Mandaeism - <AUTHOR> https://en.wikipedia.org/wiki/Mandaeism <comment><USER3> Oh hey, I was raised Mandaean. Neither of my parents spoke the language and were some of the first immigrants to America so I didn't really participate in the community much. A priest visited the area in my youth and I was baptized.

Later in life I came into possession of a translated copy of the Ginza Rba. It's a pretty cool holy book, lots of interesting symbolism and mystery. Light and darkness intermingle in interesting ways in these texts. Since most of the significance of these religious elements is taught priest-to-priest and through oral traditions I did not take part of, it's difficult to examine it more deeply.

Although I don't practice religion these days, on occasion I'll reflexively mutter a prayer under my breath. In a more secular light, being a Mandaean strongly informed my material circumstances due to geopolitics and I'm always struck by the weirdness of being part of a dwindling ethnic group swept up by the tides of history.

<comment><USER4> I'm mandaean as well if anyone is interested in asking anything

<comment><USER5> The Wikipedia article suggests that Mandaeans haven't liked to discuss their religious beliefs and traditions with outsiders, but then sort of goes on to reflect a lot of variation in this.

Do you have a sense of how this impulse toward secrecy has worked over time, what's motivated it, and how Mandaeans might understand it today? Are there other Mandaeans you know of who might be unhappy that you're happy to talk about the tradition with strangers on an Internet forum?

How unified do you think different Mandaean communities have been in their beliefs and practices?

<comment><USER4> I think there are 2 reasons (for me at least) for why Mandaeans don't like to discuss their religion.

1\. The lack of need for evangelicalism, unlike most religions, you can't become a Mandaean unless you're born with it, other religions want to spread their message to expand. 2\. In Iraq (when I was living there at least) Mandaeans were very much prosecuted for being Mandaeans, a lot of them didn't identify as Mandaean in public for fear of being ostracised or prosecuted. Eg. a lot of my relatives that had restaurants/cafes would have to lie about their religion to be able to sell, Muslims wouldn't buy from us otherwise.

I'm not sure how unified Mandaeans are right now, there are different communities in every country, where I live (UK) there's a small number of Mandaeans (around 1000) where there is almost no community, this is the case in most countries, we're pretty much spread out all over the world where's there's a 1000 people in Norway, 1000 in the States, it's really to create a sense of community when the people are so sparsed out. The internet (Facebook especially where there are pages/groups that have tens of thousands of Mandaeans together) is the only thing that brings us together, for example when sending Eid (similar to Christmas) greetings and so on.

</comment></comment></comment></comment><comment><USER6> Wow, surprised I get to see this on the front page of Hacker News. Gnostic sects are quite interesting. I've seen a good handful jaded ex-religious people who turned to Gnostic beliefs because of their dissatisfaction with modern religion, since they believe that Gnosticism is more "philosophical".

The Gnostics were hated during their times by the Neoplatonists for their over-emphasis on theurgy (religious rituals focused on awakening), and they were rejected by mainstream Christians after the first Ecumenical Council for being heretics (Gnostics believe that matter is intrinsically evil; orthodox Nicene Christians, in contrast, believe that matter is a "lesser good").

It seems that, from this article, Mandaeism also has some dualistic tendencies (believing that the world is a prison for the soul; and that the world was created by a god of Darkness). It's also quite radical to me that they consider Jesus, Abraham, and Moses to be false prophets, and that the Holy Spirit is an evil creature.

If you are interested in Gnosticism, you may be even more interested in simply reading the Neoplatonic philosophy of Plotinus and Proclus; or you might be interested in the early Christian theurgical writings of Pseudo-Dionysius and Maximus the Confessor. I think that these traditions are more internally consistent than Gnosticism.

<comment><USER7> Gnosticism is mostly just Greek Neoplatonism filtered through older near eastern religions.

Really multiple waves of Greek philosophy swept through the near and Middle East after Alexander, leaving new religions in its wake — including mainstream Christianity.

</comment></comment><comment><USER8> I wonder why a religion that seems to have always been from around-about southern Iraq is so concerned with the prophets out of Jewish history.

It makes sense if the religion appeared fairly late, so that Roman Christians could make that history a big thing that others pay attention too. But it is more puzzling if the Mandaens are pre-Christian as they seem to claim.

Other possibilities are (a) Judaism itself is was bigger deal among non-Jews than I imagined or (b) it's a selection effect under Islam: people who happened to revere Jewish prophets could make a strong claim to being "People of the Book" and were thus allowed to keep their religion.

<comment><USER9> The Jewish people were dispersed when Israel was conquered, first by Assyria and then by Babylon (modern day Iraq). This led to the exile (diaspora).

In addition to the people the ideas were dispersed. A good example of this are the magi who come to visit the young Jesus following an astrological sign - <USER2> odd mix of Jewish and Persian syncretism.

During Roman times Jews could be found all over the Roman Empire. In particular Alexandria, which was a center for scholastic thought (see philo)

So it doesn't seem a stretch that religions may have been influenced by Judaism fairly early.

</comment></comment><comment><USER10> Mandaeans are heavily persecuted in Iran and much of the rest of the Middle East. Here's the story of a colleague of mine:

[https://www.youtube.com/watch?v=5gb5SoJdEnA](https://www.youtube.com/watch?v=5gb5SoJdEnA) (13 min, but well worth it)

[https://www.smh.com.au/lifestyle/when-he-came-to- australia-h...](https://www.smh.com.au/lifestyle/when-he-came-to-australia-he- hadnt-heard-of-the-internet-now-this-former-refugee-works-for- google-20150927-gjvt4k.html)

</comment><comment><USER11> I'm interested in these, older, yet still active lesser known religions.

Aside from this I'm aware of the Ahmadiyya and Baha'is (offshoots of Islam, but with distinct founders claiming to bring a revelation). They're in the 5 to 10 million range. And Jainism of course, but that seems to be a little better known.

Then there's Zoroastrianism and Yazdânism with under 1 million.

Does anyone have a complete list of these smaller religions?

<comment><USER5> For the Near Eastern landscape, you might also be interested in

[https://en.wikipedia.org/wiki/Samaritans](https://en.wikipedia.org/wiki/Samaritans)

[https://en.wikipedia.org/wiki/Alawites](https://en.wikipedia.org/wiki/Alawites)

[https://en.wikipedia.org/wiki/Druze](https://en.wikipedia.org/wiki/Druze)

[https://en.wikipedia.org/wiki/Karaite_Judaism](https://en.wikipedia.org/wiki/Karaite_Judaism)

I first found out about the Karaites when I asked a theologian why there was no Jewish equivalent to the Protestant notion of "sola scriptura". It turns out that there is. :-)

There are also some parts of Eastern Christianity that aren't very familiar to many westerners, like Syriac Christians.

[https://en.wikipedia.org/wiki/Syriac_Christianity](https://en.wikipedia.org/wiki/Syriac_Christianity)

[https://en.wikipedia.org/wiki/Oriental_Orthodoxy](https://en.wikipedia.org/wiki/Oriental_Orthodoxy)

<comment><USER12> Don't forget the Yazidis

[https://en.wikipedia.org/wiki/Yazidis](https://en.wikipedia.org/wiki/Yazidis)

<comment><USER5> The other commenter already mentioned "Yazdânism", which Wikipedia considers to include Yazidism. :-)

[https://en.wikipedia.org/wiki/Yazd%C3%A2nism](https://en.wikipedia.org/wiki/Yazd%C3%A2nism)

</comment></comment></comment></comment><comment><AUTHOR> I also found this article about the Mandaeans in Massachusetts:

[https://www.pri.org/stories/2016-10-06/these-iraqi- immigrant...](https://www.pri.org/stories/2016-10-06/these-iraqi-immigrants- worship-john-baptist-theyre-not-christians)

<comment><USER13> > The religion does not allow for conversion to the faith. If a Mandaean man > or woman marries someone who is not part of the religion, the couple's > children are not considered to be Mandaeans.

That's interesting. Seems like the religion is "doomed" to forever remain that of a small and shrinking minority.

<comment><USER14> This is also true of some ultra orthodox sects of judaism that are thriving.

<comment><USER15> Can you name the sect? I was raised as an Ultra-Orthodox Jew and this is not normative.

<comment><USER16> The Syrian Jews in Brooklyn, New York are near-impossible to convert into. I don't see it as inconceivable some other sect banned it altogether.

<comment><USER15> They do marry other Jews or descendants of converts from other courts, they just don't marry converts or convert using their own courts. Therefore they are not a real endogamous population.

Also, the edict is only since 1937, they were accepting converts earlier than that. So fundamentally they aren't a success story - they haven't been doing this very long.

