table_name FROM information_schedule.tables;

But yes, that's harder to type/remember than \d.

<comment><USER2> Does that really work for every version of SQL? This might change my life.

<comment><USER5> information_schema (not "schedule"; GP had a typo in the query) is part of the ANSI SQL standard[1] so should work with any database that implements the ANSI standard. Note that not all databases or SQL dialects comply with this.

[1] [https://en.wikipedia.org/wiki/Information_schema](https://en.wikipedia.org/wiki/Information_schema)

<comment><USER4> Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER6> I have been looking for a faster alternative to pgcli [1] ( with features like auto-complete for table names and columns) and was getting excited.

Sadly this is "just" a plain old CLI.

Also: had to install with `go get -tags "no_sqlite3" -u github.com/xo/usql` since the sqlite3 package did not build.

[1] [https://www.pgcli.com/](https://www.pgcli.com/)

<comment><USER7> It's at a disadvantage vs pgcli and mycli because they're in Python and have access to the excellent Prompt Toolkit (which also powers ipython), while usql is in Go.

I started using mycli recently and it actually made me joyful about how good it was. DBeaver is really good but for most things I'd prefer a cli, and the autocomplete actually makes it faster to use for many things.

<comment><USER8> I've not used Prompt Toolkit (or usql) but am very interested in making better cli, what makes Prompt Toolkit so good?

<comment><USER7> Here's a presentation at PyCon 2017 by the author of pgcli and mycli that's a great answer to your question:

[https://www.youtube.com/watch?v=hJhZhLg3obk](https://www.youtube.com/watch?v=hJhZhLg3obk)

<comment><USER8> That was really interesting and fired my imagination! Thanks.

</comment></comment></comment></comment></comment><comment><USER9> ... not to be confused with ... U-SQL

[https://docs.microsoft.com/en-us/u-sql/](https://docs.microsoft.com/en- us/u-sql/)

<comment><USER10> We had one of those too: [https://news.ycombinator.com/item?id=10301147](https://news.ycombinator.com/item?id=10301147)

</comment></comment><comment><USER11> The universal CLI for my preferred database is `dig` if you're old-school, `drill` if you're not.

Some may argue that DNS isn't really a database, but by that metric, neither is Redis.

</comment><comment><USER10> Related from last year: [https://news.ycombinator.com/item?id=17310568](https://news.ycombinator.com/item?id=17310568)

and [https://news.ycombinator.com/item?id=17299356](https://news.ycombinator.com/item?id=17299356).

2017: [https://news.ycombinator.com/item?id=13780587](https://news.ycombinator.com/item?id=13780587)

<comment><USER12> Do you do that by memory? Or do you have some text indexing tool that helps?

<comment><USER10> I use HN Search, which is linked from the bottom of most HN pages. That's definitely a text indexing tool that helps! The search company Algolia provides it for free—a major service to this community, because not only does it help users find things, we rely on it heavily for all kinds of moderation tasks.

It's particularly helpful to include "comments > N" or "points > N" if looking for old threads.

</comment></comment></comment><comment><USER13> Awesome project! Having unified tools is a boon for those of us who work across many different dialects.

One piece of feedback though - I've never been a huge fan of using backslashes for anything that isn't escaping as it can get confusing to know when it's escaping or if it's syntactic (do I use two slashes here? Or three or four? Especially when piping input or putting stuff in text files).

Very cool though and will be keeping an eye on it!

<comment><USER14> If you're interested in this sort of thing, it's worth checking out [https://drill.apache.org/](https://drill.apache.org/)

It lets you query multiple databases but also join between them. Or say, translate your mysql table to a local csv file. And if you need it to be faster you can deploy to hadoop.

worth checking out anyway, I used to use it a lot before i started on Apache Spark.

</comment></comment><comment><USER15> If you like this, check out OctoSQL.

It not only presents a SQL interface to sql databases, NoSQL databases and files (Excel, csv, json for now), but also lets you join data between them and use multiple databases at once in queries.

Though it's definitely in an earlier stage and maturity than this, with fewer supported databases. (Though we do support redis for instance, which this does not)

<comment><USER15> The forgotten link: [https://github.com/cube2222/octosql/](https://github.com/cube2222/octosql/)

</comment></comment><comment><USER16> How come a standard (network) protocol for SQL RDBMS'es never came to be? Sort of JDBC, but based on TCP (HTTP?) not Java.

<comment><USER17> Because once you get beyond select and where clauses database diverge a lot in capabilities and syntax. If all you want is a common interface to send arbitrary text to an arbitrary RDBMS then ODBC mostly solves this.</comment></comment>


Burning Out - <AUTHOR> http://robertbanh.com/

<comment><USER2> It sucks to be at that stage, but well said. I hope you find some rest and can downshift into normal life for a while.</comment>


Google's "Chrome Frame" plugin for IE no longer requires admin rights - <AUTHOR> http://blog.chromium.org/2011/06/introducing-non-admin-chrome-frame.html <comment><USER2> Yay for clever technical hacks that help users circumvent ossified IT bureaucracy. But I'm a little astonished that this is possible. They're running a second process that detects new instances of IE starting up and injects Chrome Frame into them. Doesn't that make a mockery of "admin rights"? Couldn't this technique be used to do just about anything?

<comment><USER3> No. A bunch of windows processes typically run under users other than the current user, and at higher integrity levels, specifically to prevent this.

IE is also _intentionally_ run as the current user at a low privilege level, which makes it possible to do things like this to the IE process, but makes it impossible for the IE process to do things like this to other programs.

</comment></comment><comment><USER4> Can you get Chrome itself without admin rights? That would probably be as beneficial or more for circumventing draconian (and short-sighted) IT policies.

<comment><USER5> Yes, it is possible to install Google Chrome without having local administrator rights. It installs itself into the user's "Application Data" folder. A user cannot set it as the default browser without having local admin, however.

If an administrator installs the "multiple user" version of Chrome on the computer (which is installed in the "Program Files" folder as per a normal app), the next time a user runs their "single user" version of Chrome it will display a message that the multiple user version has been installed and their single user application is uninstalled.

References: [http://www.google.com/support/forum/p/Chrome/thread?tid=31d0...](http://www.google.com/support/forum/p/Chrome/thread?tid=31d02264c4184298&hl=en) [http://www.google.com/support/chrome/bin/answer.py?answer=11...](http://www.google.com/support/chrome/bin/answer.py?answer=118663)

</comment></comment><comment><USER6> "Awesome! Do you have any stats on how many people have installed Chrome Frame?"

I found this question interesting, does anyone know of any viable source for this kind statistics? Is the user-agent for chrome frame distinguishable?

Edit: Found the user-agent from the dev docs; "GCF reports that it is available by extending the host's User-Agent header with the string chromeframe"

</comment><comment><USER7> Has anyone experienced any problems enabling chrome frame on a large scale web app? Any resistance from users when prompted to install Chrome Frame?

</comment><comment><USER8> Nice to see a bit more of the tech behind how they did it, albeit it's admittedly not much.

Side note, from their FAQs:

 _Is Google Chrome Frame open-source?

Google Chrome Frame is built from open source code in the Chromium project just like Google Chrome._

Does this sound like a non-answer to anyone else, or is it just me?

<comment><USER9> Not really. You can view the source code for both Chrome, Chrome OS and Chrome Frame in their repo: [http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame...](http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame/)

As a side note, after having looked at the code for a few minutes, it appears they're doing some clever things with the Chrome Frame helper program: (tidy) DLL injection into Internet Explorer, together with dynamic BHO loading using the windowing API and the IWebBrowser2 interface (see [http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame...](http://src.chromium.org/viewvc/chrome/trunk/src/chrome_frame/bho_loader.cc?revision=87033&view=markup) ).

The "right" way to do this is to register your BHO dll through regsvr32 (I believe this creates a registry entry as well.) If you have Administrative rights, the installer does this for you, and Internet Explorer will do everything on its own from there on.

It surprises me that their workaround actually works. One would think that aspects such as DLL injection and API interfacing would be blocked for non- administrative users. The code could actually prove inspirational for malware writers. I still wonder how they load the helper program at startup. Probably using a service, but setting a new service would require Administrative privileges, I believe...

<comment><USER3> Restricting DLL injection and 'API interfacing' (if that's even a thing) to administrative users would provide no security benefit. People would just have to run as admin. DLL injection is used all over in windows to provide useful features like alternate input methods, icon overlays in explorer, etc. You aren't allowed to inject DLLs into processes owned by other users or processes of higher integrity level, so it's not really a significant security threat under the current windows model. IIRC Chrome and IE both run their processes at low integrity so those processes won't even be able to inject DLLs into other processes unless those other processes are also low integrity.

<comment><USER9> Ah, thanks for the clarification. "API interfacing" was formulated a bit quickly (then again, don't you interface with an interface?) -- perhaps I should have said "using API's".

</comment></comment></comment></comment><comment><USER10> Old news init? Thought this was announced at IO a month or so back.

<comment><USER11> Announced at IO. Releasing now.

</comment></comment><comment><USER12> Google announced this recently during Google I/O.</comment>


Why people say NO when you ask for informational interviews or mentoring - <AUTHOR> http://www.noshortageofwork.com/pages/499

<comment><AUTHOR> I like helping people a lot but not so much if they are only trying to help themselves.

In 2004 I changed how I hire people and you folks discussed that (see: [http://www.slideshare.net/BrookeAllen1/brooke-allen-has-a- be...](http://www.slideshare.net/BrookeAllen1/brooke-allen-has-a-better-way- of-hiringP))

Since then I've become more public about how the job market is broken and how it might get fixed.

A year ago when I retired from Wall Street finding ways of improving the market for work has become a major passion project of mine. I have connected with many people and helped them change how they hire or helped them with an article or blog post they are writing.

But one downside is that I often get requests from total strangers to help them get a job and - to be frank - I find these requests a imposition.

I did not understand why I felt this way until reading this piece by Nick Corcodilos.

