Predicting, Decrypting, and Abusing WPA2/802.11 Group Keys [pdf] - <AUTHOR> https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_vanhoef.pdf <comment><USER2> WPA2 is toast.

Ref to the CVEs that will make a lot of network admins hate Monday: [https://twitter.com/nick_lowe/status/919527451570638848](https://twitter.com/nick_lowe/status/919527451570638848)

And some background: [https://eprint.iacr.org/2016/475.pdf](https://eprint.iacr.org/2016/475.pdf)

<comment><USER2> Also worth nothing that the attack in the OP is on TKIP, but the KRACK attack that will be revealed tomorrow is based upon problems with the RNG (the example RNG, which apparently everyone used, is trivial to break and the protocol is also kind enough to provide you with a huge chunk of the entropy used in seeding the RNG. D'oh!)

<comment><USER3> This comment should be made the top comment. Thanks for the information.

I guess this implies not "only" passive eavesdropping but also network access in environments without a MAC address filter (not that these can't be spoofed regardless)?

<comment><USER4> Spoofed yes but they're hard to guess in advance without prior knowledge of the device's MAC address.

<comment><USER5> MAC addresses are broadcast in the clear regularly, so any device doing that without some randomization is ripe for the picking.

<comment><USER6> Worth noting also: You vannot randomize it when connected to a Wi-Fi network.

</comment></comment></comment></comment></comment></comment><comment><USER7> "We initialize the random number generator with the system uptime, then use it to make crypto keys" \- really?!?

"We also publish the system uptime in an unencrypted broadcast message to save you the effort of even bruteforcing it".

Does nobody do security reviews on this stuff, or are these weaknesses there deliberately?

The line between incompetence and malice really is thin here...

<comment><USER8> And on a device equipped with a radio, it's not very hard to generate entropy.

<comment><USER9> The radio might not be exposed to the OS. If it's a Fullmac device, you usually don't have access to the radio stuff. Even with Softmac, there's not a guarantee.

<comment><USER8> I am sure that's a problem on the client, but on the AP, the manufacturer controls both the hardware and the OS.

<comment><USER9> Not necessarily. Again with fullmac devices you don't control the complete hardware.

<comment><USER8> Yeah but if you are Cisco, Netgear or DLink, and tell your supplier that you want a function to access noise in the signal, or you want to get a true random number based on that noise, I am sure they could accommodate in future generations of their chip at an insignificant cost.

</comment></comment></comment></comment></comment></comment><comment><USER10> This is a 2016 paper. Tomorrow's details are apparently about forcing nonce reuse in most WPA2 implementations. Don't let the date fool you into thinking it's old news being discussed!

<comment><USER11> Details for tomorrow's WPA2 attack will be published to: [https://www.krackattacks.com/](https://www.krackattacks.com/)

</comment></comment><comment><USER4> Here is a good summary of the situation right now: [https://www.alexhudson.com/2017/10/15/wpa2-broken-krack- now/](https://www.alexhudson.com/2017/10/15/wpa2-broken-krack-now/)

</comment><comment><USER12> I understand that the info to answer my question may not be public yet. I would greatly appreciate an an answer by someone who can explain when it is.

If an attacker had recorded encrypted WiFi traffic in the past and then performed one of these attacks could they see the traffic? (I know TLS is used for a lot of traffic, but in time that will be broken too.)

It seems to me that a patient attacker could gain a lot of sensitive info given enough time. Is this assumption flawed? I would love to hear why/why not. (Nonces make decryption of large amounts of TLS traffic impractical?) What about the impact of just knowing DNS lookups? (Real world info on DNS caching? Does DNSSEC stop this? Is it widely implemented?) What if a data broker recorded a lot of encrypted WiFi traffic at a public place like a mall? (Could they learn MAC addresses? mDNS device names? DNS lookups? I bet a lot of tracking cookies and other advertiser tokens don't bother with TLS which could get them emails and more.)

Someone recording encrypted WiFi traffic from a sensitive network may have enough motive to do something this long-term and the attack would be (electronically) undetectable. Most people rarely change their passwords and at a minimum this would give an attacker knowledge of the internal network, intranet sites, and services used by targets.

<comment><USER13> I expect they could, yes; WPA2 doesn't offer forward secrecy.

But WPA2 never offered much anyway. If you're on mall wifi, you can _already_ see unencrypted traffic for everyone else, because the client keys are derivable from the shared passphrase (which presumably everyone at the mall has been told) and overhearing the four-way handshake when someone joins. And! You can even fake a disconnect message that forces the four-way handshake to happen again, if you weren't around when the client originally joined.

All of which is to say, WPA2 in passphrase (PSK) mode never actually provided meaningful encryption against other people on the network. :( Someone forgot to tell the protocol designers that Diffie-Hellman exists. Using Diffie- Hellman would achieve both removing the exploit where you observe the four-way handshake, and providing for forward secrecy too.

<comment><USER14> > * If you're on mall wifi, you can already see unencrypted traffic for > everyone else*

Without contradicting your observation, I want to mention that virtually anything important you do on the Internet these days--from online banking to Google searches to reading Hacker News--is protected by a second independent layer of encryption: HTTPS. I'm not excusing the WPA2 flaws, but I do think that your bank info, web searches, and Hacker News comments are secure even at the mall.

If someone can offer a credible explanation of why online banking or other HTTPS activity is insecure on public wifi, I'd like to hear it please.

<comment><USER15> If you don't have extensions that force HTTPS on all content, you could, for example, get served a malicious image file.

from the article:

> they won't be able to pretend to be a secure site like your bank on the > wifi, but they can definitely pretend to be non-secure resources

</comment></comment></comment></comment><comment><USER16> The article says that only WPA2-TKIP is vulnerable to the downgrade, therefore running WPA2 with only AES should be fine.

<comment><USER17> Stay tuned for tomorrow's KRACK announcement, then.

</comment></comment><comment><USER18> Here's the CCC talk with the author of this white paper: [https://www.youtube.com/watch?v=KJWd- _BDC_g](https://www.youtube.com/watch?v=KJWd-_BDC_g)

<comment><USER2> There are also a BlackHat Europe 2017 paper that is apparently a strong foreshadowing on the attack.

</comment></comment><comment><USER19> Here's an article on Ars about it: [https://arstechnica.com/information- technology/2017/10/sever...](https://arstechnica.com/information- technology/2017/10/severe-flaw-in-wpa2-protocol-leaves-wi-fi-traffic-open-to- eavesdropping/)

</comment><comment><USER17> Well, if there's one piece of (somewhat) good news around this and [https://www.krackattacks.com/](https://www.krackattacks.com/), it's that TLS and VPNs will become even more common.

Where did WEP and WPA2 come from, anyway? What's the historical reason we aren't all using TLS to connect to our APs?

<comment><USER5> > What's the historical reason we aren't all using TLS to connect to our APs?

Because it's insanely impractical for home use? Hey, here's your new WiFi router. Just install this new root CA on all your devices, create a device cert for each machine and install that very as well, and don't forget you need to re-do this every year...

<comment><USER20> Trust keys on first use. Like SSH.

[https://www.tedunangst.com/flak/post/moving-to- https](https://www.tedunangst.com/flak/post/moving-to-https)

"So how does one verify that the downloaded cert is the original? The same way the CAs do. Perform a DNS lookup, make a web request, trust the result. The addition of HPKP would indicate that people find the CA model untrustworthy, solving the problem with trust on first use key continuity. Why not cut out the middle man? Protesting the CAs is admittedly pretty futile, but if I can't do it, who can?"

<comment><USER21> The router isn't the issue here the clients are.</comment></comment></comment></comment>


Tax sugar, alcohol and tobacco to help the poor, say experts - <AUTHOR> https://www.theguardian.com/society/2018/apr/04/sin-tax-sugar-alcohol-tobacco-to-help-the-poor <comment><USER2> This is by far one of the dumbest ideas I've ever heard. That is not why we have taxes.</comment>


Who's at risk for obsessive healthy eating? Toronto research sheds light - <AUTHOR> https://www.ctvnews.ca/health/who-s-at-risk-for-obsessive-healthy-eating-toronto-research-sheds-light-1.4421908 <comment><USER2> It's chilling when you see a description of what you are doing, online, in a random click that you just made.

I have OCD, and hide it well. Looks like I have ON and have not hid it well at all. I run obsessively, eat extremely clean and have been struggling to even eat things that are outside my "normal" diet ever since the stress at work and relationships have increased.

I figured it was something I needed to research when I felt _bad_ for eating a sandwich after a 56 mile bike ride. But I never did, maybe because I didn't want to know the answer.

Oh well, the more you know...

My OCD has increased as well. They're definitely connected.

Edit: grammar and some spaces.

<comment><USER3> Anorexia nervosa and excessive exercise seem to be causally linked.¹

If you want to cure someone of anorexia, you will usually have more success if you both eliminate the excessive exercise and address the eating behaviour at the same time.