<comment><USER16> > They do marry other Jews

Other Jews can marry in, but even this is limited. The majority of self- identifying Jews in the US would not have the qualifications to marry in. Any how, they are an insular community.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> From TFW:

"Mandaeism or Mandaeanism (Arabic: مندائية Mandā'īyah) is a gnostic religion[1]:4 with a strongly dualistic worldview. Its adherents, the Mandaeans, revere Adam, Abel, Seth, Enos, Noah, Shem, Aram, and especially John the Baptist. The Aramaic manda means "knowledge", as does Greek gnosis.[2][3]

"According to most scholars, Mandaeaism originated sometime in the first three centuries AD,[4] in Mesopotamia.[citation needed] They are Semites and speak a dialect of Eastern Aramaic known as Mandaic. There is a theory that they may be related to the Nabateans who were pre-Islamic pagan Arabs[5] whose territory extended into southern Iraq.[6]

"The religion has been practised primarily around the lower Karun, Euphrates and Tigris and the rivers that surround the Shatt-al-Arab waterway, part of southern Iraq and Khuzestan Province in Iran. There are thought to be between 60,000 and 70,000 Mandaeans worldwide.[7] Until the 2003 Iraq war, almost all of them lived in Iraq.[8] Many Mandaean Iraqis have since fled their country because of the turmoil created by the 2003 invasion of Iraq and subsequent occupation by U.S. armed forces, and the related rise in sectarian violence by Muslim extremists.[9] By 2007, the population of Mandaeans in Iraq had fallen to approximately 5,000.[8]

"The Mandaeans have remained separate and intensely private. Reports of them and of their religion have come primarily from outsiders: particularly from Julius Heinrich Petermann, a scholar in Iranian studies,[citation needed] as well as from Nicolas Siouffi, a Syrian Christian who was the French vice- consul in Mosul in 1887,[10][11] and British cultural anthropologist Lady E. S. Drower."

<comment><USER18> Why did you copy and paste the article?

<comment><USER17> Because, in practice, a lot of people commenting don't actually read the article. As a convenience I've copied the opening paragraphs from the Wikipedia article. Is that against HN rules / norms?

<comment><USER19> _Because, in practice, a lot of people commenting don 't actually read the article._

Someone else made a habit of doing this a few months ago, with an almost word- for-word excuse as yours. They were asked to quit doing it. At best, based on empirical evidence, you'll just invite a flurry of downvotes.

</comment></comment></comment></comment><comment><USER20> Wait but what? Why is a religon being posted to HN?

<comment><USER21> The test of a good HN submission is intellectual interest, and there's plenty of that here.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment><comment><USER22> Why is just a wikipedia page posted?

<comment><USER21> Many interesting Wikipedia pages have been posted over the years.

[https://hn.algolia.com/?query=wikipedia.org%20points%3E10&so...](https://hn.algolia.com/?query=wikipedia.org%20points%3E10&sort=byDate&dateRange=all&type=story&storyText=false&prefix&page=0)</comment></comment>


Court rules California employers must pay employee cell phone expenses - <AUTHOR> http://www.dlapiper.com/en/us/insights/publications/2014/08/bring-your-own-device/ <comment><USER2> Why does this even need a court decision? How would you defend the position, that you force additional work-related expenses onto your employees but are not required to compensate them?

<comment><USER3> An employer making employees pay for a plan to use cell phone minutes in a non-incidental way is amazing; I don't know how that can stem from any place but fuck you, I've got mine. Though Amazon is claiming they shouldn't have to pay employees for waiting in line for security checks, for up to a claimed 30 minutes [1].

edit: I recalled a situation at a previous employer for an ops person who had significant work usage of his cell phone; our employer didn't want to pay for it. I'm not sure how that got resolved. Though this employer had pictures of naked women as part of the interview process so, you know, all class. (I didn't get that for my screen, but others did.)

[1] [http://www.businessweek.com/articles/2014-10-02/security- che...](http://www.businessweek.com/articles/2014-10-02/security-checks-paid- as-work-supreme-court-will-decide)

<comment><USER4> I've had colleagues refuse to give their phone number out unless management say they will pay towards the cost of the phone. Also stops the out of hours calls.

</comment></comment></comment><comment><USER5> Expense reimbursement is always tax-free for the employee and fully deductible for the company, whereas any increase in compensation from $100k-$150k can carry an effective tax rate over 50% due to progressive marginal rates and phase-outs.

Particularly for these types of ambiguous use items, I would expect savvy companies to be maximizing this benefit, not minimizing it.

<comment><USER6> The cost for an employer gets cheaper as an employee makes more money, not more expensive. There are no increasing marginal rates for employer payroll taxes- just the employee state/federal income taxes.

<comment><USER5> It depends how you measure the cost to the employer. When you're talking about increasing employee compensation in the $100k - $150k range, I look at the total cost to end up with $1.00 in the employee's savings account. The point is that increasing compensation is extremely inefficient in the $100k - $150k range. That's why, for example, US engineers getting raises in that pay range will often find it doesn't change much in their living situation. "I got a $10k raise" but really take-home pay just increased $4500.

Often times paying out compensation in cash like this is _just too expensive_. It's a weird concept that the cost of cash is a curve mostly dictated by tax rates. When the IRS is taking 55% at certain points in the curve, you get much bigger bang for the buck by offering other benefits, like maximizing expense reimbursements. (phone, internet, qualified commuting expenses, food & entertainment, etc.)

</comment></comment></comment><comment><USER7> "employers that require employees to use their personal devices to conduct business as a condition of employment will need reimbursement plans or face litigation risk."

So what does this mean? Likely not triggered by simply storing my mobile number on the internal groupware contacts card.

However, if I'm in services or sales, and I travel a lot - I would now be in a position where I need to be available - would that be considered "as a condition of employment"?

Examples would make this a lot easier to navigate.

</comment><comment><USER8> I love California. This is the 300th reason why I will never leave the state. It is so good about protecting workers ( when compared to the rest of the US. )

<comment><USER9> Interesting point of view. Employers beyond a given scale want to LEAVE California because of just how ridiculous things can be here. And so, you like CA because of your perceived (or real) benefits to employees when, in reality the rules that keep piling up are making jobs leave the state and, in effect, cost employees dearly. In other words, employees are not losing small amounts or benefits here and there but rather their jobs and the ability to maintain a standard of living as everything else in the state ads cost to doing business here.

Remember that widely reported employment numbers count minimum wage jobs and highly-paid jobs the same way. In other words one could say that CA is gaining, not losing, jobs yet when you dig into the data you discover that jobs that pay well are leaving and the ranks are being filled by people taking pay and standard of living cuts.

It's interesting to come to the realization that the average Joe and Jane has no clue as to what a business equation looks like, how businesses run and how costs and legislation affect numbers.

You can't keep taking from people and businesses forever without consequences. This isn't a politically charged statement, this is simple mathematics. Eventually we succeed at killing off our own source of income when they decide to pull-up anchor and move to more reasonable shores (sometimes literally). Both businesses and people have choices.

<comment><USER8> Humorous point of view.

You are welcome to move to a place that permits employees to be abused.

The hardest problem I have is hiring good people: Not taxes.

If a business wants to move to out of the largest economy in the U.S. -- well then it is making an interesting choice that other businesses will take advantage of.

Funny thing is that Rick Perry has been trying oh so hard to get businesses to move to Texas... but if the best employees are in California then that means a business is trading lower taxes for lower quality workers. That too is an interesting choice.

<comment><USER9> You are thinking locally. Nobody cares where Tesla or Toyota build their cars. Having your business located "in the largest economy" isn't a factor for a huge number of businesses.

Another way to put it is: You can build a massively successful business anywhere in the country. There is no particular magic in California in this regard. What is different here is that it cost more to simply exist in this state. And there's far more to it than wages at play.

<comment><USER8> But the costs of running a business are much more than taxes and regulations.

Here is the TL;DR:

Businesses want the benefit of low taxes (lower immediate expenses) with the benefit of high taxes locations (government provide services that the business would otherwise have to pay).

But low tax utopia fails if no one pays high taxes needed to provide the services.

Longer explanation here:

[http://sworddance.com/blog/2014/10/23/california-is- awesome-...](http://sworddance.com/blog/2014/10/23/california-is-awesome-for- business-the-myth-of-the-importance-of-low-taxes/)

and here:

[http://sworddance.com/blog/2014/10/23/low-business-tax- utopi...](http://sworddance.com/blog/2014/10/23/low-business-tax-utopia-myth/)

<comment><USER9> It's not just taxes, it's everything. Doing business in California, depending on what you do, can be very difficult. If you are a website designer none of this is likely to make sense. If, on the other hand, you happen to own an manufacturing facility as I do, yeah, you get it and I don't have to explain it.

Quick example. There's something in the County of Los Angeles called "Business Property Tax". It is officially considered a "privilege tax", meaning, you pay for the privilege of doing business within and through the County of Los Angeles. All of it is nonsense but the "through" part is particularly sickening. Even if your business is in Arizona, if you DRIVE THROUGH LA to do business you are, in theory, supposed to pay for this tax. Thankfully they can't keep track of such things yet so they are not pissing all over this country asking for money.