Brooke (BrookeAllen.com)

<comment><USER2> I agree that unsolicited requests are an imposition because there is no exchange of value. Whether or not it is a veiled job interview, for someone to ask for advice/time from someone else without even trying to first develop some kind of relationship is asking for something of value without offering anything in return.</comment></comment>


Ask HN: How to Get Good at Algorithm Design? - <AUTHOR> I have been trying my luck with CLRS, some Skienna, Leetcode and HackerRank.  I have gotten a bit better at it, but nowhere near where I could come up with a brand new algorithm.  Any pointers what I may be missing?  Is it Math?  More practice?  I really want to get good at it.  My real interest is in Scientific Computing, but that's for another day. <comment><USER2> If you want practice, _Algorithm Design_ , by Jon Kleinberg and Éva Tardos has 200+ problems to design for, with walk through solutions to many of them. The problems are all class-tested in homework or exams by students at Cornell. _Algorithms: Parallel and Sequential_ book by Umut A. Acar and Guy E. Blelloch walks through many of the same undergrad algorithmic techniques finding opportunities to split up the work, chap3 walks through genome sequencing methods for example [http://www.parallel-algorithms- book.com/](http://www.parallel-algorithms-book.com/)

 _The Design and Analysis of Algorithms_ , by Dexter Kozen is 40 self contained lectures, introduces theory I didn't read in the other books, and his analysis walk throughs are well written. It's much more definition->lemma->theorem style but if you know set theory and familiar with graphs, trees, DAGs from the CLRS book you can understand most of the lectures.

</comment><comment><USER3> Designing novel algorithms is very hard. You can borrow some ideas from the existing literature, but you have to figure out how to apply them to your problem and that can take some nontrivial inspiration.

I have one paper with a few new algorithms in it and that took me several years to write in grad school. The algorithms themselves aren't that complicated, but the concepts and theorems we had to come up with to support them required some genuine insight.

</comment><comment><USER4> A brand new algorithm as in an algorithm to solve a common problem that has never been invented or an algorithm that solves it faster than known algorithms?

</comment><comment><USER5> Try projecteuler.net.

There are some pretty great problems in there and your solutions might be novel.

<comment><USER6> Be forewarned that once you get up into about the triple digits, it starts becoming less about algorithmics and more about how much math (particularly number theory) you know or can pick up while working on the problem. Easy to get rabbit holed.

</comment></comment><comment><USER7> By studying and applying existing algorithms a lot, you start noticing patterns. CLRS goes into general concepts such as divide&conquer, dynamic programming etc.</comment>


40,000-year-old jawbone reveals early modern humans interbred with Neandertals - <AUTHOR> http://phys.org/news/2015-06-genetic-analysis-year-old-jawbone-reveals.html

<comment><AUTHOR> The actual article title is:

"Genetic analysis of 40,000-year-old jawbone reveals early modern humans interbred with Neandertals".

The fact that modern humans have some Neanderthal ancestry is a well-known fact these days, and does not capture what is really notable about this particular find. The title I used on the submission is:

"DNA from a 40,000 year old jawbone reveals very recent Neanderthal ancestry"

which I think accurately reflects the content of the article and communicates to the reader why this article might be worth reading.

</comment><comment><USER3> Imagine... if Neanderthals were still around today. How would society view them? Would they be social outcasts, literally, a caste of individuals destined for menial jobs (garbage collection, etc.)? Would there have arisen an extreme form of political correctness, denying any difference between the species because "we're all human beings"? That there would have been differences is clear, both physical - Neanderthals were much stronger than modern human beings - as well as mental, although it is unclear how those mental differences would have played out - Neanderthals had bigger brains than modern humans do.

</comment><comment><USER4> I don't understand why it's always been such a surprise that various hominid groups interbred. It's not like one day there were Neandertals and the next day they stopped existing and the next group took over. Surely that's just part and parcel of evolutionary theory?

<comment><USER5> Not really since the whole idea about species is they don't actually interbreed. What I find most interesting about the whole human genetic story is all sides were right. The out of Africa side is right and the regional hypothesis side is also right. This is not what I expected 10 years ago.

</comment></comment><comment><USER6> If she is cute, hit it. Enough said.

<comment><USER5> All the Neanderthal gene flow in living humans came in from the male side - <USER2> is more like if he is cut, hit it (Neanderthal's were significantly stronger and more muscular than other humans).

<comment><USER6> Women still go for the Neanderthal's. Guess things never change :)</comment></comment></comment>


Realtime blood sugar data from a wearable on my arm - <AUTHOR> https://henrik-cgm-remote-monitor.herokuapp.com/ <comment><AUTHOR> Diabetes technology is becoming pretty cool :) I have a Dexcom G6 CGM on my arm that sends blood glucose measurements to my phone every 5 minutes. It then sends it to Dexcom's cloud service which I poll using an open source project called Nightscout which I have deployed on Heroku.</comment>


The Unlikely Activists Who Took on Silicon Valley – And Won - <AUTHOR> https://www.nytimes.com/2018/08/14/magazine/facebook-google-privacy-data.html <comment><USER2> > Just weeks later, the original sponsor of the Illinois privacy act, a genial > Chicago-area lawmaker named Terry Link, abruptly proposed an amendment to > his own law. The amendment clarified that digital photographs did not count > as a source of biometric information and that the law only protected facial > scans conducted "in person." A Facebook official told me that the company > had provided Link with suggestions for clarifying the law, not the language > itself. But in a recent interview, Link recalled that the amendment language > was given to him directly by a lawyer for Facebook. (Link did not specify > who, and would not comment on why he had pursued the amendment in the first > place.) Indeed, the amendment, introduced with only a few days left in the > year's legislative session, seemed tailored to buttress Facebook's arguments > in the California lawsuit, leaving Facebook and other companies free to > create face scans from digital pictures without consent.

Wow. Facebook get sued, so their lawyer simply emails the changes to law they need in order to get off.

And it's done. That seems incredibly corrupt.

I can't find a campaign funding details regarding Facebook contributes (I assume they're through intermediaries of some kind) I wouldn't be surprised if Facebook contributed tho, is anyone more skilled in this area?

[https://votesmart.org/candidate/campaign- finance/9519/terry-...](https://votesmart.org/candidate/campaign- finance/9519/terry-link)

</comment><comment><USER3> Excellent article. Many points struck a nerve:

\- EFF et al not supporting Mactaggart's ballot proposal because it wasn't perfect - a classic case of "perfect being enemy of good", which we have seen so many times across so many issues. Why can't people lock in incremental progress and then work towards improving things further?

\- It took a rich man with a few million at his disposal to fight this battle. What can an ordinary citizen do?

\- Facebook trying to alter Illinois law stealthily - the legislator who tried to sell out should be tarred and feathered and should probably never be elected to office again.

\- Incredible power and influence wielded by Google, Facebook and other tech co's - one thing which could really help here would be a "woke" employee base in these companies, who can influence change from inside these companies. Let's see if Silicon Valley folks really want to make the world a better place or were they just empty words!

</comment><comment><USER4> This story is incredibly well reported. The lobbying force Google, Facebook and the rest of the surveillance capitalism industry can bring to bear against privacy legislation is incredible. If Apple wants to make a real dent in the universe for privacy, they need to be the opposing force in the same arena. Privacy at a product level is great, but creating a legislative equivalent to GDPR (and their other privacy laws) in the US would be infinitely better.

Loved this line:

>Soltani wryly pointed out that Mactaggart had offered Silicon Valley a take- it-or-leave-it privacy policy — the same kind that Silicon Valley usually offered everyone else.

</comment><comment><USER5> I really enjoyed this story. I hope Alastair Mactaggart has the will to fight for something stronger in the future, and I am disappointed to read that the ACLU and EFF went the route of the perfect being the enemy of the good in this case. I can see why the ACLU and EFF did what they did, but still.</comment>


New York City Moves to Create Accountability for Algorithms - <AUTHOR> https://www.propublica.org/article/new-york-city-moves-to-create-accountability-for-algorithms <comment><USER3> This is a good thing --an algorithm with up to a 30 error rate is unreliable. One hopes this scrutiny will lead to development of more dependable and trustworthy algorithms. Also hopeful politicians don't have the ability to tweak things in order to fit their agendas.

For example an algorithm is too good at detecting which gov't employee is stealing from the public. Or it tells them they should decrease fines in some area to get better results --but that would affect their budget adversely, etc.

<comment><USER4> This is an unrealistic law that doesn't matter. It sounds good, but it's futile. If this taskforce takes the decision that an algorithm that is working is unacceptable (which we all know they'll do on the worst possible basis - publicity), then what happens ?

They'll pause the algorithm ? Replace it ? They can't do that ...

The issue is that once you automate something you can't unautomate it without providing the workforce necessary. Because in nearly all cases a bad automated algorithm will far outperform 1% of the required workforce in humans, that's how algorithms win. Not because they beat humans, they don't. They win because they actually take action in 100% of the cases, whatever that number is. A dumb algorithm taking action 100.000 times can easily beat a very hardworking human that takes 100 smart decisions in a lot of cases. So that will be tens to hundreds of people in easy cases, and thousands to tens of thousands in bad cases, and this is New York, easily the size of a decent country. So it'll always be "we need to pause this NOW !", "OK, no problem at all, that'll be $15 million per hour. Under what budget item do we fit this ?" "Erm .... How about you just make it look like it's paused ?"

Keep in mind stopping automation doesn't even just cause damage directly, it will also cause overloading costs onto other departments and even onto private companies. Often in surprising ways. Algorithms respond quickly, under nearly all circumstances, at any time. You wouldn't believe how efficient this makes interacting with organizations. Pausing automation has an enormous and accumulating cost, making the decision impossible.

Also algorithms don't solve corruption (they may make it easier to track though, although there are ways around that).

<comment><USER5> > which we all know they'll do on the worst possible basis - <USER2>

That's such a cynical, nihilistic way of looking at government. I can only guess people arrive at it after being exposed to a rather superficial look at governments' work over a long time.

