Cloudflare ReCAPTCHA De-Anonymizes Tor Users - <AUTHOR> https://cryptome.org/2016/07/cloudflare-de-anons-tor.htm <comment><USER2> "The Tor design doesn't try to protect against an attacker who can see or measure both traffic going into the Tor network and also traffic coming out of the Tor network. That's because if you can see both flows, some simple statistics let you decide whether they match up."

[https://blog.torproject.org/blog/one-cell- enough](https://blog.torproject.org/blog/one-cell-enough)

Work on a client to try and mitigate the risk of timing attacks:

[https://news.ycombinator.com/item?id=9585466](https://news.ycombinator.com/item?id=9585466)

<comment><USER3> I remember someone at a security conference talking about a kid at a University who sent a bomb threat via Tor.

The University simply looked their their logs to see who was connecting to known Tor nodes, narrowed it down by time and found the kid.

Source: [http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_ch...](http://www.theregister.co.uk/2013/12/18/harvard_bomb_hoax_charge/)

<comment><USER2> Good opsec involves multiple layers of security. There's a fun talk at defcon next month on extending wifi range to avoid detection along with signal 'hiding' via SDR:

[https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Gr...](https://www.defcon.org/html/defcon-23/dc-23-speakers.html#Graham)

<comment><USER4> There's another good talk on more general opsec from Defcon a few years ago called "Don't fuck it up".

[https://youtube.com/watch?v=J1q4Ir2J8P8](https://youtube.com/watch?v=J1q4Ir2J8P8)

<comment><USER5> This is great, thanks for linking it. I'm really interested in this kind of stuff, but it's so hard to find resources on it. Lots of people on Twitter making fun of mistakes people make, not a lot of folks giving advice.

<comment><USER6> [https://news.ycombinator.com/item?id=6521145](https://news.ycombinator.com/item?id=6521145)

[https://news.ycombinator.com/item?id=6521517](https://news.ycombinator.com/item?id=6521517)

These discussions are definitely post-mortem analysis but there is also discussion on another OpSec presentation:

[http://www.youtube.com/watch?v=9XaYdCdwiWU](http://www.youtube.com/watch?v=9XaYdCdwiWU)

</comment></comment></comment></comment></comment></comment><comment><USER7> This short piece doesn't have much detail. But if reCAPTCHA is usable to deanonymize Tor users then I would like to know about it in detail so I can do something about it.

<comment><USER8> I didn't see anything that makes it unique to recaptcha. Any fingerprint able traffic pattern that can be observed coming and going will work.

I could make a website that adds random(1, 64) one pixel images to each page. As you browse the site, you'll be broadcasting 6 bits of identifier with every click.

<comment><USER9> I don't see anything that makes this unique to CloudFlare, either.

(You imply this in your point, but given the specificity of the accusation, I think it's worth clearly pointing out.)

<comment><USER10> I believe the "unique to CloudFlare" element is that CloudFlare effectively sees traffic for significant portions of the web...but is one entity. So, a powerful enough hostile actor (say, a state) would only need to compromise one entity (CloudFlare) to exploit users of thousands of websites, including many major ones. Er, well, two entities, because they also need entrance data. So, if a state were to compromise an ISP and CloudFlare it would give that state a lot of Tor users identities.

Very few small-ish entities have such a large reach and can interject themselves into so many connections on the web.

<comment><USER9> But if we're talking about The Adversary, then they're already deeper in than CloudFlare will ever be, so... what's different?

<comment><USER11> The difference is that reCAPTCHA provides a detectable traffic pattern and is already widely deployed. This provides plausible deniability. Other than that, I don't see a difference.

</comment></comment></comment></comment></comment></comment><comment><USER12> I didn't realize just how fragile TOR is. . . While I understand that remaining anonymous requires adjusting your browser habits somewhat extensively, the fact that a ReCAPTCHA is enough to (theoretically) de- anonymize a user seems to me that it's not able to anonymize at all when browsing.

While TOR may be useful for evading firewalls, my general perception of the project has changed from general anonymity tool to a tool tailored for very specific use.

Granted, this is probably what my understanding always should have been.

<comment><USER13> > I didn't realize just how fragile TOR is. . .

It's JavaScript that causes it (you could choose to disable it [0]). The FAQ [1] warns of it:

But there's a third issue: websites can easily determine whether you have allowed JavaScript for them, and if you disable JavaScript by default but then allow a few websites to run scripts (the way most people use NoScript), then your choice of whitelisted websites acts as a sort of cookie that makes you recognizable (and distinguishable), thus harming your anonymity.

...

Until we get there, feel free to leave JavaScript on or off depending on your security, anonymity, and usability priorities.

[0] [https://www.torproject.org/docs/faq#DisableJS](https://www.torproject.org/docs/faq#DisableJS)

[1] [https://www.torproject.org/docs/faq#TBBJavaScriptEnabled](https://www.torproject.org/docs/faq#TBBJavaScriptEnabled)

<comment><USER14> Not only javascript, you can have a http server that can send timed responses/packets and that would still work. If network traffic is being monitored at the modified server and ISP.

</comment></comment></comment><comment><USER15> In other news, a global passive adversary can use traffic analysis, timing data, and known patterns to deanoymise a Tor user.

The only "new" thing here was the rough traffic pattern analysis of CF captcha page.

</comment><comment><USER16> One way around this is to disable javascript for ReCAPTCHA, the service provides you with a rather primitive HTML form with checkboxes over the images, generating only one request on submit.

<comment><USER17> Yeah, this again. You can't secure your system, if you are running your adversary's code. Tor is upfront about this, this is why Javascript is disabled by default, and why there is a warning if you enable it globally. I suppose this does make for decent clickbait headlines though.

<comment><USER18> TorBrowser does not disable Javascript by default, and neither does TAILS.

<comment><USER17> It is shipped with the noscript plugin enabled, that part is pretty important. You aren't just referring to the fact that JS is disabled via a plugin, are you?

</comment></comment></comment></comment><comment><USER19> Isn't this explicitly outside Tor's threat model? [https://svn.torproject.org/svn/projects/design-paper/tor- des...](https://svn.torproject.org/svn/projects/design-paper/tor-design.html) See section 3.1

</comment><comment><USER20> Why is this phrased as if it's Cloudflare's fault?

If it's this easy for a side effect of a recapcha image to de-anonymize a Tor user, then this seems like a failing of the Tor protocol that they should fix. Maybe they need to introduce more jitter, repackage requests into a single stream with consistent (or randomized) packet size, or pad the packets with random data.

<comment><USER21> Introducing jitter would mean increasing latency and generally slowing down your browsing.

<comment><USER22> as a tradeoff for security? Ok..

I mean, using a VPN is slower than not, but tons of people use them

<comment><USER21> The effect will be exaggerated since tor traffic goes through three nodes and random jitter would need to be added for each. In general, beating traffic analysis in a low latency network is a hard problem. You could have perfect anonymity if you could add arbitrary delays but that would make the network unusably slow.

<comment><USER20> So make it a configurable option that you can turn on and off when you need it.

Having to wait a few seconds for a web page to load seems like a small price to pay to avoid government agents banging on your door because you're looking at "subversive content".

<comment><USER21> The delays would have to be longer than that, not just a few seconds. You're looking at minutes to hours for strong guarantees. Also having a configurable option could make you more fingerprintable.

</comment></comment></comment></comment></comment></comment><comment><USER23> Traffic analysis is always a problem; this is a specific case, but I'm not sure this is anything new.

Many attacks on Tor are facilitated by or require JavaScript. Consider disabling it rather than executing arbitrary, untrusted software on your computer automatically.

<comment><USER24> _Traffic analysis is always a problem_

Not always. High-latency mix networks with fixed message size and randomized transmission are very robust against traffic analysis.

The elephant in the room is, as usual, PEBKAC. The demand by users for low latency will always be the killer for anonymity networks.

</comment></comment><comment><USER25> Huh, I always thought that Tor breaks up traffic in a random, but deterministic (not data dependent) way - sometimes joining data from two packets into one network packet, sometimes splitting packets and holding data for a while [x]. That's how I explained the jitter to myself. Sometimes a connection would be really fast, and sometimes it would hang on a single packet for hundreds of ms. Seems I was mistaken.

In this case, it would have helped a bit, since an attacker would not have seen the characteristic staccato of the reCAPTCHA exchange. They would have seen a few kB in either direction, in 40-100 packets, over a period of a few seconds. If the implementation is clever, on end would even have a different signature than the other.

At least this is something I would have included in Tor. Now that I think about it, randomly introduced delays (from the outside) might actually be a technique to _deanonymize_ users....

([x] You'd generate packet sizes and minimum transmission times from a known seed. First packet is 501 B, 24 ms later a packet of 2048 B, then 15 ms later one of 1718 B, and so on. If there is not enough data after a grace period, pad with junk. If you constantly need more time to send packets than allowed, or need to pad, then adjust the model. Also choose the model to match regular traffic if possible. Disclaimer: I'm just making this up on the spot and am no expert, but it seems plausible and obvious to me.)

<comment><USER26> This is called a mix network and only one server currently does that in Tor's network.

<comment><USER27> Could you please expand on this? I tried to find more info of a Tor relay running mixing, but couldn't find anything. I would like to turn it on for my servers if possible.

</comment></comment></comment><comment><USER28> I stopped visiting sites with image recognition reCAPTCHAs. It has to be one of the worst UX patterns ever devised. It's dirt cheap to automate them away so it doesn't really stop any self-respecting bot maker, and it comes at a price of being a huge pain in the ass for a real user. Every time I run into them I felt used and abused.

It's really sad. So much brain power and this is what they come up with.

Apologies for the rant, couldn't help it. ReCAPTCHA is one of very few things I genuinely hate.

<comment><USER29> > It's dirt cheap to automate them away

Have any examples?

</comment></comment><comment><USER30> Are there any anonymity networks that transmit streams of packets between nodes at a constant rate regardless of whether it's being actively used?

Obviously it would be a very bandwidth hungry network, though if exit node bandwidth is currently the limiting factor (is it?) then maybe not entirely impractical.

<comment><USER19> There are a few systems based on the Dining Cryptographers protocol, but the ones I've seen implemented are very slow and don't support many users.

