Copyright troll lawsuit blows up in face of Righthaven - <AUTHOR> http://www.eff.org/deeplinks/2010/12/democratic-underground-responds-righthaven <comment><USER2> All the more reason to sign up as a regular donor to EFF.org, even if it's just $5/month. If every developer, designer, software engineer, computer scientist, and new media professional who depends on unencumbered knowledge and information for their livelihood did just this small bit, EFF would be even more capable in its defense of intellectual freedom, and better able to prosecute all of these ridiculous patent/copyright trolls back to hell.

For anyone here who hasn't, here's a clickable: <http://www.eff.org/>

:)

<comment><USER3> I'm torn.

I used to give money to EFF, and I support a lot of the same causes they do. But the last couple years or so their PR tactics have shifted noticeably into the sort of gross alarmism/hyperbole that does more harm than good to those causes. So I'll find other ways to support the things I care about.

<comment><USER2> If you find a better alternative, let us all know.

</comment></comment></comment><comment><USER4> I'm smiling ear to ear about this one. I hope Righthaven gets taken down hard!

</comment><comment><USER5> Rule of thumb: Never back down from a bully.

<comment><USER6> That's a stupid rule of thumb.

What if the bully has the means to kill you and get away with it?

<comment><USER7> Do you live in stark, utter terror of your government? Because they can do that. :P

<comment><USER8> He didn't say "stark, utter terror", he said that sometimes you SHOULD back down from a bully.

And yes you probably should back down from the government.

<comment><USER7> You should back down from the government? I smell a debate forming.

Elaborate on this theory of yours, I'd be delighted to hear.

I postulate that backing down from the government can only possibly make things worse. It might be tough to stand up now, but it'll be tougher later if you don't...

</comment></comment></comment></comment></comment><comment><USER9> I love reading the filings in cases like this. It's really amusing to see the kind of two-bit lawyers employed by Righthaven get taken to pieces by some of the finest legal minds in the country.

EFF's strategy is spot-on: turn Righthaven's odds game back onto themselves. Righthaven is betting that they can profit by filing scores of lawsuits, then coercing settlements in just a small fraction of them. If this case plays out in EFF's favor, then just a few contested cases could cost Righthaven all of their profits in defendants' attorney's fees.

</comment><comment><USER10> Grellas, any idea how a "SLAPP-back" suit would fare for any of these defendants?

<comment><AUTHOR> Anti-SLAPP statutes are products of state law and do not apply to federal claims for copyright infringement. (See a sample discussion of the issue in this blog post: [http://tushnet.blogspot.com/2008/08/copyright-and- california...](http://tushnet.blogspot.com/2008/08/copyright-and-californias- anti-slapp.html)). So these won't help.

The key to what happened here is that the defendant was able to elicit the help of EFF and the Fenwick firm, undoubtedly pro bono, and this gave them first-class legal talent with which to pick apart the Righthaven claims. Unlike patent trolling suits, where the claimant is typically able to assert credible claims for millions of dollars, the Righthaven model relies primarily on bulk processing of settlements resulting from threats to file suit. Righthaven will scout out the web and find one-fer instances of "copyright violation," as when a contributor to a site posts an excerpt from a news article in a comments section. The damages associated with this, even in a worst case, run no more than into the tens of thousands of dollars and likely would be far less. However, Righthaven takes an assignment from the newspaper that owns the copyrighted content and threatens to file its bullying suit, i.e., it threatens to subject the defendant to an expensive federal copyright suit that will cost far more to defend than is worth it for a typical defendant. In that context, Righthaven's business model depends on the vast majority of defendants caving and being willing to settle for a comparatively small dollar amount in order to avoid the suit. Righthaven does this in volume and that is how it makes its revenue - by coercing a lot of smallish settlements and relying on bulk processing to justify the economics of its efforts.

This model rapidly falls apart in any case where a serious defense is mounted and particularly where the defendant (a) is represented by first-class lawyers (as it was here) and (b) forces Righthaven to spend far more on processing the case than it can ever hope to recover. Here, Righthaven got hit with all this, plus aggressive counterclaims, leaving it unable even to dismiss the case without getting permission from the court. Seeing it had a major loser on its hands, Righthaven brought just such a motion to get permission to dismiss and met with a response from the defendant saying that the court must condition any such permission to dismiss on Righthaven's paying all of the defendant's attorneys' fees. All in all, a pretty disastrous result for Righthaven.

I am not sure how much this may be replicable in other cases but it certainly underscores that the Righthaven model is vulnerable to attack and may spur others to mount similar efforts. It is in any case a good first step.

</comment></comment><comment><USER11> I'm all for copyright trolls getting their due, but does anyone know if this kind of thing is enough to seriously hurt their profits?

<comment><USER12> It's not the profits that matter. It should be shown that these cases are defensible and the average victim should defend themselves. This way, the company would not be able to settle with anyone and thus not make any profit, and hopefully die.

<comment><USER13> And similar companies as well. It's a step towards preventing this sort of shit from existing in the first place.

</comment></comment></comment><comment><USER14> So, wait. Only the lawyers will end up profiting, as usual? (no offense, grellas :-)

<comment><USER15> I suggest the important point is not who profits but who pays the bill.

</comment></comment><comment><USER16> I'm kind of surprised this hasn't made the top of DU's list. Maybe it did, and got buried under all the WikiLeaks stuff before I could get over there...?

</comment><comment><USER17> Ahhh the joy I get from seeing these weak, greedy copyright trolls beg for mercy from the innocent people they prey on!

</comment><comment><USER18> I love this story. Kudos to them.

</comment><comment><USER19> A New Hope? Now I'm waiting for the Empire to Strike Back.... I kid but seriously, this is great great news. Patent trolls are anti-innovation, impede creators/entrepreneurs, and drive up costs for consumers.

<comment><USER20> I hate to be a pedant, but this case concerns a copyright troll, not a patent troll. The distinction between the two is well worth acknowledging.

However, I agree with everything you've said about intellectual property trolling, in general. :)

<comment><USER19> Oh oops! I didn't catch that before, but yes I do understand the distinction. My mind was just being lazy.</comment></comment></comment>


China wants an orderly exit from Bitcoin mining - <AUTHOR> https://qz.com/1174091/china-wants-an-orderly-exit-from-bitcoin-mining/ <comment><USER2> _As to mining farms owned by smaller players, especially those in the mountainous areas of Sichuan and Yunnan provinces, simply locating the miners is a near impossible task. A growing number of private owners of hydropower plants in the two regions have begun to operate mining machines themselves as the price of bitcoin has surged, Du Jun, founder of Node Capital, a Beijing- based venture-capital firm focusing on the blockchain industry, told Quartz prior to news of the latest crackdown. "How can you find them?" he asks._

Couldn't they be found by looking at their IP address?

The Chinese state has tremendous resources. It seems like if tell people to stop mining bitcoins, the vast majority would do so and any minority which didn't would be very vulnerable.

Also, it seems like China could stop bitcoin mining by blocking the protocol using the Great Firewall or otherwise filtering bitcoin out.

<comment><USER3> That's a naive view of networking. The physical location of an IP address can be very difficult to track down (and of course IP addresses aren't part of the bitcoin protocol).

Bitcoin is also super low bandwidth, and it would be very easy to build a custom proxy to circumvent the firewall. We are effectively talking about 3 megabytes (or even less) every 10 minutes (5 kBps). It could also be obfuscated with stengraphy rather than encryption (e.g. a valid webpage, where the spacing, or css properties are the (also encrypted) bitcoin blocks).

<comment><USER4> > That's a naive view of networking. The physical location of an IP address > can be very difficult to track down

Unless you are the Internet provider … And I do believe that Internet providers in China would answer to Chinese government requests without troubles (I doubt they would sue the government like they would in the US).

</comment></comment></comment><comment><USER5> I am personally of the opinion that China swiftly killing off its cryptocurrency mining industry overnight would be to the great benefit of humanity. The sheer amount of electricity it wastes is an environmental disaster.

<comment><USER6> Agreed. Shutting down participation in the planet's largest pyramid scheme doesn't have a lot of downside.

<comment><USER7> Here is what a pyramid scheme is: [https://en.wikipedia.org/wiki/Pyramid_scheme](https://en.wikipedia.org/wiki/Pyramid_scheme)

Bitcoin is a distributed database that solves the "Two Generals Problem". Please don't spread misinformation on things you do not understand.

<comment><USER8> Sigh. The only sense in which it "solves" the Two Generals Problem is the sense in which it will, over the course of decades, create a rainbow table for it. None of the work being done is in any way socially useful (a crypto coin based on, say, folding proteins actually produces a social good and so could be equity based).

Decentralized proof of a transaction having occurred is in principle valuable, but the token itself is not the store of value. The reason it is accurately described as a pyramid scheme is because holding bitcoin for the purpose of reselling it is exactly like holding a baseball card, or a share in Bernie Madoff's hedge fund: it is based on the premise that someone will come along and pay you more for it than you paid, despite no actual appreciation in any fundamental value.

<comment><USER9> Do you have any idea how rainbow tables actually work and what it would take to "create" one for the SHA-256 hash used by Bitcoin mining? In order to create such a rainbow table, you would have to do about 2^256 SHA-256 computations. All of the Bitcoin mining ever done so far has carried out somewhere in the order of 2^87.

To put this in perspective, the most power-efficient miners available right now require 0.1 J/GH of energy. There are roughly 10^24 stars in the visible universe putting out about 10^27 watts each. If you could use the entire energy output of all those stars to mine Bitcoins with the most efficient mining hardware currently available for the entire lifespan of the universe to the present day, you'd still get less than 2^210 hashes, about 1/10^74th of what you'd need to create a rainbow table for SHA-256. I'm pretty sure that even upgrading this hypothetical universe-wide computational machinery to hypothetical mining hardware that's as efficient as the laws of thermodynamics allow wouldn't get you close.

