Mac App Store: Open for Business - <AUTHOR> http://www.apple.com/mac/app-store/

<comment><USER2> Is it just me or is the .app an abomination of a UI?

Why does Apple now have three different window control styles? <http://dl.dropbox.com/u/20635/Screenshots/r3da.png>

Why are there back buttons ("like a browser") but you can't click hold to get the contextual drop down?

The navigation (Featured, Top Charts, etc) are so far away from _the other controls_ (Back and Forward) its insanely awkward to use.

It feels kind of ... weird using an app store on my Mac. I guess because I'm fortunate in that I know where to look for Mac applications, I don't really have the burning need for a central place.

<comment><USER3>
      Why does Apple now have three different window control
      styles? http://dl.dropbox.com/u/20635/Screenshots/r3da.png

Only three? That makes very consistent interface then.

      Why are there back buttons ("like a browser") but you can't
      right hand click to get the contextual drop down?

Back buttons are there, you know, to get back. Very common usage pattern. Contextual drop down? Not that common. Even Safari does not have it. Neither does Opera on OS X.

      The navigation (Featured, Top Charts, etc) are so far away from the
      other controls (Back and Forward) its insanely awkward to use.

Jus like on every web page? Does not cause much trouble though.

<comment><USER2> Seriously...

      Only three? That makes very consistent interface then.

How is three good? Why are we applauding that, when, last week, Apple had _two_ styles? I don't use Windows much but I'm pretty sure 99% of all the applications use the same window elements and style (this one: [http://media.arstechnica.com/images/windows7/Peek%20-%20Befo...](http://media.arstechnica.com/images/windows7/Peek%20-%20Before.png))

      Back buttons are there, you know, to get back. Very common usage pattern.
      Contextual drop down? Not that common. Even Safari does not have it. Neither does Opera on OS X.

It isn't right click, its click and hold. Same difference. Safari has it. App store doesn't.

      Jus like on every web page? Does not cause much trouble though.

Lets compare Safari to App Store in terms of distance... <http://dl.dropbox.com/u/20635/Screenshots/1bwg.png>

<comment><USER4> 99% of Mac apps use the same window elements and style too...

<comment><USER5> We're talking about Safari and iTunes--two of Apple's most frequently used apps. They might represent 1% of the app space, but they represent a large majority of the app usage space.

</comment></comment></comment></comment></comment><comment><USER6> I'm impressed with the Mac App Store so far. Pretty bold of Apple to push it so prominently onto every Mac user's Dock as part of a point update to the operating system.

My little landscape generator app, _Turtledoveland_ , is currently at #5 on the Top Paid list for the Graphics & Design category.

I'll be sure to let HN know what kind of sales numbers that actually means, once the numbers come in...

<comment><USER7> > Pretty bold of Apple to push it so prominently onto every Mac user's Dock as > part of a point update to the operating system.

I hope you make just bucket loads of cash. However, I wouldn't call it pretty bold. I would call it "fucking obnoxious." (Also, and totally off-topic, why does Apple keep insisting that I _restart_ my damn machines for dinky-ass upgrades like this?)

<comment><USER8> Because it's an entire OS update. It includes not just the Mac App Store app, but all the underlying functionality to enable it.

</comment></comment></comment><comment><USER9> I will say this: Apple is not afraid to leave old technology behind. While website XYZ aims to support multiple versions of every browser, including those released a decade ago (IE6), Apple won't even support Leopard with its new store, which was the version that came with the Mac I got just over a year ago.

<comment><USER10> Supporting old browsers by XYZ: you have to, to profit.

Supporting old OS by Apple: of course they want you to upgrade, to profit.

I would not say that's because Apple is brave, it makes business sense.

<comment><USER11> By the very same logic Microsoft should push as strong as Apple because it makes even more business sense for them. They don't sell hardware. Their profit comes entirely in software. Do we see the same behavior? Hell no.

<comment><USER12> And risk alienating large businesses who want business critical legacy apps supported? I don't think so. It wouldn't make sense for Microsoft.

Correct me if I'm wrong here, because I don't have the figures to back this up, but I'd imagine most of Apple's revenue from Macs comes from the home, rather than a business environment. It's easier to convince a home user to upgrade to the latest and shiniest version than it is to convince a cautious and conservative IT department.

</comment></comment></comment></comment><comment><USER13> Arrrg! No way of uninstalling apps in one central location. Why, Apple, why? There is this nice list of installed apps, why doesn't it have an uninstall button? It doesn't make any sense.

I guess you are expected to drag apps to the trash like before? That sucks.

<comment><USER14> I realized something that I think is even bigger than uninstalling: There's no software trial mechanism in the App Store. That's always been the spirit of shareware (and a lot of hosted services, too). You install it, kick the tires, and then decide on purchasing before the trial is done. But here, even programs available for trial on the actual developer sites seem only to be available for instant purchase. (The equivalent to a trial period on the iphone I guess is the lite version of an app. I wonder if that will start to be the dominant approach for Mac software, too.)

<comment><USER15> Apple has specifically mentioned that no trialware or Lite version of app is allowed on Mac App Store, and advise developer to host such version on their own. Good move by Apple.

<comment><USER16> Care to elaborate on why that is good?

<comment><USER17> It removes the unusable rubbish from the store. The last thing Apple (or I as a customer) want is a vast quantity of demo or crippleware on my computer and cluttering up the store.

<comment><USER16> Demo and full version of the app could easily be combined into one entry and that would solve the clutter problem.

I don't know about you, but even 50€ is a lot of money for me, and I'd like to try the app first and buy it only if I find it useful. And I suspect that the average Joe will not know how to find the demo version on the internet.

<comment><USER18> Steam does this, and it's great. Games have 3 buttons: watch trailer, play demo, buy game.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> If you get an error 100 (<http://yfrog.com/h4b9kkp>) attempting to download any apps, clear /Library/Caches and ~/Library/Caches. Something to do with the Terms and Conditions acceptance not firing.

<comment><USER20> Clearing the cache directories was also not sufficient for me -- I had to clear the cache directories, then sign out from my Apple ID (within the app store) and back in.

<comment><USER21> Signing out and back in worked for me. I didn't have to clear the cache.

<comment><USER19> I saw that suggested, tried it a few times, no luck. Wonder what the underlying issue is.

</comment></comment></comment></comment><comment><USER22> Call me old fashioned, but I fail to see how implementing a corporate middleman between developers and users can be a progress... OK, from a developer's stand point, this could be really beneficial (distribution, centralization etc), but as a user, it feels like seeing independent record stores about to be crushed by a shiny new Virgin Megastore. I can't help to hope this will be an immense failure

<comment><USER23> distribution already exists! it's called the internet. fire up a website, have a downloadable app, and you're done. I don't understand why people keep saying the same for "app stores" like iphone and android, and now osx too. why can't I just search for an app on a search engine, goto that apps website, download it and run/install it? how does this system benefit me as a user at all?

<comment><USER12> You don't _need_ it, but it makes things a hell of a lot more convenient. When I run Linux, I don't Google "linux media player", I just search the repository and install things much easier. If I googled "linux media player", I'd have to sort through various unrelated sites (reviews, howtos, spam/malware, old versions on different sites, forums, etc). When I search an app store/repository, I just get exactly what I want. It's less of a noticeable benefit if you know exactly what you want (because you can usually look for the app name and find their site), but it's helpful for searching for a category of apps. Additionally, it's nice to have a simpler update system. Updating apps on Windows is a mess, and I know I should really do more about it, because apps that don't include update functionality generally don't get updated.

<comment><USER23> you make a fair point, making the distribution easier is a nice feature. I still would have preferred a slightly more open approach however. How about defining an installer protocol? like install://url.to.my.servers/my.app.installer.json.or.whatever.format and then my browser could have the app installer for my OS registered on install:// urls. that way the installer format could be cross platform, and not controlled by any 1 company, but still be an easy point-and-click on a website without the hassle of running other things etc?

Then if you want the trust that the verification of apple gives you, you should make sure you only download software from apple.com, but the whole system is still more open and accessible by being online on websites rather than specific to a piece of software running on OSX.

</comment></comment></comment></comment><comment><USER24> There are a lot of apps that I'm surprised to not see in the store on launch day. Versions, Kaleidoscope, Skitch. I'd like to see a way for open source apps to show up here too, because I think managing my applications from the Mac App store will be nice.

<comment><USER25> Most of the apps I use are not there too, we'll have to wait a bit I guess. What about Chrome and Firefox. are they forbidden and they didn't bother submitting ?

<comment><USER26> Google is probably working on integrating its auto update to the new app store, similar to how they did it with Debian.

</comment></comment></comment><comment><USER27> As long as this doesn't become the only way for me to put apps on my Mac. :P

<comment><USER28> It's not. The traditional method(s) will still work.

For me the main selling point of the centralized app store is that you get all updates in a single place instead of having each app spawn it's own update mechanism.

<comment><USER29> Why hasn't anyone else thought of this before!?!

EDIT: Sarcasm.... ;)

<comment><USER30> As in Bodega, the pre-existing mac app store, or Sparkle, the mac app updating framework?

<comment><USER31> Or any of the serveral package managers on linux that have been around for ~10 years.

</comment></comment></comment></comment></comment><comment><USER32> TextWrangler is available, but has removed the command-line 'edit' command, and the ability to authenticate to edit root-owned files. So it begins...

<comment><USER33> So _what_ begins?

<comment><USER34> Crippling of the Mac for power users.

</comment></comment></comment><comment><USER35> Is this like synaptic et al.? I mean, do you get updates automatically? That would be great! Also, a central packaging tool helps avoiding multiple installations of the same software, when dependencies can be tracked and resolved. If that is what this is: cool.

<comment><USER36> They don't do dependency tracking, but will notify you of updates. I don't think Mac developers believe in packaging libraries, since it requires the same version of the library for all programs. The preferred way to do things is statically compile all of your dependencies into your binary. This has the advantage that you can just drag your .app bundle around.

<comment><USER37> Which, considering disk space is cheap, is a better way to do it than getting stuck in apt dependency hell.

<comment><USER38> It's also a security nightmare.

<comment><USER39> No. It is not. I'm really tired of this argument. It assumes other platforms are the same as Linux, and that's incorrect.

