Huge attack on WordPress sites could spawn never-before-seen super botnet - <AUTHOR> http://arstechnica.com/security/2013/04/huge-attack-on-wordpress-sites-could-spawn-never-before-seen-super-botnet/ <comment><USER3> Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.

<comment><USER4> Unfortunately it doesn't look like that would do any good here.

With over 200k different botnet controlled machines, all that tracking the IP sources would do here is create massive blocklists. There's already evidance growing that the botnet is trying 2-3 passwords per source IP - <USER2> bypassing existing limiting plugins.

A solution to the above is to limit the logins per account per timeframe, but that just locks the legitimate users out, causes the botnet to spread out the attack over longer periods, and ultimately only has a negitive affect for the user.

The Hosts are feeling the pain though, i've seen some hosts are disabling access to wp-login.php entirely, this tells me that the shared hosts are having resource issues, so a limit-login style plugin would do zero to help them, it'd still cause massive problems for the host.

WordPres, Joomla, and other smaller CMS's are being targetted here, so this is by no means just WordPress's problem either.

<comment><USER3> I get what you're saying but if the default setup were to rate-limit per- account logins, there'd be little reason for these botnets to do what they're doing. They don't want to block admin access to their CMS. They want to have actual access. Effective rate-limiting per-account would kill the effectiveness of their efforts.

</comment></comment></comment><comment><USER5> Use a two-factor auth plugin like <https://wordpress.org/extend/plugins/google-authenticator/> It works with the Google Authenticator app.

Duo Security is also good: <http://wordpress.org/extend/plugins/duo- wordpress/>

The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: [http://macmanx.com/2013/04/12/two-step-authentication-on- wor...](http://macmanx.com/2013/04/12/two-step-authentication-on-wordpress- com/)

<comment><USER6> Simply use five random dictionary words as a password and you are fine. The browser will store then the password easy login.

Two-facor auth just adds to complexity, and that is a bad thing when it comes to secutiry. You want to be able to easily understand that a system is secure. The more complex a system is, the larger the likelyhood of a surprise "whoops, I overlooked that" somewhere down the road.

<comment><USER7> Or any slightly obscure memorable phrase. e.g. mycatmiffylikesbiscuits or tallspeakerswithoutafaceplaterattle or emptyhandlebeerglasshasfoam ...

<comment><USER8> No. The key word in the comment you replied to was "random". "mycatmiffylikesbiscuits" is a pretty terrible password.

<comment><USER9> How so? Assuming about 100,000 common words in the English language, with a five word phrase aren't you talking about 10000000000000000000000000 combinations for a dictionary attack to churn through? Even if you narrow it down to phrases that make grammatical sense (which certainly isn't a trivial thing to do algorithmically), you're still talking pretty astronomical numbers, and that doesn't account for the large increase in the corpus that would be needed for an attack that could include a name like "miffy" in its attempts.

<comment><USER8> Have you ever used SwiftKey or Swype on Android? Vaguely the same principles apply here. It actually wouldn't be hard to generate passphrases where you try the most "predictable" phrases first. E.g. if you start your brute-forcing at "my cat" you would try "my cat likes" a long time before you tried "my cat algorithmically".

Also, 100,000 common words is a bit more than you would need. If people are plucking words from their heads, rather than rolling dice and picking from a list, you can assume a more limited corpus and still crack a lot of passwords.

<comment><USER10> Nobody starts brute forcing at "mycat." Even if they somehow knew that's how it started, that barely helps them. They don't know how many other words there are, or what the next one is. Simply because it is more likely to be "my cat likes" does not mean it is now feasible to crack. Without social engineering, that password is not crackable for all practical purposes and is far from a terrible password.

<comment><USER8> No, but we're talking about brute forcing billions of attempts per second, and we're not up against randomness, we're up against "the best pseudorandomness the human brain can muster", so the odds _aren't_ 1 / <number of possibilities>. A password is severely weakened if it isn't sufficiently random.

<comment><USER11> What Wordpress site can accept billions of login attempts per second?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> "...the distributed attacks are attempting to brute force the administrative portals of WordPress servers, employing the username "admin" and 1,000 or so common passwords."

I'm a little surprised that such a simple attack vector is a legitimate threat in creating a "super botnet."

<comment><USER13> On older Wordpress installs (pre-3.0 I believe), you couldn't change the username of the first user from "admin" when setting up a blog, and you had to manually change it later. Yes, it was stupid.

<comment><USER14> I remember having to perform some magical incantation to actually pull that off around then. Set up WP, log in, create new user, set it as admin, log in as the new user, try to delete the admin account, log back in as admin because you forgot something, log in as the new user again, actually delete account.

No wonder everyone stuck with 'admin'.

</comment></comment></comment><comment><USER15> Another nice bit of advertising for Cloudflare..

There's some more about this on their blog:

[http://blog.cloudflare.com/patching-the-internet-fixing- the-...](http://blog.cloudflare.com/patching-the-internet-fixing-the- wordpress-br)

<comment><USER16> Exactly what I thought when I read "Operators of WordPress sites can take other measures too, including installing plugins such as this one and this one, which close some of the holes most frequently exploited in these types of attacks. Beyond that, operators can sign up for a free plan from CloudFlare that automatically blocks login attempts that bear the signature of the brute- force attack.".

Then I saw the source for this "news": Cloudflare's blog.

</comment></comment><comment><USER17> I've used WordPress in the past because it was easy to setup and use. However, given the consistently bad security record I'd love to try something different. Anyone have recommendations for other open source CMS's? Similar functionality to WP is enough - I don't need anything fancy.

<comment><USER18> Drupal

</comment></comment><comment><USER19> It is time for every Wordpress user to consider to switch to Octopress. Static sites have no attack vector, don't need security updates and are faster out of the box. Octopress has importers for many blogging systems including Wordpress:

<https://github.com/mojombo/jekyll/wiki/blog-migrations>

P.S.: I have migrated a few days ago myself from Posterous to Octopress. It was a piece of cake.

<comment><USER5> Static site generators require a lot of sacrifices:

What about non-technical users? Multi-author blogs? Idiot-proof extensibility? Updates from phones and tablets? Huge sites with thousands of posts? Editorial and review systems? Access to thousands of cheap or free themes?

The ideal static site user is in a pretty privileged group. Most WordPress users would be better off securing WordPress and using a caching plugin that gives them the benefits of a powerful, dynamic platform while serving static files with automatic serverside compilation: <http://wordpress.org/extend/plugins/wp-super-cache/>

<comment><USER20> Exactly. My own static blog is pretty much the perfect CMS that I wouldn't recommend to anyone for the life of me.

At the very least, it needs something like <http://prose.io/> on top of it, and since their website keeps not working, you don't want to put all your eggs in one basket, if shit hits the fan.

</comment></comment></comment><comment><USER21> I can confirm. We host a lot of WordPress blogs (for photographers) and our scans have have detected an uptick in installs infected with malicious files. I'm not sure if it's the same attack mentioned in the article but the last 2 weeks have been the worst I've seen.

In my experience people get compromised due to bad folder permissions or old versions of WP. I hadn't considered brute-force password attacks.

<comment><USER22> Can I suggest it might be worth investigating the "Wordfence Security" plugin?

I use it pretty much everywhere that I have anything to do with WordPress - I'd noticed an uptick early this week of random ip addresses from far-flung countries getting locked out after 5 login attempts or multiple lost password attempts.

(One site in particular gets a _lot_ of drive-by login attempts - it's got the word "anonymous" in the domain, which I suspect attracts mostly the wrong sort of traffic... Wordfence is locked down _much_ tighter on that site.)

<comment><USER23> I was just about mention this ... I'm using Wordfence on a wordpress site right now, already had logins limited.

And the 'live scan' is scary -- constant attempts to login as 'admin'.

</comment></comment></comment><comment><USER24> It's actually two separate, but extremely similar attacks. One is exactly as described in the article, fairly distributed dictionary attack with user admin against wp-login.php. The second one is slightly more advanced, much much more distributed and I've seen it go for Joomla and wordpress, trying common usernames at times (though generally sticking to administrator/admin) and going through what appears to be a dictionary of about 3000 passwords. The bigger issue is these are coming in so fast and from so many directions, on resource constrained machines this is essentially ending up like a DDoS, which has a lot of ancillary effects. mod_sec and other similar methods of identifying these incoming before hitting apache and spawning a php thread are proving to be very much not enough.

</comment><comment><USER25> Ahaha, great headline...

Seriously, the security of password protected systems are a disaster(, when combined with the average user).

We should push static content generators like jekyll & co the reduce the surface, till somebody solves the authentication problem.

</comment><comment><USER26> I'm a new WordPress user. Are there any guides online with best practices that I can follow? (Some suggestions I see in this thread: rate-limiting plugin, don't have user id #1, don't have user "admin".)

<comment><USER27> Start here: <http://codex.wordpress.org/Hardening_WordPress>

Find a good host, use a secure password password, pay attention to the 3rd party plugins you're installing, and keep your install updated.

</comment></comment><comment><USER28> What URL is the login requests sent to? Would changing the wp-admin directory to something random help avoid the attacks? Or does wordpress have another point of entry for authentication?

</comment><comment><USER29> Not surprisingly one of the most commonly scripted search query at Blekko is for wordpress themes in one way or another. We do what we can to not return them any useful data.

</comment><comment><USER30> I write all (futile) login attempts on my site to a log file. I can confirm this rise in password bruteforcing attempts during the last days.