<comment><USER10> Isn't 2^210/2^256 = 1/2^46 ~= 1/10^14 or so? (1/10^74 is approx 1/2^245)

</comment></comment></comment></comment></comment></comment><comment><USER11> This is a good time to invest in electricity and facilities in Mongolia

> Mongolia hosts 10% of the world's known coal reserves at an estimated 162 > billion tonnes in 2011 with 17 operating coal mines

<comment><USER12> Fun fact: Mongolia buys electricity from China

<comment><USER13> Mongolia is also investing in renewable energy. For example the solar park in Darkhan and the Salkhit wind farm, but of course these are not closely enough to cover Mongolia's need yet. In the meanwhile the population of Ulaanbaatar has to breathe some of the most toxic air in the world.

However, Mongolia seems to be one of the few countries, where Bitcoin mining seems to make sense, because of cheap energy and it's complicated economic situation that makes producing and exporting goods very hard. With Bitcoin they don't have to ask China or Russia for permission to cross the borders.

</comment></comment></comment><comment><USER14> Not gonna happen, they just wanted to stop it and get a piece of the pie. Mining will resume in China

<comment><USER12> Chinese government hates everything it can't control, especially related to money. That is just a fact.

</comment></comment><comment><USER15> Can they track mining operations down by looking for abnormally high power consumption?

</comment><comment><USER16> Maybe these operations will incorporate solar + battery storage into their systems if they want to stay alive... Be less efficient and less productive, but be legal, environmentally and socially responsible (sucking this much power from the public system is not responsible), and still profit.

</comment><comment><USER17> It's things like this that really make the west seem backwards. Did you know the average Chinese citizen has more representation in their government than the average US citizen cf. [https://aeon.co/ideas/one-way-the-us-and-the-eu- are-less-dem...](https://aeon.co/ideas/one-way-the-us-and-the-eu-are-less- democratic-than-china)?

<comment><USER18> Comparing China's National People's Congress to the US Congress is ludicrous. The NPC holds one annual session lasting less than 2 weeks, and passes legislations often with 99% Yeas. Every Chinese knows that the NPC is largely a show and holds no real power despite what the constitution says. Wikipedia summarizes it pretty well [1]:

> In theory, the NPC is the highest organ of state power in China, and all > four PRC constitutions have vested it with great lawmaking powers. However, > in practice it usually acts as a rubber stamp for decisions already made by > the state's executive organs and the Communist Party of China.

[1] [https://en.wikipedia.org/wiki/National_People's_Congress](https://en.wikipedia.org/wiki/National_People's_Congress)</comment></comment>


Java/Android SSLSocket Vulnerable to MitM Attacks - <AUTHOR> http://op-co.de/blog/posts/java_sslsocket_mitm/

<comment><USER2> Also can be phrased as: "Rarely used, low-level Socket class intentionally doesn't perform automatic SSL certificate verification, and is documented as such."

<comment><AUTHOR> _Rarely used, low-level Socket class intentionally doesn 't perform automatic SSL certificate verification_

It is true this class is rarely used, but it does not mean that security is optional for rarely-used APIs. As can be seen from the linked CVE and the list of affected applications, the problem is real and needs more developer attention.

 _and is documented as such_

I beg to differ. The SSLSocket class documentation not only does not mention this fact, it creates the illusion that SSLSocket is secure. The fact that a different document mentions this shortcoming can hardly count as "documentation", especially with the grave implications for apps.</comment></comment>


Jagex launches HTML5/WebGL game mode for RuneScape (beta) - <AUTHOR> http://runescape.com/beta Jagex, creators of the popular MMORPG RuneScape just launched their beta version of RS3, a purely HTML5/WebGL implementation of their (so far) java based game.<p>I -think- this might be the first huge implementation of html5 in game form, and clearly marks Jagex as even bigger innovators in both the web and gaming industry. <comment><USER2> I remember having to give up playing RuneScape back when I switched to a Mac many years ago, due to how poorly Java integrated and performed within the available browsers (not to mention the glitching hardware-acceleration support).

While I have generally lost interest in these sort of games since then, this is exciting enough to make me want to try it out again.

<comment><USER3> I had to use the downloadable Runescape client to get it to work on OSX. It works reasonably well but still sucks that I can't play in my browser anymore. A lot has changed so it's probably worth looking into!

</comment></comment><comment><USER4> It's unfortunate, but this may be too little too late for Runescape. After Jagex was slowly bought by VCs company decisions became less about the experience for the player and more about the bottom dollar.

Maybe this will be enough to bring back some of their lost subscribers, but who knows.

<comment><USER5> Absolutely. As of last year, they have this thing in the game called Squeal of Fortune. You earn or buy "spins" and you use them to win coins, items or experience. It's basically gambling, but instead of winning real money, you win virtual money. Not only does it destroy any integrity the game had left, it aims to get kids addicted to gambling.

<comment><USER4> It's not gambling that is at the heart of Squeal of Fortune; it's micro- transactions. Runescape has been moving in that direction for a long time to squeeze whatever is left of the remaining player base.

</comment></comment></comment><comment><USER6> Congrats, porting a Java codebase of that size is no small undertaking.

<comment><USER7> I think it was actually easier than that for them to do. From what I recall they actually have their own in house language that compiles to java. I can't remember what it was called off of the top of my head, but I would imagine it would be much easier to port a compiler than a codebase the size of runescape's.

<comment><USER8> The content, e.g. quests, map, npcs, dialog, etc are all in proprietary formats (Runescript and various config formats) but this doesn't compile to Java - it's simply loaded by the engine.

The engine, server and client, is 100% hand coded in Java, and the client portion of that is what we manually 'ported' to Javascript. I say 'ported' in quotes, as though lots of the new code performs the same or similar job to the existing Java client (bugs and all!), its implementation is sometimes quite different to that of the original Java version.

</comment></comment></comment><comment><USER9> I click "go to beta" and then "register", and it says my Java is not up to date? I thought this was Java-free?

<comment><USER4> Also logging in to the website does require that you have java installed.

<comment><USER10> Not strictly true - <https://secure.runescape.com/m=weblogin/loginform.ws?mod=www>

</comment></comment></comment><comment><USER11> This is exciting news for the validity of HTML5 games in the browser!

<comment><AUTHOR> It is, it also shows what innovative ways Jagex go to in bring both the web and gaming industry closer, and forward.

Just for clarification; I'm not an employee of Jagex, I'm a long time player of RuneScape though. I'm also a huge fan of what they've accomplished when you look at the systems they use, and the hardware required to enjoy their products.

<comment><USER12> Hm, are you an employee?

<comment><USER13> I was wondering that same thing. Looking at the accounts infrequent commenting history and then all the responses in this thread seem to point towards that.

</comment></comment></comment></comment><comment><USER14> I've been wondering why this hasn't been done yet.

Their game being coded in Java should make it easy to port to many different platforms seeing as there's a library or framework for almost anything Java.

I don't play RuneScape but I'm happy to see this, this should help bring the game to other platforms like Android, Firefox OS and hopefully iOS (they could make a native app for iOS).

</comment><comment><USER15> This is extremely good news. At one time, back in 2007, Runescape was the elephant in the room for western MMORPGs - if you counted it amongst them, it made all the commercial ones clearly the long tail, not the short peak of success - <http://www.raphkoster.com/2007/05/29/mmo-long-tails/>

</comment><comment><USER16> If anyone still remembers RSC (Runescape Classic) and would like to continue playing it, this is the most popular and well-kept private server for it FYI: <http://www.rscemulation.net/>

<comment><USER17> So i basically ended up as a programmer by hacking the runescape clients so i could use them in the creation of private servers. Illegal but great fun (but wasn't everything illegal but great fun as a teenager?). Contributed quite a lot to the private server community. I still tend to hang out in the programmer usergroups of those communities though I lost interest in modding runescape. But hey, I'm a programmer now, so thanks jagex

p.s. : sorry for helping so many people steal your content, it was just for the lulz. I promise!

<comment><USER18> Hey so did I!

My first programming experience was working on RS2DBase. It was pretty popular back in the day. I met loads of great people through those forums and I don't think I'd have gotten into programming without them.</comment></comment></comment>


Ask YC: Do I need to have breadth on accounting and laws? - <AUTHOR>

Hi all,
I frequent here reading. I really value the opinions here, hence here I have questions that I felt best to post here.
1. Do I need to get some breadth about bookkeeping, accounting things myself? If yes, where can I get such resources if I decide to self-learn?
2. Do I need to get some breadth laws regarding startups? If yes, where can I get such resources if I decide to self-learn?
3. Do you do the bookkeeping (money) records yourself or hire somebody to do it?
I have completely no idea and am just reading business books. I am trying to get more sense and prepare myself some sort. Thanks a lot all!
Update : I'm China based. <comment><USER2> I assume you are US based? In the UK there are govt agencies called "business link" which will gve you free advice on startups and getting your business off the ground. They can give you quite a bit of info related to laws and accounting. I assume that in the US there are similar initiatives (though you might have to pay).

As to employing someone?

I'd say it comes down to how much admin time you want to spend on the company - or rather how much you can spare. If you find yourself becoming too much of a manager and lose the ability to drive the project forward (IMO essential in the opening stages of a startup) then it might actually be more beneficial to employ someone.

Plus of course if you can employ someone experienced for 18 months then that is 18 months where you get to see how it is done and pick up tips & tricks from them. (after which it might then be economical to do it yourself).

I have been quite lucky. My father has run his own firm for a number of years - which is quite small (so he does all the admin). As a result he knows a lot about the books, accounting and legal aspects (if only on a small scale). In the end I decided to go with an accountant - but only because I have a friend qualified from university who is doing it on the cheap :) (if you don't know anyone like that then go befriend them! :D)

</comment><comment><USER3> Under standard circumstances, it's always important to understand where the money is going and how it gets there :). Whether or not its your job to constantly track it at every stop and all the related tasks is a different situation. Generally, I feel its important that you know your basic accounting and bookkeeping and be able to understand it to a sense that you can do it during the early stages. Once you're founded, in the US, you do have financial and tax responsibilities that you have to be aware of and you likely don't have the money to pay an accountant to do it. Once you grow a little bit and have the money to spend on a professional accountant, if you're not really good at it (and even if you are) its generally best you get someone to do that for you, just follow along with everything that's going on.