Here's why you're wrong:

Unlike Linux, Mac OS X ships with a standard, stable, and exceptionally complete set of libraries. Apple goes to great lengths to maintain binary and API compatibility, and this means a few things:

\- Most applications will _only_ require Apple-supplied libraries, as there's very little that isn't provided by the OS libraries.

\- Apple keeps the OS libraries up-to-date.

This feature-complete ABI/API-stable environment is not free for Apple to provide -- it takes a lot of effort to provide a consistent API across libraries and maintain the API/ABI compatibility across releases, but the advantages are tremendous. Mac OS X has been able to skate by without package management for years because this approach allows for drag-install drag- uninstall application distribution.

UNIX derivatives, on the other hand, were faced with a lack of standardization of core application libraries, a huge number of incompatible libraries to fill in the gaps, and a software distribution model that involves splatting files all over the disk. The end result is that you _need_ a packaging system to maintain security updates, manage all the files on disk, and upgrade the world in lockstep due to API/ABI compatibility issues across libraries shared by wildly disparate applications.

So -- tl;dr -- it's not a security 'nightmare' because the core libraries that everyone uses are already shared and updated by the OS vendor.

This is also what makes Mac OS X so much nicer to develop _and distribute_ applications for as compared to platforms that require a centralized package manager authority to keep things sane.

<comment><USER38> I agree with you and I think all your points are valid but the GP specifically mentioned statically compiling dependencies, not using only what is already provided.

Something else that helps with Apple's way of doing things is their reasonably slow release cycle (when compared to most Linux distributions).

</comment></comment></comment></comment></comment></comment><comment><USER40> Does anyone else feel that the word "app" is already branded to mean fast and cheap? Perhaps, it's just a perception that will diminish over time. I guess it sounds better than the "Mac Desktop Application Store".

<comment><USER41> at the risk of telling you what you already know...

programmes on the mac have the extension .app; it's roughly equivalent to .exe in Windows (except it's not a binary, more like a .jar). When the iPhone started, I guess 'App' was the natural name for them, and thus App Store came naturally as well.

Now it's come to the mac, it's makes even more sense, because it's back where it (Apps) started

<comment><USER42> Minor historical note: the .app extension for application bundles is a holdover from NeXTSTEP. I don't think that has anything to do with the usage of "app" on the iPhone, and I think the Mac App Store is branded that way for similarity with the iPhone store.

<comment><USER43> Macintosh programs have always been called "Applications", and "App" is a natural slang contraction of "Application". I'd say we're overthinking this, folks.

</comment></comment></comment></comment><comment><USER44> Disappointed to see Twitter among the most popular apps. For mobile devices the native-app-front-end-for-existing-websites was arguably necessary and beneficial, but for desktop clients it really feels like a big step back to start moving back out of the browser.

<comment><USER45> I highly disagree. Native apps can provide way more better integration to your desktop and therefore improve the user experience. E.g. showing a consistent (growl) popup for tweets is not possible as far as i know from the web version. And that's just a very simplified example.

<comment><USER46> (Off-topic rant)

Yes, because it's vitally fucking important to interrupt my workflow everytime there's a new "Shit My Dad Says". God, I hate Growl sometimes.

<comment><USER47> You hate a notification framework because YOU installed an app that uses it to ping you with stupid crap?

<comment><USER46> There are a few legitimate things I need Growl to notify me about, mostly unit tests. Unfortunately, every single time I install any other Mac application that wants to use Growl to notify me about dumb shit, I have to go configure it not to use Growl for dumb shit. It's an annoyance.

<comment><USER48> Then don't run desktop Twitter applications. Problem solved?

<comment><USER46> I don't. That _was_ , in fact, my original point: did you see the comment I was originally replying to? tommi explicitly named Growl notifications of new tweets as an important _feature_ of desktop Twitter clients as opposed to just using the website. I, on the other hand, find Growl notifications to be an anti-feature more often than not, and disable them for all kinds of things (IM clients, Firefox, etc.) I actually do want to use.

<comment><USER49> So your point is that people who voluntarily it tend to have a less favorable opinion? That is not exactly surprising. Not to say your priorities aren't right for you, but I don't see the larger point here beyond "I prefer different things!"

<comment><USER46> As I said at the outset, it's an off-topic rant about how Growl by default enables every application that wants to annoy me, to annoy me. It's a two- line, two-point HN comment, not my magnum opus. The "larger point" is pretty banal: I want to use Growl for some things, but I don't want Growl to, by default, spam me with every possible notification it can, while providing no easy way to change this default so I continue to be surprised by innocuous- seeming applications that I install. (If you're ever designing software that does something similar, think about whether you have users like me and how to accomodate them. That's as large as the point gets.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER50> It's just like a massive computer magazine shareware cover disk.

</comment><comment><USER51> Pretty similar experience to the itunes store but I have to say it's interesting to see more professional applications on here.

Nice little detail it knows whether you installed an application even if you didn't do it through the app store.

One interesting little thing though.

It seems like the different applications icons still need to catch up to the quality of the ios app icons.

</comment><comment><USER52> Aperture is US$ 79,99 in the Store, Lightroom now seems so expensive...

<comment><USER53> Aperture was US$ 199 before.

<comment><USER54> Still is if you want a box: <http://store.apple.com/us/product/MB957Z/A>

</comment></comment></comment><comment><USER55> Is adware prohibited from everything in the store? It seems like every windows application I download has some sort of toolbar bundled but maybe this isn't a problem on Mac.

<comment><USER42> You don't see a lot of that on the Mac, mostly because of the culture. A lot of the big players in the Mac development world have been developing software since the 90s or earlier, so have a tangible sense of quality about their work. Newer developers are usually attracted to developing Mac software for that reason, and they don't want to disrupt it.

<comment><USER56> It's becoming increasingly more popular for developers to release a free, ad- laden version in addition to the paid version though. NetNewsWire is one example and Kiwi is another.

<comment><USER57> NetNewsWire does its small ad in a very tasteful non-intrusive way. I have yet had the urge to throw the software away for the small ad.

Whereas on the iPhone the iAds and other ads are annoying, intrusive and flashy.

</comment></comment></comment></comment><comment><USER58> I'm at #20 in Top Paid Music, and climbing... <http://thefiddlybits.miazmatic.com/>

</comment><comment><USER59> Why does Apple permanently want the 3 digit security code on the back of my credit card? Shouldn't that be asked for at the time of each payment transaction?

<comment><USER60> You don't say the same thing about subscriptions do you?

Apple treats it like a subscription. They want one click buying.

</comment></comment><comment><USER61> Anyone else feel like <https://chrome.google.com/webstore> makes this seem old-fashioned? Seriously who's going to be running software on their local machine a year from now (apart from hackers obviously).

<comment><USER19> Apple Remote Desktop, Aperture, etc. aren't going to run in the browser anytime soon.

<comment><USER62> There have been browser based remote desktop solutions for years now.

Microsoft Live Mesh and LogMeIn come to mind, but I'm sure there are others as well. They require some sort of plugin/Java/ActiveX/whatever, but hey so does video.

<comment><USER19> That's not all ARD does.

</comment></comment></comment></comment><comment><USER63> _Distribute Mac apps on the Mac App Store_

 _$99/year_

Hm ..

<comment><USER29> Really that's a pittance. And it'll keep people from blatantly spamming the App reviewers with garbage.

<comment><USER28> Yeah but it kind of sucks for open source apps

<comment><USER3> I don't know. Let's say I wan't to host it myself, I'd pay about $240 per year for Linode VPS.

<comment><USER64> I'd pay nothing, and host it on GitHub. In fact I, and many others do.

<comment><USER65> The OP said "Let's say I wan't to host it myself". So his pricing is right.

And the new appstore doesn't stop anyone from hosting their OSS on github - even for Macs. The appstore is for the average user; github is for the better than average programmer.

<comment><USER18> D'oh, I read _wan't_ as _don't want_ because of the superfluous '.

</comment></comment></comment></comment></comment></comment></comment><comment><USER66> They allow redownload. How nice... I got burned by the removal of this in the iTunes app store when upgrading my iPad failed.

<comment><USER67> What? You can still redownload, for free, any app you have ever purchased in the iTunes app store.

<comment><USER68> Just not music, TV, movies.

</comment></comment></comment><comment><USER69> Whatever the comments on this, Apple is creating another new way/market for developers to make money and at the same for itself. Genius.

fyi, i do not develop apps for apple. i gave my mac to my brother about a year ago. i figured that i could do the same with my cheap acer without worrying about dropping or losing it.

</comment><comment><USER70> Categories aren't working properly in the Turkish store. More often than not, I get the "One Moment Please..." message when I click on a category, and I have to go back and click on the category again.

Is anybody else experiencing the same thing on non-US stores?

</comment><comment><USER71>
        class UIComplaint(BikeShed.colorComplaint):
            print("blah")

</comment><comment><USER72> Wow, this is a major step towards creating an uniform marketplace for not just mobile and tablet but also traditional computers. It does seem like a natural next step, it should even have happened earlier, how come nobody thought of it until today?

<comment><USER73> Steam have run an app store for sometime now

</comment></comment><comment><USER74> Bummer - no way to create promo codes for Mac apps as of yet in iTunesConnect...

</comment><comment><USER75> Creative icon... If it was black, it would fit nicely with iTunes.

<comment><USER28> I guess it's meant to look like the AppStore icon in iOS. Which in turn looks like the Applications folder icon on the Mac

</comment></comment><comment><USER76> The Mac App Store is not showing in software update here (UK)

edit: never mind, it is showing up now.

<comment><USER77> It's showing up for me. Comes with the 10.6.6 update.

</comment></comment><comment><USER78> My x-wife purchased a substantially number of songs from iTunes - we are talking a 5 digit investment. When I moved over seas to England; I was no longer able to partake in my music due to the DRM placed on it by Apple and my new "jurisdiction."

I am very deeply suspicious about the 'app-store' what if I purchase an application while I am here in the UK? Is it going to work when I get back to the USA - or will they force me to purchase it again the way they are attempting to do with my music?