But wait, what is this "Business Property Tax"?

Is it a tax levied on the building you own or lease?

Nope. Not at all.

Do you own a desk? A computer? A printer? A trash can? A fax machine? Did you change the carpets at the office you rent (Did you do any tenant improvement work)? Do you have desk lamps? Chairs? Shelves?

Yes? OK, hand over the receipts to the County of Los Angeles, you have to pay TAXES on your business property.

No bullshit. Here:

[http://articles.latimes.com/1997-01-21/business/fi-20589_1_p...](http://articles.latimes.com/1997-01-21/business/fi-20589_1_property- tax)

and here:

[http://lacountypropertytax.com/portal/contactus/ppa.aspx](http://lacountypropertytax.com/portal/contactus/ppa.aspx)

Even if the computer you are using is yours --not owned by the business-- you can technically be required to pay this tax on it because it is used by the business and controlled by the business to a degree.

Utopia? Well, it's very real. And it is absolutely fucking unbelievable. It isn't a lot of money, somewhere in the order of 1$ annually. But the concept that the County of Los Angeles grabs a 1% tax FOREVER on that laptop you bought for your business on an annual basis is, well, sorry, only raw sewage dumped on this page could begin to describe what I think of taxes like this one. It's theft, that's what it is.

Because the tax is small people have better things to do than to fight it. And, because a lot of voters are predisposed or easily convinced to be anti- business trying to get it repealed is likely to fail as smart politicians would quickly weaves all kinds of lies about greedy business men wanting to take food away from poor children. Theft.

And like that there are many other little needles California loves to stick into you depending on the type of business you are in. A friend of mine leases about four million dollars of manufacturing equipment.

This is why some of the comments I read on HN get me riled up at times. It is easy to tell they mostly come from twenty-somethings who have not been exposed to the real world enough to get a nice tan bordering on a burn and truly understand things.

We need to aggressively cut down on taxation and remove nearly all incentives for politicians to tax us. If we don't we end up with hundreds of little 1% taxes that, collectively, only serve to pay for their pensions and wasteful spending and do nothing, absolutely nothing, for society. Next time you get gas anywhere pay attention to how much and how many taxes and fees you are paying and then try to square that away with the condition and disrepair of our roads and bridges.

<comment><USER8> So move to Kansas.

They are doing exactly what you want.

Seriously. Move if it is so bad. Otherwise, realize that paying taxes is part of the cost of doing business.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Why is this even an issue?

If I were running a company, I'd just give you a corporate phone that the company completely pays for. This seems like a no-brainer.

BYOD (bring your own device) always seemed like a non-starter to me. Do you _really_ want your employer to have _any_ access to your personal device? I sure wouldn't.

<comment><USER11> BYOD does not mean the employer has access to the device, it means that the device is used for all work related purposes that would require such a device. In some jobs, that might require giving the employer some control, but that is not nessasary.

The main benifits I see are: not having to carry two phones, and having more freedom to choice what device you use.

<comment><USER12> But you can have the cake and eat it too:

Company lets you decide what device you want, pays the bill and - allows you to use it privately. I gave my mobile contract to my wife, only use my 'business' phone now. Private calls are explicitly allowed (most calls are free anyway, in this contract). Some common sense is required: Calling a dating line is probably stupid, talking to relatives in somewhere-over-the-sea is out as well. The only 'real' limitation I have is that I should avoid excessive texting (I .. write one sms a month, maybe, anyway. Nothing that concerns me), due to the way the contract works.

So: \- device of my choosing \- only one device on me \- I call my friends and family using said device

</comment></comment></comment><comment><USER13> Unrelated, but the ridiculous banner on that website takes up half of my screen, and a good portion of it as I scroll down, the purpose of which is beyond me. "We noticed you are in the United States"... no I'm not.

</comment><comment><USER14> > Consider these factors when building a compliant reimbursement policy [... > long and incomplete list ...]

Those regulations are micromanaging trivia. Is that really the proper role of government? In addition to the cost of the phones, companies have to hire additional people just to design, build and manage a "compliant reimbursement policy."

<comment><USER15> The "role of government" phrasing makes this sound more anarcholibertarian than I think you meant it, but it's really not that notable.

The use of "compliant" is a little misleading. This is a court ruling, not a regulation. It just says that you have to pay for your employee's expenses, which is sort of a "duh" thing to me. Companies have "compliant reimbursement policies" for travel and purchasing and client schmoozing already, and this need be no different or more complicated.

If employees have to pay for stuff you have to pay them back. That doesn't sound like over-regulation to me.</comment></comment>


Genius engineer Claude Shannon used this problem-solving process - <AUTHOR> https://www.businessinsider.com/engineer-claude-shannon-problem-solving-process-2017-7 <comment><USER2> From 2017 to promote this book:

[https://www.amazon.com/Mind-Play-Shannon-Invented- Informatio...](https://www.amazon.com/Mind-Play-Shannon-Invented- Information/dp/)

Anyone have any other recommendations for books about Shannon?

I believe he's covered by James Gleick here:

[https://www.amazon.com/Information-History-Theory- Flood/dp/](https://www.amazon.com/Information-History-Theory-Flood/dp/)</comment>


The long tail of MD5 - <AUTHOR> http://www.tedunangst.com/flak/post/the-long-tail-of-MD5

<comment><USER2> These days, I find using MD5 absolutely inexcusable. SHA-1 is available pretty much everywhere, SHA-2 algorithms are quite readily available too. BLAKE2 ([https://blake2.net](https://blake2.net)) is slightly faster than MD5, and significantly more secure. It's based on the SHA-3 finalist BLAKE. Additionally, there are versions of the algorithm that parallelise using SIMD, and there are both 32-bit and 64-bit optimised versions too. It also gives you the possibility of customising your hash, using it as an HMAC at no extra cost, salting it, or adding a personalisation key to effectively have different hash functions for different purposes. As a nice extra, it also uses a third less RAM than SHA-2 or SHA-3. If output length is a concern, truncating the output (with a corresponding increase in the likeliness of collisions) is perfectly fine with any good hash function.

</comment><comment><USER3> MD5 also remains quite popular for file hashing/hash set analysis. I.e., is this file a member of a known set? For example, NIST's NSRL still includes MD5 hashes.

* This is not an endorsement of MD5 for such use cases.

<comment><USER4> Do the security problems with MD5 make it bad as a hashing algorithm?

<comment><USER5> Generally the tuple (<length>,<hash>) is unique since the attacks on MD5 all involve changing the number of octets in the hashed source. That said, it isn't secure if you can change the length independently of changing the hash. Hence the challenge of using it cryptographically. If you're confident you know the correct 'length' value (acts as a sort of openly shared secret in this case) then you trust the hash.

<comment><USER6> I believe this is wrong, and in this case it's very dangerous information. See for example the Wikipedia article for two chunks of data that only differ in a few bits (not length!) and hash the to same MD5 hash: [https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities](https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities)

</comment></comment></comment></comment><comment><USER7> Good article that really shows why design decisions can have impact 20, 30 years or more.

This is why I get fairly upset when people design something new I n 2014 that uses md5. Yes even if your application does not use md5 for anything security related, the mere fact that you use a bad, slow algorithm should be considered wrong. And adding new dependencies will make it harder for us to migrate away and extend that tail even further.

If you need a good hash function that is fast, use SipHas. If you need a really secure one, use SHA-512, SHA-3, BLAKE or just SHA-256.

<comment><USER8> Do NOT use SipHash as a cryptographic hash function. It is designed to be a PRF, and its output length is way too small to make it collision-resistant when used as a hash. SHA-3, SHA-512/256 or BLAKE(2) (in increasing order of performance) are suitable cryptographic hash functions.

<comment><USER9> I think you meant: it [SipHash] is NOT designed to be a PRF.

<comment><USER8> No, I meant what I wrote. SipHash is fine as a _keyed_ primitive -- 128-bit security against key recovery, (64 - t)-bit security against 2^t forgery attempts.

However, as a hash function (e.g., with a fixed key), it is entirely too weak: 2^32 work for a collision, and 2^64 work for arbitrary (second-)preimages.

<comment><USER9> OK... so if it's suitable as a PRF, then you should be able to widen the output by using two different keys and concatenating the results, no?

<comment><USER10> Unfortunately not: it's only 64 times slower to generate 2^64 collisions for hash function by generic attacks than just one, and those 2^64 messages will contain a collision for another hash function of length 128. The total time is only the sum of the times for each one.

<comment><USER8> The attack you describe---Joux's multicollisions, as far as I can tell--- applies to Merkle-Damgard functions. SipHash is a spongy, wide-pipe, design where that sort of thing doesn't work. The generic bound is (k!)^(1/k) ⋅ 2^(n(k-1)/k)) work to find a k-collision, or approximately k ⋅ 2^n for large k.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Content-MD5 has been removed from HTTPbis.