For some reason, it seems as if each behaviour somehow supports the other, and to break the cycle, you have to address both.

Also if you or anyone has an eating disorder, take it seriously and seek treatment. Eating disorders have the highest death rate of any mental disorder.

1: When researchers restrict rats' food intake while giving them unlimited access to a wheel, the rats start running excessively. Paradoxically, these rats opt to continue running rather than eat during the short intervals of time food is made available to them. If allowed, they will literally run themselves to death. ([https://www.verywellmind.com/excessive-exercise-eating- disor...](https://www.verywellmind.com/excessive-exercise-eating-disorder- symptom-4062773))

<comment><USER2> I wonder why its unethical to test such things on human beings. I'm assuming it's unethical, because there rarely seems to be any damn work on this using humans.

Those rats ran themselves to death, will we humans? We share about 92% of the genes[0] (on the first google attempt), what changes does that giant 8% contain?

Just pick up people like me, and make us run and give us food.

I doubt we will object if it means there's a possibility that we might help ourselves.

Are they afraid they'll make it worse? Sure that's a possibility, but that's the price to pay. I'm willing to pay that price if it means people after me, who have this wire crossed in their brains will be served better healthcare in the future.

Some experiments might not work, but we've just discovered another way to _not_ make the lightbulb, but the good news is that the lightbulb _will_ be made if we try n times.

[0] [https://blog.23andme.com/23andme-and- you/genetics-101/geneti...](https://blog.23andme.com/23andme-and- you/genetics-101/genetic-similarities-of-mice-and-men/)

<comment><USER4> It's far cheaper to run an experiment on 100 rats than 100 people, and it's unethical to let people run themselves to _death_ obviously.

It's not unethical to watch people run and eat -- Gatorade/UF exercise lab does this stuff all day long. Obviously it's unethical to let you continue to do so if adverse health effects are observed.

<comment><USER3> > it's unethical to let people run themselves to death obviously.

It's also unethical to let rats run themselves to death, and it wouldn't pass an ethics review board if you suggested an experiment like that these days.

<comment><USER5> So the truth is that rats could run themselves to death (seems unlikely) or maybe could stop at some point before, when some metabolite reachs some level or falls under some level. Impossible to know it because... taboo.

Even if this information could help to understand better anorexia nervosa in humans.

Maybe we should do the experiment with running thumbleweed instead.

</comment></comment></comment></comment></comment></comment><comment> relative-energy I'm glad there's a label for this that's not attached to the previous connotations of "anorexia." I'm a guy who struggled with eating disorder symptoms for most of my life, and hid them for fear of attaching AN stigma to myself.

Last year I got serious about researching the biology of eating disorders, and I'm convinced now that in 40 years we'll think of anorexia and its cousins more like type I diabetes than a mental disorder.

For example: did you know that it's possible to induce self-starvation and hyperactivity (hallmarks of eating disorders) in mice [1]? It's been known to science since the 1950s, but this fact is curiously absent in popular understanding of eating disorders.

This new understanding led me to start a recovery project, and happily it's working out: I've finally got relief from the awful mental fixations (like those described in this article).

[1] [https://relative- energy.tumblr.com/post/183390573416/activit...](https://relative- energy.tumblr.com/post/183390573416/activity-based-anorexia-and-animal-models)

<comment><USER6> Oh this is interesting. This behavior is fairly common knowledge among cat people: if you have an adult cat that's being persistently hyperactive and displaying increased hunting/pouncing in a manner that's out of character for your cat, you need to take your cat to the vet for a checkup, your cat probably has dental problems and isn't eating.

What I'd like to know is why this reaction isn't more common among humans. I'm a fat person who's tried calorie restriction and all it does is make me tired and depressed. I suspect there's a good reason for that, and it has a lot to do with why I'm a fat person in the first place.

<comment><USER7> > What I'd like to know is why this reaction isn't more common among humans. > I'm a fat person who's tried calorie restriction and all it does is make me > tired and depressed. I suspect there's a good reason for that, and it has a > lot to do with why I'm a fat person in the first place.

There're interesting stories about people changing their weight after a stool transplantation, without changing their diet.

The bacteria in the gut seems to have a deep impact how food is utilized, even which kind of food is preferred and how you feel eating it, but it also seems to work the other way around, that the food effects the kind of bacteria in the gut.

It makes perfect sense to work this way, on one side you prefer food you can better utilize, on the other your body is able to adapt to the available food.

So changing the bacteria eating different food should also be possible, but the change might be quite unpleasant, you certainly won't feel that well, it might take some time and you need quite a bit of will power to get through.

<comment><USER8> Unfortunately the studies on stool transplants didn't replicate.

</comment></comment></comment></comment><comment><USER9> > They also discovered that vegetarians and vegans were at higher risk.

Surely it's far more likely that the causation goes the other way? Or is there a hypothesis that trying vegetarianism promoted overthinking / overcaring about diet?

I suspect this isn't very specifically an eating disorder, but that it's an obsessive compulsive or zealotry disorder where food just happens to be a target.

<comment><USER10> Sounds like something that requires further research, however, I do see how vegetarians / vegans (or anyone following a specific diet for that matter) become a lot more mindful of what they eat, or what they "are allowed to" eat.

</comment></comment><comment><USER11> Questions I had after reading the article:

1\. Is there any reason why these researchers are focusing on an unhealthy obsession with healthy eating, instead of an unhealthy obsession with [x: x ∈ anything], or just unhealthy obsessions in general?

2\. Are there enough people with this disorder to classify it as a disorder?

3\. Why are "Lacto-vegetarians" at the highest risk? What is it about drinking milk that makes people want to be extremely healthy?

\----

Answers I received after reading the link to the University Press Release:

1\. It's basically a disorder for people whom are relapsing from a previous eating disorder. Although it's gender-neutral for some reason.

<comment><USER12> You could classify lots of things as 'unhealthy obsessions' but then you'd just have a group of disorders, it wouldn't help you treat them. Clearly even two kinds of obsessive eating patterns are different enough to warrant different analysis. For example, there are a great many more practical ways you can act on ON than AN, and being health-obsessed might have less social stigma so the patterns leading to it might be harder to pick out as problems. If you want to treat these people on their terms and in ways that make sense, you have to drill down and deconstruct the specific phenomena.

There is a place for general obsession research, of course, but examining why people congregate around this one is obviously helpful to that goal anyway. What exactly about healthy eating makes it attractive to obsessive tendencies? The commonalities and differences compared to AN are surely going to be valuable.

We programmers like to abstract over things, but tons of good work in science involves just having a go at at one thing until it is better understood.

</comment></comment><comment><USER13> This is tricky. If you believe that glycemic variability (or avoiding insulin spikes) is a major factor in longevity, or if you believe the same for periodic or intermittent fasting, it will in fact "interfere with your normal life" or "make it hard to go out eating with others" as the researchers described. But those challenges are still the right thing to do if you subscribe to that science.

I think the researchers are imaging hardline discipline and re-structuring of normal dining affairs without any element of "obsession", even though the latter is probably required at some dosage to be effective, in the same way you obsess over, say, technology X when you need to be good at it.

<comment><USER14> Even if you do accept that disordered eating behavior leads to a longer life, that doesn't mean that it's the right thing to do. If someone is spending years of their life with increased social isolation, decreased free time, and decreased enjoyment of food, just to live marginally longer, is that a rational choice?

For me, it wasn't a rational choice at all - it was an anxiety response to food with a good justification (health) that people around me were willing to accept. In retrospect, I realize how much I was missing out on. Life's much better now that foods something I can enjoy and now that eating can be a social experience.

<comment><USER13> I can't accept the label "disordered eating", given it's based on how people ate for millennia and the underlying mechanisms therein.

There's of course room for middle ground. For example, I had a dinner I cared about, the host cooked lasagna, and I didn't want to reject the host's cooking or draw that kind of attention to myself. I know you can render your body in an insulin sensitive state if you do a muscle-glycogen depleting workout before, so I just did some weights after work and could enjoy the gathering guilt free.

Definitely about health span too, not just lifespan. Ie invest now so at 60 you feel like 40, and can pick up (great)grandkids let alone be able to tie your shoes in your 90s.

<comment><USER8> Disordered eating isn't about the eating. It's about the thought process and obsession behind it.

So the thought process you described is similar to orthorexia except the feeling of guilt is more powerful so it has a more powerful effect on behavior. For instance missing loved ones birthday's and avoiding go outing much at all in order to make sure you only eat the healthy food.

</comment></comment></comment></comment><comment><USER15> There is no need to obsess over anything when you better your habits. You will eat good, because that'll be your "standard", your habit, your go-to mode, your default.

If you only eat good/clean when you are pushing yourself to eat clean, you are doing it wrong and eventually you'll give up and gain back all the weight. Inevitable.

Also, as someone that has very low bodyfat (6/8 pack for years), there is absolutely no need to eat clean 100% of the time.

I'd say that if you eat 90% cleanly of the time, you are golden.

