How To Stop Hostile Jerks From Killing Your Social Site by Cory Doctorow - <AUTHOR> http://www.informationweek.com/shared/printableArticle.jhtml?articleID=199600005 <comment><USER2> Thanks, I have just been worrying about this recently. The site is now growing to the point where people feel anyonymous enough to get quite rude in comments. I've tried asking them to be civil. Sometimes it works, but not always; and in any case it doesn't scale. So when I get back to the US in June I will try to add some flame-retardant features. If anyone has any suggestions, let me know on this thread.

<comment><USER3> A few ideas:

1) If someone is downvoted, don't allow them to post for a set period of time. It seems angry people post a lot in succession, especially if they get voted down. More time to think and cool down.

2) Have a short timer (five minutes) stopping you from replying directly to someone who replied to you. More time to think means logic gets to fight emotion for longer and hopefully win over. I like reading strong arguments until they degrade into emotional monkey flinging.

3) Check for votes for or against a person over a set time frame as well as testing for variety. This would stop people who get a real hate on for someone and downvoting all their comments to torpedo their karma.

4) Force people to enter a reason when they downvote. Just a simple one line reason that would only be read by the moderators. Having to stop and think about why you are making a decision and justify it to someone else would cull a lot of the punitive downvotes. It would also provide you a place to start a dialog with people who aren't adapting well to the site.

<comment><USER4> point 1: Yes, except that I've had comments downvoted to 0 and then upvoted to 2... you shouldn't be penalized for an unfair downvote. Point 4 will eliminate some unfair downvotes. No one (except me, maybe) will admit to downvoting someone because of an ideological disagreement.

Point 2: OK, except it will sometimes be annoying.

Point 3: Yes, but it will be tricky to optimize this algorithm.

Point 4: This is the best suggestion to implement immediately.

<comment><USER5> _No one (except me, maybe) will admit to downvoting someone because of an ideological disagreement._

I vote up a comment if I strongly agree with it. Conversely, I vote down a comment if I strongly disagree with it. Those in between, which I don't feel strongly about, I leave. Isn't that what the down vote is intended for?

</comment></comment></comment></comment><comment><USER6> What about dispearing the comment without the poster knowing it?

For example a variation of this would be: If a post has -2 votes, 10% of the users will not see it. If it gets -4, 20% will not see it...etc. The poster will always see it and he has no idea that he is being gradually ignored.

</comment><comment><USER7> Make a word replacement filter.

If someone is causing problems just word-filter their name into something embarassing. Or take a word they use frequently in their posts and word-filter it into gibberish.

</comment><comment><USER8> what constitutes a negative post?

<comment><USER9> Something you wouldn't say in the same way to someone's face.

<comment><USER10> No, anything that disagrees with the common "community" view... in this case, people's perception of what pg has said.

<comment><USER9> I've disagreed with things PG said in the past, like this:

<http://journal.dedasys.com/articles/2007/04/26/ideas-are-worthless>

I also think some of his "startups are the future" thinking is naive in that it excludes many fields of endeavor where far more significant amounts of capital are necessary to get anything going.

But I wouldn't have any problems telling him the same thing to his face, over a beer. From what little I know of most people on this site, they all seem reasonable enough that I'd quite enjoy talking with them about a variety of things, even those we might not agree about.

<comment><USER10> I think you gave what should be the correct answer, but unfortunately, I think in practical terms, it is not the current answer for this community.

</comment></comment></comment></comment></comment><comment><USER11> Disclaimer: I don't really like Cory Doctorow very much.

This article seems very much like a lot of what Mr. Doctorow produces: it shows a lot of promise (in this case by suggesting that he has a silver bullet to the Problem of Trolls), but barely attempts to deliver.

There's no 'there' here! Does he suggest even one concrete thing we might do? If he did, and I didn't see it, fine, I'll eat my words. From what I could tell, he a) told us what we already knew about the problem, b) told us what other sites have tried unsuccessfully, and then c) tries to tell us about being a "troll whisperer" -- something about removing vowels and some other vague "techniques".

There is no 'there' there.

Incidentally, if you're ever tempted to read a Cory Doctorow short story or novel, expect the same thing: a premise that may seem compelling on the surface, but with prose that has no substance. (You might accuse Thomas Pynchon of the same thing, but at least that guy can write well. Cory writes with the subtlety and beauty of a chainsaw.)

<comment><USER12> Sometimes subtle ideas are very powerful. The "troll whisperer" was something I hadn't previously considered.

The Wufoo's have another simple but apparently powerful idea -- on their blog, they prefill the comment box with "everyone needs a hug", or something like that.

<comment><USER13> That's a really good point. You reap what you sow, and the Wufoos sow lots of goodwill and good humor, and that's what they get in return (generally). There's a lot of that kind of thing on their sites ("dinosaur buddy", "like a champ", etc.).

I've been trying to start thinking like that in all of my interactions with customers and users of our Open Source products. People take just about everything, even bad news or criticism, better if it is from a friend.</comment></comment></comment>


Ask HN: Where do you store your stuff? - <AUTHOR>

Personal stuff.  Pictures, excel documents, personal financial statements, etc.
Locally on your PC?
External hard drive?
Dropbox or other cloud service?
Your own cloud service? <comment><USER2> S3, local storage (TrueCrypted), SAN (RAID), lots of USB drives and flash keys (TrueCrypted)

</comment><comment><USER3> Dropbox, iCloud, Google Drive. Drobo, Time Capsule. Couple of external USB disk drives. MBP, Windows Desktop.</comment>


Lottery jackpots being reduced as coronavirus hits ticket sales - <AUTHOR> https://qz.com/1832728/lottery-jackpots-being-reduced-as-coronavirus-hits-ticket-sales/ <comment><USER2> I'd expect that there's significant spread of COVID-19 by persons who go to a convenience store with the primary purpose of buying a lottery ticket. Public lotteries continue to have benefits but I believe that, on balance, we need an immediate nationwide ban on in-person purchases of lottery tickets.</comment>


Google +1 spelling conventions - <AUTHOR> http://www.google.com/support/profiles/bin/answer.py?hl=en&answer=1237207

<comment><USER2> This reads like a joke. It probably is, one way or another.

<comment><USER3> It's clearly a joke, but it makes me even more sure that it's a crummy name. It also makes me think that there is a camp of folks at Google who agree :-P</comment></comment>


Ask HN: Application to store and tag articles as PDF? - <AUTHOR> Okay, so here is the thing: I read a lot of articles on the Internet and I'm doing so for many years now. I have a few sites I visit on a regular basis but I also discover interesting pieces by browsing blogs and sites like (who knew) Hacker News ;)
Over time I accumulated a big list of links to articles which I finished reading and I also have articles on Instapaper which I consider to be my "reading queue".
I don't know how you and others read, but for me it's important to "get something out of it". That means that I nearly always take down notes in a plain text file while I'm reading to be able to remember what it was all about. Otherwise most of it will be forgotten more or less immediately...
Even though my method works somehow, I'm not 100% happy with it. What I'd like to have is an application that provides features like these: - Store only the content (without ads, navigation, ...) of an article as an offline PDF (they don't disappear anymore, can be found without an Internet connection and used on all devices via Dropbox) - Flag them as "to read" or "read" - Be able to tag these PDFs within the app to categorize them - Add notes (Not directy to the PDF but in the app)
I don't know if anything like this exits but even if it doesn't it would be great to hear in which way you consume text and store the information you found interesting or eye opening.
Please don't mind any grammatical errors, I'm not a native English speaker ;) <comment><USER2> There is Zotero for Firefox (open source, a bit clunky) for annotations and Mendeley not open source but has good tagging, search and note-making utilities.

My advice is not to use any proprietary software (not future proof) and not to use Zotero (to complex and becomes tiresome). The easy way: open your pdf in Firefox, bookmark it, tag it the way you like, put notes in the title bar. For more extensive note taking: TiddlyWiki files, bookmark and tag. Then use search utility of your choice for that. One simple tool for note-taking that I like is nvPy, put your notes tags, and file locations as links (local or remote), link your notes together.

If you need remote storage, rsync it and tag it, also rsync the bookmark library.

What's your daily driver Linux, Windows or Mac?