Don't forget VBA digital signatures BTW, for which MD5 is the only choice. I wonder how feasible a collision attack would be.

<comment><USER12> Yeah a couple years ago I was trying to determine whether to support Content- MD5 in some HTTP software I was writing I could find nobody actually using it. There was an attempt a decade ago to make Firefox validate with it, but that died: [https://bugzilla.mozilla.org/show_bug.cgi?id=232030](https://bugzilla.mozilla.org/show_bug.cgi?id=232030)

Also the author is wrong that there isn't a proposed replacement -- it's the "Digest:" header (RFC 3230) although I don't think anybody uses that either.

<comment><USER13> Id hazard the most prolific use case of md5 as http checksum is AWS S3. You can, IIRC, send content-md5 on PUT and POST and theyll reject with a 400 if the body hash doesnt match. Conversely the default etag is the body md5.

</comment></comment></comment><comment><USER14> Want to kill MD5?

Provide public-domain easy-to-compile/use versions for all languages, and furthermore, get their google page ranks high.

Do not underestimate laziness. If Joe Random can find a suitable MD5 algorithm in 10 seconds but it takes 30 seconds to find a suitable SHA algorithm, guess which one gets used?

<comment><USER15> Honestly, this is not so much a problem. Cryptographers like to write simple C public domain implementations of their algorithms and then people go to work for months and years squeezing performance out of them, cryptanalyzing them, recoding them in various languages and releasing their own implementations under new licenses. You can see this happening with pretty much every newly designed crypto component from hashes to ciphers to entire crypto systems.

The problem is exactly the one elucidated in the blog post above: the long tail of baked in brokenness. These systems were never designed to be extensible, they are cooked into code that hasn't been serviced in years, perhaps even decades in some cases. They're bolted into specifications in ways that either obsolete the technology completely, or make it so incredibly complicated to update the technology that doing so outweighs the apparent cost. And that's without considering problems like deployment and phase-out.

These types of problems make it very likely we will be stuck with the stupidity of DES and MD5 in strange places until it becomes a fire drill and then all the sudden people will be baking in SHA-1/SHA-2 or BLAKE2 and we'll be going through these very same motions again in 5-15 years, wondering why we didn't learn from the mistakes we made last time.

</comment></comment><comment><USER16> HMAC MD5 is a perfectly reasonable choice for some situations.

<comment><USER17> A situation like not caring.

</comment></comment><comment><USER11> _Everybody knows that MD5 is as terribly useless as ROT13_

Huh?

<comment><USER18> Collision attacks are trivial. It's been almost ten years since Ron Rivest declared MD5 broken.

<comment><USER11> I know, but this does not make MD5 as broken as ROT13.

<comment><USER19> Rot13 is actually useful. I have perl scripts which download my bank statements, running from cron. Gets the latest every month. These perl scripts use passwords, but without knowing that they are there, who would find them?

The trouble is, they have to pass the name of the form field to the server on the other side, which is some variation of "password". So anyone doing a simple string search will eventually find the perl scripts, and have access to my passwords (supposing they have root).

If I rot13 the form field name, and then have the name be rot13('cnffjbeq') in the script, this makes is unsearchable.

<comment><USER20> Note to self: add "cnffjbeq" to my password-finder scripts.

<comment><USER19> Might as well add rot-1 through rot-25 to it as well... not like there's a storage constraint, is there?</comment></comment></comment></comment></comment></comment>


Academics have built models to assess the probability of a putsch - <AUTHOR> https://kyso.io/KyleOS/using-data-to-predict-a-coup <comment><AUTHOR> According to CoupCast, Burkina Faso, Afghanistan, and South Sudan should be all be wary of a coup in the near future.</comment>


Detroit: Bike City - <AUTHOR> http://vimeo.com/25805461 For all of you who think all of Detroit is a vast wasteland here is proof that it is not. <comment><AUTHOR> For those of you that think Detroit is nothing but a vast wasteland here is cinematic proof that it is not.</comment>


Y Combinator Dataset Of Posts Version 1.1 - <AUTHOR>

A 102MB archive of Y Combinator posts is available by accessing http://www.rushy.com/ycombinator-news20080506.tar.gz<p>More to follow in the next day or so. <comment><USER2> Wow. That's a pretty large file. Might I suggest mirroring it or creating a torrent?

Good effort though. I shall download later when I'm home and have a look.

<comment><AUTHOR> This is an ongoing issue ( <http://news.ycombinator.com/item?id=172701> ) and I've had to hide the file on the borrowed server due to excessive use of bandwidth during business hours. Downloads can resume after 7PM BST. Regardless, some people have obtained the archive in full so mirrors may become available before 7PM.

<comment><AUTHOR> Apologies for interruption. The file is restored and downloads can resume.</comment></comment></comment>


Firefox Ships with 6000 Potential Bugs, Community Lead Departs - <AUTHOR> http://www.conceivablytech.com/9114/products/firefox-ships-with-6000-potential-bugs-community-lead-departs

<comment> ac-slater Chrome manages to release every six weeks without each release creating a deluge of bugs. This makes me think that maybe Mozilla is missing something that make's Chrome's fast release schedule successful.

</comment><comment><USER2> that's pretty much what happens when you run behind versions</comment>


Restoring the Gold Filter in Deus Ex: Human Revolution – Director's Cut - <AUTHOR> https://cookieplmonster.github.io/2020/04/26/dxhr-dc-gold-filter/ <comment><USER3> I've never been an avid gamer, more of a casual one, but I am so glad I played Deus Ex: Human Revolutions all the way through. It didn't feel like a game, more like experiencing an interactive sci-fi book. The story, the settings, the _music_, absolutely fantastic. I still sometimes listen to the soundtrack when doing work (it is available in Spotify).

I would encourage sci-fi fans to give it a try, you can pick it up for cheap nowadays and you won't need top hw to play it (although it won't hurt either).

Edit:

Then entire soundtrack is also on YT [0]

[0] [https://www.youtube.com/watch?v=tyG6YMLEWus](https://www.youtube.com/watch?v=tyG6YMLEWus)

<comment><USER4> If you liked Deux Ex, I highly recommend checking out Prey (the 2017 one) and Dishonored. They share the same game design philosophy, the so called "immersive sim".

<comment><USER5> and when you are trough with these, the original deus ex is still an awesome game.

The main thing that got very old between the game release and nowadays is that conspiracy theory were a joke in 2000, but twenty years later they are taken very seriously by way too many people, including the current US president.

Also, this kind of game is often called "immersive sim", it has seen a mini resurgence in the last years.

Breath of the wild fits in that genre as well, so does MGS5 or Rimworld. They are all very different from Deus Ex, so it really depends on what you liked in that game.

<comment><USER4> Yeah, the original Deus Ex is still one of my all time favorites. It's a bit harder to go back to now, but it's still fun, especially if you use a few mods to modernize things. (I prefer the GMDX overhaul mod.)

It's amazing how much that game accurately predicted.

<comment><USER6> The original Deus Ex is still an approachable and fun game from a gameplay perspective, because so many of its gameplay choices became mainstream.

And the story? Timelier every year.

<comment><USER7> I'm not someone who has a problem with older games - I've gone back and had a blast with System Shock 2, Baldur's Gate, Mechwarriors 2/3/4, Thief, Planescape Torment, etc. relatively recently.

But Deus Ex is one of the few classics that I just can't get to click. It just feels too clunky and ugly, with a lot of the mechanics coming across as ...not to my preferences let's say. Even after I've completed the whole campaign two times over I still just don't "get it". As for the plot getting timelier, to be honest it still just came across as conspiracy gibberish to my ear. I dunno, maybe I'm just not smart enough for it.

<comment><USER4> > to be honest it still just came across as conspiracy gibberish to my ear

Warren Spector said that his initial idea for the game was "what if every conspiracy theory was true?", so that's pretty intentional. So as long as you buy into that conceit, there's a lot of amazingly clever writing in the game.

My favorite conversation in the game is probably the one with the AI Morpheus: [https://www.youtube.com/watch?v=1b-bijO3uEw](https://www.youtube.com/watch?v=1b-bijO3uEw)

<comment><USER8> My favourite is the sub-plot about the two coffee chains. No spoilers!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Big fan of the game and I actually liked the gold filter a lot. The designers described the art style of the game as cyber-renaissance, mixing the premodern larger than life characters and themes of remaking mankind and so on with the technical futuristic stuff.

I thought that was a pretty unique take and I found the art direction of the newer Deus Ex game to be bland in comparison.

<comment> m-p-3 And the presence of triangle shapes throughout the environment, the design team did an amazing job.

<comment><USER10> Indeed. While playing, I enjoyed taking a moment to stealth up and appreciate the level design, and so did a lot of other folks [1].