There are ways to make your food delicious without adding huge amounts of calories (think of spices, etc.)

All it takes is some common sense, and some (very little) knowledge of nutrition to eat healthy. I would say that anyone can learn this, in less than a month.

Also, I suggest anyone (that hasn't done this) to count their calories for a month, and be meticulous about it - you _will_ learn a lot. Afterwards, you will _not_ have to count calories - your estimation will be good enough.

About the habits and "converting" to a better lifestyle? That I don't know. I don't understand why is it so hard for people. It seems like it is, even for people that know everything about it. That I can't explain.

<comment><USER16> > There is no need to obsess over anything when you better your habits.

That's not how orthorexia nervosa works. It's not an "obsession" in the colloquial way you're using the term but an actual pathological obsession. A diagnosable mental health condition. Your comment is incredibly insensitive (I hope because you only bothered to read the title) and is the equivalent of telling someone with a cold that there's no need to cough.

<comment><USER15> I stand behind what I wrote, cause that's the truth. I can't understand anyone being offended by it.

Not a fan of the way we are blowing things out of proportion so much these days.

Eating right is not that difficult. It's not difficult AT ALL. The mere fact that we are discussing this is insane, to me.

There was a point of time in history where civilizations routinely starved to death - THAT was difficult.

Having the most abundant choice, and voluntarily picking the wrong one, all the time, all day every day - I just can't sympathize with that and call it "difficult".

Especially if you know what you are doing. And you must know, cause you'd figure it out by the results pretty quickly. (Not _you_ in particular, it's a general statement)

</comment></comment></comment><comment><USER17> I don't understand why the general tone of this article is "Did you know disordered healthy eating is possible" but the review of literature found that most of the studies are of poor quality, and furthermore the DSM does not recognize this condition as an eating disorder.

Am I missing something or isn't this putting the cart before the horse?

<comment><USER12> If you were trying to turn your scientific community around and make them pay attention to an issue when they hadn't been, isn't "Guys this thing is real" the tone you would take? The lit review is used to show that not enough research $ are being poured to get good science, but you can't convince the $ to flow if people don't think it exists. You don't have to prove the disorder exists to a peer-reviewed standard before they let you try to do exactly that. You can start with anecdotes if you want. These folks started with a meta- analysis of risk factors, which looks fine to me.

</comment></comment><comment><USER18> I became obsessed with label-reading and healthy foods because I had a serious problem with feeling ill from food. It turned out it had nothing to do with organicness, preservatives, additives or much else besides that I had undiagnosed celiac disease and a couple food allergies.

I was a vegetarian for a while because I found I felt better. This was probably a coincidence related to the meals I prepared being gluten-free.

"They also discovered that vegetarians and vegans were at higher risk." seems backwards - isn't it more that hypertrexia makes one more likely to become a vegan or vegetarian?

</comment><comment><USER19> There is a question as to whether this is a real disorder. Eating healthy and convincing others to do so isn't a sin.

[https://nutritionfacts.org/video/is-orthorexia-a-real- eating...](https://nutritionfacts.org/video/is-orthorexia-a-real-eating- disorder/)

<comment><USER20> Whenever researchers talk about any mental disorders you need to add the phrase "...which interferes with their day to day life, and causes harm or distress".

These people are not eating healthily, they have an obsession with "healthy" food that interfere with their day to day life and causes harm or distress.

That harm may be from something like REDS (Anna Boniface has written useful stuff about that), or it may be over-training or food restrictions.

<comment><USER4> Sometimes 'disorder' means "behaving in a way that annoys other people".

[https://www.mayoclinic.org/diseases- conditions/personality-d...](https://www.mayoclinic.org/diseases- conditions/personality-disorders/symptoms-causes/syc-20354463)

<comment><USER20> For information about the label of PD I like _Meeting the Challenge, Making a Difference_ , because it was coproduced by people with the label.

[https://www.crisiscareconcordat.org.uk/inspiration/meeting-t...](https://www.crisiscareconcordat.org.uk/inspiration/meeting- the-challenge-making-a-difference)

I think you've been unfairly downvoted. I don't think you're saying "people who have this label are annoying", I think you're saying "health care professionals who struggle with a patient are likely to say it's the patient's fault, because that patient has a PD".

<comment><USER19> Isn't talking about downvotes prohibited on here?</comment></comment></comment></comment></comment>


Email transparency - <AUTHOR> https://stripe.com/blog/email-transparency <comment><USER2> I've known companies that had pretty good email policies....until they got sued and every email debate was turned into the evidence that they knew X or considered Y or thought about Z and were therefore guilty. :-(

<comment><USER3> Hi (I'm Stripe's lawyer). Litigation discovery is something that any company needs to think about when crafting its email policy. But whether an email goes to a few individual recipients or to a broader list won't impact whether it needs to be disclosed in discovery. The seemingly private email between two or three co-workers will almost always persist in someone's inbox for a very long time, and ultimately be discovered.

In most cases, the kinds of emails you are talking about -- where someone says something that can be mischaracterized or otherwise damaging to the company in the future -- are a result of poor judgment. And that's where I think Stripe's policy has a distinct advantage. When people know they're sending things to a broader group of recipients they tend to be more thoughtful in how they communicate and just avoid saying many of the imprudent things that would be troublesome in future discovery.

<comment><USER4> Random question relating to both e-mail and the law...

So everyone puts these signatures/disclaimers on their e-mail now which say (paraphrasing):

> This message is confidential. It may also be privileged or otherwise > protected by work product immunity or other legal rules. If you have > received it by mistake, please let us know by e-mail reply and delete it > from your system; you may not copy this message or disclose its contents to > anyone. Please send us by fax any message containing deadlines as incoming > e-mails are not screened for response deadlines. The integrity and security > of this message cannot be guaranteed on the Internet.

Or similar. Do these things actually have a legal purpose/meaning? I mean can you really enforce a contract the other person hasn't agreed to? Can you really demand what THEY do with an e-mail YOU sent them?

A few years ago I thought this stuff was silly but now a lot of big companies are doing it and I can only assume these companies have a legal department...

PS - If you were to reply I wouldn't assume it was legal advice, I am asking you as a person who just happens to be a lawyer, not as a lawyer. :)

<comment><USER3> I think people do these things mainly to deal with inadvertent disclosure (e.g., an incorrectly addressed email) or further downstream distribution of an email. The idea is to have some indicator that the original sender meant the communication to remain in confidence (which may be required to maintain, for example, attorney client privilege, or to preserve trade secret protection). When they are affixed automatically to every email (as they are by many firms), I really doubt they work. I'm not aware of any case where the existence of this kind of disclaimer has been a factor, and I suspect most people put this in the "it couldn't hurt" category, rather than really thinking it'll be effective. Would be interested to hear if anyone is aware of evidence to the contrary.

<comment><USER5> They are effectively worthless if it can be shown they are added automatically to every mail. Privileged communication requires something explicit or genuine intent, i.e. the sender writing 'privileged' at the top. It actually can be quite bad if it's shown that the privileged communication was abused (either in terms of piercing all veils or censure).

My experience is people add these signatures because they see other people doing it and they assume it's a good practice or seemingly professional. It may be some inexperienced lawyers recommend it so they have something to say about email policy. It's not hurting anyone beyond eating up mail quotas, right?

</comment></comment></comment></comment></comment><comment><USER6> "We use Gmail for email and Google Groups for lists."

"What we have today works pretty well for our current size—around 45 people."

So if I can manage to get the Google authentication credentials for just one of Stripe's 45 employees, I can get access to the vast majority of Stripe's email? I hope they require two factor authentication.

<comment><USER7> Yes, we do require two factor auth, and we're very stringent about laptop security generally. We're pretty cognizant that, even at a less open company, compromising any employee can generally be used to obtain a surprising amount of sensitive company information.

<comment><USER8> In light of this issue, what have you done to restrict the amount of harm that even a trusted employee can do? I'd be happy to learn that after a suitable time period for disputes, literally _no employee_ would be able to provide any demographic info related to a particular charge. You can't harm my customers if you don't have access to their data.

</comment></comment></comment><comment><USER9> Very cool experiment. How do you deal with less technical people in the team who don't find it fun to tweak email filters all day long? Is your tooling to the point of polish where that's no longer an issue? Or are you simply at a stage where you don't (yet) need to hire non technical people? We've found this to be the main obstacle in getting full adoption for things like this.

<comment><USER10> We help them create their filters when they join. We'll hopefully make this part more streamlined over time.

<comment><USER11> The Google Groups webface is also getting good enough that you can keep up with some lists without having to actually subscribe to them via email.

<comment><USER7> Speaking as a non-technical person at Stripe, the google groups web interface good, but not great. Andreas on our team built a filter manager, which makes it much easier: <https://github.com/antifuchs/gmail-britta>

I was all set up with filters on my first day and then made tweaks over my first couple of weeks to improve efficiency.