This is what the bruteforce passwords look like, these tried to login as "admin":

      [Sat Apr 13 05:30:31 2013]   nevalidniipass
      [Sat Apr 13 05:30:34 2013]   gfhjkm
      [Sat Apr 13 05:30:37 2013]   gggggggg
      [Sat Apr 13 05:30:39 2013]   ghbdtn
      [Sat Apr 13 05:30:41 2013]   ghgftmn6
      [Sat Apr 13 05:30:43 2013]   ghghgh
      [Sat Apr 13 05:30:44 2013]   ghjkju
      [Sat Apr 13 05:30:46 2013]   ghjrdjcn
      [Sat Apr 13 05:30:48 2013]   gjkzyjxr
      [Sat Apr 13 05:30:50 2013]   globax123
      [Sat Apr 13 05:30:52 2013]   go0gle
      [Sat Apr 13 05:30:54 2013]   go2fuck
      [Sat Apr 13 05:30:55 2013]   gogogo
      [Sat Apr 13 05:30:57 2013]   goldz
      [Sat Apr 13 05:30:59 2013]   gthtw112
      [Sat Apr 13 05:31:02 2013]   guest
      [Sat Apr 13 05:31:05 2013]   h69s9t
      [Sat Apr 13 05:31:07 2013]   hackett
      [Sat Apr 13 05:31:08 2013]   hal9000
      [Sat Apr 13 05:31:10 2013]   hazem200
      [Sat Apr 13 05:31:12 2013]   heccrbqh
      [Sat Apr 13 05:31:14 2013]   herbie
      [Sat Apr 13 05:31:16 2013]   hghgh
      [Sat Apr 13 05:31:18 2013]   hhhh1
      [Sat Apr 13 05:31:20 2013]   hhhhhaaaaa
      [Sat Apr 13 05:31:21 2013]   hockey
      [Sat Apr 13 05:31:23 2013]   home555
      [Sat Apr 13 05:31:25 2013]   honda
      [Sat Apr 13 05:31:27 2013]   htrdbtv
      [Sat Apr 13 05:31:29 2013]   http
      [Sat Apr 13 05:31:31 2013]   hycvibck
      [Sat Apr 13 05:31:33 2013]   i_am
      [Sat Apr 13 05:31:35 2013]   ib6ub9
      [Sat Apr 13 05:31:37 2013]   icing
      [Sat Apr 13 05:31:38 2013]   icq123
      [Sat Apr 13 05:31:40 2013]   icqpass
      [Sat Apr 13 05:31:42 2013]   if6was9
      [Sat Apr 13 05:31:44 2013]   ifhgtq79
      [Sat Apr 13 05:31:46 2013]   ifyfif
      [Sat Apr 13 05:31:48 2013]   iiiiiiii
      [Sat Apr 13 05:31:50 2013]   ikaihsot
      [Sat Apr 13 05:31:52 2013]   il0vey0u
      [Sat Apr 13 05:31:54 2013]   iloveaol
      [Sat Apr 13 05:31:56 2013]   iloveu
      [Sat Apr 13 05:31:57 2013]   iloveyou
      [Sat Apr 13 05:31:59 2013]   inferno
      [Sat Apr 13 05:32:01 2013]   infinity
      [Sat Apr 13 05:32:05 2013]   infree
      [Sat Apr 13 05:32:08 2013]   iof314
      [Sat Apr 13 05:32:11 2013]   jake4440
      [Sat Apr 13 05:32:13 2013]   jamie1
      [Sat Apr 13 05:32:15 2013]   janice
      [Sat Apr 13 05:32:16 2013]   jay18birdman
      [Sat Apr 13 05:32:18 2013]   jc5000
      [Sat Apr 13 05:32:20 2013]   jeffery
      [Sat Apr 13 05:32:22 2013]   john1
      [Sat Apr 13 05:32:24 2013]   joomla
      [Sat Apr 13 05:32:26 2013]   joshua
      [Sat Apr 13 05:32:27 2013]   keys
      [Sat Apr 13 05:32:29 2013]   kholmsk3
      [Sat Apr 13 05:32:31 2013]   kir11421
      [Sat Apr 13 05:32:33 2013]   kkkkkk
      [Sat Apr 13 05:32:35 2013]   kngvhpg
      [Sat Apr 13 05:32:37 2013]   ko#]|7sz
      [Sat Apr 13 05:32:39 2013]   kxvq4k2d
      [Sat Apr 13 05:32:41 2013]   laksmi
      [Sat Apr 13 05:32:42 2013]   lefty
      [Sat Apr 13 05:32:44 2013]   lex1977
      [Sat Apr 13 05:32:46 2013]   linux
      [Sat Apr 13 05:32:48 2013]   lol
      [Sat Apr 13 05:32:50 2013]   lol777
      [Sat Apr 13 05:32:52 2013]   lollol
      [Sat Apr 13 05:32:54 2013]   lovelove
      [Sat Apr 13 05:32:55 2013]   lucille2000
      [Sat Apr 13 05:32:57 2013]   lyxasgje
      [Sat Apr 13 05:32:59 2013]   m@$ter
      [Sat Apr 13 05:33:02 2013]   m@ster
      [Sat Apr 13 05:33:07 2013]   m1911a1
      [Sat Apr 13 05:33:11 2013]   google
      [Sat Apr 13 05:33:13 2013]   facebook
      [Sat Apr 13 05:33:15 2013]   microsoft
      [Sat Apr 13 05:33:17 2013]   obama
      [Sat Apr 13 05:33:18 2013]   twitter
      [Sat Apr 13 05:33:20 2013]   wp
      [Sat Apr 13 05:33:22 2013]   wordpress
      [Sat Apr 13 05:33:24 2013]   060890
      [Sat Apr 13 05:33:26 2013]   060891
      [Sat Apr 13 05:33:28 2013]   060893
      [Sat Apr 13 05:33:30 2013]   060988
      [Sat Apr 13 05:33:32 2013]   060989

They also try to get access as "administrator".

<comment><USER31> nitpick: that's a dictionary attack, not brute-force

<comment><USER30> Yes, of course you're right, my mistake. Mainly I wanted to share some information and give examples of passwords.

Here are some more observations which I made during the last months:

Most of the time it seems that the attackers are using a list of popular passwords, the same passwords appear over and over again: 12345, qwerty, 1q2w3e4r, and so on.

Most of the time they try to login as "admin", "Admin", "administrator", "root" or the name of the domain or blog or a part of that name, for example omitting a ".com".

In the HTTP requests, the parameters "log" (for the user name) and "pwd" (for the password) are always transmitted, but the parameters "wp-submit=Log In" and "testcookie=1" are not always transmitted.

Many of these attacks do not transmit a user-agent field in the HTTP headers. Blocking the empty user-agent seems like a good idea to me.

These attacks look simple, but I guess that they are successful on a big number of sites.

</comment></comment></comment><comment><USER32> Don't know if this is a dumb question: but would it be possible for a good party to use the same method to get admin access and install rate-limiting login plugins on all of these insecure WordPress blogs? Seems like that would be badass.

<comment><USER33> See this post for an explanation why it isn't a good idea: [http://www.schneier.com/blog/archives/2008/02/benevolent_wor...](http://www.schneier.com/blog/archives/2008/02/benevolent_worm_1.html)

</comment></comment><comment><USER34> I've also noticed an increase in spam comments and trackbacks that akismet doesn't catch. Is this possibly related? At least on two occasions I've noticed the ip address of a spam comment match against an attempted login.

</comment><comment><USER35> Attacks are continuing, I've logged two more attempts from todays. There is no reason these sites have login attempts from said countries: 188.8.131.52 (Italy) 184.108.40.206 (Spain)

</comment><comment><USER36> The effect is probably reasonably limited though. Most of the time you're going to be in safe mode or on shared hosting, which means no SYN floods and no bitcoin mining.

</comment><comment><USER37> If you still have user id #1 and/or the user "admin" on your wordpress install, you just haven't been using wordpress long enough to know what bad ideas those are.

<comment><USER38> I've not heard of the problem of a user with id #1 before, can you explain please? What's the issue with a user id #1 when the username is not admin?

<comment><USER39> if user #1 is still an admin but with a different name you can just go to wpurl/?author=1 and if url rewriting is enabled you'll be redirected to wpurl/author/nicename and nicename is usually equal to the username

<comment><USER40> I don't think this adds the layer of security you think it does, merely a minor bit of obscurity. In context of the specific vector you reference, author={$user_id}, it probably doesn't do anything at all to protect you.

Not that there is anything wrong with adding a bit of obscurity, not using 'admin' as a username and using a non-privileged author for posts can go a long way.

However, if you are worried about someone getting your username from "author={$user_id}," using a user_id of 2,3,4,5, ect, probably isn't going to protect you. I think you are incorrectly assuming that the person that would use this method to get a username is going to stop if they get a 404 at #1(or even after just a single attempt.)

</comment></comment></comment></comment><comment><USER41> In my opinion, Better WP Security is a requirement for any WordPress site.

</comment><comment><USER42> Just get the Login Lockdown plugin and install it.

<comment><USER43> 1) Login Lockdown

2) WP Better Security

3) WPScan (<https://github.com/wpscanteam/wpscan>)

Should be sufficient for most small/medium installation

</comment></comment><comment><USER44> tldr; automated scripts attacking default wordpress username with weak password. Welcome to the internet.

</comment><comment><USER45> Time to start moving away from TurdPress.

</comment><comment><USER46> I'm sorry but white on black makes my eyes angry

</comment><comment><USER47> I wonder if this is related to the DDOS that has been off and on against the bitcoin exchanges.</comment>


Ask HN: Why are the cloud providers misrepresenting blockchain technology? - <AUTHOR> Well, startups too are misrepresenting blockchain tech. But cloud providers doing this seems strange.
Have a look at the following offerings:
1. AWS Blockchain - https://aws.amazon.com/blockchain/ An excerpt from the page - "Blockchain technologies are often used to solve two types of customer needs. In the first case, multiple parties work with a centralized, trusted authority to maintain a complete and verifiable record of transactions." - WHAT, REALLY?!
2. Azure Blockchain - https://azure.microsoft.com/en-in/solutions/blockchain/
What are they really selling? - A 2018 post by Consensys comes to mind - https://media.consensys.net/blockchain-vs-distributed-ledger-technologies-1e0289a87b16 - this neatly distinguishes b/w blockchain and other distributed ledger technologies (DLT) - Corda & Hyperledger & discusses each's capabilities and limitations.
AWS & Azure blockchain offerings basically allow you to setup Corda, Hyperledger & other DLTs in the cloud. It's not hard to see why they want you to do this - basically just like every other application, DLTs require compute, network and lots of storage. Not to forget cross-selling analytics services. But does it really require the biggest cloud providers to misrepresent blockchain tech?
R3's Corda uses intermediaries called notaries to establish trust and the notary service provides consensus as a pluggable component. Hyperledger's orderer service provides consensus as a pluggable component too.
Now most business use cases listed with the aforementioned cloud offerings could easily be powered with Crash fault tolerance (CFT) consensus (like Raft) and Byzantine fault tolerance (BFT) consensus (like PoW) would be an overkill. And if I'm only using their cloud offering in a DLT with CFT consensus configuration, I'd be better off using a more mature distributed database technology instead. So what's the point of all this AWS/Azure blockchain hoo-ha anyway?
Am I missing something here? <comment><USER2> They want to make money off the blockchain hype. That's it. They're not idiots and they know what they're selling.

I've bumped into a few projects where a company's non-technical management demanded that blockchain be used, regardless of technical reasons. Several of those projects ended up using immutable, append-only, row-level-encrypted databases and then called them "blockchain". Management was satisfied.