</comment></comment><comment><USER31> It's bizarre that this article is critical of Cloudflare. If TOR can't stand up to a recaptcha without leaking PII, then it sounds like TOR ultimately needs to be fixed.

I stand by Cloudflare. So much malicious traffic comes through Tor that administrators need to do a lot to protect themselves from it.

<comment><USER32> Almost all the pages I see CAPTCHAs on with Tor have _absolutely nothing_ to protect. Arguably the website owners who use CloudFlare are far more to blame than CloudFlare itself. Nevertheless, I believe CloudFlare should stop using reCAPTCHA and create a challenge system that does not require JavaScript, and does not require sending requests to any website other than the website being visited. I like their proposed solution[0] of automatically creating an onion service for websites using CloudFlare and redirecting Tor users there.

[0]: [https://blog.cloudflare.com/the-trouble-with- tor/](https://blog.cloudflare.com/the-trouble-with-tor/)

</comment></comment><comment><USER33> I wonder why these anti-abuse systems don't use proof-of-work. Instead of a captcha, let the browser chug for 5 seconds, and then POST the solution in order to gain a temporary access cookie.

Sure, this could be attacked - but not at scale, and that's the whole point of the capchta anyway, right?

<comment><USER23> That requires JavaScript.

CloudFlare does have a JS-only challenge, which presumably does this type of thing, but this has a couple different problems. From a security perspective, you're executing arbitrary software, which is unwise, especially if you're looking for anonymity. The other issue is that the software is also proprietary.

[https://support.cloudflare.com/hc/en- us/articles/204191238-W...](https://support.cloudflare.com/hc/en- us/articles/204191238-What-are-the-types-of-Threats-)

"During a JavaScript challenge you will be shown an interstitial page for about five seconds while CloudFlare performs a series of mathematical challenges to make sure it is a legitimate human visitor."

Related: I have started trying to get into contact with webmasters of sites that enable JS Challenges; my template is at the bottom of this page; it'd be great if others could do the same:

[https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/...](https://gitlab.com/mikegerwitz/dotfiles/blob/master/emacs.d/mail.org)

<comment><USER33> Good point. The Cloudflare capthchas I've seen seemed to use Javascript, but maybe it's just incredibly good CSS.

Interestingly, while a javascript calculation might leak more information to CloudFlare (since they might collect other info beseides the result of a proof-of-work function), it would probably leak less to anyone trying to analyze tor traffic from the outside? Seems to me like it would be harder to correlate the two ends of the tor circuit.

<comment><USER23> It'd be harder to do traffic analysis, yes, though I really wonder why it makes so many requests to begin with. I'd like to see an analysis of the CAPTCHA.

Considering that they allow it without JS enabled, I wonder why they'd need any requests at all.

</comment></comment></comment></comment><comment><USER34> Don't most recaptcha http requests go to google, i.e. wouldn't google be the one with the information/control necessary to de-anonymize?

</comment><comment><USER35> A lot of comments here talk about recaptcha having a distinctive traffic signature, but I don't understand this.

Why does recaptcha have a distinct signature and if it does couldn't an attacker just make a distinct signature without recaptcha?

And why does recaptcha have a traffic signature that can distinguish between users? I mean how does a simple request response create a distinct traffic?

<comment><USER25> Right, include Javascript (or heck, just a bunch of images of different sizes) that open requests in Morse code. Long request, long request, short request, long request...

Or, my favorite, the binary search (assuming you control the server / the network in front of the server / some exit nodes, and can monitor the traffic of your targeted user): have sites that cause transmissions for some time (long running JS / requests, or just a lot of content the user interacts with). Freeze 50% of the servers connections. Is the user still connecting? Then s/he is in the 50%. If not, in the other. Repeat until the is user matched to activity on the server.

</comment></comment><comment><USER36> Having a dynamic IP from the 3rd world, I can't help but notice how so many of the sites I visit are behind CloudFlare. 70% of the time I have to solve a captcha the first time I enter a domain during my browser session. This space could really do with more competitors on their same level.

</comment><comment><USER37> >No one is that incompetent.

Well, I'm not sure I'd go that far.

</comment><comment><USER38> If an attacker ran the entry and exit node for Alice's connection, they could exploit this technique and not need access to the relay node.

</comment><comment><USER39> "No one is that incompetent." Yeah I don't think so. Beautiful article, otherwise.

</comment><comment><USER40> does that captcha works without JavaScript?

<comment><USER23> The one they're describing does, yes.

<comment><USER40> still can't understand why people use TOR with javascript enabled.

</comment></comment></comment><comment><USER41> Browser signatures are probably easier still.

<comment><USER42> The point of Tor-browser is to make all signatures the same, when screensize.

<comment><USER42> *even screensize.

</comment></comment></comment><comment><USER43> It is an USA company - that is enough to not trust them.

We do not need any more evidence, there is enough out there about gag orders, secret courts, worldwide compromise of network security.

USA tec company inhabitants and founders, read this: please move out of the country, build your companies in other places, do it now. There is no time to waste. You can not repair the system, that corrupt bureaucrats have irreversibly destroyed.

It will take one or two generations to rebuild a freedom oriented democracy in some other place. Currently Europe still seems to be a good starting point, especially now that the main USA influence channel GB is out.

Please give up the false hope and act now. Get out of that failed state! Freedom can not be rebuild in a fascist system without help from the outside - you can do help much better from outside!

People who still stay in USA will be seen as cooperators by history, the window of opportunity is closing, hurry on and get out asap. Help to defend freedom in other places!

<comment><USER44> Why the downvotes?

<comment><USER8> Seems a little tangential to the original article.</comment></comment></comment>


A Girl's Nude Photo, and Altered Lives: 8th graders charged with felony - <AUTHOR> http://www.nytimes.com/2011/03/27/us/27sexting.html?src=un&feedurl=http://json8.nytimes.com/pages/national/index.jsonp&pagewanted=all

<comment><USER2> You can't sext if you don't have access to a cell phone. Remind me why we think kids need cell phones, computers in their rooms, access to their parents' cash, relaxed curfews, no chores, better clothes than we ever had... And why, even with all the evidence, parents come off as surprised to hear their kids --- the ones they almost never talk with and are inexplicably afraid of --- are sexting.</comment>


Marissa Mayer's Next Big Acquisition Could Be Imgur - <AUTHOR> http://www.businessinsider.com/imgur-and-yahoo-acquisition-talks-2013-12

<comment><USER2> I heard about this on Twitter this morning. Jason Scott from the Internet Archive tweeted this gem :)

"Yahoo! is in talks to buy Imgur. If Yahoo! buys Imgur, @archiveteam downloads what it can of Imgur before Yahoo! destroys it."

[https://twitter.com/textfiles/status/410168842355097600](https://twitter.com/textfiles/status/410168842355097600)</comment>


Pad your JSON - <AUTHOR> https://jsonpad.herokuapp.com/

<comment><USER2> From the name, I thought it was for reindenting json. Although I'm not au fait with json jargon.

<comment><AUTHOR> Ahh yes padding isn't the first thing that comes to mind when first encountering the acronym JSONP.</comment></comment>


How to prevent Cylons from taking over your data (or how Zumodrive does it) - <AUTHOR> http://blog.zumodrive.com/sometimes-you-have-to-roll-a-hard-six

<comment><USER2> This sends the file in transit over SSL, but encrypts the data at rest on EC2. That means you must completely trust EC2.

Worse, based on the comments in the blog, it is unclear who has the key that is used to encrypt the files: hotzyco: "What key AES uses to encrypt files?" Response: "Sorry hotzyco. We can not give out that information."

If Zumodrive controls that key, they have access to your data.

<comment><USER3> I think they need to tell us pretty quickly that they aren't using the same key for all data.

I hope they can!

<comment><USER4> Since they'd want to deduplicate equal files across different users, to save bandwidth and storage costs, I imagine the keys they use won't be user-by- user. They'd be defined file-by-file, or block-by-block, with the keys being stored elsewhere (but where?), or there's just one universal master key. Considering their security is just theatrical in nature, I'd bet they have one master key.

<comment><USER4> I'm being dumb in the previous posting. I know.

</comment></comment></comment></comment><comment><USER5> No, they'll create a humanoid form Cylon that's a tremendously hot blonde. She will seduce you and steal the encryption keys. "All this has happened before, and all this will happen again."

</comment><comment><USER6> NOT RELEVANT TO DISCUSSION:

Here's something for all you people who run blogs for your app or business or something.

Please LINK to your actual app/business/something so I can click my way there.</comment>


A Medieval Grape Is Still Used to Make Wine - <AUTHOR> https://www.theatlantic.com/science/archive/2019/06/grape-clone-wine-900-year-old/591181/ <comment><USER3> A similar thing can be said for "spelt" (a kind of wheat).

[https://en.wikipedia.org/wiki/Spelt](https://en.wikipedia.org/wiki/Spelt)

> Spelt was an important staple in parts of Europe from the Bronze Age to > medieval times; it now survives as a relict crop in Central Europe and > northern Spain, and has also found a new market as a 'health food'.

</comment><comment><USER4> Rather odd to talk about wine continuity across the centuries without mentioning phylloxera: [https://en.wikipedia.org/wiki/Great_French_Wine_Blight](https://en.wikipedia.org/wiki/Great_French_Wine_Blight)

So the seeds might be the same, but the roots often aren't.

<comment><USER5> I kept seeing somewhere for a while that Ohio based grape varieties are used for the root stock now used, but I can't find this anywhere now. Perhaps it isn't accurate.

<comment><USER6> Uncertain that they were from Ohio, but it was (and is) American rootstock that's used to combat the parasite.

<comment><USER7> I had read earlier that the rootstock came from Ingleside, near Corpus Christi, TX. Wikipedia says they came from Temple, TX.

</comment></comment></comment></comment><comment><USER8> At a wine seminar I attended a few years ago we primarily had wine from Bethlehem and the general Palestine region. The importer told us that the wine culture there is some thousand years old (which of course it is, at least there is a tradition to turn water to wine ;-)); but he also said that some grape farmers are growing grapes [again] that are as genetically close to the grapes from said water-to-wine era as possible.