</comment></comment></comment></comment><comment><USER12> This is cool. We had cargo-culted the idea of open email and CCing the entire company at CircleCi, so its great to see the details exposed. Looks like that structure will be really useful once we get a few more people.

</comment><comment><USER13> Lists work well to a certain extent but would not be suitable for a number of cases. Say a team member decides to add an existing email conversation to the list at a later point in time. This would break the original email thread structure when added to list. What happens to an email in a conversation which came from someone outside the company. Someone forwards it to list again? Say someone forgets to do a "reply all" in an ongoing conversation, this email never lands up in the list.

We like using email for most of our tasks too. We use our own product GrexIt's (<http://grexit.com>) Shared Labels to share information and even collaborate right from our email inbox. Shared labels allow you to share particular Gmail label among a group of people in your company. Every email conversation on which a shared label is applied gets pushed to the user's inbox who were part of the shared label. All followup emails that arrive in an ongoing conversation also keep getting shared automatically. This approach requires minimal effort to share information and works better than lists. Most importantly users continue to access information from their inbox itself.

We use the shared labels approach for a variety of use cases like support and development. As soon as support email arrives to the support@ email-id it get shared with everyone. We have shared labels with every team member's name, say Task:John. To assign an email to someone, we simply apply the user's shared label on that email. This allows us to collaborate easily without needing any 3rd party tools

</comment><comment><USER14> Why not use Yammer or similar? We are trying G+ for business apps. It's ok.

<comment><USER15> We've tried Yammer, and it's never really taken off. The nice thing about just copying an email to a list is the barrier to entry is so low -- the sender doesn't have to open a new tab, or create any additional content.

<comment><USER13> Exactly. The idea of copying email from one inbox to another "shared inbox" is painful.

</comment></comment></comment><comment><USER16> Nearly all of these use cases are covered by a number of social enterprise platforms such as Yammer or Socialcast without the need for new employees to setup filters.

In Socialcast activity streams can be filtered by groups which could be public, private or externally facing(meaning you can invite people outside your company to participate in them). People can be notified directly by @-mentioning them in your posts and so forth. And of course all the content is searchable and filterable.

The usefulness of these social enterprise tools was not clear to me until I saw it being used in both a 40-people company and a 13,000-people company. It brings about collaboration, transparency, a way for people to discuss their issues and to often vent about things they dont like.

Maybe its time for Stripe to check it out too :)

Disclaimer: I work for Socialcast, the VMWare company

</comment><comment><USER17> This is an interesting tactic. I think it can work well for companies up to a certain size, at which point new hires start getting auto added to certain lists and you start to have enterprise email issues (I think Stripe will manage to avoid this fate though) ;)

This is a timely article for me though. We actually did a Show HN earlier today for a product (lightermail.com) whose ideal use is exactly this scenario. It allows people to control the flow of email from specific senders or domains. We see it being ideal for companies who have these sort of mailing lists, because it allows employees to subscribe to all the relevant lists without getting distracted by all the associated email throughout the day.

Good luck with your experiment! It will be interesting to see how it goes.

</comment><comment><USER18> I'm curious about your thoughts on mailing lists vs. private newsgroups. I think of email and news as just two different ways of sharing MIME messages, with the difference that email is sent to specific people and newsgroups are stored on a server and can be archived and made (semi-)public.

I realize that newsgroups have received much, much less attention than email recently, and it may just be that there isn't enough software support for news to make it worth bothering with, but it does seem like a mailing list with archives is a lot like what news was trying to accomplish. (The only other big difference I can think of is push vs. pull notifications. But newsgroup readers can fetch all new messages, so I don't think that's a big deal.)

<comment><USER19> Can you send an email and cc a newsgroup?

<comment><USER20> Assuming you're talking about an nntp newsgroup then yes, if you're running a mail-to-news gateway.

</comment></comment></comment><comment><USER21> When I was an engineer at Google, most Googlers tended to handle the email the same way. And of course, all 50k+ employees used the same Gmail and Google Groups as you and me.

I absolutely loved the system, and I've convinced my startups and organizations use solely Google Groups to communicate as well. Especially as an engineer in a company with thousands of simultaneous projects, it was extremely helpful to have a searchable archive of every conversation or set of meeting notes that was relevant to something I was working on.

The legal liabilities, however, that this system could obviously bring up, as greggman mentioned, are an entirely different conversation.

</comment><comment><USER22> How do you handle customers' emails? Is support@stripe going to a "support" mailing list? How do you make sure every email is answered only once? I.e. that all the team can see the conversation and can opt-in optionally. Thanks!

<comment><USER23> Support emails do not go to the support@ mailing list, they're handled through a helpdesk management tool that allows us to see full contact history, etc.

</comment></comment><comment><USER24> Part of the issue around transparency is that email inbox silos may be the wrong tool for a collaborative and productive tech company.

In general, email is now being seen (as often remarked by ShowHN MVPs) as To Do lists, and in a tech shop, multiple people have an interest in that process. This results in unenforceable policies about To: vs Cc: and unwieldy threads you're never sure if you should delete the tail nested indent history from. As the ShowHN projects assert, email's a poor To Do list tracker.

To refine that slightly, emails tend to be _requests_.

You don't create a new email thread to give yourself a To Do item. You create a new email thread to ask someone for something. The recipient doesn't care about your agenda. You're the interested party asking, and you need to track your requests.

Employees and clients email requesting action from someone: do this for me, let me do this for you, give me a resource, read this, take action on this, file this, and of course, receive a copy of this to cover my ass. Your To Do items (emails) are now in their lists (inboxes), and once there, you've lost control over the prioritization and handling of them. You'll probably lose visibility too, the moment you stop getting CC'd on your own email thread.

So, we quit using email.

Instead, we use Request Tracker, tracking all those requests. Instead of the Inbox, we have the RT dashboard, backed by automation with full extensibility:

        http://bestpractical.com/rt/screenshots.html
        http://bestpractical.com/rt/features.html
        http://bestpractical.com/rt/extensions.html

We all use it, and clients are trained (by sales, by contract, and by firm account managment and support response) to use tickets for anything as well. If there's no ticket, you didn't really request it. RT makes this easy, because the client can still just use email -- there's no web interface (well, there is, but they don't have to use it) for them to have to learn. They can just email a team (internally, an RT "ticket queue") and be sure the team will sort out who's handling it with an SLA promise.

If someone on a team has a family emergency, it's no issue, as anyone else on the team can take over that person's tickets till they're back, and immediately see the whole history.

All this is public within the company and fully searchable, going back about a decade.

When I said above we quit using email, I lied!

We actually all use email, but what we're emailing are RT tickets. So throughout the day, we can use any email capable device in the world to interact with this shared request handling history. RT automates the history and the cc lists. You can search your own requests using your email client, or hit the web interface to search everything. Through the web interface we enjoy the benefits of the dashboard summary, automatic response SLA monitoring, cross linked issue tracking, and visibility/searchability by everyone.

Note that RT can pick apart email addresses and subject lines, so you can route all your RT queues through a single Gmail account if you want, spam protecting your system and giving you a master archive searchable using Google's search tools as well.

Stripe is essentially slowly reinventing Best Practical's Request Tracker. Might be worth giving RT a try.

<comment><USER25> _You don't create a new email thread to give yourself a To Do item_

Maybe I'm just weird, but I do this pretty frequently (fire off quick instructions/reminders with "TODO:" prepended); after all, there's very little besides email that I care enough about to check frequently enough for any action items I assign to myself to matter.

I understand and agree with the idea behind the "Show HN" projects you mention, but as a potential user, at the end of the day all I really care about is that my personal system/workflow works and helps me get stuff done, not how structured or semantically beautiful my data is. The last thing I need is yet another application/service to demand time/attention from my day.

(On a similar note, I've never been able to commit myself to a well-organised file structure with meaningful nested directories, an indexing system, and so forth, when a flat directory holding tens of thousands of files + ls and whatever regexes has Just Worked for me for years, despite not being pretty.)

<comment><USER26> _Maybe I'm just weird, but I do this [send emails as todo items] pretty frequently (fire off quick instructions/reminders with "TODO:" prepended);_

It's also something that I do indirectly via Google Now or Samsung Voice - launch it, say "Note to self - Fix a time with Patricia" or "Remind me to book train tickets". It sends an email to me with that content.

</comment></comment></comment><comment><USER27> That sounds like a lot of email to keep up with.

<comment><USER28> And then, too often, you need to speak to the sender to find out what the email actually meant in the first place, only to find out that it had no relevance to you.

I like the info sharing and should lead to increased efficiency, but its something that IMHO needs very careful scrutiny.

</comment></comment><comment><USER29> I have been working on this use case of private/shared email and have been testing in private beta for a year with a firm of 40 staff. If you are interested, please send me an email (firstname.lastname@example.com).

</comment><comment><USER30> What software do you use to run the lists? Just some majordomo, or mailman software?

<comment><USER31> Sounds like they use Google Groups.