<comment><USER57> You can actually thank the music industry and labels for that, they want to artificially keep music in only certain areas. There have been a lot of times that I have wanted to purchase music that is not available in the US iTunes store, and have not been able to do so.

</comment></comment><comment><USER72> iTunes should be renamed, it's not just about the "tunes" anymore

<comment><USER13> The App Store is not part of iTunes.

<comment><USER25> App Store app is just a different interface to the itunes servers, you can try to copy links in App Store and you'll see the exact same kind of url as for tunes, movies, iOS apps, etc... In fact I don't understand why they didn't integrate App Store in iTunes. Maybe they realized iTunes is crap, or they didn't want to change the icon once again. Doesn't make me feel like they have long term strategies lately.. kind of the same with Facetime desktop not being in iChat.

<comment><USER13> I'm not sure those technical details matter at all.

If you ignore iTunes, Apple doesn't do kitchen sink apps. Their apps might not have razor sharp focus (you can do a lot of different stuff with iPhoto) but in general they stick to one theme (but everything in iPhoto has something to do with photos). I'm a fan of the hypothesis that the only reason iTunes does so many different things is that it has to run on Windows. Apple might not want to ship a few different apps for Windows, they might want to keep it all together. Apple might already have split iTunes into a few different apps if they only had to run on the Mac.

The App Store doesn't run on Windows, it doesn't have the same problem so Apple just reverted to their default non-kitchen-sink approach.

</comment></comment></comment></comment><comment><USER79> Ubuntu's had an app store for years (although paid apps are a more recent addition).

</comment><comment><USER80> Buy, download, and even redownload. its amazing how apple expected customers to pay for the same digital product over and over.

<comment><USER3> What are you talking about? I own several programs I bought before Mac App Store launched and store shows them as installed. I am pretty sure, that if you delete an app and then try to "buy" it again, you will get the same as in iOS App Store: a prompt that you already own this app and suggestion to redownload it.

<comment><USER81> I just deleted CoverSutra which I purchased this morning off the App Store and it went from "Installed" to "Reinstall" or "Not Installed" (I can't really remember which) and I was able to reinstall it with one click and it came flying back into my dock. Pretty darn easy if you ask me. However, I'm not sure if the purchases are stored locally in the app itself/cloud? Say, If I just got a brand new machine, would my app list be stored in the cloud and ready for my viewing if I logged in with my account in the App Store? I'm not quite sure about that part though.

<comment><USER82> The site suggests that you'd be covered: "You can install apps on every Mac you use and even download them again. This is especially convenient when you buy a new Mac and want to load it with apps you already own."</comment></comment></comment></comment>


Ask Hn:  Is The English Language Evolving? - <AUTHOR>

With text messaging dominating younger generations... is the English language changing?  Similar to what happened with 'Old English' writing, will language of today evolve as well? <comment><USER2> Of course it's evolving; it's always evolving. Read a 100-year-old newspaper and observe the differences. You cannot _stop_ it from evolving.

<comment><AUTHOR> So how should teachers teach English in the classrooms or teach kids how to type?

<comment><USER2> Words evolve rapidly; grammar more slowly (but surely). The truly fundamental thing change most slowly of all, so emphasize those. Don't get hung up on things like "hopefully". Help kids expand their vocabularies. Encourage them to read. Teach them the difference between formal and informal language, as it's crucial and something that many never learn.

</comment></comment></comment><comment><USER3> <http://www.youtube.com/watch?v=J7E-aoXLZGY></comment>


A Python library for writing distributed self-replicating programs - <AUTHOR> https://mitogen.networkgenomics.com/ <comment><USER2> I'm curious: what's the use case for this?

Naïvely, it looks like a platform for a virus-like application.

Reading the GitHub issues and PRs, it looks like a procedural competitor for Ansible (which is declarative).

<comment><USER3> Aside/philosophy: Do you think all life can be considered a virus?

<comment><USER4> Further aside: Viruses themselves may not even be life!

<comment><USER3> B can be A, without A being B ;)

I had this exact example in mind tho FWIW. It is an ongoing research topic whether or not viruses are life, but the analogies/similarity are overall worth noting.

Maybe on a biosphere level, or even on a more micro ecosphere level, all sentient systems really exhibit the same properties as a virus in the local context, for that system, even if entities in that system do not have the consciousness to be able to make that determination. Certainly our effect on the planet Earth since the Industrial Era should make it worth it to endeavour this analysis!

<comment><USER5> Can I interpret it like this?

human 'is' set; human set 'has' man | woman; man 'is' human but not human 'is' man

virus 'is' set; virus set 'has' life; life 'is' virus but not virus 'is' life

</comment></comment></comment></comment></comment><comment><USER6> Mentioned a few times previously on HN. Most comments were for a mention 2 years ago: [https://news.ycombinator.com/item?id=15355144](https://news.ycombinator.com/item?id=15355144)

Looks great!

</comment><comment><USER3> This is how we'll actually get AGI. Creating the necessary pre-conditions for a quasi-simulacrum of life, and just letting it rip. Beautiful work, I'm excited to dig into this further, a little later tonight.

This + incentives (hint hint, a little crypto-wallet with some cash) could really set the stage to create "Agents" (agents in the sense of independent, self running processes with their own cash balances, trading goods & services for new incomes, much like corporations which only exist in the context of humans managing day to day operations).

I'd write more but instead I'm going to dig into the docs + source code.

<comment><USER7> How do you see this specifically creating AGI?

How would you calculate the loss on a reinforcement learning model that's autonomous?

<comment><USER3> Allegory:

Running entity A performs action at time t_sub(0) that costs n_sub(t_sub(0)) currency. Response to this action by the counterparty creates a cascading tree of potential new actions, each of which require individual "reconciliations" (new actions, which each require a new response), defined by the probability distribution of potential responses->new actions. We either know these distributions a priori based on our initial conditions, or we can create them based on an initialization function.

The net present value of the expected action to these new responses can be evaluated with respect to the NPV of the current holdings of the running entity's portfolio, and that difference can be treated as the loss function.

I'm not an ML researcher, so I apologize if my lack of terminology makes this sound stupid to you but that's my initial thinking.

Feel free to email me if you'd like to discuss further, I've been tangentially working in this area for a while but this really gets my sparkplugs going.

<comment><USER8> I don't think trying to shove this model into a gradient-descent framework makes the most sense here. I'm an ML (industry) researcher and I highly doubt that AGI will be achieved with gradient descent on neural networks alone. Those may play a small role somewhere in the stack but the orchestration and reasoning will be managed by something else entirely. Neural networks today are fancy MLE machines -- nowhere close to reasoning machines, which require an "understanding" (whatever that means in this context) of dynamics with respect to the environment.

Seems more appropriate to start with a population of agents who reproduce at a rate proportional to their recent rewards, and allow them to die off at a rate inversely proportional to the same, a la a continuously-evolving genetic algorithm setup. You may have to modify the reward function to disincentivize behaviors which cause systemwide collapse, but that goes without saying.

<comment><USER3> > You may have to modify the reward function to disincentivize behaviors which > cause systemwide collapse, but that goes without saying.

Hopefully humans will figure this out one day too.

</comment></comment></comment></comment></comment><comment><USER9> I have a lot of network devices that have various python binaries. This could be really cool for running agents on them.

</comment><comment><USER10> It's basically a worm. It could be used to randomly try to brute force, thank to an embeded dictionnary, ssh server allowing password connection, propagated on the new host and start again, leaving behing it a message in new starting terminal shell.</comment>


One time Post, create instant blog posts - <AUTHOR> http://onetimepost.com/ for one time things, no account required :D <comment><USER2> There is a typo front and center.

"Tittle"</comment>


REST, I just don't get it - <AUTHOR> http://damienkatz.net/2008/08/rest-i-just-dont-get-it.html <comment><USER2> Exactly right. The dogma that develops around these kinds of things is so weird.

Update: Here is a good example of silly REST dogma: [http://www.25hoursaday.com/weblog/2008/06/10/TwoCardinalSins...](http://www.25hoursaday.com/weblog/2008/06/10/TwoCardinalSinsOfRESTAPIDesignLessonsYouCanLearnFromTheNewsGatorRESTAPI.aspx) (since a lot of people don't seem to understand that REST isn't the same as HTTP, but more like a religion layered on top of HTTP).

<comment><USER3> I think calling REST a religion is pretty unfair, and an emotive response rather than being an argument against it.

In any situation if you want to refute something a well balanced argument is much more productive, rather than name calling.

The Lenski/Schlafly dialogue is a great example of this (<http://www.conservapedia.com/Conservapedia:Lenski_dialog>). Lenski gives a compelling argument by refuting Schlafly point by point, not by attacking his religion. While the language is emotive, Lenski backs it with real points, not with the style of rhetoric Schlafly uses.

So far I see very little real discussion in this thread about why RPC is better than REST architectures.

<comment><USER4> _I think calling REST a religion is pretty unfair_

If "religion" here means what it usually means in tech discussions, namely a rigid attachment to an allegedly "right" way of doing things, then I don't think it's unfair at all. I bought the O'Reilly book on REST expecting to learn a lot about web app design, and was really taken aback to find that it was 80% dogma. Having assumed that REST=good, the authors then praise or reject various designs not for what they actually do, but for how closely they adhere to REST. For example, they criticize delicious and flickr for not being proper REST apps, which is pretty amusing.

Incidentally, I don't think the point here is that RPC is better than REST. There are more than two choices. The point is that conforming to REST for its own sake is an example of dogmatic thinking.

<comment><USER3> Personally I found the ORA REST book did a good job of explaining some of the key problems that using HTTP RESTfully solves and the benefits that brings.

I think one of the key points of the book was that Flickr and Delicious could do better with their implementations of a REST API. Just because something is successful doesn't make it optimal.

I absolutely that adhering to something for it's own sake is stupid and dogmatic, I think that suggesting improvements to an implementation based on known benefits of an architecture is perfectly valid.

<comment><USER5> Which book are you referring to? Googling brought me right back to this very comment.

<comment><USER4> I'm talking about <http://oreilly.com/catalog/9780596529260/>.

If anyone here wants a copy, email me. I've still got mine lying around.

