Cantor function, a.k.a. devil's staircase - <AUTHOR> https://en.wikipedia.org/wiki/Cantor_function <comment><USER2> To be more precise, it has derivative zero _almost everywhere_ , so title is slightly misleading. To fully grasp this, the article links topics from measure theory.

<comment><USER3> To be clear, this is the measure/probability theory definition of almost everywhere, which means that while there are exceptions, it's true 100% of the time.

<comment><USER4> This is one of those things where a surprising fact isn't astounding, but just makes me think the definitions are badly chosen. After all -- of course if you pick definitions in weird ways, you get weird results.

In this case, yes, it is true almost-everywhere, meaning that there the set of points where it is untrue has measure 0. And yet intuitively the function is increasing and so we ought to define "having a derivative" in such a way that shows that it is increasing. All this definition has done is crammed all of the increasing-ness into points that are vanishingly rare, so you can't find them. But they still exist, per _my_ definition of increasing!

I would instead choose to define "having a derivative != 0" in a different way, that captures the idea that, over any interval I choose, the function changes. Nevermind that the function becomes constant as I zoom in to a point. All that shows is that evaluating at points must not be a great way of modeling this.

Of course I'm not sure if that works exactly. But this is the reason I can't get enthusiastic about analysis: it seems like a bunch of silly definitions with silly consequences, with little relation to the actual mathematics of our universe that I care about.

<comment><USER5> For most of my life I would have unthinkingly attacked any attacker of the traditional foundations of mathematics (including the standard definitions in Analysis, Measure Theory, etc). But after reading Michael Huemer's "Approaching Infinity"[1], I am now sympathetic with your skepticism.

A shockingly large amount of pure mathematics is asserted (with either no or little argument) as the best foundational groundwork for numbers, infinities, measures, etc. Digging a little deeper shows much of the dogma to be a dubious foundation for mathematics, leading to absurdities like Cantor's function (which 99.9% of math students marvel at, instead of more appropriately wondering "wait a minute -- maybe this means our foundations are messed up?").

[1] [https://www.amazon.com/Approahttps://www.amazon.com/Approach...](https://www.amazon.com/Approahttps://www.amazon.com/Approaching- Infinity-M-Huemer/dp/1137560851ching-Infinity-M-Huemer/dp/1137560851)

<comment><USER6> There are a couple constructions like this in mathematics that... really make you think. Like Banach Tarski doesn't make any sense.

Or the one that still bothers me, ten years after I learned it. Is take an enumeration of the rationals and take the union of balls of with radius epsilon/2^n over this enumeration. And you can create dense open subsets of the real numbers, that miss basically every real number. Despite containing an open interval around every rational. The conclusion I've come to is the real numbers don't make any sense.

<comment><USER3> > The conclusion I've come to is the real numbers don't make any sense.

Oh they definitely don't.

 _Almost all_ real numbers are uncomputable, which means they cannot be written down or communicated in any way.

</comment></comment></comment></comment></comment></comment><comment><USER7> Another fun one is the slippery devil's staircase, Minkowski's question-mark function. It's strictly increasing but the derivative is 0 at rational numbers.

[https://en.wikipedia.org/wiki/Minkowski%27s_question- mark_fu...](https://en.wikipedia.org/wiki/Minkowski%27s_question- mark_function)

</comment><comment><USER8> It's also fun to define the cantor function as the CDF of a distribution. The distribution has neither a pdf nor a pmf (it is singular)

[https://en.wikipedia.org/wiki/Cantor_distribution](https://en.wikipedia.org/wiki/Cantor_distribution)

</comment><comment><USER9> My favorite function is the Devil's Staircase found by plotting the map- winding number of a circle map, which has steps at every rational number: [https://en.wikipedia.org/wiki/Arnold_tongue](https://en.wikipedia.org/wiki/Arnold_tongue) .

<comment><AUTHOR> Thanks. I hadn't heard of Arnold tongue. That page has really nice illustrations.

</comment></comment><comment><USER10> Is there any practical application or real world implication of this? I'm having trouble understanding why this is interesting. I don't have much formal math background, so tying this to something non-abstract would be helpful to appreciate it.

<comment><AUTHOR> I posted it because someone mentioned measure theory and I remembered this example from a graduate course in real analysis. Cantor's function shows there are functions that are not the integrals of their derivatives. The Cantor function goes from 0 to 1, it's increasing and continuous, but it's derivative is 0 almost everywhere. Integrating the 0 function gives us back the 0 function so it's a kind of counter-example to the fundamental theorem of calculus.

> Georg Cantor (1884) introduced the Cantor function and mentioned that > Scheeffer pointed out that it was a counterexample to an extension of the > fundamental theorem of calculus claimed by Harnack.

I don't know if it has any real world applications other than as a reminder to be careful about assumptions and definitions. Most people think that increasing/monotone functions must have positive derivatives but the Cantor function shows this is not the case.

<comment><USER11> > Cantor's function shows there are functions that are not the integrals of > their derivatives.

That's because Cantor's function does not have a derivative that's defined everywhere. Of course a function without derivative is not the integral of that non-existent derivative.

If most people think that increasing/monotone functions must have positive derivatives, they're apparently forgetting about non-differentiable functions.

<comment><AUTHOR> The function is differentiable almost everywhere (this is a technical term from measure theory). Here's a pretty good explanation of its properties: [https://epicmath.org/2012/11/27/5-the-cantor-set-and-the- can...](https://epicmath.org/2012/11/27/5-the-cantor-set-and-the-cantor- function/).

> The Cantor function, also known as the Cantor Staircase, is a bizarre > function that is continuous and has a derivative of 0 at every point where > it is differentiable. In fact, it is differentiable at every point other > than on the Cantor set, which is a set of measure zero.

So from a measure theoretic perspective the derivative of the Cantor function is well defined and it is equal to 0 almost everywhere. Almost everywhere equality is an equivalence relation and the derivative of the Cantor function is in the same equivalence class as the 0 function.

<comment><USER11> > Almost everywhere equality is an equivalence relation and the derivative of > the Cantor function is in the same equivalence class as the 0 function.

And a function in that equivalence class will have an integral that is equal to a constant function on all intervals where that function is defined. If you also integrate over intervals where the function is only defined almost everywhere, all bets are off.

</comment></comment></comment></comment></comment><comment><USER12> Some reference is Exercise 84 (Cantor function) in Tao's lecture notes at [https://terrytao.wordpress.com/2010/10/16/245a-notes-5-diffe...](https://terrytao.wordpress.com/2010/10/16/245a-notes-5-differentiation- theorems/#more-4290)

The results before/after that result have other niceties: a one sided fundamental theorem of calculus for monotone functions (even though the Cantor function has 0 derivative!) or the fact that monotone functions can also be decomposed as the sum of continuous monotone function and a jump function such as Cantor's function.

</comment><comment><USER13> Nice. I'm reminded of the Weierstrass function, which is continuous everywhere but differentiable nowhere.

[https://en.wikipedia.org/wiki/Weierstrass_function](https://en.wikipedia.org/wiki/Weierstrass_function)

<comment><AUTHOR> Yup. It's one of the first counter-examples I learned about in undergrad analysis class. What's amazing about these things is that many extremely smart mathematicians at the time thought this was impossible, i.e. that continuous functions had to be at least differentiable somewhere.

</comment></comment><comment><USER14> See also: Weierstrass function [0], continuous everywhere but differentiable nowhere.

[0] [https://en.wikipedia.org/wiki/Weierstrass_function](https://en.wikipedia.org/wiki/Weierstrass_function)

</comment><comment><USER15> People should read Cantor's bio page too.

He was treated horrifically by the mathematics establishment. There is some justice in learning his history all these years later.

</comment><comment><USER16> This function is closely related to the cantor ternary set which is uncountable but has measure zero

[https://en.wikipedia.org/wiki/Cantor_set](https://en.wikipedia.org/wiki/Cantor_set)

This and other wacky analysis things is what inspired me to study pure math in undergrad.

