Equifax blames open-source software for its massive security breach, Really? - <AUTHOR> http://www.zdnet.com/article/equifax-blames-open-source-software-for-its-record-breaking-security-breach/ <comment><USER2> This is clickbait. In 2017, most major breaches will trace back one way or another to open source software, simply because open source software dominates the serverside software market.

Pointing out that patient zero in a breach was a server running Struts is, obviously, not the same thing as "blaming open source". ZDNet just wants it to be, so that they can get their share of clicks for a story they've done no real reporting on.

<comment><USER3> Clickbait perhaps, but also tech press noting that if it was a Struts problem then it was either a 0-day when it happened or it happened months after a patch was made available and widely publicized.

<comment><USER2> Doesn't matter. The "zero day" thing is a red herring. If you operate a business like Equifax, technically you're responsible for infrastructure vulnerabilities whether they're known or not. You assume your app servers could get compromised by an unknown vulnerability; you design your applications to minimize attack surface to reduce your risk, and then build in layers of controls and additional defenses to mitigate the impact of such a vulnerability.

Nobody Fortune 500 company besides Google, Microsoft, Facebook and Apple really does this effectively (and even then, the track record isn't great). But that doesn't change anything about the analysis.

</comment></comment></comment><comment><USER4> I think a more accurate headline would be "NYPost claims that a non-technical source at Equifax blames open source software for its massive security breach"

<comment><USER5> wow

>According to an unsubstantiated report ... citing no evidence... The firm's source.....is believed to be Equifax.

</comment></comment><comment><USER6> Well, it probably was some open source software because they probably run Ubuntu/Linux, or MongoDB or MySQL etc. Probably misconfigured. But this is blaming tools rather than people and their own security team.

Many companies successfully run very secure large scale operations on open source, specifically Google.

</comment><comment><USER7> I blame the public roads when I get robbed. I mean, without those, how would the robbers get to my house? I think everyone should have a private, security patrolled road to their house.

<comment><USER8> Burbclaves

</comment></comment><comment><USER9> It's time for the Equifax CTO to collect a few million $ bonus check and then leave for "new challenges".

</comment><comment><USER10> That's an interesting turn of events. I was always told to use open source because it is safer (due to it being available publicly and all), but is it really safer to expose every bit of detail to all gov, grey, white and would- be black hats? I have been told this is true ever since the dotcom boom but the elevated state of global hacking now has had me double guessing that assumption.

But let's be honest here, the only other large-scale "trusted" enterprise vendors are Microsoft and Oracle and their developers are getting to be way more expensive than a typical "open-source developer". And do we really want to trust those who already betrayed us way back when?

So what are the probable solutions here? Most niche (and sometimes widely- used) open-source libraries are notoriously buggy, lack documentation, and usually don't have more than a few real contributors. Hybrid model perhaps? But what does that really mean?

<comment><USER11> Have there ever been exploits in closed source software, including 0-day exploits? Most definitely. So you would want to use the highest quality software you can for a given purpose, but even that isn't enough. In reality, the answer is defense in layers.

First layer -- if you are running on RedHat or CentOS, make sure to have SElinux in enforcing mode, and resolve any SElinux errors the correct way.

Second layer -- separation of concerns. The same way that many businesses accounting operations are set up, you need to have a security breach at several layers at the same time to have an issue.

This may mean that having the public facing web server talk to an app on an internal server, using a defined API, and that internal server only has firewall rules open for what is required.

That internal app server then may have access to a database server in another security zone, making requests utilizing specific API patterns. At each level, have auditing software to look if any of those patterns change unexpectedly. Also, rate-limit the amount of data that can be pulled from the DB server on a daily basis -- this would mitigate a massive data dump situation.

You could go even further, and have the web-facing side talk to an internal web server, after going through a layer that validates each request fits a given pattern. Of course this is a pain to keep updated as the app gets updated, but then again when the consequences of a security breach are high enough, this level of pain is worth it.

</comment></comment><comment><USER12> I think the most likely explanations are that the hackers either exploited an unpatched application using Apache Struts or exploited a SQL injection vulnerability in an application using Apache Struts.

</comment><comment><USER13> Wow. Just wow</comment>


Candle flames contain millions of tiny diamonds - <AUTHOR> http://www.physorg.com/news/2011-08-candle-flames-millions-tiny-diamonds.html <comment><USER2> I am more surprised it contains fullerenic particles ( <http://en.wikipedia.org/wiki/Fullerene> or familiarly buckyballs) as well.

<comment><AUTHOR> It actually makes sense that the carbon atoms would recombine to form every form of carbon in the high temperature of the flame before pairing off with an oxygen atom or two and flying off as CO or CO2.

<comment><USER3> This is not something I would have expected, but it makes sense. All possible reactions between reactants occur, but the kinetic or thermodynamic products are the significant ones we look for and isolate.

</comment></comment></comment><comment><USER4> This is astoundingly bad scientific writing. I'm actually in awe.

<comment><USER5> This article has distinct smell of automatic or computer-assisted translation all over it.

<comment><USER6> Or even just plain human translation, which was my first thought. It also sounds a little promotional.

</comment></comment></comment><comment><USER7> "A million fucking diamonds Michael!" -Lindsay Bluth Fünke

</comment><comment><USER8> Now the question is, how can De Beers extend their extorted monopoly to all flame?

<comment><USER9> They're probably working on a candle diamond detector right now.</comment></comment>


Bill Gates: My parents took me to a child psychologist - <AUTHOR> http://www.expressandstar.com/entertainment/showbiz-news/2016/01/31/bill-gates-my-parents-took-me-to-a-child-psychologist/ <comment><USER2> I _wish_ my parents had taken me to a psychologist when I was having trouble in school. Instead, I was usually punished. I was raised by conservative, psychiatrophobic parents and I never got the help I needed until after college. I'm in my early 20's. I was lucky to have the meta-cognitive awareness needed to identify that something was wrong, and that it had gotten worse. After recently getting care from a professional my quality of life and productivity improved across the board. It almost breaks my heart how much it has helped me. I feel as if I could have been so much more successful in academia. I definitely would have led less of guilt-ridden academic life.

Even if you do not have anxiety, major depression, or other disorder - I think basic psychological therapy is something almost anyone can benefit from. We like to think friends and family are all we need for help during a rough time or troubling period, but, no matter how well intentioned they might be, they are usually the least qualified to help you. It's important to have a professional to talk to in these situations. With children this is even more so.

Psychiatrists can see the red-flags that others often ignore, or brush off as personality quirks. This was the case with me for long time. I would have had a better academic life if the "ADD is bullshit" meme never happened. For me, this prevalent mentality prevented me from receiving the health-care I needed, especially with regards to my very private (and personally shameful) crippling anxiety. I hope one day basic psychological check ups for children become as routine as a dentist visits. There are so many benefits to keeping tabs on your mental health and the only downside is the current social stigma.

If your child is acting up, consistently has trouble with areas such as organization, or is all over the place with grades - please don't assume he or she is lazy or doesn't want to succeed. Help them by taking them to someone who can see things you cannot, and possibly find an easily solvable underlying problem.

<comment><USER3> While I certainly wouldn't affirm what your parents did or suggest it to be a preferred course of action, I'd also hesitate to suggest taking a child to Psychiatrists as any sort of knee jerk reaction. While you say you'd have had a better academic life if the "add is bullshit" meme was gone, mine would have been far better if the meme caught on faster. I hope you understand my wanting to disclose the following on a throwaway, but I was medicated HEAVILY for "ADD" for the vast majority of 2nd through 4th grade, and to this day some of my strangest memories are from those years, during which I developed broad slews of physical ticks and OCD-like behaviors that took me decades to train myself out of, and certainly compounded the damage to my learning and social development that the medication had already begun.

I would be TERRIFIED if psychological checkups became routine, and see that as near-dystopian as some aspects of brave new world. For so many people (I say this now being married to a psychologist of my own) including myself are diagnosed with disorders of extremely variable diagnostic validity at extremely young ages (beyond even what the DSM, with its already spotty contents, would recommend) and then medicated past functionality and/or told we have something wrong with us.

What would have helped me? If instead of being told "you need these pills to fix you" someone told me that "normal is a spectrum", and people even with behaviors we love to tag with fancy names and try and treat can learn to control them and live perfectly normal lives without drastic intervention.

Don't take this as a "we should ignore psychological disorders", it's not the intent at all. Take it as a, I've seen the culture that arises out of LOOKING for mental issues rather than encouraging growth and maturation, and I'd rather resort to a psychological approach as we do with antibiotics, _when needed and after extensive exploration of other options_, lest we unconsciously do ourselves further disservice. Although I have a different takeaway than you though, I'd echo the same guiding thought, "don't assume he or she is lazy or doesn't want to succeed" but would append "or assume they are broken."

<comment><USER4> I think the parent had a very positive experience with a good psychologist and has extrapolated that to think everyone would benefit from coming in contact with the quality professional that he/she was in contact with.

Which's another way of saying 'it is nice to meet people who are really good at what they do and can happen to help you'.

The flip-side is what you're describing - that most people are not that good at what they do and ultimately - it is usually a frustrating and tedious process of poking in the dark until something works.

For psychological issues it's often a slew of things and having one person make a significant difference in your life is a little miracle.

The thing I like that you mentioned is that you trained yourself out of behaviours that you found to be counter-productive. Which's largely my point - until one takes responsibility for the problems they're facing and stops hoping for an easy fix, it is unlikely to work out in the longterm and I don't know that a psychologist is capable of making somebody a life-long learner if you're not one to begin with.