[1] - [https://unrealitymag.com/the-strange-wonderful-ceilings- of-d...](https://unrealitymag.com/the-strange-wonderful-ceilings-of-deus-ex/)

</comment></comment></comment><comment><USER11> One of the things I liked about the Bloom effect used in DXHR is that, in addition to the gold filter look, it gave the game a very "dream" like appearance, similar to how Prince of Persia Sands of Time did it.

It used to be a very abused effect back in the mid-2000s when it first started to become popular with games like Tron, and to some degree DXHR abused it as well to achieve that aesthetic. However, I want to say that it did it tastefully nonetheless.

<comment><USER12> Seeing these screenshots reminded me of all that bloom-abuse, which feels like a hallmark of the xbox 360 era. Seeing these shots was a good reminder that it could be tastefully used.

</comment></comment><comment><USER13> The original Deus-Ex is still one of my all-time favorites and a top 10 video game ever, right up there with Half-Life and others.

What's especially crazy is how much of that story line has become true.

</comment><comment><USER14> You never asked for this, but _Ross 's Game Dungeon: Deus Ex - <USER2> Revolution_ is a delightful critique of the subject matter (a.k.a. lemon blast mode): [https://youtu.be/vYLEuQrvND0?t=351](https://youtu.be/vYLEuQrvND0?t=351)

</comment><comment> debug-desperado "I can't explain what is going on here from the technical side, but I assume the shader got converted incorrectly from the source platform (possibly Wii U)."

The consensus from Steam forum posts is that the Director's Cut version is littered with downgrades throughout: missing gold filter, lower res textures in places, lighting differences, etc. Also there are many patched-out bugs that had regressions with the Director's Cut.

It's still a great game, and I applaud the author's efforts to restore it. I'd wager that the effort to bring this version of the game from Wii U back to PC was a merge from hell and too many things just got looked over.

</comment><comment><USER15> A funny easter egg mentioned in the developer commentary - if you look closely the empty paintbucket prop that can be found scattered throughout levels are colored as though they contained gold paint.</comment>


GoDaddy SSL Cert Scam - <AUTHOR> http://rentzsch.tumblr.com/post/7471141866/godaddy-ssl-cert-scam

<comment><USER2> Timely...

At work we use RapidSSL (a division of GeoTrust) for a handful of certs. Last night I received an email with a banner warning me, "Your certificate is ABOUT TO EXPIRE". The email goes on to list the expiration date as "Oct 12, 2011". Four months is certainly generous notice, but I've always taken this as a simple marketing attempt to maintain customer loyalty.

Usually I take these emails as tickler reminders and delete the first couple. When I eventually decide it's time to renew, I pull up the site by typing the URL into the browser. Upon reading this article, I wondered whether following the link in the email would result in a different pricing structure. As it turns out, the answer is yes, though after playing around, it doesn't appear to have anything to do with the email link.

The first page of RapidSSL's order form handles both new orders and renewals with a pair of radio buttons. Another section of the form allows you to specify the validity period from one to five years. The prices appear alongside the choices, and are currently the same for both initial orders and renewals.

First I visited "www.rapidssl.com" and clicked the "buy/renew" link for a single domain cert. I got an order form with the following prices for 1-5 years:

49, 86, 122, 159, 196

Then I pasted the link from the email (which contains a fairly simple query string that does not appear to have a unique identifier in it) into a different browser. I clicked the "buy/renew" link for a single domain cert, I get the same form with the following prices:

79, 138, 198, 257, 316

It's interesting to me that the difference in price actually increases as the validity period increases:

30, 52, 76, 98, 120

Still more interesting, after resetting the browser and pulling up "www.rapidssl.com" directly, the prices are completely different:

29, 51, 72, 94, 116

I tried the email link one more time and got the 49-86-122 pricing again. Then I tried it one more time and got 19, 33, 48, 62, 76. So clearly RapidSSL is varying their prices on the fly, presumably to gain insight as to what people are willing to pay. I was ready to claim the link in the email yielded higher prices, but that seems not to be the case. So I guess after all that, this isn't particularly interesting. I'll definitely hit the site a few times when it comes time to purchase though.

Unfortunately the pricing structure for a wildcard certificate never seemed to vary.

<comment><USER3> You might be interested to know they're even cheaper when purchased through a reseller, e.g.: [http://www.namecheap.com/ssl-certificates/geotrust-ssl- certi...](http://www.namecheap.com/ssl-certificates/geotrust-ssl- certificates/rapidssl-certificate.aspx)

I suppose they think that since you're visiting their site directly, you wouldn't think (or know) to visit one of their reseller partners instead.

<comment><USER4> Most vendors who have channel partners don't want to compete with them, but they don't want to leave sales on the table, either. For bigger ticket items, the company generally sends you directly to a channel partners; for smaller ticket items, the company will often sell the item at "list" price and let the channel partners discount off of list.

Pretty standard operating procedure here and highly unlikely to be a comment on their customer's web savvy. :)

</comment></comment></comment><comment><USER5> HAHAHAHA. Well, it actually gets worse. If you cancel the auto renewal, then go into Google and search for "ssl certificate" you'll get a wonderful ad (at the very top) that is for $12.99 (with the quote "why pay more"). You can then buy that cert and it gives you the exact same thing as the renewal (admittedly a bit more work, but is the convenience of auto-renewal really worth $37?).

Been doing this for the last 3 years: they are TRULY retarded for using such a scheme but hey! It catches some people, so I guess tactics like that got them the $2bn "investment" from the friends at Silver Lake.

<comment><USER6> Exactly. Disable auto-renew for all your GoDaddy products! Thankfully GoDaddy explains how to do this:

<http://help.godaddy.com/article/1042>

</comment></comment><comment><USER7> I never understood why GoDaddy has such a monopoly-like status - even in the startup scene. I've only used their services once (because someone transfered a domain to me and prefered to do this as GoDaddy-internal transfer), but the first thing I did was transfering the domain to another registrar (the one that I typically also use for my other domains).

Reasons why I wouldn't use GoDaddy:

GoDaddy is not really one of the cheapest registrars.

I find their pricing "tactics" (as also mentioned in the article) very questionable.

Their whole website isn't just really appealing to me (I know, very subjective).

<comment><USER8> What's cheaper than GoDaddy? All my .com and .net domains end up costing me $7.49. I'd love to know...

<comment><USER9> Cheap until you get roped into an auto-renewing thing with 3x the price you first paid. Why support a company like that? It's so slimy. Your cheap domains are effectively subsidized by GoDaddy preying on others.

<comment><USER8> Did you know the majority of car insurance firms (in the UK at least) will ramp up renewal prices by a few % each year? I did sales for one such company a few summers ago, and we were told this was intentional - and if someone calls in, and complains, we just offer them to new sign-up price.

I use GoDaddy because I manually renew all my domains at the same price as I signed up for. I agree their UX is awful, and they're not the most "good" company in the world... but it serves me for what I want out of a domain provider!

Renewal price hiking is a common practice... you just need to be a smart shopper if you want to save money!

</comment></comment></comment></comment><comment><USER10> 'Scam' is a really strong word and denotes an illegal action.

While these are shady practices, they are not illegal.

And the 1-month ahead renewal is not shorting you of a month. It's preventing you from getting into a situation where your cert expires because your CC details were invalid and it took to long to replace them. It also gives you time to configure your server, etc.

They are hardly the first company to offer a different initial price than the renewal, either. I hate that tactic, and watch for it, but it's not even unethical unless they don't tell you about it.

<comment><USER11> I'm sorry I must disagree. Its not a scam in the classical sense but it is one. Its like the real-estate sites that ask for a credit card and a free trial, to cancel you must CALL between 3-4pm on a Wednesday when their lines are busy AND they promptly close doors at 4pm or you will get charged perpetually.

However GD can offer whatever they want. HOWEVER this is deceptive marketing AND I am fairly sure you can take em to courts over this.

<comment><USER12> If the real-estate sites really make it impossible to cancel, why not call your credit card company and get them to issue a chargeback?

<comment><AUTHOR> It was meant as an example of "scam"; your question is irrelevant to the discussion.

</comment></comment></comment></comment><comment><USER13> I had the exact same thing happen to me. One of many reasons why I've not only stopped using GoDaddy for myself but also why I've decided to REFUSE to work with them for my clients. If my clients use GoDaddy, they can either get off GoDaddy or find another developer. Sometimes you have to force morality upon those without. :P

</comment><comment><USER14> Okay, I use godaddy for domains and DNS. Never had a problem with them. But these 'godaddy sucks' posts and the godaddy buyout are starting to worry me. Who would you recommend as a replacement for registration and DNS?

<comment><USER15> Shameless plug. My new startup Coffee & Domains does domain registration, free private whois, and DNS control for $10 per year.