(I would love to give a citation, but couldn't find one within 2 minutes - <USER2> take this as hear-say; though the importer, which is a good friend of a good friend, seemed to be not the kind of person to make this up)

</comment><comment><USER9> If anyone is interested there's a 450 years+ old wine still growing: [https://www.slovenia.info/en/places-to- go/attractions/world-...](https://www.slovenia.info/en/places-to- go/attractions/world-s-oldest-vine)

<comment><USER10> And the oldest in the US is growing on the Outer Banks of North Carolina.

[http://www.themothervine.com](http://www.themothervine.com)

</comment></comment><comment><USER11> >Meanwhile, the pathogens that prey on grapes have continued to evolve, leading to major pesticide use

warning bells went off when reading this: it looks like wine industry as it is now is unsustainable

<comment><USER12> It is a pity to see you being voted down, since the use of pesticides in the wine industry (in volumes which exceed some of the other agricultural industries that give consumers pause) has been a matter of fairly broad public concern for a few years now, see e.g. [0][1][2]

I feel fortunate that in my country, wines in the production of which pesticides were not used, are readily available and for comparable prices to the other wines. In many markets, however, consumers do not have that choice.

[0] [https://www.nytimes.com/2014/01/03/opinion/pesticides-in- fre...](https://www.nytimes.com/2014/01/03/opinion/pesticides-in-french- wine.html?module=inline) [1] [https://www.nytimes.com/2015/03/04/dining/in- france-pesticid...](https://www.nytimes.com/2015/03/04/dining/in-france- pesticides-get-in-way-of-natural-wines.html) [2] [https://www.theglobeandmail.com/life/food-and- wine/wine/whic...](https://www.theglobeandmail.com/life/food-and- wine/wine/which-countries-wines-have-the-least-amount-of- pesticides/article26474846/)

<comment> Const-me Same here in Montenegro. I don't know whether pesticides are used by commercial wineries, but grapes just grows naturally here with very little maintenance, not requiring any pesticides.

</comment></comment></comment><comment><USER13> I would think [https://en.wikipedia.org/wiki/Aglianico](https://en.wikipedia.org/wiki/Aglianico) would be older still.</comment>


The Cobalt Pipeline - <AUTHOR> https://www.washingtonpost.com/graphics/business/batteries/congo-cobalt-mining-for-lithium-ion-battery/ <comment><USER2> First of all, there are many things about this article itself that make me really happy. The content is a well designed mix of short videos interspread in an article which references sources, investigates facts independently and is honest about what it could and could not find. They even mention a part where Amazon did not reply to their question and state that Amazon is owned by the same owner as their paper. Overall, I think this is an amazing journalistic piece. Very nice to see that good journalism is still out there and hope this catches on as well.

Now, the subject of the article itself: its really sad that the people of Congo, who should ideally be a part of the global supply chain that brings prosperity to those involved in it, should be exploited so thoroughly. While ensuring the source of cobalt is perhaps the first step, maybe what is needed is better leadership amongst the miners itself (I don't mean this as criticism but as a suggested solution). I can see that the mining companies and those profiting from dirt cheap prices of cobalt would be dead against this, but here again we see what happens when labor is plentiful and there is an absence of any sort of regulation. The fact is that if companies can get around laws to get minerals cheaply, they will. Because the market rewards those who give them raw materials for cheap.

</comment><comment><USER3> I was surprised the article left out the issue that there are many mines that are controlled by regional warlords in the Eastern Congo. Profits from not only cobalt but other minerals fund regional militias/armies. So its even more egregious than just labor exploitation as these warlords contribute to instability in a region that is far from the control of Kinshasa the country's capital.

It would be good to see something established similar to the Kimberly Accord for diamonds and certifying conflict free acquisition but the cynical part of me thinks that this designation would rendered ineffective due to corruption and falsification.

<comment><USER4> From the article:

      > In 2010, the United States passed a conflict-minerals law
      > to stem the flow of money to Congo's murderous militias,
      > focusing on the artisanal mining of four minerals.

      > But this same diligence is not required when it comes to
      > cobalt.

      > While cobalt mining is not thought to be funding wars,
      > many activists and some industry analysts say cobalt
      > miners could benefit from the law's protection from
      > exploitation and human rights abuses.

<comment><USER3> Sure, I read that however I was referring to the establishment of an internationally accepted certification protocol much like the Kimberly Process Certifaction Scheme has for diamonds.

Also I don't think anyone can say with any degree of certainty that Cobalt is not helping to finance militias or warlords when the DRC ranks at 129 out of 149 countries on the Corruption Percpetion Index.

Source: [http://www.worldaudit.org/corruption.htm](http://www.worldaudit.org/corruption.htm)

It is accepted that much of the "Great War" in the Eastern part of the DRC was financed by Cassiterite, Cobalt, Coltan and Tungsten.

See: [http://www.globalresearch.ca/the-congo-still-ravaged-by- u-s-...](http://www.globalresearch.ca/the-congo-still-ravaged-by-u-s-funded- conflict-and-plunder/5375098)

</comment></comment></comment><comment><USER5> I've been worrying about how I'll find a phone with a proper keyboard when my current one dies. I knew about the exploitation that went into making electronics, but without cognitive dissonance we wouldn't get anything done.

I think after reading this article, my next phone will be a Fairphone. There are more important things than how easy quickly I can write an email.

</comment><comment><USER6> Speaking of lithium batteries, I heard from some guy on the Business News that the world is oversupplied with lithium. There's enough to last for decades, apparently.

<comment><USER7> It's the second most common element in the universe.

<comment><USER8> Lithium isn't in the top 10 most abundant chemical elements in the universe ( [https://en.wikipedia.org/wiki/Abundance_of_the_chemical_elem...](https://en.wikipedia.org/wiki/Abundance_of_the_chemical_elements#Abundance_of_elements_in_the_Universe) ). The most abundant, of course, is hydrogen, making up close to 74% of all the baryonic mass, followed by helium ~24%. Lithium can be fused into heavier elements and the conversion happens efficiently in stellar environments where it is produced.

For every 10^6 atoms of silicon, there are only 10^3 atoms of lithium in the Earth's crust ( [https://en.wikipedia.org/wiki/Abundance_of_elements_in_Earth...](https://en.wikipedia.org/wiki/Abundance_of_elements_in_Earth%27s_crust) ).

</comment></comment></comment><comment><USER9> Not sure if its possible in a warlord controlled situation, but somehow, it seems like these guys need a union.

</comment><comment><USER10> This reminds me of I, Pencil [1], the story of how a pencil is made. There should be an I, Ethically Sourced Pencil follow up.

1\. [http://www.econlib.org/library/Essays/rdPncl1.html](http://www.econlib.org/library/Essays/rdPncl1.html)

</comment><comment><USER11> I looked up holoprosencephaly, the rare congenital defect mentioned in the article. Stuff of nightmares.

<comment><USER12> Yes, very sad and tragic for sure.

[https://www.genome.gov/12512735/learning-about- holoprosencep...](https://www.genome.gov/12512735/learning-about- holoprosencephaly/)

[https://www.google.com/search?tbm=isch&q=holoprosencephaly](https://www.google.com/search?tbm=isch&q=holoprosencephaly)

</comment></comment><comment><USER13> Full browser window videos with sound to exploit pity, blaming tech industry. Had Washington Post descend to that yellow press levels? Or it always had at this level?

<comment><USER14> What's your point? That the article is overdramatizing the issue?

<comment><USER13> It's pathos to make more money. Analogue to clickbait. Hollywood-like pity factory. This media popcorn industry is more responsible for exploiting poor africans, not creators of mobile phones.</comment></comment></comment>


'Chemsex': Doctors about days-long, drug-fueled orgies with 'ca. 5 partners' - <AUTHOR> https://www.washingtonpost.com/news/morning-mix/wp/2015/11/04/chemsex-the-days-long-drug-fueled-orgies-with-an-average-of-five-partners-doctors-are-worried-about/?hpid=hp_no-name_morning-mix-story-x%3Ahomepage%2Fstory <comment><USER2> Sounds like a great time to me.</comment>


Distru supply chain software for the cannabis industry raises $3M - <AUTHOR> https://techcrunch.com/2019/06/03/distru-a-maker-of-supply-chain-software-for-the-cannabis-industry-has-raised-3-million-led-by-felicis/ <comment><USER2> Slightly off-topic: how do American startups in the cannabis space, even in States where it's legal, not violate federal laws? Would software specifically designed to distribute cannabis be seen in the the same way as software designed specifically for encrypting cartel communication[1]?

[1] [https://www.vice.com/en_ca/article/xwn4vw/canadian-ceo- vince...](https://www.vice.com/en_ca/article/xwn4vw/canadian-ceo-vincent- ramos-who-sold-encrypted-phones-to-the-sinaloa-cartel-sentenced-to-nine-years)</comment>


Print Is Dead? Not Here - <AUTHOR> https://www.nytimes.com/2018/09/02/business/the-villages-newspaper.html <comment><USER2> Flogging the dead horse aren't we.

It's a long departed business model. No one under the age of forty has ever bought a newspaper.

Most people 40-65 stopped reading them a long time back. I'm surprised if many people over the age of 65 who are computer savvy still read them.

Does anyone seriously think once the people described above reach retirement age they're going start picking up the newspaper?

Print media had 20 years to adjust or die and pissed it away and commercial television should have also seen the writing on the wall by the early 2000s but they pissed it away too.</comment>


Will UC schools drop their SAT scores requirement? - <AUTHOR> https://www.latimes.com/california/story/2019-10-02/uc-sat-test-optional <comment><USER2> Wealth does select for IQ, but that effect shouldn't be further magnified by rich kids' option of "hitting til they're happy", i.e., retaking and repaying. Universities do need some standardized IQ filter, and it's unfortunate that private enterprise provides it in the US (as opposed to government in most countries). My advice: do high school outside the US.</comment>


AMD acknowledges 3rd-gen Ryzen boost bug - <AUTHOR> https://www.pcworld.com/article/3435780/amd-acknowledges-3rd-gen-ryzen-boost-bug-says-fix-is-coming-september-10.html <comment><USER2> BIOS update, not a huge deal. If it was a hardware issue that would be way more catastrophic.