However, being you're in China I'm not even going to step in advising you on how to go about your country's laws and financial regulations because I just don't know. China is its own animal and can't easily be dropped into the cookie-cutter systems of the US and UK. In my opinion and very limited experience that is, anyways.

<comment><AUTHOR> I see. If I am to start, what would be common ways for self-learners? And yes you are right, I don't think I am financed to pay an accountant at early stage yet. Well... it's all just thinking right now. =)

I understand the systems in China will be quite different, hence I am only asking for general advice.

<comment><USER3> For me, I learned by obsvering my mother who owns a small retail shop and how she did accounting. I also took a course at my high school.

I've not really done much of online accounting research so I don't know where would be the best place to point you. However, some of the major accounting programs are rather simplistic to use and can, usually, step you through it.

The most important thing early on is to just keep a good record of who you owe, how much, and why. If you don't have any employees that are paid yet you really don't have much to worry about. Simple budgeting should get you through.

When you start selling things and start having employees is when it starts to get complicated. Other than that just keep a record of what you bought from who and how much it cost.

 __I AM NOT A CERTIFIED ACCOUNTANT AND MY ADVICE SHOULD NOT BE TAKEN AS THAT OF A PROFESSIONAL. I AM RELAYING INFORMATION BASED ON MY OWN EXPERIENCES.

<comment><AUTHOR> Yes. Thanks a lot. I will think about it.

And don't worry, I will digest the information and decide myself, and not just directly dupe it into my brain. Thanks a lot. =)

</comment></comment></comment></comment><comment><AUTHOR> >>ErrantX

I am China-based. I assume I do not have a friend that can do the work, and after all it seems a friend who will do cheap is very likely a close friend, right?

That is great that your father is someone who has experience. I am walking my own path. Do you have any titles to recommend?

I do not know if I will get bored of those manager things, and I have never did it before. But then, I felt there is a need to do it sooner or later, if we are to start anything.

>>Ram1024

I am trying to storm things out with a friend of mine. We are both developers. No actual things coming out yet, but I believe if both of us are not having ideas of how these things work, there's going to be a pain afterwards. I just want to get some breadth in advance.

You are right, think it loud.

One of the questions we are troubled at is : if we failed and decided to shutdown the startup we are trying, what if an agreement of 1 year payment is signed, how can we get rid of liabilities and not be sued?

\--- Please pardon my unclear questioning as I am still not familiar with the details of how things work. Thanks.

<comment><USER2> Hey,

Well my personal circumstances are by the by: they were an example :D My point was really more that you should try to talk to people with experience (face to face, not just here). A half hr to an hr conversation will probably get quite a lot of stuff straight.

Considering your situation it's a bit hard to give advice. Do you actually have a product to bring to market? Are you at a stage where you a) need funding or b) can begin to sell. With my startup I worked with a team of friends for about 2 years before we formed the actual company. We all had day jobs or university and so we worked in our downtime bringing our idea into fruition. Now we have an almost marketable product and are at the stage where funding is essential: so recently we took the step of forming the company and searching for funding.Until now it was an unecessary need.

If your not selling or bringing in cash for funds then I would advise avoiding forming any legal entity. The only thing I would say is that it might be worth signing some kind of partnership agreement between you and your friend. I'm sure things will be fine but if you fall out (it's so easy) it is best to know exactly where you stand in terms of what individually you can take away (ideas, code, etc.).

As to the final part of that post - regarding getting out if the startup fails. That is incredibly country specific. You will need to get some advice: either from a lawyer or from a public body (if they exist) as to your exact options.

In the UK you could, for example form a Limited Liability Partnership (where if things folded you only have a small personal liability) or an full on LTD company (where there is no personal liability). I _assume_ similar entities can be formed in China (though I DONT KNOW).

I think the best advice is to hunt for someone locally who can tell you your options in that case.

If your entering into contracts with other companies at this stage (note not _just_ selling - actual contracted agreements) then you DEFINITELY need to consult professionally. It shouldn't be too expensive and is worth it. If your obtaining funding and are presented a contract ALWAYS ALWAYS ALWAYS take it to a lawyer before signing. :)

Good luck!

<comment><USER2> One other point is how you plan to account as well. If you want to do it yourself you'll either have to put together your own system (that is EASY to use - trust me that is essential) or invest in a commercial package. That can be expensive - so it might be cheaper to seek professional services.

If iti s only a small company you _might_ be ok just keeping a general book (income, outlay, expenditure etc etc.) and keep all receipts. Then at the end of the financial year take all that to an accountant and pay him to get it all written up and submitted. That is how it works in the UK (and probably costs around £400-500 depending on the amount of work involved) - I dont know if that is the case in China but it is worth investigating. Usually there is no formal requirement for a small startup to keep regulated books - just to have some form of accounts the tax man can request at any time (it;s more complex than that but, meh, essentially all that ya need to know :P)

</comment></comment></comment><comment><USER4> I think you should ask the question, "Hey, should I know where my money is and will I get sued?"

If those two points are relatively important to you, I would imagine spending a little time understanding them.

1\. You should at least know the basics, how accounts work and how to balance the books. Quarterly and fiscal reports are good to know so you can tell where your business is at. Wikipedia.

2\. You will probably need to know about contract and IP law most in the tech business world these days. Wikipedia.

3\. Yes, I use quickbooks. It's so easy to use that it has somewhat dumbed down my understanding of accounting that I formally studied last year. Learn accounting first.

Law is a huge deal. Maybe start off at Jurisprudence? :] I have formally and vocationally studied many topics of law (I hope I don't switch from IT/Coder to lawyer >.<) and it's a relatively abstract and complex subject. Basically, learn the basics about contract and IP law, then just work in good faith. The courts like people and businesses that work in good faith.

</comment><comment><USER5> It also depends on your business model. If you are going to be invoicing clients/tracking time you should check out something like freshbooks.com it will really cut down on wasted time and improve organization. If your company is ad-driven, email your favorite websites and tell them that you are new, but love them and that you would like to put up an ad for them for $5 a month or something. 2 out of 3 times they will happily do it.

</comment><comment><USER6> well it would probably help paint a clearer picture of what you need if you explain to us what you're trying to do.

like for example:

"i am a coder, i am making so-and-so product (can be vague if you're worried someone might steal your idea) for this field. i am currently partnered with someone who does design and marketing right now and we're looking to start full time work on this company in 2 months, what resources or skillsets should i be researching?"

i get the feeling that even by fleshing this out you'll realize some of the things you might need to look into.

let us know :D</comment>


Facebook Warns Debt Collectors About Using Its Service - <AUTHOR> http://www.theatlantic.com/technology/archive/10/11/facebook-warns-debt-collectors-about-using-its-service/66831/

<comment><USER2> Ah, the poor debt collector, what a burden he carries these days.

When I started in my legal career over 30 years ago, debt collectors could declare open season on their victims and pretty much harass them without limit: calling up at all hours of the night, lying through their teeth about what might happen if you did not accede to their demands, pestering friends, relatives, employers, and anyone else in reach once they had exhausted their arsenal on the hapless debtor, and when all that didn't work, cynically start the process up again the next day until the poor soul was worn out from the continuous beating.

All of this has radically changed in the past several decades, to the point where debtors (and, dare I say, deadbeats too) now pretty much have the upper hand with collectors when it comes to fending off their efforts to win through harassment or intimidation. A fascinating write-up on this appears here ([http://www.dallasobserver.com/2010-01-21/news/better-off- dea...](http://www.dallasobserver.com/2010-01-21/news/better-off-deadbeat- craig-cunningham-has-a-simple-solution-for-getting-bill-collectors-off-his- back-he-sues-them/)) and that piece in turn sparked an interesting HN discussion on the topic (<http://news.ycombinator.com/item?id=1075903>).

Essentially, there are now innumerable laws that permit debtors to sue debt collectors who slip up on even small issues in the way they handle their collection efforts. What is more, the entire industry depends on hiring low- skilled workers whose main talent is to intimidate and such persons are normally not astute enough to avoid the legal traps. The hope is that most people will remain ignorant of the laws protecting debtors while the harassment continues.

Accordingly, this game turns on playing the percentages. I have dealt with people at the wholesale end of this business and, believe me, the amounts they pay to acquire debt packages are miniscule in relation to the size of the debts involved (often as low as 1% of the face amount of the paper). Thus, it is rare that any of this ever winds up being pursued in court (at least for the low-quality packages) because that would never pay. The goal, rather, is to scare people into paying. This means, of course, first finding the person so that the process can begin. And this in turn places a _huge_ premium on whatever data might exist by which a debtor might be tracked.

So, yes, the debt collectors will use all forms of social media available as well as any accompanying tricks that might lead to finding their targets. Facebook may adopt policies to try to limit some of this but I would doubt that this would be effective except against flagrant offenders. Anti- harassment laws likely would be more effective, assuming the debtor is savvy enough to know about them and to use them effectively.

In the meantime, this cat-and-mouse game will continue on and on, as it has for eons, only it will now involve the new playing ground of social media.

<comment><USER3> 1%.. really? I was tertiarily involved in this at a college job and they where paying 50 to buy debts. 1% is shockingly low really.

</comment></comment><comment><USER4> Facebook needs to put something in their terms of service saying:

If you are using our service in any way to contact a client of yours who owes you money, you agree to forgive the debt in the entirety.

<comment><USER5> Either the wording will be too specific and not mean much, or it will be too broad and harm the innocent.. in a BAD way. Say, a contractor writing to a client "hey, I'm done now, could you wire me the last 50%?"...

<comment><USER6> They've got no business using Facebook to conduct business in the first place. Besides, their chat and message tools are terrible. If Facebook disallows it in their TOS and it's widely known, then don't do it, especially for business.