<comment><USER17> Not just related—the staircase is built by, in essence, putting stairs on the ternary set. There's enough Cantor set to get from 0 to 1, but not enough to disturb the almost-everywhere vanishing of the derivative.</comment></comment>


Help Coinpunk Keep Bitcoin on the iPhone - <AUTHOR> http://www.indiegogo.com/projects/help-coinpunk-keep-bitcoin-on-the-iphone

<comment><USER2> > Apple is trying to block Bitcoin on the iPhone to anti-competitively prop up > their own crappy payments system, at the expense of hard working merchants > that want to accept Bitcoin at their stores.

Oh, FFS. No, Apple isn't blocking Bitcoin out of fear it'll supplant IAP. They're almost certainly concerned about regulatory issues if the Feds decide to go after Bitcoin.

<comment><USER3> Regulatory issues against bitcoin seems like a far less likley (and indirect) reason for Apple to remove Bitcoin apps from the App store over the them being afraid of competition with their own payment platform.

Just my ฿0.00002

<comment><USER4> The terms around IAP state that "content, functionality, and services" used in an app must be purchased using IAP.

Further, you may not complete a checkout process by linking to an external site.

Critically, if an app uses IAP to purchase goods or services to be used or consumed outside the app, it will be rejected.

Bottom line if you want to sell socks, sandwiches, or massages for USD in an app, you can, but your checkout process must be native.

Competition with IAP is not at issue here.

</comment></comment></comment><comment><USER5> I love Coinpunk, but don't care at all about Apple and their ecosystem. Maybe this is not the most effective way to ask for support.

<comment><AUTHOR> Thanks! We wish there were more people like you. :)

So, what is it about Coinpunk that you feel is most valuable?</comment></comment>


DEA agents conduct surprise searches of Amtrak passengers - <AUTHOR> https://theintercept.com/2019/08/31/dea-amtrak-passenger-search-albuquerque/ <comment><USER2> >It's legal for Perry to search people without probable cause, a warrant, or a dog because travelers supposedly realize that they have the right to decline to submit to his searches.

We need to extend the Miranda Warning to circumstances such as these. "You are not under arrest and you have the right to refuse a search. If you consent to a search, and something illegal is found, it can be admitted into evidence against you in court." If every interaction started with those words, you'd see a lot more people exercising their right to refuse.

<comment><USER3> Miranda warnings don't seem to help much in practice. Pretty much everyone who is given one waives their rights and speaks anyway.

<comment><USER4> Is that true?

<comment><USER5> The prevalence of advice videos from criminal defense attorneys advising citizens in contact with the police to simply shut their mouths would at least anecdotally support this statement.

<comment><USER6> Top-of-head thinking? Défense lawyers probably remember really well the cases that could have been a lot easier to win.

Just as doctors tend to prescribe what worked last time - easier to do what's at the top of your mind than critically appraise the evidence.

<comment><USER7> It goes deeper than anecdotal "I wish my client hadn't said anything", there are concrete reasons for this advice.

For example, according to rules of evidence, any exculpatory statements you make to police are hearsay and therefore cannot be mentioned in a trial. The police _can_, however, try to use that information against you and then use information derived from your original statement at trial.

There's a pretty popular lecture[0] on this. It covers a lot of edge cases and common arguments against "don't talk to the police".

[0]: [https://www.youtube.com/watch?v=d-7o9xYp7eE](https://www.youtube.com/watch?v=d-7o9xYp7eE)

</comment></comment></comment></comment></comment></comment><comment><USER8> Just say no. In fact these agents have no authority to force you to submit to a search without a warrant, probable cause or a dog. Most people either don't understand that, or fear the consequences. What can happen of course is intimidation and causing you to miss the train entirely. Papers, please, may be a stereotype but one agents like these heartily believe in.

<comment><USER9> The dog will alert on who they want it to alert on.

<comment><USER10> I've had the fuzz try "the dog" on me in the past. As a living creature the dog is rarely where they need it to be. Knowing my rights, and also knowing I'm not holding, I just repeat over and over again, "am I being detained. Am I free to go?" That usually clues them in I know the law just enough to cause them problems and they go away.

Typically the only probable cause they have is their own racist bias and once I point that out, a hit dog will holler.

<comment><USER11> I've always wondered how dog hits are seen by courts as different from officer testimony. Of course they're well trained and qualified and accurate, one would hope. But they can also get a subtle cue off the handler to simply sit because they've learned it's expected. So back in court, you're back to officer testimony that they did or didn't cue the dog to show a hit; it might even be subconscious. If that's the case, the dog isn't neutral and might as well be skipped as theater.

<comment><USER12> They're quite inaccurate in fact. They barely have a 50% ratio. [https://www.washingtonpost.com/news/the- watch/wp/2015/08/04/...](https://www.washingtonpost.com/news/the- watch/wp/2015/08/04/federal-appeals-court-drug-dog-thats-barely-more-accurate- than-a-coin-flip-is-good-enough/)

</comment></comment></comment></comment></comment><comment><USER13> Amtrak's a perfect representation of everything wrong with the US. A slow, unreliable train. Seems always delayed hours without being informed of why or how long. Receives almost $2 billion in federal subsidies. Bathrooms are dirty. And then you're pressured searched by a DEA agent whose already scanned the passenger logs looking for targets....

<comment><USER14> I took Amtrak regularly along the East Coast. Door-to-door was both faster and cheaper than flying, plus the experience was a lot more pleasant.

Less travelled routes have a chicken-and-egg problem: nobody uses them, so they're not a priority, so they get even worse. NYC to Montreal, for example, should be 2x as fast as it currently is....

<comment><USER15> They have Amtrak service along the west coast, and I've taken the Seattle to Eugene and Seattle to Vancouver trains. I was unimpressed, because the maximum speed is about 80 miles per hour, like most of I-5 (edit: I mean that's effectively how fast people drive, not the speed limit), and the fare is so high you could actually rent a car for a few days instead, especially if there's more than one of you traveling. (Seattle -> Eugene, a 4 hour trip, one way starts at $78 according to their website.) I've always suspected it was a critical mass thing, and if more people used the service the price might go down, but for a self-interested individual, it just doesn't make sense right now.

<comment><USER16> > I've always suspected it was a critical mass thing, and if more people used > the service the price might go down, but for a self-interested individual, > it just doesn't make sense right now.

personally I find traveling on amtrak to be a lovely experience. even on the NE regional I usually get a whole row to myself if it isn't a holiday weekend. of course, this is probably why it's so expensive. on the other hand if the ridership went up, it wouldn't be such a nice experience anymore.

<comment><USER15> Oh, don't get me wrong: I like trains in general, and I've got many fond memories of train adventures in Europe and Asia. Amtrak can be pleasant if you're just touring around. If you're looking for a serious mode of travel, though, the train system on the west coast is a joke. It's in a weird spot where if you care about money you can take a bus and if you care about convenience you can take a plane, but if you don't care about either...take Amtrak?

</comment></comment></comment></comment></comment><comment><USER17> I got fucked with by a plains clothes cop on an Amtrak once. He flashed a badge at me that I didn't even have time to read. Then he produced a bag and asked me if it was mine. It wasn't and I told him so.

He left.

He came back not 5 minutes more and claimed that it was my bag, basically insuating that I was lying. I told him again, this time rudely, that it was not my bag and to leave me and my wife alone. He looked pissed and left us alone.

Most people who travel Amtrak, especially the long hauls, don't have as much money as people flying. I'd like to see the DEA try these tactics with rich people and see how far they get.

<comment><USER16> > Most people who travel Amtrak, especially the long hauls, don't have as much > money as people flying.

why is this the case? I've only price shopped on the east coast, but I usually find that it's actually cheaper by plane than by train. sad because I am usually trying to justify taking the train.

<comment><USER18> I took the Amtrak California Zephyr from Reno, NV, to Ottumwa, IA a week ago - $118 coach seat or $936 for a roomette vs $547 flying - 39 hrs train time vs 24 hrs driving (which I do several times a year). Beautiful scenery and lots of time to think, write and program. No wifi but _git push origin master_ when I finally got online worked out just fine. "Most people ... don't have as much money as people flying" probably true for coach, but not at all true for the roomette cars. The dining car is where the two demographics meet.

<comment><USER16> I do have a thing for trains, but 39 hours in a coach seat sounds pretty rough regardless of the scenery. I can see why there would be a downward pressure on price for such a journey.