In reality, the vast bureaucracy that is government takes thousands of actions every single day, almost all of which are uncontroversial. They work hard to establish procedures minimising uncertainty. The work is far more transparent than any private organisations'. And all decisions are subject to judicial review–with the judiciary having its own, long tradition of thoughtful deliberation and even-handedness.

As one example, the list at [https://www.regulations.gov/searchResults?rpp=25&so=DESC&sb=...](https://www.regulations.gov/searchResults?rpp=25&so=DESC&sb=postedDate&po=0&np=90&dct=N%2BFR%2BPR) shows some recent (federal) actions. Note that this list is only the tip of the iceberg, with the most controversial administration in modern history. Yet it is dominated by "Class E Airspace; Revocations: Eaton Rapids, MI" and other items of rather low publicity value.

<comment><USER4> Yeah - I've consulted for years for about 4 governments, going from department to department. I still think I'm far too hopeful. The whole thing is utterly corrupt, the politicians running things have utter disdain for actually running things (to the point that they have their security agents shove them aside sometimes - seen that happen). To say that the vast majority of the government - both politicians and bureaucrats - from high to low, everyone, doesn't care about running the place is a complete understatement.

And the government is so full of abuse, it's just disgusting. The thing is even "unintentionally corrupt" as I call it. Regulations that get important things done (especially where it pertains to hiring, consulting, real estate, ...) by just asking it in the right (and "published") location and person. Then, they tell this to 2-3 companies and the rest have to figure it out on their own. Then, of course, they switch to actually corrupt, and change where they need to ask a few months later.

</comment></comment></comment></comment><comment><USER6> One of those paradoxical situations when something _really_ needs to be regulated but can't be regulated. E.g. how do you know what data set is the result of an algorithm (a dubious consolidation step?), or how do you regulate algorithmic learning when we don't fully understand how learning works?

<comment><USER7> If you look at the specific issue that provoked this law, you will see issues that can - and should - be regulated. the city was using DNA matching software that turns out to have demonstrable errors, yet the office of the medical examiner stonewalled all attempts to have it audited until, thankfully, the courts forced the issue.

This sort of unjustifiable secrecy (the accused absolutely have a right to examine the premises of the accusation) can be regulated. Unfortunately, this law substitutes nebulous criteria which, no matter how worthy, are likely to turn a clear-cut situation into a tar-pit of legal wrangling that the victims cannot afford to enter.

The chief medical examiner is still holding fast on the very dubious claim that these flaws raise no doubts about the convictions in other cases where it was used, another area where I think specific legislation is needed.

> How do you regulate algorithmic learning when we don't fully understand how > learning works?

This was not one of those cases. There are, however, cases - and this would be one if it applied - where it is reasonable to say that you can't use it until you can explain how it works.

<comment><USER8> In this particular context, maybe, but in general - who cares if you can't explain all the values in the neural network, when it is demonstrately safer than a human driver.

<comment><USER9> You can't say "demonstrably" until you can specify the full breadth of the algorithm's specs. Something being "demonstrable" is something incredibly hard to achieve in certain classes of NNs.

If it breaks on edge cases, that's important.

</comment></comment></comment></comment><comment><USER10> I wonder how an algorithm with low explainability will be treated, like a large nueral network. Seems like it would be hard to pin it on the algorithm rather than the data.

<comment><USER11> If there's a way to objectively evaluate quality of output, that seems sufficient. It's not like a building inspection where it's a component-based evaluation. The results need to be reasonably and verifiably reliable to an appropriate degree, but the courts don't need to care how that is accomplished.

<comment><USER12> > If there's a way to objectively evaluate quality of output, that seems > sufficient.

But that's the whole problem. If you had something that calculates the the thing algorithm is supposed to do in a better way than the algorithm actually does it, you could just use that as the algorithm.

</comment></comment></comment><comment><USER13> I find this incredibly off putting since the city cannot even account for its own wasteful budget.

There is nothing wrong with accountability and am glad they are starting somewhere but until they start holding others like the ones who purposesly destroy on time metrics of transit in order to keep thier salary gravy train choo-chooing, I am not holding my breath.

[https://mobile.nytimes.com/2017/11/18/nyregion/new-york- subw...](https://mobile.nytimes.com/2017/11/18/nyregion/new-york-subway- system-failure-delays.html?referer=https://www.google.com/)

<comment><USER14> > Signal problems and car equipment failures occur twice as frequently as a > decade ago, but hundreds of mechanic positions have been cut because there > is not enough money to pay them — even though the average total compensation > for subway managers has grown to nearly $300,000 a year.

That's a pretty incredible quote from the article above, since it's an average...

</comment></comment><comment><USER15> I think it's a travesty that the source code won't be shared with the public, but I hope it would at least be provided for review to the agencies adopting the algorithms.

In my field we are highly regulated and must provide the regulatory agencies with an audit trail for all data. I would like to see an audit trail for these algorithms that would allow someone to follow the decision tree and review the outcome of the algorithms.

</comment><comment><USER16> This is a good move. I hope other states follow suit. I highly recommend reading Weapons of Math Destruction: How Big Data Increases Inequality and Threatens Democracy

<comment><USER17> I recommend reading this review before deciding to read the book. [https://thezvi.wordpress.com/2017/06/04/book-review- weapons-...](https://thezvi.wordpress.com/2017/06/04/book-review-weapons-of- math-destruction/)

<comment><USER18> This was a good read, thanks.</comment></comment></comment>


Pills: A simple responsive CSS grid for humans - <AUTHOR> https://github.com/rohitkrai03/pills <comment><USER2> The problem with all of these responsive grid systems is that they are opinionated about how a component responds.

Responsiveness is not a document level problem, it's a component level problem and each component has it's own concerns. One component might keep the 2up grid from desktop to mobile, another might collapse to single column half way, and so on. Having generic desktop and mobile class names ala bootstrap doesn't solve this. You end up with components that have to collapse at pre-defined points and a massive amount of class soup on your containers.

This is related to the fact that components respond to the window width and not their parent containers size. Components are very dumb right now, we need smart components that understand their surroundings beyond the window. Then we will have truly portable components!

<comment><USER3> The problem with all of these responsive grid systems is that it's so easy to do a grid in plain CSS with flexbox and media queries that they're close to zero added value in almost all cases.

<comment><USER4> Agreed, flexbox is one of the best things to happen to CSS in a very very long time.

<comment><USER5> > very very long time.

It's sad really. Table-based layouts have been considered bad practice for years but CSS is only _just now_ becoming a superset. That is if you're lucky enough to be free of old browsers. If you want everything to "just work" tables are still the practical choice _to this day_. Kudos to PG for sticking to what he learned in the 90's when he built HN.

<comment><USER6> Yes! It's sad that table-based layouts became "bad practice". Generally they're a lot simpler to understand than the mess of CSS and bizarrely named divs we have today.

<comment><USER7> I think part of the reason tables became considered "bad" was that back at that time most web pages were built by interspersed HTML and ASP or PHP code and getting all the TR and TD tags balanced especially with rowspans or colspans thrown in quickly became a mess. Every page was a standalone thing also, it was much less common to see templating systems used to establish the overall structure of the site. So if you ever got the assignment to "reskin" a website, it was a huge amount of very tedious work making repeated similar changes to all the tables and other markup on every page.

Today we have much better ways to create an overall layout and separate markup from content. Using tables today would be a lot less of a problem than it was when they were decreed to be "bad."

<comment><USER8> From what I could tell, it is because HTML tables have a specific structural meaning, which is among other things used by screen readers. So if used properly, a person who needs a screen reader could reliably have the contents of a table read to them, but if it's used for layout the result is useless. There seems to be enough people conscious of this that use of tables for layout has always been frowned on. Now there are better hints for screen readers, ,but tables are still useful for screen readers "out of the box."

In any case, tables are not nearly as flexible as a true responsive layout.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Hey rohitkrai03, good on you for creating something that is useful to you and putting it out there for others on the chance it is useful for them too. There are so many approaches to styling web content. I enjoy finding all the projects that get brought up (and beat up) in these threads. CSS is all about figuring out what works for you. Cheers.

<comment><AUTHOR> Thanks a lot for appreciating my work.

</comment></comment><comment><USER10> Or, just write the display:flex you need, where you need it, as little as you _actually_ need.. easy as pie unless your deadline was days-ago. This here might save _you_ 10 minutes of manual work, at the expense of further code- base bloat, external-lib-dep accumulation, technical debt. OK fair game for your MVP-landing-page-A/B-split-test-shenanigans, granted.

<comment><USER11> Besides lack of good cross-browser support until recently, I think there are a few reasons why flexbox is still less popular than float- or margin-based grids:

\- Steeper learning curve and less accessible than adding a class like "col-3" or "grid--1/2". The latter is almost self-explanatory.

\- Requires an existing or new CSS class to bind the styles to. If it's a new class, you have to figure out a good name (which isn't always easy, naming things is hard).

\- Requires editing CSS/Less/Sass, which (depending on your setup) can require waiting for it to compile. The wait time for compiling/bundling HTML is usually negligible.

\- Traditional grid systems just work, and they work well enough for most things. When you have more important & interesting problems than a CSS grid system, there's a bias towards shipping what works and moving on.

That being said, flexbox is really powerful and a great tool for many things. But for many simple layouts, traditional grid systems can get the job done just fine without requiring much initial investment. On interdisciplinary teams where non-frontend devs can contribute, end-user simplicity is sometimes more important than language sophistication.

<comment><USER12> ... and it relies on DOM structure.

This is horrible, IMHO. Flex containers will layout the flex items, which are by definition its direct descendants. If by some reason [1] you get an extra DOM element between the flex container and the item you intend to layout, then you're in for a rewrite of the CSS and maybe some extra classes.

Also, this bug in Webkit is rather inconvenient: [https://github.com/philipwalton/flexbugs/issues/115](https://github.com/philipwalton/flexbugs/issues/115)

[1] For instance, if you create an Angular element directive.