</comment></comment></comment></comment></comment></comment><comment><USER3> HTTP is an implementation of REST. REST is an architectural style defined by Roy Fielding in his PhD thesis.

The point of using common verbs for common actions and sticking to it is that you get to be able to predict the interface.

The overloaded POST vs PUT thing is much less of an issue than other un- RESTful things. The reason not to use RPC style interfaces is that you hide data behind the interface. One of the major wins of RESTful architecture is to make all resources addressable. E.g. I can directly refer to data using a URI.

<comment><USER6> Except that the problem is that precisely none of those features were invented by the REST people. This is the way sane network applications have worked since the beginning of time. What REST introduced is a dogma that said not only "this is good" (something no one agrees with) but "you must do it precisely this way", which is just ridiculous.

Flatly: there isn't that much innovation in REST. It's a good idea that can be expressed in a few short sentences. It doesn't deserve books, and it doesn't deserve the priesthood that has grown up around it. When sane ideas start to smell like heavyweight frameworks, they've outlived their usefulness.

<comment><USER7> > What REST introduced is a dogma that said not only "this is good" (something > no one agrees with) but "you must do it precisely this way"

REST is just a description for one good way to build certain types of networked applications. I don't think anybody claims that Roy Fielding invented the concept, or that it's the only way to build anything.

If there are people that treat it as a dogma, I don't think you can blame REST; they're just the same loud and obnoxious people that treat _everything_ as a dogma (and usually don't understand it very well).

</comment></comment></comment><comment><USER8> The comments about REST being religious seem to miss the point. It seems Damien is simply saying, "REST isn't the answer for EVERYTHING". That's a pretty straight-forward and safe statement to make.

REST seems to work well for most web applications because they are typically document-oriented. Sites like Youtube, Flickr, Wikipedia, Gmail, Amazon, etc. are dealing with some form of hypermedia documents. It only makes sense to apply CRUD design concepts to documents.

Unfortunately a lot of people have taken REST design concepts too far and try to apply it to everything, which simply won't work. But does this surprise anybody? Its pretty damn hard to saw a 2x4 in half with a hammer.

From a "religious" point-of-view; I do find RESTful websites easier to test & diagnose since problems (application state) can typically be isolated to specific URLs. You gotta love it when you can refer to curl as "the truth"!

As Paul and many others point out, the web has gotten along fine with just the POST and GET verbs; but a good web application is built upon sensible and addressable URLs.

<comment><USER9> "REST seems to work well for most web applications because they are typically document-oriented. "

Can you (or anyone) give examples of things on the Web that are not concerned with the transfer and manipulation of resources?

"As Paul and many others point out, the web has gotten along fine with just the POST and GET verbs; but a good web application is built upon sensible and addressable URLs."

URLs do not have to map to the underlying architecture of a site. They are orthogonal if you provide a routing layer, something pretty common and easy to manage in most modern Web frameworks.

</comment></comment><comment><USER10> REST's big win, as a commenter said, is caching.

I think of REST-style as the read-only calls in any program being hashed to their results (e.g. "mult(5,2)" -> "10"), and used as a cache. If those parameter values are frequent, this can be a huge win. But if always unique, no win at all (minus the hash.put() and hash.get() overhead).

Probably obvious to folks here, but I now realize REST is FP, in its immutableness...

The human readability of REST is very nice (as another commenter said), but that's the specific realization of REST in HTTP - not a necessary to REST- style.

</comment><comment><USER11> > But what is the big advantage of making all your calls into GET PUT and > DELETE? If POST can handle everything you need, then what's the problem?

XML can also be used to represent anything, but that does not mean it's a good idea to use it for everything.

</comment><comment><USER12> It's still REST even when you don't use PUT, HEAD, or DELETE. Regardless, verbs are important. Consider the command-line. Which is more clear:

      $ anImplementation move --from=data/preciousFile.dat --to=data/preciousFile-aug.15.2008.dat

or

      $ mv data/preciousFile.dat data/preciousFile-aug.15.2008.dat

<comment><USER13> Make people use the first one instead of the second one, for the sake of "clarity", and they'll be banging at your door with torches and pitchforks in no time flat.

<comment><USER12> That's my point, ironically.

</comment></comment></comment><comment><USER7> I see that we're deep into the backlash phase of the hype cycle.

</comment><comment><USER14> When your API is RESTful you have a lot less explaining to do in your documentation. It totally makes sense for services to conform to the same pattern.

<comment><USER15> Assuming the service maps cleanly to the HTTP verbs, which if it does he says by all means use a RESTful interface, but if not, don't be afraid to make it non-RESTful.

<comment><USER14> Do you have an example of an online service that doesn't fit into RESTful model?

<comment><USER2> Nearly all of them? Run your packet sniffer on Gmail for example -- I guarantee that send isn't implemented with a PUT to noun url!

<comment><USER16> And your point?

<comment><USER2> He asked for an example of a web service that doesn't follow the RESTful model. I replied to his request. My point is that almost no web service is truly "RESTful".

<comment><USER14> Sorry, but I asked about a service that doesn't FIT the RESTful model.

<comment><USER2> Well, I guess it depends how you define "FIT". It's possible to shoehorn just about any service into just about any model, but that doesn't make it a good idea. For example, sending email by doing a PUT to some newly created URL is silly. There's a reason that the english language has more than 5 verbs.

<comment><USER14> Right, closer analogy would be object oriented programming, where some methods are standard (constructor->post, destructor->delete, copy->get, assignment->put) and some are totally type specific. The point of REST is that these type specific methods do not have to pollute your core / transport and can happily reside in your client libraries.

Sending email is best mapped to POST (create), not PUT (update), and the URL doesn't change for POST.

<comment><USER2> I think perhaps we're talking about a different aspect of REST.

What I find annoying is people objecting to "POST /actions/subscribe" (with the params in the post body) because it's "non-RESTful" -- the url is a verb and REST demands a noun.

<comment><USER7> REST doesn't _demand_ a noun. If they all have the same code backing them, there's no functional difference between:

        POST /actions/subscribe

and

        POST /subscriptions

and

        POST /abcdef1234567890

The shape of a URL has nothing to do with REST. However, if a lot of your URLs contain verbs it _suggests_ that you aren't doing REST. It's a design odor.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> I guess I always understood the principles behind full-on REST using all the neglected HTTP methods as a way of enforcing clean API design. Good programmers can, of course, just use POST methods for an API, and not cause grief. Others might need some nudging in the right direction: "no, that's closest to a deletion so use DELETE; and that's closer to a store so use PUT."

</comment><comment><USER16> the simplest explanation of REST:

the URL is part of the UI, both to the user and to api consumers.

If you think of it that way, REST makes a lot of sense. Sure there can be other elegant approaches, but REST is one that has gathered steam b/c it addresses this in a logical, useful way.

<comment><USER4> _the URL is part of the UI, both to the user and to api consumers_

This is not an explanation of REST. There are lots of designs that adhere to that general principle and yet don't follow REST at all.

</comment></comment><comment><USER18> I thought REST was just a synonym for CDR :)

</comment><comment><USER19> Not understanding something isn't a reason it's not good...</comment>


New data shows China has "taken the gloves off" in hacking attacks on US - <AUTHOR> https://arstechnica.com/information-technology/2018/11/new-data-shows-china-has-taken-the-gloves-off-in-hacking-attacks-on-us/ <comment> King-Aaron Is there more Chinese hacking etc stories cropping up in the media at the moment, or is it just that people are sharing them more frequently right now?

<comment><USER2> Easier to grab eyeballs with the word China on your article. Likely to do with the fact that Chinese-related hacking attacks have reached size or quality of Russian or East European attacks.

<comment><USER3> Haven't they been for quite a while though?</comment></comment></comment>


Clicking a 1959 Cherry mechanical keyboard switch – YouTube - <AUTHOR> https://www.youtube.com/watch?v=VvTSLRab7Kg <comment><USER2> two notes! thats almost jazz...</comment>


What Kind of Country Reneges on Its Contracts? - <AUTHOR> http://blogs.hbr.org/fox/2011/07/what-kind-of-country-reneges-o.html

<comment><USER2> Politicians are only temporarily in office, but get to reap immediate rewards, regardless of the longer sustainability of the process. Also, from a political perspective, future people are not present voters, so present voters may themselves be willing to spend future capital in the present.

But generally, it's not a 'contract' when a liability is hoisted on someone without them having agreed to something beforehand.</comment>


Bill Gates: Entire country must shut down for 6-10 weeks to fight coronavirus - <AUTHOR> https://www.geekwire.com/2020/bill-gates-entire-country-needs-shut-6-10-weeks-effectively-fight-coronavirus/ <comment><USER2> I don't think the answer is that simple. I would rather see a measure and act strategy. Like South Korea did.

Shutting down the entire country of 300 million people for 2-3 months puts a lot people at the risk of losing their jobs, homes and not even having enough to eat. With a country where guns are legal, and 20% having no health insurance, there will be some who have nothing to lose and cause civil unrest. Bill Gates is a Billionare, he probably doesn't feel the pain of someone working to make ends meet. I know neighbors and friends who are rock bottom right now.

I would rather see an approach of locking out the known hot spot areas. Stop all travel from hotspots unless someone tests negative. Running millions of tests periodically to see where hotspots are and managing them in an organized fashion. Meanwhile the rest of country practices strict hand washing and social distancing where possible.

Ideally when the virus was causing havoc in China, our airports and borders should have stopped all non-essential travel immediately. Every person that comes in should have been tested and put in a 2 week monitored quarantine.

We were just too late to get the testing ramped up, with enough protective gear for those who need it.

I really hope there is an effective Vaccine soon. Or someway to figure out who will have very mild symptoms and induce the virus to them in a controlled fashion such that millions of us develop immunity to it and are certified as "covid-19 safe workers". Herd immunity is not a bad idea, we just don't know why some people have a mild reaction and others need ICU.

</comment><comment><USER3> Gates is right. Without a clear, unified message from news orgs, I don't see how anyone will overcome influence from Chambers of Commerce & similar special interests.

<comment><USER4> Correct me if I'm wrong, there were some rumours around Bill gates regarding illegal clinical trials in third world countries.