<comment><AUTHOR> Hey, thanks for the tips! I'm currently using a Mac.</comment></comment>


Show HN: Metacopter – Advanced Drone Search - <AUTHOR> https://metacopter.com <comment><AUTHOR> Hey HN, this was sitting around 80% developed for awhile, so I decided to complete it to hear that if it has some utility to you. I wanted to make filtering as quick and detailed as possible (still lacking though, like video features), and comparing easy. I'll be adding more drones. For folks don't like Material UI, sorry, wanted to give it a go back then. :)

Also you can turn off affiliate links at the bottom of the page.</comment>


Show HN: CloudRail SI – Cloud Storage and Social APIs Unified in a Single API - <AUTHOR> https://cloudrail.github.io/ <comment><AUTHOR> We've just released a version for iOS and Java in addition to Android. Happy to hear your feedback.</comment>


Google Vizier: A Service for Black-Box Optimization [pdf] - <AUTHOR> https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46180.pdf <comment><AUTHOR> Vizier is an internal Google service for hyper-parameter tuning. The authors posted a cute video demo here: [https://www.youtube.com/watch?v=Z2YL4XJKVpQ](https://www.youtube.com/watch?v=Z2YL4XJKVpQ)

</comment><comment><USER2> Everyone knows that Viziers always become evil. Or is that only Grand Viziers?</comment>


I built a Hacker News clone for Coronavirus in less than a day - <AUTHOR> https://towardsdatascience.com/how-i-built-a-hacker-news-clone-for-coronavirus-in-less-than-a-day-f4a199f4d842?source=friends_link&sk=870f95fc0039a16e78ce492963ac51ff <comment><USER2> I would expect a clone to also have comments and voting. This looks more like an RSS feed w/ HN layout.</comment>


New Carbon Debit Startup - <AUTHOR> http://www.carboncreditkillers.com/default.asp <comment><USER2> I guess it is a parody? I think carbon credits are a really harmful idea...

</comment><comment><USER3> This is the stupidest thing I've ever seen.

</comment><comment><USER4> This isn't a startup, this is a business!</comment>


How Silicon Chips Are Made - <AUTHOR> http://www.pcplus.co.uk/node/3059/ <comment><USER2> Good pictures, and not a bad summary of the most expensive kitchen operations in the world. See also <http://en.wikipedia.org/wiki/Semiconductor_fabrication>

The writer got a bit confused at the tail end of section 9. You may get partly functional dies if, for instance, 3 out of 4 cores in a single die (=chip) work. And besides functional testing, you may also have performance 'binning' (some parts hit higher speeds, etc.)</comment>


Why you should fly United Airlines - <AUTHOR> http://markmaunder.com/2013/12/26/united-airlines-pet-policy-baggage-lost-found/

<comment><USER2> If losing your MacBook is a single point of failure for your crypto-coins (in terms of both backup and encryption), can you really say you own them at all?

<comment><AUTHOR> I have backups, but back in Portland, so I would have to race back there, restore the backup and spend the coins before the attacker. The macbook is new as are the wallets and I hadn't had a chance to encrypt/secure everything. It was not all my coins, just purchases made in the last week that hadn't been put in cold storage yet.

</comment></comment><comment><USER3> I have witnessed on two separate occasions a laptop left with a TSA security check point (Dallas and Cleveland) and both times they dod the right thing and too possession of the laptop and locked it up, both time it took aprox 48 to contact the airport (after the situation was realized) and the laptop was properly retrieved. That being sated - would I recommend TSA? No!

Further I worked for both AA and Untied (granted in IT) and have flown over 2M miles - this guy got lucky a honest person found the laptop - period. You cant rate an airline on one honest or dishonest person (further it's possible it was not even a UA employee who found the laptop!).

</comment><comment><USER4> Anecdata for anecdata: United may have come through with your pets and laptop, but they lost someone else's _child_.

[http://www.cbc.ca/news/world/airline-loses- couple-s-10-year-...](http://www.cbc.ca/news/world/airline-loses- couple-s-10-year-old-daughter-1.1188965)

</comment><comment><USER5> Am I the only one who would happily pay a little more to fly on an airline that didn't allow animals in the cabin? A load of stinking cats an their over- active sebaceous glands? No thanks!

</comment><comment><USER6> During the passed 4 times flying on United, the return flights from the Bay Area (SFO/OAK/SJC) were either delayed or cancelled. Very unreliable IMO.

</comment><comment><USER7> I wonder if this is out of the norm, for all airlines and for United. I've never flown with pets or lost any property flying, so I don't know.</comment>


Ronin – A Lisp-based image processing tool - <AUTHOR> https://100r.co/site/ronin.html <comment><USER2> I've been following Ronin and the author for a few years now from a distance. As I have said in other threads on hn about this work, the theme and ethos are so consistent and thorough they just slap you in the face. You know exactly what is going on with Ronin, Oscean, Orca and it is a pleasure to see such clear manifestation of intent.

Ronin in particular is the most fascinating piece of this network to me. I was hooked by the (broken) version 1.0 when I first found it a couple years ago and played around a bit with fixing it. It played well with a few other key influences in my life and I've been playing around with similar--albeit prototype--systems ever since.

To name one stand out feature. I have been playing around with generative design/creative coding/coding art for a while now and I seem to be on an edge of the domain. My work lately has been increasingly taking a set of starter points, so to speak. I have shapes or layouts in my head that I want to run through the generative process, but I am distinctly starting with these hard coded values.

Ronin provides direct manipulation on the canvas with `$` prefixes in the code. If you type `$point`, then click on the canvas, "$point" is replaced with code representing that point. The simplicity of this interface for writing code that heavily involves numbers in context (ie on their domain) is an inspiration. There are probably a couple of names for this connectivity, but one might be bi-directional evaluation. Manipulations in code yield the canvas, and manipulations on the canvas yield code.

There's a lot going on here, xxiivv.com

And some fun to be learned by poking through git commits. If you know Orca, (was popular here a while back) it didn't start as a music generation system.

Edit:

Ronin tutorial video, 5:22. First 30s tease the original version I saw. [https://www.youtube.com/watch?v=SgAWGh1s9zg](https://www.youtube.com/watch?v=SgAWGh1s9zg)

Old version tutorial/demo 4:09 : [https://www.youtube.com/watch?v=gifzjhyBwOc](https://www.youtube.com/watch?v=gifzjhyBwOc)

<comment><USER3> Check out acme/plan9. Lots of similar cursor/content/programming synergies.

There are entire parallel end user computing universes out there that we have barely scratched the surface of.

<comment><USER2> There is a plan9 and acme demo on YouTube which is eye opening. One idea that has captured me is the idea that end users ought to be able to create custom UIs. This appears to be a foundational principle of plan9, the way all text is able to be executed. Another avenue for this idea are ZUIs as originally envisioned. Individual clipboard state can be reified as buttons in the UI, any formatting or pens or fonts can also be manifested in the interface and selected with something along the lines of the "eyedropper" tool present in many applications.

edit: video here [https://www.youtube.com/watch?v=dP1xVpMPn8M](https://www.youtube.com/watch?v=dP1xVpMPn8M) "A Tour of the Acme Editor" by Russ Cox

<comment><USER4> Sounds a lot like some of the macro tools in Emacs, all told. [https://www.gnu.org/software/emacs/manual/html_node/emacs/Ed...](https://www.gnu.org/software/emacs/manual/html_node/emacs/Edit- Keyboard-Macro.html) has the general vision of showing so keyboard interactions. I don't know why this couldn't include mouse events.

<comment><USER2> I agree, thanks for pointing me to that info page. I would bet that keys representing functions probably evolved simultaneously with the first computer typewriters, they've been around forever and are "obvious" to some degree. Making functions apparent in menus is also probably synonymous with the first non text-based GUIs. I don't know enough about the history of toolkits, but as far as I can tell that area of development is nowhere near mainstream today.

I have been reading Sutherland's Sketchpad thesis, and it struck me that no aspect of the system was unavailable to the user. By itself, this isn't entirely unusual, I think the same could be argued for emacs or linux in various ways or even of software when code is available etc. The unique aspect of this universal control with regard to sketchpad is that it was a graphical system. Controls for the graphics and viewport were essential, and reflected by the development of the first oop principles of master/instance and recursive expansion of arbitrary material in the workspace. Of multiple viewport movement controls (physical dials too!) and focus-selection zooming.

It is easy to imagine extensions of sketchpad with graphical macros. Of savable viewport state, of non-euclidean jumps between locations on the digital "paper".