</comment></comment></comment></comment><comment><USER19> I don't know what motivates someone to be so psychopathically obsessed with invading other people's privacy, stealing their property, and even ruining their lives.

<comment><USER20> Catching criminals?

<comment><USER12> Then do that, with actual targeted investigations. This is just harassment and a fishing expedition.

<comment><USER20> In sales, it is known as "cold calling".

</comment></comment></comment></comment><comment><USER21> I recently took part of this route (DC to Chicago then Chicago all the way to LA) in December of 2018, the people were really fascinating. Lots of folks, especially older ones, who just didn't like taking flights and weren't up to driving cross country and then some who were train enthusiasts and just loved trains and then a few families. It's a real shame that they're doing searches like this, it sounds pretty sketchy.

</comment><comment><USER22> "An email uncovered in a federal drug trafficking case from last year showed that Greyhound tried to kick the DEA out of its Albuquerque station. [...] Greyhound declined to comment about the email or what has happened since."

Sounds like someone has been gagged by a National Security Letter.

</comment><comment><USER23> I would find this distressing to see as a tourist let alone a US citizen. Why not go the whole hog and have pre-boarding searches like airports?

<comment><USER24> Because travelling is increasingly becoming synonymous to being up to something?

This is what drives me mad. This is such a violation of every principle of good hospitality. By delegating responsibility for one's safety away from oneself to the responsibility of the purveyors (or overseers) of the mode of transportation, we all end up being treated as threats until proven otherwise.

It is such a tenuous balance. Excessive restriction of the conditions under which hospitality is granted leads to a breakdown of social reciprocity, intensification of in-group mentality, and alienation of the outsider. This stratifies and jeopardizes the ability of these myriad in-groups to coexist and transact peaceably, detracting from the possibility of maintaining any semblance of a national/international unity, or at least peaceful polity.

It's diplomacy, in essence, at smaller and more localized scales. Most societies have carveouts for providing for the need of the outsider, because tit-for-tat is such an easy state of affairs to end up in. Mind, the tit-for- tat part is implicit, not explicit, as most text on hospitality emphasizes the duty of the host to care without concern for [individual] reciprocity. Collectively speaking however, the way one culture recieves another does have an impact on overall relations between polities.

I just wish there was greater emphasis placed on this. I get it, lofty ideals tend to be the first to get binned, but sometimes the ideal is worth tolerating a greater degree of perceived immediate risk in order to facilitate a much larger payoff in terms of unity of action across non-emphasized in- groups.

Sometimes it's the difference between all travelers looking at and being suspicious of each other in transit, perpetuating macro-level conflict into every strata of everyday life, and a group of strangers coming together, and momentarily sharing the unique opportunity of traveling together, and being able to freely exchange in an environment of goodwill and camaraderie, and to be assured of unity of action through dissolution of fear at having to react to defuse violence on behalf of the traveling group.

Dissolution of macro-scale tension must begin at the bottom Of the social pyramid. Trying to work from the top down is a fool's errand.

<comment><USER25> Driving is largely unregulated, so I doubt this is about preventing travel.

<comment><USER26> Unless pigmented.

</comment></comment></comment></comment><comment><USER27> And that's how you make stealing legal. Perry is a thief, plain and simple, not to mention the many other derogatory terms that could describe this subhuman shitstain. He is the embodiment of the American idea of creating a problem where one doesn't exist and then "solving" it for profit. This is known as the war on drugs. It's extremely profitable not only in terms of money but also in terms of creating fear used for societal control, especially for controlling minorities. Ruining people's lives and society to make a buck. I hope it really does get dangerous for this scumbag. The world would be better off without him and all the rest of the people like him.

</comment><comment><USER28> The first time I traveled Amtrak, as a tourist in 2013, I was shocked to be asked for photo id just to buy my ticket. It seems a bit "Papers, please".

</comment><comment><USER29> Offtopic: What a strange layout this website has. No offense, Failed to make any sense to me.

</comment><comment><USER30> Interesting about one-way itineraries... I always wanted to go on a cross country train trip, the only time I've ever been on trains was at theme parks that just do a loop. No Wi-Fi though sounds a downer though. Maybe a time to read an ebook or edit vacation videos... My dream if ever making it big in tech is to retire early and travel full time, by train, cruise ship, by plane then buy an rv when ready to settle down some and slow down a bit with a house on wheels... Kinda interested in all styles of travel. So few years of traveling full time with just a suitcase and backpack, then buy my dream RV. Which be nice, be my own little apartment on wheels, can cook instead of eating out all the time, but still minimalism.

I think buying a big house, staying in the same area 98% of the year if lucky enough to even go on a vacation and collecting junk would be boring. I know some couples have so much junk, they argue about it and have cluttered houses. Then people load everything on credit, which if used responsibly and paid back monthly you get reward points, but some people just let it get to them. I rather have more experiences than collecting things, and the things I have should have a purpose. Then even if you pay off your house in full, you don't really own it. If the state decides to build a new highway or high speed rail, they'll just knock it down. At least with a RV or Tiny house on wheels you can move it. Someone with a $250,000 RV probably owns it more than someone living in a 5 million dollar mansion, yet they are more homeless than someone living in a $100,000 house.

So much to see and do, people dream about this all the time but money is a stopper sadly. There's a guy who owns his own business and decided to just cruise non stop, makes him happy and don't have much to take care of but he stays on the same ship about 6 months at a time booked back to back so he can have the same stateroom, I rather check out different ships and itineraries but everyone has different travel styles and wants. I know they have routes between Seattle and California, so maybe if booked 2 cruises with time to spare in between taking a train instead of a plane would be more scenic and a different experience, something to try at least once in a lifetime.

Also, I heard they cut the diner car out, and it's more airline type food now in an effort to save money. There's even a site called Amtrak Vacations too, so I figured one-way trips would be more common... People might fly and ride the train and fly back home or whatever next if they are a nomad.

It makes me sad people don't know their rights, even corporate media too... I seen recently a news story where they blur the video of the police, which I'm surprised since they are public officials. I feel like our founding fathers are tossing in their graves at what America is turning into, but I doubt any other country is much better anyways since some places are even worse.

I know officials get sworn in to uphold the constitution, but I don't think they even read it... Just raise their hand and repeat what they are told to be sworn in. Should quiz them on it.

Also surprised they don't search bags beforehand or tickets before getting on... I always figured it'd be similar to an airport. I know I heard a conductor goes seat to seat checking tickets at random, so seems a bit backward to me. I figured they would check everything before you board.

Then also traveling solo is a red flag too I heard which can get you sent to secondary, so if you aren't married or have a boyfriend or girlfriend that can slow you down... but I seen on the news solo travel is more popular than it is but I guess customs assumes a person is a drug smuggler, but I've heard it happens to woman more for some reason...

It seems like people who think for themselves and have alternative lifestyles such as digital nomads or even retired couples who RV get hassled more too, maybe due to stereotypes or profiling... Not a criminal, but just because you don't fit a profile you can be treated like one. Like I know in some states, nomads such as full-time RVers can't get a driver license or state ID unless they lie about living with someone else. Michigan is one I know of off the top of my head. So most people head to South Dakota and fill out an affidavit they are a full-time traveler, seems like that's making the state a bunch of money for catering to this niche. Seen a story about a couple who sold their house and got threatened by the Michigan DMV for not owning a house anymore because they used a mail forwarder. South Dakota and Texas allow mail forwarders. Florida does too depending on the county. One says if it's possible to live there even if don't park their full time, and not required to even lease a spot 365 days a year just possible to spend a night and it's good enough for them, so there's a campground that forwards mail and its allowed by the county. While another county, Clay County has interpreted something different and tried to take away voting rights recently. So If you live in a RV, boat or living out of a suitcase traveling you are basically a homeless person with money, so some states will discriminate against you. But then again by Michigan discriminating against them, they saved on taxes on their investment income by switching states so it ended up working out for them... I think maybe some states are tougher on residency requirements maybe because they have more social programs too, and you being a resident is a liability to them.</comment>


Ask HN: Request for Career Advice - <AUTHOR> I'm looking for advice on the fastest path to become a software engineer based on my experience so far. I appreciate any thoughts you can share. Thanks in advance!
Here is some background about me:
* I'm based in the Bay Area, but willing to relocate.
* I have a Bachelors degree (non-CS).
* I have ten years experience as a teacher and working in a non-tech role for a big tech company.
* I'm currently enrolled in an online CS degree program and will graduate in summer 2021. I'm thankful for this experience, but I don't think what I have learned in my degree so far is applicable to the day-to-day work of a software engineer.
* Outside of my CS degree, I've also spent time earning certifications from MOOCs, completing pre-coursework from multiple bootcamps, doing LeetCode problems, and learning how to build basic iOS apps.
For my next career step, there seems to be several options:
* Finish my degree and apply for junior roles.
* Put my degree on hold and get an internship.
* Put my degree on hold and apply for a bootcamp.
To be honest, I'm overwhelmed by all the different options and that has led me in many different directions over the past few years.
I'm hoping the HN community can advise me on what is the fastest path to get a paid technical position.
What do you think my next step should be? <comment> eigen-vector Are you still employed at said big company? Usually the fastest path for somone in your situation would be to slowly transition into a programming role in your company. Some companies even have a well defined system in place for such transitions.