</comment></comment><comment><USER32> ahem. what you have described, is Yammer...</comment>


Ask HN: Will you steal my idea? - <AUTHOR>

If I show my web app on HN, and it gains some interest, what's to stop some hot-shot start-ups putting a team of developers onto something similar before mine has the chance to take off? <comment><USER2> Nothing will stop someone from copying your idea.

But consider this, no matter what your idea is, there are at least 3 people doing the same thing and closer to launching than you!

<comment><AUTHOR> who are they and where do they live? seriously tho, is this a general paranoia that most developers have and is the answer that there's no point in worrying as there's nothing you can do?</comment></comment>


Show HN: Tech against Coronavirus – remote working product list - <AUTHOR> http://techagainstcoronavirus.com/ <comment><USER2> Awesome list! Already almost 100 products.

<comment><USER3> "© 2020, created by Paul Balogh and Cristian Dinu"

<comment><AUTHOR> It is normal for Paul to be so excited :)

BTW -- anything we ca do to make it better?</comment></comment></comment>


Ask HN: What has been surprisingly effective in improving your business? - <AUTHOR>

What tricks, tactics, services, strategies, etc., have ended up being most instrumental in whatever success your company has had so far? <comment><USER2> We signed up to go to a industry related conference as a vendor.

Had low expectations and lost money but the conference was insanely valuable.

First because we had the chance to talk to customers for days straight. We refined our sales pitch, heard objections and concerns, learned about new features people cared about and more.

Second because everybody really rallied around the conference deadline and we got so much work done to prepare for the conference it really skyrocketed our momentum and productivity.

</comment><comment><USER3> 1\. cheap low level marketing campigns such as distributing flyers or putting up posters work well at the start

2\. lesser the features your product has more customers love it.

3\. taking an office space is much larger expense than it appears at the start thanks to travel time, travel cost, utility bills, eating out at restaurants, etc. work from home as much as possible.

</comment><comment><USER4> Concentrating on absolutely ONE GOAL at a time. Crucial for lean growers grasping at a MVP.</comment>


EASA warns pilots against pitot tube blockage after corona storage - <AUTHOR> https://kokpitherald.com/easa-warns-against-pitot-tube-blockage/ <comment><AUTHOR> There is an alarming trend in the number of reports of unreliable speed and altitude indications during the first flights following the aircraft leaving storage.</comment>


City Passes the First Bitcoin Mining Ban in the US - <AUTHOR> https://motherboard.vice.com/en_us/article/8xk4qv/bitcoin-ban-plattsburgh-coinmint-mining <comment><USER2> At first I was going to ask why the city was sticking its nose in people's private business and why they care what they're using that electricity for. But it seems that they aren't doing it for that reason, and residents are being pretty severely negatively affected.

On a side note, the city's goal was to use cheap electricity to lure industry to town, and their policy did exactly what they tried to. Seems like they didn't exactly plan out what would happen if they succeeded.

<comment><USER3> > _and their policy did exactly what they tried to._

In a way. Obviously their goal was growth: to attract industry whose wages and hopefully some profits would go back into the local economy. That's not going to happen with Bitcoin mining. If 200 local jobs had been created, then the story would be different.

<comment><USER2> They were probably looking for a specific type of growth (one that includes jobs) but failed to specify. Oops, but lesson learned.

But there's also a second issue: even if the bitcoin operation had brought jobs, it still used enough power to raise everyone's electric bills by $100-200 a month. That's huge, and it's not obvious that it's even worth it.

Of course, you can argue that if a business had high labor costs, it never would have expanded as much as or as quickly as the bitcoin mining businesses did.

</comment></comment></comment><comment><USER4> Just change the price of electricity or make it tiered. Problem solved. Making a law seems overkill and a bit draconian. What business is it of the government what you do with your computer if you aren't doing anything malicious or immoral? Ensuring a blockchain stays secure and updates faster is a legitimate service.

</comment><comment><USER5> I just hope they start banning it everywhere. And follow through with enforcing it.

<comment><USER6> While they're at it they should ban tvs and computer video. video games are definitely a no-no too. They all waste so much electricity! /s

Do not presume to dictate what others do. If there really are negative externalities set regulation to price those externalities in. At worst create step functions in pricing to discourage behaviors above some typical threshold. But outright banning something that others find utility in just because reasons is a dangerous game.

<comment><USER7> I've been pretty bullish on cryptocurrencies for a number of years, but it has to be acknowledged that it's not _if_ there are externalities, there _are_ legitimate real world externalities that need to be considered. The article says that some residents of Plattsburgh have seen their electric bills go up by $100 or $200. Many of those residents will not see significant offsetting benefits.

Plattsburgh, New York as of the census of 2010: "The median income for a household in the city was $28,846 … About 13.6% of families and 23.1% of the population were below the poverty line, including 20.0% of those under age 18 and 13.0% of those age 65 or over."[0] The income levels in federal poverty guidelines [1] are pretty low so there are very likely a number of households in the city that are above but near the guideline. However, it isn't necessary to get bogged down by federal poverty definition to acknowledge that some folks are going to have a hard time with unexpected energy bills.

For a while I worked as a manager of a program that helps low income households with their utility bills. I can tell you from experience that if a fixed income senior or low income family were to suddenly receive a utility bill that was $200 higher than they were expecting, they would face serious hardship. Even as a somewhat comfortable working family with two incomes, my household finances would be thrown into a bit of disarray if we suddenly had to pay substantially more per month for electricity and I wouldn't be too happy as rate payer if that increase came with no benefit for me.

The utility can't just decide on a new rate schedule and start billing it, they have to go through a process. The process for setting utility rates is typically a protracted and expensive affair. I am not as familiar with rate cases in the eastern states, but per the NY State website it looks like it takes about a year [2]. If folks can't pay their utility bills now, it's not going to get easier.

City leaders see that their neighbors are having a difficult time so it seems reasonable to put a hold on mining activities until they can come to an equitable solution. It is unfair to other rate payers if they are being asked to effectively subsidize mining activities.

[0] [https://en.wikipedia.org/wiki/Plattsburgh_(city)%2C_New_York...](https://en.wikipedia.org/wiki/Plattsburgh_\(city\)%2C_New_York#Demographics) [1] [https://www.federalregister.gov/documents/2018/01/18/2018-00...](https://www.federalregister.gov/documents/2018/01/18/2018-00814/annual- update-of-the-hhs-poverty-guidelines) [2] [http://www3.dps.ny.gov/W/PSCWeb.nsf/0/364D0704BEEC5B7D852578...](http://www3.dps.ny.gov/W/PSCWeb.nsf/0/364D0704BEEC5B7D85257856006C56B3)</comment></comment></comment>


Ex-Googlers CockroachDB: A Scalable, Geo-Replicated, Transactional Datastore - <AUTHOR> https://github.com/cockroachdb/cockroach/blob/master/README.md <comment><USER2> Are there distributed data stores like this that are also resilient to intentional sabotage?

I've been looking recently at long-term digital preservation systems -- tools designed to archive large amounts of data for decades. This is the Library of Alexandria problem -- how do we preserve all this data we're generating against once-in-a-century disasters?

So this 2005 paper lists thirteen different threats to long-term archives: Media Failure; Hardware Failure; Software Failure; Communication Errors; Failure of Network Services; Media & Hardware Obsolescence; Software Obsolescence; Operator Error; Natural Disaster; External Attack; Internal Attack; Economic Failure; Organizational Failure.[1]

Fault-tolerant distributed data stores are exciting, because they solve a bunch of those problems off the bat -- media failure, hardware failure, communication errors, failure of network services, hardware obsolescence, and natural disaster.

They also help to address software failure, software obsolescence, and economic failure, because archival projects are always strapped for resources and it's great to rely on tools that exist for totally distinct, commercially- valuable reasons.

But that still leaves operator error, external attack, and internal attack -- burning down the Library.

Hence my original question: are there distributed data stores that can be configured to resist intentional destruction of data?

[1] [http://www.dlib.org/dlib/november05/rosenthal/11rosenthal.ht...](http://www.dlib.org/dlib/november05/rosenthal/11rosenthal.html)

<comment><USER3> The problem with internal/external attacks is that we (the society) don't really want to prevent it. The reason is simple: child porn. To date, Bitcoin block chain (and related ideas) is the only data-storage that is 100% resistant to attacks (i.e. changing history), but luckily it cannot handle amounts of data large enough to be viable for child porn (or most other forms of media). Tor, on the other hand, gets a bad rep precisely because it doesn't prevent it (despite its numerous other, beneficial, uses).

The core of the issue is that humans view different information differently (child porn vs. Mona Lisa), whereas for computers, bits are bits and numbers are numbers. As long as child porn remains illegal and socially unacceptable, we'll _want to_ enable _attacks_ on data, i.e. for someone (usually internal operators) to be able to delete some kind of information, corrupt it or at least track it. Of course, this necessarily means that _all_ information stored in the same data-store will be vulnerable.