It's funny to me that most clever things I enjoy about vim seem like they could fit right into a graphical system like sketchpad. `mkview`, marks, folds, repeat operations, contextual movement or selection like accessed via combinations of `[{(`.

Infinite canvas artboards are fantastic workspaces, but lack even the basic "focus shifting ability" of a few stacks of paper on a desk, taped on a wall, or strewn across the floor.

<comment><USER4> The thing I like about the best parts of vim and emacs is how much it feels like a conversation with the computer. Such that it natural lends itself to interacting with completed things. Indeed, "ciw" only works if you have a completed "word" to change.

Notebooks are usually tons and tons of fragments. Such that a precise dialog with them feels very difficult. I agree it would be awesome, but I have yet to see something that doesn't just harken to the ultimate failures of graphical programming languages. Neat for performance style programming. But needing a ton of rehearsal to get a performance.

</comment></comment></comment></comment></comment></comment><comment><USER5> The author was recently featured in a brilliant Future of Coding pocast, providing some highly inspiring ideas.

#44 - Making Your Own Tools: Devine Lu Linvega [https://futureofcoding.org/episodes/044](https://futureofcoding.org/episodes/044)

#45 - Orca: Devine Lu Linvega [https://futureofcoding.org/episodes/045](https://futureofcoding.org/episodes/045)

<comment><USER6> Excellent interviews.

</comment></comment><comment><USER7> This is exceptionally cool. Thanks for sharing and building!

When I'm using Sketch or Movie Maker or Logic or some other GUI-based >>x<< editing tool, the thing that keeps going through my head is: "Dammit I wish I had the abstraction tools that I have as a programmer. It would literally make this task 100x faster."

To me Ronin is some strong validation that all these editing tools would be much improved by a human-readable and programmable intermediate representation of what you're doing with the GUI. The GUI is just an editor for modifying this representation.

John Carmack did some work when he was at Oculus on something like this for VR: \- [https://www.youtube.com/watch?v=ydyztGZnbNs](https://www.youtube.com/watch?v=ydyztGZnbNs)

These ideas are all in their infancy, but really excited to see people starting to make moves in this field.

Thanks again!

<comment><USER8> FWIW, Autocad, being written in Lisp, had a repl that was fed via the UI, so that you could basically see what the UI was generating and write your own scripts based off that.

I haven't used Autocad in 25 years, so I don't know how much of this is still true.

<comment><USER9> Autocad still allows all of that, and, in my opinion, a lot of its success is derived from that. Even Autocad clones have a Lisp repl.

</comment></comment></comment><comment><USER10> Lisp has a long history in computer graphics. It was particularly popular in the 1980s.

There was Symbolics, a manufacturer of Lisp workstations (sometimes also remembered as the first company to register a .com domain).

Symbolics had a Lisp-programmable 3D graphics suite that seems to have been fairly successful at the end of the decade. Here's a video from 1989: [https://youtu.be/gV5obrYaogU](https://youtu.be/gV5obrYaogU)

The video doesn't seem to show any Lisp though.

On the 2D side, the immensely popular AutoCAD adopted Lisp as its expansion language in 1985.

Autodesk founder John Walker explains the decision in this contemporary memo "Why Lisp": [https://www.fourmilab.ch/autofile/e5/](https://www.fourmilab.ch/autofile/e5/)

<comment><USER11> \----

<comment><USER12> The date is below the title next to the author: February 5, 1985.

<comment><USER11> \----

<comment><USER13> I think the GP means contemporary as "at the time".

<comment><USER10> Right, I meant the memo was contemporary with the decision.

</comment></comment></comment></comment></comment></comment><comment><USER14> Reminds me of Symbolics S-PACKAGES from the 1980s... (also LISP)

[https://www.youtube.com/watch?v=gV5obrYaogU](https://www.youtube.com/watch?v=gV5obrYaogU)

Edit: looks like someone beat me to it below

</comment><comment><USER15> Can some plz hack Emacs support for this. Lisp without paredit-mode or lispy- mode is really not my cup of tea anymore.

<comment><USER16> Why not take a shot at it yourself? Both Emacs and Ronin are open source.

</comment></comment><comment><USER17> Isn't this just SVG but with different syntax?

<comment><USER18> is SVG more than a markup language? Ronin has trig operators, lamda functions, conditionals etc

<comment><USER19> And dynamic behavior: handlers for mouse clicks and animation events that are written in the parenthetical language.</comment></comment></comment>


Life of an HTTP request, as seen by my toy web server - <AUTHOR> http://tia.mat.br/blog/html/2014/10/06/life_of_a_http_request.html

<comment><USER2> This is a very nice article, I'm just getting confused by the prefix trie part. I'd be happy if someone could explain. The text says that the structure only has eight pointers per node and fills one cache line exactly.

But looking at the code, the struct is larger than 64 bytes so it won't fit into one cache line. Even if we just look at the first 64 bytes of the struct (the array), the nodes are allocated using plain calloc which (on your typical linux system, but not guaranteeed) is going to give you memory aligned to 16 bytes.

<comment><USER3> Author here. Yes, you're right -- the whole structure is larger than 64 bytes, but the pointers to the child nodes all fit in 8 pointers only (in contrast with the previous version, which had 256 pointers instead). Maybe I need to adjust the wording to make this clear.

<comment><USER4> The section on Coroutines links to itself; perhaps you meant it to link to your other article on Coroutines? ([http://tia.mat.br/blog/html/2012/09/29/asynchronous_i_o_in_c...](http://tia.mat.br/blog/html/2012/09/29/asynchronous_i_o_in_c_with_coroutines.html))

<comment><USER3> It was supposed to be linking to the Coroutine article on Wikipedia. Fixed.

</comment></comment></comment></comment><comment><USER5> I wonder how this compares to [http://gwan.com/](http://gwan.com/)

<comment><USER6> Last time GWAN came up it didn't fare well.

[https://news.ycombinator.com/item?id=4109698](https://news.ycombinator.com/item?id=4109698)

</comment></comment><comment><USER7> A little question: what is the name of the color scheme using in this article?

<comment><USER8> Looks like solarized [https://github.com/altercation/solarized](https://github.com/altercation/solarized)

</comment></comment><comment><USER9> ../../

<comment><USER9> ../

</comment></comment><comment><USER10> What is the font you are using for source code?

<comment><USER11> It's Source Code Pro ([http://store1.adobe.com/cfusion/store/html/index.cfm?event=d...](http://store1.adobe.com/cfusion/store/html/index.cfm?event=displayFontPackage&code=1960)).</comment></comment>


Ask HN: Twitter app to easily to create Retweet for Discount campaigns? - <AUTHOR>

I quite like the Retweet for Discount feature at socialfeet.com ... Do you know another app/site that does similar stuffs?
I know there are quite a few apps in Facebook that does similar stuffs.. But not in Twitter...
ps: I could be wrong of course. <comment><USER2> <http://www.paywithatweet.com/> may be what you're looking for</comment>


After Russian election hack, U.S. security advisers to make 2020 race unhackable - <AUTHOR> https://www.usatoday.com/story/tech/news/2017/10/10/after-russian-election-hack-u-s-security-advisers-form-group-make-2020-race-unhackable/747403001/ <comment><USER2> it amuses me when companies state that something will be unhackable. as long as humans are writing the code, there will always be flaws.

</comment><comment><USER3> If electronics are involved, it will _always_ be hackable.

The safest system, with an automatic in-built audit trail, is good old paper and pencil ballots with scrutineers from both/all parties supervising.</comment>


Venture-Backed IPOs Head to Taiwan - <AUTHOR> http://blogs.wsj.com/digits/2010/05/17/venture-backed-ipos-head-to-taiwan/

<comment><USER3> Historically, Wilson, Sonsini, Goodrich & Rosati (WSGR) is probably the most prestigious law firm in the world for taking startups public in the U.S. markets. Guess what they are promoting on June 2nd? That's right - <USER2> presentation on how to take your company public _in Taiwan_ ([http://www.garysguide.org/events/3077312/wsgr-going- public-i...](http://www.garysguide.org/events/3077312/wsgr-going-public-in- taiwan)).

This symbolizes how important this trend is becoming for venture-backed startups in the Valley and elsewhere. The VCs need to get returns back up and they will not sit around forever as conditions remain relatively unfavorable in the U.S.

</comment><comment><USER4> > In the U.S., the cost (to go public) is $2 million to $3 million and (start- > ups have to meet the bar of) $100 million in (annual) revenue.