<comment><USER13> Yes! Flex box has lots going for it, but it breaks a "feature" that many web developers and framework developers have relied on since the earliest days: it being mostly harmless add an extra layer of element at a whim anywhere. One could argue this is a lousy feature (and I would agree). But lots of developers and lots of frameworks do it.

<comment><USER12> Adding elements _just because_ (and, above it all, just for styling purposes) is wrong, of course. But having - or forcing - a tight coupling between structure (DOM) and layout/styling (CSS) is also wrong. IMHO, standards should try to move in the direction of decoupling; they did the opposite with Flexbox.

Anyway, the most present case for me is really Angular, where DOM elements are usually added because they are needed (and actually beneficial, if you like a component-based architecture and DRYness). Angular 1.x deprecated the `replace` option for element directives a few months ago (i.e. your <my- directive> will be in the DOM). Also, AFAIK, it never supported the `replace` behaviour in components (which are always elements). This means that, currently, Angular and Flexbox don't play very well together...

</comment></comment></comment></comment></comment><comment><USER14> Please explain to me: What happened to the philosophy behind [http://csszengarden.com](http://csszengarden.com) ? Back when CSS needed evangelizing, the main selling point was "never touch the DOM for styling".

What went wrong?

<comment><USER15> CSS Zen Garden was more close to art than to real world production work. It existed to draw a line between the old days' table-based layouts and what CSS brought to the table.

In those days CSS was perceived as not powerful and flexible enough, and capable only of boring boxy layouts (which is in fact the favoured aesthetic nowadays) and CSS Zen Garden and other similar sites existed to disprove that notion.

Also, some of the core ideals of the time, like obsessing over having 100% semantic markup and the ability to change styles without having to touch the markup turned out not to be that important.

And, lastly, if you look at the provided source in CSS Zen Garden you can see that it has a lot of _DOM affordances_ like classes, IDs and even some extra markup to make sure that the CSS author had everything she needed to make his design work.

source: I got a design published in the garden a long time ago [http://www.csszengarden.com/110/](http://www.csszengarden.com/110/)

</comment></comment><comment><USER16> Why not just use flex? [https://philipwalton.github.io/solved-by- flexbox/demos/grids...](https://philipwalton.github.io/solved-by- flexbox/demos/grids/)

<comment><USER17> Because IE 9 is still (unbelievably) a top 10 browser. But, it won't be for much longer, at which point I'll start converting. ([https://www.w3counter.com/globalstats.php](https://www.w3counter.com/globalstats.php))

</comment></comment><comment><USER18> I created one grid system exactly like this [1] a couple of years ago as part of Picnic CSS [2].

However it was limiting in several factors, so I rewrote it from scratch as a flexbox solution, called it Flexpoint [3] and I love it. Now I need to integrate it back into Picnic.

For instance, can you change elements order? How do you account for an undetermined number of elements (same size, full width total)?

[1] [http://web.archive.org/web/20150713011953/http://www.picnics...](http://web.archive.org/web/20150713011953/http://www.picnicss.com/plugins/grids/)

[2] [http://picnicss.com/](http://picnicss.com/)

[3] [http://francisco.io/flexpoint/](http://francisco.io/flexpoint/)

<comment><USER19> Looks good! How does the grid handle columns with different heights?

<comment><USER18> They should be filled up to the size of the tallest one if I'm not mistaken. Though so far I've only tried it with uniform elements so I don't know first hand.

</comment></comment></comment><comment><USER20> Really nice, though these days flexbox should kill libraries for that. Also I hate when you have fixed break points. Sometimes you need elements to be visible hidden on different screen width and frameworks like this limit the ability to change the breakpoints.

Take as an example the smashing magazine [1] and count the breakpoints there

[1] : [https://www.smashingmagazine.com](https://www.smashingmagazine.com)

</comment><comment><USER21> I like simple libraries like this that do one thing well. Too many web libraries try to do everything, when all I don't need anywhere near that much.

</comment><comment><USER22> Using tables for layout sometimes makes sense: [https://www.combatentropy.com/coming_back_to_the_table](https://www.combatentropy.com/coming_back_to_the_table)

How are these DIV's with presentational class names any better?

</comment><comment><USER23> I've found [https://milligram.github.io/](https://milligram.github.io/) very nice. Sure, it's a bit more than a grid system (it uses flexbox) but it's very nice and doesn't take up much bandwidth.

</comment><comment><USER24> Looks a lot like semantic-ui [http://semantic- ui.com/collections/grid.html](http://semantic-ui.com/collections/grid.html)

</comment><comment><USER15> I don't get the author's pain point. `col-md-12` looks like pretty self- explanatory class name (or `medium-12 columns` in foundation). I mean, you're already writing HTML where `img` means "Image" and `div` means "arbitrary container", so unless you don't understand (or don't care about) the value of a 12 columns grid I don't see what's so bad about bootstrap's column names. Especially if you're already OK with having presentational classes in your markup.

</comment><comment><USER25> this is great. I really like how he breaks down the three types of grid systems out there. And "just memorize the cryptic codes like col-md-6 or whatever from their favourite CSS Framework like Bootstrap" is so true. I knew there had to be a better way and pills could be it. I starred it and forked it.

<comment><USER26> >just memorize the cryptic codes like col-md-6

It's awkward at first, becomes second nature after you use Bootstrap for a while.

I guess a grid only framework makes sense if you only use the grids from the big frameworks, but it's not my use scenario since i use LOTS of stuff from Bootstrap .

</comment></comment><comment><USER27> Whilst 'three' is better than 'col-3', it's still based on a 12-column way of thinking. Try Avalanche ([https://github.com/colourgarden/avalanche](https://github.com/colourgarden/avalanche)) for a grid system based on percentages or fractions (you choose) </plug>

<comment><AUTHOR> Pills also has support for fractions along with normal four columns like namespace.

</comment></comment><comment><USER4> It will never not be faster to roll your own based on the project needs. Aside from knowing how to use Bootstrap, I can appreciate the work on these CSS grid systems and frameworks but I don't see any need for most of them. Do people use Blueprint anymore?

</comment><comment><USER28> Honestly, I just use

      .something
      {
      width: calc(33.33% - #{$spacing-small*3/2});
      margin-left: $spacing-small;

        &:first-of-type
        {
        margin-left: 0;
        }
      }

Well simple

<comment><USER28> Correction:

      .something
      {
      width: calc(33.33% - #{$spacing-small*2/3});
      margin-left: $spacing-small;

        &:first-of-type
        {
        margin-left: 0;
        }
      }

<comment><USER29> For the gutters, just do:

      .something {
        width: calc(33.33% - #{$spacing-small * 2/3});

        + .something {
          margin-left: $spacing-small;
        }
      }

<comment><USER28> I like that!

</comment></comment></comment></comment><comment><USER30> Pill is almost 400 lines just for the grid. Here's a 48 line alternative that's customizable:

[https://github.com/doximity/vital/blob/master/source/stylesh...](https://github.com/doximity/vital/blob/master/source/stylesheets/_grid.sass)

</comment><comment><USER31> Well, usually grid systems are used for responsiveness and the ability to have a specific design for individual screen sizes. As far as I read through the docs, unlike bootstrap, this library does not allow to target specific screen sizes like xs,md,lg, etc...

Just pointing this out :D

<comment><USER32> This framework is getting posted everywhere and it's not even really responsive. I saw this junk on Reddit too. People were defending it saying it had mobile and desktop sizes. What?

</comment></comment><comment><USER33> Pardon my cynicism but the adjective 'simple' has been abused to the point where it repels me when I find it in framework descriptions.

Calling something 'simple' is a subjective statement which is a meaningless waste of words, especially from the author of the framework. Of course you perceive your own framework as simple. Nobody designs a framework to intentionally make something more complicated.

The word 'simple' is repeated 8 times in the first 2 paragraphs of your description. It reads like something thrown together in a thoughtless hurry. Your framework could be wonderful but it leaves the reader wondering if the code has the same level of investment as the description.

<comment><USER3> Most Hacker Newsy Hacker News Comment Of The Year Award

</comment></comment><comment><USER34> I created SlenderGrid [1] a while ago which I believe is really all you need. It's 16 lines of code and you define your OWN actual __semantic __grid classes.

so for instance:

        .content {
            @include box-size(3/4);
        }

        .sidebar {
            @include box-size(1/4);
        }

[1] [https://github.com/donatj/SlenderGrid/blob/master/src/_slend...](https://github.com/donatj/SlenderGrid/blob/master/src/_slendergrid.scss)

</comment><comment><USER11> At NextBigSound.com, we've found that a nestable fractional-based grid is generally easier, faster, and more flexible to work with than traditional N-column grids:

<comment><AUTHOR> Pills also support fractional based grid like half, one-third or two-third like that.

</comment></comment><comment><USER35> Adding my own me-too onto the pile of "I made something just like this:" [https://github.com/secondparty/arrange](https://github.com/secondparty/arrange) — I built it out of curiosity, and have used it in my projects, (shrug emoji). These types of projects are fun.

</comment><comment><USER36> Wrote this [0] more than a year ago, it generates a tiny CSS grid template using attribute selectors. Should work with any amount of columns. Might be useful for someone here.

[0] [https://github.com/mateogianolio/griderator](https://github.com/mateogianolio/griderator)

</comment><comment><USER37> Honestly, I see one~three of these simple, responsive, lightweight CSS frameworks every week on HN. I wonder how many people actually get to use these new shiny frameworks over the reputable ones. I personally use bootstrap, and will try foundation next, but none of these __new __ones.

</comment><comment><USER38> Hey there, I am the maker of Wing.css ([http://usewing.ml](http://usewing.ml))

This is a really nice grid system. I love the simplicity and the website. Keep it up!

</comment><comment><USER32> It is so simple and so human it isn't even really responsive. Magic!

<comment><USER39> Can you explain?

When I resize the window, the demo ([http://arkpod.in/pills/](http://arkpod.in/pills/)) reflows exactly like I'd expect.