<comment><USER4> You're conflating the archival properties of the medium with the decision about what to save. Oil paint on canvas is durable. It doesn't mean that a museum needs to retain every piece of crap that anyone paints.

<comment><USER5> The problem is that removal of content because it's crap/immoral versus operator destruction is not a meaningful distinction, from a software perspective.

So it would probably need to be write-only to prevent people from burning it down, which would necessarily mean that, once content is included, it cannot be modified or removed.

</comment></comment></comment></comment><comment><USER6> Why the 'Ex-Googlers' in the title. Is it like a seal of approval or something?

<comment><USER7> Yes, it's called social proof. If you're observant you'll notice that people use it everywhere. Of course, social proof doesn't mean guarantees.

<comment><USER8> Nah, it's honor-by-association fallacy. Social proof is a behavioral thing, not false reasoning.

</comment></comment></comment><comment><USER9> So I cannot tell if this is aiming to be CA or AP. Having beaten my head against the CAP wall for a while, how does it deal with partitions?

<comment><USER10> The design doc [https://docs.google.com/document/d/11k2EmhLGSbViBvi6_zFEiKzu...](https://docs.google.com/document/d/11k2EmhLGSbViBvi6_zFEiKzuXxYF49ZuuDJLe6O8gBU/edit) says, "TBD: how to avoid partitions? Need to work out a simulation of the protocol to tune the behavior and see empirically how well it works"

.. so they've gone for CA and forgotten about P.

<comment><USER11> You're taking a sentence out of context and giving it the most uncharitable possible interpretation. They certainly haven't "forgotten" about network partitions because if you actually _read_ the design document, instead of ctrl-F'ing for the word "partition", they talk about the mechanisms they use to ensure sequential consistency. The software is not yet at the point of being testable AFAIK, but clearly the _intent_ is to build a CP system.

The section you're quoting is discussing a separate gossip protocol that is used to lazily propagate node state information. It does _not_ affect the consistency of actual data replicas.

<comment><USER9> Here's how I understand it: if you claim that your database cannot be taken down by component failure, you have to necessarily consider network partitions as well as individual node failure. If you are node A talking to node B, and node B stops responding you _cannot_ distinguish between a node failure and a network failure. In order to claim high availability you must build an AP system.

Let's reduce this case to a multi-master setup where a client can connect to any node and write to it. If a node fails outright and a client tries to connect, no big deal: the client chooses a different node, the failed node eventually comes back online later, catches up, then says "OK, write to me!" opening a listening socket.

However, if a partition happens, and client X writes to node A, client Y writes to node B, and then the two nodes cannot agree on the correct data, then you lose consistency. You can of course say that no node can be written to if other nodes are offline, which means the system is not highly available.

So their stated goal: "The primary design goal is global consistency and survivability..." either implies that high availability is not something they are going for, or that they are shooting for something that is not theoretically possible.

Of course all of the above is just my understanding, not necessarily fact, so please correct me if I'm wrong.

<comment><USER11> > In order to claim high availability you must build an AP system.

I strongly disagree. The "A" in CAP describes a system such that any single non-failing node can _always_ make progress. That would be a nice property to have, but it's much stricter than is required for a real system.

If a distributed database is resilient to failure of a minority of nodes, it still makes sense to describe it as high-availability. And that is exactly what a consensus algorithm like Paxos or Raft gives you.

</comment></comment></comment></comment></comment><comment><USER12> Here in the Southeast, we call them "Palmetto Bugs". Maybe a rename to PalmettoDB? :)

<comment><USER13> Palmetto bugs are generally the larger, flying "American Cockroach." "German Cockroaches" are smaller, don't fly but are generally the ones that cause infestations. I grew up in the Northeast and German Cockroaches are all I ever saw up there. I've been down in Atlanta for years now and I only see Palmetto bugs here.

Unless this database can fly, I'd say they've chosen the right name. ;)

</comment></comment><comment><USER14> Comparing to Facebook ' s TAO approach from yesterday post, I like the FB small set of api approach better. But that mainly focus on handling social graph with objects and associations.

On the other hand, almost all my backend related features can be easily abstracted to those APIs.

<comment><USER15> > Comparing to Facebook ' s TAO approach from yesterday post

Link? I see no relevant-looking "Facebook" or "TAO" in my recent RSS entries :(

<comment><USER16> I think he is talking about this post: [https://news.ycombinator.com/item?id=8557408](https://news.ycombinator.com/item?id=8557408)

</comment></comment></comment><comment><USER17> Many things that I don't agree with: [https://github.com/cockroachdb/cockroach/](https://github.com/cockroachdb/cockroach/)

MySQL: Weak consistency

Cassandra: No availability or weak consistency with datacenter failure

<comment><USER11> MySQL provides strong consistency when run on a single machine, but that breaks down when you handle failover using asynchronous replication between DCs.

</comment></comment><comment><USER18> I hope Ceph can takes cues from this and be able to do geo-replication at scale.

</comment><comment><USER19> Are there any details on how the distributed joins are achieved? (Sorry if that detail is in the design doc, my access to google drive is blocked from work).

</comment><comment><USER8> It's really strange to see networked databases go through this iterative design fad. It was file transfers back in the 90s/00s; everyone had their own distributed decentralized file transfer solution. Little known fact, Gentoo's Portage almost became an internet-wide distributed decentralized public file system. Thank god they abandoned that idea. Can you imagine trying to debug a file transfer error just to get an mp3 player to install on your machine? I can't wait until databases go back to being mainframes.

<comment><USER20> > Little known fact, Gentoo's Portage almost became an internet-wide > distributed decentralized public file system.

Am I the only person really sad that this didn't happen? after using apt over Tahoe-LAFS (over I2P - KillYourTV's PPA is on clearnet and I2P), I wanted this to be the default behavior for apt.

</comment></comment><comment><USER21> awful name!

<comment><USER22> I think the sentiment was "hard to kill" and/or become extinct due to its resiliency. But I agree, they should have picked something else.

<comment><USER23> Good point about the likely reason.

Hydra could have been another good choice :)

[http://en.wikipedia.org/wiki/Hydra](http://en.wikipedia.org/wiki/Hydra)

See first entry at above Wikipedia page, about the many-header serpent.

</comment></comment></comment><comment><USER24> Happy to see it's written in Golang.

<comment><USER25> As a Go developer I was happy as well.

On the other hand this question immediately popped into my mind: What kind of overhead does the GC incur, and how does it affect processes like a database where low latency is desired?

<comment><USER24> If I had to guess, I would say network and disk I/O will be the bottlenecks. Disk I/O less so because distributed system, and SSD. I imagine if anyone can solve GC issues, though, I would bet on Google :)

<comment><USER26> Their chosen solutions to the GC issues are in this roadmap. [0]

[0]: [https://docs.google.com/document/d/16Y4IsnNRCN43Mx0NZc5YXZLo...](https://docs.google.com/document/d/16Y4IsnNRCN43Mx0NZc5YXZLovrHvvLhK_h0KN8woTO4/preview?sle=true)

</comment></comment></comment></comment><comment><USER27> Awful name!!! Why Cockroach..??

</comment><comment><USER27> awful awful name... folks didnt get anything than cockroach..

</comment><comment><USER28> the name feels sick</comment>


Ask HN: What should I look for in my first programming job? - <AUTHOR> I'm a computer science graduate looking for a software engineering job. I realisE that my first job might not be the most glamorois or well paid but What should I look for in my first position? How can I find a position that will enable me to grow as an engineer? <comment><USER2> go work at a dev shop - a company that contracts with clients to build things. Usually the gigs are hard & demanding. The good thing though is that you get exposed to all sorts of tech and people, but probably most importantly you'll understand why best practices are the way they are.</comment>


Hacked? Your paranoia is justified! - <AUTHOR> http://p1k3.com/2007/9/1

<comment><USER2> "Bring your bike inside from the front porch, because I promise you some kid with a hacksaw can take care of that cute little lock in about 30 seconds flat."

Who needs a hacksaw - when he can pick locks.</comment>


Is The Death Of JavaScript Upon Us, Or Is A Transformation Underway? - <AUTHOR> http://techcrunch.com/2013/03/15/the-future-of-javascript/

<comment><USER2> Does the title of this article propose a false dichotomy between two equally unlikely outcomes, or was that a giant waste of 15 paragraphs of my time?

Look, JS is a lovely language, and it's fun to write things in Node. However, no one thinks that JS is going to become a "universal language", even though all the cool kids are writing the next great todo list web app using Node- powered hyper asteroids. Nor will Javascript "die out" for reasons that should be obvious to anyone. Some people will write backends in Node, but most people will write them via one of the other myriad backend languages available. Huzzah! Choices in backend development. Rejoice!

<comment><USER3> I didn't read anything new there, except maybe the mention of ASM.js.

JS is a fine language, but I've run into problems where I wished I had just a little more structure. I've started to turn to Dart, and I hope it catches on. My servers are usually in Go because that's what it was designed for.