I am confused. What about that guy who is taking his beer pong table business public to raise 12,000? And what about other penny stocks? Can some one clarify by what he means by it costs 2 million to go public and your company needs to have a 100 million in revenue?

<comment><USER5> The beer pong guy was only trying to raise $10,000 and had one employee. Trying to raise millions requires finding investment banks with rich clients who will subscribe to your initial offering. If a firm wants to raise millions in an IPO (and you aren't Google), you have to hire one or several investment banks to shop your shares around. They charge huge fees, typically a percentage of the total offering.

<comment><USER4> Thank you for clarifying and educating me.</comment></comment></comment>


Thailand cave rescue relied on talent, luck, and on sticking to the rules - jor-el https://arstechnica.com/features/2018/07/risky-thailand-cave-rescue-relied-on-talent-luck-and-on-sticking-to-the-rules/ <comment><AUTHOR> As frightening as it was for the kids+coach, and as sad is it was to lose the SEAL trying to rescue them, situations like this are nice for the world once in a while.

For a moment we can stop paying so much attention to the maelstrom of politics we're in to focus on a cause we're all (globally) rooting for; shine a light on the stressed trials humans can overcome when actions and problem solving are needed in a snap.

</comment><comment><USER2> I wonder if it would have been possible to blast a bigger hole in the rock to get the victims out more easily?

</comment><comment><USER3> But Elon and his sub....

<comment><USER4> As an engineer, I appreciate his willingness to try an unconventional approach in the face of disaster. As a diver and casual bystander, I think he got his ass handed to him and should have left it to the pros.

<comment><USER5> > As an engineer, I appreciate his willingness to try an unconventional > approach in the face of disaster.

As an engineer I disagree. His proposal was pathetically devoid of any of the mission's basic requirements and feasibility analysis, and in essence boiled out to nothing more than a maketing ploy to promote his own public image.

Pulling that stunt at the expense of a disaster that could have ended with a dozen deaths speaks volumes about his character, as does is smear campaign targeted at one of the divers which went to the extrene of Musk himself accusing him of being a pedophile.

<comment><USER6> He showed himself to be the narcacist it's obvious he always was.

To use the lives (and potential death) of children for PR is abhorant.</comment></comment></comment></comment>


Are the girlfriend rentals on Facebook a viable business opportunity? - <AUTHOR> http://www.quora.com/Startups/Are-the-girlfriend-rentals-on-Facebook-a-viable-business-opportunity

<comment><USER2> Moral issues aside, this is a pretty good idea...

<comment><USER3> Hahaha I can see it now, Boyfriends as a service</comment></comment>


Learn TensorFlow and deep learning, without a Ph.D. (2017) - <AUTHOR> https://cloud.google.com/blog/products/gcp/learn-tensorflow-and-deep-learning-without-a-phd <comment><AUTHOR> Previously [https://news.ycombinator.com/item?id=13464496](https://news.ycombinator.com/item?id=13464496)</comment>


Boolean operation "trick" - <AUTHOR> http://stackoverflow.com/questions/3687397/boolean-operation-trick

<comment><USER2> A classmate of mine wrote something similar in C++ a while ago:

if ( Foo( ) == true ) { return false; } else { return true; }

The comparison to true is what really had me laughing.

</comment><comment><USER3> I would laugh, but I know I've written similar clunky code while thinking about the more complicated problem at hand (especially if in a rush).

Also, this is a neat example to show how novices/beginners learn how to program. They don't think about conditionals operating on booleans, the result of an expression like (1 == 2). And, they overall just seem to treat booleans differently. Seems silly once you've internalized it, but I'm sure we all make this realization while we're learning.</comment>


NSF announces plan for comprehensive public access to research results - <AUTHOR> https://www.nsf.gov/news/news_summ.jsp?cntn_id=134478&org=NSF

<comment><USER2> Buggywhips.

This plan is for articles to be widely available like two years after being written. One year after publication [1], which can be a year after the article is written [2].

Imagine a blogging platform that took two years between pressing "publish" and the article appearing online. It sounds like a Kafkaesque nightmare, but here it is, hailed as a breakthrough. The scientific community is as much to blame as the publishers.

[1] "NSF will require that articles ... be available for download ... within one year of publication." (linked article)

[2] [http://www.quora.com/What-is-the-duration-of-peer-reviews- fo...](http://www.quora.com/What-is-the-duration-of-peer-reviews-for-various- disciplines)

EDIT: The tepid reaction surprises me. We are on the verge of big advances in artificial intelligence, anti-aging, space travel, and we direly need new energy sources. Yet people are pleased with a two year delay disseminating the most important research? The heartbeat of progress is the time it takes to disseminate information. The status quo is absurd and we should be angry about it.

<comment><USER3> > _Yet people are pleased with a two year delay disseminating the most > important research? The heartbeat of progress is the time it takes to > disseminate information._

This is a bit of a strawman, don't you think? Researchers, the vast majority of whom are located in corporate R&D labs and universities, already have the subscriptions to big digital libraries so they can download papers as soon as they are published.

The move towards open access mostly affects practising engineers outside this environment, and I think a delay of a year or two is acceptable in this scenario.

</comment></comment><comment><USER4> What is most exciting about this announcement, to me, is that it provides the starting point for researchers to publish data and code.

I frequently hear scientists say that they would like to publish their data sets and source code, but don't know how to do it, or don't have a public place to put it. This NSF announcement streamlines solutions for these items.

<comment><USER5> I wonder if this presents an opportunity for someone to set up an app just for this?

Like GitHub but for publishing scientific data and code.

<comment><USER6> Figshare[0] has already gotten quite a lot of traction in this space. Full disclosure was started by a friend, but people say very good things.

[0] [https://figshare.com](https://figshare.com)

<comment><USER5> Thanks for the heads up!

</comment></comment></comment></comment><comment><USER7> This is nice gesture, but in my experience, especially for medium/large experiments, it almost definitely won't be applicable to analysis software, _private_ datasets/raw data/metadata, and more specifically middleware. It doesn't really help with reproducible results in the cases which might be most interesting. For medium to big data experiments, most source code is often useless without the (often custom or proprietary) middleware used for processing the data. For very large experiments, there is likely no canonical dataset and all "datasets" are actually generated on-demand (at least those might be covered under this).

For software, and especially middleware, some universities will be very reluctant to give that up, especially because many times the majority of the software/middleware isn't actually funded through the NSF, but maybe through a computing division, foreign institution, or international collaboration, for example. At the very least, they'll likely want to assert a restrictive copyright on the license and likely even attempt to patent some of the methods (a la Google). Researchers themselves may be reluctant to give up code: Some (maybe most?) universities have profit sharing too.

At the very least, however, it is a policy researchers can point to.

<comment><USER8> I always wondered when reading papers how anybody could reproduce the conclusions (p-values, that sort) from the data.

One simple solution would be every time you have some data analysis, you set up a VM or Docker type thing with your dataset and your code. That way other people can download it and run it, see your results, and tinker.

<comment><USER9> [http://nucleotid.es/about/](http://nucleotid.es/about/)

</comment></comment></comment><comment><USER10> Is this essentially the NIH policy, now also applied to the NSF? If so this is great news!

(Actually, I didn't realize the NSF wasn't on board with this already)

</comment><comment><AUTHOR> I just saw this announced at work and it was just too good not to share. It's my first submission.

<comment><USER11> Keep them coming!

<comment><AUTHOR> Thanks. I was pleasantly surprised that I was the first to note it. I figured it was appropriate for our community, but I got nervous when there was little uptake at first. Thankfully, after a few hours, it was on the front page, which restored my confidence. I'll keep an eye out for more useful stuff.

Incidentally, I realized that my GP statement might make people think I work at the NSF, and I don't. I work at Ohio Supercomputer Center and this was announced to us via an internal mailing list.

</comment></comment></comment><comment><USER12> That's good news. I'm hearing more and more good things for open access to journals and research. Now a country's governmental organisation is opening it's doors. Let the information flow!

</comment><comment><USER13> As founder of openrev.org, a platform to share and discuss research papers openly (or privately), I am very pleased with this announcement. It is more than just baby steps towards an open, scientific communication system.

In physics we do already have that with the arxiv.org (though there are no public discussions) but it works darn well in my sub-field and others. We cannot wait for most other disciplines to have an epiphany. So grant agencies forcing publishers AND authors to open access their material will bring us a huge step forward towards solving the most challenging problems of our time.