'When a student is ready, a teacher appears' :)

<comment><USER2> When someone has spent years hiding compulsions, tics, tendencies, mood swings, panic attacks, delusions, irrational fears, and other neurotic behaviors, it's not as simple as "training yourself" out of it.

> until one takes responsibility for the problems they're facing and stops > hoping for an easy fix...

You have just delivered a more eloquently articulated version of the "be a man and suck it up" mentality that does way more harm than good. This sort of reductionist hand waving does not result in useful or practical advice. I suspect it is coming from your limited experience with these issues.

EDIT: I also find it gross that you consider getting help from a psychologist an attempt to find a "easy fix". As if sufferers don't put in A LOT of additional effort themselves...

<comment><USER5> What health-care did you require? It is hard to imagine a scenario where someone can "become better" without having an internal, personal, change. I don't believe psychiatrists can think for you (though they can certainly feed you thoughts).

<comment><USER2> > I don't believe psychiatrists can think for you (though they can certainly > feed you thoughts).

Right... like I said, it takes A LOT of effort on the suffers part. It's none of you business, but I take an SSRI and do cognitive behavioral therapy for OCD. The behavioral therapy is for learning and developing good habits and the medication helps prevent intrusive and obsessive thoughts. Nobody is "thinking for me" (It saddens me that this is the prejudice you have). These professionals help me help myself, by giving me tools, information, and guidelines I would not have access to otherwise.

A college-level course on object oriented programming isn't going to magically make you a good Java developer, but it may help you learn in a more sophisticated way than a self-taught curriculum. Either way, you wouldn't shame someone for "not helping themselves" or "taking the easy way out" by enrolling in such a course.

<comment><USER5> >Nobody is "thinking for me" (It saddens me that this is the prejudice you have).

As I said, I don't think that is possible.

I only meant to counter-point your point:

>it's not as simple as "training yourself" out of it.

In some sense, it is that simple, as that is really the only base tool that one can access (probably why CBT is so helpful). That is, no one else can 'train you out of it'; they might be able to show you the door, but you have to walk through it.

<comment><USER2> No, it's not that simple. You're actually contradicting yourself a lot so I'm debating if it's worth replying.

> (probably why CBT is so helpful)

I'd say the medication is more helpful, to be honest. BTW, "that's probably why CBT is so helpful" does not follow from "training yourself is the only base tool that one can access". CBT is not at all training yourself. It's almost literally the opposite.

<comment><USER5> Please list a self-contradiction.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I started drinking in 8th grade, moved to marijuana soon after, and did many drugs in high school. I did many stupid things, and graduated with barely a 3.0. I was a "wild child", and although I was raised by a very intelligent and successful single mother, she said I couldn't be controlled and thought giving me freedom was the best solution for me.

In college, I had sort of a "been there, done that" attitude to parties and substances while many of my peers were just starting to experiment. I realized that this was my chance, and if I didn't buckle down and study, I was going to wind up a failure in my own eyes.

Would I want what I went through for my own kids? No. In hindsight I would have put more boundaries and controls on myself. But I turned out OK. There's hope for everyone.

<comment><USER7> Your's is an interesting story. I'm glad for you that you were able to recognize what was happening and change. I agree that there is hope for everyone. Freedom to create your future is a heavy task, but as a song goes: "the weight is a gift".

I had a similarly difficult transition to "adulthood" \- mine happened after a vanilla engineering college experience though. After I found out post-college life isn't anything at all what I expected, I went through a period of self- loathing, depression, reckless behavior and substance abuse.

Somewhere in the fog, I found a wonderful book about self-compassion and was able to muddle towards a better sense of wholeness. Then, I re-discovered a love for programming and threw myself into that with a renewed sense of direction.

A common theme that I've observed in people's stories who were able to "help themselves" was the realization that they are solely responsible for their success in life. Circumstances and other people will aid or obstruct, but ultimately the only thing you can control is your response to external events.

</comment></comment><comment><USER8> This was an interesting quote.

"I worked weekends, I didn't really believe in vacations," Gates says of his early years at the helm of Microsoft.

"I had to be a little careful not to try and apply my standards to how hard [others at the company] worked. I knew everybody's licence plate so I could look out the parking lot and see, you know, when people come in. Eventually I had to loosen up as the company got to a reasonable size."

<comment><USER9> >> I knew everybody's licence plate

Wouldn't it'd be easier to just remember what car people drove, than the plate? Dave drives a green, older Ford Bronco. Jim drives a new red Porsche.

<comment><USER10> I have this thing where I accidentally memorize license plates in the same way you might accidentally memorize what car people you know drive. It's a completely automatic process just like everything else we effortless memorize throughout the day. And, I've never thought about this before, but the cars themselves actually don't stick very well. Bill says it so casually that I wonder if it's the same for him.

I grew up near Microsoft, and it might help to know that until recently Washington plates for standard cars have all been 6 characters long in the form 123-ABC or ABC-123. On top of that there are a ton of common patterns on the road at any given time due to the way they are distributed. So they are pretty well designed to be memorable.

As an aside: We're now on a 7 letter system in the format ABC1234, and that's most of what you see on the road. These don't stick quite as often -- I can't tell if that's the format change or if I'm just aging or more often lost in thought and not noticing the world around me or what. I believe they _all_ start with A now, so it's not actually an extra letter to memorize, but I think the format change modifies the rhythm to the plate and makes it so it doesn't automatically chunk and therefor doesn't automatically get memorized. I guess trucks (before this change) have always been something like B12345D (where it's always B and usually ends with D, I think) and those didn't stick very well, either.

<comment><USER11> When my son was 5, he would ask me if we were going in the "455 car" or the "378 car". Both cars were the same model and color, but he had the plates memorized.

Now that he's 6, he has about 300 digits of pi memorized. He's also got the entire periodic table, and the song "Yakko's World" (all of the nations).

Some people have an easy time with faces. Others have an easy time with data.

<comment><USER12> What inspired your 6 year old son to memorise 300 digits of pi?

<comment><USER11> he watches lots of educational and semi-educational videos on youtube. I believe the one that inspired him was [https://www.youtube.com/watch?v=Skf8NTEnrO4](https://www.youtube.com/watch?v=Skf8NTEnrO4) though he has half a dozen other pi songs he watches as well.

He also regularly asks me questions he's learned the answer to from videos, like "why isn't the District of Columbia a square?", "which countries in South America don't have oceanic coastlines?", and "what would happen if you tried to make Graham's Number but you used 2's instead of 3's?"

<comment><USER13> also he can fly, tell the future, and count backwards from the last digits of pi.

Sure.

<comment><USER11> I'm disappointed that I don't appear to have a "flag" button at the moment. There's really no need to be a dick about someone else's young child on Hacker News (or in any other circumstance), at all, ever.

To bring this back to the topic, though: yes, my son is an absolute genius when it comes to data. I'm not making it up to score internet points. I actually have a six year old who has legitimately reached 4096 in the game 2048, and who has a basic understanding of what a "limit" is, and who in the last week has really taken to fractals. That doesn't mean he's good at everything -- we're still working on pooping in the toilet, not talking in the middle of someone else's sentence, and not having a gigantic meltdown if his milk is in a green cup instead of a yellow cup.

Point being, it may initially seem weird that Bill Gates memorized license plates rather than car makes and models, but that may just be what his brain handles well.

<comment><USER13> > To bring this back to the topic, though: yes, my son is an absolute genius > when it comes to data.

I just highly doubt anyone who is so excited to return the conversation to their "genius" son. It's very [https://www.reddit.com/r/iamverysmart/](https://www.reddit.com/r/iamverysmart/) .

<comment><USER11> > _" It's very > [https://www.reddit.com/r/iamverysmart/"*](https://www.reddit.com/r/iamverysmart/"*)

This isn't Reddit. HN guidelines don't say "it's OK to be a jerk as long as you highly doubt someone". If you think I'm making stuff up about my son (who I'm very excited about because I'm a parent and that's how it works) to score internet points, the proper thing to do on HN is hold your tongue and not bother commenting, or use your downvotes once you've earned that right.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment> m-i-l Source link (Desert Island Discs interview): [http://www.bbc.co.uk/news/magazine-35442969](http://www.bbc.co.uk/news/magazine-35442969)

<comment><USER14> Thanks for the link, it made me look for the corresponding podcast [http://www.bbc.co.uk/programmes/b06z1zdt](http://www.bbc.co.uk/programmes/b06z1zdt)

<comment><USER15> The programme goes back continuously to the 1940's. It's very well known in the UK. Unfortunately they only have occasional fragments for the early programmes, but for instance I just found clips from the Dave Brubeck and Alfred Hitchcock episodes, from 1959:

[http://www.bbc.co.uk/programmes/p009y7kb](http://www.bbc.co.uk/programmes/p009y7kb)

[http://www.bbc.co.uk/programmes/p009y7js](http://www.bbc.co.uk/programmes/p009y7js)

Hitchcock mentions his upcoming production, a 'rather gentle horror picture' called Psycho!

</comment></comment></comment><comment><USER16> I had a particularly awkward conversation with my parents about 10 years ago when a family friend had joked about a psychologist following me around in kindergarten.. It turned out to be true and no one had ever told me.

<comment><USER17> Now I have to ask you to tell the whole story, pretty please :).

<comment><USER16> I honestly don't know much about it other than I was a weird kid and the school thought I was weird enough for observation. I don't think anything ever came of it though, I never changed schools or classes (not that I know what they would necessarily do about a "weird" 5 year old)

</comment></comment></comment><comment><USER18> > I knew everybody's licence plate

I have trouble remembering my own license plate number... but I'll argue that it makes me a better contractor, because I have to document everything, from the current architecture to the work I do.

<comment><USER19> That sounds exactly like something that a person who is unaware of their irrational biases would say.