</comment><comment><USER3> "Blockchain" is like "cloud" as a term – it is ambiguous. It means different things to different people. Not everyone understands what a blockchain is – a lot of people probably have about as much understanding of it as they do cloud. I guarantee a lot of people who even give talks and consult on blockchain tech don't know what Byzantine fault tolerance is.</comment>


Download a Copy of The Pirate Bay, It's Only 90 MB - <AUTHOR> http://torrentfreak.com/download-a-copy-of-the-pirate-bay-its-only-90-mb-120209/

<comment><USER2> We had <http://news.ycombinator.com/item?id=3568393> yesterday</comment>


Musk Says Tesla Cars Will Go 620 Miles per Charge in 2 Years, Autonomous in 3 - <AUTHOR> https://www.youtube.com/watch?v=ktyMmzZ6WeM <comment><USER2> Just recently 550 miles were broken with a Tesla S, driving at an average speed of 21 mph.

[https://www.reddit.com/r/teslamotors/comments/3lc8hu/tesla_m...](https://www.reddit.com/r/teslamotors/comments/3lc8hu/tesla_model_s_85d_shatters_500_mile_mark_5503/)

My observation, based on the driver's comments and the Tesla efficiency chart, is that you could go close to 500 miles at 30 mph, which is almost a reasonable speed.

Note the context that the title comes with. Tesla cars will break 620 miles when driving slowly (under 30 mph), not 620 miles using the EPA rating which is commonly used when addressing this issue.

<comment><USER3> An interesting thought experiment: when we have AI driven electric vehicles used to transport goods (and thus no human labor costs in the equation), will driving behaviors for some types of shipments be optimized for fuel economy at the expense of slower speeds? Will some trucks be driving the _minimum_ speed limit on highways to save electricity?

<comment><USER4> Minimum speed limit? As far as I'm aware, in the US you are supposed to go the posted speed. You could get a ticket for going slower if you are impeding traffic trying to _safely_ go the posted speed. Are there roads in the US that specifically allow a range of speeds (beyond the variation seen because human drivers don't follow the law)?

<comment><USER5> > Minimum speed limit? As far as I'm aware, in the US you are supposed to go > the posted speed.

The posted speed is usually an upper bound (though in some cases only a presumptive one, not a conclusive one, the way the law is actually written.)

> You could get a ticket for going slower if you are impeding traffic trying > to safely go the posted speed.

You can get a ticket for impeding traffic, but usually going slower than the limit is not sufficient for that. (And may not even be _necessary_.)

> Are there roads in the US that specifically allow a range of speeds (beyond > the variation seen because human drivers don't follow the law)?

Every highway (which is much broader than freeways) in California that doesn't have an expressly posted minimum speed limit, plus every one that _does_ have an expressly posted minimum speed limit that isn't identical to the posted maximum limit. (California Vehicle Code Sec. 22400 allows a minimum speed limit to be established and posted -- which is still, where established, a soft limit -- and provides a violation for impeding traffic with or without such a limit, but does not set the posted maximum speed limit as a minimum speed limit, soft or otherwise, where no minimum speed limit is posted.)

<comment><USER4> Part (a) of VC Section 22400 is what I was remembering from _way_ back when I took driver training, and it states "No person shall drive upon a highway at such a slow speed as to impede or block the normal and reasonable movement of traffic, unless the reduced speed is necessary for safe operation, because of a grade, or in compliance with law."

Wouldn't driving below the posted speed limit when there are no hazardous conditions fall under "as to impede or block the normal and reasonable movement of traffic"?

<comment><USER5> > Wouldn't driving below the posted speed limit when there are no hazardous > conditions fall under "as to impede or block the normal and reasonable > movement of traffic"?

Not normally, driving below the posted maximum speed limit would not, in and of itself.

It _might_ \-- and, given the soft nature of upper limits, it might _even without driving below the posted maximum_ \-- in the presence of other traffic, depending on the road (what will impede traffic on a single-lane road is different than what will impede traffic on a multilane road) and particular traffic conditions.

<comment><USER6> Sorry, let me confirm this. You can get a ticket for driving slower than traffic, despite driving at the speed limit?

Could you, in the same situation, also get a ticket for following the traffic—i.e. breaking the speed limit?

<comment><USER5> > You can get a ticket for driving slower than traffic, despite driving at the > speed limit?

Some speed limits in California are soft (it depends which of the provisions allowing speed limits they are adopted under, or whether they are the default limits.)

It is legally possible for traffic to exceed the speed limit where those limits are soft without necessarily being illegal, unreasonable, or safe.

It may, in some circumstances, therefore, possible to impede reasonable flow of traffic while driving at the speed limit in those cases, thus breaking the law.

> Could you, in the same situation, also get a ticket for following the > traffic—i.e. breaking the speed limit?

Yes, but if the circumstances were such that someone could be impeding traffic at the speed limit, it would also necessarily be true that it would possible for you to exceed the speed limit and not be breaking the law. But the burden of proof would be on you to show that the driving was safe.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Having trouble accepting Elon Musk's claim that Teslas will be capable of fully autonomous driving in 3 years.

One of the difficulties I am having is that I'm not aware of another advanced technology that just popped into the consumer market overnight like we've been told to expect with self driving cars.

There's always a gradual evolution of a technology over time. There's very little of that evolution seen with this technology. There's self-parallel parking cars, there's autopilot-style cruise control systems, but we're going to instantly leap from that to fully autonomous driving?

It's like aliens visiting and giving us some far-future tech overnight.

<comment><USER8> My biggest gripe with hearing about fully autonomous cars is northern climates and their inability to handle bad weather.

<comment><USER9> My biggest gripe about hearing about the invention of planes is the lack of runways.

My biggest gripe about hearing about the invention of the automobile is the lack of mechanics and gas stations.

My biggest gripe about hearing about the invention of the internet is the lack of home computer ownership.

etc. etc.

<comment><USER10> "the lack of runways"

As an historic note with little relevance to your point, this wasn't solved until the US entered the second world war and the government built a bunch of them for heavy bombers, which were later converted into civilian use.

That's why the flying boats, like the Boeing 314 Clipper, were the go-to plane for long distance travel pre-war. There's no need for a runway when you can land and take off on water.

"lack of mechanics"

This isn't really true. The early cars could be fixed by most any mechanic or blacksmith. Remember, farm equipment was already pretty mechanically complicated.

The lack of gas stations was much more critical.

<comment><USER9> The specific examples I used were not the point.

The point is that you must give new technology time to grow and become mainstream before you can expect them to be everything for everyone.

Lots of new tech will _never_ be everything for everyone

<comment><USER10> Hence "As an historic note with little relevance to your point".

At best, treat it as comment about how hard it is to think what detractors to X might have said before X became wide-spread. I believe your example of 'lack of mechanics' is poorly chosen; akin to saying 'My biggest gripe with hearing about fully autonomous cars is that they will be so expensive that only the five richest kings of Europe would own them.'

As a real-world examples I think are better, 'My biggest gripe with hearing about telephony is there won't be enough operators to handle the number of calls.' 'My biggest gripe with hearing about computers is that they are too bulky.' 'My biggest gripe with television is I'm at work when my favorite show is on.'

</comment></comment></comment></comment></comment></comment><comment><USER11> Go 620 miles how? Different battery technology? More batteries? Reduced chassis weight? Lighter powertrain designed for a lower top speed?

A new 2x battery technology seems unlikely. There's nothing that good coming on line within three years. Panasonic is already setting up Tesla's battery cell plant, so that decision has been made. (Panasonic makes the cells, Tesla packages them; many of the employees at Tesla's "superfactory" work for Panasonic.)

<comment><USER12> The gigafactory will more than double the worlds production of lithium-ion batteries, which will drive the cost down. This will allow Tesla to pack more batteries in the car for a similar price.

Quoted from [http://waitbutwhy.com/2015/06/how-tesla-will-change-your- lif...](http://waitbutwhy.com/2015/06/how-tesla-will-change-your-life.html) :

      Right now, Musk says Tesla could make their cars with a 500 mile range—they don't do it because it would increase the cost of the car.

If we believe the 500 mile range _right now_ quote, then the jump from 500 to 620 seems plausible with a few years of further improvements.

<comment><USER13> Isn't the limiting factor the physical volume and weight of the batteries, not necessarily the price?

<comment><USER14> The quote in the GP seems to imply otherwise. In case you missed it, "Right now, Musk says Tesla could make their cars with a 500 mile range—they don't do it because it would increase the cost of the car."

</comment></comment></comment></comment><comment><USER15> I know Elon Musk gets a lot of flak for throwing out unreasonable predictions, but I watched this interview a couple of days ago and didn't think much about the claim because it was an off-the-cuff guess instigated by the interviewer.

It wasn't like Elon made a special announcement to tell the world about this. The press picks up anything he says and makes it into a big "announcement". I saw several headlines that made it seem like an official announcement. I guess he should be more careful when he's thinking out loud.

<comment><USER16> Yeah, the context was linked above, it was really just off-the-cuff;

He was asked about 1,000km range:

        1,000 kilometers... hmm...

        Well, it depends under what circumstances for
        a thousand kilometers. As it is, the record right
        now for Model S is 800 kilometers (496 miles).
        That's the furthest that anyone has driven a Model S.

        Now, in order to do that, they did drive at a relatively
        slow speed, so, you know, we're talking, I think they
        drive at 40 or 50 kilometers an hour (25-30mph) or
        something like that.

        But I think, my guess, we could probably break
        a thousand kilometers within a year or two..
        5% - 10% per year.

<comment><USER17> IIRC they drove not only at a low speed but on ~0 grade road and with all conveniences disabled (no AC, just fans).

</comment></comment></comment><comment><USER18> This seems possible by simply doubling the battery size, along with modest improvements to efficiency. Sure, it'd add another 1200 pounds, but that's still lighter than a pickup truck.

With a price drop due to the gigafactory, they might even be able to do it for the same cost of the current models.

Perhaps someone more knowledgeable could chime in about whether or not that'd be possible. It seems like there could be enough room for another layer of batteries, with only a modest change to the shape of the car.

<comment><USER19> [http://my.teslamotors.com/forum/forums/max-load- model-s](http://my.teslamotors.com/forum/forums/max-load-model-s) indicates that the weight of (passengers + cargo) in the model S should not exceed 962 pounds. So adding 1200 pounds of battery to the model S to get that range is out of the question.

Even if you could, if you add 1200 pounds, power usage will go up.

So, you will have to change the design of the car to accommodate the larger battery weight. It is unlikely that you can do that without adding further weight, increasing power usage further, or tremendously increasing the price of the car.

<comment><USER20> Historically this is the rocket equation, which led to multi-stage rockets. I'm not sure we'll see multi-stage electric cars anytime soon. Although with progress in autonomous vehicles, some kind of first stage or trailer could drop off and drive itself back home...

<comment><USER21> At that point, you do not even need rocket style staging. Instead, when you are low, have a battery car meet you and dock while you are driving along the highway. Once you are recharged, the battery car can go back to the charging station, or to another customer.

Of course, I do not forsee this being a cost effective approach, even without the regularty hurdles of highway speed docking.