<comment><USER5> Without doing any research: much like how mastercard supplied negerias ID cards (which double as credit cards). there is often no real alternative route for these government to get things like healthcare, so i highly doubt that there would be illegal trails rather than legal trails (be they against international agreements or not).

</comment></comment></comment><comment><USER4> "This is kind of the nightmare scenario," says Bill Gates, who warned about the dangers of a pandemic in 2015. "[I] talked about how we needed to invest in new platforms so that we could quickly make diagnostics, make drugs and make vaccines to stop an epidemic.

      - Bill gates.

Prevention is better than cure.

      Bill gates, a smart individual as we all know, should have preferred "prevention" than chasing for cure.

      hmm hmm.

      As always it's an intellectual mind that plays with mind of weaklings.

But wait a sec.

      There were news and posts in the past about illegal trials being carried out in third world countries funded by whom!</comment>


Capybara: Acceptance test framework for web applications - <AUTHOR> https://github.com/jnicklas/capybara

<comment><USER2> Capybara has been a part of my/our workflow for a while; I'm curious why this is on the frontpage -- is there a specific update I'm missing?

Either way, I really enjoy Capybara -- especially being able to jump between different drivers for various reasons.

<comment><USER3> Yeah, it feels like we're partying like it's 2011. I have no idea why this is one the front page either.

</comment></comment><comment><USER4> If you use Capybara, a couple of useful notes, based on what I learned implementing js-enabled &headless specs for my SaaS [3]:

First, using the poltergeist driver [1] which is PhantomJS based will tend to be faster AND raise errors when a javascript error occurs (unlike capybara- webkit), which is really handy if your app has a bit of javascript.

Also, you can inject puffing-billy [2] into the mix: this is a proxy that will allow you to mock XHR queries without touching the javascript libraries. This allows to write full integration specs for scenarios involving libraries like Stripe/Recurly.js etc, but using mocked calls.

[1] [https://github.com/teampoltergeist/poltergeist](https://github.com/teampoltergeist/poltergeist)

[2] [https://github.com/oesmith/puffing- billy](https://github.com/oesmith/puffing-billy)

[3] [https://www.wisecashhq.com](https://www.wisecashhq.com)

<comment><USER5> I recommend using the built-in Rack Test for tests that don't require Javascript, and Poltergeist for tests that do. That is the fastest configuration.

<comment><USER6> Very good point. I do this when I can so my suit runs much faster.

</comment></comment></comment><comment><USER7> Capybara's a great too that we use heavily at [https://www.incoin.io](https://www.incoin.io). One of the hangups we had is with multiple API endpoints being hit for a particular page. In some instances the first API request would finish and Capybara would assume that loading is done, when really there's another API request pending meaning our promises haven't yet finished and tests would fail randomly.

In order to prevent this you need to delay Capybara's processing so that all requests have finished using a request counter. Information is here: [http://tonyhb.com/stop-treading-water-with-marionette-and- ca...](http://tonyhb.com/stop-treading-water-with-marionette-and-capybara)

Other than that, Capybara is absolutely amazing. It doesn't replace manual UI testing by any means, though it provides a lot of confidence knowing we haven't broken critical components of our app.

</comment><comment><USER8> If you liked this, you might also like the following: [https://github.com/webdriverio/cucumber- boilerplate](https://github.com/webdriverio/cucumber-boilerplate) , not as detailed as Capybara but similar

</comment><comment><USER9> I think that your ultimate goal is to rely on Capybara for your testing as little as cleverly possible. Push all your logic into separately-unit-testable JS, perhaps use a DOM emulator, anything to get away from slow, barely- deterministic full browser Capybara testing.

</comment><comment><USER10> so, yet another later on top of seleniun or I'm missing something?

<comment><USER11> Selenium is one of the many drivers it can use. This is a DSL for driving a browser.

<comment><USER4> Indeed, it also works with webkit (capybara-webkit) and phantomjs (poltergeist driver) too.

</comment></comment></comment><comment><USER12> I was disappointed that the subtitle wasn't "tighter and tighter testing". [http://i.imgur.com/1aD54YR.jpg](http://i.imgur.com/1aD54YR.jpg)</comment>


Gallery Owner Arrested After Placing Spoon Sculpture at Purdue Pharma (2018) - <AUTHOR> https://www.courant.com/news/connecticut/hc-news-stamford-opioids-spoon-sculpture-0623-story.html <comment><USER2> I wonder why he's being charged with "interfering with police"? From the article:

"The interactions between Alvarez and police were cordial. While waiting to issue the summons, the gallerist and the cops chatted amiably about civic matters and the opioid epidemic."

<comment><USER3> You might find this interesting, where a lawyer explains why should never say a single word to the police, under any circumstances: [https://www.youtube.com/watch?v=d-7o9xYp7eE](https://www.youtube.com/watch?v=d-7o9xYp7eE)

</comment></comment><comment><USER4> Alas, if you have enough money the government won't look twice. However, mess with the money buying government officials and you WILL go to jail.

<comment><USER5> Assange on one side and Sackler family on the other.

Eventually, the people rise up and separate the heads from the bodies of the Marie Antoinettes.

</comment></comment><comment><USER6> Using art in this way is especially effective since the owners of Purdue pharma are large patrons of the arts. It should become more difficult for the art-world to hold their noses while taking the money.

[https://www.vox.com/future- perfect/2019/3/26/18282383/sackle...](https://www.vox.com/future- perfect/2019/3/26/18282383/sackler-opioids-purdue-museums-donation)

</comment><comment><USER7> This is some good quality civil disobedience.

There's some concern about the charges but "criminal misdemeanor" seems pretty on the ball here. It's not good civil obedience without some risk of a misdemeanor.

</comment><comment> d-sc I'm normally pretty in support of free speech. But this here is pretty straightforward, the person put a large object in a commonly used path. If I did a similar thing at a local school, library or gun manufacturer, I probably would face similar repercussions.

</comment><comment><USER8> Add 2018 to the title please.

</comment><comment><USER9> I hope to see a follow up article in a few days about a flash mod dumping piles of spoons next.

<comment><USER10> Actual followup article is here:

 _A giant sculpture of a bent, burnt heroin spoon, which was illegally unloaded in front of the Stamford headquarters of Purdue Pharma in June [2018], was placed temporarily in front of the Massachusetts State House on Friday and given as a gift to the state's Attorney General Maura T. Healey to thank her for her leadership in the state's fight against opioid addiction._

[https://www.courant.com/news/connecticut/hc-news-giant- heroi...](https://www.courant.com/news/connecticut/hc-news-giant-heroin-spoon- massachusetts-state-house-20181026-story.html)

</comment></comment><comment><USER11> 2018

I wonder how to show went

</comment><comment><USER12> GDPR strikes again!

> Unfortunately, our website is currently unavailable in most European > countries. We are engaged on the issue and committed to looking at options > that support our full range of digital offerings to the EU market. We > continue to identify technical compliance solutions that will provide all > readers with our award-winning journalism.

<comment><USER13> It's not the GDPR's fault if their (apparently) award-winning journalism comes with stalking.

<comment><USER14> All websites collect data on visitors. They don't want to expose themselves to the risk of being fined by the EU for not following their detailed regulations, when they have very few customers from there. It doesn't necessarily mean they're doing anything beyond what most websites in the EU are doing.

<comment><USER15> sites don't need to collect data. it's a choice which comes with a cost

<comment><USER16> sites also don't need to be prohibited from collecting data, that too is a choice with a cost as shown here.

<comment><USER13> Disagreed.

You are allowed to invite your friends home and interact with them without having to keep a mandatory spying device in your house to record the interaction.

Why should spying be allowed when you make a web search or click on a link?

<comment><USER16> Whats spying? In this situation they are merely recording signals that your device is sending to them. If you don't like the operator having the information contained within or inferred by those signals simply don't send them. Many plugins and browsers exist for that sole purpose.

<comment><USER13> > merely recording signals that your device is sending to them

They are not just recording the signals your device sends them to retrieve the page. They are serving pieces of malware (ads) that cause your device to fingerprint itself and then send back _more_ signals containing personal data.</comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: What are the end to end encrypted desktop messengers? - <AUTHOR> Preferable multi platform. I can't believe, it's not solved yet. <comment><USER3> Have you not tried searching yourself? There are quite a few.

Bitmessage, Tox, Wire, Matrix. Even Signal offers a desktop app, but it needs a phone number to register.

[https://en.wikipedia.org/wiki/Comparison_of_instant_messagin...](https://en.wikipedia.org/wiki/Comparison_of_instant_messaging_clients#Secure_messengers)

Perhaps you're referring to the fact that there's no 'standard' solution. This is the way of things, it seems - network effects weaken as choice increases.

<comment><USER4> I've used Tox before, worked fine.

</comment></comment><comment><USER5> Wire ([https://wire.com/](https://wire.com/)) is end-to-end encrypted, based on Signal protocol. It's open-source and cross-platform with mobile apps. I've been using it instead of Skype for two years and I don't regret that decision.

<comment><USER6> Looks interesting... But it is not federated, so one will not use it beyond team communications (which is a good start though)

<comment><USER7> What do you mean by "beyond team communications"?

<comment><USER6> You meet a random person and wish to connect on a chat/presence system - <USER2> is what I mean by "beyond team communications". Acceptability of such a system for that purpose either requires overwhelming adoption of a single provider (Whatsapp, Facebook Messenger) or federation (SMS, SMTP, XMPP back when Google had not yet killed it). Team communications does not suffer that acceptability requirement because tooling is hierarchically mandated.

</comment></comment></comment></comment><comment><USER8> Any mail client + any mail provider + GnuPG [0]

* Totally multi platform, even for platforms not yet invented

* Totally robust, though you might want to follow an operational guide for this [1]

[0] [https://www.gnupg.org/](https://www.gnupg.org/)

[1] [https://gist.github.com/grugq/03167bed45e774551155](https://gist.github.com/grugq/03167bed45e774551155)

<comment><USER9> GnuPG however lacks forward security, and that is seen as a downside compared to alternatives.