<comment><USER3> Der8auer thinks its a binning/marketing issue, and no amount of bios massaging can help it.</comment></comment>


Show HN: I built an open source Crowdfunding alternative in Gatsby.js - <AUTHOR> https://github.com/rwieruch/open-crowd-fund <comment><USER2> If 10 people promise to pay $100 each, can the software then ensure that they will really pay $100 each? Or what if 9 of them drops out, and only 1 pays?

Or ... after having had a closer look, seems to me as if people are charged immediately. ? ... Then, hmm, if the minimum funding goal isn't met, will it refund everything then? (is that how croudfunding platforms work?)

Interesting idea anyway. If you want you can submit it here: [https://usability.testing.exchange](https://usability.testing.exchange) and write that you want feedback about the idea and what benefits/features people want (but maybe remove the default question about UX and design).</comment>


IPhone game: app developer tycoon - <AUTHOR> https://itunes.apple.com/app/alone-app-dev-story/id668480185?mt=8

<comment><AUTHOR> My friend worked on this for nearly a year all by himself. I thought it deserved a little recognition.</comment>


A Secretive Banking Elite Rules Trading in Derivatives - <AUTHOR> http://www.nytimes.com/2010/12/12/business/12advantage.html <comment><USER2> It's a pretty amazing thing to see a NYT reporter write a five page story about 'derivatives' and not realize that the people she's talking to are referring very specifically to CDS derivatives and heating oil derivatives only.

This was my favorite quote:

 _To get a transparent exchange going, Citadel offered the use of its technological prowess for a joint venture with the Chicago Mercantile Exchange, which is best-known as a trading outpost for contracts on commodities like coffee and cotton._

Right.... First of all, get the name right. It's significantly been called the CME Group for years now -- and refers to the fact that this is a collection of all sorts of markets, the vast majority of which are financial derivatives. Ken Griffin proposed a very specific trading platform for CDS derivatives a couple of years back. The CBOT and CME (merged as the CME Group) meanwhile have been trading other financial derivatives, as the majority of their business, for three decades now.

The key point that is missed in all this imprecision -- is that CDS derivatives markets are not like other derivatives markets -- which are regulated. They are contracts that occur between large financial institutions only. That is the 'secret'. The rest is just the equivalent of a high school tourist at the visitor's desk.

That said, she's in the general right direction (I won't say ballpark). But yeah, it's almost like complex businesses require three levels of understanding that people go through:

      (1) it's a conspiracy
      (2) it's actually not so bad
      (3) there are targeted ways to improve it

Fields shrouded in first-semester textbooks, though mired in specific cases of catastrophic misuse (financial crisis), I suppose take a little more effort to get to step 3....

<comment><USER3> I think that most "lay" people would know about the exchange in Chicago by its old name. It's not like the name change of 2007 is decades ago. And I'm guessing that CME Group stands for Chicago Mercantile Exchange Group so referring to the institution as the Chicago Mercantile Exchange is hardly a howling mistake. And presumably derivatives are a type of contract, and the derivatives are based on commodities, and oil is a commodity, thus the reporter seems to be largely right.

Instead of being pedantic and snarky why don't you enlighten us all instead of using acronyms for everything? CBOT appears to be the Chicago Board of Trade. But CDS? Is this the famous credit default swaps that helped bring about the current mess that we are in? And the banks are unwilling to have a light shone on these dealings. ? What a surprise. She doesn't imply it is a conspiracy - she actually shows that there appears to be collusion and monopolistic practices. There is no, "we think they are up to something but don't know what", it's "they are up to something and aren't playing ball".

<comment><USER2> _Instead of being pedantic and snarky why don't you enlighten us all instead of using acronyms for everything?_

Okay, I'll try for a little bit. I should be programming. But a little bit of history. I apologize for sounding pedantic or snarky.

In the 1900s up until the 1970s, the Chicago Mercantile Exchange (CME) and Chicago Board of Trade (CBOT) traded mostly agricultural products. A similar market existed in New York (NYMEX). These exchanges were created so that (as alluded to in the beginning of the NYT piece) wholesalers, farmers, people with a heating oil business, etc., could hedge the risk associated with the price of their commodities (due to weather, circumstance, etc.). Eventually these contracts became standardized -- they referred to the same # of bushels, and they were backed by clearing firms and central clearing houses at the exchange that served as buffer between these hedgers (who would 'hedge their bet', if they were more interested in selling at a locked in price and not worrying about the changing prices of the market), and speculators (usually local traders, or 'locals'), who would assume this risk.

These standardized future contracts fall under the category of 'derivatives', because they 'derive' from the current price of the commodities (often called 'cash' or 'cash instruments'). It turns out that there is overlap in how you create other more complex derivatives related to these futures contracts. So you can create options on these contracts. The options 'derive' from the price of the futures, etc. Sort of similar to higher order derivatives in math (so blaming 'derivatives' in general usually irks people in the industry because that's like blaming 'acceleration').

But there are different cash instruments you can use, and different ways you can form these instruments. So in the early 1980s, due to tax incentives in Illinois, and a couple of other reasons, the CME introduces the Eurodollar future. This is the first major financial future. The cash product here is interest rates (usually the LIBOR rate -- hence, the 'Euro' -- a standard short-term interest rate used by banks). So now financial institutions are starting to see that they can do this same type of hedging of their bets (they're the 'farmer' or 'heating oil producer' in this equation). If they want, they can now hedge their exposure to interest rates.

But why stop there? Futures contracts have the benefit of different taxation (capital gains taxes in Illinois are lower than elsewhere -- I don't know how much this has changed, but, e.g., this is one of key things a good reporting piece could focus on -- the justification is that speculation and capital gains from trading is risky and deserves to be taxed less -- because of the good to the economy that it provides, etc. -- but I mean, that's worth debating). And futures contracts also have the benefit that they're standardized and accessible to anyone with a terminal. So before you know it futures on stock indicies are introduced (the largest volume contract in the U.S. -- is the S&P 500 family of futures contracts). And around this time -- in the early 90s, things start to go electronic for the first time.

Bond futures are also introduced (at the CBOT). And this allows large financial institutions to offset risk more easily with their treasury bond portfolios, etc.

The key thing here though is that all these instruments, all this financial futures -- and all the options on financial futures that created -- they're all regulated. They're all closely watched by the CFTC and other regulatory bodies.

Enter the problem. Credit Default Swaps. These are non-standardized contracts drawn up between bulge-bracket firms in New York and insurance agencies to deal with the risks associated with mortgage securities. This is a huge, multi-multi-billion dollar industry that isn't regulated because it's still in its infancy and the participants have never been truly brought into the light.

Financial engineers, having seen how derivative contracts can be used to offset or control risk -- decide to draft these contracts to deal with mortgage-backed securities. The problem with mortgage-backed securities -- I don't know for sure. But I know they've been problematic from the 80s onwards. The bundling of home loans by New York has just never worked out for everyone (and Warren Buffett bailing out Salomon didn't fix the core of the problem -- in fact, arguably it glossed it over and left it as a potentially hazardous situation for two decades later -- though that's highly controversial, and just my sense -- the rest of what I said is hopefully pretty well accepted).

So creating financial derivatives for CDSes doesn't work in an unregulated manner. So seeing things collapsing, and seeing an opportunity to be involved in a huge new market, Ken Griffin proposes that CDSes should be traded in a more open manner (in 2008). CME Group (which is a merger of all three major futures exchanges in the US -- CBOT/CME/NYMEX -- another thing a more targeted reporting piece could focus on -- there's a potential monopoly -- see their relationship with ELX, etc.), I'm guessing, correctly foresaw that they didn't want to be anywhere near CDSes with the political backlash coming. So they wisely turned down his idea. But I could be wrong there -- have no close familiarity with what really went on.

So that's a little history. I don't know the specifics of the ICE clearing house conspiracy meeting whatever. But there are hundreds of these 'working groups' for new types of derivative products. They're traditionally just large market participants voicing their concerns about how things are going to be traded (the software involved, the types of contracts, etc.). But...it's not a conspiracy.... Not any more than ISO / HTML5 working groups are conspiracies between tech companies to push their interests (I mean there's always going to be a little bit of that). But these are traditionally actually very good things -- people coming together to determine how to trade things in the open.

The problem is Goldman Sachs picking up the phone and creating a custom contract with AIG to insure themselves against a mess of mortgage-backed securities that they got themselves into. The problem is that (a) they could trade these to begin (see THE INSIDE JOB, etc. -- for the rationale behind Glass-Steagall, and the problems with its repeal) and (b) that this didn't happen in a free, open, accountable market and of course (c) that they got bailed out because they were so integral to the financial markets to begin with (which wouldn't happen if part (a) were addressed).

But I mean obviously if you're going to start regulating things more closely, it's good to figure out exactly what to regulate. But I suppose I really should get back to programming...

<comment><USER4> I'll preface this by saying that I work in electronic trading, so I have a dog in this hunt and my opinion should thus be viewed with some suspicion.

You make two points in the two posts that are related:

 _The key point that is missed in all this imprecision -- is that CDS derivatives markets are not like other derivatives markets -- which are regulated. They are contracts that occur between large financial institutions only. That is the 'secret'. The rest is just the equivalent of a high school tourist at the visitor's desk._

 _Eventually these contracts became standardized -- they referred to the same # of bushels, and they were backed by clearing firms and central clearing houses at the exchange_

In the current state of affairs, the CDS market is not transparent and the participants who want to avoid transparency point to the custom nature of the contracts as a reason that they shouldn't be quoted electronically. However, this situation is similar to what existed in equity/index options before the products started to be listed by exchanges: customized contracts were traded through brokers. This sort of OTC trading still occurs, but it exists alongside a very large, very active market of exchange-traded options whose prices are very transparent and thus automatically force down the fees that can be charged in the OTC market because they provide publicly available pricing information on similar contracts. If electronic exchanges were to create standardized contract terms for CDSs targeting some of the more heavily traded debt instruments (sovereign debt be a good target at this point for obvious reasons) and then list these contracts electronically, I suspect that this would bring a great deal of transparency to the pricing of these products due to the participation of firms like Citadel (which already has a large and profitable group making markets in electronically traded options). Large players have resisted such transparency in the fixed income markets for years, and this seems no different.