So to answer your question, I think it was a giant wast of 15 paragraphs. No new information, no new analysis, just the same old complaining.

</comment></comment><comment><USER4> "Startups identify with JavaScript. When you're just starting out, you need to be dynamic. You need to be flexible. You need to be able to bust out a prototype that just works, and you need to be able to change it on a dime without recompiling your code. JavaScript was once the startup of the browser wars, and it crushed Java and Flash for the same reasons that startups have the ability to disrupt markets and displace the established players: agility and flexibility."

What nonsense.

1) " When you're just starting out, you need to be dynamic. You need to be flexible. You need to be able to bust out a prototype that just works, and you need to be able to change it on a dime without recompiling your code."

Unlike Perl, PHP, Python, Ruby, any of the Lisps, Lua, etc.? The real reasons js is interesting on the server side is code sharing and node's (flawed) concurrency story.

2) "JavaScript was once the startup of the browser wars, and it crushed Java and Flash for the same reasons that startups have the ability to disrupt markets and displace the established players: agility and flexibility."

Comparing apples to oranges. Also, the term "browser wars" means browser vs. browser, not embedded scripting language vs. plugins.

</comment><comment><USER5> #Mloc.js 2013 videos/presentations

<http://mloc-js.com/#videos>

for example:

Douglas Crockford (PayPal) : Syntaxation

Michael Ficarra (Groupon) : Redesign of CoffeeScript

</comment><comment><USER6> "ASM.js, a subset of JavaScript that runs extremely fast on modern browsers without modification" -- NOT TRUE. The author implies (either purposefully or accidentally) that ANY "modern browser" will run asm.js fast, or in other words, current advanced JS VMs don't need modifications to effectively support asm.js. If you believe that, just look here: [https://hg.mozilla.org/integration/mozilla- inbound/rev/b3d85...](https://hg.mozilla.org/integration/mozilla- inbound/rev/b3d85b68449d)

</comment><comment><USER7> Flexibility is not the opposite of scalability. Maybe he means writing hacks, but then you have problems after 200 of code already. If he means dynamic typing and lambdas, that doesn't prevent Python from being scalable. Startup or big corp.

The equivalent of Typescript is Google Closure not Dart. Dart could kill JavaScript one day, but that doesn't seem to be the topic here.

What does the author try to communicate here?

</comment><comment><USER8> A bad article with a wonderful writing prompt.

We've long passed the point where JS is considered foundational technology, with near-universal adoption. It's hard to understate what that level of standardization can do for the whole software ecosystem, since - in tandem with the push for better browsers - it's allowing a whole new round of innovation to take place.

</comment><comment><USER9> The article seems to assume that the limitations of javascript is something inherent to dynamic language. It reads like the author has no real experience outside web development.

For all we know, the only reason JavaScript "excels at being the glue of the web" is that it's the only widely supported client side scripting language for browsers.

</comment><comment><USER10> >When it comes to demanding multimedia applications, companies still turn to Flash for performance.

Huh?

<comment><USER11> Games. HTML5 + js still loses to AS3/Flash

</comment></comment><comment><USER12> I had this eerie feeling that I was reading Thomas Friedman -- a lot of hand waving with little substance.

</comment><comment><USER13> I love language wars. It makes it very easy to identify people you dont want to work with.

</comment><comment><USER14> I really hate to expose my naivete by asking this but its mention in the article forces my hand: Who the _hell_ is writing web apps with _millions_ of lines of JS?

<comment><USER15> I assume they're theoretically counting node.js backend stuff. At least I hope so.</comment></comment>


Using ClojureScript at NemCV - <AUTHOR> http://www.zubairquraishi.com/zubairquraishi/case-study.html

<comment><USER2> Wow, since 2013? So you've seen the state of ClojureScript change drastically over the past couple years. Have you stuck with the original tooling as it was back then, or did you try to track ClojureScript as it matured?</comment>


Why Efficient Light Bulbs Fail to Thrive (2009) - <AUTHOR> http://green.blogs.nytimes.com/2009/01/27/why-efficient-light-bulbs-fail-to-thrive/ <comment><USER2> A quote from the article: "The next big [issue] is dimming. Many fluorescents that are available do not dim well. Incandescent lamps dim very nicely. They dim all the way from 100 percent light all the way to 0 percent light. They do it very smoothly and very predictably. Consumers are used to that kind of smooth dimming.

Typically when you dim a compact fluorescent it can flicker, it can buzz, it can create all kinds of what I call "unintended consequences" that disturb the consumer. So the consumer is left with a less-than-satisfied level with this kind of technology."

That's really annoying and surprising to hear. I designed dimmable flourescent power sources for the Space Shuttle in the early 1970s, those dimmers worked very well, so it's not as though the technology doesn't exist.

This may not matter very much, because it seems high-efficiency LED-based lights will likely replace compact flourescents before the latter become truly acceptable replacements for incandescents. The linked article doesn't mention this, even though the change has already begun.</comment>


Look up - <AUTHOR> https://blog.apnic.net/2017/04/05/look-up/ <comment><USER2> > There have been efforts by various countries located under the equator to > claim the geostationary slots directly overhead as some part of their > territorial domain, but these claims have not managed to gain any credence > in the international community.

Sorry, you're too poor to enforce your claim so we're going to launch the satellites ourselves and charge you for usage, kay?

</comment><comment><USER3> Completely broken on mobile.

</comment><comment><USER4> Can someone gimme the gist of this, I'm not interested in reading for 39 minutes for an unknown point.

<comment><USER5> Using satellites to provide good internet access is achieveable and avoids somewhat stagnant cable-based ISPs. Technical details and upcoming commercial ventures are discussed.

<comment><USER6> And with LEO, latency can be ~3 ms.

<comment><USER7> Would internet require geosynchronous satellites? That's ~35,000 kilometers out rather than hundreds. That adds about 600ms.[1]

1\. [https://en.wikipedia.org/wiki/Satellite_Internet_access](https://en.wikipedia.org/wiki/Satellite_Internet_access)

<comment><USER6> Nope, that's why Internet requires LEO, or at least MEO.

It's basically a mixnet. Like how cellular works. Except it's not you that's moving.

<comment><USER7> Objects in Low Earth Orbit have an orbital period of 88 minutes to 127 minutes.

How many satellites would be required to provider continual coverage for any particular large city?

<comment><USER6> Given how it works, it doesn't make sense to focus on particular cities. Orbital footprints, perhaps, but that's probably not workable.

From the article:

Iridium used 77 satellites in polar orbits at 780 km.

Planned LEO:

LEOSAT 108

OneWeb 648

SPACEX 4000

<comment><USER8> One of these things is not line the others.

<comment><USER9> Launching with SpaceX is already 50% cheaper than other providers, sans reusability. If SpaceX owns the network they can launch at cost. Let's say that puts them at a 70% advantage (When they perfect reusability maybe 90%).

Satellite technology is also cheaper and smaller so you can put a lot more tiny satellites up with each launch.

I have no problem believing SpaceX can blanket the globe with 4000 satellites at reasonable cost. As bandwidth needs increase they could simply launch more of them.

For the sake of competition in the US (and access in other parts of the world) I hope they succeed.

The only other risk I see (beyond losing money if the venture doesn't gain enough customers) is that nations like North Korea, China, Iran, etc will not be happy that their citizens can subscribe to an ISP they can't control or filter and without any way to block it. I can definitely see China (credibly) threatening to blow up the satellites if SpaceX sells access to Chinese customers.

<comment><USER6> Back in the day, some of us had that dream for the US too.

SWANsat LEO network with WiMax, plus a VPN. So you get anonymous VPN connection via satellite. Pretty cool, no?</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Myrtis Dightman, the Jackie Robinson of Rodeo - <AUTHOR> https://www.texasmonthly.com/articles/black-cowboy-the-jackie-robinson-of-rodeo/ <comment><USER2> Similar story about a black cowboy at Oregon's Pendleton Roundup in 1911:

[http://www.cowboysindians.com/2016/10/the- unforgettable-1911...](http://www.cowboysindians.com/2016/10/the- unforgettable-1911-pendleton-round-up/)

</comment><comment><USER3> "A lot of folks thought rodeo was a white man's game," he said years later. "But those bulls don't care if you're white or black. You could be green, for all it matters. They just don't want you on their backs."</comment>


Ask HN: Validate my startup idea - <AUTHOR> Introducing Repairer - An on demand repair service.
Website: https://hammadn.wixsite.com/repairer
We get your damaged products repaired for you as fast and as cheap as possible and deliver it back once it is repaired!
We'd be taking watches, clocks, smartphones, lamps, spectacles, laptops, modems and other common household products initially.
We've planned to launch in New Delhi, India initially and would be expending to many other cities all over the world pretty soon.
Would love to have your valuable feedback and suggestions. <comment><USER2> There is definitely a need for this kind of service. The authorised company repair takes ages and lot of money but I am not sure how this compares with local repair shops who are also fairly cheap (I am not from Delhi so may be wrong on this). What do you mean when you say 5% of repair price?