<comment><USER22> You could pull over just for docking. Then spend an hour towing the battery car, instead of waiting in one spot.

<comment><USER23> Or _maybe_ something like the Bombardier Primove [http://primove.bombardier.com/](http://primove.bombardier.com/) inductive charging system could be viable for private cars on motorways? Apparently Bombardier has started to pitch it as something suitable for cars: [http://primove.bombardier.com/media/news/news-detail- page/ar...](http://primove.bombardier.com/media/news/news-detail- page/article/2015/09/17/experts-convinced-by-primove-solution-for-cars.html) . I can only imagine there would be some nasty transmission losses at various stages, though.

<comment><USER24> It seems this system requires the car to be stationary while charging but it would be like using cars as electric trollies. Hmmm I wonder if cars on hwys could have an automatically deployed arm for contacting a third rail or overhead wire?

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Crazy, my lack of a driver's license might outlive the need for one after all. I'd been thinking of finally getting one these last few years (the Netherlands is very forgiving to non-drivers particularly if you work in the city you live as I do). Although I can't help but express a bit of skepticism on the 3 year timeframe, that seems overly optimistic.

<comment><USER26> I expect you will still need one for a good decade.

</comment></comment><comment><USER27> Tesla expect batteries (and hence real-world range) to improve by about 5% a year. This 620mile thing he's talking about is the record distance for driving slowly on a single charge, which is of academic interest only.

</comment><comment><USER28> "I hope civilization will be around in 20 years." And that's from an extraordinarily well-informed person.

<comment><USER29> This stood out to me, too. On the one hand, hearing him say it is a little unnerving. On the other, it's oddly comforting to know that he truly believes we're in a race against the clock to save civilization, and that someone like him is doing everything they can to prevent the end of it (at least on the environmental front; he's probably nervous about other dangers, too, that he'd have less control over, e.g. geopolitics).

Seeing that reaction from him helps explain in my mind how he's been able to accomplish as much as he has. It really feels like he's a man on a mission and that he's going to run through walls to accomplish it.

Other comments have compared him to a politician. I think that's laughable. He has a consistent track record of 'doing.' Politicians have not earned that reputation.

<comment><USER30> It's crazy to think how much further back we'd be without him

</comment></comment></comment><comment><USER31> I'm surprised he said this publicly.

Why rush out to buy a Tesla today when you can get a far better Tesla in 2 or 3 years?

<comment><USER32> Yeah, good point. How awesome would it be if cars were modular and upgradable like tower PCs. Buy today, because you you can incrementally upgrade tomorrow

</comment></comment><comment><USER33> Is he trying to cannibalize current sales? I've got a Model X reserved but I'm almost ready to bail when I hear things like this are so just a couple years away.

<comment><USER2> Of course not. The range given in the title comes with the context(which is not explicitly given). The average speed to obtain that mileage is very low.

Watch the video, this question is addressed in the last few minutes. Transcript: [https://news.ycombinator.com/item?id=10299634](https://news.ycombinator.com/item?id=10299634)

On a side note; you are basing your expensive decision on an arguably click- bait title!?

</comment></comment><comment><USER34> We changed the URL from [http://techcrunch.com/2015/09/29/elon-musk-says- tesla-cars-w...](http://techcrunch.com/2015/09/29/elon-musk-says-tesla-cars- will-reach-620-miles-on-a-single-charge-within-a-year-or-two-have-fully- autonomous-cars-in-three-years/#.bc3qki:KVt4) to the video it summarizes.

<comment><USER35> The video was taken down, TechCrunch now embeds this one: [https://www.youtube.com/watch?v=bl5vLC3Xlgc](https://www.youtube.com/watch?v=bl5vLC3Xlgc)

</comment></comment><comment><USER36> The title reminded me of Steve Jobs' "reality distortion field".

<comment><USER2> Who is distorting the reality here. The journalist or the source? Watch the video and then look at the title.

</comment></comment><comment><USER37> Who cares ? Make battery swap the standard option, build enough swap stations, and sell me a cheaper car without battery.

I want to pay for "battery as a service", I don't need to own a battery, I don't want to charge it, just bill me by the KWh used (which should better be competitive to gas).

<comment><USER38> People didn't use the battery swap stations:

[http://fortune.com/2015/06/10/teslas-battery-swap-is- dead/](http://fortune.com/2015/06/10/teslas-battery-swap-is-dead/)

(Although the business model didn't work as you describe it.)

It seems as though, for now, the supercharger network is good enough.

<comment><USER39> These stations don't get used much because Tesla sells a battery with every car they make. If the cars came without the battery, there would be a lot of demand, but would also require the infrastructure to be in place to support long range travel. It's a classic chicken and egg problem.

What Tesla discovered is that bootstrapping the battery swap infrastructure off of battery owners doesn't work, since owners are reluctant to pay for swapping out their battery over recharging the one they own.

</comment></comment></comment><comment><USER40> I would love a fully autonomous car, however I would want to see multiple layers of security in place to prevent hacking. The last thing I want is to end up dead because a hacker thought it would be funny to steer my car into a ditch.

<comment><USER41> Honestly, the car itself should be offline. Right now it seems easier to create a self driving car than secure software.

</comment></comment><comment><USER42> Autonomous within 3 years ... So Elon is planning to massively disrupt the legal and insurance industries? Both those will need a lot of changes before anyone can drive down the road in a privately owned fully autonomous car.

<comment><USER43> Well there are 200 countries. And once Norway starts to show plummeting casualty rates every major country will soon follow.

We'll need to start short selling car insurance companies soon.

<comment><USER44> Selling short? More like a good time to buy!

In my country, car insurence is mandatory and I don't see it being removed with autonomous cars. So the income for insurance companies remains similar. Crashes will be reduced however, so the expenses for the insurance companies will go down and thus profit margins will go up.

<comment><USER45> crashes aren't really an expense. If someone causes $3000 worth of claim their rate will be increased such that by the time it's back to it's pre-claim level the difference between the pre-claim rate and increased will be approximately the amount paid. Don't believe me? Run the numbers.

It's medical stuff that actually costs the insurance companies money. Look at modern cars. The engineers aren't the ones drooling over 10+ airbags. Setting of 10 explosions close to people in a safe way is a PITA and the hardware takes up precious weight and space that could be used for something else. Consumers aren't demanding cars that get crushed like a tin can totaled out when you get rear ended at 10mph or back into a pole. The "safety at the cost of all else" designs that have been creeping into cars do keep people out of the (expensive) hospital but at a highly increased cost of ownership and with sacrificed performance in other areas (including efficiency).

The first I in IIHS doesn't stand for consumer. That's not who they're trying to protect.

<comment><USER44> You leave me the impression that you would rather increase the risk of biological injury with the benefit of less property injury. I for one am happy to see the safety trends and think that it should be taken even further. In fact I see autonomous vehicles as a strategy for this. It would decrease the probability that some person will crash into me.

</comment></comment></comment></comment></comment><comment><USER46> The recent oil price changes made me wonder if the future of cars will be EV or continue to be ICE. It's not because of the current low price of oil. It's what caused it, which is fracking. Fracking has been known for a long time. But it suddenly became viable when oil was at $100+. And it was so successful it crashed the global price of oil.

When oil reaches $100 again, what other new technologies will be viable? What about $200, $300? This could easily happen due to decreasing oil reserves and increasing demand for a carbon tax due to climate change. Many assume that the path from here is EV.

But at $200, $300, the technologies to make oil may become viable. There are technologies right now (I think Audi demonstrated something last year) to take CO2 from the air and combine with hydrogen to make oil. This kind of technology also goes very well with renewable power like wind and solar. The big issue with wind and solar is storing excess electric generation. Most think batteries are the solution. But what about just making oil instead?

All of this works directly with the huge current infrastructure and investment in oil and cars. It even provides a much easier solution to reducing climate change than EV. Just create a government regulation that requires all gas to be at least 10% from carbon neutral source. They already did it with ethanol (E10). And if more CO2 reduction is required, they can just keep increasing the percentage mix.

When all of these technologies are viable, gas will probably be very expensive. I don't know what the number will be, but let's imagine it's $10 per gallon. That's very expensive, but is it enough for everyone to throw away their cars and buy EV? Is it enough to pay the premium for EV?

<comment><USER47> > It even provides a much easier solution to reducing climate change than EV. > Just create a government regulation that requires all gas to be at least 10% > from carbon neutral source.

Poe's law.

<comment><USER46> It's laughable to think about this now. But nature doesn't care about liberal/conservative or democrat/republication. The effects of climate change are already happening (California drought). As the effects become more obvious and clear, and the younger generation replaces the old, the political climate can change quickly. EV is simply not a general solution. People keep their cars for a long time and there's no way that infrastructure can change fast enough (for example, all the urban areas with apartments and no personal garages).

Nature won't wait for us to upgrade and change our infrastructure to be EV friendly. So what if there's a way to keep the current system but reduce CO2 at the same time? Fracking was once laughed at as not economically viable. Then it suddenly was. Technologies to make oil is now laughed at. Will it still be when oil is at $200 or $300?

<comment><USER48> I'm not aware of anyone laughing at technologies to make oil. They're just not economically viable at current prices.

</comment></comment></comment></comment><comment><USER49> Sort of naive question; where are we getting the raw materials for all these batteries?

<comment><USER50> Tesla has announced 2 big lithium contracts, one with a mine in Mexico, and one with a mine in Nevada.

[http://www.streetinsider.com/Corporate+News/Tesla+%28TSLA%29...](http://www.streetinsider.com/Corporate+News/Tesla+%28TSLA%29+Enters+Lithium+Supply+Contract+with+Rare+Earth+Minerals+and+Bacanora+Minerals/10850689.html)

[http://www.rgj.com/story/money/economy/reno- rebirth/2015/09/...](http://www.rgj.com/story/money/economy/reno- rebirth/2015/09/16/tesla-secures-lithium-deal-nevada-pure-energy- minerals/72345888/)

</comment></comment><comment><USER51> I think Elon is still talking about hypermileage not production numbers.

</comment><comment><USER52> Autonomous in 3 years sounds impossible. Though I guess that depends on what definition of autonomous you use.

<comment><USER53> It sounds aggressive, but most of the hurdles at this point are regulatory and insurance related (at least during fair weather conditions). Uber is aiming to have autonomous cars within two years and Google is actively testing local autonomous commuter cars, so it seems feasible. Also note that current Tesla cars (assuming you are in the beta program) can drive themselves on highways _today_.

<comment><USER52> I mean fully autonomous, like let it drive to pick up the kids on its own. Not a really advanced cruise control / break if it sees an accident about to happen.

Uber's map system can't even correctly get me from my house to my work without leading the driver into an alley.