</comment></comment></comment></comment><comment><USER5> I am writing from my "other" account and I make a living in financial modeling.

While in general the article is true, as always, journalists fudge truth just a bit to sound more sensationalistic.

> But Mr. Singer wonders if his company, Robison Oil, should be getting a > better deal. He uses derivatives like swaps and options to create his fixed > plans. But he has no idea how much lower his prices — and his customers' > prices — could be, he says, because banks don't disclose fees associated > with the derivatives.

Sure there are fees, but most of the premium is the price of risk, the price of the insurance if you will. While banks sometimes do some proprietary pricing enhancements, the foundation methods are usually the same and can be picked from books (like the bible of derivative pricing by John C. Hull) and papers. I know for a fact that big commodity companies (e.g. oil companies) have their own financial analysts on staff to double check derivative pricing. And it is not just that this allows you to haggle with the banks - you do no want to get derivatives that are too cheap either. That may be a result of incompetence or a sign of trouble - should the derivative seller pay to you they will not have enough capital to cover their obligations. That is exactly what happened with AIG and Lehman Brothers.

Now, Robison Oil may not be that big to have financial analysts on staff, but they could use third-party pricing consultants, at least.

<comment><USER6> "proprietary pricing enhancements", that sounds like a scam if I've ever heard one.

</comment></comment><comment><USER7> I don't care what the market players do, as long as the taxpayer is not on the hook when things blow up in their faces. The fact that we are lets them take dumber risks.

<comment><USER8> You've got to understand that when you create a massively interlocked system whose collapse would _seem_ likely to bring the entire economy down with it, you've institutionalized that system's bailout without any laws being passed.

And yes, that lets the risks pile up too.

And no, I don't think the bailout left us better off but the fix was in long before October 2008.

<comment><USER7> The key phrase is "would seem likely". And it seems even more likely with people like Hank Paulson claiming that if he doesn't get a slush fund, the world will end. Even though its really just profits at Goldman Sachs that would end.

That doesn't mean we can start unwinding things by rolling back the individual policies that are causing the risky behaviors.

The government could, for example, ensuring only 80% of their bank deposits. We could start phasing out subsidies for housing by 2% per year. We could let the market set interest rates.

Of course, the people in charge (regardless of which party) seem to think only more government interference in the economy could possibly help. They seem incapable of examining anything they've done or admitting any errors.

<comment><USER9> Or we could recognise that a financial services organisation over a certain size engagine in certain risky practices is no more inherently safe for society than a factory dumping toxic waste, and restrict it accordingly. Sometimes 'big government' creates risk, but sometimes it controls it as well.

<comment><USER8> Yes,

Though one should also look at the number and sophistication of the people a company deals-with, the amount of leverage it uses and so-forth. But this kind of analysis isn't really new. It is what central banks are supposed to do. The Fed's job _was_ "to take away the punch bowl just as the party gets going," (<http://en.wikipedia.org/wiki/William_McChesney_Martin,_Jr.>). Unfortunately, the Fed joined party itself with the repeal of the Glass-Steagel act and we've had stimulus-through-speculation over the last twenty years. The rise of speculative excess has a societal and psychological dynamic and once it gets going it is sustained by the social power achieved by the speculators. The pattern is old and has ended in grief a number of earlier times in history.

I would recommend <http://prudentbear.com/> and Doug Noland's Credit Bubble Bulletin. This gives an intelligent analysis of the last twenty years' speculative excesses.

Also, before tossing out knee-jerk anti-regulation comments, consider how well Alan Greenspan used this sort of ideology as "covering fire" for the speculator economy. I'm neutral on whether a libertarian system could be built soundly from the ground up. But I think it's crucial to note how the use of a bit libertarian rhetoric to dodge regulations when convenient has been instrumental in leading us to the unsound ground we are currently on. (I would admit that Ron Paul's critiques Greenspan's policy actually have been quite good over the years).

<comment><USER7> One big problem with regulation is how subject to manipulation it is. It provides a false sense of security to just assume government regulation means someone is actually writing sensible rules and that someone is actually enforcing them.

The idea that there is some central intelligence that can decide the soundness of investments deceives the average investor or saver into thinking they need do nothing themselves. All the while the government is actively making things less sustainable and handing out favors along the way.

One could argue that the same is true of private stamps of approval. But there is competition and many voices out there, each having their own tolerance for risk.

To have government regulating things is like your brain never having doubts, never weighing competing concerns except for political ones. And many people think that way, just going along with the crowd. But we can't afford to have that sort of thinking govern everything.

<comment><USER8> I agree the government shouldn't be in the business of controlling investment.

But I would just as much note that most people shouldn't have more than a fairly small percentage of their savings in real, honest-to-god risky investment. The small investor's chances of being wiped-out are too high and their being wiped out would, again, have a cost to society not just themselves.

Thus, the government _should_ supervise a system where most of the average person's savings go into simple, plodding savings accounts and a fairly small amount is invested.

This system worked pretty well 1933 ~ 1980. I think Nicholas Taleb also mentions a similar system.

Oddly enough, a lot of this comes down to the non-Gaussian nature of a market's expected return. The theoretical foundation of all the schemes for interdependent, self-insured investment processes assumes the distribution of market corrections was Gaussian and that thus large corrections would be rare and multiple investment vehicles would support each other through the law of large numbers. But with a non-Gaussian, "L-stable" distribution, you simply can't expect such things.

Government aren't always. Certainly the US government has become more corrupt on the level of policy over the last thirty years but private industry has become similarly corrupt (as well as entwined with the state). I'm not sure what to do here. The state creates monopolies and then

Mandlebrot's essays on finance are very important to look at (along with Hyman Minsky's theories, etc).

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I saw a good Frontline documentary on this the other day, <http://www.pbs.org/wgbh/pages/frontline/warning/view/> apparently this whole mess started back in the 90's and the head of the CFTC then, Brooksley Born, wanted to put rules in place then to make the derivatives more transparent but was vehemently opposed by Greenspan, Rubin, and Summers. Turns out that the current head of the CFTC, Gary Gensler was one of the deputies of the three guys opposing any regulation of derivatives in the 90's. The three actually went so far as to get a law passed saying that the CFTC couldn't regulate derivatives.

Bottom line is anyone that acts surprised by the lack of regulation shouldn't be because Congress voted on and passed a law specifically prohibiting regulation of derivatives in the 90's. A law that was promoted by the same people who now run all the US government agencies like CFTC, Treasury etc...

</comment><comment><USER10> Single page: [http://www.nytimes.com/2010/12/12/business/12advantage.html?...](http://www.nytimes.com/2010/12/12/business/12advantage.html?_r=1&pagewanted=all)

</comment><comment><USER11> The world of high finance has intrigued me as of late. I recently watched the documentary "Inside Job" and it made me feel incredibly stupid, so I've set out to learn what I can about the industry. What an odd little world of its own.

I can't even say any more than that about the article - it would be like when my Mom tries to talk about programming. I just thought I'd drop a little plug for the film here (no affiliation) in case anyone else wanted an interesting and easy starting point for this stuff :)

<comment><USER12> Inside job is a bit sensationalistic.

That said, you can probably learn a decent amount by reading a book called "Hedgehogging.". It goes into some of the cultural aspects of finance.

Just keep in mind that "trading" is all about having a better eye for value than the other guy. In every respect. If you're bad, you'll get fleeced. And by you, I mean everyone who has placed money with you.

<comment><USER11> I thought it might be. I'd be curious to hear a more balanced perspective on the crisis, and I suspect part of that will come as I just inform myself about the industry as a whole.

Thanks for the recommendation - I will be buying _Hedgehogging_ this week if I can't find it at the library.

<comment><USER12> There are a lot of books on the subject and I've read quite a few of them.

Like most things, different perspectives led different people to arrive at different conclusions about what led to the crisis.

Put very simply, the folks in charge (traders) were simply allowed to take on too much risk. And by risk, I mean that they were allowed to borrow money to make bets on the future value of securities. They believed that most of that risk was offloaded to a company that could absorb it (AIG) but it turns out that they couldn't. When everyone found out that AIG couldn't absorb that risk (defaults on mortgage-backed securities), they ran for the hills (refused to lend money with mortgage-backed securities as collateral).

Hedgehogging will give you a good idea of the people/mentality that drives traders and how managing big money works. It's a complicated business and quite different from your regular mom-and-pop investor. One of the lessons I took from the book was that being very successful in your fund can lead people to WITHDRAW their money from your account. It's like they expect you to be unable to repeat your performance.

Another lesson is that a lot of hedge funds fail. Their fund manager can't get out of a slump and everyone takes their money out. The fund closes.

But the best lesson is the analogy of fund managers to star athletes. Those managers that can consistently beat the market are paid very well because they are making a lot of other people very very rich. That's rare and not a lot of people can manage it.

</comment></comment></comment></comment><comment><USER13> Govt will not take any action because Wall Street is the highest tax payer and job creator.

<comment><USER14> Govt will not take any action because Wall Street floods politician's election campaigns with dollars so they play ball. If they don't play ball, Wall Street funds a challenger to the seat.

<comment><USER3> How does Wall St, collectively and en masse decide and go about doing this? I'm not saying that they don't - I think that it has been fairly well reported that the sums of money coming from Wall St. as campaign contributions are large - I would just like to know if there is any coordinated mechanism or is it a kind of wisdom of the financial crowds ...

<comment><USER15> Well, it's not that complicated. In a tribe, you help your friends and you hinder your enemies.

Imagine some techie eating lunch with his techie buddies. Is he likely to talk about how he's against net-neutrality, or is it likely that he's for it? If he were against it, he'd seem weird.

Basically, you're not going to screw the people you hang out with all the time, and might want to work with later.

</comment></comment></comment></comment><comment><USER16> step 1 in their evil scheme: hide all their plans behind a NYT login wall

</comment><comment><USER17> Their lock on the market is less than 100 percent.