</comment><comment><USER14> About time!

<comment><USER15> Agreed. The tax paying public now gets to share in the scientific results it has paid for.

</comment></comment><comment><USER16> problem solved: arxiv.org

<comment><USER17> Problem not solved. This is primarily policy problem, not a technical one. See also: [http://blog.wellcome.ac.uk/2015/03/03/the-reckoning-an- analy...](http://blog.wellcome.ac.uk/2015/03/03/the-reckoning-an-analysis-of- wellcome-trust-open-access-spend-2013-14/)</comment></comment>


Ask HN: Best Sites for UK Job Search - <AUTHOR>

Hi all,
There's a big push in a lot of smarter job matching sites coming out. Sites like Hired & White Truffle look great for finding that next great job without having to check a list of search results on a regular basis (like on say Monster). But so many of these sites have a very heavy US focus. Does anyone know any that is more UK based? I'd like to upload my CV & talk about a salary in pounds instead of using résumé & dollars :)
As a UK resident thinking of finding myself a new job, my options seem a little limited at the moment! You have your classic job search sites like Monster & LinkedIn but nothing a little smarter. So I'd love some suggestions. I wanted to shout out a question on Twitter but knowing my development manager follows me (and tends to see all my tweets), asking around for job search advice probably will cause a bit of an interesting question the next day!
Thanks for any input, Lee <comment><USER2> Find the companies you want to work for and reach out to them directly. Even if the company doesn't have a current opening they may be willing to create a role for you or put you on-top of the pile for when a role does open up.

It's more hard-work than submitting CVs but it gives you a much better chance of finding a job you love.

</comment><comment><USER3> While not a job-posting board, but rather a once-a-year event, I still can recommend Silicon Milk Roundabout: [https://www.siliconmilkroundabout.com/startups](https://www.siliconmilkroundabout.com/startups)

You might browse through current London's startup needs.

</comment><comment><USER4> Would you consider a 1:1 UK based service? Mainly to investigate your options & find the right kind of jobs that are not via a recruiter.

Or are you more after a list you can check daily?

</comment><comment><USER5> JobServe.com could be of use.</comment>


Show HN: MERN 2.0 - Easily build production ready universal apps - <AUTHOR> http://mern.io/?v=2.0 <comment><USER2> Do you know any MERN app in production ?

I am looking forward building with MERN, but still looking for insights

<comment><AUTHOR> Hashnode uses MERN stack. Also, we are preparing a list of people using MERN in production and will add it to the repository soon.

<comment><USER2> Great thank you !

Is MERN deploy ready already ?

<comment><AUTHOR> We are working on it as we speak. You can subscribe in the MERN website. We will notify you once it is ready.

<comment><USER2> Great, thank you !</comment></comment></comment></comment></comment>


Clojure Destructuring Tutorial and Cheat Sheet - <AUTHOR> https://gist.github.com/john2x/e1dca953548bfdfb9844 <comment><USER2> This is great, and it is also worth reading "Destructuring in Clojure and Ruby":

[http://eyeofthesquid.com/blog/2013/09/29/destructing-in- ruby...](http://eyeofthesquid.com/blog/2013/09/29/destructing-in-ruby-and- clojure/)

which has some great comparisons. As it says:

"As with many things in Ruby, the better question than "Can it be done this way?" is "Is it wise?". "

There is a lot that you can do in Ruby that is more gracefully done in Clojure. Brian Carper brings this out even more clearly with his post "Keyword Arguments: Ruby, Clojure, Common Lisp":

[http://briancarper.net/blog/579/keyword-arguments-ruby- cloju...](http://briancarper.net/blog/579/keyword-arguments-ruby-clojure- common-lisp)

That post shows the exact point where keyword arguments in Ruby can become ambiguous, which is the exact moment that Clojure's clarity becomes obvious.

Also, Jay Field's post on the subject of Clojure destructuring is where I got a lot of practical starting ideas (such as using the :keys directive):

[http://blog.jayfields.com/2010/07/clojure- destructuring.html](http://blog.jayfields.com/2010/07/clojure- destructuring.html)

</comment><comment><USER3> I first learned about destructuring through Clojure. Lately I've been working on a Firefox extension and discovered that Firefox JavaScript 1.6 supports destructuring ([https://developer.mozilla.org/en- US/docs/Web/JavaScript/Refe...](https://developer.mozilla.org/en- US/docs/Web/JavaScript/Reference/Operators/Destructuring_assignment)), too, and is very pleasant to use. I hope it makes it into the ECMAScript 6 standard.

<comment><USER4> Your hopes shan't be dashed! Destructuring assignment is part of the ES6 specification now: [http://wiki.ecmascript.org/doku.php?id=harmony:destructuring](http://wiki.ecmascript.org/doku.php?id=harmony:destructuring)

</comment></comment><comment><USER5> Instead of "rest" (which the author mentions is a core function), the Clojure convention for getting the remaining items appears to be "more"; e.g. [x y & more]

I really like this tutorial.

</comment><comment><USER6> This is exactly what I was looking for after I reached minimal competency just to finish the exercises on the 'koans' site.</comment>


Algorithm Tutorials from training camp organised by UCT Algorithm Circle - <AUTHOR> http://groups.google.com/group/algorithm-chat/web/chpc-uct-algorithms-camp-2009?pli=1

<comment><USER2> Anyone knows a compreensive source like this in text or html?</comment>


Show HN: I just released my first commercial audio plugin - <AUTHOR> Hey all.
For the last few years, I have been developing a software synthesizer as a side project. It's taken longer than I both hoped and feared, but earlier this week I finally shipped 1.0.
Details about the synth itself are up on my website, https://lhiaudio.com/.
For those who are unfamiliar, in music production, there are host applications (such as Logic Pro, Ableton Live, or REAPER) in which most of the work (such as recording or sequencing MIDI data) is done. These applications generally have some built-in tools for the actual generation and processing of audio data, but there is a massive ecosystem of third-party plug-ins for doing this as well. Cadmium is such a project – it takes MIDI notes in and generates sound.
I built Cadmium from the ground up, based on my own framework for plugin API abstraction (for which I only have one backend, but that's not important right now), my own UI toolkit (rutabaga (https://github.com/wrl/rutabaga), a cross-platform OpenGL 3.2 scenegraph), and finally the synthesizer engine and plumbing on top of all of that. The whole thing is written in C, with some Python (using waf as my build system) for compile-time codegen and some GLSL for pieces of the UI. Runs on Mac, Windows, and Linux.
Realtime audio programming is a pretty challenging field, all things considered. Since it's realtime, there's a lot of mundane bits of programming that are strictly verboten – no allocation, no file I/O, no locking/mutexes – but only in the audio thread. So there's a lot of ringbuffers, lock-free queues, things of that nature, and then there's the actual UI programming and math/EE for the DSP on top.
If you're a musician or producer yourself, I'd love to hear what you think. If you've always been curious about this kind of development, feel free to voice your curiosities here too! I love talking about this lesser-known corner of the wider software development landscape.
-w <comment><USER2> I've just downloaded the demo to have a play with it - like the sounds, there's a lot here that could be useful for me (Musician/Producer and Music Tech educator), so I have a few comments (I've spent under an hour playing with it, so forgive the shallowness):

Love the modulation assignment method - dead simple to use and understand within 10 seconds. Right-click to remove that assignment is nice as well. The manual being online (and therefore animated to show things like this) is a good idea.

UI is simple and clean, although it's a little on the dark side, IMO. However, the VPS waveform display (and running through the instructions in the VPS section of the manual) really help you understand what's happening to the waveform and why it sounds like it does - a vast contrast to the the FM and PD synths of the 80s where you just heard what was happening with (probably) no idea why. Really nice touch there.

The flexibility of the LFOs (note or frequency-based) is another great help to understanding and making sounds - really nice to be able to switch function without having to recreate the modulation you'd created (as you would have to if they were different modulation sources).

Filter is nice - particularly nice to have modulation options on Resonance and Drive as well as cutoff.

Sounds are interesting - I think a lot of synths live and die on their presets to show off what they can do, and there's a good selection here.

Some of the patches seem to use a LOT of CPU - for instance WRL Sine Keys is around 50% (and a few others are around there as well) while KL Resonances Seq can peak near 100%. These are readings from Cubase's Audio Performance meter (I'm seeing about 7% CPU load in Task Manager > Performance). This is on Win7 x64, running Cubase, on an i7 4790K system that I dual boot for 'general' and music use. Running the same MIDI on a Tyrell N6 sees almost no reading in the meter in Cubase.