<comment><USER20> But it might just as well be said by someone who IS aware of their irrational biases. So that's not actually a meaningful statement.

</comment></comment></comment><comment><USER21> From the BBC source program: [http://www.bbc.co.uk/programmes/b06z1zdt](http://www.bbc.co.uk/programmes/b06z1zdt)

"Hopefully make it [polio] the second decease ever, after Smallpox, to be completely eradicated"

Wrong, it would be the third decease ever. Rinderpest was the second.

[http://www.nytimes.com/2011/06/28/health/28rinderpest.html?p...](http://www.nytimes.com/2011/06/28/health/28rinderpest.html?pagewanted=all)

[https://en.wikipedia.org/wiki/Rinderpest](https://en.wikipedia.org/wiki/Rinderpest)

<comment><USER22> I have a feeling that statement meant to only include diseases that infect humans.

</comment></comment><comment><USER23> "I wrote the original software on Apple 2."

How Steve Wozniak Wrote BASIC for the Original Apple From Scratch [http://gizmodo.com/how-steve-wozniak-wrote-basic-for-the- ori...](http://gizmodo.com/how-steve-wozniak-wrote-basic-for-the-original- apple-fr-1570573636)

In case you were wondering why people in computing _hated_ Bill Gates with an undying passion. He still won't stop taking credit for others' work, and using the legal system to give himself special privileges (copyright and such) because of it.

<comment><USER24> "The Apple II Plus, introduced in June 1979, included the Applesoft BASIC programming language in ROM. This Microsoft-authored dialect of BASIC, which was previously available as an upgrade, supported floating-point arithmetic, and became the standard BASIC dialect on the Apple II series (though it ran at a noticeably slower speed than Steve Wozniak's Integer BASIC)." [https://en.wikipedia.org/wiki/Apple_II_series](https://en.wikipedia.org/wiki/Apple_II_series)

</comment></comment><comment><USER25> > He also selected copies of the world's great lectures on DVD as his luxury > item

The company and the products weren't named in the article but here's the link where Gates writes about them:

[https://www.gatesnotes.com/Education/Great-Lectures-from- The...](https://www.gatesnotes.com/Education/Great-Lectures-from-The-Teaching- Company)

Disclaimer: just their satisfied customer.</comment>


Show HN: Mrkff – An Information Overload Management Tool - <AUTHOR> https://mrkff.com/ <comment><AUTHOR> Developer Here

Hey everyone, for the last Startup School (September2019), I submitted this application - Mrkff. It still need work then but I have decided to carry it forward and release Mrkff in Alpha state as I continue to work on it.

Please feel free to leave any amount of criticism and advice. This is the first time I am releasing a product of any kind to the public, thank you all for checking it out.

Also as a note. I have gained an immense amount of respect for developers who work in the Natural Language Processing field. In this product I use several libraries to parse keywords to try my best to find keywords in the page that accurately represent the content.

I had to learn quite a bit about NLP so that I could create proper summaries. The algorithm I designed for summaries isn't ready for production right now since it still produces poor results, but I will be updating and releasing new features over the next few months.

Again, thank you all for reading.

<comment><USER2> A quick tweak of the css breakpoints might be a good idea - on my iPhone 11 the home page text is just slightly off screen in a one character wide column about six miles long (and a bit difficult to read). I can believe the product is super interesting but I can't actually tell in this format.

<comment><AUTHOR> Thank you for looking at it. I underestimated just how much css I would need. Thank you for bringing it to my attention

</comment></comment></comment><comment><USER3> You should test your site on FF android, as the page is unreadable. Text is vertical with very large whitespace areas in between.

<comment><AUTHOR> Thanks for the feedback, I never tested it on mobile, that was my oversight.

<comment><USER4> It's not just mobile. I normally have my browser on my desktop take half my screen, and when I visit the page, I just see super-huge icons that take up all the viewing area. I need to be on full-screen to make any sense of what I'm seeing.

<comment><AUTHOR> Thank you for checking it out. I tested the half screen on a large screen and I completely forgot to test the half screen on other sizes.</comment></comment></comment></comment>


How Perfect Offline Wallets Can Still Leak Bitcoin Private Keys [pdf] - <AUTHOR> https://www2.informatik.hu-berlin.de/~verbuech/klepto-ecdsa/klepto-ecdsa.pdf <comment><USER2> The crux of this argument is the following: The attacker must first create a compromised version of ECDSA. The attacker will now watch for consecutive signatures signed by the compromised ECDSA on the blockchain.

It's not as bad as it looks. Basically if your source code is audited and your random number is really random, you are fine.

A more easy to digest version of this news is here: [http://www.coindesk.com/research-hackers-install-backdoor- bi...](http://www.coindesk.com/research-hackers-install-backdoor-bitcoin-cold- storage/)

<comment><USER3> So, the attacker must inject a malicious ECDSA signing code to the victims bitcoin client?

If I get this right, it doesn't sound like sensible research to me at all. If you are able to get code to the victims computer, then you can just steal the private keys right away.

<comment><USER4> > If I get this right, it doesn't sound like sensible research to me at all. > If you are able to get code to the victims computer, then you can just steal > the private keys right away.

The private keys are not on the computer, but on a piece of hardware (like the Trezor). The researchers claim that they can get the private key from the Trezor, by feeding it malicious, unsigned transactions. At least that's how I understand it.

</comment></comment></comment><comment><USER5> I would like to see some analysis done on the Blockchain itself; it should be pretty easy to see if there are any compromised addresses like this according to their paper.

As it is, I think it's probably unreasonable for someone to worry if they're using a generally available audited ECDSA toolkit for their signature signing. You have to imagine that the ECDSA kit has a way of secretly storing these numbers and keeping track of their state across calls which might span months. Sounds hard to implement in an open source project.

On the other hand, the idea of something like a Trezor leaking information isn't too hard to believe; at least, now that this paper is written.

Those sorts of attacks don't seem likely to be economical, which is to say a highly secure hardware wallet implementation might be worth more as a company than any one user's single address. You probably couldn't do it more than once or twice before shit got real nasty.

<comment><USER6> You cannot distinguish malicious from legitimate signatures. From the paper: _' This can be done in such a way that only the attacker, who made the malicious implementation, can extract the secret from the signature, and that the distribution of malicious signatures is polynomially indistinguishable from legitimate signatures by anybody else.'_

<comment><USER5> Hmm, I must have read too quickly. The initial analogy they used didn't have that property. Thanks!

</comment></comment></comment><comment><USER7> Nothing really new here.</comment>


Smartphone boom could result in operator losses within three years - <AUTHOR> http://thenextweb.com/mobile/2011/02/03/smartphone-boom-could-result-in-operator-losses-within-three-years/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheNextWeb+%28The+Next+Web+All+Stories%29&utm_content=Google+Reader <comment><USER2> Nice concluding sentence: "The report suggests North American operators are most vulnerable to the increase in mobile data use, _plunging them into profitability by 2013_...."</comment>


Ask HN: Bug Fixing as a Service - <AUTHOR> I do 10-20h of freelance dev for a startup currently where I fix non-urgent bugs and things. They're short staffed and their devs don't have the bandwidth for it.
It got me thinking - could I offer this as a productized service charged at a fixed monthly price? I'd obviously only offer it for the tech stack that I excel at.
Though I'm not sure how you'd structure pricing for something like this.
I'd love to get feedback on this -- is it something that your startup/dev team might consider? The pitch is that it'll cost at a minimum $2-3x of your FTE dev time and more importantly, distract them from building core product that moves the needle.
Here's my math: $/hr value of dev on your team = $100/h (in the bay area)? Say they spend 6-8h fixing 1-2 bugs every 2w sprint. That's ~$1500/mo of your dev's time.
What if instead you paid $0.5x of that and got a similar SLA? <comment><USER2> It sounds like you're being used for cheap labour. Fixing as a service was Tweakys business model @ $80 per fix before they were acquired so there is a market there, just stop underselling yourself.</comment>


To Fight Global Warming We Must Tax All Recreational Exercise - <AUTHOR> http://freakonomics.blogs.nytimes.com/2008/05/20/to-fight-global-warming-we-must-tax-all-recreational-exercise/ <comment><USER2> "There are about 300 million Americans who consume about 1,500 calories per day."

Fail. When surveyed, the average American claims to eat around 2,000 calories a day, and studies have shown that people greatly underestimate that. Also, over 3,800 food calories per person disappear daily. Even if you consider that much of it is waste, the average number of calories eaten per day is well above 2,500.

Guess who just read "In Defense of Food"?

<comment><USER3> We'd better tax leftovers, too.

<comment><USER4> Not if they are left in the fridge. An air-tight fridge to be sure.

</comment></comment></comment><comment><USER5> it is a very blog entry, from the creator of Freakonomics. There is no real study, no real data, and wikipedia is quoted.

Not worth the read, insubstantial and borderline trollish. Disapointing comming from somebody like him.

<comment><USER6> Of course, he's trolling in response to similar behavior from the authors of the Lancet article.

The authors propose solving a health problem with economics, giving climate change as a motivation. Levitt is pointing out climate change is a poor motivation for what they are trying to accomplish, and, if you follow their reasoning to its logical conclusion, it will actually encourage worse health problems.

</comment></comment><comment><USER7> I believe that the Good Lord gave us a finite number of heartbeats and I'm damned if I'm going to use up mine running up and down a street. -- Neil Armstrong

<comment><USER8> Maybe he shoulda done the math.

Using his logic, if exercising increases you pulse rate from 70 to 140 beats per minute for 30 minutes per day and decreases your pulse rate from 70 to 60 beats per minute the other 23 1/2 hours per day, how much longer would you live after 50 years of this?