<http://tinyurl.com/22pu34p></comment>


A Guide to Autodidactism - <AUTHOR> https://www.jackkinsella.ie/articles/autodidactism <comment><USER2> > _I wish there were dynamic SRS decks for language learning (or other > disciplines). Such decks would count the number of times you have reviewed > an instance of an underlying grammatical rule or an instance of a particular > piece of vocabulary, for example its singular /plural/third person > conjugation/dative form. These sophisticated decks would present users with > fresh example sentences on every review, thereby preventing users from > remembering specific answers and compelling them to learn the process of > applying the grammatical rule afresh. Moreover, these decks would keep users > entertained through novelty and would present users with tacit learning > opportunities through rotating vocabulary used in non-essential parts of the > example sentence. Such a system, with multiple-level review rotation, would > not only prevent against overfitted learning, but also increase the total > amount of knowledge learned per minute, an efficiency I'd gladly invest in._

Exactly this is my side-project at the moment. Hopefully it will show up on "Show HN" in a year or two.

<comment><AUTHOR> The world needs this. I'm eagerly awaiting your release. Free free to ping me at release.

</comment></comment><comment><USER3> I'm an auto-didactic. I dropped out of HS and taught myself everything I know by reading books. I have never subscribed to a system of note taking. I guess all I ever did was relate problem spaces in my head. This problem is an analog of that problem with separate variations. Perhaps that is an extreme oversimplification.

<comment><USER4> Autodidact.

A better translation of the last sentence from Goethe runs "Here I sit, for all my lore, the wretched fool I was before."

<comment><USER3> > Autodidact.

Thanks, I didn't notice the spelling error. Honestly the reason I dropped out of high school was undiagnosed dyslexia and dysgraphia. It makes me so excited when someone is willing to show me that I spelled something wrong and then call me a fool. You know. Because ability to spell is far more important than the fact that I've forgotten more about Linux than most system administrators will ever know, or that I can program in over 10 languages and am familiar with DDD, CRQS, SOLID among other design patterns. I've mentored over 50 developers, and made Principal Engineer before I turned 35 despite my lack of credentials. I worked my way up from Help Desk to PC Support to, Network Admin, to System Admin before becoming a Software Engineer. But, nah, I'm a fool because I've misspelled a word. Thank you kind stranger for pointing out my limits, it gives me an incredible sense of frisson to know people like you are out there to keep us all in check.

<comment><USER4> No criticism intended.

"Autodidactic" is the adjective, "autodidact" the corresponding noun. As you know, in English we often like to leave the noun merely implied, letting the adjective alone fill in for the noun phrase. Still, the term "autodidact" being shorter than the adjective gives it an unusual appeal. I like to imagine that readers other than yourself may welcome the suggestion.

Each of us knows a negligible part of what is known, which is itself truly negligible compared to what is yet to be known. Most of us are overwhelmed just pruning away what we thought we knew that has turned out not to be so. Don't trust anyone who is not.

My real reason for posting was to make a place to write the translation I like better.

</comment></comment></comment></comment><comment><USER5> Hmm... you don't see Baskerville used on websites often.</comment>


How to Kill Mysql Performance - <AUTHOR> http://www.slideshare.net/techdude/how-to-kill-mysql-performance

<comment><USER2> Hi folks, this is Jay Pipes, the author of the slide decks in question...someone notified me via email that these slides were up online.

I had no idea those slides were even up online! People tend to take the slides from my website (<http://jpipes.com>) and post them on various websites without my knowledge, which is perfectly fine. :)

Those slides are also quite old (2+ years now). I've done many presentations since then and have a number of alternate slide decks which you may find useful. Here are the links to download PDFs from my website.

<http://jpipes.com/presentations/kill-mysql-performance.pdf>

[http://jpipes.com/presentations/target-practice/target- pract...](http://jpipes.com/presentations/target-practice/target-practice.pdf)

[http://jpipes.com/presentations/target-practice/target- pract...](http://jpipes.com/presentations/target-practice/target-practice- workbook.pdf)

<http://jpipes.com/presentations/joinfu/joinfu_part_one.pdf>

<http://jpipes.com/presentations/joinfu/joinfu_part_two.pdf>

[http://jpipes.com/presentations/dqm/legend_drunken_query_mas...](http://jpipes.com/presentations/dqm/legend_drunken_query_master.pdf)

You can also download a chapter of my book (Pro MySQL) on SQL Scenarios:

<http://jpipes.com/presentations/sqlscenarios.pdf>

Cheers!

jay

</comment><comment><USER3> How to ensure that [some] people won't read your post: require Flash.

<comment><AUTHOR> You would probably be better off complaining to slideshare.net or the original author of the slideshow for posting it there.</comment></comment>


Reddit CEO claims TikTok app is 'fundamentally parasitic' and spyware - <AUTHOR> https://www.usatoday.com/story/tech/2020/02/27/reddit-ceo-calls-tiktok-app-fundamentally-parasitic-spyware/4895825002/ <comment><USER2> [https://news.ycombinator.com/item?id=22430508](https://news.ycombinator.com/item?id=22430508)

</comment><comment><USER3> It's hard to make out what Huffman is referring to in particular. I'm sure TikTok tracks user behaviour on its platform but I assume so does reddit when it sells ads on its platform. As far as we know tiktok does not appear to store American user data on Chinese servers.

Parasitic is definitely what I'd call a flat out inappropriate label in particular in the context of attacking a Chinese company without much evidence to back it up. I think Sandbergs comment highlights what the real problem here is

> _Sheryl Sandberg had similar comments, noting that she was concerned about > the fledging video app on NBC's "Byers Market" podcast. "They're huge, > they're growing really quickly, they've gotten to bigger numbers faster than > we ever did," Sandberg said._

[https://www.theverge.com/2020/2/27/21155845/reddit-ceo- steve...](https://www.theverge.com/2020/2/27/21155845/reddit-ceo-steve- huffman-tiktok-privacy-concerns-spyware-fingerprinting-tracking-users)

</comment><comment><USER4> While he may be right about TikTok, I really don't trust what Reddit is turning into either. Reddit does the same thing and tracks outbound clicks and user browsing as well.

</comment><comment><USER5> Ok, TikTok is bad, what does that make Facebook?

</comment><comment><USER6> Posturing by an american company to a chinese one. Reddit is just as parasitic with subreddits like /r/wallstreet bets and /r/nsfw I don't see how his argument holds any water whatsoever.

<comment><USER7> What is the problem with WSB? They are pretty upfront about how stupid the shit is.

I haven't been to /r/nsfw. Is there a problem with mature/adult stuff or something else?

<comment><USER6> Yeah, /r/NSFW used to be as bad as 4chan but now its just specifically geared towards men. Edit: replace "it" to be /r/NSFW</comment></comment></comment>


Face detection with Python and OpenCV - <AUTHOR> http://blog.jozilla.net/2008/06/27/fun-with-python-opencv-and-face-detection/ <comment><USER2> If anyone is interested, I wrapped OpenCV face detection into a gstreamer plugin.

<http://github.com/sandaru1/smartcut/tree/master/gst-opencv/>

</comment><comment><USER3> Anyone hear of a port of this to beagle board?

<comment><AUTHOR> For OpenCV you can check out these pages for a hint on where to start:

[http://montamer.blogspot.com/2009/01/opencv-on- beagleaboard....](http://montamer.blogspot.com/2009/01/opencv-on- beagleaboard.html)

[http://www.computer-vision-software.com/blog/2009/03/arm- wre...](http://www.computer-vision-software.com/blog/2009/03/arm-wrestling- with-opencv/)

[http://stackoverflow.com/questions/1968414/cross- compilation...](http://stackoverflow.com/questions/1968414/cross-compilation- of-opencv-for-arm-9-processor)

For Python on mobile devices (one of the links on the page may provide more info for Python on ARM Cortex-A8) check out:

<http://www.awaretek.com/pymo.html>

Otherwise start looking on Google</comment></comment>


CRISPR Gene Editing - <AUTHOR> http://andrew.gibiansky.com/blog/genetics/crispr/

<comment><USER2> Great podcast on CRISPR from radiolab [1]

[1] [http://www.radiolab.org/story/antibodies- part-1-crispr/](http://www.radiolab.org/story/antibodies-part-1-crispr/)

<comment><USER3> One of the main arguments given against splicing human embryos on there was that embryos couldn't decide for itself whether it wanted it.

I think that's kind of absurd. The decision that impacts it the most has already been made for it - existence. If we take the Buddha's view that life is suffering, then it has been decided that is suffers. Compared to that, what sin is it to give it whatever advantages a few spliced genes can offer?

</comment></comment><comment><USER4> While the author is pretty clear that "only a passing knowledge of modern microbiology" is necessary, I think that understates some of the technical language in here. I really laughed at the line, "Silencing a gene with CRISPR/Cas is incredibly simple." Still, I learned a lot. This is the closest I've come to feeling like I know what's going on in CRISPR.

CRISPR has got to be one of the most important scientific achievements of the past few decades, right?

<comment><USER5> Yes. The next time some "What is the most promising technology?" thread pops up on reddit, you can safely post CRISPR.

Depending on how things go with the patent stuff and the technology itself, sooner or later this will absolutely transform our lives. We are looking at the incubation of a technology that may easily save millions of lives (over a long time frame).

Potential for misuse is near infinite though - imagine a privatized CRISPR inaccessible to the sub-$50 million/ year crowd.

The limitations of CRISPR really do appear to be few though. Lots of techniques and methods will be developed and figured out in the next years. It allows us near complete control over the most essential biology. And all that in vivo.

The road ahead is rough but I am confident that CRISPR can become the magic tool I just described. It will be black and white magic. Question is which will dominate?

<comment><USER6> Potential for misuse is near infinite though - imagine a privatized CRISPR inaccessible to the sub-$50 million/ year crowd.

I can imagine a lot worse than that. Imagine genetic engineering gets dirt cheap, and that does seem to be the direction we're headed. Novel pathogens are going to be a lot easier to design than treatments and preventative measures to protect against them. How do you stop the proliferation of bio- weapons? I'm thinking that would be about as easy as stopping the proliferation of malware.

<comment><USER7> One major difference is that you have to order your DNA typically from a third party provider and they can screen for pathogenic sequences. We could probably stop malware if we could screen all the code before anyone was allowed to run it. I think the current system is reasonably robust for stopping novel syn bio pathogens.