<comment><USER8> Very valid point, thus:

> The primary problem with PGP is that there is no Forward Secrecy. Losing a > key means that all content encrypted with thatkey is compromised. There are > two ways of dealing with this:

> create a single master holy grail key and guard it with your life

> create keys frequently and destroy them as soon as they are no longer needed

[0] [https://gist.github.com/grugq/03167bed45e774551155#key- loss-...](https://gist.github.com/grugq/03167bed45e774551155#key-loss-is- catastrophic)

</comment></comment></comment><comment><USER10> Matrix paired with the Riot.im frontend offers the best functionalities. Do not trust anything with a Facebook label on it, especially Whatsapp.

<comment><USER11> Why not WhatsApp? Isn't it peer reviewed by Signal?

<comment><USER12> I've never heard of it being peer reviewed by Signal. And even if it is, there's a lot of stuff around Whatsapp apart from the protocol that most likely is not.

<comment><USER11> It was Open Whisper Systems. My bad.

<comment><USER12> They're the people behind Signal, kind of assumed you meant them :-)

</comment></comment></comment></comment></comment><comment><USER13> Any xmpp client that supports OTR. I like psi+ ([https://psi- plus.com/](https://psi-plus.com/)), but there are many.

You can pair it with conversations on android ([https://f-droid.org/packages/eu.siacs.conversations/](https://f-droid.org/packages/eu.siacs.conversations/)).

<comment><USER14> OMEMO[1] seems to be the new hotness for end to end XMPP encryption. The feature is that it is better integrated than OTR and tends to be easier to use.

[1] [https://omemo.top/](https://omemo.top/)

</comment></comment><comment><USER15> Keybase has good messaging functionality built it.

</comment><comment><USER16> keybase and signal are my favorites; imessage, whatsapp, and some others also have native clients.

signal and whatsapp's "native clients" are chromium-driven, but can run independently of the browser.

<comment><USER17> WhatsApp's "native" "client" is abusing your phone as a server. No-go IMHO

<comment><USER16> this is true for Signal as well, but I think this is a design feature: your phone becomes a 2FA token.

</comment></comment></comment><comment><USER18> Do people still like Telegram? Personally, I love it but every time it comes up people question the quality of the encryption.

<comment><USER19> Am working on converting my people to Riot.IM/Matrix.org. Pretty user- friendly, considering they're alpha or beta, and their attention to their cryptography.

</comment></comment><comment><USER20> Pidgin/Adium + OTR works well for many of my use cases. The Signal Desktop client also works well for me.

</comment><comment><USER21> Does anyone have any suggestions for the following?

* Simple for family members to download and use?

* Opensource (server & client)

* Available on Linux, Windows, iOS and Android

Riot/matrix seems like a great match, but I worry that family members will be unable to use it easily.

<comment><USER13> > * Simple for family members to download and use?

psi [https://psi-im.org/](https://psi-im.org/)

> * Opensource (server & client)

Can install your own prosody instance or use one of the many free xmpp servers avalable.

> * Available on Linux, Windows, iOS and Android

I don't know about iOS, but on Android Conversations is excellent: [https://f-droid.org/packages/eu.siacs.conversations/](https://f-droid.org/packages/eu.siacs.conversations/) and [https://play.google.com/store/apps/details?id=eu.siacs.conve...](https://play.google.com/store/apps/details?id=eu.siacs.conversations)

<comment><USER21> This looks like it might solve my problem. Thank you for the suggestion, I'll be looking into this!

</comment></comment></comment><comment><USER22> Wickr is a great option. they have Windows, Mac, Linux, iOS and Android apps. They also have a pro app that can do end to end encrypted voice and video calling with forward secrecy. the best part is message timers that cause remote destruction of messages. [https://www.wickr.com/](https://www.wickr.com/)

</comment><comment><USER23> Would Threema be an option? Gets occasional discussion here. Open source web client: [https://github.com/threema-ch/threema- web/](https://github.com/threema-ch/threema-web/)

</comment><comment><USER24> Might be slightly off topic, but have you used Clatter from the Windows Store? Logs into 10 or 15 web clients at once. URLs can be added. Looks to be encapsulated edge, but highly useful.

</comment><comment><USER22> Wickr is great, they have Mac, Windows as well as a few Linus Distro versions.

[https://www.wickr.com/](https://www.wickr.com/)

</comment><comment><USER25> Cryptocat - not sure how that project is going these days, but here are some links:

[https://github.com/cryptocat/cryptocat](https://github.com/cryptocat/cryptocat) [https://en.wikipedia.org/wiki/Cryptocat](https://en.wikipedia.org/wiki/Cryptocat) [https://en.wikipedia.org/wiki/Nadim_Kobeissi](https://en.wikipedia.org/wiki/Nadim_Kobeissi)

</comment><comment><USER26> [https://www.peerio.com/](https://www.peerio.com/)

</comment><comment><USER27> Signal desktop solves this problem

<comment><USER28> Only if you have a phone AFAIK.

</comment></comment><comment><USER29> Best human usable solution is iMessage.

Any mail client with either PGP or SMIME.

</comment><comment><USER30> iOS/MacOS Messages/iChat is end to end as far as I know. I know it's not strictly multiplatform, but just putting it out there.

</comment><comment><USER31> None mentions telegram secret chats ?

<comment><USER32> Telegram has security issues, see older threads.

<comment><USER19> As far as I'm aware, POTENTIAL security issues. No one's busted it and shown proof.

I still don't trust their encryption when compared to Matrix.

</comment></comment></comment><comment><USER33> keybase</comment>


Graphene shows promise for bulletproof armour - <AUTHOR> http://www.bbc.co.uk/news/science-environment-30246089

<comment><USER2> The future is arguably graphene.

As exciting and life-saving as this could be, I am actually more excited for graphene batteries. We already have pretty good bullet proof vests that save lives, what we haven't seen is really any decent innovation in the battery space in sometime. Tesla is said to be working on graphene battery technology that could allow their vehicles to travel up to 500 miles on a single charge.

I am excited to see where this and other graphene related developments go (including bulletproof armour).</comment>


What Are The Pros & Cons of My Approach? - <AUTHOR> http://www.evanlemke.com/getting-started-with-startups/ I have an idea for a SaaS app, but I'm putting it on hold to launch a niche site.  Hopefully, it leaves me better prepared to tackle the "big idea". You can read more about it on my blog @ http://www.evanlemke.com<p>What do you think about this approach? <comment><AUTHOR> I have an idea for a SaaS app, but I'm putting it on hold to launch a niche site. Hopefully, it leaves me better prepared to tackle the "big idea". You can read more about it on my blog @ <http://www.evanlemke.com>

What do you think about this approach?</comment>


Ask HN: How do you deal with repeated failure at interviews? - <AUTHOR>

I have failed in interviews at two of my dream companies over the last two months.  I always clear the coding round and preliminary technical rounds. But I always flunk the last architecture round where there are many open ended questions.  I never seem to understand the questions clearly.<p>How do you deal with this setback?  I am very low at confidence and need some advice. <comment><USER2> I have similar issues but with the coding part, usually my brain stops working for the time of an interview and then makes me hate myself for the rest of the week. The only advice people gave me, that made sense, was: training. Go do all the possible questions you can find to the point you could do it in your sleep. For your issue, since it's open ended, it's not "as easy", but you can still read and think about as many of those questions you can find, open forum posts and debate what other people would have answered and why, to see better where your reasoning is lacking/failing something.

<comment><AUTHOR> Thanks for the advice. Once this shitty feeling of self hatred passes away, I plan on doing exactly that.

</comment></comment><comment><USER3> What works for me is to ask questions. Don't think of the interview as one sided. When they ask an open ended question start firing questions back. This allows better understanding of what they are really looking for in an answer and gives you time to think about possible solutions.

<comment><AUTHOR> I agree with you, but asking too many questions might come as a defensive approach. I did that once and the interview panelists were not particularly impressed, so I try to balance the questions and assumptions.

</comment></comment><comment><USER4> Could you give examples of some of the open ended questions that you mention? Like that we can have a better idea and mention maybe some books to help with that.

For which technologies is it?

<comment><AUTHOR> One questions which was asked me in similar flavors was:

How would you design an online shopping application like Amazon?

I get stumped with such questions because I don't understand where to start and which direction to take. In the previous interview I started with a high level technology stack I would use and then how the front end, middleware and database would be organized. They happened to be more interested in the Object modelling. I missed that.

In the recent interview I started with Object modelling, but they said they were interested in a high level tech stack I would go for and the reasons for each.

This makes me go a bit blank during interviews and I panic, blurting out 'Sorries' and 'I can't recollect it at this moment'.

<comment><USER4> The solution is going to more interviews until you nail it, practice makes perfect. Next time ask if they want a high level architecture or oo design,etc. the thing about interviews is that every interviewer asks the same questions, use the same tricks etc that they read on linkedin.

By going to more interviews you will get much better at it. Try to go to the next one as soon as possible. Remember that for each person hired there where maybe 3 othercandidates that didnt make it so its normal.

Remember that there are many factors completely out of your control, but if you insist and lesrn from mistakes you will go through in the end.

<comment><AUTHOR> That's the plan. I have another one tomorrow, at a company I am not very keen to join. But I am attending it for practice.

<comment><USER4> Based on my own personal experience, you are in the right path. Good Luck!

<comment><AUTHOR> Update : I failed today's interview as well. But I am not much concerned because the questions were quite silly. But a feeling of sadness is there.</comment></comment></comment></comment></comment></comment>


Central Banks Have Few Options to Deal With Another Crisis - <AUTHOR> https://www.bloomberg.com/opinion/articles/2018-12-15/central-banks-have-few-options-to-deal-with-another-crisis <comment><USER2> Maybe it is. On the other hand, I'm seeing way too many people calling "bubble."

My n=2 experience with the late 1990s stock bubble and the early 2000s real estate bubble have taught me something:

When there's a real bubble, one whose collapse truly threatens to bring down an entire economy, the only people yelling "bubble" will be cranks and nutjobs.

Everyone else will be so wrapped up in the rarefied air they're breathing, impressed by their financial acumen, the way they've made a fortune so easily, the rich prospects for the future, that they'll ignore any signs pointing the other direction.

As the saying goes, if the wind is strong enough, even turkeys can fly. Except those turkeys actually _think_ they're flying and therefore can't detect the wind blowing them.