I think we'll get 95% of the way to autonomous, but I sort of doubt we'll have a car that you can, for example, sleep in while it's driving you around.

I hope I'm wrong. I'd love to buy one in 3-6 years.

</comment></comment></comment><comment><USER54> Just make them go 200mi while running heat, ac, and radio and make them under $30k. That's all we want.

</comment><comment><USER55> phragg says $TSLA will be >$500 per share when autonomous hits.

</comment><comment><USER56> I wish he didn't do this. He should stop comparing "record-breaking" numbers with each other, and instead focus on what "normal driving" would get you. He's only going to encourage other auto makers to be highly misleading about their numbers, too. I was hoping Tesla would keep that in check. Oh well.

<comment><USER57> Did you read the article?

> Musk didn't elaborate on whether someone would need to drive just as slowly > to reach 620 miles in 2017. We'd guess that's not what he had in mind, > though.

He is saying that by 2017 he believes Tesla cars will be able to drive 620 miles under normal driving conditions.

<comment><USER58> No, he didn't say that at all. "We'd guess that's not what he had in mind" is Techcrunch editorializing. Musk himself didn't say what he had in mind.

Given that 620 miles is roughly triple a Tesla's current everyday range and it's unlikely that battery performance will triple in the next two years, it seems a lot more plausible that he's thinking of extending the current hypermiling techniques -- add a special software mode, tuck in a few extra battery packs around the edges, etc. -- than about some fundamental innovation that would yield 620 miles from typical driving habits. If he really meant the latter, he could have said so, but keeping it vague allows him to make an ambitious-sounding prediction that is, strictly speaking, still pretty straightforward for Tesla engineers to fulfill.</comment></comment></comment>


Water Main Break Floods Dallas Data Center - <AUTHOR> http://www.datacenterknowledge.com/archives/2010/06/07/water-main-break-floods-dallas-data-center/

<comment><USER2> Water main breaks, basement fills with mud and "Oil". Only in Texas. Since we relocated from Las Vegas to Austin I tend to forget about the other big industry here--Oil. People in Las Vegas never had oil problems.</comment>


Bank of America Says We're Experiencing 'Peak' Everything - <AUTHOR> http://www.bloomberg.com/news/articles/2016-10-06/bank-of-america-says-we-re-experiencing-peak-everything-and-a-major-market-change-is-coming <comment><USER2> Remember, headlines frequently are only somewhat tied to the body.

The first line shows that "everything" is an exaggeration:

> Some of the hottest trades of the past few years could stage a sharp > reversal as global markets face "peaks" in liquidity, free trade, and income > inequality.

We are not at peak horse-drawn carriages, peak steam trains, nor peak elephant ivory kill^Wharvesting.</comment>


German OpenStreetMap making map unusable, to protest against EU copyright reform - <AUTHOR> https://www.openstreetmap.de/karte.html <comment><USER2> Good on them. I wish more big sites would grow some balls and take action like this. The Internet as we know it is being attacked from multiple angles right now, with the EU filtering proposals, AU/5Eyes anti-encryption proposals, etc. The MSM are all onboard with the "think of the children! terrorism! what are you trying to hide?!" propaganda, and most of the big sites/services enjoy the Government contract money too much to dare upset their masters.

</comment><comment><USER3> The FAQs on the proposed reform for anyone who, like me, was not up to speed:

[https://ec.europa.eu/digital-single- market/en/faq/frequently...](https://ec.europa.eu/digital-single- market/en/faq/frequently-asked-questions-copyright-reform)

Note that it is a very biased source and uses a lot of hedge words like "major" and other fuzzy words like "majority" which can be interpreted in diferent ways.

Per the FAQs "Article 13 of our proposal does not target services similar to Wikipedia."... just because it "does not target" does not mean it won't be unintended collateral damage. I haven't read the reform but I'm curious what safeguards it has to remove uncertainty from platform providers on if their service is effected by this.

</comment><comment><USER4> Oh no, more evil political hacking! Placing an industry PR article into a newspaper of note is totally fine btw.

[http://m.faz.net/aktuell/feuilleton/medien/eu-and- copyright-...](http://m.faz.net/aktuell/feuilleton/medien/eu-and-copyright- anatomy-of-a-political-hacking-15771185.html)

</comment><comment><USER5> I hope they made sure that their maps weren't being used for critical purposes like rescue operations[0] before doing this?

[0]: [https://www.wired.com/2015/05/the-open-source-maps-that- made...](https://www.wired.com/2015/05/the-open-source-maps-that-made-rescues- in-nepal-possible/)

<comment><USER6> Also Humanitarian Operations are governed by Humanitarian OpenStreetMap Team [0] - they have their custom styling [1].

[0] [https://www.hotosm.org/](https://www.hotosm.org/) [1] [https://wiki.openstreetmap.org/wiki/Humanitarian_map_style](https://wiki.openstreetmap.org/wiki/Humanitarian_map_style)

<comment><USER7> "governed" probably isn't the right word. HOT is a separate organization from OpenStreetMap. They do a lot of work editing OSM and there are people with overlapping involvement.

In addition to running their own tileserver, they also often produce large format maps in QGIS or what not.

</comment></comment></comment><comment><USER8> Since when do businesses hate copyright protection again? The only service providers upset by this are the ones that won't be able to copy paste maps from other sources anymore.

<comment><USER9> Not exactly true - every service will have to implement a copyright checking mechanism, which is a huge technical outlay likely to require linking in with a bigger company - which will further cement existing businesses.

Also, just about companies always being keen on furthering copyright, Disney seemed fine about it when they created steamboat Willie, Cinderella, snow white, etc, all based on prior art.

</comment></comment><comment><AUTHOR> Translated from [https://www.openstreetmap.de/uf/](https://www.openstreetmap.de/uf/)

"How can I remove the black error tiles?" – "You can't, at all. But in a few days we're going to restore functionality."

And they mean it. They haven't even made it so that a reload blacks out other tiles. No, they really want to make it utterly unusable, even with effort on the user's part.

So now the German OSM holds pretty much the same place in my heart as the German Wikimedia club.

The OSM Foundation needs to react harshly here. To think that I used StreetComplete just yesterday. That will certainly stop.

<comment><USER10> ... because a single website with tons of alternatives does a small protest action you don't like you're not going to contribute to the entire project anymore? I honestly can't understand that.

<comment><AUTHOR> A single web site that is obviously pretty officially affiliated with the OSM project proper (as far as "unofficial" can go) and loves to use my contributed data kicks me in the shins. Yes, I feel I'm justified in being mad.

Wikimedia Germany is also legally seoparate from the Wikimedia Foundation, and still everyone considers them the official German offshoot.

<comment><USER11> You contributed the data so that they - and everyone else - can do what they want with it as long as they stay within the terms of the license. I don't see that they are violating the license by choosing to render that data a certain way (in this case as a black tile).

<comment><USER12> German OpenStreetMap is not a third party who is only bound by the copyright license though - it's a contributors' community with various explicit and implicit expectations. See e.g. [https://wiki.openstreetmap.org/wiki/Code_of_conduct](https://wiki.openstreetmap.org/wiki/Code_of_conduct)</comment></comment></comment></comment></comment>


Ask HN: I just launched a Coworking space at the Jersey Shore - Now What? - <AUTHOR>

Been wanting to open a coworking space for a number of years and we recently moved to a larger retail/office space and we have room to test out the idea.
We opened a few weeks ago and have just started to ramp up on promotion. I was wondering if anyone else out there had any success in promoting a coworking space outside of a major city where there is little to no tech culture and quite a smaller population.
What marketing/promotion strategies do you find helped, didn't work, etc. We bootstrapped this project but have a little capitol to invest if there is a potential for solid return. For reference, you can check out http://cowerking.com <comment><USER2> I helped to launch a co-working space in a community of 12,000 in the Sierra Foothills. (Although I can't claim any credit at all for its current implementation. :-) You can check it out at <http://sierracommons.org/>

Contact Robert Trent there at (530) 265-8443, tell him Rob thought he might be willing to talk to you. If you can get him to slow down for a few minutes, he'd probably be very willing to tell you all about what he's done.

In short, they've managed to take a run-down space above a restaurant, and turn it into a beautiful co-working space. I think they managed to fill every available desk within the first couple of months, despite being (IMO) way pricey. They've done a lot of it through grants, so definitely ask him about that.

If you'd like to know anything else about the project and can't get ahold of him, feel free to drop me an email -- address is in my profile.

EDIT: Just to be clear, all I did was start a "solopreneur" group in the area, and shortly afterward, start pitching the idea of a co-working space. Eventually, I met Robert Trent, who had some extra office space and graciously opened it up to anyone who wanted to give it a shot. He and I debated different models for a co-working space. I disagreed with some of what he wanted to do, and eventually lost interest. He took the project the rest of the way and ran with it, and has done a truly amazing job of pulling it all together. It's still not what I had originally imagined, but he's the one that actually made it happen, and it's certainly successful. So, all props to him.

</comment><comment><USER3> Ok, as someone who rotates amongst coworking spaces quite a bit, I agree with people saying that your daily drop-in rates are too expensive. First and foremost, you need to build a community. You need a _lot of people_ to be doing daily drop-ins and then aim that some will convert to being monthlies. So, the daily drop-ins should be something like "you can come in 7 times for free, and then pay $5 or $10 / day". You essentially want people to compete for the free seating.

$325 is very reasonable if you get a desk, a locker to keep your stuff, and a key for 24/7 access. If you think that you can charge $325/month and yet have people be there just Mon - Fri 9 - 5, you are _absolutely_ delusional - that's just too expensive for not that much benefit.

Look at <http://citizenspace.us/> for an idea of what it should be like.

</comment><comment><USER4> Maybe you can enlighten me about what I'm getting here? It's $20/day if I want to drop in and work? What are you offering me that a coffee shop or bar does not?

Or the $325/mo? But I don't even get to keep my stuff there?

Do I get access to a conference room or a receptionist or something like that?

<comment><USER5> Peace and quiet; no screaming babies or giggling teenagers or laughing office workers on break. No espresso grinder in your ear or frappucino blender. No smell of an employee warming up a panini full of stuff you hate.

For $325/mo though I'd better get my own desk and a place to stash my things.

<comment><USER3> Actually, most coworking spaces have a kitchen area with a coffee maker and coffeebeans grinder and a microwave where people most definitely warm stuff up. You are dead on with the "quiet" part though.

<comment><USER6> Yep, we've got a kitchen (and micro, and coffee pot, etc) at my co-working space in brooklyn.

And, yeah, the fact that it's a work environment (to respond to further up this thread), is a huge benefit. Way easier to focus here than at a coffee shop or at home.

<comment><USER3> ... Rails Billy from "The Change" ?