<https://www.coffeeanddomains.com>

<comment><USER16> Any plans to allow purchases from Non-US countries?

I just tried to buy a domain but can't fill out the form.

<comment><USER17> Really? Damn. I was considering trying someone new for domain management and put this on the list.

</comment></comment></comment></comment><comment><USER18> Any recommendations on where to buy a good ssl certificate?

<comment><USER19> <http://www.startssl.com/> will give you a free ssl certificate for a single domain (actually, they'll give you one that covers a domain plus a single subdomain). Handy if you want to setup your own mailserver somewhere: the root certs are in all the main browsers & mail clients. You'll need to have your (web|mail)server serve up the intermediate cert as well as the leaf cert which can be a slight pain to setup, but apart from that it all works just fine.

<comment><USER20> The root cert is not in early versions of Android, due to a bug. I'm not sure when that was fixed. Unfortunately, you can't update root certificates in these versions.

<comment><USER19> Are there any phones out there that can't be at least updated to Froyo now, whether officially or not?

If you're geeky enough to want your own ssl cert then you're geeky enough to root your phone & install CyanogenMod.

<comment><USER20> I can't update my users' phones for them. Just pointing out that users stuck on older versions of Android, for whatever reason, may run into problems with the free cert. In the mail client, it will work if "TLS (if available)" is checked, but that's a departure from what other mail clients mean by that option.

<comment><USER19> If you check that then won't those users using an unencrypted connection?

</comment></comment></comment></comment></comment></comment><comment><USER21> Domains are GoDaddy's loss-leader.

All profits come from cross-selling, up-selling, and shady tactics.

A registrar that has sold 1 million domains at $10/year price, and does nothing else, is one that will make at most about $25,000/year in profit max after various costs (reg fees, support, etc), but more likely will be in the hole.

I stopped blaming GoDaddy a long time ago. This is just the nature of the game.

</comment><comment><USER22> The author's first point is incorrect.

GoDaddy doesn't take a month off the length of the cert. They do start sending you reminders 60 days ahead that say your cert needs to be renewed in 30 days, but you get your full extra year. I've had the pleasure of doing this dozens of times for our certificates, the last thing we buy from GoDaddy after moving our domain business elsewhere.

</comment><comment><USER23> Never liked GoDaddy's service. There are several reasons why. So moved to namecheap.

But the point here is GoDaddy by default puts all your services on auto- renewal. I am a bit paranoid over what goes on in my accounts ( especially PayPal) so i had disabled the auto renew when i saw it.

Talking about price hike, thats a marketing strategy. You usually don't get coupon codes for renewals ( if you do get, those are usually for bulk renewals ). These service providers always lure you to register at special prices so you stick with them forever and in this case it auto renewed :\

About the cert. expiration, that seems a bit odd but better talk to GoDaddy Support, they would help you out.

</comment><comment><USER24> Same thing would have happened to me but my credit card on file expired. Talked to customer service and was never charged. Despite some of the obvious disadvantages of using GoDaddy, I've always gotten great customer service from them.

</comment><comment><USER25> Was start date of the renewal term synced to the end date of the expiring term? If so it doesn't sound so shady to me. It seems logical that they would notify you and confirm your desire for a renewal prior to the end of the previous term rather than wait until the absolute last moment, especially with something like an SSL cert.

I'm not saying GoDaddy isn't shady. And they certainly are aggressive with their auto-renew policies. Heck how do you think they afford Superbowl ads and Danica Patrick at the prices they charge :) But the experience you described doesn't sound like a scam to me.

</comment><comment><USER26> The same thing happened with a Network Solutions hosting plan I had. They auto-renewed me when I had over one month before renewal. Their service had been horrible on Drupal sites. Just the DNS resolution to my hosting account was taking 2-3 seconds. I enlisted an up-time monitoring service and found that my site was down frequently even while I was paying for this renewal I did not want. Shame such a dominant company in the 90s has basically laid the road map for shady hosting.

<comment><USER27> Yes, network solutions is also terrible. I still have a domain with them, and it takes five clicks just to get to the DNS management interface. Every step in the way they try to make as unclear as possible by flashing banners and shiny buttons in your face to get you to buy more of their services.

</comment></comment><comment><USER28> Another "scam" I associate with GoDaddy is that when you pick to pay for the Whois Privacy protection, you also get a 'Business Registration' fee added (like $5/year or something trivial).

All this fee does is list your domain name or something similar in a GoDaddy ran business directory -- useless.

It's an extra charge they hope you don't notice, and it's only added to your cart when you add Whois Privacy protection.

You need to remove it from your cart afterwards.

</comment><comment><USER29> I also use GoDady because they are cheap and it does the job. For DNS, I use DNS Made Easy because it's never a good idea to have your DNSes at your registrar (if you ever need to move).

The trick with GoDaddy, don't check the box to leave your credit card with them. You'll then have to manually renew all services and you never run into the risk of forgetting to uncheck some auto-renew option...

</comment><comment><USER30> I don't really see the problem here. GoDaddy products can be had very cheaply, they are so cheap with coupon codes the probably potentially make very little per sale.

All insurance companies work the same way, try hard to get a new customer, milk them dry on the tail end because they are too lazy to search out a better deal.

</comment><comment><USER31> This isn't really a scam. I have dozens of domains with GoDaddy, as well as some of their other services. "How can I get the cheapest price" is a game we all play with them. Revision3 has a handy page with GD discount codes, and I've been referring to that page for years. I am helping keep Digg in business from the affiliate fees.

Can we agree the "auto-renew" was not scammy? They didn't rip you off a year. Just reminding you 60 days early as they should.

Can we agree its not shady or unethical to charge different prices for 1st year versus a higher price for subsequent year renewals? Or different prices for different people, in some type of A/B test? Everyone does that. Even amazon.com shows different prices to different people.

Can we agree their customer support was really helpful to you?

So what's the problem exactly?

<comment><USER32> It's unethical to charge someone one price for a recurring service and then more than triple the price, in an opt-out fashion.

If you raise prices, you need to do your due diligence to make sure your customers are aware they're paying more. This kind of a price increase should really be opt-in rather than opt-out.

<comment><USER33> I totally agree with you. The same thing happened to me with another registrar/hosting company (ipage). Hosting for a year went from around $50 to over $100 with auto-renew. I did receive an email notifying me of the upcoming renewal but no price was included in the email. When I confronted them after the fact they told me that the information was on their home page where it says something to the effect of "Hosting only $50/year" and then right underneath in small print "(save 50%)". Maybe I should have assumed that saving 50% now meant I would be charged twice as much the next time but I guess I'm not that bright. Also, when asked for an explicit price list in a chat session, they gave me a link to a page buried in the FAQ to which, they acknowledged, you couldn't get directly in any easy way.

I guess they're all the same.

<comment><USER34> > I guess they're all the same.

Gandi has been nothing but ethical in my dealings with them.

You don't have to deal with the abuses of the godaddys of the world, you just have to be willing to pay a bit more to support companies that aren't out to fuck you over.

</comment></comment></comment></comment><comment><USER35> I had the same problem, signed up last year, set it up a month later and now I'm getting time to renew emails. Also although its 'easy' to disable the auto-renew I've had products that still renewed after disabling the auto- renew.

</comment><comment><USER36> For anyone who needs SSL certificate without perks, consider free one from <http://www.startssl.com/>

It do not offer strong encryption and do not do personal identification (obviously - it is free), but it is very cost-effective solution to have <https://> on your website to prevent eyes droppers sniff traffic.

(not sure if it is enough for e-commerce, like google checkout tho)

Now you have no excuse to not have <https://> in your website where people enter their passwords =)

</comment><comment><USER37> The $12.99 price is a special price and always has been. You can still find discount codes and apply it to them when you renew to get it at the same price.

Godaddy can be insanely cheap if you never auto renew and always manually renew with discount codes.

Though yes you need to get off Godaddy. As do I. Just waiting for a little more revenue from my site to move to Rackspace Cloud :)

<comment><USER38> Sale prices that are always in effect are not "special" prices.

</comment></comment><comment><USER39> This makes me happy that we decided to go with Digicert. Although not the cheapest their customer service is above par. We just got a renew (not auto- renew) notice 60 days from expiration. Not only where they offering a 15% discount on renewal but for every day early we renew we get 2 days added to the new cert. I.E. renew 60 days early on a 12 month cert and they give us 14 months.

</comment><comment><USER40> Thanks you just saved me $70 bucks, I got charged extra for one year already and they didn't refund me after I complained.

</comment><comment><USER41> So obviously they should disable auto-renew by default and start emailing you the day before expiry, right?

Except that's nuts -- many of their customer's certs would lapse before they renewed. That's so bad that most sites should even put up with the extra 30 bucks to reduce their risk.