Any chance of a resizeable UI, a la sylenth? It's a bit small on a 4k screen.

Also, is there a roadmap? Whenever I see 'licence valid until vX.0 is released', I wonder how long that will be; particularly when it's a plugin.

Anyway, I don't want to sound negative - what you've done is an immense achievement (I'm learning the basics of programming in Python at the moment, so I can appreciate a fraction of what you've had to go through) - hats off to you for that. I've got to go and have dinner, but hopefully I'll get some time later in the week to have a more serious play around with it.

<comment><AUTHOR> Hey, thanks for checking it out. Really appreciate the feedback all around. Going to address a few specifics here –

"Sine Keys" is a monster. It's the long release time coupled with a healthy setting for max poly, and the killer in Cadmium is the per-voice overhead. I'm definitely aware of this – the CPU usage is a consequence both of the audio- rate modulation and because of VPS being difficult to antialias. Nonetheless, it's a priority and I'm working on it.

Resizable UI is also on the roadmap. The next version (1.1) will have Retina support, and that will pave the way for a fully resizable UI likely in 1.2 (Q1/Q2 next year).

There's a loose roadmap, but I haven't made it public just yet. My priority right now is getting the next version sorted out to establish a release cadence, and then after 1.1 I'll be more open about my plans.

Again, thanks for demoing it, and glad to hear you're enjoying it. Feel free to reach out anytime. :)</comment></comment>


Avoiding the Distributed Monolith - <AUTHOR> https://www.simplethread.com/youre-not-actually-building-microservices/ <comment><USER2> Not sure why a contract development shop is putting stuff like this on their blog. Perhaps they have small clients asking for microservices when unnecessary?

Agree that this headline is presumptive and so is the article. Not every piece of engineering is a "slap it together in 3 weeks" build and many systems are designed with independent parts that use different technologies and scale at different rates.

I think what the author was trying to say is: "If you don't have enough experience to derive an architecture that isn't just some battle of buzz words or copying off blogs posts, you're in for a crude awakening when you have to maintain, scale, and refactor your work. Also, creating and maintaining a continuous delivery architecture with tons of moving parts is a lot of work".

At large companies (and small) devops, engineers, architects, CTOs, and many other players collaborate to develop an architecture which evolves over time and includes legacy systems, greenfield projects, duct tape, off-the-shelf bits, vendor-specific bits, open source bits, and other concerns that all have to work together. These organizations already have massive teams (or small and really good teams) taking care of making sure everything works together.

If you have a small team, little funding, and/or little experience you are probably getting in over your head trying to architect and orchestrate tons of moving pieces. It really depends on what you are building, your budget, and your team as to how you should build. Some industries and products require complexity, scale, and proper function from the beginning while others are accepting of bugs, scaling issues, and long delays.

TLDR: There's not a simple playbook that defines how everything should be engineered. Also, don't read some poorly written blog post which provides zero insight on the complexities of approaching an engineering challenge and decide to choose X or Y approach.

<comment><USER3> > Not sure why a contract development shop is putting stuff like this on their > blog.

Content marketing - it is a thing and this is how it is done. If were reading it so is some decision maker. It only has to "look right" to someone with a minimal set of information in order for it to make the publisher look like an "expiator"

<comment><USER4> Another possibility - many startup/product companies self-fund by doing contract dev work. It could easily be learnings from their in-house product dev rather than just brazen content marketing...

<comment><USER5> I wonder how many of the consulting giants got started accidentally. "We did a contract, then another, then we had built up a team and reputation and really didn't see a point in doing our product anymore"

</comment></comment></comment></comment><comment><USER6> TFA has some excellent lists to test whether you're just building a distributed monolith or actual separate microservices.

The key that was not mentioned was the interfaces. In my experience, the key is to carefully define the functions and scope of each separate component, then do a lot of up-front work building a clean interface for sending data and/or messages between the components.

Once this is done, the team on Componnt A should be able to make, rollout, and/or move to different hardware, and/or add/subtract hardware at will without the team on component B even noticing. All teams should be able to keep their paws 100% out of each others' code and data structures.

Then, you have independent components that can actually be immediately scaled to meet unexpected load changes by throwing HW at them, thus buying time to streamline the code. You also have a structure that you can upgrade and maintain with much greater freedom.

Without the clean and stable interfaces, he's right, you have only a distributed monolith.

I'd recommend starting the first version with a quick-to-build near-monolith throw-away, get some experience with the actual data flow, then decide on the actual components and interfaces.

<comment><USER7> Googling "TFA microservice monolith list" leads to your post. Where are the lists? (-;

<comment><USER6> In the original article linked above to which this is a comment("TFA" = "The Fine Article"), first one about a page down

</comment></comment></comment><comment><USER8> Just noting this as I have some successful use cases of microservices as it may help others. What I mean by successful is I have reused them in many projects without having to modify them for each project, meaning they stood alone with only needing some config items to add one or more clients.

1) Authentication - JWT and OAuth provider related, can be used with multiple clients or installed per client 2) Pre signing of S3 uploads (very tiny file to do this one) 3) Ecommerce api w / shipping using fedex and stripe 4) Plugable CMS with JS dropped on a page used for UI and auth and S3 used as content store with an API sitting in between

I guess some of them could be considered just an API? But if you can reuse it generally and the scope is fairly narrow, that is more of what a microservice should be. There is also the tradeoff where you may be thinking if this is so tiny, why even do it?...which is probably a good thing to consider before adding more complexity.

<comment><USER2> Yes, others also include:

\- Proxies that upload/retrieve assets to multiple cloud providers (i.e. upload files to / retrieve from GCS and S3 in case one is down)

\- A service that screens/transforms attachments/uploads for security before allowing them to reach other services

\- An API for sending mail/SMS/other contacts via multiple providers to deal with outages to one or more providers.

Often, these are before built as libraries and imported into multiple projects which is the wrong approach. Offering up an API for these instead can help decouple.

However, the author probably doesn't understand versioning and deprecates or makes breaking changes to APIs and then has to update a bunch of consumers. If you want a decoupled system, you have to not break the system. This is why legacy stuff exists at older companies. Once API v1 of the mail sending service is done and working, there's no reason you need to break it, or add new features, or take it down. Keep it running and also run v2 so that people can use the new features. The author is probably running v1 and v2 out of the same codebase and overwriting the v1 history so they can't maintain it, that's just bad software project management.

Maybe the title should switch to: "coordinating a complex architecture is hard, I only build easy stuff"

<comment><USER8> Yah funny you say that about versioning and breaking changes. The side effect of the CMS one for example is its been around for 7 years now and I want to kill it off but there are clients depending on it. I don't even update the code anymore so I guess its ok but from that lesson learned, making the other "microservices" as I've defined them you should build a microservice so it can also be used individually for a client as well as multiple clients where the work of doing one or many is the same so you could easily walk away from the responsibility of hosting it if you wanted.

<comment><USER2> It's good that you want to update it and make it better. However, it it works fine for the clients and they are happy, you should be too.

We all look back on our previous work and see room for improvement, that's a good thing. However, spending too many cycles trying to achieve perfection where it's not desired will prevent you from moving on with your life to bigger and better pursuits.

Be really happy that you have a software project which survived for 7 years. Many fail in far shorter time and provide no value.

</comment></comment></comment></comment><comment><USER9> But Microservices means I'm good because Agile in the Cloud.

<comment><USER10> But do you have Containerized Multicloud Agility?

<comment><USER11> Microservice-as-a-service.

<comment><USER12> Too bulky. I switched to Microservices-as-a-Microservice (MA'AM) and have never been happier.

</comment></comment></comment></comment><comment><USER13> The growth of microservices is the result of the growth of working remotely. If you have a large organization in one place most days out of the week its easy to coordinate proprietary interfaces. With the growth of Agile development and the ability to have independent groups working on manageable subtasks is natural. Microservices are simply an application of Divide and Conqure at the macroscopic level.

</comment><comment><USER14> No, truly I am.

<comment><USER15> I too am frustrated with presumptive headlines.

</comment></comment><comment><USER16> The quote at the end "don't even consider microservices unless you have a system that's too complex to manage as a monolith." causes me to laugh.

I have never fundamentally disagreed with a well-known domain expert as much as I have with Martin Fowler, and I have had a fairly successful career despite my attitude of "do things the way M.F. wouldn't".