In my mind the big risk comes with home based DNA printers. There are several close to getting to market (eg [http://www.kilobaser.com/](http://www.kilobaser.com/)), at that point we lose control over what gets printed and then maybe there are concerns... though I do think creating a pathogen is really hard and most likely to end up killing the creator before anyone else.

<comment><USER8> It's _very_ hard to Figure out what a random piece of DNA will do just from the sequence. Combine that with other molecular biology techniques for combining, slicing, and dicing DNA, and there would be very little hope to do any sort of prospective screen.

<comment><USER9> > It's very hard to Figure out what a random piece of DNA will do just from > the sequence.

While it's certainly true that it's hard to determine the function of a DNA sequence from scratch, it's considerably easier to compare that sequence (or the sequence of the translated polypeptide) to other homologous sequences to see if it matches something dangerous.

I previously worked in a lab that studied _Bacillus anthracis_ , and we had a bit of trouble getting a major gene synthesis company [1] to produce a plasmid with a variant of _atxA_ [2], and _atxA_ isn't even a toxin, it's just a transcriptional regulator. We presumed that they just BLASTed [3] the sequence we gave them and threw up a red flag when it matched anthracis. So this sort of sequence-checking already occurs.

[1] [https://www.dna20.com/](https://www.dna20.com/)

[2] [http://www.ncbi.nlm.nih.gov/pubmed/8577251](http://www.ncbi.nlm.nih.gov/pubmed/8577251)

[3] [http://blast.ncbi.nlm.nih.gov/](http://blast.ncbi.nlm.nih.gov/)

</comment></comment></comment></comment></comment></comment><comment><USER10> _(Unfortunately, it seems like there is some debate over who invented CRISPR and should be awarded the patent for it.)_

Maybe the bacterium which first expressed a CRISPR sequence should be awarded the patent. We're just using the tools that nature invented for us!

<comment><USER11> Truly- When asked why he did not patent the polio vaccine, Jonas Salk responded by asking if you could patent the sun- it seems as though if the sun were discovered today, we'd have a legal battle over all of the attempts to do so.

<comment><USER12> > "When Jonas Salk asked rhetorically "Would you patent the sun?" during his > famous television interview with Edward R. Murrow, he did not mention that > the lawyers from the National Foundation for Infantile Paralysis had looked > into patenting the Salk Vaccine and concluded that it could not be patented > because of prior art – that it would not be considered a patentable > invention by standards of the day.

[http://www.biotech-now.org/public-policy/patently- biotech/20...](http://www.biotech-now.org/public-policy/patently- biotech/2012/01/the-real-reason-why-salk-refused-to-patent-the-polio-vaccine- a-myth-in-the-making)

> In the decades since, a great myth has grown to dominate the popular > imagination. Its name is "The Conquest of Polio," and Salk is its hero.... > This retelling of the history of polio, however, is largely a distortion. > The full, true story is far more complex. Its hero is Albert Sabin – for if > any one man conquered polio, it was Sabin, who developed the oral attenuated > live-virus vaccine. While Salk's vaccine did slow down the incidence of > polio among middle-class Americans, its cost and its requirement of three > injections and a booster meant that for years the disease continued to > affect the poor and others lacking access to proper medical care. It was > only after Sabin's oral vaccine, which was cheap, effective, and easy to > administer, was licensed for production in 1962 that polio could be fully > controlled in the United States.

[http://www.technologyreview.com/review/404390/the-myth-of- jo...](http://www.technologyreview.com/review/404390/the-myth-of-jonas-salk/)

<comment><USER13> [http://www.slate.com/articles/technology/history_of_innovati...](http://www.slate.com/articles/technology/history_of_innovation/2014/04/the_real_reasons_jonas_salk_didn_t_patent_the_polio_vaccine.html)

> There is an important footnote regarding Salk's statement that "there is no > patent." Prior to Murrow's interview with Salk, lawyers for the National > Foundation for Infantile Paralysis did look into the possibility of > patenting the vaccine, according to documents that Jane Smith uncovered > during her dive into the organization's archives. The attorneys concluded > that the vaccine didn't meet the novelty requirements for a patent, and the > application would fail. This legal analysis is sometimes used to suggest > that Salk was being somewhat dishonest—there was no patent only because he > and the foundation couldn't get one. That's unfair. Before deciding to forgo > a patent application, the organization had already committed to give the > formulation and production processes for the vaccine to several > pharmaceutical companies for free. No one knows why the lawyers considered a > patent application, but it seems likely that they would only have used it to > prevent companies from making unlicensed, low-quality versions of the > vaccine. There is no indication that the foundation intended to profit from > a patent on the polio vaccine.

> The decision not to patent the vaccine made perfect economic sense under the > circumstances. "The National Foundation for Infantile Paralysis was a > nonprofit, centralized research and development operation," says Robert > Cook-Deegan, who studies intellectual property and genomics at Duke > University. "They didn't need an incentive structure."

</comment></comment></comment></comment><comment><USER14> Can someone help me understand the main differences between CRISPR and traditional genetic engineering that has been done for many years now? My understanding is that we've had technologies to selectively modify DNA for some time, but perhaps it hasn't been as targeted or reliable as CRISPR?

One thing that stands out to me (especially from the radiolab episode) is that it sounds like CRISPR isn't just gene editing in the sense of engineering something in a lab; it's gene editing in an _already living_ organism. If DNA is anything like an organism's "source code", once the code is "shipped" (organism is conceived), traditionally we tend to think of that code as being locked/frozen. It sounds like CRISPR is akin to modifying the code _live_ \- "in production", so to speak. Is that a fair analogy?

Edit: to explain, when I say "in an already living organism", I'm referring mostly to a developed, multi-celled organism. I understand that traditional techniques also use living cells, but the radiolab episode makes it sound as if a full-grown adult human may someday get a live "DNA upgrade" \- at least to applicable portions of the body - via CRISPR, e.g. to remove a genetic predisposition for developing a particular disease. To me, that would be substantially different (in practical application) from genetically engineering something like a gamete or a single-celled bacteria.

<comment><USER15> Mostly, CRISPR/Cas9 reduces the cost of getting a custom endonuclease (molecular scissors that cut DNA at particular sequences). It is several orders of magnitude cheaper than alternatives, and it is also incredibly quick to set up! This makes it much easier to try more experiments. Also dCas9 (partly or wholly disabled Cas9) can be used to make the system the basis for multiplex gene targeting experiments that can be used to induce entirely new regulatory networks in one step! Wow!

So there is a lot of good but don't forget your question: haven't we had this for a long time? Yes, the techniques are fundamentally the same as others which have been used for a long time. Endonuclease and homologous repair are standard tools in genome engineering. It just costs much less to design custom endonuclease now. It seems like there is a bit too much hype about CRISPR/Cas9 techniques as genome engineering tools--- we are engineering genomes in exactly the same way as before. The scissors have changed but the glue is still endogenous to the organisms that we are engineering.

To my knowledge there has only been one case in which DNA was shipped as code to be the genome of a dead cell. Maybe someday we will be able to write large genomes. Until then nearly all the editing we do will be in living organisms, as it has been forever (even before CRISPR/Cas9).

<comment><USER16> Well said. I'll add some scientific esoterica, because it parallels software a little: we've even had custom endonuclease services for a while (TALENS[1]), which serve a very similar function. But they were hard to generate and difficult to work with. Companies like Invitrogen even sold a TALEN-making service, costing in the dozens-of-thousands of dollars to generate a TALEN for preclinical drug discovery use.

Then CRISPR came along. It was like the open-sourced, better-performing alternative to the cumbersome, proprietary software. Switching was a no- brainer, and it has handily become the future, if not the mainstream already.

[1][https://en.wikipedia.org/wiki/Transcription_activator- like_e...](https://en.wikipedia.org/wiki/Transcription_activator- like_effector_nuclease)

<comment><USER17> Right. My own PhD work was on designing custom transcription factors to bind to specific sequences (not even with TALENs- it tried to do full molecular dynamics to predict the binding constant for multiple different DNA sequences, which was absurdly expensive). It would have to be re-engineered once for each sequence; with CRISPR, you just provide a matching template sequence.

</comment></comment></comment></comment><comment><USER18> Will anyone here be _really_ surprised if it turns out ribosomes are duplicating machines designed by some alien race?

The entire process of reading the DNA code and turning it into proteins is just amazing.

<comment><USER19> I understand the downvotes, but the wonder here with biology that the OP has is well placed. I came into bio from DoD/Physics and am constantly astounded by what nature has made. I mean, it's been ~4 billion years and the generation to generation time is ~20 minutes (~1.1E14 generations total), so I think we all can expect a fair bit from nature, but still, she is really clever.

I do think about this as well. The complexity, the reliability, the ability for nature to do what she does even in the face of all the thermal noise and viruses and enviroment, it really seems like there must be someone making it happen. Alas, no though! As far as we can tell, it's all just evolution and chance on a planet wide stage with microscopic actors. If anything, I think this makes nature even more exciting and awesome (in the true sense of the word). That she did so much with so little is stupefying to me.

</comment></comment><comment><USER20> This actually raised an interesting thought to mind about the long-term ethical implications of lowering the barrier to entry for genetic engineering. What happens when anyone with a little know-how and $10K can use the techniques?

<comment><USER21> > This actually raised an interesting thought to mind about the long-term > ethical implications of lowering the barrier to entry for genetic > engineering. What happens when anyone with a little know-how and $10K can > use the techniques?

The barrier to entry for genetic engineering is already zero; but it has much less sexy names like "washing your hands" and "sex". DNA synthesis is just a matter of being more specific and deliberate about which biological organisms you keep around. Anyone is capable of selectively breeding bacteria, fungi, molds, or anything else. I think the reverse(?) question needs to be asked as well, which is what are the ethical implications of trying to restrict the ability to make DNA?

Here's some infotainment I guess: [http://diyhpl.us/wiki/diybio/faq/news/](http://diyhpl.us/wiki/diybio/faq/news/)

<comment><USER20> I should have been more specific, when I said 'genetic engineering' I was referring to using techniques like CRISPR to perform gene modifications in animals and humans.

No one with the resources required currently would surreptitiously test a new gene on another human, what happens when the resource and knowledge barrier drop?

</comment></comment></comment><comment><USER22> I think this explanation is missing the real explanation of why CRISPR is useful.