<comment><USER40> It only has one breakpoint whereas bootstrap has multiple (xs, sm, md, lg).

</comment></comment></comment><comment><USER41> It would be nice to mention on the grid website what is the key difference from other grids.

e.g. what is the difference from Bootstrap? both 12 columns, grid based on floats. Is there any difference than naming?

<comment><AUTHOR> One difference from bootstrap would be it handles desktop and tablets using fluid layout instead of breakpoints. The only breakpoint in the grid is for mobile.

<comment><USER40> Yeah it's more like the Boostrap 2 grid, which will be a step back for some people used to multiple breakpoints of Bootstrap 3.

</comment></comment></comment><comment><USER42> skeleton has the same approach

<comment><USER43> This seems like skeleton's exact syntax with a different name... [http://getskeleton.com/](http://getskeleton.com/)

</comment></comment><comment><USER44> Grids make for fast development but boring websites. I find the design I work with more often break the grid than conform to it.

<comment><USER15> Are you serious? Unless you're David Carson, you should always design based on a grid if you want good design.

Mark Boulton wrote some amazing articles about grid design long before grid frameworks were a thing [http://www.markboulton.co.uk/journal/five-simple- steps-to-de...](http://www.markboulton.co.uk/journal/five-simple-steps-to- designing-grid-systems-part-1)

</comment></comment><comment><USER45> Small point which I see fairly regularly. Please provide a partial sass/less partial in addition to the css file.

</comment><comment><USER46> a css grid for humans... First thought flexbox for distributing people waiting for the subway.

On a more serious tought... the great thing about bootstrap whille I admit is sometimes a bit messy is the fact that you can use different sizes for different breakpoints which is something this method apparently does not allow.

</comment><comment><USER47> i made something like this (although much less extensive) because i found myself using the same pattern for a few freelance gigs

[https://github.com/r-medina/grid](https://github.com/r-medina/grid)

thanks for sharing!

</comment><comment><USER48> What's the point of something like this is a world where flex box is a standard?

</comment><comment><USER49> So it's just a clone of Bootstrap with different class names.

<comment><USER50> Without the ability to control width percentage in mobile, or set it differently between tablet and desktop.

</comment></comment><comment><USER51> Why not go gridless? [https://github.com/lucianmarin/gridless](https://github.com/lucianmarin/gridless)

<comment><USER52> I hate that pixels made a comeback. They are a total pain in the era of multiple resolution sizes, aspect ratios, orientations, and densities.

</comment></comment><comment><USER53> Are there any sites that use grid systems? I can't think of any off the top of my head.

</comment><comment><USER54> Another one. For lazy humans.</comment>


Facebook Helped Develop a Tails Exploit - <AUTHOR> https://www.vice.com/en_us/article/v7gd9b/facebook-helped-fbi-hack-child-predator-buster-hernandez <comment><USER2> It's worth reading the original article in full. I simultaneously understand why they did it and am deeply uncomfortable with the tactic.

[https://www.vice.com/en_us/article/v7gd9b/facebook-helped- fb...](https://www.vice.com/en_us/article/v7gd9b/facebook-helped-fbi-hack- child-predator-buster-hernandez)

<comment><USER3> Url changed to that from [https://www.schneier.com/blog/archives/2020/06/facebook_help...](https://www.schneier.com/blog/archives/2020/06/facebook_helped.html). Thanks!

</comment></comment><comment><USER4> This guy deserves what was coming to him, I can understand how it would be very tiresome to deal with a pest like this who keeps coming back, but breaking norms about reporting bugs to vendors like this sets a very nasty precedent.

As does a company like Facebook spending large sums of money to narrow down on specific people, it could be someone you hate today and an activist the next.

<comment><USER5> Facebook are masters when it comes to controlling the narrative (damage control is their expertise). There is almost certainly something else under the surface. I find it implausible that Facebook would care enough to go after a single individual. No matter how bad that individual was. If they did this for every criminal of that level who uses Facebook, they'd run out of money. They simply cannot do this. Whenever the media or a big company focuses on a single individual, it's never actually about that individual. It's either about some higher social concept or it's simply a PR stunt to control the narrative. I think anything of this sort which comes out of Facebook is more likely to be damage control. They probably came up with the narrative before they even implemented this backdoor.

Facebook has teams of people whose entire job is covering Facebook's ass. Before Facebook even does something bad, they already figured out an excuse for it before they even started doing it. If they didn't have an alibi, they wouldn't even do the crime. That's the kind of operation they run. They preemptively create the narrative, then they act. Why do people treat Facebook as if it were a conscientious person?

<comment><USER6> Well, Facebook actively campaigns against privacy, and the FBI actively campaigns against encryption.

This is great PR for themm to say that both privacy and encryption are bad and should be outlawed.

Wouldn't be surprising at all if that's how they spin it.

<comment><USER7> >Facebook actively campaigns against privacy

Source? I know FB is pretty bad with the privacy of users of it's own services, but I'd be curious to see how they've campaigned against privacy.

</comment></comment></comment></comment><comment><USER8> « _They also paid a third party contractor "six figures" to help develop a zero-day exploit in Tails: a bug in its video player that enabled them to retrieve the real I.P. address of a person viewing a clip._»

This sounds like they describe the well-known WebRTC leak: [https://restoreprivacy.com/webrtc-leaks/](https://restoreprivacy.com/webrtc- leaks/)

<comment><USER9> Other than webRTC being related to video playing, i dont see the connection. They don't really describe the exploit, so hard to say, but the webrtc leak isn't really in the video player part, its super well known (literally a feature not a bug) so i dont think you would need to pay six figures for it, and tails uses tor browser which doesn't support webrtc.

<comment><USER10> But you can install WebRTC enabled browsers in tails. Depending on how tech- savvy someone is, they could be motivated to install one of them.

<comment><USER9> The article specificly says the issue was in code that used to be in tails and isnt anymore. Additionally, the motherboard article describes the payload as a video file uploaded to dropbox, which doesnt sound like webrtc.

<comment><USER11> Yes, I doubt that it's WebRTC. Or at least, I recall similar vulnerabilities in video player code that predated WebRTC. There used to be a Metasploit leak- testing site (Metasploit Decloaking Engine) which checked for IP leaks via video, PDFs, etc. And it included an early version of the NIT that the FBI has used since ~2011.[0]

0) [https://securityaffairs.co/wordpress/43442/cyber- crime/fbi-u...](https://securityaffairs.co/wordpress/43442/cyber-crime/fbi- used-nit-against-pedo.html)

</comment></comment></comment></comment></comment><comment><USER12> The vulnerability should have been disclosed to Tails developers as soon as Hernandez was arrested.

<comment><USER13> Well yes, but the fact that it was already patched in the next Tails release, and that was the reason they pulled the trigger when they did, makes even that concern less of a practical problem. It was basically going to get fixed in short order no matter what they did.

<comment><USER14> Since they never released the exploit, in reality we have no way of verifying this is actually true. It very well could be the case Tails still has this vulnerability.

<comment><USER11> In my opinion, Hernandez screwed up by not appreciating the risk profiles for Tails and Whonix. Tails is a LiveOS, which doesn't leave traces in RAM or on disk. Whonix is a pair of VMs, one with the Tor process, and the other with user apps. Using Whonix, exploits like this are impossible, because the apps VM has no public IP address, and can hit the Internet _only_ via Tor.

<comment><USER15> I can imagine for high-value target there are stacking exploits:

1) escape from browser into VM

2) escape from VM into host

3) run exploit on host

<comment><USER11> True. However, such high-value targets would be isolating the Tor process and apps at the hardware level. It's over my head, but I can imagine elements from Tinfoil Chat and Qubes Air.

And yes, vulnerabilities in Tor have been exploited. So it's prudent to hit Tor via nested VPN chains, just in case.

</comment></comment></comment></comment></comment></comment><comment><USER16> > For years, a California man harassed and terrorized young girls, extorting > them for nude photos and videos and threatening to kill and rape them or > shoot up their schools. Much of this abuse took place on Facebook, and now, > months after the man, Buster Hernandez or "Brian Kil," pleaded guilty,

From Engadget coverage [1], I feel a bit of context is missing in TFA.

[1] [https://www.engadget.com/facebook-fbi-hacking-tool- targeted-...](https://www.engadget.com/facebook-fbi-hacking-tool-targeted- child-abuser-171753372.html)

</comment><comment><USER17> In my apparent ignorance, when I first read the title I actually imagined Facebook developing a backdoor of some kind into Tails, given that Tails is open source.

Then I understood that "developing" an exploit means taking advantage of existing properties/vulnerabilities.

Is this standard wording in security circles?

<comment><USER18> "develop" here refers to the process of (potentially) researching and then subsequently writing the software that exploits a vulnerability (an 'exploit'). It's used in the same sense as any other software development.

The process of discovering a vulnerability is called 'vulnerability research'.

So when Schneier says Facebook paid for an exploit to be developed, it means they paid for software that exploits a vulnerability.

In the case of paying for such exploits, it's not always clear who exactly did the research. Often the research comes from a third party who put together a simple proof of concept that demonstrates only that the security control can be breached (the PoC) -- then, a contractor may buy this vulnerability ('0day') from e.g. zerodium and develop an exploit for it, which will usually be pretty much point and shoot so you don't need an exploit dev team to leverage it.

Hope that makes sense.

</comment></comment><comment><USER4> Facebook could at-least have had the decency to report the bug after they were done, who knows what the FBI / NSA are using it for now.

<comment><USER19> According to this article [1] the code involved with this exploit should be removed at some point.

" A factor that convinced Facebook's security team that this was appropriate, sources said, was that there was an upcoming release of Tails where the vulnerable code had been removed. Effectively, this put an expiration date on the exploit, according to two sources with knowledge of the tool.