Also, please don't use code blocks for text.

<comment><AUTHOR> Thanks for the quick reply and heads up on the code block. I'll try to fix it.

I'm a full-time student now, and not employed at the company anymore.</comment></comment>


C.E.O. Libraries Reveal Keys to Success - New York Times - <AUTHOR> http://www.nytimes.com/2007/07/21/business/21libraries.html?ex=1342670400&en=f19d91baf1d045e9&ei=5090&partner=rssuserland&emc=rss

<comment><USER2> "Knew when to stop, too--didn't cut the pages. But what do you want? What do you expect?"</comment>


Some unique aspects in US which make risks of COVID19 higher than Europe - <AUTHOR> https://threadreaderapp.com/thread/1232666666645016576.html <comment><USER2> This seems like it's missing the forrest for the trees. COVID19 is a strain of flu and like all flus, it affects the respiratory system. For this reason, COVID19's mortality rate is 2.8% among men in China, compared to 1.9% among women, which can at least partially be attributed to men smoking at a rate of >50% whereas women smoke at a rate of 2% in China. [1] I think that the thread's focus on the interplay between the healthcare system and the spread of COVID19, which imho is going to be lessened because of fears of the virus making people more likely to go to the hospital. On the other hand, The US overall has fewer smokers[2], which makes the effects of COVID19 less likely to be severe on those who do get it. Most cases are mild[3], so its more important to see where the severe cases will be, rather than cases overall

[1][https://www.nytimes.com/2020/02/20/health/coronavirus-men- wo...](https://www.nytimes.com/2020/02/20/health/coronavirus-men-women.html)

[2][http://worldpopulationreview.com/countries/smoking-rates- by-...](http://worldpopulationreview.com/countries/smoking-rates-by-country/)

[3][https://www.nytimes.com/2020/02/27/world/asia/coronavirus- tr...](https://www.nytimes.com/2020/02/27/world/asia/coronavirus-treament- recovery.html)

</comment><comment><USER3> Who is this person? As far as I can tell it's just some random person speculating. Is there a reason we should be taking them seriously? Because a lot of this seems like fear mongering.

<comment><USER4> Which points do you have issues with? I think they all seemed on 'on-base'.

<comment><USER5> By their own admission, they fail to quantify their findings. So, my issue is that they're sound bites that a lot of people were predisposed to agree with (eg "American healthcare is bad and expensive") and therefore unlikely to evaluate critically.

People have also argued the opposite: the US is special because we have large natural borders (mostly). Or maybe the US is special because the US has a large Chinese-American population, many of whom travel regularly.

Epidemiology is a science. Why listen to Twitter randos when you have specialists?

<comment> blaser-waffle Why listen to HN randos for that matter?

(Counterpoint: HN has a huge selection bias for educated, technical types and a higher overall pool of talent. Doesn't mean disinformation campaigns and marketing won't work on this crowd, though)

<comment><USER5> Sure! If the thread had been posted on HN I'd raise similar skepticism :)

</comment></comment></comment></comment></comment><comment><USER6> ok, but considering how many fewer people take public transportation in the US, and on average how less dense living conditions are it may be that the risks balance out.

Edit: I will also say that health care in the US is excellent for many people. I know it is an unpopular opinion but all I can say that most people I know (myself included) have access to excellent health care, included with the employer-sponsored plan, with all costs covered (I pay directly into a tax- free health saving plan and use that, for the first $5K costs, after which additional costs are covered).

</comment><comment><USER7> Beds per 1000 people:

USA: 2.9

Italy: 3.18

China: 4.36

Hong Kong: 5.4

South Korea: 12.27

Japan: 13.05

Source: [https://en.wikipedia.org/wiki/List_of_OECD_countries_by_hosp...](https://en.wikipedia.org/wiki/List_of_OECD_countries_by_hospital_beds)

</comment><comment><USER8> Horrible thought - given the nature of this disease (kills aged 50+, very infectious) and the demographic of US leadership on all sides... what impact might this have on the dynamics of US politics?

(edited to clarify)

<comment><USER9> The powers that be have access to healthcare the masses could only see in a glint of their eye.

<comment><USER10> There are no magic wands against this thing, at any price. It's too new.

<comment><USER9> No magic wands, but superior health care to stave off the symptoms presented. True it won't be 100% effective, but more effective than the masses.

</comment></comment></comment></comment><comment><USER11> I sent this email to my team last night. Feel free to steal it for your own workplaces.

 _We should consider working from home._

You may all have seen the news by now. A patient was just diagnosed with COVID-19 at UC Davis after having no known contact with anyone travelling. Importantly, they were diagnosed after being intubated already for 7 days. It is suspected that this is the first known case of public transmission of the virus in the US. From what we know about the incubation times and progression of the illness, that means they contracted it sometime between 14-21 days ago. This is the letter UC Davis sent to their staff.

If the virus has already been in the wild in California for 3 weeks, it seems likely to me that it has or will reach the bay area, and given the limited testing capability that has been reported, we may not know until the first cases end up in the ICU, weeks after exposure.

The death rate for young healthy people is relatively low, around 0.2%. It is much higher for older people, who it kills in double digit percentages. Still, 20% of the people it infects need intensive hospital care. Many epidemiologists now suspect that it is likely to become endemic, and that 40-70% of the world's population will contract it. [https://www.theatlantic.com/health/archive/2020/02/covid- vac...](https://www.theatlantic.com/health/archive/2020/02/covid- vaccine/607000/)

So what can we do?

The most important thing to keep the death rate low is to reduce the burden on the hospital system so that they don't end up with more cases needing critical care than they can handle. And the most important thing for reducing the burden on hospitals is to slow the spread of the virus, so that even if it ends up infecting all of us, it doesn't infect all of us at once.

We're fortunate enough that aside from impromptu collaboration and whiteboarding, all of our concrete tasks can be done at home. Most workers will not be in this situation, and will have to come to work to keep the economy running. For those of you familiar with random graph theory, the average number of edges in a graph has an exponential effect on its diameter, and so the best thing we can do is to avoid as much contact as we can. [https://www.ndsu.edu/pubweb/~novozhil/Teaching/767%20Data/ch...](https://www.ndsu.edu/pubweb/~novozhil/Teaching/767%20Data/chapter_3.pdf)

For people coming to the office, the WHO has a document on getting your workplace ready for COVID-19 that I'd encourage you to read and internalize. [https://www.who.int/docs/default- source/coronaviruse/getting...](https://www.who.int/docs/default- source/coronaviruse/getting-workplace-ready-for-covid-19.pdf)

I'm already conveniently WFH with a cold, which I hope is just a cold, but I think we should consider making this the norm, at least until we have more clarity on what the situation is.

<comment><USER12> I wonder why people/news seem so obsessed about the death rate itself, while ignoring the incidence of permanent organ tissue damage caused in survivors, as some papers already indicate. I'm assuming this has to be studied further.

<comment><USER13> Do you have any links for this? Otherwise you're injecting a lot of scary, unsubstantiated info here, implying the survivors are gonna envy the dead.

</comment></comment></comment><comment><USER14> I did not know about the screening for coronavirus being ineffective. A 35 y/o guy at work died from the flu a little over a week ago (Denver). If it was coronavirus, they'd know, wouldn't they?