I want to take a crack at it. Let's say we want to change in the genome the sequence (where each of the 'letters' represents a somewhat long stretch of base pairs):

ABCDE to ABC'DE

you would normally create the sequence

BC'D

in vitro and put it into the cells. The organisms contain mechanisms to match the B & D sections and thus 'swap out' the C section for the C' section.

Note that C could be "" which would make the process a straight insertion. C' could be "" which would make the process a straight deletion. C and C' could be a single base pair, which would mimic a point mutation, etc...

However, you don't have TOTAL control over this process, it's stochastic, and doesn't have 100% efficiency. So you have to do something clever to make sure you have what you want. Typically that involves inserting resistance to a chemical factor (e.g. antibiotic). So for insertions (if you don't mind a dirty insertion) it's fine, but for other transformations like mutations and deletions, you might have to be clever, and say, do C -> C' -> C'' where the C' includes the selection factor. And C'' is chosen either because it lacks a toxic factor that we put in alongside C' or by doing a reverse selection where we pick clones and test to see if they die (and keep some of the originals in case they pass the test).

This process generally works quite well in most microbes with small genomes (E. coli requires a tweak to the process). It is basically effortless with yeast.

With higher eukaryotes it's not quite so simple. A competing process is inserting the BC'D sequence _elsewhere in the genome_. It's not entirely clear why this is such a huge problem, but likely it's because of the increasing complexity and size of the genome. If C' contains a selectable marker, it becomes difficult to distinguish between what you want (ABC'DE) and just BC'D somewhere random in your genome. Both are resistant. And the process becomes bogged down by the need to isolate single cells, propagate them, and check to see if your strain has the substitution you want (relative easy, just a PCR reaction) and no other substitutions elsewhere in the genome (haaaaaaard).

The CRISPR advantage is that just before you add BC'D to your cell you create a scission somewhere in C so you're left with ABc//cDE - and what this does is triggers the cell repair system to search for B & D sequences to hook into. Naturally it will find BC'D. Well, if it doesnt, usually a fragmented chromosome will also result in death of the cell, so you're virtually guaranteed that the surviving cells have ABC'DE. With this, the rate of successful targetting so exceeds the rate of random insertion that the necessity to check is basically eliminated (or at least you don't have to search through so many clones to pull out a total success).

The net effect is that for many higher organisms genetic manipulation becomes much much much easier. YMM(still)V with some plants which have high level of repeats within the genome.

</comment><comment><USER23> I've been studying biochem as a hobby and have been hearing CRISPR off and on but never really heard a good explanation until now. I don't fully understand everything that was said but at least I have a general picture of going on. Thanks for writing this.

</comment><comment><USER24> is there any practical approach on the horizon (or here) that allows scientists to apply crispr throughout all the cells in a living organism? I get how this works with a single cell, but typically that's only useful for either very very very small or very very very young individuals (right?)

<comment><USER22> No. For permanent genomic changes you have to select what you want. For precise edits, there's usually a counterselection (so it takes two hits). The efficiency of the process is still low. You have to be willing to throw away a lot of cells to get precisely the correct one. One way to think of it is a big component of what CRISPR does is to make it easier to find the good edits (although it does also make good edits more likely).

</comment></comment><comment><USER25> This will win the Nobel</comment>


Performance Bugs (2011) [video] - <AUTHOR> https://www.youtube.com/watch?v=89qiHoDjeDg

<comment><USER2> Really good talk. In today's modern web apps the most common types of performance bugs tend to be either external http requests (buried inside of APIs that often times you're not even aware of the multiple round-trips), or inefficient DB queries (mostly thanks to abstractions by ORM's). There are exceptions, but in most typical modern web apps performance bugs live in i/o and network calls, not in native code.</comment>


Show HN: Automatune – Procedural Music Editor (Mobile and Standalone) - <AUTHOR> https://github.com/GabrielePicco/Automatune <comment><AUTHOR> I have just published a procedural music editor developed in my spare time. This is the first version, if someone goes to download it and get me some feedback I would be grateful.</comment>


Ask HN: When to Form LLC/Bank for Side-Projects? - <AUTHOR> There have been a handful of topics on AskHN recently regarding starting an LLC [0], stripe atlas, banking for side-projects etc; that I have found helpful. I was curious to ask others how they handle new business setup for working on side-projects.
As I've worked on dozens of side-projects over the years it never seemed logical to open a new LLC and new bank account for each one. It made more sense to just build them as 'myself' and then if they ever started gaining traction/revenue to start exploring splitting it out into its own business/banks.
Now I fear that could create issues down the road for both liability and accounting purposes by having my personal self/banks attached to it even during a brief amount of time. What is the correct way to handle this?
One option I considered was starting an LLC/Bank for 'all side-projects', and then if/when a particular one started producing revenue I split it off into a separate business/bank. This I suppose adds a layer of liability and accounting complexity between my personal accounts, but I'm not sure if this solves the issue completely.
Any suggestions on proper way to handle?
[0] https://news.ycombinator.com/item?id=20009534 <comment><USER2> I strongly recommend waiting until you get to one of these stages:

1\. Formal agreement between partners on project - Time is your most valuable asset so if you are investing into the project with additional persons it's best to formalize structure once you've made an agreement and are at a place where you are each committing 10+ hours per week

2\. Monetary Investment is being made - At the point that meaningful monetary investment is made which I would pin at $10,000. The cost to formalize an LLC in California is $800 + minor costs so setting aside 10% of your initial spend on formalizing is money well spent

3\. Take on any outside investment from anybody - You need an ivnestment vehicle so the second you decide to raise $5,000 from your Uncle Larry it's time to open the LLC

I really like your idea of unifying projects in 1 LLC then spinning them on success. You can also create a unique DBA for each project and this is very effective.

Hope this helps.

Best, SS

</comment><comment><USER3> It's really hard to give you proper advice without understanding what these side projects are or how many people use them.

It's all about managing risk and reward so it totally depends on how much you are charging, what the product or service is, and how many (and what type of) people are using it.

Forming an LLC that holds all of your side projects isn't a massive expense and it can actually make things a lot easier for you. If your LLC has a bank account and you fund it for expenses and take all revenue through it, accounting will be much easier than interlaced debits and credits in your personal bank account.

Skimping out on legal is a big turn off to investors as well so it depends on whether or not you are trying to grow any of these projects into businesses. LLCs are super flexible structures that can be easily modified later should you need to spin out a project into it's own company, change to C/S corp, or use a series LLC (not all 50 states recognize) to separate assets or liabilities.

Another thing to consider is your personal assets and risk. If you own a home, make good money, or have a sizable amount of assets, spending a few hundred or few thousand to protect them seems logical.

None of this is legal advice, I'm not an attorney.

</comment><comment><USER4> You're on the right track. A couple of rules of thumb:

1\. An LLC's liability protection kicks in when you start to deal with others.

2\. For the first LLC especially, you should measure the value of what's at risk, not the 'profit' or value of the business.

In (the many) states where LLCs are cheap, it makes sense to put side projects into a container sooner, not later, especially if you have significant personal assets. Your personal assets are probably worth a few hundred bucks to protect, even if you don't have outside investment.

It's a more difficult question to decide when to split out a particular side project into its own LLC.

</comment><comment><USER5> I've formed and run an sole member LLC, S Corp and C corp. Sometimes I get people asking me about forming a company to do EBay, Amazon FBA, and other side gigs. Here is basically what I tell anyone who asks (cliff notes version), off the top of my head:

1\. If it's not making money, it's a hobby.

2\. If it's making a little bit of money, don't form an business entity. Just do it as a sole proprietor - this is basically the easiest thing to do. Just open a separate bank account for the business and Schedule C on your tax return. Save ~25% of income in savings account for self employment taxes and taxes. Converting to an LLC, S Corp, etc., is always a possibility later.

3\. Your choice of business entity will have consequences down the road that your attorney or accountant may not explain to you up front. For example, I did most of my consulting through an LLC on the advice of an accountant who convinced me to give up my S Corp. When my wife and I went to purchase our first house, they convinced me drop off of the mortgage application because they didn't like the fact that I was "self employed." If I had kept the S Corp, I would have W2 wage income and they wouldn't have batted an eye.

4\. The rules regarding business entities vary state to state. Some states will allow a single member LLC and single owner S Corp; others may not. Make sure you understand your state laws and the taxes. Some states have an income tax; others have franchise tax. You can form the corporation in another state, but you will likely have to register as a foreign corporation in your state. For a few years my corporation was chartered in Delaware, and I would register in a state when I had business activity there.

5\. The IRS has no sense of sympathy or humor when it comes to payroll taxes. State governments are even more fanatical about getting their money, on time. Penalties can be severe. I was depositing payroll taxes quarterly and was surprised when they wanted me to start depositing monthly. They notified me with a 17% penalty.

6\. Understand that filing a tax return can trigger the requirement to keep filling out tax returns even if you don't owe anything. If you shut down the business, make sure you spend the time and be persistent in closing tax accounts or you will get notices for _years_. Don't trust it when a government employee says the account will automatically get closed.

7\. Understand that with an S Corp or LLC you will have to do the business tax return first, before you do your own tax return. If you are an minority owner of a corp, make sure they get the tax returns done on time and you won't get surprised. Once you get surprised with a $20k tax bill...

8\. In some cases a C corp can make sense, regardless of what everyone says.

9\. Make sure you setup a proper retirement account and make contributions. This can payoff over the long term, even if you business isn't super profitable. Make it a priority.

I have plenty more, but that's a few thoughts.

<comment> pickle-wizard I would like to reiterate point 6 as I made this mistake with a past business. I was filing the quartly sales tax reports with 0 dollar sales. THen I just stopped.

4 years later me and my partner get a letter from the state comptroller wanting to know why we hadn't been filing. We were looking at several grand in penalties. When we went to the audit thankfully we got an understanding auditor who was able to close the account retroactively and remove the penalties.

</comment></comment><comment><USER6> Lawyer here. But not your lawyer.

Anytime you have potential liability, you should form a separate legal entity and bank account. Look up "piercing the corporate veil." Also, depending on your income, a C Corp in Trump Era might save you about 40% on your taxes. Personal rate vs Corporate. So why not do that?</comment>