As far as the Facebook team knew, Tails developers were not aware of the flaw, despite removing the affected code. One of the former Facebook employees who worked on this project said the plan was to eventually report the zero-day flaw to Tails, but they realized there was no need to because the code was naturally patched out. "

[1] [https://www.vice.com/en_us/article/v7gd9b/facebook-helped- fb...](https://www.vice.com/en_us/article/v7gd9b/facebook-helped-fbi-hack- child-predator-buster-hernandez)

<comment><USER20> That would also be the perfect way to avoid disclosing the vulnerability so they could keep using it.

Not saying that's what is happening here, but it's not like Facebook has a glowing reputation to begin with. Telling the vendor that a future release will patch the bug gets everyone to stop asking questions without really knowing if it's true.

<comment><USER21> If you have need for Tails and you continue to use old versions of it out of laziness, then you really are just begging to be pwned. We're not talking about consumer-grade Ubuntu here.

<comment><USER20> I think you misunderstand me.

By telling Tails that the vulnerability will be patched in a future release without disclosing the details of the vulnerability, Tails has no way of knowing if this is actually true.

It's easy to be a little skeptical when a company spends 6 figures to develop an exploit and then state publicly "we can verify that the issue will be patched in a future Tails release, but we're not going to tell them or anyone else what the exploit was in the first place."

If you wanted to keep using that exploit, or sell it, the easiest way to do so would be to tell Tails that it's going to be fixed without actually giving them any details about it.

</comment></comment></comment></comment></comment><comment><USER22> Fascinating part in the story about his arrest (first link in the vice article) is that the FBI set up cameras outside his home to correlate his physical presence with internet activity from the IP address.

You frequently get people on the internet saying "Your IP address doesn't prove anything", but I was always curious how that worked in the real world.

<comment><USER23> I don't know about the US, but it is generally very easy: go to the ISP with the IP+date and an order from a judge and they'll tell you who was using it.

<comment><USER24> > they'll tell you who was using it

IP only tells the investigator whose name is on the ISP account, not which person was at the keyboard. Your recommendation only helps the police know where to set up the surveillance, not who to bring charges against.

</comment></comment></comment><comment><USER25> This is something to consider in the recent development of Amazon and Microsoft saying they won't sell facial recognition to law enforcement. I expect police will approach this minor inconvenience by outsourcing to a private company who will do the face scanning for them.

<comment> blaser-waffle Government contractors like General Dynamics are already all over facial and license plate recognition. AMZN and MSFT not getting on board isn't going to slow it down, just delay it from landing in consumer software.

</comment></comment><comment><USER26> Seems like the lede is buried -- what is the video player exploit? Is there really a way to modify video files such that playing them locally can broadcast an IP address?

Think this is less about Tails and more about this "video-tagging" tech.

<comment><USER27> Without a zero day in the actual decoder (which is probably a possibility given the resources they poured into this), one way would be to send someone a playlist file that tells the player to fetch the video from some URL. Does the player on Tails obey proxy settings when playing URLs from an m3u? Maybe it was that easy or maybe they had to abuse something like fragmented nature of Linux media playback to find a neglected component that carelessly makes network connections, or find a way to call youtube-dl which is often integrated with these players.

</comment></comment><comment><USER28> Facebook also doesn't report the browser exploits they use to track people, nor the wetware exploits they use to drive engagement. Just sayin'.

</comment><comment><USER29> To deepen the ethical quandary: what if Facebook had developed the exploit for this case, and then the FBI used it for an unrelated, not-child-molesty case?

At some point you have to wrestle with the fact that law enforcement is predicated upon having strong tools with which to deal with law breakers of all kinds, not just the few you find particularly onerous. They're going to need to perform ethical hacking to prosecute people under laws or circumstances you disagree with. And it would probably be better for us if they didn't always have to hack to get the information.

I think we need to work much more closely with law enforcement, not just technically on being able to lawfully intercept private communications, but in what laws and what cases its use is allowed. Nobody trusts the government in this age, but I think that needs to change, and it's the people that need to step up to reign in their government, not vice versa. That means more oversight, restrictions on when and how powerful tools can be used, periodic review, input into the design phase of new technologies, and so on.

We can use our brains to both make it more difficult for them to abuse advanced tools, and also make it more convenient to use them to solve serious crimes. We don't have to live in a black and white world where we either allow everything or allow nothing. We can live in a world of gray, but we have to step up to create that world; we can't just expect to keep saying 'no' to law enforcement and them being able to do their jobs, which is keeping our people safe.

<comment><USER24> > and then the FBI used it for an unrelated, not-child-molesty case?

You _must_ assume this is the case. The FBI isn't going to stop using a tool just because they caught one suspect in once case.

</comment></comment><comment><USER30> There's an easy way to fix the Web RTC Leak issue network wide: Use a VPN on your Router so your network clients literally don't know their "real" ip and therefore can't leak it. Same thing works for TOR. In my experience OpenWRT and an Wireguard VPN Provider works best

<comment><USER31> I don't think it was a WebRTC issue, I think they crafted a video such that the decoder would end up executing code.

Similar to what happen to Jeff Bezos.

<comment><USER32> The point is that you can't have the Tails machine decide what connections are proxied through Tor and which are not. If you have an external device like a router or a Raspberry that _transparently_ tunnels the data, a compromise of the Tails machine can't trivially expose your real network connection.

<comment><USER33> One thing that I've thought about this is that whether you do the firewalling on the end-user device or on another device, the firewall will normally permit connections to _every Tor guard_. That means that if an attacker can make the device make a "special" TCP connection of any kind (e.g. just an HTTP request) to an arbitrary IP address and port number, it could make that connection to _an actual Tor guard node_ run by an affiliate of the attacker. Then the attacker can distinguish that connection from other Tor activity because it isn't Tor traffic.

The point of that is to say that "only allowing the machine to talk to Tor nodes" wouldn't stop an exploit from effectively bypassing Tor—by talking in a slightly unusual way to an adversary-controlled Tor node!

If they're not already doing it, it might be safer for Tails to learn _the specific guard_ that its copy of Tor is using at a particular time, and only allow outbound traffic _to that guard_ rather than to any Tor node. (Another precaution which they might already be taking: only the Tor daemon process should be able to open remote sockets at all.)

</comment></comment></comment></comment><comment><USER34> I don't believe most of the technical details of this story and it sounds like parallel construction created to avoid revealing the technique.

How would they know he was running tails particularly?

And what a happy coincidence that the 0day was patched before they even had a moral obligation to notify anyone about it. _Quelle chance!_

</comment><comment><USER35> > The firm worked with a Facebook engineer and wrote a program that would > attach an exploit taking advantage of a flaw in Tails' video player to > reveal the real IP address of the person viewing the video.

Doesn't Tails route all traffic through Tor by default?

<comment><USER36> The video player must not use the default protocols.

</comment></comment><comment><USER37> "The FBI then got a warrant and the help of a victim who sent a booby-trapped video to Hernandez"

Seriously, Vice, "booby-trapped"..? It'd be funny if it wasn't minors. Actually, it's still kind of funny.

</comment><comment><USER4> Stopping random strangers from talking to kids over TOR could help to stop pests like this as-well and it wouldn't cost six figures or undermine privacy.

</comment><comment><USER38> Or a widely publicized and plausible parallel construction.

</comment><comment><USER39> I will admit to not being a fan of FB also, but discouraged by the number of Slippery Slope arguments on this piece.

</comment><comment><USER40> The fact that it took thousands of dollars and an entire company to write an exploit shows how secure Tails really is.

<comment><USER41> Looks like the bug wasn't really in Talis but in other software they use, Firefox/Tor-Browser?

<comment><USER42> Weakest link.

That's one of the issues an aggregate system (which describes any system of meaningful size, these days) has to deal with.

How many of the massive breaches we hear about, originate with dependencies or subcontractors?

<comment><USER43> Speaking of, I always find it very telling that the knee-jerk reaction is to blame a dependency or subcontractor. That's the same mentality that says "paid for code must be better" when, last I checked, there aren't any more Windows phones, are there?

But there was a Windows password hash method in the early 2000s that could be brute forced on a single consumer grade CPU in less than 24 hours on their current-at-the-time flagship network server OS. So there's that...

<comment><USER42> I have no idea why you made that post.

</comment></comment></comment></comment></comment><comment><USER44> Its so uncomfortable that they also hold all our data too

</comment><comment><USER36> "We knew it was gonna be used for bad guys,"

And everyone else.

Facebook is a honeypot.</comment>


Why Do People Believe in Conspiracy Theories? - <AUTHOR> https://www.psychologytoday.com/us/blog/talking-apes/201801/why-do-people-believe-in-conspiracy-theories <comment><USER2> This article seems to miss some major points by casually dismissing all conspiracy theory as a false belief. While there are many conspiracy theories that are indeed false there are many that started as theories and then discovered later to be true. The documents that Edward Snowden revealed are a good recent example.

There's also many examples of governments (leadership) acting in less than honorable ways towards their citizens. Tuskegee study is one example that went on for decades.

People don't believe only because they are seeking control in their life for things they don't understand. People believe in part because actions that have been done in the past are indicators of what will be done in the future.</comment>


Ask HN: What's the easiest way to land a job in RoR? - <AUTHOR>

I'm new to learning RoR and read blogs that talk about how impossible it is to land an entry job (every job require 2 yr experience).
I plan to take 2012 to learn RoR full time. I imagine that working for a company (vs self learn) would expose me to more environments.
I applied to Hungry Academy, and will apply to either Code Academy or DevBootcamp. After that, I want to know what to focus on.
What is most important to learn to get employment? What companies or industries are most likely to employ newbies? <comment><USER2> It may not be the best "overall" advice but I've met a lot of people looking for freelance developers or simply rubyists to hire by going at local ruby meetings.

I can't say anything about Ruby groups other than Paris, but at each of our meetings I talk with people having trouble to hire a ruby or rails developer.

Conclusion: Get there and even try to do a lightening talk ! You'll learn a lot, create your network with Rubyists. It's simply about getting closer to other people working in this field.

<comment><AUTHOR> I'm from Kansas City (in the middle of the US) where they lack good Ruby groups. I may have to move to make it happen. I appreciate the feedback.