<comment><USER3> It's not that screening is ineffective, it's that the initial kits sent out by the CDC were defective. That isn't true everywhere (places where patients have been evacuated to have testing capabilities, like California, Chicago, and Omaha), and samples can still be tested at the CDC, it just leads to a delay. It's not ideal but it isn't like testing simply isn't working.

As for the man in Denver, it would be very unlikely to be COVID. There is some evidence starting to emerge currently of transmission now occurring in the US, but it's still very early and concentrated to where you might expect. It takes a while for coronavirus to kill (about 7-14 days after symptoms appear), and so if this dude was sick with it, he would almost certainly have to have had either traveled out of the country (to China), or been close with someone who had. That is something any competent medical staff will ask, and if it were the case, they could send samples to be tested to the CDC.

It may be possible moving forward that if community transmission starts spreading here in the US, things could start slipping through the cracks, but at this point it's highly unlikely that anyone in Colorado who died a week ago was sick with COVID

</comment></comment><comment><USER15> It will be interesting to see how elastic the supply of healthcare services is in the US versus the social systems if a pandemic does break out. History has shown that when mobilized for a common cause, the US is a force even when compared to socialist and authoritarian states. Thunder God Mountain may not have been possible in the US, but in the worst case scenario, it will interesting to see what is possible in the US.

<comment><USER16> > Thunder God Mountain may not have been possible in the US

What would you say would be the biggest impediment here? I would think actually that just government regulation in and of itself would prevent any private company from achieving this feat. And even Federal and State governments are similarly encumbered by regulation.

<comment><USER15> It seems like the US government isn't structured to deploy such resources so quickly (e.g., FEMA's responses to Katrina, Sandy, etc.) and regulation would seem to kill private efforts. Maybe a state or local government could pull it off with accommodation from federal regulators.

<comment><USER17> In the US, private industry is broadly empowered to say "No" or "I'll see you in court" to government demands, to a larger degree than many other countries.

The side effect of empowering private industry is that organizations like FEMA and the CDC can't _force_ much, and typically advise or request.

Which doesn't get things done nearly as efficiently when it's a situation where proposed actions are detrimental to one corporation, even if good for the nation.

<comment><USER16> What do you think the US government would have to demand from private industry to do build in the time frame that Thunder God Mountain was built?

</comment></comment></comment></comment></comment><comment><USER18> Considering most of this is common knowledge and was largely discussed elsewhere recently, it's still shocking to see how normalized is USA's dystopian existence. It's like COVID19 is the least of their problems considering what's considered "normal".

</comment><comment><USER19> What about spare capacity that US medical system possess as opposed to say neighboring Canada? Otherwise, all points are valid.

<comment><USER20> They're actually worse off (ranked 36th vs. US' 32nd)

[https://en.wikipedia.org/wiki/List_of_OECD_countries_by_hosp...](https://en.wikipedia.org/wiki/List_of_OECD_countries_by_hospital_beds)

Here are the full stats:

[https://stats.oecd.org/index.aspx?queryid=30183](https://stats.oecd.org/index.aspx?queryid=30183)

<comment><USER21> I think you're agreeing with GP? Who's saying that the US has more spare capacity than Canada.

But also, #beds per capita isn't the same as spare capacity.

<comment><USER20> They edited their comment. It was a more general question of comparable rates before.

</comment></comment></comment></comment><comment><USER22> Is Trump setting Pence up as the fall-guy?

<comment><USER23> If you work for or with Trump you are, by definition, a potential fall-guy. Trump is never culpable, again by definition...

</comment></comment><comment><USER24> This is what happens when you totally ignore that healthcare is a public issue that needs to be addressed publicly.

One cannot be pro-vaccination and anti-public-healthcare, for example, for reasons extremely analogous to the argument made in the twitter thread.</comment>


Google Adwords: the reality - <AUTHOR> http://mybizexperiment.blogspot.com/2007/09/google-adwords-results-after-one-month.html

<comment><USER2> $50 is not enough to even begin to know what you're doing with Adwords. Read "Winning Results with Google AdWords" by Andrew Goodman and put it to work with a reasonable budget.</comment>


LIFE photo archive hosted by Google (millions of photos from the LIFE archive, 1750s to today) - <AUTHOR> http://images.google.com/hosted/life

<comment><USER2> I like this one. In the immediate JFK aftermath in Dealey Plaza with what appears to be someone filming ... Zapruder? ( <http://en.wikipedia.org/wiki/Zapruder_film> ) ~ [http://images.google.com/hosted/life/l?imgurl=63197f2608eaa0...](http://images.google.com/hosted/life/l?imgurl=63197f2608eaa0f8&q=Kennedy+assasination+source:life&usg=__- aK1hZgWSIh1j7MVbXIXxOthpHw=&prev=/images%3Fq%3DKennedy%2Bassasination%2Bsource:life%26start%3D20%26ndsp%3D20%26hl%3Den%26sa%3DN)

<comment><AUTHOR> Amazing picture.

That's The Grassy Knoll: <http://en.wikipedia.org/wiki/Image:Grassy_Knoll_2003.jpg>

</comment></comment><comment><USER3> Photos from 1750, are you really sure?

<comment><USER4> Take a look at these photos, they are from 1750s [http://images.google.com/images?q=1750s&q=source%3Alife](http://images.google.com/images?q=1750s&q=source%3Alife)

<comment><USER3> Those are not photographs. "Le pittore antiche" means "Antique pictures" (not photography) and not even litography was invented before the 19th century.

</comment></comment></comment><comment><USER5> I found this Time magazine cover from 2002 particularly interesting: <http://bit.ly/17CJf>

Apple and Jobs have changed a lot since then :-p.

For an even more extreme change, see: <http://bit.ly/13h9T>

</comment><comment><USER6> A lot of these overlap with <http://gettyimages.com> (Editorial photos).

</comment><comment><USER7> This GRUESOME photo SICKENS me ... how as human beings could we treat one another this way ... again this is GRUESOME

[http://images.google.com/hosted/life/l?q=1860s+US+Civil+War+...](http://images.google.com/hosted/life/l?q=1860s+US+Civil+War+source:life&imgurl=1f9d93111ab69256)</comment>


A Twitter app bug was used to match 17M phone numbers to user accounts - <AUTHOR> https://techcrunch.com/2019/12/24/twitter-android-bug-phone-numbers/ <comment><USER2> Very relevant: [https://news.ycombinator.com/item?id=21747424](https://news.ycombinator.com/item?id=21747424)

Can this be an API leak which Chinese MSS used to track Chinese users?

It may well as be if we believe that API wasn't implementing discoverability restrictions from privacy settings, and only hid users on the UI level.

> Basically Twitter got pwned big time, and now denies it because GDPR will > ruin them if breach is proven. Here is what Doubi's online followers > figured:

> State security got all phone numbers used for Twitter phone verification up > to May 2019 and possibly till July.

> Twitter haphazardly closed the breach in complete secrecy.

> API hole explanation is excluded as people with 100% private accs got police > visits.

> People with foreign SIM cards also got into trouble. So the explanation that > China compromised Twitter's SMS providers is also excluded, as its > improbable that they did it in 4+ countries.

> 2016 breach is also out of question.

> The only explanation is that they got hold on a big piece of their user DB, > or, worse, they have an active infiltrator in Twitter, or Twitter > voluntarily cooperated.

<comment><USER3> > _they have an active infiltrator in Twitter_

If I was China, I'd go for this. Twitter has thousands of employees, many of which can surely be turned with some pressure. Also many who has family in China that can be used for leverage.

<comment><USER4> I'd have to imagine this is very common, and they've probably got one at all the big tech companies. It's an underreported threat IMO. Who would say no to doubling their salary in exchange for running the occasional DB query for their home country?

<comment><USER5> At a public company like Twitter, for SOX compliance reasons, it will be very difficult to find someone that has such permissions, and running anything unusual can be easily found by auditing. I'd stop with the conspiracy theories.

<comment><USER6> [https://www.washingtonpost.com/national-security/former- twit...](https://www.washingtonpost.com/national-security/former-twitter- employees-charged-with-spying-for-saudi-arabia-by-digging-into-the-accounts- of-kingdom-critics/2019/11/06/2e9593da-00a0-11ea-8bab-0fc209e065a8_story.html)

In general, most companies want to scope SOX as narrowly as possible. So if you can, only things that your auditors think will affect revenue reporting.