<comment><USER7> Businesses doing business on Facebook is exactly more of the kind of thing Facebook wants, don't kid yourself. They won't pursue a lot of this stuff directly themselves, but they're happy for anything that drives revenue without pissing off users. See: Asana.

</comment></comment></comment></comment><comment><USER8> I don't see what's threatening or intimidating about "Have your friend Melanie call me." Seems pretty innocuous to me.

Could you buy Facebook ads that target the person's friends? All the data you need is there for the debt collector's taking. You wouldn't need to intimidate anyone or say anything hateful. The ad could be as simple as, "Get $5 in Facebook Credits. Have Your Friend Melanie Call Me." Not sure if that ad would actually work, just thinking out loud.

From Facebook's perspective, you don't want people to stop creating accounts (or quit using them) because of fear of debt collectors, but debt collectors are a business that could provide them a revenue stream.

It's already a known fact that some employers check potential hires on Facebook and I don't think that's had much of a chilling effect on the growth of their social network.

<comment><USER9> 'I don't see what's threatening or intimidating about "Have your friend Melanie call me." Seems pretty innocuous to me.'

It doesn't take too many of those 'innocuous' messages for someone to figure out what they are. If your friends suddenly get 15 messages from strangers asking them to have you call, it's pretty clear what it is.

I get calls from debt collectors all the time. The problem is it's not me they are looking for; I just happen to have the same fairly unique name and live in the same city. I know it's not me because it's for a credit card debt from when I was 7. I really don't want my friends all getting messages from strangers asking me to call them. Sure, the example cited in the article was pleasant sounding, but I can guarantee you they will quickly degrade into threatening/harassing messages if Facebook gives debt collectors the signal that it's okay to use their service. I know because I deal with them on the phone all the time yelling, calling me a liar, etc. when I try to explain it isn't me they are looking for.

<comment><USER10> I had a similar problem when I got a new number a few years ago. I would get calls, usually very early in the morning asking for someone else. Even though I would say they had the wrong number they would just continue to call back day after day. The number was from a debt collection agency.

<comment><USER11> I have this problem right now and it's pissing me off. I'm starting to wonder if I can do anything against them. The guy doesn't even have the same name as me. He hasn't had this number for years yet I still get calls.

<comment><USER12> Under the fair debt collection act, all you have to do is tell them to stop calling you. Seriously. Just say something to the effect of "under the rights granted by the fair debt collection act, I'm informing you that you are calling the wrong number, I am not the person you're looking for and to please never contact me again" if they do, you can sue them for up to 10k for violating it. You have to do it with each distinct debt collector though. Check clarkhoward.com for more information.

</comment></comment></comment></comment></comment><comment><USER13> You'll get more sympathy if you use Facebook to track down deadbeat dads and sex offenders who haven't registered.

<comment><USER14> Or, on the internet, not really.

(family law systems and sex-offender registries are both fairly widely known to be disgustingly broken)

<comment><USER13> I'll believe you when I see a warning from Facebook castigating investigators for using their service for those purposes.

</comment></comment></comment><comment><USER15> Do the repo men know about FB Places & foursquare yet? Seems like that would make their job easy.</comment>


A couple of projects for engineering students - <AUTHOR> We have designed two projects specially for engineering students. One, called Randhaa, is a new Windows apps in C that greatly simplifies the process of building Windows apps in C. Contact email@example.com for this. The other is another Windows app that helps you explore the design of sound characterization algorithms using your laptop. Such algos could, for example, be used to build sound accessible personal assistants such as SIRI. Contact email@example.com for this one. <comment><USER2> Some links about projects would be nice.</comment>


Kill Sticky Headers - <AUTHOR> https://alisdair.mcdiarmid.org/kill-sticky-headers/ <comment><AUTHOR> On Firefox I use extension Hide Fixed Elements for this [0] because it gives me a toolbar button (although I'm wishing for a keyboard shortcut) that makes it easy to turn it on and off.

However, adding that bookmarklet to the browsers on my phone has been the biggest life saver - it's crazy how often I hit a site where only ~30% of my screen is dedicated to content and the rest are sticky headers or footers.

[0]: [https://alisdair.mcdiarmid.org/kill-sticky- headers/](https://alisdair.mcdiarmid.org/kill-sticky-headers/)</comment>


Cranked RSS reader - <AUTHOR> http://cranked.io/

<comment><USER2> Sound great but none compatible mobile app :/ I use Press on my Android phone for example with feedbin and another desktop app on my mac</comment>


WTF do I click on? (site usability testing) - <AUTHOR> http://hacksushi.com/2009/02/08/wtf-do-i-click-on-website-usability-testing/ Article on website usability testing. <comment><USER2> Yes, web analytics and usability testing are powerful tools that complement each other. Useful reminder that neither has to be very expensive in time/money and... can pay huge dividends to your site in both revenue and in development time (when you are more selective in which features get most of your attention and when they effectively grab _visitors'_ attention).</comment>


Algorithm eliminates blurred images caused by shaky footage - <AUTHOR> https://techxplore.com/news/2017-06-algorithm-blurred-images-shaky-footage.html <comment><AUTHOR> Link to study page with arXiv link:

[http://dev.ipol.im/~mdelbra/videoFA/](http://dev.ipol.im/~mdelbra/videoFA/)

</comment><comment><USER2> Zapruder film!</comment>


Ask HK: What about niche market software startups - <AUTHOR>

It seems that most information out there are about public facing product, by that i mean startup companies which have their main product geared toward the general public ( Yelp,facebook,Airbnb etc...).
I am wondering what is it like for companies with a specific/ constraints demographics, like security system for stores, Financial application for trading firm,medical/research/weather forcast. applications etc... Are those market amendable to startups ?
Does targeting those market change something significant (like more focus on revenue instead of share value)
Anybody with experience in this care to share his/her point of view. <comment><USER2> check out all of these companies yc has invested in: [http://yclist.com/](http://yclist.com/)

<comment><AUTHOR> I am not sure i understand your point</comment></comment>


Copy-Left Left Behind - <AUTHOR> https://www.theregister.co.uk/2020/01/17/mit_apache_versus_gpl/ <comment><USER2> > in the area of cloud computing, we are seeing a resurgence of interest in > extremely strong copyleft licensing, such as the AGPL

The problem with this statement is that _NONE_ of the actual successful projects that are turning to the AGPL are making an open source play. Instead they are pursuing a dual licensing strategy.

I love the GPL2 but I think it's time for the FSF to accept that because v3 and Affero overreach so much they have made software less free.

I once began negotiating to _pay_ for a dual licensed package and after several rounds of email, the lawyer finally revealed that the cost to my company would be $10,000 per host and 1/3 of our gross revenue. That is why where I work now, and everywhere I've ever worked, Affero and GPL3 is forbidden.</comment>


YC Rejection Letters Are Out - Share your rejected project - <AUTHOR> Once again, I was on the receiving end. 10th time for me (but with multiple different projects/startups)! Is that a record?<p>If anyone is keen on figuring out what is affecting their sleep, and improving it, check out https://withbliss.net <comment> 100-xyz Our product lets users create animations in minutes. Here is an example of Siebel of Ycombinator rejecting us :-)

[https://toonclip.com/player?key1=530f95331f](https://toonclip.com/player?key1=530f95331f)

<comment><USER2> This isn't a terrible idea. It reminds me of that mobile game "Episode"

</comment></comment><comment><USER3> I always wondered if they see applying many times with different ideas as a red flag, as it might indicate that someone quickly abandons things?

</comment><comment><USER4> That could be a record :) Do you feel like your startups got better with each application, or they were just different ideas?

<comment><AUTHOR> Both. I am working on very different ideas. The most recent is the first time I have something that can be explained simply, which lots of people suffer with, etc. But I only came up with it a few weeks before I submitted my application.

My last start-up is still going, and making some money, but still after 4 years it's difficult to explain and understand the market for 3D mapping, volumentric video, and where that intersects with outside sports.

Come up with a one-liner for that [https://ayvri.com](https://ayvri.com)

<comment><USER5> For the consumer, that video is better than any one liner. One liners don't generally make me want to play with an app for the next hour :D

<comment><AUTHOR> That's so kind. Thank you. When people ask me what I do, 99% of the time, I have to pull out my phone and say "easier to show you then try to explain it".

Thanks for the kind words, glad you enjoyed it.

</comment></comment></comment></comment><comment><USER6> 10th time, wow! admire the dedication.</comment>


KLM to Lay Off 5k Employees Due to Covid-19 - <AUTHOR> https://kokpitherald.com/klm-to-lay-off-5000-employees-due-to-covid-19-crisis/ <comment><USER2> > 500 ground positions, 300 cabin crew positions and 300 cockpit positions and > approximately 400 positions at KLM subsidiaries and Air France-KLM group > functions

Non-skilled employees are for a tough ride as a crisis is when most people loses their jobs, and it is when it is more difficult to find a new one.

But, this is appalling news for many highly specialized employees. Many of them had a career in fly-related fields.

To have skills on an industry that suddenly disappears under your feet is the nightmare of any skilled worker.

The software industry slowly re-invents itself, and one needs to keep up to date. But, it has never been such a turning point so fast and that seems that is going to last for long.

<comment><USER3> Phrasing here is weird how "non skilled" people in for a "tough right", but for skilled people this news is "appalling".

Seperately, I'm a developer and I stopped working in March due to reasons unrelated to COVID-19 and now I'm finding it exceptionally hard to get back in and find a job.

<comment><USER4> That can be explained by most companies operating with a hiring freeze right now.

I was interviewing with a few companies and all but 1 froze hiring during the process. I think it's to insulate from economic shock; nobody knows how bad each company may be hit.

<comment><USER3> Yup. I know.

Still sucks when you can't get a job. I too thought because I was a smart web developer that I would always be able to make so. Oops.

</comment></comment></comment></comment><comment><USER5> 6000 Quantas staff let go last month. Hard to keep everyone when travel is virtually zero

<comment><USER3> FWIW, _Qantas_ is an an abbreviation (originally Queensland and Northern Territory Aerial Services), so there's no "U" after the Q.