<comment><USER7> Neil Armstrong could be right. He may be referring to Kleiber's law ( <http://en.wikipedia.org/wiki/Kleiber%27s_law> ) and the Metabolic theory of ecology ( <http://en.wikipedia.org/wiki/Metabolic_theory_of_ecology> ). Apparently, "for most organisms, the average # of heartbeats in a lifetime is equivalent. Elephant ~ 30 beats/min. Shrew ~ 1,000 beats/min" ( <http://members.cruzio.com/~zdino/psychology/ecology.htm> ). "The size of these hearts differs enormously, but over the course of each species' lifetime, they appear to beat the same number of times - approximately 1 billion" ( [http://www.wellcomecollection.org/exhibitionsandevents/paste...](http://www.wellcomecollection.org/exhibitionsandevents/pastexhibitionsandevents/heart/WTD027771.htm) ).

<comment><USER9> I think edw519's point flew past you. Here it comes again:

A resting athlete's heart rate is lower than a resting couch potato's heart rate. What does that mean in the context of what you just posted?

<comment><USER10> _I think edw519's point flew past you. Here it comes again:_

Kinda mean.

<comment><USER9> Yeah, I've been grading exams the last two days. It's hard to be diplomatic after a while.

</comment></comment></comment></comment></comment></comment><comment><USER3> Also, for the next Earth Hour [1], we should consider the first minute to be 'Earth Minute', and all hold our breaths in the dark against global warming.

[1] <http://www.earthhour.org/>

</comment><comment><USER11> Very good. How do we solve the overpopulation problem, which is the root cause to global warming?</comment>


Managing Technical Lock-In in the Cloud - <AUTHOR> https://www.gov.uk/guidance/managing-technical-lock-in-in-the-cloud <comment><USER2> This is interesting, as the ruling party recently sold access to all medical data, for UK citizens; to amazon, without any approval or info provided to the public.

I feel there needs to be some legislation to make large cloud providers have standard tools/procedures to migrate between them, much like mobile phone service providers.</comment>


Introducing Redis: a fast key-value database - <AUTHOR> http://antoniocangiano.com/2009/03/11/introducing-redis-a-key-value-database/

<comment><USER2> _Redis is pretty much an Italian product; and like other Italian products such as Lamborghini and Ferrari, this schema-less database is amazingly fast._

<comment><USER3> I hope it isn't as unreliable in cold weather though: <http://www.clubscuderia.com/forum/showthread.php?t=1539>

</comment></comment><comment><USER4> And now I'm curious how Redis stacks up against Tokyo Cabinet ([http://www.igvita.com/2009/02/13/tokyo-cabinet-beyond-key- va...](http://www.igvita.com/2009/02/13/tokyo-cabinet-beyond-key-value- store/))

<comment><USER5> Are you using Redis in a high traffic and/or production environment?

<comment><USER4> I am not yet using Redis for anything. Nor TokyoCabinet, actually.

</comment></comment></comment><comment><USER6> This is cool, but do we need another key-value store?

<comment><USER7> answer here: <http://code.google.com/p/redis/wiki/FAQ>

The most important part for the lazy guys: So what is Redis really about? The User interface with the programmer. Redis aims to export to the programmer the right tools needed to model a wide range of problems. Sets, Lists with O(1) push operation, lrange and ltrim, server-side fast intersection between sets, are primitives that allow to model complex problems with a key value database.

As a proof try to play and download the source of our small twitter clone at <http://retwis.antirez.com> and imagine to write it with a plain key-value DB: it's much harder, and slower.

</comment></comment><comment><USER7> Before the next beta I've to select a license among GPL, LGPL, and BSD. Please help me if you have some idea about it. I always liked more BSD because there is more freedom, but for a project like Redis that is used like a 'service' maybe the BSD is not that useful and the GPL instead works as a protection. But I'm not _that_ sure.

<comment><USER8> BSD, MIT or Apachev2 is my preference. I really don't like the GPL and it does tend to turn off some folks from using open source projects. I would not be too concerned about someone taking the work closed source even if you do go BSD.

<comment><USER7> Ok everybody want BSD, so it's the way to go. About someone closing the source in a proprietary application, who cares as long as we can still access and hack on our source BSD-licensed? Ok we have a license :) Thanks</comment></comment></comment>


Do not use the first words in common sentences to create passwords - <AUTHOR> http://www.lightbluetouchpaper.org/2011/11/08/want-to-create-a-really-strong-password-dont-ask-google/

<comment><USER2> People who create the websites frequently get it wrong. (See also "JUST USE BCRYPT".)

If clever people with access to research and articles and advice and existing best current practice crypto libraries can get it wrong how do we expect the regular person on the street to get it right?

If banks - who are a real target with money to lose - can get their advice to customers wrong how can the customers be expected to learn?

Password security is a real mess. Someone could make a name for themselves if they did research and created a workable system that regular people could understand and use. Design some protocols and standards, release these as open standards and allow them to be tested and changable. And then hope that software creators and website designers build them in.</comment>


Windows 8.1 forces the user to interact in a way that doesn't work - <AUTHOR> http://user.wordpress.com/2014/02/15/windows-8-1-forces-the-user-to-interact-in-a-way-that-doesnt-work/ <comment><USER2> His point is valid. The ability to dismiss these tips would be ideal. However, most people would skip them and complain about how "unusable" Windows 8 is (without even taking a minute to learn the basics). In my opinion, these mandatory tutorials are a necessary evil.

The real issue here is that Windows 8 somehow recognizes Wacom pads as touch inputs (with swiping from sides support). If it recognized it as a mouse, it would simply tell the user to use "hot corners":

\- Top-Left: App switching

\- Bottom-Left: Start screen

\- Top/Bottom-Right: Charms menu

A one-time unskippable tutorial that you can get through in less than 10 seconds is probably not worth complaining about. Displaying the wrong directions to Wacom users is.

<comment><USER3> There is no mandatory user tutorial for the iPad.

True, sometimes you need to teach the user to do something, but if you're forcing this even for basic usage, you're doing it wrong (unless this was a really specific tool/procedure, and even then)

<comment><USER4> The iPhone ran tons of ads showing people how to navigate and use swipes and pinch-to-zoom before the product was released. That's really not an obvious thing to do with a phone, if you've never seen it before.

<comment><USER5> It seems that 2 year old babies that have never seen the ads knew how to do these things just fine. Heck, there are even videos of cats playing with an iPad and getting it to scroll and such.

Swipe with finger to scroll, tap to press, and even pinch-to-zoom are as basic interaction as interaction goes. You only need a second to get them if shown, and most people can even discover them instantly without being shown.

<comment><USER6> The Windows "tutorial" item in question is a shortcut for switching to recent applications. The equivalent action on iOS is either a four-finger swipe to the right, or else double-tapping the home button, then tapping on an app. These are obvious to 2 year old babies and cats?

<comment><USER5> No, but "switch to recent applications" is not a basic action.

It's actually an action you might not even use at all -- since you can do it in another way (home and click the app you want to open next).

It's not a common action since using apps is mostly a seggregated affair. Now you use this, after some time you go and use that. You don't usually flip from one to the next all the time.

<comment><USER6> Sure, and that's the case on Windows too. You can launch and switch exclusively through the start screen and never use the recent-apps swipe. It's just included in the tutorial popups for whatever reason (maybe because Windows users are expected to be more keen on multitasking, given its desktop heritage and since that's a point of differentiation for Windows vs. the iPad).

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I gotta wonder, is anybody at Microsoft really surprised that their decision to completely rework all of their 25-year standards of how their OS works has side effects of varying levels of bad in a huge number of relatively obscure use cases? This sounds like such a textbook example of why you don't do that.

I'm still running Windows 7 on my desktop PC. It has a mouse and keyboard. I have no intention of ever getting any kind of touchscreen, pen tablet, touchpad, or other alternative input device for it. I'll show some enthusiasm for upgrading when they make the mouse and keyboard first-class citizens again, instead of treating them like an afterthought in an attempt to get some traction on tablets.

<comment><USER8> Ignoring Modern UI in Windows 8 is relatively easy: [http://www.gizmag.com/windows-81-modern- ui/29552/](http://www.gizmag.com/windows-81-modern-ui/29552/)

<comment><USER9> Ignoring Modern UI does not make Modern UI completely disappear. Nor does it change the fact that Microsoft thought this was a good idea. Poor usability is poor usability. Microsoft messed this one up, and it will impact them and a lot of peoples perceptions of the future of Windows.

<comment><USER8> Nonetheless, for most people on this site using Windows, it makes sense to take the relatively simple (for HNers) steps to upgrade to Windows 8 and hide Modern UI, as Windows 8 provides various performance improvements over Windows 7, Modern UI notwithstanding.

</comment></comment></comment></comment><comment><USER10> microsoft does that all the time.

Last week I tried to signup for windows azure. It asked me to enter my credit card data, I did it and it was ok, then the signup fails without explanation ("contact support").

What is happening is, I believe: I am forced to enter a billing address in the country from which I am _connecting_ (hungary), but my card is from another one (italy). The first thing is stated _nowhere_ but I presume it is so after various attempts at inserting non-hungarian zip codes.

So the card is valid, the billing address is valid, but an additional check is performed that the two have a matching country, which fails. Also not stated anywhere.

There is no way I can workaround this other than taking a plane or getting a new credit card. Customer lost.

(bonus: the "support" is the "windows azure" stackoverflow tag, which I don't think is competent re: billing, and an MSDN forum where people say "this happens sometimes, there can be many reasons sorry").

<comment><USER11> Have you actually tried contacting Microsoft about this? Your assumption of why it failed may not even be correct.