</comment><comment><USER42> They auto-renewed some auction service for $75 that I have never used or heard of. Really sick of Godaddy

</comment><comment><USER43> It's well known that domain/hosting companies often offer great discount for first year/payment, then charge for full price later. For example, Godaddy's $1.99 .info or Namecheap's free first year Privacy Guard or Gandi offers a free domain with their SSL cert.

</comment><comment><USER44> All SSL certs are a rent-seeking scam.

Pay the protection money, get a string of bits which cost the vendor _nothing_ to produce. Or choose between zero security or users' browsers whining about "self-signed certificate" every time they visit your site.

</comment><comment><USER45> I know people who work for GoDaddy and the confusing website is part of the upsell. That GoDaddy would screw people with SSL certificates is no surprise.

My requirements for hosting are always 'Anyone but godaddy."

<comment><USER46> I used to have an 'Anyone but godaddy" policy. Then I ended up with some names at eNom and they just emailed me my password. Now I'm shopping around to move.

</comment></comment><comment><USER47> Same thing happened to me for a $200 dollar cert. I complained through their support ticket system and they issued me a refund.

</comment><comment><USER48> Luckily if you pay via credit card then you are always protected, if you file a credit card chargeback.

</comment><comment><USER49> Screw you GoDaddy !

</comment><comment><USER50> >I called GoDaddy Support this Sunday afternoon. While it was a long distance call, I only had to wait about a minute to reach a person in their Billing Department. They were happy to refund me the $49.99 after I deleted the cert and sent me the instructions to disable auto-renewals I linked to above.

This times 1000

I experienced this exact same issue. I was pretty pissed to say the least but I called, got a human in about 60 seconds, and they refunded me as well as told me how to disable auto renew. I see no problem here.

<comment><USER51> > I see no problem here.

Really, you don't see a problem with their "better ask forgiveness than permission" tactic?

<comment><USER52> > Really, you don't see a problem with their "better ask forgiveness than > permission" tactic?

uh, isn't that what PG and all the other people here _constantly_ say is what you should do in business?

<comment><USER53> Not with my money. You taking my money without specifically asking means that I will never, ever do business with you again. (And that I'll specifically warn other people against dealing with you.)

"It's better to ask forgiveness than permission" is not a universal truth to be applied to every aspect of startups/tech work. It _is_ often a good idea when there's a lot of bureaucratic red tape and/or you need to get approval from other people about things. This is a very different situation: you're charging your customers ~4x more than they originally paid for something automatically. Are there other companies that do this sort of thing? Sure. Maybe it makes sense financially, but it's not a good way to treat your customers.

<comment><USER54> I might generalize that to say that "better to ask forgiveness than permission" just doesn't apply to customer relations.

</comment></comment></comment></comment></comment><comment><USER55> Godaddy is he only place I've found "Extended Validation" certs at a reasonable price - $99 instead of $499+. I hate their website and crosselling, but I do appreciate as the author points out that they have people you can call - how many registrars have that?

Are there any alternatives for EV certs that are not a ripoff?

<comment><USER56> How arduous was the EV process? What did you have to provide as proof? I tried to go down this route with Comodo and it was a colossal waste of time. The documents they require would make the FBI blush.

</comment></comment><comment><USER57> Use paypal guys. All those auto-renew things get 100% visible on your paypal dashboard so its pretty easy to remove them all.

</comment><comment><USER58> Complain all you like but it seems at any given time I'm working for at least one organization that is running an expired SSL certificate on a server I need to use. More of these organizations should be using auto-renew.

<comment><AUTHOR> Auto-renew won't automatically setup a renewed certificate on your server.</comment></comment>


HN Show: Shortener for phone numbers - <AUTHOR> http://phon.li

<comment><USER2> The domain "phon.li" is seven characters. If such a service would to take off, it would become irrelevant after aproximately 630 permutations in which case all the case-insensitive two-letter subdomains would be taken. At best, this shortener would only fulfill it's purpose if the subdomains were case- sensitive, in which case it could only fulfill 1,326 permutations for two- letter subdomains.

After two-characters, it's not exactly a shortener since it would be the same length or more characters than the average telephone number.

</comment><comment><AUTHOR> Thanks for your feedback. Maybe shortener is not the right word. It is more about having an easy to remember alternative to phone numbers. And it is good to grab someones attention, for example when you print your phon.li domain on xour business cards.</comment>


Infographic: The Ultimate Guide to Tech Media - <AUTHOR> http://www.lipmanb.com/tech-media-infographic-ultimate-guide/

<comment><AUTHOR> Its no secret that the tech media landscape has changed drastically in the last few years. After analyzing 100,000 articles and the business models of a dozen tech media sites this is what I found.</comment>


Are Business Plans Still Necessary? - <AUTHOR> http://www.bothsidesofthetable.com/2009/11/03/are-business-plans-still-necessary/ <comment><USER2> The last 2 startups I was involved in had no formal business plan. Instead they both relied heavily on a solid marketing plan, a rough demo and the team. That's it. Back of the napkin discussions which raised over $1m each during the seed rounds.

</comment><comment><USER3> As Dwight Eisenhower once said: (Business) plans are useless, but planning is indispensable.

</comment><comment><USER4> Plans may change or be forgotten but planning is essential.

</comment><comment><USER5> Business Plans should now be called 'working notes'</comment>


Slide to Unlock? Patented - <AUTHOR> http://9to5mac.com/2011/10/25/slide-to-unlock-patented/ <comment><USER2> They also have the patent on touch screens. Soooooo. I don't think this is a really big deal! [http://www.pcworld.com/article/230892/apple_gets_touchscreen...](http://www.pcworld.com/article/230892/apple_gets_touchscreen_patent_makes_things_potentially_awkward_for_rivals.html)

</comment><comment><AUTHOR> Michael Heilemann remembered the famous quote in this regard: "And boy did we patent it!"</comment>


A Letter From Media Temple Founder - <AUTHOR> http://bin.mediatemple.net/newsletter/media-temple-godaddy/index.html <comment><USER2> Bummer. GoDaddy is easily the worst company I've had to deal with in over a decade of running 4chan.

Godspeed to the MediaTemple guys!

<comment><USER3> How so? I know they don't have a great reputation, but I am guessing you have had to deal with a ton of companies while running 4chan. What made GoDaddy stand out?

(Apologies if you've posted an answer to this somewhere else... please provide a link if that's the case!)

<comment><USER2> [http://www.4chan.org/news?all#39](http://www.4chan.org/news?all#39)

They essentially suspended 4chan's original .net domain without warning, didn't notify me, then sent me in circles trying to get it back. At the time you couldn't e-mail or call the abuse department. You would leave a message, and they would [never] return your call. The domain was expired/released early, requiring I attempt to get it at auction, and instead a squatter got it.

So if you've ever wondered why 4chan is a .org, that's why. (And we were a .net originally because the site is based on 2chan.net.)

<comment><USER3> Makes a lot more sense now as to why gd could stand out so much... wow

Thanks moot!

</comment></comment></comment></comment><comment><USER4> So with both MT founders transitioning out as a result of this acquisition, it's very apparent to me that they wanted to cash out.

All the fluff about how this wont change anything, or how this is better for everybody is just noise. This is how it ends, MT.

</comment><comment><USER5> Yuck. That's disappointing. It's only a matter of time before MT is inundated with GoDaddy's garbage.

Moving all my domains off GoDaddy was a pain, but not being plastered with 90 sub-offers on my way to checkout is bliss. They have zero respect for customers and are just generally shady in every aspect of business.

</comment><comment><USER6> >We will continue operating as an independent and autonomous company and our mission will remain unchanged.

That's what they all say.

<comment><USER7> You just made me sad about Blizzard all over again. I was just starting to come to terms with their demise.

<comment><USER8> Or any of the amazing small studios EA has picked up and discarded.

<comment><USER7> Thanks for reminding me about those too.

On the bright side, there is a spiritual successor to Syndicate in the works, I can't recall where I read about it though.

</comment></comment></comment></comment><comment><USER9> Never expected these guys will sell themselves to a company with questionable reputation.

<comment><USER10> money rules the world

<comment><USER9> Money rules the world. Certainly not everything. Not principles, morale and/or conscience. Does it sound too bookish?

</comment></comment></comment><comment><USER7> At this point I guess anyone who works for Media Temple has lost confidence in their founder. He stated that he is proud to have been acquired by Godaddy, so that means one of two things. Either he has incredibly poor judgement, or he is flat out lying to his work force.

If its the money, just say so.

</comment><comment><USER11> This letter combined with all the MT people trying to astroturf the comments on the techcrunch post is pretty ridiculous. It's like they don't realize we are capable of thought.

</comment><comment><USER12> From the FAQ about the merger:[1]

 _What about GoDaddy's reputation in the tech community?_

GoDaddy has been transformed in recent months and is essentially a new company. If we did not like what we have seen, we would not have joined the GoDaddy family. They have overhauled their leadership team and attracted tech talent from the best-of-the-best. We love "the new GoDaddy" that CEO Blake Irving and his team have created, especially their new approach with advertising, product focus and UX.