<comment><USER6> Interesting. If we are being pedantic, I can't resist: While technically an abbreviation as well, most would call that an acronym.

</comment></comment></comment><comment><USER7> Avianca, the second oldest still operating airline in the world went bankrupt already.

KLM is the oldest still operating airline, it'd be crazy if they go bankrupt too!

</comment><comment><USER8> Air travel is ecologically unsustainable.

I would hope the Corona crisis would be the perfect opportunity to wind down this archaic sector and transition that part of the economy to something more future sustainable.

<comment><USER9> Thats a fair take but when I look at my leftie social circle they all had gap years in New Zeeland and love shopping in New York.

<comment><USER10> Too bad you are downvoted. What you are saying seems to be correct

> Green Party supporters 'most likely' to fly long-haul

[https://www.telegraph.co.uk/travel/news/Green-Party- supporte...](https://www.telegraph.co.uk/travel/news/Green-Party-supporters- most-likely-to-fly-long-haul/)

</comment></comment></comment><comment><USER11> More evidence that you never know, there is no such thing as a secure position so if you're dreaming of starting your own thing or venturing into something more unsecure, there is no reason to wait (unless you're saving up for it, or something like that)!

If you have the possibility you should definitely reach for it, the greatest risk in life is to never have tried to achieve your dreams.

<comment><USER12> Working in a corporation gives you the illusion of security,

becoming an entrepreneur gives you the illusion of freedom.

<comment><USER13> Corporations are slow and predictable. In that sense they are reliable for income. As soon as they cut expenses like conference or travel or bonuses it is time to look for another job even if they say the cutbacks are temporary. You will have another corporate job with the 4-6 month window of the upcoming job cuts.

<comment><USER6> Unless the entire industry is in a downcycle and there are no jobs to be had.</comment></comment></comment></comment>


Advanced Attack Toolkit, Fully Undetectable Rat / Botnet, and More - <AUTHOR> https://github.com/quantumcored/paradoxia <comment><USER2> Looks like it's just a standard executable that listens on a hardcoded IP and port. This is the kind of stuff we'd whip up in an afternoon during a pentest when we needed a throwaway tool to use.

</comment><comment><USER3> In the event you want to pwn a person who uses Linux desktop? If so, glad to see this, there are cross platform rats that work on Linux but a Linux specific is rare to me.

Oh and I wouldn't say undetectable,AV may not detect it now but Linux detection can be pretty wild, even with good EDR vendors a lot of tuning is needed due to how customizable it is (admins/devs always do one off unusual things, windows has more predictable structure).

Didn't read the code but I loathe the python usage, if for windows you can use pyinstaller to build an exe. Anywhere else, your rat will break because of python versioning/deps.

<comment><USER4> The client runs on Windows and is written in C++ (bot directory). It's still terrible, amateur-level code that nobody should be running but the most critical aspect here is the architecture: Fixed, with most things hardcoded and hard to adapt/change. Also, no runtime flexibility whatsoever. This isn't what an advanced attack toolkit looks like, even a minimal one written in C/C++.

Here is my own contribution to this space:

[https://downloads.immunityinc.com/infiltrate- archives/python...](https://downloads.immunityinc.com/infiltrate- archives/python_deflowered.pdf)

</comment></comment><comment><USER5> Certainly not FUD or "advanced". No encryption/obfuscation used to communicate with C2 at all, common patterns in the c++ binary that drops on clients, no polymorphism, drops itself on the disk. Might be a fun toy project for the author but this wouldn't be useful in any actual security testing deployments.

</comment><comment><USER6> Just wanted to say, the github page has a note saying: NOTE : Do not upload the BOT to online scanners!

With you posting it here, I can guarantee that at least a few people are going to upload it to online scanners.

</comment><comment><USER7> If it was fully undetectable it would mean that it would have no effect and does not exist on disk or in memory of any sort. Any malware/RAT is detectable in someway since it has some effect that shouldn't be there. That can be network activity, just the process running, just the code existing on a drive or in memory or anything else.

<comment><USER8> I like how he writes "do not upload to online scanners".

</comment></comment><comment><USER9> There is nothing noteworthy or undetectable about this. Disappointed that it's getting hype on HN.</comment>


Configuration-free P2P Skype replacement - <AUTHOR> https://tox.im

<comment><USER2> tox is kil</comment>


Intro Guide to Dockerfile Best Practices - <AUTHOR> https://blog.docker.com/2019/07/intro-guide-to-dockerfile-best-practices/ <comment><USER3> As is the case with the Docker's best practices for Dockerfiles in the official documentation, they're leaving out some really important details.

Specifically, they don't really express how Docker packaging is a process integrating the way you build, where you build, and how you build, not just the Dockerfile.

1\. Caching is great... but it can also lead to insecure images because you don't get system package updates if you're only ever building off a cached image. Solution: rebuild once a week from scratch. ([https://pythonspeed.com/articles/docker-cache-insecure- image...](https://pythonspeed.com/articles/docker-cache-insecure-images/))

2\. Multi-stage builds give you smaller images, but if you don't use them right they result in breaking caching completely, destroying all the speed and size benefits you get from layer caching. Solution: you need to tag and push the build-stage images too, and then pull them before the build, if you want caching to work. (Long version, this is a bit tricky to get right: [https://pythonspeed.com/articles/faster-multi-stage- builds/](https://pythonspeed.com/articles/faster-multi-stage-builds/))

<comment><USER4> > Solution: rebuild once a week from scratch.

I've noticed the official docker images don't seem to do this. E.g. the official "java" images seem to be uploaded and then are never changed, the only way to get a newer underlying base system is to upgrade to a newer version tag release. Is this true of all the official images, I wonder?

<comment><USER5> This is not true. The images are rebuilt automatically when base images are updated.

<comment><USER4> What is the source for that? When I looked into this before, I wasn't able to find anything in the documentation stating this would happen.

Here's the official Node.JS image from a couple years ago, for example...

      $ sudo docker inspect node:6.1 | grep 'Z"'
             "Created": "2016-05-06T21:57:54.091444751Z",
                 "LastTagTime": "0001-01-01T00:00:00Z"

Node 6.1.0 was released on May 6 2016, it looks to me like the image was never changed after that? And if I run `ls -lah /var/lib/dpkg/info/*.list` inside the image, I get a modification time of May 3, 2016 on all the files... I tried the "node:10.0" image as well and I see similar behavior.

<comment><USER5> This is how the official images work.

[https://github.com/docker-library/official- images/tree/maste...](https://github.com/docker-library/official- images/tree/master/library)

Each image has a manifest with all the source repos, tags, what commit to pull from, what arches are supported, etc.

As long as the tag is listed in that manifest, it is automatically rebuilt when the base image changes.

<comment><USER4> Perhaps we're talking past each other? When I go to [https://github.com/docker-library/official- images/blob/maste...](https://github.com/docker-library/official- images/blob/master/library/node)

It only is showing the newest version of node 8.16 listed in the manifest file. In other words, if I had an image based off node 8.15, it isn't going to be updated ever.

So it's not a matter of just rebuilding regularly, if you aren't updating your dockerfiles to use newer language versions, you also aren't going to get system updates.

Edit: I think i do see your point which is that if you are completely up to date on language versions, clearing the build cache every once in a while may still help get a system update if an upstream image is changed in between the release of a new language tag.

<comment><USER5> Yes, and it is mostly up to the maintainer of the image on how to handle tags. Typically minor patch releases are not kept around once the new patch is out. May be worth filing an issue if this is problematic?

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Use the experimental BuildKit Dockerfile frontend for much improved build time mounting: [https://github.com/moby/buildkit/blob/master/frontend/docker...](https://github.com/moby/buildkit/blob/master/frontend/dockerfile/docs/experimental.md)

* You can mount build-time secrets in safely with `--mount-type=secret`, instead of passing them in. (Multistage builds do alleviate the problems with passing secrets in, but not completely.)

* Buildkit automatically parallelizes build stages. (Of course!)

* Mount apt-cache dirs in at build time with `--mount-type bind` so that you don't have to apt-get update every single time, and you don't have to clear apt-caches either.

And lots more.

Notice that this mostly involves capabilities that Docker already has to _build time_.

<comment><USER7> But in order to build with BuildKit you MUST BE connected to the internet during the build... So not ready to go yet...

<comment><USER8> I assume you mean the helper for COPY/ADD is pulled from the registry. That is not the case since Buildkit v0.5 / Docker v19.03 . If you have images you use locally, network connectivity is not required, otherwise, BuildKit will verify that the mutable tags have not changed in the registry (eg. it doesn't use the string "latest" to verify the validity of cache).

<comment><USER7> The message without internet connection is: ERROR resolve image config for docker.io/docker/dockerfile:1.0-experimental (the most current version of Docker Desktop for Windows - 184.108.40.206 with Docker Engine 18.09.2)

<comment><USER8> As I mentioned you need to have the images you use available locally (eg. `docker images | grep docker/dockerfile`). In your Dockerfile you explicitly say that you want to use docker/dockerfile:1.0-experimental from the hub as a build frontend. If there is no such name/tag locally it needs to check the state in the registry as `1.0-experimental` tag is updated on new releases.

</comment></comment></comment></comment></comment><comment><USER9> If you use multi-stage builds be aware that COPY --from also can do a chown and save image size - doing a RUN chown -R that is sometimes necassary to run stuff as a regular user _duplicates_ the image size because changed metadata equals a copy for Docker.

Also if you dare to enable user-namespaces for Docker because, well also security - multi-stage builds fail ([https://github.com/moby/moby/issues/34645](https://github.com/moby/moby/issues/34645))

<comment><USER10> COPY --chown

<comment><USER6> COPY --chown is a big improvement, but the way that COPY works differently than a Unix cp can be an impediment. (It flattens directory structures.)