Here's an alternative hypothesis:

The bubble forms by progressively beating the pessimism out of almost everyone. With each correction, the bubble-sayers come out of the woodwark (this article is an example). Then, quite unexpectedly, things turn around, and markets head to higher highs. The next time a decline happens, there are fewer bubble-sayers, and so on.

Eventually, the only bubble-sayers are the permabears. When the inevitable happens and the year-after-year lack of a wipeout convinces investors to buy any dip, the permabears finally get their place in the spotlight.

At that point, it's all bears, all the time.

<comment><USER3> In that past, society was less informed. We are very much connected more than any time in history. I'm no were near wall street, but I can access some street gossip forums to find out how investment banks are doing, I can find out which funds lost what and who is laying off who and how many. It's much easier to pluck and sniff out these signals than in the past. I can run a query and find out exactly how many houses sold in a city this month, compared to last month or this time last year. I can see the price difference. I can see how long houses are sitting before they sell, the vast amount of data the ordinary man has access can't be discounted. My hypothesis is that in future bubbles, we will know like we know now, but they will not have a big pop, but rather a very slow deflation that goes on for months or even years. Because people know about it, some will anticipate they can profit from it and keep jumping in and out, whereas most would have stayed out if there was a big pop instead of a slow deflation.

</comment></comment><comment><USER4> as an engine mechanic, i remember the last time this happened and it was absurd even now just thinking about it.

\- I lost my first home and my dog, and was forced to live out of my car for a month. The news told me it was because I was foolish and tried to get too much for my home loan. Id say a 41k loan on a mobile home is pretty lavish, and I was a fool to ever barter so unwisely.

\- My boss paid me overtime to pour mud into running engines and actually destroy working cars. it was called "cash for klunkers" and the idea was that people would be better off with a 45k car payment instead of a running car. The smoke from the engines closed a local elementary school playground.

\- Then president George W Bush cut me a "stimulus check" for about seven hundred dollars. I figure the idea was I would take that money and spend it on something nice...you know...treat myself after having to wash my clothes in a truck stop bathroom because some bank that was too big to fail couldnt fail this year.

\- I cashed that check and paid off some money i borrowed from a friend. George went on to paint weird portraits of veterans and world leaders. And the banks, well today im told theres another crisis....

</comment><comment><USER5> I largely agree with the first half of the article -- the global economy is showing cracks at the same time that Western politics is in disarray.

But towards the end he seems to be saying he thinks this might end in the downfall of civilization as we know it, which, come on. A little overdramatic, and about a dozen steps over the horizon of what you can even speculate about.

<comment><USER6> I recommend reading Taleb's _The Black Swan_.

Imagining the unimaginable is much more important than most people give it credit for.

<comment><USER7> I _think_ , maybe, his point is, why would anyone be worried about the stock market or the banks if civilization collapses? (It may not be though. You could read that comment a lot of ways.)

That's the one thing that, once it's gone, it's not coming back. So why are you trying to get more dollars or property? Especially when both would have to be guaranteed by the aforementioned collapsed civilization?

This entire discussion only means something if civilization is _not_ collapsed. If civilization _is_ collapsed, then the only thing that has any real long term value would be passage to Asia. (Assuming that, like the last collapse, the Eastern half of civilization would chug along happily without the Western half of civilization.)

But yeah, for the rest of us, it's just gonna be a slightly more modern version of the dark ages. (ie - More of us will be killed by raids and disease because the weapons tech will be a little better and there are more of us to spread contagion.)

</comment></comment></comment><comment><USER8> I'm looking forward to too big to fail bankers being bailed out while little people like me will be supposed to just applause the big banks not going under.

<comment><USER9> Unfortunately, banks going under _also_ ruins little people like us.

I thought the government did a good job with the first few institutions rescued in 2008. Their shareholders got nothing (or pennies), the management got kicked to the curb, but the institution itself survived, and took care of depositors. _That 's_ the way it should be done... except that it's disruptive, and the disruption helps further the crisis. (Jobs were lost, even if deposits weren't. Not all of the lost jobs were in the financial industry. That kind of crisis hurts little people in many different ways.) It seems to be better, even for the little people, to help before things get that far, even if it doesn't wipe out all the people we'd like to see pay for the mess they made.

<comment><USER8> I wonder if little people are being hurt more by the current perpetuating hegemony of the ruling class or if they would be better off if we let free market take care of this for once and let the banks fail. It would hurt but perhaps it would be better long term for the little people. All of the bad debt and Wall Street Ponzi schemes would be cleared off and a new economy which doesn't rely on free money from government to the banks would form.

<comment><USER10> That was what Bush did at first during 2007 / 2008\. Bush let Bear Sterns and Lehman Brothers go bankrupt. Then IndyMac went bankrupt. And then...

[https://www.nytimes.com/2008/10/01/business/smallbusiness/01...](https://www.nytimes.com/2008/10/01/business/smallbusiness/01CREDIT.html)

Credit Crunch. As banks fail, they closed credit-cards and other loans. My personal credit card dropped to $5,000 line (down from $10,000) for example. I don't rely on my credit card, so it wasn't a big deal.

But there were lots of businesses and factories which relied upon credit to make payroll. The fundamental business was solid, but remember that Businesses in America are typically Net90 (paid 90-days after delivery).

So if you had a very successful month selling things, you wouldn't be paid until 3 months later. So what do you do? You put it on a credit card, so that you can pay your workers.

Too bad those credit cards failed and closed up, and all those workers had to be fired instead.

\</comment></comment></comment></comment><comment>----

If you let banks fail, then innocent businesses / people who rely upon those banks will also fail. In effect, banks hold the American People themselves hostage, as people are reliant on financial services to make payroll.

</comment><comment><USER11> I have recently started saving in mutual index funds. I have no idea what I'm doing, but it makes me happy whichever direction the economy is heading: when things point up, I'm happy because it let's me withdraw more cash, should I want to; when things point down, I'm also happy because I know that means I'm about to get a really good deal on shares which I can later sell for lots.

<comment><USER10> > when things point down, I'm also happy because I know that means I'm about > to get a really good deal on shares which I can later sell for lots.

That's not how recessions work.

When a general recession happens, there is a high chance you will lose your job. So when the stock market goes down, you are forced to withdraw money from your stocks to pay your mortgage / rent, or other living expenses.

And that's why people hold onto bonds: so that you have something to sell during a recession. If you are 100% into stocks, you won't have anything to sell when the recession starts. Bonds often go up during a recession (but not always: 2008 Municipal Bonds + Corporate Bonds went down. But US Treasuries did go up, so anyone holding onto Treasuries in 2007ish would have done well during the recession)

\</comment></comment><comment></comment><comment>--

Lets start with a hypothetical recession, where the general unemployment rate increases from (currently) 3.7%, to 10%. With 3x as many unemployed people as right now, a measured drop in enetertainment services (Netflix, Movies, Cruises, Vacation spots, etc. etc.) usually happens.

So expect Netflix, Disney (vacations + movies), AMC, Sysco (Restaurant company), malls, shopping areas to all ALSO lay off staff.

Which will eventually have an impact on the tech industry: Netflix buys fewer computers from Amazon. Microsoft slows production / maintenance of Windows. Tech Companies start to fire free-lancers and contractors (and focus on core staff only).

The hardest hit places lose lots of people. Ex: Detroit had a MILLION people leave the city and surrounding area during the 2008 recession. Property values drop dramatically, rents fall. Landowners lose their income streams and are unable to sell homes or find new tenants.

THAT is a recession. A huge number of things (stocks, real estate, even employees) in the USA loses value and are shed off. If you're worried about your stock account numbers, you aren't really in a recession yet. People are worried about their actual jobs and daily livelihood during recessions. In effect, the ones who can afford to buy up the stocks were the lucky ones, who weren't hit by the recession.

\</comment><comment></comment><comment>--

By definition, a recession is over after a year or two. Which is why people say you need to keep your emergency savings in cash.

A depression may last longer than that: several years or even a full decade. (Ex: the entire 1930s)

So the only way you have money to spend on the Stock Market, is if you saved up money beforehand. IE: You have some bonds to sell, or you managed to predict the recession and hold onto cash. Your job income isn't necessarily safe during a recession (or worse: a depression)

<comment><USER11> This was a very sobering and well-presented perspective. You bring up some critical points I hadn't considered, and I'm very thankful for it.

I have quite a bit of emergency savings in cash, but you shone a light on the whole long-term vs. short-term, high-risk vs low-risk thing that I had previously understood on a mathematical level, but not how it would apply to, well, me.

<comment><USER12> Look up Bogleheads and their Lazy Portfolios, this may help you understand some different scenarios.

[https://www.bogleheads.org/wiki/Lazy_portfolios](https://www.bogleheads.org/wiki/Lazy_portfolios)

</comment></comment></comment><comment><USER13> am i nuts or did the bubble already lose all of it's air? MSFT, AAPL, AMZN, NFLX, GOOG have lost 20+% of their market cap since the peaks at end of august/mid september. S&P500 and DJI are at 52 week lows after people proclaimed another 3-5 years of The Golden Bull Run on CNBC. the crash happened, it just took months, not seconds.

<comment><USER14> The 2008 recession saw the Dow retreat to a two _decade_ low. Losing a year of market gains certainly doesn't indicate things are over. A recession hasn't even started yet.

<comment><USER10> Say it with me: The stock market is NOT the economy.

A recession is a decrease in the GDP of the USA. This means people are LAID OFF, as companies don't have enough money to keep everyone on staff. Because people are laid off, there are fewer people buying stuff, which causes more people to be laid off.

The stock market can go up during a recession. Its a bit unusual, but it isn't unheard of. Usually, the stock market goes down because people start to lean on their emergency savings, and are forced to sell off stocks while they're in between jobs. That, combined with lower profits (from the overall recession) makes people retreat towards safer investments, like Bonds.

But otherwise, the stock market isn't really "the economy". Its just that Americans TEND to sell stocks and buy bonds when they see the signs of a recession. When you're worried about your job prospects, you act differently. When a lot of Americans are worried about their job, you can see it in various indicators.

<comment><USER15> The way I think about it is "the stock market" (by which we mean the total value or price of stocks) is 2 different things.