On one hand I find it frustrating how people take his ideas as gospel. On the other hand I'm humbled to think there isn't necessarily "one right way" and other schools of thought can find success.

<comment><USER17> This comment would be more interesting if instead of laughing you would state what your other way of doing it.</comment></comment>


Zoom plans to roll out strong encryption for paying customers - <AUTHOR> https://www.reuters.com/article/us-zoom-encryption-exclusive/exclusive-zoom-plans-to-roll-out-strong-encryption-for-paying-customers-only-idUSKBN23600L <comment><USER2> This may not be nice or demonstrating customer obsession but it is probably a good way for them to make money with business customers.

For better or worse Zoom has obtained "iPhone status" in corporate IT.

What killed the Blackberry was when decision makers had a personal iPhone and a work Blackberry and they finally turn up in the head of IT's office and say "hey these things you're making us use really suck, please just make it so we can use these iPhones which are soooo much better."

I see exactly the same thing happening now with Zoom. I see IT types saying "but encryption" yadda yadda yadda and decision makers tuning up saying:

"This conferencing software you're forcing us to use really stinks. I had a meeting with our soccer parents group on Zoom and it was so much better. Please switch us to this."

A product that reaches that status stands to really disrupt the enterprise if they're smart and take advantage of it.

<comment><USER3> Who uses Jitsi and Zoom and still wants Zoom? Fuck's sake, our industry is in trouble.

<comment><USER4> Jitsi doesn't perform as well as Zoom for a ton of people, and most people outside of tech circles haven't heard of it. It's a miracle people are using Zoom instead of webex or Teams/Lync, honestly, since those have both been around forever.

<comment><USER3> Perform in what way?

WebEx over Jitsi?! I must be missing something huge, here.

</comment></comment></comment></comment><comment><USER5> Not a bad way to entice business customers to pay.

I rather zoom become a product that earns money by providing value to customers, rather than having the "customer" as the product like google's offerings.

<comment><USER6> Why does one exclude the other? Given their history they might demand money and sell your data.

<comment><USER7> What history?

<comment><USER6> Their recent history, where security and privacy was an afterthought.

<comment><USER7> I would argue that cutting corners when it comes to data protection in favor of feature development is a very different tradeoff than intentionally building a monetization strategy around selling said data.

</comment></comment></comment></comment></comment><comment><USER8> > Gennie Gebhart, a researcher with the Electronic Frontier Foundation who was > on Thursday's call, said she hoped Zoom would change course and offer > protected video more widely.

> But Jon Callas, a technology fellow of the American Civil Liberties Union, > said the strategy seemed a reasonable compromise.

> Safety experts and law enforcement have warned that sexual predators and > other criminals are increasingly using encrypted communications to avoid > detection.

> "Those of us who are doing secure communication believe we need to do things > about the real horrible stuff," said Callas, who previously sold paid > encryption services

Why do people still believe that preventing civilians from using encryption is going to stop criminals? Is there a name for this fallacy?

What does Zoom's premium subscription offer? Jitsi supports unlimited participants and runtime for free, and soon E2E encryption.

<comment><USER9> This is horrific. The surveillance state has infiltrated ACLU. How is such a brazenly anti-liberty person tolerated at the ACLU?

Even if you take his perspective, why is child porn OK in the enterprise?! Especially after Jeffrey Epstein?!

<comment><USER10> The ACLU is not a singular entity with the same thought; it's a collection of people, and people have different opinions on things.

I'm reminded of when the ACLU defended a white supremacist and many were upset, even to the point of leaving the ACLU.

</comment></comment></comment><comment><USER11> Doesn't seem like a particularly bad idea to me - I'd much rather they were making money from paying corporate customers, rather than making money selling users data....

I highly suspect the vast majority of home users, who are using Zoom to host weekly quiz nights with friends, particularly care about strong encryption....

<comment><USER12> Tim Cook had it right with "Security isn't a feature"

I'll liken it to healthcare despite the US not figuring this out yet. Healthcare for all helps everyone, which consequently is a value creating proposition. The fallout from a lack of healthcare negatively impacts the rich in the longterm

When security is widespread, everyone benefits. A culture which make security default off is one that throws everyone under the bus for nickles & dimes. You don't vaccinate only 10% of the population

<comment><USER13> While I agree with your overall point, it's worth pointing out that Apple doesn't really do a lot of freemium stuff, so Cook's comment should be taken in the context of having nearly all customers who have already paid up.

<comment><USER9> Free users should get time-budgets or group size limits or video resolution limits, not be spied on.

<comment><USER14> This is exactly what free users get when using zoom.

Up to 3 people in a meeting is unlimited. Over 3 is limited to 40ish minutes.

The Facebook pixel SDK etc etc stuff you're probably thinking of got removed from recently updated clients. Check out their privacy policy to have a look at the actual data they retain from actual meetings. it's fairly limited and only to do with account management / meeting management from what I recall.

</comment></comment></comment></comment></comment><comment><USER15> The title should say 'full/end-to-end' rather than 'strong'.

It's not about how hard it is to break but rather where it's encrypted/not.

</comment><comment><USER16> Not unlike what Slack is doing with data residency controls - only available for Plus and Enterprise plans.

<comment><USER17> Slack is worse. If you don't pay, not only do they not give you access to >10k messages, but they still store those messages and don't allow you to do things like delete them.

<comment><USER18> > _and don 't allow you to do things like delete them._

How does that work with GDPR?

<comment><USER19> It doesn't. Big companies who want to be gdpr compliant buy enterprise Slack and force slack to store the data in European datacenters. Slack doesn't give a shit about gdpr if you're not paying

<comment><USER20> Doesn't that make Slack themselves non-compliant?

<comment><USER21> It probably does. But it requires someone to pick the battle (a customer or an enforcement agency on their own) to get it enforced.

</comment></comment></comment></comment></comment></comment><comment><USER22> Another thing you need to know. Zoom will charge you automatically next year, you have to cancel the subscription by yourself. What is disgusting is that the menu is hidden in the zoom webportal! I think 99.99% of the customers don't know it will renew(charge again) automatically and don't know how to cancel it.

<comment><USER23> Which service that gives "$X per year"/"$Y per month" pricing _doesn 't_ automatically renew? And at least for me, it clearly shows "$X billed today, recurring yearly/monthly payment $X" when going to order a subscription?

<comment><USER22> Zoom has no option to turn off Automatic Renewal

<comment><USER23> You can cancel and your subscription will keep running until the end date when it otherwise would renew. Exactly the same as Spotify, Netflix, and the majority of other subscription services that "99,99%" of customers likely are familiar with.

<comment><USER22> Can you find the cancel subscription from the Zoom webportal? It is hidden!

<comment><USER14> Web portal > account/profile > account settings > billing

Then there's an orange "add/edit subscription" link and a "cancel subscription" link.

The process is well documented in an article on their help centre.

A simple DuckDuckGo search brings up the help centre article as one of the first results.

</comment></comment></comment></comment></comment></comment><comment><USER24> 404 currently so I haven't read it, but that acqui-hired Keybase team is surely leaving... Its motto was literally _[double-checks]_ 'crypto for everyone'.

It may not be related, but the homepage now instead has phrases like 'for things that matter', and the slogan at the bottom is 'because safety first'. I can't be certain, but I think it said 'for everyone' on the site too, not just app-stores pre-Zoom.

It's a real shame, but I did start my de-Keybasing yesterday. Making it profitable without losing the acqui-hired team would obviously be best for users, but I think most likely is axing it, followed by butchering it into a niche security nerd product without the interest or direction of the original team.

</comment><comment><USER25> Bad move.

Zoom will still get hacked if the minimum security isn't enough, then they will have to blame their potential customers for their own problems while their brand is smeared.

</comment><comment><USER26> Zoom is for people who don't mind kids organizing raids to plaster their meetings with hardcore gay porn and images of tubgirl.

</comment><comment><USER27> Why did you have to add the 'only' word to the title, the original title doesn't contain it? That transforms your title from informative to an opinion

<comment><USER28> It's a statement of fact and included in the article itself.

<comment><USER7> Facts are facts. Choosing which facts are relevant is an opinion. Editorializing doesn't mean creating fiction.

Edit: It's so odd what gets downvoted sometimes. Anyone care to enlighten me on what could be controversial about my statement?