<comment><USER12> Have you ever tried Microsoft Support (even if you have a fully paid up gold partnership agreement)?

At best you'll get some low end support peon who doesn't know ass from elbow. At best you get denial.

Then there's Microsoft Connect, their public bug tracker (for products they feel like pretending to support), which basically is a route for them to close every ticket straight away as not reproducible despite being reproducible by hundreds of people.

<comment><USER13> I've tried Azure support, and it was pretty good.

<comment><USER12> It was until the day it was down last year. At which point it was hopeless for nearly a week. I was on the end of a down system deployed to Azure as the technical contact. Not fun.

<comment><USER13> I'd imagine. That sucks :(.

</comment></comment></comment></comment></comment></comment><comment><USER14> The basic problem is that gestures are non-discoverable, and should not be used for core functionality.

<comment><USER15> Yes. I recently purchased a Windows 8.1 laptop and had to turn to Google to figure out how to reboot it. And when I do discover a gesture, it's by accident and it screws up whatever I was trying to do.

<comment><AUTHOR> I googled it to learn how to reboot my computer too. And quite confusingly it turned out I have to go to "Settings" menu in order to reboot my machine! Weird! Doesn't make sense.

<comment><USER16> A few (many) years ago I bought myself a Windows 95 computer. In order to reboot the computer I had to use the "Start" button. Weird, didn't make any sense.

Once your muscle memory start working, it becomes like a second nature to use Settings->Reboot (like using the "Start" button in the old days). The human mind can create habits, with a bit of initial struggle, from anything. Give it some time.

<comment><USER17> I agree that you'll be able to get used to almost anything, however;

The old location (inside the start menu) was at least a 'logical' location, because the start menu in W95 was designed to be the central place for _anything_ you did. The only confusing part was the naming.

Settings is possibly the worst possible location to put this; \- In daily use, you will _never_ use the settings menu \- Settings are meant to make a (permanent) change in the configuration of your computer. (I configure my computer to 'reboot'? Should it reboot whenever I switch it on?)

<comment><USER6> Settings is the place for configuration _and management_ of your computer (and the current app). Shutdown/restart is a management function so it goes in Settings.

</comment></comment></comment></comment></comment></comment><comment><USER18> I've been putting off switching from W7 for 2 years now. I hated how the Wacom worked on the first version fo Windows 8.

Check this page to see how much pain they have been putting people through: [http://viziblr.com/news/2012/8/18/windows-8-rtm-and-wacom- ta...](http://viziblr.com/news/2012/8/18/windows-8-rtm-and-wacom-tablets-even- more-flawed-than-before.html)

</comment><comment><USER19> I've seen this in a VM (with no touch support at all) I ignored it. IIRC I just pressed the windows key, went back to desktop and presto, forced swipe how-to gone.

If not, just reboot.. isn't that the way all serious problems in Windows are fixed? ;)

All things taken aside I do agree that the simple solution, an "x" button is missing.

<comment><AUTHOR> "If not, just reboot.. isn't that the way all serious problems in Windows are fixed? ;)"

Well said! :D

<comment><USER17> And, apparently the official way to do things ;)

"your computer will restart in 10 minutes", no you cannot finish your presentation, or keep to your deadline. We will forcibly restart your PC and don't allow you to save your work when the countdown has completed... This update solves a potential data-loss probl.........

One customer less. Problem solved!

</comment></comment></comment><comment><USER20> There. Disable the help tips with Group Policy Editor.

[http://superuser.com/questions/666247/hide-win-8-1-tip- about...](http://superuser.com/questions/666247/hide-win-8-1-tip-about-switch- between-apps)

<comment><USER21> I'm (somewhat) sure that this works only in 8 Pro.

<comment><USER20> Indeed :(

[http://blogs.windows.com/windows/b/bloggingwindows/archive/2...](http://blogs.windows.com/windows/b/bloggingwindows/archive/2012/04/16/announcing- the-windows-8-editions.aspx)

<comment><AUTHOR> I never understood this "versioning" thing! If they have written the code for the complete Windows once, why can't they have just one version? I mean why force poor people to have less feature?

<comment><USER22> It's called price discrimination and it's common among many, many products and services.

If there was only one version then you'd either have to price it higher than the "cheap" version, which will lead to price conscious consumers choosing a competitor. Charge less and you're leaving money on the table from businesses that are happy to pay more.

It's the same logic behind "Senior Discounts" and coupons.

</comment></comment></comment></comment></comment><comment><USER23> These tips we're there in Windows 8. People complained that there was no tutorial.

<comment><AUTHOR> the tips by themselves are quite good. The problem is that they are compulsory and in this case even wrong and there's no easy way to get rid of them.

</comment></comment><comment><USER24> I think there's more than meets the eye here.

The OP didn't receive the drivers from WU. Instead he downloaded them from Wacom, suggesting they're not Windows Hardware Certification Program certified. And that's probably because amongst other things, the driver set is reporting touch inputs where there are none, perhaps for some specialized Wacom case/use. Had these been certified, I believe the OP would have received slightly more useful mouse-specific tips.

</comment><comment><USER11> Maybe. But you know what? So do OS X and Linux.

</comment><comment><USER25> There also should be button "Close this and don't show anything like that!".

</comment><comment><USER26> Unskippable tutorials.

Windows 8 failure #426,208.</comment>


Best Practices for Building a Microservice Architecture - <AUTHOR> http://www.vinaysahni.com/best-practices-for-building-a-microservice-architecture <comment><USER2> Good detailed piece, but I think it could have used more details about Enchant's decisions rather than just summarizing what options are out there.

For instance, you mention two async communication strategies (message broker and webhooks), but not which you picked and why.

In the case of complex workflows, you picked decentralized interactions, but you don't walk us through an example of how it works for you, what challenges you face and why it's a better fit than the problems using a centralized orchestrator.</comment>


What do your think of our MVP demo - AutoAvatar (profile pic from name) - <AUTHOR> http://autoavatar.com

<comment><USER2> I like the idea a lot, but it didn't work terribly well for me. Other than my gravatar, none of the suggestions seemed particularly relevant, or well suited to be an avatar.

Couple of notes:

1) make all suggested avatars square

2) suggest some avatars based off my initials. Picking a photo I like will be hard, but maybe if it said "George" or "GH" in cool text that could work.

</comment><comment><USER3> A link to where it found the image and / or a way to view a larger version of the source would be great. My search shows a couple of things which look like movie posters and some kind of icon, I would like to know what they are.

Interesting project, good luck!

</comment><comment><USER4> It works well--entering just my name offered photographs of me, adding my email address got me the avatar I use pretty much everywhere. (Which makes me wonder whether you're pulling images in from Gravatar?)

</comment><comment><USER5> This reminds me of a project i did for a class once. We had the users profile pics autogenerated from a google 'im feelin lucky' search for their username. It was a highly entertaining feature, but easily abused. But i do hope this company has some kind of quality/appropriateness control over their images!

</comment><comment><USER6> I got the "default" Gravatar image (the placeholder logo). You might want to filter that out. Interesting idea, though! Didn't work too great with my details but I'm wondering whether I could have really expected it to.

</comment><comment><USER7> The website asks for our name, our e-mail address, and our website. Where is the privacy policy?

<comment><USER8> "Don't worry it will be free" but you are going to sell my info? Not that I think you guys are, but

A) You need to explain you won't (I hope).

B) Provide a link to your company that shows you have proven your self to be trust worthy with customer data in the past. Before I sign up with a service I always look to see who is behind it.

\--

If you don't have a company yet, start a web site for one. With some bios of who you are and a statement that expresses you care about customers, why you care and that won't sell their data.</comment></comment>


When your friends can't join you, get a Stand-in - stand-in http://www.getastandin.com/beta <comment><AUTHOR> DNS doesn't resolve.</comment>


Building Highly Reliable Websites For Small Companies - <AUTHOR> http://www.kalzumeus.com/2010/04/20/building-highly-reliable-websites-for-small-companies/

<comment><USER2> Good work Patrick. I'd point out another, tricky source of failure: crappy dns hosting. It's worth it to buy dedicated dns hosting from two different providers. The cost is about 50 bucks per year.

<comment><USER3> Do you have providers that you recommend?

<comment><USER2>
       whois archivd.com

       Domain servers in listed order:
          NS1.WORLDWIDEDNS.NET
          DNS0.MTGSY.COM
          NS2.WORLDWIDEDNS.NET
          DNS1.NAME-S.NET
          NS3.WORLDWIDEDNS.NET
          DNS3.MTGSY.COM

The only other smallbiz-grade service I've used is DNSPark. They are decent but their management interface is painful and has not changed in 7 years (!).

<comment><USER3> Cool, thanks. I've been using ZoneEdit without any problems, but I may look into those providers also.

</comment></comment></comment></comment><comment><USER4> I really liked the concept of this article. I've been impressed by your other posts and just wanted to thank you for the insights you provide. As I get closer to launching my own ideas, I can't tell you how helpful it is to learn (or attempt to learn) from the experience of others like yourself.

A side note - I noticed you're using slicehost. With the "cloud-y" providers available (Heroku, AWS, etc) would you ever consider a move to them? Could that help eliminate any of the moving parts, or just relocate them?

<comment><AUTHOR> I don't have personal experience with Heroku or EC2.

My feeling is that, coming from my background (system engineer: I can do basic Linux administration but I don't breathe it) and at my scaling requirements, EC2 is more complexity versus "as simple as dedicated" VPS providers like Slicehost without any compensating advantage. Heroku seems like it would potentially be amazingly useful for folks who swing more programmer than systems engineer, and quite possibly for me as well, but I just have never gotten around to trying it out for a test drive.