1\. Company financial performance (aka earnings)

2\. Multiple at which the stock is valued (aka P/E)

These are two independent features. Investors, for a variety of reasons, may change what multiple they value stocks at. Regardless of the company's actual performance.

This can cause the price of the stock (and usually the market as a whole) to rise or fall, even if nothing changes about economic performance.

Consequently, you can see the stock market deleveraging (the multiple decreasing) even while earnings (somewhat "the economy", ignoring tax impacts) remain strong.

</comment></comment></comment></comment><comment><USER16> This article has an incoherent approach to monetary and fiscal policy:

"Yet, even after recent U.S. interest rate hikes, the Fed has nowhere near enough room to cut rates that much without going negative."

"Fiscal policy doesn't offer much of an alternative. ... The U.S. government deficit is forecast to rise to $1 trillion as a result of tax cuts and higher public spending, ... Most economies are pushing against high and rising government debt levels"

"Ultimately, central banks might have to resort to QE variations such as "helicopter money." Originally a thought experiment of Milton Friedman, the government would print money and distribute it to the public to stimulate the economy... Helicopter money would at least deflect criticism of QE programs as favoring the wealthy and exacerbating inequality, as benefits would accrue to a wider spectrum of the population."

Helicopter money is nothing other than a particular combination of fiscal policy and monetary policy. It is populist government deficit spending financed with money rather than debt. So a couple points:

\- There are proposals for money-financed government deficits: [http://bilbo.economicoutlook.net/blog/?p=31715](http://bilbo.economicoutlook.net/blog/?p=31715)

\- Why give the money away for nothing? There's still unemployment, let's get something out of it. Let's use helicopter money to pay people to do things for the public good

\- There are proposals for public jobs financed by government deficit spending: [http://bilbo.economicoutlook.net/blog/?p=23719](http://bilbo.economicoutlook.net/blog/?p=23719)

</comment><comment><USER17> Like many others here I've invested in index funds in recent years, just to see modest returns. I doubt this kind of return is really worth the trouble, even though all thouse "early retirement" people keep telling me I'll come out on top in the long run. I don't really think it's a very good idea to trust the global economy to do the right thing with my money, considering all those dumbf __ __* running the show.

<comment><USER18> Sorry, but I'm not understanding your point. Index funds are almost no trouble at all. People harping on index funds typically suggest something akin to 'invest in an S&P 500 index fund and let it sit for 35 years.' So all you have to do is buy the shares and leave them there. If it's in your 401(k) then it can be essentially automated.

We have a long history of data that suggests that in the long run the stock market is the good investment to get returns from. Picking an index fund protects you from one of the companies in the index going to zero and removes the randomness of stock picking from the equation.

Considering returns compound, even modest returns are better than just sitting in cash. What would you suggest as an alternative?

<comment><USER19> If the system breaks, returns don't compound. That's an assumption that our whole system is defined on, but globally the amount of leverage on money is astronomical. Basel III set it to 3% (I'm aware the US is either 4% or 5%)

Returns don't compound if it's all made up of fairy dust and repeatedly bailed out by issuing more money to do quantitative easing. That's a sign of trouble, and harmed societies all over the world. You can't just keep bailing the banks in order to make sure 'returns compound'. At some point it's too ridiculous and things break.

<comment><USER20> If things break as you say then it won't matter what you've invested your money in. In such a scenario the investments that pay off are in knowledge that others find useful and physical fitness.

</comment></comment></comment></comment><comment><USER21> I missed the last bubble in 2008 because I was studying so I look forward to the next one. Hopefully no one is going to get bailed out this time. We need to reset everything.

<comment><USER7> > _Hopefully no one is going to get bailed out this time. We need to reset > everything..._

Well, rely on hope, if it brings you comfort. Just keep in mind that the big shot bankers are relying on political donations. So I wouldn't put any money on that "Hope" if I were you.

</comment></comment><comment><USER22> So close to understanding the cause...

 _" Historically, central banks have needed to slash official rates as much as 4-5 percent in order to offset the effects of a financial crisis or an economic slowdown. That's why former U.S. Federal Reserve Chair Janet Yellen talked about the need to raise rates in good times — to provide room to cut when necessary. Yet, even after recent U.S. interest rate hikes, the Fed has nowhere near enough room to cut rates that much without going negative."_

Um yeah. The Fed hiked the rates and thus crashed the economy. Some are speculating that they crashed it on purpose, to make Trump look bad or to punish him for taking a stand against 1-sided tariffs that have been hurting the USA for decades.

It is interesting to think about the Fed having such tremendous and unaccountable power. This is deeply troubling. It's a bit like the Supreme Court, powerful yet unelected, except that it isn't a constitutionally defined branch of our government.

<comment><USER23> Rates were near zero for close to a decade. Fed needs to raise rates in order to have room to respond to a crisis, otherwise we won't have many monetary tools to use when another 2008 comes around.

Fact that the economy is starting to sputter with rates around 2-3% signifies some serious problems that we can't use zero interest rates to paper over forever.

<comment><USER24> Not to mention putting money in the hands of the middle class also is a way out. Unfortunately the govt likely won't have that option since it just strapped itself with 1 Trillion in debt giving money to people who mainly purchase investable assets.

Meaning having the ability to cut rates is even more important.</comment></comment></comment>


Here's my secret weapon: I read - <AUTHOR> https://medium.com/hi-my-name-is-jon/heres-my-secret-weapon-i-read-1bf722d1cfeb <comment><USER2> So, what I took away from that is the guy reads!

</comment><comment><USER3> Is there a group of people who actively choose not to read? Are they choosing not to grow themselves, as the author positions reading for?</comment>


Hardware hack defeats iPhone 5C passcode security - <AUTHOR> http://www.bbc.com/news/technology-37407047 <comment><USER2> Again, it only applies to iPhone 5 and below. No one has yet proved to being able to clone the secure enclave and attempt this on a newer iPhone.

<comment><USER3> Still - that's enough to make it interesting that the FBI rejected this approach and then paid for an outsider's solution to accessing the phone.

<comment><USER4> No, it's not. Previous discussion [https://news.ycombinator.com/item?id=12510586](https://news.ycombinator.com/item?id=12510586).

<comment><USER5> You are wrong. The San Bernardino attacker's iPhone was an iPhone 5C, completely vulnerable to this NAND cloning attack.

<comment><USER4> >You are wrong. The San Bernardino attacker's iPhone was an iPhone 5C, completely vulnerable to this NAND cloning attack. reply

No one claimed it wasn't, no one was even talking about the secure enclave protected phones.

That doesn't mean that NAND mirroring is a forensically acceptable method, hence it "doesn't work".

Read the paper, and read the discussion.

<comment><USER6> You're right.

But the question is, did the FBI read that image and seek a court order anyway?

The FBI is slow, but not incompetent by any means. This was a terrorist's cell phone, a crucial link to determining whether this was a lone act or a coordinated plan.

Even if they couldn't introduce it in court, wouldn't they do it anyway? In fact, it seems very suspicious that the FBI suddenly found an exploit vendor after Apple refused to bow to governmental pressure.

So the question is becomes, "If they had the data anyway, why seek a court order?"

To examine the problem, consider that to the FBI, accessing a single phone is a win in a single battle. That is not what the FBI is after.

What they are after is total victory. They believe only an ironclad legal precedent can win their war. They may be right. They may be wrong. I strong suspect that they are wrong.

Encryption is like the tide. It can be pushed back, but in the end it will win.

Water always finds the cracks.

<comment><USER4> Yes they were after a precedent because regardless of how "easy" this is it's not a turnkey solution and it doesn't scale well.

The FBI were looking for an easy solution that every law enforcement can use and that is to force Apple and other device makers to unlock the devices or undermine their security sufficiently for traditional mobile forensic approaches to be viable.

The FBI didn't find an exploit they found a vendor with an exploit, likely a vendor with an exploit that did not involve doing irreversible damage to a phone to extract the data from it. Forensics and even digital forensics have pretty strict rules to what counts for a forensically secure data extraction and what doesn't. When in doubt you simply wait for a better method to come around, you preserve evidence this is why we can go back and reexamine evidence with new techniques, the first question of any new forensic process is "does it alter the state of the evidence".

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Press again fails to understand the topic, how this applies only to 5c and how phone vendors (Apple) defeat this with safe hardware data storage and keys (see previous HN discussion).

<comment><USER8> The BBC stands well ahead of the pack in terms of chasing tabloid-level inaccurate clickbait crap, especially in terms of oversimplified pop-science.

<comment><USER9> Well, you're making a claim for which contrary evidence exists in the form of the very article you're commenting on. Do you have any evidence to back what you're saying?

</comment></comment></comment><comment><USER10> > Finding a four-digit code took about 40 hours of work, Dr Skorobogatov said.

> And finding a six-digit code could potentially take hundreds of hours

If it takes 40 hours to brute force 4 digit pin, it would take 4000 hours to brute force 6 digit one.

<comment><USER11> I am guessing this includes the work required to set up the ability to do this in the first place.

</comment></comment><comment><USER12> Every time Apple iterates on a phone they move the security forward. The biggest leap was with the 6 and the introduction of the secure enclave. And they are getting better still.

<comment><USER13> Minor correction: The secure enclave was introduced in the A7 chip on the iPhone 5s

</comment></comment><comment><USER14> I'm probably missing something here, but without a secure enclave, why can't the PIN be bruteforced "offline", i.e. not via the iPhone?

<comment><USER15> I _believe_ the device data is encrypted with a built-in hardware key _and_ the passcode, so you'd need some way to read the key out of the CPU.

<comment><USER14> Ah, right. How is that different from the secure enclave? Less isolated, perhaps?

</comment></comment></comment><comment><USER16> Old news on old phones. Headline should be updated.

<comment><USER17> Thanks, we've updated the title.</comment></comment>


End-to-End Testing Web Apps: The Painless Way - <AUTHOR> https://mtlynch.io/painless-web-app-testing/ <comment><AUTHOR> Author here. Happy to answer any questions about this post or take any feedback about making it easier to follow.

</comment><comment><USER2> what about those elements which do not have ids, like react. Then it is still painful to maintain scripts when element changes.</comment>