Though neither GoDaddy's brand nor operations are being integrated into ours, we are excited to be a positive influence on them with how to make even more improvements to better serve the Web pro community

[1] [http://weblog.mediatemple.net/2013/10/15/faqs-about-the- goda...](http://weblog.mediatemple.net/2013/10/15/faqs-about-the-godaddy- acquisition/)

<comment><USER13> Well of course they are going to say things like this. They know that GoDaddy has a bad reputation, and for good reason. We all have our stories about why GoDaddy is awful.

But let's consider this: a company doesn't get rebuilt in "recent months" from the inside out. Especially one as large and with as much baggage as GoDaddy has.

Secondly, why would GoDaddy buy MediaTemple? I'd bet it has less to do with hoping MediaTemple can help them improve their customer service. Maybe my bet is wrong, but it seems to me that GoDaddy will continue making money the way they have before, which has less to do with customer service and more to do with customer count and customer confusion.

I for one believe MediaTemple will become a lower-barrier service that can be attached to a domain in the checkout process, which will probably increase the quality of package-store-website servers. Unfortunately, this will necessitate an energy focus shift that could put the boutique firms lower on the priority chain.

</comment></comment><comment><USER14> I think it speaks to GoDaddy's reputation that a portion of this letter was dedicated to talking about GoDaddy's new leadership team and motto, one assumes to assuage any concerns about that reputation's impact on MT. Judging by the comments here...it didn't have the desired effect.

<comment><USER15> As long it isn't Bob Parson's steering the ship.

</comment></comment><comment><USER16> So when can we start expecting to see tasteless MT ads during sporting events?

</comment><comment><USER17> Ah, an american love story: Two obese, dim-witted, overly wealthy hosting companies marrying each other.

</comment><comment><USER18> Considering MT has made money time and time again citing GoDaddy's faults, issues and outages, it strikes me a bit odd that they would sell out to them. But then another part of me isn't really surprised at all to be honest.

</comment><comment><USER19> echoing the sentiment here but really; how sad. MT was a staple in my earlier development career.

godaddy is a shit product. this won't hinder MT.

but godaddy is also a shit company. this makes MT a shit company by association, if not definitively.

</comment><comment><USER20> Sad. I like Media Temple but I dislike GoDaddy more.

</comment><comment><USER21> Ugh, this is really upsetting. Are there similar alternative services available? I need to find a new host...

</comment><comment><USER22> Those days when one of the worst companies buys one of the best...

</comment><comment><USER23> Here is to hoping Enom does not sell out to GoDaddy

</comment><comment><USER24> Well cash is nice...

</comment><comment><USER25> I've been with GoDaddy for years. People who blame them for their SOPA stance need to remember there was a lot of support in Congress for SOPA. Was it the best Bill? Nah, that doesn't mean GoDaddy's reputation should be torn to shreds every single time their name comes up on HN. The same people should remember there are a lot of good people at GoDaddy, techies just like them who are trying to earn a living doing a job they love.

<comment><USER26> This is some Grade A shilling. Well done.

<comment><USER25> I've got some domains with GoDaddy, that's it. Does that make it ok for you to make an unfounded and wrong accusation?

edit: Adding a reference: [http://en.wikipedia.org/wiki/Shill](http://en.wikipedia.org/wiki/Shill)</comment></comment></comment>


Predictors Of The Fundraising Market - <AUTHOR> http://techcrunch.com/2012/08/04/predictors-of-the-fundraising-market/ <comment><USER2> As a data scientist, of course I am drawn to this sort of analysis.

But is the size of the fundraising market really the appriopriate target variable? The amount of VC that can be raised is a useful number, because companies always want to be able extend their runway.

But isn't this figure ultimately a proxy for numbers that are more broadly applicable? Such as: Will your company's growth accelerate or decelerate? What is the amount of "value" being created by tech? How likely are you to make money as a tech investor? (Admittedly, some of these are very difficult to measure, and there are a lot of confounding factors.)

I'm curious if other people have ideas about what is useful to predict, in terms of the economics of tech.

</comment><comment><USER3> Interesting. Totally makes sense when you think about it. Asset allocation among the LP set tends to be backward-looking, so if we believe exiting via IPO = high fund IRR, we should expect fund flows into VC. Similarly if we assume that M&A exits are less profitable (especially, less likely to move the needle on a particular fund's IRR) we should expect to see pressure on the VC to reinvest that capital and take another swing of the bat.</comment>


Mentor for Python - <AUTHOR> How can I find a free python mentor? <comment><USER2> A colleague hired a python programmer from upwork.com to review his code.

</comment><comment><USER3> What would you do with such a mentor?

<comment><USER4> That might be what op is looking for: Guidance. It's very clear that mentorship is a really good tool, however it might not be so clear how can you get the most out of it.

A good mentor would be IMHO the one leading the relationship.

</comment></comment><comment><USER5> look for people in your local meetup groups.</comment>


The Joy of Interpretation - <AUTHOR> http://yaxu.org/the-joy-of-interpretation/ <comment><USER2> Summary: iPad and consoles are restrictive (Agreed, but those who read past the first paragraph - which held such promise - probably know this already)

</comment><comment><USER3> I was expecting to read something on interpreters, jit, or virtual machines.</comment>


MapReduce and RDBMS: Practice and Theory - <AUTHOR> http://grigory.us/blog/rdbms-mapreduce/

<comment><USER2> I disagree with the last statement: "While there is room for apple-oranges none of these seem to be successful so far. It seems to be common sense that SQL-on-Hadoop just like an apple-on-orange is not a great idea in terms of performance. Limited success in attempts such as Hive on Hadoop seem to prove this so far. Using low-level programming languages such as C++ with RDBMSs is also possible (see e.g. SQLAPI). However, described above advantages of RDBMSs most likely vanish if you do so."

Actian Vortex has shown that you can have a fully ACID compliant database running on top of Hadoop all while providing exceptional performance. [http://wwwcdn.actian.com/wp-content/uploads/2014/06/AAP- Hado...](http://wwwcdn.actian.com/wp-content/uploads/2014/06/AAP-Hadoop-SQL- Edition-Benchmark.jpg)

</comment><comment><USER3> MapReduce and RDBMS are apples and oranges - both are good at what they do and are effective within their own use cases. One allows you to handle any type of data and manage it whichever way, another allows you to understand your data if you can live within some defined structure. It is silly to suggest to use MapReduce to power a dashboard with sub second response time. Same way, it is silly to suggest using MPP or RDBMS like techniques for processing highly unstructured or even semi structured content.

Apache Spark is getting close to being able to do both, but still as a developer building a data stack, I would not inspect terabytes of data every single time if 80% of questions can be answered by looking at data once and saving summarized results in relational format.

I thought Hadoop vs RDBMS was a fight settled may be 4-5 years ago! Amusing to see it being raised at this time.

<comment><USER4> We have stored many terabytes of unaggregated transaction records in Vertica and analyzed large subsets fully ad-hoc, on-the-fly in less than 5s. We have also used BigQuery to directly power dashboards with few-second response times, also analyzing billions of records at a time.

On the other hand, we both build and use summary tables with Spark. (in a relational format to boot, and using Spark SQL).

I think you would benefit from re-evaluating the assumptions you made 4-5 years ago.

</comment></comment><comment><USER4> Parquet + Spark SQL makes me wonder if MapReduce and columnar MPP are really so far apart?

I know they're orders of magnitude slower than e.g. Vertica today, but I wonder if there is a fundamental reason for that, or is it just the implementation?

<comment><USER5> Most of the performance differences are in how these systems handle representation, I/O, and execution scheduling. In other words, implementation. The challenge in closing the gap is that the architectures across systems are quite different so you can't just add performance that is largely derived from fundamental architecture.

Columnar MPP needs to be carefully defined to answer the question. Some important data models that fit in these architectures operate on data types that are not meaningfully order-able at a mathematical level i.e. you can't sort them. A lot of columnar implementations, and virtually all in open source, assume sortability as a property of the represented data types.

tl;dr: Columnar MPP sometimes is not far outside what you can express with Parquet/Spark/MapReduce/etc, just much faster, but there are data models supported in some advanced Columnar MPP systems that are not usefully expressible with that stack. It depends on the platform and the use case.

<comment><USER6> Sorry I don't think the last paragraph you said is true. I dont see any special data types or models that can be modeled by MPP architecture but cannot be modeled in Spark. In short, I don't believe there is much difference at the physical execution level between MPP and Spark.

I also don't understand what you mean by orderable. Spark does not require records to be oderable. Maybe you can elaborate?

</comment></comment></comment><comment> bra-ket these are not directly comparable, but look at Apache Hbase+Phoenix which is a distributed RDBMS on top on underlying Hadoop filesystem</comment>