</comment></comment><comment><USER5> _For historical reasons, most databases are made/configured around the assumption that it is better to fail loudly and completely rather than fudge the ACID guarantees silently._

It's the opposite, actually. The default install of modern databases (Oracle, MySQL, and Postgres are all guilty) is to silently corrupt data rather than to abort transactions. If you want data integrity, you have to explicitly ask for it:

[http://search.cpan.org/~nuffin/KiokuDB-Backend- DBI-1.10/lib/...](http://search.cpan.org/~nuffin/KiokuDB-Backend- DBI-1.10/lib/KiokuDB/Backend/DBI.pm#Transactions)

Presumably this is because people get really scared when transactions fail. (Except that's the whole point of transactions -- optimize for success, and clean up a few failures here and there.)

Also, most NoSQL databases are fully ACID. OK, CouchDB isn't, but nobody uses that anymore, right? What people "give up" with NoSQL is the strict structure of the relational model. Things like sets and transactions still exist -- it's just that sets can be polymorphic, or you can use some other collection structure!

<comment><USER6> Your last claim is not true. Most NoSQLs don't have transactions thus can't have any ACID properties. ACID is all about transactions in the first place.

<comment><USER5> BDB and Tokyo Cabinet have transactions, and so does everything built on top of these (KiokuDB, Memcachedb, etc.)

Mongo, Couch, and Cassandra don't have transactions over the entire database, but documents must be self-contained and must not refer to other documents. Following those rules, operations are atomic, consistent, isolated, and durable. "Useful" is not one of the ACID qualifiers, however :)

</comment></comment></comment><comment><USER7> I have mixed feelings on this one:

      Some organizations get checklist happy and make checklists for procedures
      which essentially can't fail and which require no judgement.  Those shouldn't
      be checklists — they should be shell scripts.

That's in principle the right thing to do, but shell scripts have this nasty habit of accumulating complexity, to the point where you end up with, say, a backup-and-restore process that everyone is afraid to change the slightest thing about, because nobody actually remembers exactly how it works (even if you wrote it yourself!), and the bash script has grown to be some opaque monster.

Maybe it could work to insist on very well-commented shell scripts, so well- commented that someone could use it as a checklist just by reading the comments, if they needed to. But then the comments have to stay in sync with what it's actually doing!

<comment><USER8> Put it in version control. svn blame and the rev's log message should tell you want you want to know.

</comment></comment><comment><USER9> _If you do this, you can escape the time or notification limitations which the notification services use to segment their customers into "hobbyists" and "enterprises who have an awful lot of money to spend to make sure nothing breaks."_

Another free alternative to Mon.itor.us and Pingdom is my own <http://wasitup.com> \- monitors up to 10 of your sites in 5 minute intervals, takes 10 seconds to setup.

<comment><USER10> Wow! That literally did take 10 seconds to set up. Thank you!

</comment></comment><comment><USER11> ServerDensity is another tool that's good at notifying you if something is amiss on your server: <http://www.serverdensity.com/>

As a bonus, the creator of ServerDensity has a great blog that shares details of his entrepreneurial bootstrapping endeavor: <http://blog.boxedice.com/>

</comment><comment><USER12> Great article Patrick. In particular, I liked where you mentioned doing external API calls asynchronously. I hadn't thought of that in the past and I know I'll be doing that in the future.

</comment><comment><USER13> Operator error and the use of checklists to avoid it is spot on; too many people learn this the hard way.

</comment><comment><USER14> Excellent article. Let me start writing my check list now.</comment>


Ask HN: Should I leave academia and jump to Silicon Valley? - <AUTHOR>

I'm a long-time academic who has tenure at a major university. However, I feel that academic life is not as satisfying as I'd like it to be. There is a lot of overhead and I hardly get to spend any time hacking. Being in the ivory tower also feels pretty isolating. Recently I've been offered a position at a major Silicon Valley tech company that you have all heard of. It is an exciting opportunity but it is a one-way street: returning to a tenured faculty job after leaving for industry is going to be almost impossible. So it's a pretty serious decision.<p>Have other ex-academics here on HN made a similar switch, and what has your experience been like? <comment><USER3> I made the switch. My first job out of college was teaching at a private high school. I certainly felt that I was making more or less a permanent decision when I decided to go; now, I'm less convinced, but I certainly agree that going back to a tenured faculty position would be difficult.

What makes you think that this new position is going to be the bee's knees and satisfy your itch? How do you know that you won't be trading one type of pain and suffering for another? Is there any chance you could use a sabbatical to do work for this company, to "test the waters"? I'm guessing you couldn't actually become an employee, but perhaps you could work some deal that would further your academic research while seeing if joining the non-academic tech industry would suit you.

To me, "major Silicon Valley tech company" smells like Google, Yahoo!, Microsoft, et cetera. Keep in mind that while all of these types of large companies have different approaches to being large companies, they all have to deal with human scale, and with that can come a load of bureaucracy and overhead that may in time frustrate you as much as it does in academia. Some of those companies do a better job at that than others.

One last thought. When I saw the light bulbs go on in my students, and when I saw them teach other students what I had taught them, so I knew they truly "got it", that was very special and very rewarding. Moving to the tech industry has had it's own rewards and intellectual challenges, but for me, teaching others was very rewarding, and I find often that the times I spend teaching my colleagues something are some of the best. Don't forget the good parts of your current job, too!

</comment><comment><USER4> Not really on-point, but there's frequent discussion about the the direction and value of higher education on HN, including questions of tenure. It would be interesting to hear more from someone who actually has academic tenure about the overhead you describe and how it has affected teaching and research, compared to your expectations when you began teaching.

Good luck with making your decision. One-way choices like that are quite intimidating. A sanity check might be to consider what you would do if either you hated working at the company, or they hated having you work there - <USER2> happens. So suppose you were unemployed a year from now, and forever banned from setting foot on an academic campus - what would you do with yourself?

</comment><comment><USER5> Can you take a leave of absence or jump over during a sabbatical year? I don't know many tenured academics who have made the jump, but the few that I do know have done of those two things when trying out a research lab or trying their hand at a startup.

</comment><comment><USER6> You should talk to Hal Varian.</comment>


The Daily Scrum Is Not a Status Meeting - <AUTHOR> https://www.arring.net/daily-scrum-is-not-a-status-meeting/ <comment><USER2> I agree with the assertions made in this article.</comment>


Restaurant Search App Zomato Lays Off 300, 10% of Staff - <AUTHOR> http://techcrunch.com/2015/10/16/restaurant-search-app-zomato-lays-off-300-10-of-staff-in-shift-away-from-live-data-collection/ <comment><USER2> Wow. I always wonder how an app I have never heard of can have 1000s of employees.

I am certainly not a huge restaurant goer but I have a fair to middling interest in technology and having never heard of this app I wonder how other people have, enough other people to support 3000 staff?!</comment>


Help the Open Rights Group, UK's EFF equivalent - <AUTHOR>

The ORG is the UK's EFF equivalent and needs your help, today the open rights group is half way to their goal of 300 new members:
https://www.openrightsgroup.org/join/
With the election coming up we need to get them to their goal!
Funding is to:
- Build a tool together which tells you where your local candidates stand on privacy and surveillance.
- Run local hustings across Britain, together with other NGOs and charities to make sure you can ask your candidates tough questions on civil liberties.
- Take part in a Don't Spy on Us bus tour around the country to engage voters on surveillance.
- Hold meetings with candidates to put digital rights in the minds of new MPs.
- Create question guides so that you feel confident talking to your candidates about these issues. <comment><USER2> I consider the ORG like I might consider a union for tech workers. It's far from the same thing, but it does work to protect the fundamental freedoms that allowed us to train for our profession.

If you work in the technology industry in the UK, please consider paying "union dues" to stop the bizarre laws which haven't been thought out and just don't make any sense (eg. "ban encryption", "backdoors in everything"), and instead force politicans to pass technology-affecting laws that actually make sense.

It's a small price to pay out of your paycheck if you consider that it's effectively insurance for all your future paychecks.

[I'm a passive ORG supporter but otherwise have no affiliation]

<comment><USER3> It's strange, there's already a professional association (the British Computer Society) but they're not useful. They're very conservative/blue chip, not very "Internet culture" at all.

Even more ludicrously there's the Worshipful Company of Information Technologists.

(I too am an ORG donor and got involved with the consultation on Scottish identity database)

</comment></comment><comment><USER4> Jim Killock(Director of ORG) toured around Scotland last week to talk about a Scottish National Identity scheme. The audio I recorded of him is on the internet archive here[1]

[1]: [https://archive.org/details/JimKillockScottishID](https://archive.org/details/JimKillockScottishID)

</comment><comment><USER5> Erm... [https://www.edirectdebit.com/openrightsgroup/pending.aspx](https://www.edirectdebit.com/openrightsgroup/pending.aspx)

How do I join?

<comment><USER6> [https://secure.edirectdebit.com/Open-Rights-Group/Join- us2](https://secure.edirectdebit.com/Open-Rights-Group/Join-us2)

There is a URL on the screen for those with Chrome problems, I used it and it worked.

<comment><USER5> Thanks, worked for me too.

</comment></comment></comment><comment><USER7> From the title and description, where the ORG is described as the "UK's EFF", I got the impression that the ORG is affiliated with the EFF, but on the website it seems that it isn't. Maybe it would have been better described as the "UK's EFF equivalent".

<comment><AUTHOR> Changed, I didn't mean to give that impression! I'm not one of the ORG, just seen them speak at a Nottingham tech meetup and donate, so my fault, not them!