</comment></comment></comment></comment></comment><comment><USER7> Drop the price for a single day to 5 or 10. Encourage free try-outs. Offer to hold Meetup events there for free, and find some of your own guys to do the first few ones on topics that will draw local groups. Contact people who run local meetups and offer the space to them. That's how I ended up at hackerdojo.com.

</comment><comment><USER8> 9-5 seems a bit rigid to me. I can spend all day at Borders or Starbucks, and it would only cost me zero dollars . Better yet, I can just stay home and avoid the hassles of having to pack up every night. On top of that the Asbury Park location in itself is plenty of reason not to want to go in the first place.

If you are going to provide a co-working space, find some value for your clients.

One more thing..would you pay $20 per day to go use some space in Asbury Park? the answer would be a resounding NO for most people, so you simply have to come up with something other than just the space to attract people.

For people unfamiliar with NJ, Asbury Park has a reputation for being a "high crime area" , whether its deserved or not, I have no idea. The actual situation may also have changed, but for me and a lot of other people, Asbury Park would not be number one on the list of places I want to go and hang out.

<comment><USER6> Asbury Park has changed dramatically over the last few years. I don't have any stats on hand, but I'm originally from the area, and spent some time working for the city (a job that took me into places where my safety was very much in question), so I can assure you it's changed dramatically for the better.

Parts of it are still really tough, but it's not the kind of place you should be scared to visit, especially the downtown area around Mattison and Cookman (this is actually a great place to hang out with a lot of new business and restaurants, too. You've even got a great pub, Brick Wall, and the beach down the street). The west side of the city, closer to Neptune, is still a pretty dangerous place, but you wouldn't be going there if you went to this place.

</comment></comment><comment><USER9> Having worked for a coworking company for a long time, I can't emphasize how beneficial craigslist is. Obvious I know, but a HUGE percentage of clients came from there and you can't beat the price. Post often (3-4 times a day), as real estate ads get buried quickly.

</comment><comment><USER10> Hire "the situation" to run the joint!

</comment><comment><USER11> Sounds difficult if there are not lots of home based entrepreneurs and home office workers in your area. Do you have any idea about that? Any stats?

Here are a couple of links that might give you some ideas: [http://webworkerdaily.com/2009/04/14/coworking-in-rural- plac...](http://webworkerdaily.com/2009/04/14/coworking-in-rural-places/) [http://www.mail- email@example.com/msg05...](http://www.mail- firstname.lastname@example.com/msg05810.html)

This is an interesting area to me. I have been toying with the idea of opening a co-working place myself. Let me know if you want to talk. Contact at <http://en.origoterra.com> Dan

</comment><comment><AUTHOR> This is really awesome feedback. Thank you for all the constructive criticisms - we're actually going to be modifying things a bit based on everyone's suggestions. Just a heads up - our pricing scheme is based on what the local market is getting for office space/etc. A typical office space in town typically goes in the $600-$700/mo range (not including utils, internet, etc) so at $325 we are hoping there is enough of a demand...

</comment><comment><USER12> I've been to this place...great space!! ;)

</comment><comment><USER13> Maybe you could profit from the apparent weakness of the location? Target small-time entrepreneurs and try to connect them with the more tech- or finance-savvy crowd. People setting up web shops. Small-time contractors getting all the accountants and call services they need.

</comment><comment><USER14> Clickable: <http://cowerking.com>

</comment><comment><USER6> Strooltz is the original "Situation"

<comment><AUTHOR> hahaha...

<comment><USER6> wow, we both got modded down for a joke. harsh.</comment></comment></comment>


Verizon customers forced onto Frontier - <AUTHOR> http://www.meetfrontier.com/ <comment><USER2> Forced?

Yeah, that title isn't editorialized.

Verizon divested themselves of some of their wireline footprint, selling it off to Frontier.

This is no different than, say, a cell company merger or similar.

Don't like it? Switch providers. But Verizon is no longer an option for you.

The reality is, Verizon is leaving the terrestrial television business in a big way, and if I had to bet, they'll be a pure wireless company in the not- too-distant future.

As an aside, this also should be no surprise to Verizon subscribers in affected areas. This deal was announced last February and approved last September:

[http://www.prnewswire.com/news-releases/fcc-approves-sale- of...](http://www.prnewswire.com/news-releases/fcc-approves-sale-of-verizon- local-wireline-operations-in-california-florida-texas-to-frontier- communications-300137234.html)</comment>


The Rule of 2 - <AUTHOR> https://chromium.googlesource.com/chromium/src/+/master/docs/security/rule-of-2.md <comment><USER2> _" If you can be sure that the input comes from a trustworthy source"_

Perl's _" taint"_[1] capability is pretty interesting in this space. Do other languages have something similar?

[1] [https://perldoc.perl.org/perlsec.html#Taint- mode](https://perldoc.perl.org/perlsec.html#Taint-mode)

 _" You may not use data derived from outside your program to affect something else outside your program--at least, not by accident. All command line arguments, environment variables, locale information (see perllocale), results of certain system calls (readdir(), readlink(), the variable of shmread(), the messages returned by msgrcv(), the password, gcos and shell fields returned by the getpwxxx() calls), and all file input are marked as "tainted"."_

Unrelated rant: Sometime recently mobile chrome omits any part of a url after a # when you copy/share the url. Grrr.

<comment><USER3> I'm not aware of a similar feature built into other languages, but most of it could be easily achieved with almost any type system.

Just have two separate types, e.g. UnsafeString and regular String, and some kind of `convert` function that takes a validation function as an argument. You'd get compile-time checking that way.

People don't tend to use such things in practice though, and you would also have to ban a portion of most language's standard libraries to enforce it in practice (because they already return regular strings for inputs).

<comment><USER4> This can be a useful pattern - though I've never seen it used for this usecase. A similar one is templating languages (like Jinja) where you need to wrap strings if you want to send HTML to your templates with them being escaped on render.

We use something similar where we have a BadNumber class in our code (python). Any operation with another number will also create a BadNumber. It allows us to make sure that these tainted numbers are always obvious.

</comment></comment></comment><comment><USER5> > The Rule Of 2 is: Pick no more than 2 of

> * untrustworthy inputs;

> * unsafe implementation language; and

> * high privilege.

> Security engineers in general, very much including Chrome Security Team, > would like to advance the state of engineering to where memory safety issues > are much more rare. Then, we could focus more attention on the application- > semantic vulnerabilities. That would be a big improvement.

> Unsafe implementation languages are languages that lack memory safety, > including at least C, C++, and assembly language. Memory-safe languages > include Go, Rust, Python, Java, JavaScript, Kotlin, and Swift

Very nice. At the end of the process, Google might adopt Rust in Chromium. As much as I use and love Firefox, it's only realist to say that Chrome has higher chances of being around in 10 years.

I wonder why the list doesn't include their wuffs language.

<comment><USER2> _" Memory-safe languages include Go, Rust, Python, Java, JavaScript, Kotlin, and Swift"_

An interesting list. They left out C# and PHP if it's supposed to be the most popular languages.

<comment><USER6> Selective view based on in house languages.

<comment><USER7> I work at Google and as far as I know Rust is not really "in house" at Google, at least not any more than C#. Both languages exist in some form, Google does have some plugins for Unity and I believe Fuchsia has some Rust code. It is indeed unclear what criteria was used to select languages, though it's really not very relevant to the primary point anyway.

(Legal line noise: my opinions are not those of my employer.)

<comment><USER8> Rust has been pulled into the Android tree.

<comment><USER7> That's genuinely exciting to hear. Thanks for letting me know.

</comment></comment></comment></comment></comment></comment><comment><USER9> > But if you transform the image into a format that doesn't have PNG's > complexity (in a low-privilege process, of course), the malicious nature of > the PNG 'should' be eliminated and then safe for parsing at a higher > privilege level. Even if the attacker manages to compromise the low- > privilege process with a malicious PNG, the high-privilege process will only > parse the compromised process' output with a simple, plausibly-safe parser.

It's interesting to get a sense of how deeply unrealistic they think it is, to write a safe parser for a typical data format in an unsafe language.

<comment><USER6> Because as of 2019 the same errors as in early 1980's keep being repeated, regardless how many tools have been developed to tame C and it's derivatives.

It is so unrealistic that Android is following up Solaris footsteps.

Google has announced that ARM memory tagging extensions will be required in future Android versions.

<comment><USER10> When is Google going to require monthly security patch delivery?

<comment><USER6> Soon it seems.

According to an interview they gave to Are in 2017 about changing Play Store contract.

And the new Project announced at IO to require support for GSI images.

</comment></comment></comment></comment><comment><USER11> Two actually seems like a lot here. Why would you angle for two and not one? It seems like the latter two (unsafe implementation language and high privilege) are both within the purview of developers. Is it just a case of resource management?

<comment><USER12> It's practical advice for Chrome developers wanting to get a patch accepted. Deciding to rewrite the high-privilege parts of Chrome in Rust (say) is too big a project to be in scope.

</comment></comment><comment><USER13> How about rule of 3:

\- untrustworthy inputs

\- privilege

\- unsafe language

\- big, ball-of-mud codebase

We _can_ do the first three, if the thing is small and simple.

Pretty much every OS kernel out there in wide deployment has all four of the above, though.

</comment><comment><USER14> Does anyone have a working link to the diagram at the top? It seems to be a Google Drawing that requires permission to view/

</comment><comment><USER15> Image is broken.

<comment><USER16> It's hosted off of a private google drive.

</comment></comment><comment><USER17> "unsafe implementation language" is a pretty moot point.

Looking at all the trivial exploits against web applications which are basically never written in memory-unsafe languages (Ruby, Python, PHP, ...) shows that it doesn't really matter much. While having the same implementation in a memory unsafe language would be slightly less safe, it's very unlikely that a heap corruption could be exploited remotely.

<comment><USER6> Morris Worm.

About 70% of CVE reported exploits are due to memory corruption.

Living with the remaining 30% would already be a huge security improvement.

<comment><USER17> The Morris Worm happened back when security was not really a big concern.

Memory corruption is much harder (and in most cases realistically not at all) to exploit beyond a DoS, and that's what you would get with "safe" languages such as Rust or Python as well.

Heartbleed, Shellshock, Dirty COW etc. would all happen exactly the same way in different programming languages.

Yes, there is clearly a benefit in using something which makes it much harder introducing memory safety issues, but it's not nearly as big as many here on HN think.

<comment><USER18> Didn't Heartbleed rely on reading uninitialized data? I'd assume memory safety includes preventing code from reading uninitialized data.