</comment></comment></comment><comment><USER11> Tip #6 (Use official images when possible) is certainly convenient when you're just spinning up something (I use them in local docker-composes all the time), but it's surely opening yet another security hole when it comes to prod. We're not lacking examples where packages are hijacked (feels like it happens constantly on npm, rubygems had it just the other day...), and docker hub has already had one security breach.

Perhaps worth a mention in this blogpost?

<comment><USER12> You can use the official images and tag them with the SHA image ID - <USER2> should give cryptographically enforced security and reproducibility.

<comment><USER13> Actually, if you use the SHA256 of the image as a reference for the FROM (ex: tomcat@sha256:c34ce3c1fcc0c7431e1392cc3abd0dfe2192ffea1898d5250f199d3ac8d8720f), and if there is no tag associated to that SHA, there is a chance that the Docker Registry will garbage clean it. The Docker Inc garbage cleaning frequency is not very documented.

<comment><USER14> Hello, I am one of the engineers on Docker Hub. If the image was ever pushed via a tag which must be the case if it was done via docker CLI then that image is never deleted (unless the tag is deleted from Hub UI and no other tag refer to it). This means if sha256:c34ce3c1fcc0c7431e1392cc3abd0dfe2192ffea1898d5250f199d3ac8d8720f was referred by latest tag which was pushed to another image sometime later then `FROM tomcat@sha256:c34ce3c1fcc0c7431e1392cc3abd0dfe2192ffea1898d5250f199d3ac8d8720f` will continue to work. Apologies for not having this documented. I'll work on getting this documented on [https://docs.docker.com/docker- hub/](https://docs.docker.com/docker-hub/).

</comment></comment></comment></comment><comment><USER15> For Java it's better to use Jib Gradle/Maven plugin from Google. It produces docker image directly and creates layers with dependencies and class files.

</comment><comment><USER10> I've read several "Dockerfile best practices" would-be tutorials, and this one stands out as both correct, concise, well explained, and ordered from simple and important to more nuanced. To the author - great job.

</comment><comment><USER16> Could someone explain why tip#9 is a good idea? To me it makes more sense to build the application in the CI pipeline and use Dockerfile only to package the app.

The post is focused on Java apps but, for example, there is a distinction on runtime and SDK images in .NET Core. If you want to build in Docker, you have to pull the heavier SDK image. If you copy the built binaries to image, you can use the runtime image. I guess there could be similar situations in other platforms too.

Other than that, it looks like a decent guide. Thanks to the author.

<comment><USER17> For me the big advantage of doing more in docker and lees in the CIT environment is that I have less lock-in/dependency to whatever my CI provider does. I try to reduce my CI scripts to something like

        docker build
        docker run image test

All complexities of building and collecting dependencies go in dockerfiles, so I can reproduce it locally, or anywhere else. And importantly, without messing with any system settings/packages. No more makefiles or shell scripts that make a ton of assumptions about your laptop that need to be set just right to build something from source; just docker build and off you go. Such a hassle when you need to follow pages of readme just to build something from source (plus a lot of installed dependencies that you have to clean up afterwards)

</comment></comment><comment><USER18> I thought about using Docker for a reproducible build environment but, in that context, found it problematic that every time a Dockerfile is built you may end up with new base images and different package versions. That's hardly reproducible.

Perhaps I'm coming at this from a wrong angle.

<comment><USER19> Build a java application with RHEL-base-jdk:10 and from commit id:[HASH], that is as reproducible as it gets. As is stated you can save all the build dependencies in an Docker image, so you can go back and look at it later. Usually it is enough to have the build logs though.

We set system time as well.

</comment></comment><comment><USER20> Dockerfiles are a mostly adequate prototyping tool but are not great for generating production builds. Lack of modularity, cascading versioning / dependency management, reproducible builds, ... every time I've used Dockerfiles in anger I've cobbled together another 60% of a build system out of bash scripts.

I wish Dockerfiles would just fade away into the background, and be replaced by something more similar to an archiver but with better integration with repositories and versioning metadata.

<comment><USER3> There are some people trying to build alternative toolchains for Docker builds that remove Dockerfiles altogether, e.g. [https://buildpacks.io/](https://buildpacks.io/) and (in a very different approach) Nix-based builds.

My personal approach for Python applications' Docker packaging ([https://pythonspeed.com/products/pythoncontainer/](https://pythonspeed.com/products/pythoncontainer/)) was similar to yours: wrap the build process in a script. I wrote it in Python rather than bash, so it's more maintainable, but a Ruby shop might want to write theirs in Ruby, etc..

</comment></comment><comment><USER7> Dockerfile = docker run + docker commit + MANY unneeded limitations

<comment><USER6> Please don't downvote parent. This is true.

It is a fact that everything that happens in a Dockerfile execution via `docker build` can be done with a `docker run` and executing commands and ending with `docker commit`. Even the caching mechanism can be replicated. (Except with more control in my opinion.) It is also a fact that `docker run` has more capabilities than `docker build`, such as being able to mount things in.

<comment><USER21> Thanks as an occasional docker user this wouldn't have occurred to me.

</comment></comment></comment><comment><USER22> Order of copying is especially important with Java (Maven/Gradle) builds and NPM, it saves time.

Its also good to speed up builds with configuring them to cache artifacts in a separate layer before the build happens or you can get them to use the host machines cached .m2 /.npm folders as a volume, however that might not work with pipelines etc. that build the docker containers.

</comment><comment><USER23> COPY caching doesn't work between computers.

This was surprising to me. I thought I could `docker pull` the layers from the registry and only re-build what had changed on my machine. But no, this doesn't work.

The reason is that the docker client archives the source files, including all the file attributes like uid,gid,mtime, ... Between two computers those are bound to be different.

<comment><USER8> I recommend you to upgrade to BuildKit. Also, the above isn't really true for Docker CLI, mtime was never taken into account in the old builder and Docker CLI never sends uname/gname. With API it was possible in the old builder though (hence the incompatibility with compose for example). In more practical cases I've seen it caused by git directory instead, that isn't stable. In that case, you can put .git into .dockerignore or if you don't use it, BuildKit will discard it automatically.

</comment></comment><comment><USER24> I highly recommend checking out [https://github.com/docker/buildx](https://github.com/docker/buildx) . It's still in tech preview but it's an exciting look at the future of docker-build.

</comment><comment><USER25> What about changing the default USER in the dockerfile?

<comment><USER26> I think you're not the only one that mentioned this omission, I'll throw in since it seems to be pretty poorly highlighted and has some surprising failure modes:

When you use the USER directive to set up a working user in Dockerfile, be explicit about UID and use the numeric UID.

What works 99% of the time is to use alpha username in the "USER" directive. You can get some surprising artifacts if the container runtime hits this rare bug[1]. There are likely several other great ways this can go wrong, as well. Somewhere deep in the manual, it is suggested that you should only use a numeric UID, even though USER accepts an alphanumeric username most of the time, but if you look at container images built by OpenShift and other pro docker-ers, you will see they always do this with a numeric UID.

[1]: [https://forums.docker.com/t/unable-to-find-user-root-no- matc...](https://forums.docker.com/t/unable-to-find-user-root-no-matching- entries-in-passwd-file/26545)

</comment></comment><comment><USER27> so if you want a vi in your image (the article has a vim line) you can get one (because they are occasionally useful) for a low cost by installing _nvi_ instead of vim. It's great and only a few K.

<comment><USER28> You should not include binaries not needed for production for security reasons, not because of size alone.

<comment><USER29> Can you elaborate on this? If someone pwned my container and is able to execute commands, what does it change whether they get to use a text editor? Otherwise, what does it change whether unused programs are around?

<comment><USER30> I believe the whole point is that adding unnecessary software to a container also increases the attack surface unnecessarily.

</comment></comment></comment></comment><comment><USER31> My personal best practice is to never use docker.</comment>


Hackers: Wizards of the Electronic Age (1985, w/ Stallman, Levy, Woz and others) - <AUTHOR> http://www.youtube.com/watch?v=bl_1OybdteY

<comment><AUTHOR> Amazing how much has changed and how much has not. I recently showed this to a group of undergraduate students in a Tech Talks course (Mostly CS majors and a few MEs and EEs). The range of reactions ranged from nostalgia and excitement to "I didn't like the outdated 80's movie".

I should note, it's 30 minutes long, worth watching though.</comment>


Brainjunk and the killing of the internet mind - <AUTHOR> https://techcrunch.com/2018/02/07/brainjunk-and-the-killing-of-the-internet-mind/ <comment><USER3> I love the assumption that all the free content is 'junk' and the paid content is somehow better. In my experience, it's the free stuff from hobbyists that's often better than the stuff printed by professional publications, since they care about the topic rather than meaningless clicks and ad analytics.

Because the thing is:

> But if you actually want to learn, to improve your mind, to improve your > awareness and understanding of the world, you have to shell out.

I don't need to shell out anything. I can find perfectly good content from people that care for free, and I myself write perfectly good content for people that are interested in the topic and provide it for free.

The people that want good content don't need to pay for it, they can find for it free. And the people who don't care for good content now...

Probably weren't caring much for it in the past either. Do you really think the folks that read the tabloid papers (or the Daily Mail) wanted a super deep, thought provoking piece that questions every bit of their world view?

That the people who watch cable news shows or what not were going to pay for something from a professional organisation?

That wasn't going to happen, and it didn't. Instead, the people who wanted good content found they could get good content elsewhere, the ones who wanted mediocre content found they could get the same stuff elsewhere and the old media are left in a situation where they're really not the best at either of these things.

<comment><USER4> > I don't need to shell out anything. I can find perfectly good content from > people that care for free, and I myself write perfectly good content for > people that are interested in the topic and provide it for free.

What kind of content is this, _exactly_?

I think you're missing the forest by focusing on a few unique trees. I agree, you're likely to find far better free stuff about tinkering around with microcontrollers (for instance) that are written by hobbyists than you will from paid publications. Taken all together, though, that kind of stuff is ultimately very limited and misses whole _universes_ of valuable areas. For instance: news reporting, history books, etc. require a breadth of attention and effort to create that just isn't possible with a day job. If you want to "improve your mind, to improve your awareness and understanding of the world" you can't hyper-focus on hobbies.