Querying ads performance data? Sure, we'll SOXify it. Querying user accounts writ large? "Meh, our engineers need to be productive."

</comment></comment></comment></comment></comment><comment><USER7> > Over a two-month period, Balic said he matched records from users in Israel, > Turkey, Iran, Greece, Armenia, France and Germany, he said, but stopped > after Twitter blocked the effort on December 20.

Sounds like the other thing Balic discovered (not explicitly published here) is the rate limit below which Twitter's anomaly detection will not notice that you are using an interesting API endpoint.

> While he did not alert Twitter to the vulnerability, he took many of the > phone numbers of high-profile Twitter users — including politicians and > officials — to a WhatsApp group in an effort to warn users directly.

Uh. I wonder how that went over?

</comment><comment><USER8> It sounds like he spent two months extracting data through a flaw that's existed for years and then bragged about it after it got closed to his egregious usage.

Is this considered normal or ethical behavior for a security researcher?

<comment><USER9> They literally ruined it for everyone else for the publicity. Typical of PR obsessed white hat script kiddies.

<comment><USER10> What was ruined? And who ruined it?

<comment><USER11> Access to what had until then been an 0day.

Ibrahim Balic "ruined" it, though public bragging (which is _not_ responsible disclosure).

<comment><USER10> Ruining access to a 0day sounds like a good thing to me. I don't want people to have access to 0days.

Some people dislike the term "responsible disclosure" and believe it's not a moral imperative:

[https://hn.algolia.com/?query=author:tptacek%20responsible%2...](https://hn.algolia.com/?query=author:tptacek%20responsible%20disclosure&sort=byDate&prefix&page=0&dateRange=all&type=comment)

Of course what Ibrahim did wasn't full disclosure either, so he shouldn't be fully congratulated. But bragging about it was better than keeping silent about it in this case.

</comment></comment></comment></comment></comment><comment><USER12> This is a "feature", not a bug. Twitter keeps asking for phone numbers all the time and then suggests you also allow others to discover your account via phone number.

So this guy merely enumerated a lot of phone numbers and found accounts of users who agreed to have their phone number publicly match their account.

<comment><USER13> Yeah. Not long ago I thought I can finally try Twitter, but 20 minutes in (just enough time to follow a couple of people and to start getting familiar with the UI) I found UI to be totally blocked by the demand I submit my phone or else. Naturally, I figured I don't need Twitter _that_ much.

So to call a feature nobody asked for which they went a long way to introduce a "bug"... yeah.

<comment><USER14> Same thing happened to me when I just wanted to sign up to follow some esports organizations. It says a phone number is optional during signup, then a few minutes after I create my account it becomes locked and I get an automated message saying that I'm suspected of being a bot, and the only way to unlock it is by giving them my phone number.

</comment></comment></comment><comment><USER15> The worst part about this is that twitter _requires_ you to add a phone number. Why?? That's very privacy hostile, since a phone number is very personal and identifiable.

And it's like a bait and switch. They don't require it at sign up, but within a short time they'll lock your account until you add it.

<comment><USER16> a dark pattern because while it's not actually required it might as well be, their 'account locked' email conveniently leaves out that you can simply email them and have them re-enable the account without a phone number.

that email for the curious:

 _Hello,

Your account appears to have exhibited automated behavior that violates the Twitter Rules: [https://support.twitter.com/articles/18311](https://support.twitter.com/articles/18311).

In order to continue safely using Twitter, please follow these steps:

1\. Log in to your account on the web or open your Twitter app (iOS or Android). 2\. You'll see a prompt letting you know your account has been locked. Click or tap "Start". 3\. Select your country/region from the drop down menu, and then enter your phone number. 4\. Click "Send code" and Twitter will send you a text message with a confirmation code (note that your standard message rates may apply). 5\. Enter the code you received in the "Your code" box and click "Submit". 6\. You will see a confirmation message that your account is now unlocked.

Once you confirm your identity, it may take up to a few minutes for your account to be unlocked.

If you're still experiencing an issue after confirming your identity, please reply to this message and provide us with specific details of the problem you're experiencing. We'll do our best to help!

Thanks,

Twitter Support_

If you reply to this saying you don't have a phone they will re-enable your account but there's no mention of that or "click here to verify account" option.

<comment><USER17> Yeah, I gotta try that sometime.

</comment></comment></comment><comment><USER18> Doesn't really have anything to do with the Android app. He was using an api endpoint that anyone could hit.

Step #1, turn two factor authentication on

Step #2, have your phone number leaked because of a dumb feature.

<comment><USER19> I think these days, Twitter will suspend your account immediately after sing- up, for "suspicious activity", and require a phone number to re-enable it.

<comment><USER20> At this point it has to be on purpose, right? There is no way that Twitter has just overlooked this closing of accounts "for suspicious activity" for years right when the account is created.

<comment><USER21> I made one a week or two ago, followed some people, made a few tweets, and wasn't asked for a phone number. I wasn't even asked for a CAPTCHA.

I deleted the account a few days later because Twitter is dull and the entire point of what I was trying to do was see if the rumors of immediate account flagging were true. They don't seem to be.

<comment><USER22> I made one a few months ago and it immediately did the suspicious activity provide phone number b.s.

I've not tried again since, and considered twitter 100% off-limits after that experience since it's obviously just an effort to acquire phone numbers coupled to accounts and email addresses under the guise of "security".

<comment><USER23> thanks. I registered an account lately and wondered why this happened. thanks for clarification.

</comment></comment></comment></comment></comment></comment><comment><USER24> I recently started to use the "neo-banks" (fintech apps that may or may not be actual banks, mostly for payments). All of them offer an app and APIs and ways to discover which contacts use the same app via their phone number.

Immediately following this I received highly targeted phishing sms messages that included links to plausible looking login pages.

Perhaps this shouldn't be too surprising, but people will get burned and somebody will have to pay for it.

</comment><comment><USER25> I think it was irresponsible to keep collecting more phone numbers, and I think he should've let Twitter handle informing users of this vulnerability. Had he used responsible disclosure, he could have claimed a nice bug bounty (between $280 and $2,940, according to [0]).

      [0]: https://hackerone.com/twitter

<comment><USER26> I'm always curious why these bug bounty programs for billion dollar companies pay so little.

Why not make this a 10K, 25K bounty even if it's small potatoes?

That amount is nothing to Twitter but might prevent what happened in this case (continued collection of data, public release before Twitter could notify users, etc).

I've noticed this trend of painfully cheap bounties at most other tech giants too.

<comment><USER27> Katie Moussouris has spoken a lot about this. The incentives are pretty complex.

[https://www.computerweekly.com/news/252450337/Bug- bounties-n...](https://www.computerweekly.com/news/252450337/Bug-bounties-not- a-silver-bullet-Katie-Moussouris-warns)

[https://www.zdnet.com/article/relying-on-bug-bounties-not- ap...](https://www.zdnet.com/article/relying-on-bug-bounties-not-appropriate- risk-management-katie-moussouris/)

[https://threatpost.com/newsmaker-interview-katie- moussouris-...](https://threatpost.com/newsmaker-interview-katie-moussouris- on-improving-bug-bounty-programs/139488/)

<comment> munk-a I mean, there is a mix here, some genuine notes about how high bounties can cause coordinated breaches to farm income but also notes about how bounties shouldn't replace pen testing (I agree, but have both and don't, as a pen tester, just argue that more money should go to pen testing, it's way too self-serving) and a weird comment that having a low bounty and then overpaying for a return of privileged data if the compromise could expose that data is a bad idea because it encourages bad actors - if the bounty is 3k and the data is worth 30 mil then yea, bad actors will emerge because you're criminally underpaying for exploits.

Honestly, a lot of the reasons I'm seeing for lowering the payout of bounties seems to revolve around "It's too expensive"

<comment><USER27> More reasons [https://twitter.com/k8em0/status/1078798252151992320](https://twitter.com/k8em0/status/1078798252151992320) Almost any amount of money allocated to bug bounties would be more efficiently spent developing in-house talent.