<comment><USER19> Yes, and correct.</comment></comment></comment></comment></comment>


DNA evidence increases our understanding of contact between Stone Age cultures - <AUTHOR> https://phys.org/news/2020-06-dna-evidence-contact-stone-age.html <comment><AUTHOR> Link to paper: [https://onlinelibrary.wiley.com/doi/full/10.1002/ajpa.24079](https://onlinelibrary.wiley.com/doi/full/10.1002/ajpa.24079)</comment>


Show HN: gridster.js, a drag-and-drop grid plugin that actually works  - <AUTHOR> http://gridster.net/

<comment><USER2> What are some example use cases? Judging from comments so far, several people need this and plan to use it but I'm having a difficult time thinking of use cases, other than puzzle games.

<comment><USER3> We built it for our own product, Ducksboard. Users can build their own metrics dashboards by adding widgets and arranging them as they like.

That's the use case: being able to arrange/sort a set of widgets by dragging and dropping them in an grid. Puzzles, dashboards, image collections, think of any thing built of visuals elements where order counts.

<comment><USER4> Nice, could be really useful for WYSIWYG web design in general. My first impulse was to try and resize the edges of the boxes, have you thought of implementing this?

</comment></comment></comment><comment><USER5> Very impressive! It's not an easy thing to do ([http://metafizzy.co/blog/mythical-drag-drop-multi-column- gri...](http://metafizzy.co/blog/mythical-drag-drop-multi-column-grid- plugin/)).

I've been trying to fake it on a recent project for Stanford's recent HCI online class (see <http://btubbs.github.com/slapdash/>), but Gridster looks much nicer. Will be switching.

</comment><comment><USER6> Nice! and indeed needed... How do you handle scroll areas? can one column be independently scrolling? that was my main pain point with JQueryUI draggable...

Note that your "Fork me on github" banner points to <http://github.com/you>, which shows me MY profile page :)

<comment><USER3> When the mouse pointer gets close to the bottom of the viewport while dragging an element we scroll the document. Columns are not scrolled on their own, since the whole grid is a "block".

We built it because jQuery sortables were limiting us to use separate columns, which couldn't handle "wide" (more than 1 column in width) elements.

Sorry for the wrong link, we fix it right now!

</comment></comment><comment><USER7> This has very interesting drawing bugs in Safari 6 (Mountain Lion):

[http://dearmacos.tumblr.com/post/28341302336/computer- graphi...](http://dearmacos.tumblr.com/post/28341302336/computer- graphics-101-drawing-rectangles-props)

<comment><USER3> Oops, no Mountain Lions around, was tested and worked ok on Lion's Safari.

Will have a look at what can be done, thanks :)

<comment><USER8> I've been seeing this in many sites including Gmail and Facebook so it's probably not your bug.

</comment></comment></comment><comment><USER9> Very nice! Any tips/issues on making it responsive to the window size? Having just viewed at the demo and not really digging into the code, I am not sure if this is rather obvious or not. Thanks!

<comment><USER3> Not supported at the moment :(

We've started by building something to fulfill our needs, and responsiveness wasn't in the list for a first version.

Some logic is ran on browser resize, but the grid itself is not resized.

We'd love to add it to future releases!

</comment></comment><comment><USER10> This is the best dnd layout manager I have seen so far and trust me I have played with a lot of them. There is of course some improvement that can be made but that is what github is for. I really hope this project will get enough traction to warrant updates and new features. great job

</comment><comment><USER11> Very nice. Hopefully there's a simple way to take the serialized position array and parse out an order. Would be nice to use this plug-in to allow users to easily rank and group objects.

<comment><USER3> You actually can.

Have a look at the serialize() API method, as well as the serialize_params options attribute.

It's what we use at Ducksboard to let users arrange widgets in their dashboards.

</comment></comment><comment><USER9> Does this implement any auto-layout / best fit methods given a random set of tiles?

<comment><USER3> There is a "top gravity" attracting widgets towards the top end of the grid. It's the only supported auto-layout feature currently.

We'd like to allow different strategies in the feature, we just started by the one we needed.

</comment></comment><comment><USER12> Very nice, does the license allow this to be used in a commercial project?

<comment><USER3> Sure, it's licensed under MIT :)

</comment></comment><comment><USER13> Well done guys!

You're going to make my children very happy indeed!

</comment><comment><USER14> Any examples of this integrating with Twitter Bootstraps layout?

<comment><USER3> Hi there.

The only current integration of the tool is Ducksboard, where we use it to handle widgets arrangement.

The documentation is pretty extensive anyway, it should be easy to integrate anywhere.

<comment><USER14> Thanks, I may end up taking a look at this...

</comment></comment></comment><comment><USER15> Cool! As soon as i come home i'm going to try it

</comment><comment><USER16> Nice! Really cool!

</comment><comment><USER17> really cool stuff.. :)

</comment><comment><USER18> Wow, I've been looking for something like this for a while now, and this is _really_ impressive. Good work!</comment>


Genesis P-Orridge has died - <AUTHOR> https://www.bbc.co.uk/news/entertainment-arts-51893184 <comment><USER2> A more complicated profile here: [https://www.theguardian.com/music/2018/dec/10/genesis-p- orri...](https://www.theguardian.com/music/2018/dec/10/genesis-p-orridge- throbbing-gristle)

H/er artistic and personal partner of many years, Cosey Fanny Tutti, has accused h/er of physical and mental abuse over many years.

FWIW, I have always enjoyed her and Chris Carter's work, but I have to admit never really getting into the Psychic TV output despite owning many records.

</comment><comment><USER3> A long time ago a friend of mine gave me a TG cd. He told me that at the far end of the night when you want people to leave your house party, put this on full volume. He was right.

<comment><USER4> Thee cool friends are thee ones that would stick around, browse your occult book collection, and talk about works ov ToPY members

<comment><USER5> Yup. In my youth plenty of parties went from forty people to just half a dozen of us listening to something... Unconventional like Discopathology or BANG! An open letter.

Some of it's definitely actually good. "Discipline" is good for example. Some of it is important ("All largely propaganda" makes a good point) and lots of it is just annoying and will make people leave. Some of the same friends actually hosted a few live music events at the turn of the century and "Did people leave in disgust?" was a measured criterion of success.

</comment></comment></comment><comment><USER6> I grew up with Throbbing Gristle. Genesis has a complicated legacy of control and manipulation that was part of their music and art. They lived their work, which is part of what made it so compelling. Industrial music for industrial people - more prophetic than insane.

<comment><USER7> I grew up listening to them and the Industrial music, art noise, intellectual punk sounds of the 80's. I met Genesis at a dinner party, but he was not really there there, being on some multi-day trip and just sat zoned in the corner. So, no, I did not meet him beyond his eyes glancing my way when my name was stated. Ah, those were the daze...

</comment></comment><comment><USER8> S/he made an immense contribution to music and though I never really fancied industrial stuff, I certainly appreciate a lot of Psychic TV's output for its creativity and diversity. My partner put me onto it and he's bawling his eyes out right now, listening to 'The Orchids'. I highly recommend people watch the (always) excellent Nardwuar interview Genesis [0] to hear some of the crazy stories from h/er life.

[0]: [https://www.youtube.com/watch?v=-4suhp5QNpE](https://www.youtube.com/watch?v=-4suhp5QNpE)

</comment><comment><USER9> A far better profile in New York Magazine: [https://nymag.com/arts/art/profiles/58864/](https://nymag.com/arts/art/profiles/58864/)

</comment><comment><USER10> A good time to re-watch Decoder, 1974.

[https://en.wikipedia.org/wiki/Decoder_(film)](https://en.wikipedia.org/wiki/Decoder_\(film\))

<comment><USER7> Oh man, I was at the Einstürzende Neubauten show in Los Angeles that got them banned from ever performing in California again. Their show's climax was cutting cables allowing two 20 foot steel girders to swing down and crash into each other like a gong. The sonic wave knocked the audience off our feet, everyone had bleeding ears and could not hear for the next several hours. The building, The Palladium in Hollywood, had plaster falling and it was said to be damaged by their show. That was an event.

<comment><USER11> This reminds me of being at a Survival Research Lab show and having to run from tear gas or whatever horrible noxious smell all the pyrotechnics were putting out. That was under the 80 freeway in a parking lot in SOMA during the dot com boom. Does wild stuff like that even happen anymore?

<comment><USER12> ever heard of this rave in the desert called Burning Man?

<comment><USER11> Yeah. I was there in 1997 and 2007. I guess I must suffer from old school disease, because it just doesn't have that sense of danger that 90s fringe culture had. Lots of people sitting around in lawn chairs in front of their RVs drinking beer in 2007.

</comment></comment></comment></comment></comment><comment><USER13> Sad, although it reminded me of a quirky usenet meme in the early 90s that Gen had died via having a Pepsi machine falling on them. I miss rec.music.industrial

</comment><comment><USER14> from

[https://www.theguardian.com/music/2018/dec/10/genesis-p- orri...](https://www.theguardian.com/music/2018/dec/10/genesis-p-orridge- throbbing-gristle)

> P-Orridge's genius didn't lie in her artistic skills, but rather in her > ability to manipulate others

It's true. His now her talent in any musical configuration was always adding a non-musical element. I would liken him now her to a hype man, like Flava Flav, but one that has traveled through and beyond a permanently state of drug induced psychosis to land on some distant shore, mysterious, disturbing, pointless, raw, Dionysian in the Paglian sense (not necessarily in the sense of N).

I love GP because sheitwhat proves that the absolutely psychologically depraved can find a place in this world, can be of value, too. It's an important and reassuring lesson.

</comment><comment><USER15> Whoa. One of the true weird experiences of my life way see GPO play a little, super rough punk bar in Tempe, AZ about... geez... maybe 9 years ago. S/he played topless.

</comment><comment><USER16> I was lucky enough to very briefly meet Genesis outside the venue that Psychic TV was playing in Salt Lake City on their Infinite Beat tour. A real inspiration and a genuine trailblazer. It wouldn't be an exaggeration to say that music changed my life.

</comment><comment><USER17> S/he truly toed the line between genius and insanity. A monumental loss.

[https://www.youtube.com/watch?v=QEjl6V6wC28](https://www.youtube.com/watch?v=QEjl6V6wC28)

</comment><comment><USER18> Vale Genesis P-Orridge. I first became acquainted with their work watching the excellent electronic music documentary _Modulations: Cinema for the Ear_

<comment> Anthony-G I hadn't heard of that documentary so thanks for mentioning it. Based on the artist listing for the soundtrack, it looks like it'd be worth watching.

[https://en.wikipedia.org/wiki/Modulations%3A_Cinema_for_the_...](https://en.wikipedia.org/wiki/Modulations%3A_Cinema_for_the_Ear)

</comment></comment><comment><USER19> For a great retrospective of the British industrial/neofolk scene, check out the book _England's Hidden Reverse_. I'm more of a neofolk than an industrial fan myself, but there would be no David Tibet without Genesis P-Orridge.