<comment><USER5> Wikipedia, Project Gutenberg, Stanford Encyclopedia of Philosophy, Cosma Shalizi's notebooks.

<comment><USER6> StackOverflow

</comment></comment></comment></comment><comment><USER7> > So let me propose a little framework: "Enjoy content. Not too much. Mostly > paid".

High quality, good free content can still be found on the web. Some people, including me, actually like the idea of giving away content for free.

I found a pretty strong visual content filter is the bling factor: you know, those extremely insightful old fashioned no bullshit plain html sites with minimal CSS, and no ads... One of the reasons they don't really need ads is because it costs pennies to host and serve KiBs of content, there is no "platform" or "ad engines" or any of that nonsense, it's just some people who want to share some insights, they write some static html and throw it up for pennies because it's KiBs. This style of content authoring tends towards good content because it's not prone to hunt for eyeballs... it's just there, there is no difference to the author or the content's existence regardless of how many views and clicks happen.

That said it doesn't have to look crude, It's some clean minimal CSS design can improve the legibility of the content immensely without bloating it - it's just less common.

<comment><USER8> I agree with your overall premise - that attention-seeking ads and whatnot is usually an indicator of bad content, but not always.

It's hard for authors to do this full-time without advertising. Who pays them if not users or advertisers? Hobbyists and amateur publishers are one thing, but people who do things and write about them full-time are searching for a way to support themselves.

I would replace "no ads" in your comment with "respectful and honest ads" (and even better if those ad fees are paid directly to the author or a small distributor that is being selective about matching ads to pages).

<comment><USER7> > It's hard for authors to do this full-time without advertising. Who pays > them if not users or advertisers? Hobbyists and amateur publishers are one > thing, but people who do things and write about them full-time are searching > for a way to support themselves.

This is just my opinion: but I think this is the so called "problem" that people need to not solve... medium keep talking about "how can we replace the ad model", and hey, maybe in "reporting" style content this is a legitimate problem, but going forward I don't see it applying to a lot of written content, people with insightful things to write about often have those insights because they do something other than writing for a living. Directly making monkey off literature in the traditional sense is not necessary - <USER2> making the literature can indirectly make you monkey by e.g improving your employment prospects if that's important to you, not to mention writing literature can be an enjoyable art form in itself.

<comment><USER8> That kind of writing makes sense for a blog, and most blogs I see/follow don't have much advertisting that benefits the author.

> writing literature can be an art form

Right. There are some amazing writers out there who are true artists and yet have to subsidize their writing with traditional employment. The writing far outvalues the other-job output.

(This isn't a problem just for writers - many artists are starving of course)

I'd like to find a model that lets them do writing full-time and get paid in a way such that better writing => more readers => more income.

It's unclear how to pay a great writer for their writing if not for ads or directly from readers.

<comment><USER7> > Right. There are some amazing writers out there who are true artists and yet > have to subsidize their writing with traditional employment. The writing far > outvalues the other-job output.

My "completely free" opinion applies more to people writing informative content based on their successes and experiences separate from the writing it self.

It definitely doesn't apply for those who are writing for the sake of writing as a creative work, where the "other" job is just a means. In this case it's back to the same question, and it may even suit the content more because it's more about what people enjoy to read than what is objectively "good" of "useful", in which case voting with your monkey seems not to corrupt as much... then again there is hollywood and pop music so scratch that. I think the best ideas about for this now are things like patreon - where the focus is more on encouraging author creativity rather than monetisation of past works like copyright. However this still has it's downsides... e.g it suits and encourages continuous streams of small pieces of works more than masterpiece style sized works.

</comment></comment></comment></comment></comment><comment> temp-dude-87844 I wonder, where does this assertion come from, that "readers crave brainjunk at the expense of all other quality content"? The surrounding sentences suggest that the author genuinely believes that demand came (and comes) first, and "media companies have been more than happy to oblige". I posit that this is a load of crock.

Free "junky" content is popular simply because it's free and plentiful, and has a vastly, unquantifiably lower barrier to entry than paid content -- and not because it's dopamine-releasing junk. It's popular because it's accessible, requires little cognitive load to evaluate ahead of time, and its momentary consumption is noncommittal. If article mills stopped producing throwaway clickbait to fill an Outbrain footer, the corresponding "demand" would plummet.

But this content keeps being produced, because business models on the web suck, so every publisher feels they have to put some eggs into advertising. Because reader attention has an upper bound, one publisher's gain is quite often another's loss, and this directly translates into advertising revenue.

Given the low appetite for the masses to pay, Apple, Google, Facebook, Medium, and incumbent news publications have all tried to solve this problem in ways that further integrate advertising, analytics, and personalized suggestions, and these efforts continue to face challenges due to the misalignment of incentives.

<comment><USER9> The Gutenberg Project had free e-books decades ago, but people did not and do not devour Beowulf the same way they do an Instagram feed, even though Beowulf is even easier and cheaper to access.

<comment><USER10> Most people couldn't even read Beowulf if you gave it to them.

 _Wæs se grimma gæst Grendel haten, mære mearcstapa, se þe moras heold, fen ond fæsten; fifelcynnes eard wonsæli wer weardode hwile, siþðan him scyppend forscrifen hæfde in Caines cynne._

Many people struggle to read their own language sadly, or comprehend stories with any amount of depth. Old English is probably asking too much of them.

I'm not convinced that this is new though, we're just far more connected to the LCD than ever before.

Edit: Translation of excerpt:

 _Grendel this monster grim was called, march-riever mighty, in moorland living, in fen and fastness; fief of the giants the hapless wight a while had kept since the Creator his exile doomed. On kin of Cain was the killing avenged..._

<comment><USER11> There are translations also on The Gutenberg Project.

<comment><USER10> Yes, I remembered that and included the translation, but I'd say that my overall point stands. How many people would find the translation overly accessible unless they were already of a literary bent, or just well educated?

<comment><USER11> It's an epic about a king traveling and killing a dragon, it doesn't take a ton of education to enjoy. And beyond that, there are many books on there that are accessible for anyone who can read. Your overall point seems fine, but it agrees with the person you replied to that cheap and easy to get isn't what's driving this.

<comment><USER12> > It's an epic about a king traveling and killing a dragon, it doesn't take a > ton of education to enjoy.

That is an extremely simplistic look at literature - you just reduced it to one sentence description of plot alone. That is not how it works and that is not how it ever worked. What makes it hard is the way it is written, presence of either dragon or killing does not make something easier to read. He is right in that most people would not enjoy it.

> And beyond that, there are many books on there that are accessible for > anyone who can read.

And many many more that are decisively not accessible. You assume that people will dig for hours through guttenberg to find something fun and accessible, but they wont and probably cant.

<comment><USER11> >That is an extremely simplistic look at literature - you just reduced it to one sentence description of plot alone. That is not how it works and that is not how it ever worked.

There's more in the text than just the plot, but the story alone can be enjoyable without knowing everything else. I'll agree the old translation of an ancient poem is probably still going to be a chore, a better example is something like Dracula.

>And many many more that are decisively not accessible. You assume that people will dig for hours through guttenberg to find something fun and accessible, but they wont and probably cant.

No, I assume that people will find something fun and accessible by the same means they do elsewhere, either through talking to other people or looking at what's popular.

<comment><USER10> You're giving me the strong impression of someone who is very bright, and has spent most of their time around other very bright people in the context of an excellent education. You should be proud of that, while recognizing how many more people live profoundly different lives. Consider the popularity of entertainment you'd find offensively boring, and remember that far more people enjoy that, than Beowulf.

In short, what you're saying isn't wrong or unreasonable, but I think it's fair to say that it reflects a fundamental misunderstanding of what "average" looks like.

<comment><USER11> Popular entertainment isn't a new phenomenon, there are plenty of books on Project Gutenberg that anyone could find enjoyable without needing some deep understanding of literature.

And remember what's being discussed here. You can't blame "brainjunk" on people unwilling to pay for content, as they are also ignoring the free content on Project Gutenberg.

<comment><USER12> Popular entertainment of 19 century is often not fun for someone living in 21 century. The reasons why it was fun to people went away with changing society.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I've been reading the NY Times, Washington Post, Wall St. Journal, BBC and others for a long time now; most of what I see published isn't improving my mind, awareness, or store of useful knowledge. Some of it is flat out wrong.

As I became more and more educated on certain topics I noticed this more and more - articles about a field I know a lot about often get the details wrong, and draw the wrong conclusions because of it. I'm reasonably sure this isn't unique to my fields of expertise.

That has nothing to do with paid/free, but if someone is going to say I should pay them to provide me with knowledge, I'd like to be sure they actually possess said knowledge, consistently.

As it is, different papers are good for different things and almost completely untrustworthy for others. By virtue of a subscription, I subsidize both.

<comment><USER14> What you're saying appears quite related to the Murray Gell-Man effect, which if cashed out in reality calls into question the value of reading the news as a way to become informed.

[https://seekerblog.com/2006/01/31/the-murray-gell-mann- amnes...](https://seekerblog.com/2006/01/31/the-murray-gell-mann-amnesia- effect/)

</comment></comment><comment><USER15> This is a terrible article. It leads with social commentary about supposed healthy amounts of content, and then goes on to describe the shake-up at LA Times because the editor got pulled into the #metoo fiasco.

Harvey Weinstein arguably produced some of the best content in Hollywood during his tenure, and so the two shouldn't be coupled. Yea, fire the dude and move on, but don't make this about cheap content, and don't make this also about the press failing to generate revenue. All very different things and misses the nuance of what is going on.

</comment><comment><USER16> _"Enjoy content. Not too much. Mostly paid_

 _[...] if you actually want to learn, to improve your mind, to improve your awareness and understanding of the world, you have to shell out."_

The "paid" part seems awfully arbitrary. I went to a great exhibit the other night, where I got to see wonderful photography, for free. I just read a great biology paper published for free by the Royal Society on my way to work. And I am now listening to a fascinating NPR podcast, also downloaded for free.