<comment><USER8> Cheers, Matt. Also just joined. Been meaning to for a while now. Also based in the Midlands. Will hopefully get a chance to get involved this year.

</comment></comment></comment><comment><USER9> Cool! I had no idea this existed even though I work in the open data and transparency space.

</comment><comment><USER10> If you're in Oxford, we're setting up a local branch of ORG [http://www.meetup.com/ORG-Oxford](http://www.meetup.com/ORG-Oxford)

Love to see some of you at our first meeting.</comment>


PagerDuty Ringtones - <AUTHOR> https://community.pagerduty.com/t/pagerduty-ringtones/63 <comment><USER2> I've been using "the server's on fire".

For when you need a bit of whimsy on being woken up at 3am.</comment>


HashiCorp has raised $100 million in Series D funding - <AUTHOR> https://globenewswire.com/news-release/2018/11/01/1641376/0/en/HashiCorp-Raises-100-Million-to-Help-Enterprises-Adopt-Multi-Cloud.html <comment><USER2> Hello, I'm one of the founders of HashiCorp! We're super excited about this. I'm really proud of the team that got us to this point, thankful to our communities, and just generally excited about the future for us.

The project that really kicked off HashiCorp was Vagrant, and I "launched" it right here on HN over 8 years ago: [https://news.ycombinator.com/item?id=1175901](https://news.ycombinator.com/item?id=1175901) So its always fun to see things come back around. :) For those that are less familiar these days, HashiCorp now has many major OSS projects: Vagrant, Packer, Consul, Terraform, Vault, Nomad (in addition to lots of minor ones and libraries) addressing different areas.

For the HN crowd, there are a couple background viewpoints that I would also like to share that may be helpful on painting the backdrop on the product and business behind HashiCorp. A first quick one is my tweet on the four dimensions for "multi-cloud": [https://twitter.com/mitchellh/status/1022162653618135040](https://twitter.com/mitchellh/status/1022162653618135040) At HashiCorp we're mostly looking at enabling #1 (workflow portability), though that has downstream effects of helping with the other dimensions as well.

Second, I often get asked "Why multi-cloud?" And I wrote up a fairly long answer on Reddit about that with real examples that I recommend: [https://www.reddit.com/r/devops/comments/91afzz/why_multiclo...](https://www.reddit.com/r/devops/comments/91afzz/why_multicloud/e2x156y/)

While I'm happy to answer any questions, this post is rather late for me local time (past 10:30 PM here) and I'm leaving tomorrow to get married this weekend so I can't promise anything!

<comment><USER3> Congratulations! I've been a fan of Vagrant for a long time and have done some Vault as well. I haven't yet had a chance to try Terraform, but everyone says it is better than Cloudformation. :-)

I'm curious what you think of this crazy idea?:

With databases, some ecosystems use declarative migrations, where you keep a description of your schema, and the system automatically takes you from here to there. I've heard .Net people say how nice this is. On the other hand with Rails & Django you have delta scripts that give imperative directions for getting from here to there, rather than a declaration of the end state. I like that solution a lot, because sometimes you need more control over what to do. (For example, changing a one-to-many relationship to many-to-many, and moving the existing data.)

It seems to me that Cloudformation and Terraform take the declarative approach to cloud management, and there is no tool for the imperative approach. (Cloudformation has Change Sets but you can't write those or edit them; they just tell you its plan.) Resizing your database's EBS volume may be an example where you want to give careful instructions. Try that in Cloudformation and it will destroy the old volume and attach a new one. :-)

I'd love a tool that lets you keep a history of "cloud migrations", where you write both the "up" and the "down". It could be as simple as some organization around a bunch of fog/boto/aws-sdk scripts, although it would be even nicer if it had helper methods like in Rails, e.g. add_autoscaling_group, and those would usually know how to reverse themselves.

The _really_ great feature would be to have "transactional DDL" for cloud migrations. With database migrations you get this for Postgres but not MySQL, and it's really nice. I know this isn't 100% possible, but CloudFormation comes close already with its rollback attempts. You'd definitely need your own layer of helper methods for this, because I can't imagine implementing it without something like a Command pattern. (The way AWS auto-generates their API tools, maybe it wouldn't even be that difficult to generate an identical API that just records what you want to do.)

I've pitched this idea a few times to AWS people, but maybe you should do it instead. :-)

Anyway, Hashicorp has contributed a ton to my developer happiness, so I wish you great success. Oh, and congratulations on your wedding!

<comment><USER4> _It seems to me that Cloudformation and Terraform take the declarative approach to cloud management, and there is no tool for the imperative approach._

With CloudFormation you can use custom lambda backed resources.

<comment><USER3> Hmm, thanks for mentioning this. It looks like it's just over a month old? Here are the docs I found:

[https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/template- custom-resources-lambda.html)

[https://aws.amazon.com/blogs/aws/cloudformation- macros/](https://aws.amazon.com/blogs/aws/cloudformation-macros/)

That could be really useful!

<comment><USER4> It's been around for at least two years from what I can tell.

</comment></comment></comment></comment></comment><comment><USER5> I love Hashicorp products and i personally used most of them throughout my career, so big congratulations. The only thing i was always wondering is how are you planning to make money? It feels a bit like Docker - great technology, supported by big fundings, but the business side of things is very immature...

<comment><USER2> We're not comfortable talking about revenue publicly, but HashiCorp is an extremely healthy business at the moment. We've doubled revenue ( at least, maybe more ;) ) two years in a row and thats from a starting point of 7-figures. If we chose to halt hiring and growth, we could very easily be profitable today even with the 350 employees we have. But we're still seeing really strong growth and so we're continuing to invest!

</comment></comment><comment><USER6> Great news! The HashiCorp stack has really made my infrastructure work a much more enjoyable thing. Nomad and Consul in particular are wonderful antidotes to the complexity of Kubernetes for setups that don't require all of its features.

</comment><comment><USER7> Terraform has become a big part of my professional life. It has become a force multiplier in my ability to solve large problems. I've liked it enough to regularly contribute to provisioners and make documentation improvements.

Thank you!

</comment><comment><USER8> Good for them! HashiCorp is solid engineering.

</comment><comment><USER9> That's awesome. It's a powerful idea to abstract cloud resource provisioning. Makes multi cloud much simpler.

<comment><USER10> Terraform is the best you can get right now but it's still so incredibly painful to use. Every team I've ever been a part of is ultimately building a custom framework on top of terraform to spit out .tf files. It's so frustrating.

<comment><USER2> I wish our HashiConf videos were up but they won't be up for another week or so. But the major theme for our Terraform announcements was "listening & reacting." We've been spending a lot of time with users/customers and listening to their feedback and we wanted to show that we're committed to that. Without going into the whole thing, a couple highlights are Terraform 0.12 and our commitment to collaboration for everyone. Both linked below. Hopefully these help a lot but we're definitely trying to make it easier to use across the board!

Terraform 0.12: [https://www.hashicorp.com/blog/terraform-0-1-2-preview](https://www.hashicorp.com/blog/terraform-0-1-2-preview) It is in alpha right now (we've shipped 2 alpha releases over 2 weeks) and we're burning down bugs to get that out as quickly as possible.

Terraform Collaboration for Everyone: [https://www.hashicorp.com/blog/terraform-collaboration- for-e...](https://www.hashicorp.com/blog/terraform-collaboration-for-everyone)

<comment><USER11> Where do you go to find this feedback? Anywhere in particular or just reading all over the internet?

<comment><USER12> They hired a TerraForm customer named Kristin Laemmert away from Nike and she gave an in depth talk on new language features in HCL such as for loops. She demonstrated a ton of before and after code snippets that included hacks she had to make in HCL to get things to work.

She was pretty clear at least some of the work was in-flight before she started at Hashi so it seems they're using community input as well.

</comment></comment></comment></comment></comment><comment><USER13> I'm curious what's HashiCorp's flagship product? Is it really a combination of all their various projects?

I only use Vagrant but it seems like it's in the process of being deprecated or at least de-emphasized.

<comment><USER2> (I'm one of the founders of HashiCorp)

Consul, Nomad, Terraform, and Vault are the only products that have associated enterprise products (in addition to being open source). Different products have different impacts different quarters but all of them are contributing many millions per year individually.

Vagrant and Packer do not have enterprise products and we don't try to monetize them much (Vagrant Cloud has some paid plans for box hosting but primarily so that we remain cost neutral). However, we're fully committed to them and both teams have full time engineering and management assigned to them. They're not deprecated in any way.

<comment><USER14> How do the products bring in $ if they are OSS?

<comment><USER15> For any OSS products that claims to make money you can check their product page and see if they put out some pricing information. For example [https://www.hashicorp.com/products/consul](https://www.hashicorp.com/products/consul)

</comment></comment></comment></comment><comment><USER16> I've been using hashicorp products almost my entire professional life (8 years). I'm really happy to hear this news.

</comment><comment><USER17> Congratulations.

Please don't sell out to IBM in the future.</comment>


Drone Light Painting - <AUTHOR> http://www.asctec.de/en/drone-light-painting-the-christmas-edit/ <comment><USER2> Amazed at the stability. Is it typical for drones of this caliber? I would think weather would have knocked them off course at the very least.