</comment></comment><comment><AUTHOR> I should add that I'm working on the basics now (CSS/HTML)

<comment><USER3> Try doing a small project yourself. This can help in a bunch of ways:

\- Learning is quicker. Till the time you can not get a job in a company, why not build something yourself?

\- Familiarize yourself with real world and give you the ability to design an end-to-end system.

\- You will have a portfolio to show off your skills.

\- Using open source tools/scripts on the way will allow you to make contributions to them later. Contributing back to the community helps deepen your understand, gain valuable feedback and also get visibility.

<comment><AUTHOR> I just opened a github account and will post an easy to deploy project soon.

Is there a link or site that has step by step for more complexed ones?</comment></comment></comment>


Elon Musk says Tesla is "vastly ahead" on self-driving - <AUTHOR> https://arstechnica.com/cars/2019/04/elon-musk-says-tesla-is-vastly-ahead-on-self-driving/ <comment><USER2> This seems obviously ludicrous to me. Tesla is, if anything, deeply behind the market leaders. Optimistically, maybe it's only a little bit behind. Has Tesla demonstrated any kind of significant city-streets ability on any of its cars? Unprotected lefts? Negotiating pedestrian-heavy intersections? Sharing the road with bicyclists?</comment>


Apple's protected App Store doesn't look so bad now - <AUTHOR> http://www.loopinsight.com/2011/03/30/apples-protected-app-store-doesnt-look-so-bad-now/ <comment><USER2> To me, it's less about the protected app store and more about the fact that the protected app store is the _only_ way to get apps on your iOS device. Allow sideloading, and suddenly the protected app store is not really an issue.

<comment><USER3> While I don't agree with the author in regards to the app store Apple's restricting installs to the App store is a valid security measure. Allow side loading and there's literally no way to secure the device any longer (which is why PCs have so much trouble)

<comment><USER4> As long as it goes by the Android model (turned off by default and made clear that once activated that sideloading can be dangerous and warranty voiding), what wrong with that? Isn't it a person's personal decision whether they want to prioritize security?

</comment></comment></comment><comment><USER3> This is a straw man argument. Apple's rarely been criticized for a restriction that safeguarded the user. In fact, most of the criticism of the review process isn't criticism of an individual restriction at all but criticism of the fact that Apple doesn't publish its policies. So you don't know what you are and are not allowed to do.

As for Google being open doesn't mean you have to be reckless. Nothing about doing a basic security check contradicts a policy of letting every legitimate app into the store.

</comment><comment><USER5> I agree with the fact that Apple made a smart move by controlling submissions to the App Store, but I think some responsibility lies in the owners hands in the case of Android. Too many download apps and never once look at the permissions involved before installing. For example if a ringtone app asked for geolocation, something is probably fishy.

</comment><comment><USER6> I wonder sometimes if there is some way that you can have an open store, but keep out malware. Or does keeping out malware always entail some sort of app review process? If it does, then, yeah I would much rather have the closed, app reviewed store than the open one. Getting a virus on my computer somehow doesn't seem as bad as getting a 'virus' on my phone. That's just me though.

<comment><USER7> _If it does, then, yeah I would much rather have the closed, app reviewed store than the open one._

I wouldn't object to a stronger review process for the Android market, specifically because Android allows the option of installing apps from outside the market.

 _Getting a virus on my computer somehow doesn't seem as bad as getting a 'virus' on my phone._

That seems to be the general feeling, but it doesn't make a lot of sense. Your computer is at least as likely to have sensitive information on it as your phone, and is more likely to have stuff like business and financial information. I'd really like somebody to ask Apple "since it's so important to remove any possibility of malware, how can you justify continuing to allow Macs to run software from any random source"?

</comment></comment><comment><USER8> The Google store is closed to malware the same way the Apple store is. Both stores have automated software to check for malware before approval, and both stores have mechanisms to remove malware afterwards. Apple's checks are more thorough and have humans in the loop, but neither are infallible.

</comment><comment><USER9> >With the malicious apps installed, the developer was able to gain access to the customer's IMEI and IMSI, product ID, model, partner, language, country, and userID. In a statement released by Google, they said it's believed that only the IMEI was compromised.

Number one, who cares.

Number two, they were revoked and remote deleted.

Number three, nothing about Apple's process actually ensures that this can't or doesn't happen. It may have some affect, but there have been mistakes made in Apple's store as well.

I don't find the conclusion to be appropriate. "Most people just want to feel safe."?

"They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety."

<comment><USER3> _Number three, nothing about Apple's process actually ensures that this can't or doesn't happen. It may have some affect, but there have been mistakes made in Apple's store as well._

We really don't know the specifics of Apple's process so you really can't say that. Also the author makes the point that he can't think of a malicious app that made it into Apple's app store and I agree with him on that. I can't think of anything either. If you can think of one than you should tell us otherwise you shouldn't say Apple's made similar mistakes.

<comment><USER10> Considering Apple has removed apps after the fact for learning they had functionality they did not desire to be available (Camera+ using volume control for other things, or Yelp's special feature that was turned on via gestures or shaking or somesuch), there is 0 reason to believe they will catch outright malicious software.

</comment></comment></comment><comment><USER11> this is exactly correct. kudos to Apple for having the foresight on this one.</comment>


Ask YC: do you have a business plan? - <AUTHOR>

Do you have a formal business plan with budgets, market research, marketing plan, etc. or do you simply have an idea that you work on, hoping that somebody will like what you build?
Personally I write concept papers that discuss what the product is, why it is great, who will use it, and a rought sketch of where the money will come from.
What do you do ? <comment><USER3> 1) Write scripting language for mobile phones.

2) ....

3) Profit!

</comment><comment><AUTHOR> To add a bit to the above.

Having done startups with investors I know that formal business plans are invaluable to them, preferably printed on nice glossy paper with lots of whitespace and nice pictures.

But when it comes to actually doing what is stated in the businessplan after you have your funding things seem to change so fast that either you have to spend a lot of time updating it, or else just leave it and go and make your product work.

I tend to opt for the latter.

</comment><comment><USER4> Funding and outside influences aside, writing a business plan is still one of the most important aspects of developing your product. When working on an idea, if my product isn't important enough to warrant a couple days pouring over the market research and putting something together, then the idea isn't worth developing.

This is especially true if you have more than one person working on the project. You need to make sure everyone stays focused on the big-picture goal, and that everyone is equally aware of the target market and projections for the company. You don't have to get incredibly specific in the plan though. Feature changes shouldn't need to be included in updates to the plan. But if your project is changing directions or target market, then the changes should be researched and plan updated accordingly.

That being said, I almost always leave out financial projections until later in the game after v1 has been launched, because even most investors will know that this section is complete BS before that point.

Oh, and all of this should of course be filed under "IMO".

</comment><comment><USER5> The closest thing we have to a full business plan is all the work done for the YC App. The first time we did it we didn't see the character limit so our app was something like 10+ pages. We edited the whole thing down but kept the original and called it our pseudo business plan.

</comment><comment><USER6> Well, in my humblest of opinions, a full fledged business plan is not really necessary until you are looking for angel and institutional funding - <USER2> you do not necessarily need a fully detailed business plan for angels, I think it adds a level of professionalism and lets potential investors know that you have thought out your business

If nothing else, putting together a BP is a great exercise for you and your team to go through to minimize risks \--

My company has ~15pg BP at the moment

</comment><comment><USER7> I'm currently writing one.

My business is struggling to get a merchant account because it's basically a 3rd party processing app, which most banks wont touch with a barge pole.

The business plan will be used to illustrate what the business is, how we expect it to make money and how we expect to try and grow the business. Using that we can hopefully either convince a bank that we're not the fraud risk they assume we are, or attract an investor to give the company more respectability..

</comment><comment><USER8> 1) conceptualize

2) implement (keeping in mind things will change)

3) get feedback (indicating how I will change things)

4) scrutinize what I have conceptualized or implemented against feedback I get

5) continue on to either step 1 or 2 depending on what happens in step 3 and what I choose is the focus of step 4

</comment><comment><USER9> I got one, I used Business Plan Pro software, pretty friggin cool if you ask me. I had no idea about how to do a business plan before but it's pretty good at guiding you threw it.

www.BusinessPlanPro.com

It's like 100 bucks but ... * cough ... * cough ... Usenet Cough.

</comment><comment><USER10> 1\. Build it; 2\. They come; 3\. Profit!

I don't have any formal business plan, but I already know exactly what my audience is, why they NEED what I'm building, and how they'll find out my product exists. It's a niche thing.

</comment><comment><USER11> That depends on what you mean by the word 'a'.

</comment><comment><USER12> We have one, but it's more a general roadmap than a specific plan that we follow line-by-line.

</comment><comment><USER13> 1) Not fail

2) See 1

</comment><comment><USER14> "what the product is, why it is great, who will use it, and a rought sketch of where the money will come from"

This may sound strange, but I use the first page of my website as my "business plan". No sense working on anything else until it answers all of these questions in an instant.

<comment><USER15> The first page of my web site answers those questions...

<http://ourdoings.com/>

...but I don't think that constitutes a business plan, not by a long shot. I need business plan help, big time.

<comment><USER16> The hard part is not writing a business plan. The hard part is tossing all the junk out.

</comment></comment></comment><comment><USER17> its fine as long as your business plan is not a plan for you to build your business ..its only purpose is to look good on paper and get the money in....somethings are best use and throw

</comment><comment><USER18> what's a business plan?</comment>


Ask HN: Who's hiring non-developer/designer positions? - <AUTHOR>

There's always some people like me who love technology and work at start-ups, but have no programming or design skills.<p>thanks <comment><USER2> Obviously, at a tech startup, the primary street cred comes from being able to do something technical. This doesn't necessarily mean coding or sysadminning, but it DOES mean that you have to produce something in order to even get any credibility.

My biggest issue with non-technical people is so much of what they do doesn't produce deliverables. Sales/marketing? Might produce some brochures. Sure produces money. But they don't actually build anything, making it hard for my brain to properly evaluate their skills.