The site does not look good to me and I find the symbols distracting but probably you will have something different once you launch. Not sure if you want to be app only. I am a bit hesitant on installing a new app for everything so prefer web-based. It would be good to have that option.

Also will you be handling things like adding extra ram, building a custom desktop which are technically not repair but some of us do go to local shops for this.

<comment><AUTHOR> Thanks for your feedback, indogooner.

By 5% of repair price we mean that you've to pay just $0.25 as a service charge if the repairing cost was $5 or Rs. 5 if the repairing cost was Rs. 100

The website is obviously not the final piece and we'll be developing a more professional and simpler one.

We've seen this a lot that people are usually to busy or too lazy when it comes to getting their damaged products fixed and those products remains damaged for a long period of time, so the idea is to take your damaged products and get it repaired for you so that you don't have to go out yourself for such tasks.

Your advice on going both web as well as app is great and we'll surely take it into consideration.

</comment></comment><comment><USER3> One way to validate the idea is to find users before launch. Validating an idea by seeing if it works will provide better feedback than some random internet user in Alabama.

Validation means:

1\. It is possible to identify people who want things repaired.

2\. It is possible to sift people who want things repaired and find people who are willing to pay for repairs.

3\. It is possible to get people who are willing to pay for repairs to actually use your service.

4\. It is possible for your service to deliver repairs to the people who have paid for repairs.

5\. It might be feasible based upon actually having delivered actual repaired items to customers to build a business that might make sense out of the process.

Each of those steps is much much harder than asking a question on Hacker News.

Good luck.

</comment><comment><USER4> I guess pickup & drop off service for repair would be a good addition.

<comment><AUTHOR> Thanks for you valuable suggestion, desaiguddu.

Either I have failed to describe the idea clearly or you might have picked it wrong. Pickup & drop-off service is basically what we're gonna do. :|</comment></comment>


Santa, a binary white/blacklisting app for macOS from Google - <AUTHOR> https://github.com/google/santa <comment><USER2> Although this is from "Google's Macintosh Operations Team," this is not an official Google product.

Just FYI, for those of you who've become shy about using programs from Big G after the two recent Chrome scandals.

</comment><comment><USER3> Nice and dandy, one alternative to Xprotect.

Now, who is going to maintain the blacklist?</comment>


Machine Learning Course by Tom Mitchell - <AUTHOR> http://www.cs.cmu.edu/~tom/10701_sp11/ <comment><USER2> Can anyone recommend a good intro in machine learning that does teaches the building blocks of the math side of things? It is fascinating as a topic, but there is such a large prerequisite learning curve that it seems out of reach for those not as strong in math.

That might just be the reality of it, but hoping there might be a better introduction (even something super simple like a Codecademy equivalent).

<comment><USER3> I was in a similar situation a year ago. Two things fixed my problems:

I took a course on Linear Algebra (Bretscher's book up to chap 9) and a Probability course (Ross' book up to chap 6) and did very many problems by hand on paper. I just finished a ML course (Bishop's book, and Jordan's book), mixed grad+undergrad, which was 80% problems w/ pen and paper and 20% code up something algorithmically trivial but mathematically challenging, and don't think I would've been able to pick up the _additional_ math along the way without these two great books and their many exercise problems behind me.

I read layman's explanations of ML concepts a year ago, and got nowhere in terms of my own implementation+debugging/improvement upon established techniques. Now I can solve problems I saw a year ago and thought "no one can do this."

My advice is to take the gateway drugs first, Probability (Ross <\- I love this book!) and Lin Alg (I like Bretscher much better than Strang, but not everyone agrees with me :) Take a course in real life (for a grade and a transcript) at a competitive university if possible, nothing makes you study thoroughly like a gun to your head.

<comment><USER4> I would appreciate if you can give links to those books on Amazon or some other site. Thanks!

<comment><USER5> I was interested so I looked them up:

A First Course in Probability: [http://www.amazon.com/First-Course- Probability-9th/dp/032179...](http://www.amazon.com/First-Course- Probability-9th/dp/032179477X/ref=sr_1_1?ie=UTF8&qid=1418999863&sr=8-1&keywords=probability+ross&pebp=1418999876886)

Linear Algebra with Applications:

[http://www.amazon.com/Linear-Algebra-Applications-Otto- Brets...](http://www.amazon.com/Linear-Algebra-Applications-Otto- Bretscher/dp/0321796977/ref=sr_1_1?ie=UTF8&qid=1418999936&sr=8-1&keywords=linear+algebra+bretscher&pebp=1418999943552)

Note that the Bretscher book has really terrible reviews, but I can't evaluate if the reviews are correct or not.

<comment><USER6> A First Course in Probability: [http://www.ebay.com/itm/A-First-Course-in- Probability-EDN-9-...](http://www.ebay.com/itm/A-First-Course-in-Probability- EDN-9-by-Sheldon- Ross-/261607443332?pt=US_Texbook_Education&hash=item3ce904cb84)

Linear Algebra with Applications: [http://www.ebay.com/itm/Linear-Algebra- with-Applications-5ed...](http://www.ebay.com/itm/Linear-Algebra-with- Applications-5ed-by-Otto- Bretscher-/251574886499?pt=US_Texbook_Education&hash=item3a93082063)

International editions of textbooks are immensely cheaper.

<comment><USER7> Besides the price is there anything different between the US and International editions? There must be a trick here... ?

<comment><USER8> Sometimes the paper can be thinner. Sometimes it's in black and white and the US edition is in color. The international edition is almost always softcover and the cover may be in Chinese (for instance). The problem sets may be in differing order.

Many of these things are described in the comments. I almost exclusively buy international textbooks for home reference if available. The price difference and the relatively small quality difference makes it a no-brainer. If you are doing it for a class though, find a friend with the overpriced version for homework.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Does anyone have the book? Having looked through the ToC on Amazon, there are a few topics that interest me and it seems to be more in-depth than these lectures. But as it is from 1997 (and doesn't appear to have been updated), I'm concerned it will be a bit out of date.

<comment><USER10> I read this cover to cover for my ML course at Imperial College London in UK. While not an easy read, reviewing the same topics a few times did make you understand the fundamentals better. AbeBooks sometimes has it going for £20(~$30). The exercises were a bit tricky as often the answers weren't attainable by simply following the book and resulted in you needing to consult other material.

<comment><USER4> what are pre-requisites to start with the book? Requires heavy math understanding of Linear Algebra etc?

</comment></comment></comment><comment><USER11> Does anybody have URLs for the videos? Clicking on the video link for a lecture asks you to install Silverlight.

<comment><USER12> [http://pastebin.com/raw.php?i=hbDV5iiS](http://pastebin.com/raw.php?i=hbDV5iiS)

<comment><USER13> Anybody got a mirror of lecture #6? It seems to be dead on the server.

</comment></comment></comment><comment><USER14> I am registered for this course and I am quite excited!

</comment><comment><USER15> Good to see cmu opening up to open learning!

<comment><USER16> As a current student, unfortunately, this is a rare gem. CMU still fails to make any attempts at free courseware.

<comment><USER17> As another current student... you are very mistaken.

See: [http://oli.cmu.edu](http://oli.cmu.edu)

<comment><USER16> However, with the exception of one or two of those courses, those are nothing but introductory courses. And while this is great material to have access to, grants almost no access to the wealth of knowledge at CMU.

</comment></comment></comment></comment><comment><USER18> I have a "pre-existing working knowledge of probability, linear algebra, statistics and algorithms", but can't he be more precise ? I mean to what difficulty are those math used ?

<comment><USER19> This is a Phd-level course at CMU. Pretty heavy on math. You can just take a look at the material to know the difficulty. If you are not sure, you probably should try easier ones such as Andrew Ng's on Coursera.</comment></comment>


Show HN: Boost by Humbot, a scholarship for homework help - <AUTHOR> https://humbot.io/boost <comment><AUTHOR> We launched Humbot a couple of months back. With Humbot, we're providing instant homework help for school kids by real humans. We charge a fixed fee of only $99/month.

Humbot Boost is our scholarship program: Students can apply and, if selected, can access Humbot for a significantly reduced rate of only $15/month. We launched Boost because our goal is to drive down the cost of high-quality education in the coming years. We aim to offer 1-on-1 tutoring at a lower price to everyone someday. Unfortunately, today we can't build a sustainable business with this pricing. But with Boost, we can start enabling more and more kids from lower-income families to improve their education and do better at school.

I know that HN users are not our direct target group, but I'm happy to hear your thoughts and feedback. Also, feel free to share it with loved ones that could benefit from this.</comment>


5m views in a week = more viral than $1 Shave Club: Helloflo.com - <AUTHOR> http://www.youtube.com/watch?v=0XnzfRqkRxU

<comment><USER2> "IT'S LIKE SANTA FOR YOUR VAGINA!"

(Yes, that's also top comment on YouTube comments)</comment>