I guess my taxes paid for all of those in some way (even though I only lived in the UK for a year, so that was a meager contribution to the Royal Society's coffers), but I wouldn't say I "shelled out" for all these things.

<comment><USER17> On a thread about a week ago another commenter also pointed out that some of the best content on the web is in (free) sites maintained by hobbyists, on some specialized topic or other, and that this content is more often than not difficult to find because it doesn't SEO well.

(Which should be a strong indicator that Google's SEO algorithm is wildly broken from a user's point of view. But at this point, Google, the de-facto search _and_ web advertisement monopoly, has no incentive to prioritize quality content, and every incentive to prioritize content that brings them ad revenue. Which garbage content, presented poorly, is great at doing.)

Some days I long for DMOZ…

</comment></comment><comment><USER18> _> The bulk of my friends don't pay for subscriptions. The bulk of the internet doesn't pay for subscriptions. People will gladly spend hours a day reading brainjunk, to avoid even the slightest expense that might improve the quality of what they are reading._

There are non-subscription models, e.g. people pay for ebooks.

There are niche subscriptions, e.g. finance, health, which cost much more than Netflix.

Some websites have occasional article gems, but there's no way to pay for a high quality, non-DRM, indexable, offline readable, surveillance-free PDF/A version.

<comment><USER19> Agree.

> There are non-subscription models, e.g. people pay for ebooks.

Another nice example is Blendle.

While there exist good reasons to pay for quality journalism there's no reason why I should pay a monthly subscription to every news outlet I ever want to read anything from.

</comment></comment><comment><USER20> It's not simply miserliness that makes people reluctant to pay for articles online. It's also because subscribing is so much work. If you could pay 50 cents for an article with a single button click, a lot of people would do it. But filling out a subscription form and getting out your credit card and typing in a 16 digit number off it just to read a single article (which is all one wants at the point one is being asked to subscribe) seems like way too much work.

<comment><USER21> And what is more, am I supposed to subscribe to all sites where I occasionally find valuable content?

One of the good things about internet journalism is that I can read different publications very easily, every day. Some of them I'd actually like to pay, but not by way of a subscription, because paying for five or ten subscriptions at ~$30 per month each is just too much.

With paper newspapers, I can at least buy a single issue. With online articles, it would be feasible to pay per article, heck, even per half articles or whatever. But for some reason all the publishers come up with is obnoxious paywalls, and the option to subscribe or get lost. I honestly don't understand why micropayments haven't become a thing for online journalism.

<comment><USER22> Is there potential for a news article broker to sit between the readers and the major news sites? For example you credit an account on a news broker then when younwant to read an article the article access fee is deducted from your account. That avoids readers needed to subscribe to many newspapers or magazines and would provide a more friction free way to access specific articles.

<comment><USER21> Yes, something like that would work. I guess the biggest problem is to get the major publishers as well as the readers to work with this broker.

Flattr had a similar problem, you could pay-per-article via their button, but as I understand the adoption just wasn't sufficient, by both publishers and readers.

Maybe if publishers could add a micropayment button that used ApplePay/GooglePay/AmazonPay/PayPal, so that readers wouldn't have to sign up for an additional service and could just use their credit card in a one-click transaction.

</comment></comment></comment></comment><comment><USER23> This is silly. There is a ton of high quality free content on the internet. What matters is taking the time and putting in the effort to ensure that you're consuming higher quality content. Even wikipedia is worthwhile as a basic introductory or survey level overview for lots of different subjects (it's hard to know what to dig into and study in depth in some area without having a general understanding first).

And there is absolutely a ton of excellent free material on youtube, of all places. Tons and tons of DIY and how-to videos. Woodworking, machining, electronics, knitting, sewing, cooking, the internet is a treasure trove of data. And some of the best educational content on linear algebra and calculus in the Universe at any price is on youtube for free (from 3blue1brown).

Overall this critique strikes me as generationalist and classist.

</comment><comment><USER24> Not sure if it was intentional, but Crichton here uses the same Pollan metaphor that Johnson makes in his book, The Information Diet. In fact the tagline is right on his site: [http://informationdiet.com/](http://informationdiet.com/)

I just got finished reading the Information Diet a couple weeks ago and was pretty disappointed in the book overall. Same with this article. Both seem to have a problem that I agree with: we should be more intentional about the information we consume. However, the "solution" in both isn't fully realized or it's tainted with an agenda of some sort.

I'm really ready for a good book on this topic as I raise my kids in the junk knowledge/misinformation age.

Anybody have any recommendations?

<comment><USER25> Are you looking for a solution, or more information? _The information: a theory, a flood_ by James Gleick is good. I read it because I'm in that line of work, but I think it's a good summary of _why_ content is produced and what the challenges are. You could also do something like _The shallows_ by Nicholas Carr, which is more of polemic than anything else, though I did enjoy it.

Perhaps _You are not a gadget_ by Jaron Lanier or _Hamlet's Blackberry_ by William Powers, but neither of those are books I could finish.

Finally, I read _Deep work_ not long ago and thought it was pretty good.

<comment><USER24> Definitely looking for a solution.

I actually loved Lanier's "You Are Not A Gadget", it was the first deep dive of technology philosophy that I've ever read, and was definitely worth finishing.

I'll definitely check out some of these other ones you mention. Thanks for the recommendations!

</comment></comment></comment><comment><USER26> TechCrunch has some good articles, and does good reporting sometimes, but there's some irony in this article coming from them.

<comment><USER27> I think they acknowledged this in the last couple sentences. The article is talking less about what is good or bad reporting, and more about what is a sustainable financial model for good reporting.

</comment></comment><comment><USER28> Echoing the sentiment that some of the best content is free is exactly why the only news app I have on my phone is for reading Hacker News.

I value the level of comments here just as much and sometimes more than the articles people share

</comment><comment><USER29> I'm as ok with the rot-inducing content as I am with junk food. I don't go near junk food and so stay slim with minimal effort (I'm just past middle age). I find muscle dysmorphia repugnant and so haven't gone too far in that direction either.

And so it is with content. I read quality books. James Clavell, Robert Ruark or Frederick Forsyth for example, over J. K. Rowling or E.L James, for instance. I source my news with care, and if a story interests me I look for counter positions or arguments.

We all have this choice.

One path makes you look stupid, and, in comparison, the other makes you look interesting, learned and intelligent. Amongst other benefits.

Like I said this is a choice we all make. Regardless of income (junk food is expensive, and libraries are free).

</comment><comment><USER30> TLDR: mainstream news media says to read more mainstream news media and pay for it.

</comment><comment><USER31> Well, this is what BAT is supposed to help fix.</comment>


The Pirate Bay should stop activities in Netherlands, court rules - <AUTHOR> http://www.monstersandcritics.com/news/europe/news/article_1492822.php/The_Pirate_Bay_should_stop_activities_in_Netherlands_court_rules_ <comment><USER2> Since torrent traffic doesn't pass through the Pirate Bay site, is it even possible for them to block traffic to the Netherlands?

It would seem far more plausible to put the onus on the ISPs in the Netherlands to block the traffic, though it would be blocking a lot of legal torrents as well.

<comment><AUTHOR> absolutely. This is a misguided judgement if there ever was one.

The simple fact that the pirate bay was summoned to the court in a country other than the one that they live in and were delivered their summons via email, twitter and facebook no less makes it a complete farce.

As if I have an obligation to appear in a swedish court if a judge there summons me... that's what we have extradition for.</comment></comment>


Airbus crypto challenge write-up - <AUTHOR> http://cryptologie.net/article/182/airbus-crypto-challenge-write-up/

<comment><USER2> This is a good writeup. If you're interested: the e=3 broadcast attack rounds out set 5 of our (unrelated) crypto challenges:

[http://cryptopals.com/sets/5/](http://cryptopals.com/sets/5/)

The e=3 broadcast attack is pretty unrealistic (I'm not sure we ever had to actually exploit it), but the stuff in set 6 comes up all the time, and breaks non-textbook realistic RSA.

I don't know why e=3 broadcast is so popular in entry-level crypto challenges, but this attack is also a CTF favorite.

<comment><AUTHOR> ummm, I read up somewhere that e=3 used to be used quite a lot to speed up computations.

<comment><USER2> e=3 isn't itself a vulnerability. Read the writeup more carefully. :)

</comment></comment></comment><comment><USER3> > The Chinese Remainder Theorem works in a similar fashion to Lagrange > Interpolation

They're not only similar---they're the same thing. Notice that f(a), for some polynomial f(x), is equivalent to f mod (x - a). Then Lagrange interpolation can be seen as recovering f from [f mod (x - a_0), f mod (x - a_1), ...], using the same mechanism---over a different ring---as the CRT. In fact, the CRT works over any ring that has unique factorization and well-behaved divisibility (i.e., greatest common divisors work as in the integers).

</comment><comment><USER4> > RSA Encrytion uses padding (usually OAEP)

Heh.</comment>


A.I can now tell you why your baby is crying - <AUTHOR> https://www.star2.com/family/2019/07/14/ai-understand-babies-crying/ <comment><USER2> Prior art: [https://youtu.be/oxIfYYEWVT0?t=90](https://youtu.be/oxIfYYEWVT0?t=90)</comment>


Knowledge Debt - <AUTHOR> http://amir.rachum.com/blog/2016/09/15/knowledge-debt/ <comment><USER2> I think the comparison to financial debt is leaky in the sense that a developer may ad infinitum cobble things around their ignorance, albeit not too performant or clean code, but there is no explicit accumulating interest. Yes, middle-school you was ostensibly wise to wait with learning about compilers but learning about the CPython interpreter may be wise to stave off even for the older-older you. That "ignorance" will not necessarily overtime have a negative effect on you and if so it's not an accumulation of debt, it's the exact opposite as you can invest the time on another thing with a better return on investment.

So, I appreciate the sentiment but calling it debt is a metaphorical misnomer.</comment>