</comment><comment><USER20> Found about Psychic TV aimlessly downloading stuff from people on soulseek, took me through a deep rabbit hole. Truly weird person, certainly inspired me and and bunch of other people. RIP.

<comment><USER19> Awww Soulseek. I discovered so much great music there...

</comment></comment><comment><USER21> Rest in piece free spirit <3

</comment><comment><USER22> Genesis has finally joined the best people of this world. Rest in bliss.

</comment><comment><USER23> powerful poisons, unlovely</comment>


Ask HN: How does a YC Safe protect investors from lifestyle businesses - <AUTHOR>

I understand that in the vast majority of cases there will be some kind of dissolution, Equity Financing or a liquidity event. But what happens if the business just turns into a lifestyle business? What recourse do investors have under this agreement, especially if there is no interest rate attached? Reading the Safe agreement, investors have no voting rights or rights to dividends so in theory the company could pay out dividends to the common shareholders to perpetuity skipping over any upside a safe holder ought to be entitled to. <comment><USER2> Investors with a portfolio care about huge wins in their portfolio, not modest liquidity events. It would be irrational for a company to choose to remain a lifestyle business if the alternative is a huge liquidity event. This implies that in the scenario you are outlining, the alternatives are either modest liquidity events or complete dissolutions. A rational investor should spend his time evaluating deals for big wins, not try to recover modest amounts from the walking dead.</comment>


Four questions to ask at every business meeting you ever attend - <AUTHOR> http://www.ontechnologylaw.com/2010/05/pppa-four-questions-to-ask-at-every-business-meeting-you-ever-attend/

<comment><AUTHOR> [FROM OP:] I thought of a fifth question and updated the posting.

</comment><comment><AUTHOR> [FROM OP:] Wow - almost 1,000 extra hits in four hours ....</comment>


Show HN: Peoplelogic is mission control for teams - <AUTHOR> https://peoplelogic.ai/ <comment><AUTHOR> My name is Matt and I am the Founder & CEO of Peoplelogic.ai!

As a lifetime entrepreneur and as a technologist—I am deeply passionate about helping companies grow and scale successfully. I had the fortunate opportunity to successfully exit my last venture, DZone, which gave me interesting insight around team building and rapid growth.

While we did a lot of things right, we certainly took the hard road on plenty of other things. Unfortunately, a lot of those things that we made harder revolved around people, teams, and managers. We lacked the data and insights to truly understand where the risks to our business existed, with enough warning to change course.

I set out last August to develop a tool that could help managers better understand the people on their teams—their personalities, their management preferences, what drives their passion and can help managers get out ahead of problems before it's too late.

We certainly didn't plan on launching in the midst of a global pandemic—but what we've realized with our earliest partners and customers is that the tool may be a critical component of SMB organization's tech stack as they move beyond communication tools and are forced to really think about how they manage their teams and move beyond leading by their gut and their experience.

Our vision is to build an affordable, easy-to-use, and comprehensive tool to help business leaders and managers:

— Proactively monitor the health of their teams, employees, and customers — Receive automated recommendations on mitigating risks and course correcting — Dig into real-time insights to understand how work is getting done — Identify and optimize bottlenecks in team communication and workflows — Gain knowledge around potential business outcomes and scenarios using predictive analytics — Ensure growth stays on track

I welcome any and all feedback and am so happy to be able to share Peoplelogic.ai with you today!

Matt</comment>


Threadless offering $1000 for positive ID of Chicagoans in these photos - <AUTHOR> http://www.windycitizen.com/chicago/crime/2009/12/21/threadless-offering-1000-to-anyone-who-can-identify-2-chicago-men-captured- <comment><USER2> This whole idea is creepy as hell - someone from threadless just says it's "serious" and refuses to give any details as to who these people are or why they want to suddenly play net-nanny. In the meantime, here's a handful of cash for whoever decides to play big brother. It's a bad thing to start, and a bad thing to encourage.

<comment><USER3> This sentiment seems a little silly to me - there's no implicit right to anonymity in RL, especially if you go around pissing people off by stealing from them.

<comment><USER4> > no implicit right to anonymity

Check the privacy laws of the United States - they clearly do protect our right to anonymity: [http://en.wikipedia.org/wiki/Privacy_laws_of_the_United_Stat...](http://en.wikipedia.org/wiki/Privacy_laws_of_the_United_States)

In this case I see both violations of False Light and Appropriation being possible, if these guys didn't do anything, and didn't agree to be involved in this stunt.

Personally I like the idea of vigilantism, but these things are better left to law enforcement and the legal system. They are in place for a reason, after all.

<comment><USER5> You know that that Wikipedia article doesn't even have the word "anonymity" in it, right?

There's no general privacy law in the U.S. There's some minor right to write anonymously, extrapolated from the First Amendment, but absolutely no right to be anonymous in general, and in fact the First Amendment goes the other way: Threadless has the right to publish those photos and to make any truthful statements about them whatsoever. In many cases Threadless can even make untruthful statements about the photos and still be perfectly legal.

</comment></comment></comment></comment><comment><USER6> Harper (ex-Threadless CTO) just tweeted:

 _Threadless got robbed again - but there are pictures! $1000 to anyone who can identify these two Chicago jagoffs:<http://bit.ly/7C8XHn> _

<http://twitter.com/harper/status/6908083982>

<comment><USER7> whoops ;)

</comment></comment><comment><USER7> I had just finished reading "This is not a game" about crowdsourcing crime solving using ARG techniques. It was a decent read. When i heard that something terrible had happened to the threadless tech dept. It seemed like a great way to possibly find the alleged crooks.

Luckily the dudes who remain at threadless were quick on the execution and had already appealed to the community. They are attempting to use the same method that MIT used to find the red balloons (i.e. a tiered reward for reporting info).

Here is some info from threadless: [http://www.threadless.com/news/536659/Identify_these_Christm...](http://www.threadless.com/news/536659/Identify_these_Christmas_elves_for_a_reward)

Here is photos from scottv's flickr stream: [http://www.flickr.com/photos/scottvdp/sets/72157622921219371...](http://www.flickr.com/photos/scottvdp/sets/72157622921219371/)

</comment><comment><USER8> Reminds me of the "Human Flesh Search Engines" that form on Chinese BBS's. <http://en.wikipedia.org/wiki/Human_flesh_search_engine>

</comment><comment><USER9> Tell me that's not Jay & Silent Bob in real life. . .

</comment><comment><AUTHOR> Sorry our servers are struggling today...

</comment><comment><USER10> I don't like it. I don't like going on a manhunt for no good reason.

Are they ex-employees who must be punished dearly?

Are they thiefs? Alleged thiefs? Being hassled by the company?

<comment><USER11> I don't like it either. Doing this without any context is creepy and a little un-nerving. People would probably go to some length for $1000.</comment></comment>


Twitter Loses Ability to Properly Display Instagram Photos - <AUTHOR> http://bits.blogs.nytimes.com/2012/12/05/twitter-loses-ability-to-properly-display-instagram-photos/ <comment><USER2> This is likely going to hurt Instagram more than Twitter, but Instagram can now afford it.

Though some part of me can't help but to feel somewhat glad. Twitter has been treating developers like crap for the past year; is somewhat comforting to see them getting a taste of that.

<comment><USER3> Does Twitter care that much? Presumably in the not-too-distant future they'll be rolling out an enhanced camera/photo tool in their client, precious filters and all.

If it's decent, I suspect it'll replace Instagram for many Twitter users. Especially if Instagram still doesn't allow their pictures to show up in the card view.

<comment><USER4> Instagram is not about the filters. It's about the community of people sharing photos.

Unless Twitter creates a section/site dedicated to just photos, it will not be a threat to Instagram.

<comment><USER5> Are they sharing their photos on Instagram itself, or were they just using the social network integration features? I would wager that the majority of users of Instagram don't really care about the Instagram social network, instead using the application to share photos through Facebook and Twitter.

Instagram's FAQ actually puts their social network integration as a major feature of the app, even mentioning Twitter as one of the compatible networks.

<comment><USER6> _I would wager that the majority of users of Instagram don't really care about the Instagram social network_

...and I would absolutely take that bet. I know a ton of (less tech-y) people that check Instagram like it's a bad addiction. It's become a less involved Facebook- checking that results in a huge cognitive load, Instagram is just a nice stream of photos for you to browse through.

I get far more 'native' comments on my Instagram photos than I do through the integrated Facebook post. I suspect I am not alone.

</comment></comment></comment></comment></comment><comment><USER7> It's funny because the cards documentation is still using Instagram as example. :)

</comment><comment><USER8> Extremely short-sighted move on Facebook's part. This is a move meant as retaliation to Twitter's API insanity but really, all it does is makes you look as evil as twitter in the eyes of the users. The only problem is that twitter itself has a much lower bar it holds itself to than facebook. And when facebook stoops to twitter's level, it has much much more to lose than twitter.

</comment><comment><USER9> Man, what posturing we're going to see in the coming months between Twitter and Facebook.

In 12 months we'll all be back on MySpace.

</comment><comment><USER10> Companies fight, users lose. Same story, different day.

<comment><USER11> Companies compete, users win.

The press nearly always gets this wrong and the viewpoint has taken root in our collective thinking.

Competition is about customers, not competitors. With competition, customers should get better stuff, more stuff and cheaper stuff.

I've seen very little "users losing" in the past 10 years, despite continuous reporting to the contrary. Were this not the case, we wouldn't even have a twitter, facebook or instagram - we'd all be using the same thing provided by the same company and it would most definitely be outmoded and suck.

Competition works. Get used to it, change sucks.

<comment><USER12> > Competition is about customers, not competitors.

Who are FaceBook's and Twitter's customers? Certainly not the users. So it's still possible that users lose.

<comment><USER13> No, but what they're competing for is audience size. And their audience _is_ their users.

</comment></comment></comment></comment><comment><USER14> THIS is in the New York Times (blog) and creating such a storm in a teacup? I think part of me died inside. Are any of the great minds in the world really worried about this?

</comment><comment><USER15> So let me get this straight -- people are allowing their photos to be encoded with a proprietary encoding, even though any number of free, open-source encodings are readily available?

Follow-up question: Why?

After the noise dies down, I hope this issue will be seen as another argument against proprietary graphic encodings and software patents in general.

<comment><USER16> what proprietary encoding? Instagram photos are JPEG, they disabled embedding them through HTTP.</comment></comment>


Failure Is The Engine That Drives The Future - <AUTHOR> http://thecodist.com/article/failure_is_the_engine_that_drives_the_future

<comment><AUTHOR> So how did you get over "the fear" and out of the comfort zone of regular work (assuming you don't get pushed!) and actually start taking these risks? Is the fear of failure a sign of lack of entrepreneurial spirit, or just a sensible weighing up of current priorities?</comment>