<comment><USER28> Which serves the argument that instead of rewarding people for sharing vulnerabilities we should be punishing companies for having them. Harshly. The more data points a company tracks the faster the fine should approach 100% entire company market cap. Their subsidiaries, parent company's, board, and executives should also not be immune but rather personally liable for egregious cases of not knowing, failing to, or cutting corners around documented best practices, security patching, hardware rotation etc. The entire industry needs to be reworked to put security and make All pii hazardous.

Sadly software is going the way of construction. Things Will only change when tptb get inordinately effected.

</comment></comment></comment></comment></comment></comment><comment><USER29> When sites collect phone numbers to "find friends", there is always a chance that they will be leaked. And even worse, someone having enough resources will check all existing phone numbers and get a mapping between numbers and accounts.

This reminds me of a story posted on Russian site [1], where researchers managed to bypass Instagram's protection and find accounts by phone number. Sadly, I cannot confirm described method because their site requires a Google Account to find Instagram account by phone number. But if it's true it shows that even Facebook and thousands of its engineers cannot protect their users' data.

[1] [https://translate.google.com/translate?sl=ru&tl=en&u=https%3...](https://translate.google.com/translate?sl=ru&tl=en&u=https%3A%2F%2Fhabr.com%2Fru%2Fcompany%2Fpostuf%2Fblog%2F479094%2F)

<comment><USER30> When you have a typical "find friends" feature, there is no way to secure it. Each friend can lookup a large address book of 1000 users, then very quickly the whole valid phone number space can be searched.

</comment></comment><comment><USER31> " he took many of the phone numbers of high-profile Twitter users — including politicians and officials — to a WhatsApp group in an effort to warn users directly"

What on earth does this actually mean? And why does he still have a verified Twitter account or an account at all when he exploited it for 2 months without informing them?

<comment><USER32> I'm pretty sure it means, he made a WhatsApp group, and added/invited those high-profile people to warn them

</comment></comment><comment><USER33> This must be the "Account Security Issue" Twitter e-mailed me about last week. I was wondering when they'd release more details: [https://i.imgur.com/yjzMtLB.png](https://i.imgur.com/yjzMtLB.png)

Transcription:

"SUBJECT: Twitter Account Security Issue – Update Twitter for Android

Hello,

We recently fixed an issue that could have compromised your account. Although we don't have evidence that this was exploited, we can't completely confirm so we are letting you know. You can learn more about this issue here.

Please update to the latest version of Twitter for Android as soon as possible to make sure your account is secure.

We're sorry this happened and will continue working to keep your information secure on Twitter. You can reach out to our Office of Data Protection through this form to request information regarding your account security.

Thanks, Twitter"

Edit: err, no, this appears to be something different still. Not a good week for Twitter: [https://news.ycombinator.com/item?id=21847198](https://news.ycombinator.com/item?id=21847198)

</comment><comment><USER34> I see stuff like this and I keep wondering whether it is a bug or an undocumented feature.

</comment><comment><USER35> Similar bug was used maliciously by HK Police for identifying Telegram users. Telegram now has an option for identification by number.

</comment><comment><USER36> Very cool, also you can't use MFA authentication on Twitter without giving them your phone number.

<comment><USER37> > you can't use MFA authentication on Twitter without giving them your phone > number.

GitHub also require MFA authentication since this year.

Does it mean that any MFA authentication now has same leaks?

<comment><USER38> No. But you should be concerned if you choose to give your phone number to people, because if they know it they might leak it through any combination of malice or incompetence.

Other than my banks, none of the systems I've enabled MFA for required a telephone number.

That includes: Dropbox, GitHub, Slack, Facebook, Nintendo, Google, Login.gov and the Digidentity.eu variant of Gov.uk Verify.

Everywhere it was possible I used my FIDO Security Keys which are phishing proof, impractical to de-anonymise and foolproof because the site has no secrets to leak. Whenever I hear that a site I already used MFA for gained WebAuthn or U2F I go back and switch that site to Security Keys.

Everywhere else I used TOTP (Google Authenticator) which can be phished using a live proxy and the site could leak their copy of your TOTP secret (not the changing code, but the secret that drives it) but other than those two concerns it's pretty safe. At least nobody can work out your real world identity by knowing your TOTP secrets.

</comment></comment></comment><comment><USER39> So this is a different bug than the one Twitter cryptically e-mailed users about. Cool cool

</comment><comment><USER40> Cannot read it. I get lost in some "respect your privacy" nonsense.

</comment><comment><USER41> When a website asks for a phone number i treat it as "please provide a DNA sample and birth certificate in triplicate" and close the tab. Its ridiculous to what ends consumers will go and accept as "privacy compromises". Hopefully GDPR will make these practices costly enough.

</comment><comment><USER42> Did they report this breach as required by GDPR rules in the EUR? I can't imagine the GDPR rules don't reply to an American company when they are active in the EU? Especially, if they have (do they?) a branch in EU like for ads revenue or royalties to lessen the tax pay in Ireland or The Netherlands like Uber</comment>


Lawns Are an Ecological Disaster - <AUTHOR> https://earther.gizmodo.com/lawns-are-an-ecological-disaster-1826070720 <comment><USER2> Thank you for posting this (and for the author writing it).

It is unbelievable how little attention is paid to the environment cost of lawns in developed nations.

Just the fresh water consumption by these unnatural 'fashion' monsters is scary:

>"... It gets better. All America's farmland consumes 88.5 million acre feet of water a year. Lawns, with a fraction of the land, drink an estimated two- thirds as much. Most municipalities use 30-60 percent of drinkable water on lawns.

California is special. If you thought Trump tweets made no sense, LA, prior to the big drought, 70 percent of your water loss came courtesy of lawns. Water use throughout California seems to be rebounding to pre-drought levels. Lawns are soaked once more. ..."</comment>


$1,279-per-hour, 30,000-core cluster built on Amazon EC2 cloud - <AUTHOR> http://arstechnica.com/business/news/2011/09/30000-core-cluster-built-on-amazon-ec2-cloud.ars <comment><USER2> I wonder what kind of 'bad activity' detection Amazon does, if any? Did they have to call Amazon ahead of time, just to warn them they were about to boot up "3,809" instances? If I tried to do that, would Amazon prevent it?

The reason I ask... how hard would it be to boot up, say 10,000 micro- instances (using a stolen credit card or AWS account) to be used for a DDOS? What do you have to do before red lights start appearing in the AWS NOC?

<comment><USER3> Amazon limits you to 100 Spot instances per region without contacting them to change the limit for your account.

[http://aws.amazon.com/ec2/faqs/#How_many_instances_can_I_run...](http://aws.amazon.com/ec2/faqs/#How_many_instances_can_I_run_in_Amazon_EC2)

<comment><USER4> That wouldn't prevent someone from creating multiple accounts with stolen credit cards though, right? num_accounts * 100 = DDOS.

<comment><USER2> That wouldn't prevent it but it would make it much more difficult. Although, I suppose you could automate the whole thing, right from the stealing of the credentials to the booting up of 100 new instances and adding them to the ddos cloud. I wonder if this has ever been done, or if the number of AWS users is just too low to make it worthwhile (like the old argument of why macs don't have viruses)?

</comment></comment></comment></comment><comment><USER5> This is an interesting result, customer pays slightly less than a million/month (1279 x 24 x 30 = 920880) to run such a cluster. Using a 'Westmere' class processor (2 procs/mobo 6 cores per proc) that is 2500 machines, at 400W per its a MW of electricity (call it 111K$/month with a .15/kWH cost(includes cooling)). It would be interesting to price out the other costs for the machines to understand what sort of revenue that would be.

I wondered about spreading it out around the country through, seems like you would incur a lot of latency which might become a bottleneck.

<comment><USER6> The advantage of an AWS cluster is that you can shut it down when you don't need it, whereas your own cluster needs to be running all the time to justify its comparative cost.

<comment><USER5> Aye, I agree with that whole heartedly. Its the whole timeshare market I wonder about. Basically if there is a market for this 'size' cluster for about $1,300 an hour could you build one of these and rent it out like Amazon does but more efficiently. (Sort of can you cut costs by specializing into a particularly lucrative segment of the market).