So if you're a non-technical person, what will you produce that can be evaluated? Soft deliverables, such as reports, sales figures, etc., are more difficult for a technical person to evaluate -- so we tend to discount them (rightly, or wrongly) because the underlying knowledge of "how much talent / time / effort did this require" isn't inherent in the work.

<comment><AUTHOR> Sure you can. It's called revenue dollars. Most positions, whether we like it or not, can be evaluated on a quantitative basis.

Sales/marketing ---> brochures? How about sales/marketing ---> money.

That's your problem that you tend to discount sales reports.

<comment><USER3> _Sure you can. It's called revenue dollars. Most positions, whether we like it or not, can be evaluated on a quantitative basis._

To who, exactly, do you ascribe those revenue dollars?

The UX designer that came up with the feature the critical customer wanted?

The developers who collaborated and created it?

The QA team that made sure it actually works?

The sales person that sold what was there?

The salesperson's value isn't particularly clear in this equation. Could we replace them with another sales person? What did they bring to the table that was actually unique to them and not easily replaced? Would we have made the sale anyway?

It's an incredible relative, subjective judgement to have to make.

<comment><USER4> All sales are the result of sales people, just ask a sales person, they'll tell you.

</comment></comment></comment></comment><comment><USER5> Seek management jobs... Har. In order to work at a tech company, you should be as knowledgeable about tech as possible, otherwise you'll end up being another out of touch employee who can't pull their own weight in a desk job. If you have writing skills, you can seek employment as a tech writer or in administration.

<comment><AUTHOR> [1] Reddit is run by four developers, who are not out of touch, who can't make enough revenue despite their enormous size.

[2] Management jobs =/= non-developer jobs.

[3] What do you mean knowledgeable about tech as possible? Code, trends, ideas...?

[4] How can an out of touch employee not pull their own weight in a desk job? Nick Denton, Heather Harde, Eric Hippeau..guess all of these "can't pull their own weight in a desk job"

<comment><USER3> _[1] Reddit is run by four developers, who are not out of touch, who can't make enough revenue despite their enormous size._

Reddit is owned by Conde Nast. They don't have business people?

<comment><AUTHOR> " Whenever this topic comes up on the site, someone always posts a comment about how reddit is owned by Conde Nast, a billion-dollar corporation like Time Warner or Cobra, and how if they wanted to they could hire a thousand engineers and purchase a million dollars worth of heavy iron. But here's the thing: corporations aren't run like charities. They keep separate budgets for each business line, and usually allocate resources proportionate to revenue. And reddit's revenue isn't great. "

<http://blog.reddit.com/>

<comment><USER3> That quote has absolutely nothing to do with anything we were just discussing.

Reddit's revenue isn't great, and company's maintain distinct budgets for different properties, but exactly what does that actually have to do with Conde Nast having business people that should be paying attention to this?

</comment></comment></comment></comment></comment><comment><USER6> From the jobs page: Justin.tv is looking for a Head of Communications - <http://www.justin.tv/jobs#communications>

[I don't work there, just remembered seeing it on the front-page a couple of days ago]

</comment><comment><USER7> Do you have some marketable skill? That's what you need to focus on. Just being enthusiastic is usually not enough.

Are you good at sales? Do you have demonstrated ability as a product manager? Or maybe a background in technical writing? Etc.

<comment><USER8> As a product manager I face this dilemma as well. I work on side projects but I'm not a great coder and not a great designer.

The following areas have helped me become more 'active' in the early development process:

-Learn an analytics engine (I like Google Analytics) like the back of your hand. Help engineers build great testing tools that work well w/ your analytics engine, then segment + comb the data for patterns that shape the direction of the company. (see: <http://www.kaushik.net/avinash/> and buy "Web Analytics 2.0" from Amazon for more info)

-Become very familiar with A/B split testing and other forms of automated online testing. Try to gain an understanding of adwords as well so you can send targetted users to your offerings and help developers make informed decisions about whether or not the product will have interested users that are cheap to acquire off the bat. (see: <http://visualwebsiteoptimizer.com/split-testing-blog/> for expertise/more info)

-Buy Silverback (<http://silverbackapp.com/>) and conduct user tests CONSTANTLY as in every day. Continously analyze the product, summarize user input, and pass that info off to development.

-Buy Balsamiq Mockups (<http://www.balsamiq.com/products/mockups>) and start prototyping pages with improvements or new features for existing apps. This can filter into User Experience/Information Architecture and I find that it's the best way for a 'product manager' to bridge the gap between design and development.

Sorry I know that these won't get you hired right away, but they will give you the skillsets to work at a small (5-10 person) startup that is hiring people who can 'contribute.'

<comment><USER9> Can you contact me at the address in my profile? Sorry to pollute the thread, but you don't have any contact info in your profile :(

I'm in a similar situation, and would love to break into the product management area.

<comment><USER8> Sorry I didn't realize the e-mail field didn't show up publicly! I'll send you a quick note and updated my profile to include my personal e-mail going forward :)

</comment></comment></comment></comment><comment><USER10> What about technical support and customer service? Are you willing to do that? You could then get into customer development or something like that.

But I can't answer your question as to who is looking.

</comment><comment><USER11> I launched startupshiring.com a week or two ago. It show cases positions at startups that are programming and non programming oriented. Take a look. Love to hear your feedback as well.

<comment><USER9> Really nice! I'm looking to possibly relocate in the next year, so this will be helpful in determining any jobs that might exist in other cities.

</comment></comment><comment><USER12> I'm a marketing/technical writer, and I've been wondering this too. A lot of startups do the writing themselves, it seems, and it can suffer as a result.

Do people at startups ask their buddies for recommendations? I haven't seen many posts on Craigslist from startups, and nothing on job search sites like Monster.com.

</comment><comment><USER13> I currently work with a guy who is a master of monetization - and he's completely tech-braindead. Startups chase him down with countless lucrative hiring offers every day.

You get good at monetization and you become worth more than your weight in gold.

</comment><comment><USER14> <http://www.builditwith.me/>

<comment><USER15> Very cool, did you make that? Is it Sproutcore or Cappuccino?

<comment><USER14> No, author is <http://www.drewwilson.com/>, it's Titan.

<comment><USER15> Thanks.

</comment></comment></comment></comment><comment><USER3> So what do you do, exactly?

We've talked about contracting a professional writer to help get our blog and website into shape, ride us to blog about what we're doing, and help edit what we do write.

<comment><USER16> I'm not a "professional" writer, but I do write fairly often, and am working on my own startup. I am looking for some part-time work sort of along the lines you are mentioning.

What's your site/blog? You can check out my writing at <http://aflanagan.com> and <http://blog.lenguajero.com>

Contact me if you want to talk more.</comment></comment>


Mkosi by Lennart Poettering – A Tool for Generating OS Images - <AUTHOR> http://0pointer.net/blog/mkosi-a-tool-for-generating-os-images.html <comment><USER2> For some time, Lennart Poettering et al. has been working on improved infrastructure for... actually I don't know what to call it. It's not just containers and isolation and statelessness but also distribution and upgrades.

What's interesting here is that he's working on standard stuff, i.e. things that end up inside the various Linux distributions.

Perhaps we are going to see a future where the distributions, due to improved default tooling (and tonnes of integration blood and sweat), out of the box end up being where Docker wants to be today?

Things like Project Atomic are already a thing. But I suspect we might see a landslide once the whole Linux landscape moves in this direction, instead of just a few projects on the fringes.</comment>


Not just bad health IT, but spectacularly bad health IT - <AUTHOR> https://hcrenewal.blogspot.com/2018/01/not-just-bad-health-it-but.html <comment><USER2> It might have been better to link to the original post: [https://peds- mommydoc.blogspot.com/2018/01/is-marital-status...](https://peds- mommydoc.blogspot.com/2018/01/is-marital-status-of-5-year-old-child.html)

        The final summary and diagnosis section was the most
        entertaining part, which read: "primary diagnosis:
        none."  Seriously, are you kidding me? No diagnosis?
        This is the future; technology will seal the fate of
        our profession as one entirely devoid of the need for
        any cognitive skills. This earth-shattering conclusion
        after sixteen (16!) pages of documentation was utterly
        astonishing. Despite the considerable time and effort
        invested asking a febrile five-year-old whether he was
        married or having consensual sexual intercourse in his
        spare time, little to nothing was provided in regard to
        healthcare.

<comment><AUTHOR> Oops. I have linked the original here: [https://news.ycombinator.com/item?id=16239176](https://news.ycombinator.com/item?id=16239176) . Apparently I can't delete this post.</comment></comment>


Sorry, graphene–borophene is the new wonder material that's got everyone excited - <AUTHOR> https://www.technologyreview.com/s/613267/borophene-the-new-2d-material-taking-chemistry-by-storm/ <comment><USER2> Typographic note for future headline writers: If your headline only parses properly with line breaks, then it will probably cause confusion when someone else links to you. I thought this article was going to be about a hybrid material called "graphene-borophene" because there is minimal visual difference between hyphens and an em dashes here.

<comment><USER3> Not to mention the whole "sorry" smugness intended to make it sound like graphene is now suddenly useless.

There is some overlap, but the practical use cases described seem more of a more complementary nature. The novel attributes don't really seem to put these two in competition.

And there is the expectation of more to come, since we can expect discoveries into other substances that produce useful effects when treated and applied in ways similar to graphene and now borophene.

</comment></comment><comment><USER4> Obligatory - [https://www.youtube.com/watch?v=2IfCUsBpR-I](https://www.youtube.com/watch?v=2IfCUsBpR-I)

<comment><USER3> I'm pretty sure this is only obligatory on Reddit and other related goof-off sites.</comment></comment>


Golden Rule for Startups - <AUTHOR> http://www.paraschopra.com/blog/personal/golden-rule-for-startups.htm

<comment><USER2> Talk about "burying the lead": the 'Golden Rule for Startups' from the article is "Harder a business to start, better will be its eventual returns."</comment>