<comment><AUTHOR> The company that made the video and builds those drones, Ascending Technologies GmbH, is developing high-end systems targeted towards industry and universities. As far as I know, they have the only triple redundant flight controler and their own gps, which in combination is one of the most precise solutions their is [1]. It compensates winds of up to 15 m/s on its own. Their technology also powers the upcoming Volocopter [2]. So as surely the consumer drones get better and better each year, their is something to be have for a bit more money, right? ;)

[1] [https://www.youtube.com/watch?v=OAR8plnN_10](https://www.youtube.com/watch?v=OAR8plnN_10)

[2] [http://www.volocopter.com/index.php](http://www.volocopter.com/index.php)</comment></comment>


How does Yahoo plan on monetizing Flickr? - <AUTHOR> http://www.printsmart.co/blog/2013/05/22/does-yahoo-plan-to-monetize-flickr-with-printing/

<comment><USER2> Seems pretty clear to me - you get to pay $49/year for (however much you can use of) 1TB of photo storage, or you can see advertising whenever you visit.

The marginal increase from "free-with-ads/$49-per-year" to "$499-per-year" clearly means they don't expect _anyone_ to buy their intentionaly-overpriced- anchoring version, it's only there to make $49-per-year seem reasonable to people who were previously paying $25-per-year.

I guess there's some interesting speculation to be made about their apparently valuing a years worth of user ad impressions at $50...

</comment><comment><USER3> They also charge $499 for more storage space.</comment>


A Retrospective on Paradigms of AI Programming (2002) - <AUTHOR> http://www.norvig.com/Lisp-retro.html

<comment><USER2> This seems a well-thought out retrospective. It was made more than ten years ago. I wonder if it were done today if the support by Java, Python, and other languages is as good as the Lisp support.

Has anyone used some of the tools mentioned here and could explain what the current state of the art is ?</comment>


Ask HN: Help Desk outsourcing for small co? - <AUTHOR>

We manage it in-house now and have for years. It works well but there are times when it doesn't work so well. A specific example is when a customer is browsing our site on a Friday afternoon and they want to call/email/chat. When the last person leaves the office, it might be 12-24 hours until someone gets back with the user. We'd like to improve upon this reaction speed without having to hire another employee.
Ideally I'd like something that has chat, phone, and email (tickets) support.
Any suggestions? <comment><USER2> <http://www.supportresort.com> offers this service for as low as $3-4/hr. I've never used their service, so I can't tell you how good they are though.</comment>


Ghost August update: $500k annual revenue, doubled cashflow, new UI on the way - <AUTHOR> http://blog.ghost.org/august-2015-update/ <comment><USER2> awesome guys.!! Keep it up.. THanks a lot for your transparent update..</comment>


A list of domains emitting [Terry Pratchett] clacks headers - <AUTHOR> http://clacks.jonathanmh.com/ <comment><USER2> GNU Terry Pratchett

 _In Terry Pratchett 's Discworld series, the clacks are a series of semaphore towers loosely based on the concept of the telegraph. Invented by an artificer named Robert Dearheart, the towers could send messages "at the speed of light" using standardized codes. Three of these codes are of particular import:_

        G: send the message on
        N: do not log the message
        U: turn the message around at the end of the line
           and send it back again

_When Dearheart 's son John died due to an accident while working on a clacks tower, Dearheart inserted John's name into the overhead of the clacks with a "GNU" in front of it as a way to memorialize his son forever (or for at least as long as the clacks are standing.)_

[http://www.gnuterrypratchett.com/](http://www.gnuterrypratchett.com/)

</comment><comment><USER3> Hmm, I wondered a while back if anyone was keeping track of these. It seems to be a manual list so far, so added my main server, as that's been transmitting the clacks overhead since he died. Can't wait for the crawler to go live and then we'll see how many people did add it, including any big name sites.

<comment><AUTHOR> Hi Jaruzel, the crawler is live :D you can see in the bottom which page it is crawling right now.

It's basically scraping all links on every page it hits and tests the headers if they are containing the clacks value.

I added the form so people can submit pages to speed up the development of the list, even though I believe eventually the crawler would get to their pages :D

<comment><USER3> Cool! What software are you using for the crawler?

<comment><AUTHOR> I built a not very advanced one with node.js and mongodb :)

Mainly in use in the crawler: * request * cheerio</comment></comment></comment></comment>


Why Is Google Translate Spitting Out Sinister Religious Prophecies? - <AUTHOR> https://motherboard.vice.com/en_us/article/j5npeg/why-is-google-translate-spitting-out-sinister-religious-prophecies <comment><USER2> "лове"* -->

      Lovable Love as early as possible
      Love as early as possible
      Lovable Love as early as possible
      Love as early as possible
      Loving Love Loving Love Loving Love Loving Love
      no preference one-to-one-to-no-first-time
      jobseeker ascending
      Company name ascending
      First name descending
      Last login Ascending
      Descending Ascending
      Descending Ascending
      Descending Ascending
      Lovable Love as early as possible
      Love as early as possible
      Loving for love as a lover as a lover
      no preference one-to-one-to-no-first-time
      jobseeker ascending
      Company name ascending
      First name descending
      Last login Ascending
      Descending Ascending
      Descending Ascending
      Descending Ascending
      Descending Ascending
      Lovable Love as early as possible
      Love as early as possible
      Loving for love as a lover as a lover
      unborn love as good as new or oldest
      first name or last name: Lovable Love
      e-mail to the real estate model
      as % of person read in author's name
      spain number of years more than 1 year
      old Lovable Love as early as possible
      Love as early as possible
      Loving Love as a Lovable.
      Lovable Love as early as possible.

</comment><comment><USER3> The bible is one of the most completely translated texts in the world. If the biggest hammer of text you have is the bible, then maybe it sees everything it doesn't understand as a nail. What google should do is admit there is no confidence in the user input. But that's just me. I don't work in this area of engineering.</comment>


PageTrawler - Automated Content Auditing and Site-Mapping - <AUTHOR> http://www.pagetrawler.com/

<comment><USER3> With regards to what content auditing is, there's a freely downloadable guide to answer that: [http://www.pagetrawler.com/content/working-with-content- inve...](http://www.pagetrawler.com/content/working-with-content- inventories.pdf) Valid point though, more explanation would be handy.

There have also been a few requests for an example of the results before we ask people to get stuck in, so I imagine that'll get done soon. This is an Alpha, and there is lots of functionality and deeper / more valuable results we want to provide - any feedback is good feedback.

<comment><USER4> I can understand that you're aiming at "content auditing" as a task - <USER2> an inventory of a website and gathering a bunch of statistics, as well as insights. If the minimal alpha product only produces an inventory and nothing else, well, ok, it's a minimum viable product and will get you closer to people who actually do what you describe.

The problem I see is that most of the information you mention comes from sources that are unavailable to you - besides the URLs and the page content, visitor statistics have to come from elsewhere (i.e., google analytics or piwek or whatever), and with navigation info (as well as "who owns it" or last-modified info) it's probably better to retrieve directly from the CMS than to take guesses.

Then again, if you can do without (or can provide a "simple" php page that people can drop somewhere and that allows you to siphon off the information that you need from WordPress/Magento/other standard software) in a secure- enough manner, this will probably be popular with those people who don't want to talk to the grumpy IT folks right away.

<comment><USER3> This is not so much a minimum viable product as a proof-of-content (we knocked it together in 5 days to see if there'd be interest in what we'd _like_ to build).

Agreed that taking guesses is not ideal - we'd like to give users the ability to give authenticated access to services like Google analytics / Clicktales / native CMS analytics & siphon off the raw data they need, and then do our own additional assessments with it.

</comment></comment></comment><comment><USER5> I'm not sure I understand what this does. What is "content auditing"? It says "sign up and we'll tell you what content auditing is" - you might lose people there.

Also, maybe show an example of the results - I put in my domain and it showed the first 10 links with a status code - but I'm assuming this is more than just wget!

</comment><comment><USER6> I sure wish I'd had this tool 10 years ago when I was actually working on large websites.

</comment><comment><USER7> How is PageTrawler or "content auditing" different from regular crawling of a website? I ran a website through and the output was basically the same as any off-the-shelf web crawler.

<comment><USER3> At the moment it IS pretty basic. However, this is just an Alpha which we built in 5 days as a proof-of-concept. Ultimately we aim to add much richer information that gives insights into how users are interacting with the content on the site, and whether individual pages (or even clusters of pages) are fulfilling their intended purpose. In fact, you can see some of our intended functionality over at our UserVoice page: <http://redgate.uservoice.com/forums/129997-pagetrawler></comment></comment>


Judge Slashes 'Appalling' $1.5 Million File Sharing Verdict to $54,000 - <AUTHOR> http://www.wired.com/threatlevel/2011/07/kazaa-verdict-slashed/ <comment><USER2> Right, because $54,000 wouldn't be appalling either.

A song is worth a dollar, which means $24 is the maximum actual theft here (but one could argue that since the industry is willing to sell songs for less as albums, they aren't "worth" a dollar either...more like 25 cents).

Restitution might demand a small fine, such as $50 or $100. That means this person should be liable _at worst_ about $100.

So what the hell, exactly, is wrong with the music industry and the legal system? I would think it's largely a matter of doing math, and comparing this to other small theft cases like taking a candy bar from a store.

<comment><USER3> Retail price != punishment.</comment></comment>


Steve Blank and Ben Horowitz Debate the Tech Bubble - <AUTHOR> http://www.economist.com/debate/overview/206

<comment><USER2> It seems hard to believe that in only 10 years, people would have forgotten the last bubble and buy right into the next one.

If there's a bubble in tech, I don't think it can really be that big, because to some extent it requires a public lack of awareness and caution with respect to bubbles.

</comment><comment><USER3> when was the most self aware bubble ever? if there is a difference this time that's it.</comment>


Sarcasan - You and your DSLR - <AUTHOR> http://sarcasan.tumblr.com/post/8251825662/you-and-your-dslr <comment><USER2> This had some nice comments. But the author is not withstanding to somebody else's sarcasm and went and closed/deleted all of them - it seems. Irony of the the opportunist.</comment>