So if 100% 'occupancy' on your cluster is worth a million a month, and your cost of 'owning' a cluster of this scale is a quarter million a month, then you need to do better than 25% occupancy to break even, and anything better than that and you make money. It is an interesting financial exercise if nothing else.

<comment><USER7> The company I work for, R Systems (<http://www.rsystemsinc.com/>), basically does this. We own and admin several medium-sized compute clusters (200-500 node clusters) which are rented out to customers who need a lot of compute on a temporary basis.

A lot of what we do is heavily custom, and we provide a lot of support for our customers, but we still typically beat Amazon on both price and performance. EC2 might work nicely for embarrassingly parallel workloads, but they don't have Infiniband available if you're latency-bound... :)

</comment></comment></comment></comment><comment><USER8> Amazon's EC2 technology is quite amazing (to me anyway). We've been using their CloudFormation service. This has allowed us to create our entire server environment (rails/php, mysql, mongo, load balancer, route53, security groups, alarms, etc.) for different stacks (sandboxes, staging, production) with a few clicks.

"Cycle combines several technologies to ease the process" - Did that include Amazons CloudFormation services?

<comment><USER9> I doubt it, since CFN (CloudFormatioN) doesn't support spot instances yet.

</comment></comment><comment><USER10> Chances are that this pharmaceutic company's "embarrassingly parallel" workload could be ported to GPUs to run on anywhere from 1/10th to 1/100th the number of machines.

Porting the application to GPUs may offer a good ROI if the company intends to run this workload often enough.

<comment><USER11> Depends on how memory/storage intensive the tasks where: "26.7TB of RAM and 2PB (petabytes) of disk space. "

One advantage of going with Amazon, is their really high-speed and voluminous ephemeral storage available per instance in addition to your EBS backed root volume.

<comment><USER10> They sounded completely CPU-bound from the blog post. They went with "high- CPU" c1.xlarge instances that had modest RAM and storage specs. They gave no details and expressed no concerns whatsoever about RAM or storage bottlenecks.

[http://blog.cyclecomputing.com/2011/09/new-cyclecloud- cluste...](http://blog.cyclecomputing.com/2011/09/new-cyclecloud-cluster-is-a- triple-threat-30000-cores-massive-spot-instances-grill-chef-monitoring-g.html)

<comment><USER11> One way to find out - I posted a comment on that blog. We'll see if we get an answer.

</comment></comment></comment></comment><comment><USER12> If they have the headroom to spin up 30,000 cores I wonder what their total headroom is in each availability zone - and what %age that is of their total cores.

Sure, we'll never know - but it's an interesting thought experiment.

</comment><comment><USER13> What I find more amazing than anything else is that Amazon apparently has 30,000 spare cores that one can ask for when needed.

<comment><USER14> Probably not spare, probably just running spot instances at a lower bid price. You would assume that these guys paid a little bit of a premium to jump over everyone else.

</comment></comment><comment><USER15> I worked on a small scale cluster at a pharma company 6 years ago. The scientists goal was to discover new compounds to patent without having to do the screening by hand. The cluster would screen thousands of compounds simultaneously all day long. It was very interesting work.

</comment><comment><USER4> I'd be curious to see how much $$$ in terms of developer hours it took to set this up.

<comment><USER16> I know the guys who did it. It took an enormous amount of hard-won experience from similar but somewhat smaller spinups; experience that would be very expensive to replicate with a fresh team. Given that experience, however, it took them relatively few developer-hours to accomplish.

</comment></comment><comment><USER17> I find this extremely interesting. Does anyone have any experience or strong interest in this sort of work? I am looking to one day use many cores like this, although at a smaller scale.

</comment><comment><USER18> So when your latency goes from 150ms to 300ms, you'll know who to blame.</comment>


Ask HN: What are good computer science papers for fierce debate? - <AUTHOR> There are countless lists of top computer science papers. Such papers typically describe an elegant solution with clarity. However, they settle the problem so well that they do not lend themselves to fierce discussion and debate.
What are good computer science papers that do spark discussion and debate?
I am thinking about the way that a novel, poem or short story can inspire discussion about its many themes and interpretations. What computer science papers might inspire similar reactions among hackers? Ideally, I'm looking for real computer science papers rather than, say, blog posts which take a controversial stand on hot-button issues. <comment><USER2> What kind of fierce debate are you looking for? Without having read any of these papers myself ...

I suspect Turing's Test is a topic that lends itself to philosophical debate and is accessible to non experts.

With most modern papers the most likely source of debate is their assumptions and methodology. For instance, you can probably read any number of machine learning papers which follow the format of (data set -> result on that set) and critique their methodology. (Basically, for this category of debate, if you're not finding problems you're not thinking hard enough.)

I don't know what people write about in the fields of HCI, VR and AR but there's probably lots of stuff to debate about their assumptions there.

Or you could go for the bitcoin paper which is at a unique intersection of CS, economics and game theory. There's shockingly little intelligent writing on this topic.

</comment><comment><USER3> Sorry it's a blog: [https://stackoverflow.blog/2017/06/15/developers-use- spaces-...](https://stackoverflow.blog/2017/06/15/developers-use-spaces-make- money-use-tabs/)</comment>


Invest 1% of your day in your self - <AUTHOR> http://www.tryary.com/news/1174/invest-1-of-your-day-in-yoursel

<comment><USER2> This link is pimping you to sign up for some type of unspecified mystery meat. Don't bother.</comment>


Jaywalking: How the car industry outlawed crossing the road - <AUTHOR> https://www.bbc.com/news/magazine-26073797 <comment><USER2> Interesting how this is repeating itself these days with bikes versus pedestrians. Bicycles are increasingly being ridden in crosswalks and sidewalks at high speed, often without safe clearance from pedestrians. And yet, if you as a pedestrian object to having your life risked this way, you're sure to be shouted down as a rube, enemy of the planet, or whatever.

As always, the victors write the history books.

</comment><comment><AUTHOR> As we live more urban with growing population, solution like bikes, cycles, skate boards, scooters (lime etc) and of-course more people on foot... will emerge... we will see how old rules play out then...</comment>


The Future of Apple Music - <AUTHOR> https://www.macstories.net/linked/the-future-of-apple-music/ <comment><AUTHOR> Here is the Wired interview with Zane Lowe that was quoted by MacStories in this piece: [https://www.wired.co.uk/article/future-of-apple- music](https://www.wired.co.uk/article/future-of-apple-music)</comment>


Epic Games Asks Court to Allow Fortnite Back on the App Store - <AUTHOR> https://forums.macrumors.com/threads/epic-games-asks-court-to-allow-fortnite-back-on-the-app-store.2252927/ <comment><USER2> More info including the injunction filing itself on The Verge: [https://www.theverge.com/2020/9/5/21423889/fortnite-epic- app...](https://www.theverge.com/2020/9/5/21423889/fortnite-epic-apple- preliminary-injunction-filing-ios-mac)

Hearing on the 28th. Given how the first round of this went for Epic, I feel like this injunction motion won't go so well, either. It will probably be quite some time before we see Fortnite back on the App Store.

</comment><comment><USER3> They made their bed. This is a crisis that is entirely of their own making. They knew exactly what would happen.

I strongly suspect that the court will let them sleep in the bed of their own making, for as long as they like.</comment>


HTC launches $100M tech venture fund - <AUTHOR> http://www.bizjournals.com/houston/news/2011/04/05/htc-launches-100m-tech-venture-fund.html

<comment><USER2> I had expected for this to be the HTC in Taiwan, but this is also a good development. Now that many tech firms feel more loyal to industries due to the ease of connection on the internet, its nice to see companies showing real productive loyalty to their geographical nests. I'm glad not everyone's leaving the real world behind. But maybe this is just the direction of progress. Its anyone's call, and I'm just glad there are some people with the foresight to advocate a symbiotic internet-reality relationship, in which the reality must also be sustained, and not just a full online lIfestyle.</comment>


I Have a New AI Intern. It's Called FIN - <AUTHOR> https://medium.everything-will-happen.com/i-have-an-ai-intern-124e83ae156e#.choa6q5m3 <comment><USER2> I can't wait until systems like FIN can be self hosted and don't need to call back to a master server.

</comment><comment><USER3> This is useless. No link to provider of "FIN" or company name. Just lost a sale.</comment>