<comment><USER29> Please don't complain about downvotes. It breaks the site guidelines: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html), not least because users frequently give corrective upvotes ([https://hn.algolia.com/?query=corrective%20upvote&dateRange=...](https://hn.algolia.com/?query=corrective%20upvote&dateRange=all&page=0&prefix=true&sort=byDate&type=comment)), which leaves the complaint as uncollected garbage in the thread.

</comment></comment></comment></comment><comment><USER30> Zoom I've always thought must have pretty strong security if configured correctly (obviously that's a big if) It is currentLy in use by the Chinese Academy of Sciences (CAS). CAS is sort of like a mix of NSF, NIH, and DARPA all rolled into one. About 20% of their research supports the People's Liberation Army (PLA) for things like encryption research, so I assume they know what they're doing.

This is technically a white label I guess you would say, but if you download the code, a majority of the files begin with the prefix Zoom and what not: [https://cc.cstcloud.cn](https://cc.cstcloud.cn)

<comment><USER31> Why have you thought that? The actual security of the system has been dissected already.

They took RTP and just encrypted the data with ECB mode, using the same keys on every node. It's what a child would do, or somebody who either didn't know or didn't care to do better.

Well over a decade ago the _standard_ way to do that (named SRTP following the usual convention) uses a counter mode instead of ECB, with separate keys on each node. That's still pretty poor, but it's like SRTP is a Yale lock and what Zoom chose to do is use one of those "handcuff key" locks that's just a single lever. Can a specialist open that Yale lock? Yeah, probably in a minute or two, with the right tools - but any idiot can open the handcuff key lock with a bent twig, it's not security it's the barest effort to not just emit plaintext.</comment></comment>


World without end - <AUTHOR> http://www.newyorker.com/magazine/2015/05/18/world-without-end-raffi-khatchadourian <comment><USER2> I always feel like games like this die in the late-game. Once you've had fun with the exploring and are collecting resource units for the nth millionth time, the game kind of runs its course.

It would be far more interesting if, as you play, you can participate in a large economy, slowly growing your gameplay experience out from say, a single guy mining and selling minerals on a planet, to an galactic empire.

Even better if you could participate at just about any part of the virtual economy, buying, selling, crafting, shipping, policing, fighting, robbing, pirating. You could own a store on a space station or a repair shop, make enough and buy a ship, or buy a station. Now you're managing station ops.

Exploration is just one of the X's in 4x, and I feel like there's so much untapped potential in the genre.

<comment><USER3> Sounds like Eve Online meets your wishlist...

<comment><USER4> Exactly like Eve, yeah - the sheer scale and possibilities of that game are unprecedented.

</comment></comment></comment><comment><USER5> The hype around this game reminds me of the hype around Spore a decade ago (it didn't live up to it).

<comment><USER6> The trailer implies that these games offer worlds of boundless possibility, what it really is, is worlds with a bunch of generated primitives and sliders to change some numerical parameter. It's not that the trailers for these games lie, it's just we subconsciously expected more.

To achieve what we expect, the programmer needs to implement features that allow emergent gameplay and unpredictable situations to arise alongside procedurally generated settings. There are few single player games that actually pull this off. Dwarf Fortress, ARMA, and GTA V to name a few.

<comment><USER7> Yeah, sort of like those "32 in 1" and "112 tele-games" Atari cartridges, where each "game" was a permutation on the number of players, how the players were organized into "teams" combined with difficulty levels, or some such modifier. In reality, it was just the same game, and maybe you passed the controller around differently.

<comment><USER8> Or the cheap "pop station" handhelds that blatantly give you multiple copies of the same game, just with different "sprites": snowboarding, skiing, motorcycle racing, car racing, bike racing, etc all effectively identical.

</comment></comment></comment></comment><comment><USER9> Games like these come from amazingly humble beginnings:

[https://www.youtube.com/watch?v=SDNMTnXoG9M](https://www.youtube.com/watch?v=SDNMTnXoG9M) [https://www.youtube.com/watch?v=aTJFChB5wyY](https://www.youtube.com/watch?v=aTJFChB5wyY)

<comment><USER10> Thanks for that.

There should be more games like this. The technology obviously isn't the limitation here.

</comment></comment><comment><USER11> >> Murray's primary coding contribution is to planetary terrain, and he had developed a special appreciation for such formations.

So Slartibartfast then: "[Norway] was one of mine. Won an award, you know. Lovely crinkly edges."

</comment><comment><USER12> The trailer, which the New Yorker is too old school to link to: [https://www.youtube.com/watch?v=3gQi2bv1DHg](https://www.youtube.com/watch?v=3gQi2bv1DHg)

<comment><USER13> They do have video commentaries which are generally great: [http://video.newyorker.com/watch/commentary-the-universe- of-...](http://video.newyorker.com/watch/commentary-the-universe-of-no-man-s- sky)

</comment></comment><comment><USER14> > using money he raised by selling his home

Holy cow, that's a brave move!

</comment><comment><USER15> I wish he could join this up with Elite Dangerous. Elites space environment is pretty impressive and if it needs something, then a proper surface-dimension.

</comment><comment><USER16> The strength of this is its weakness: because the worlds are generated procedurally, they cannot contain dependencies between the elements of the world, unless they have been specified in the formula. The article gives a good example, of how a river can't emerge from the slopes of the terrain - instead, you have to encode the river as part of the terrain. It's not emergent. It's analytical, not numerical.

They can still have a sophisticated generation method, which does encode several different features, that can co-occur in unexpected ways, but it can't be a deep interaction. In effect, the designers are exploring the space of equations for world generation. The advantage is they can have billions of planets without storing them or expensively generating them. Analytical solutions are extraordinarily efficient - it's just a formula, you punch in the seed and you're done. No iteration or search.

In the videos I've seen, the planets all look alike, just different shapes and colours for trees, grass, terrain.

Still, I admire their dream and fervor and hope it's more interesting than I expect.

</comment><comment><USER17> I still haven't seen any comparisons of this game with Mirrormoon EP, which seems a lot alike to me.

You could fly through space to any of the stars you see, it was procedurally generated planets, bright artistic colour design choices, etc.

The only thing that seems different is the much more content and actual realism in No Man's Sky.

</comment><comment><USER18> There are theories that our own universe is more likely to be a simulation than "real". e.g. [http://www.simulation- argument.com/simulation.html](http://www.simulation- argument.com/simulation.html)

</comment><comment><USER19> "So, annoyingly, by doing it wrong you get a nicer effect,"

Realism vs Cinematics :/

</comment><comment><USER20> Amazing. This will be the first video game that I've played in a long time.

</comment><comment><USER20> THIS GAME IS GOING TO CHANGE THE WORLD</comment>


Prose - A Web-Based Content Editor For Github - <AUTHOR> http://prose.io/

<comment><AUTHOR> Found via: <http://goo.gl/mE9Oh>

</comment><comment><USER2> Sorry, but this is a dupe! :\</comment>


80 Percent of Tor Traffic Is Not Child Porn - <AUTHOR> http://www.wired.com/2015/01/department-justice-80-percent-tor-traffic-child-porn/ <comment><USER2> The claim is nothing more than propaganda. The DOJ knows the truth, and the people who are part of the technical community know the truth.

Saying this is just using false information to sway the public, and looking to badge things that are just tools as inherently evil tools, or tools only used for evil.

Disclaiming the lie is a good step - but I'd like to see the rebuttal coming from a more mainstream media source. Wired writing this article is preaching to the choir.

<comment><USER3> Having worked with attorneys (including some at the DOJ), I would advise you not to overestimate their understanding of technical concepts.

<comment><USER4> The source of the confusion here is obvious and pounding on it won't help. From the DoJ's perspective Tor _is_ hidden services. Criminal abuse enabled by proxying to the open web is not high up on their radar. Regular web sites can easily block Tor. But hidden services are unique. When Tor is mentioned in the media, it's almost always because of hidden services. When it's involved in large scale FBI investigations, it's almost always because of hidden services.

So whilst Andy Greenberg's article is correct, it's correct in a nitpicky technical sense that isn't going to have any political impact as an argument. Tor has chosen to support hidden services very strongly, so the fact that it's a relatively small amount of their total traffic doesn't matter much.

The Tor project _needs_ to take this kind of thing seriously. Alarm bells should be ringing. They are getting (apparently credible?) tipoffs about plans to seize directory authorities. Relays actually are getting seized. DoJ officials are publicly saying they perceive Tor as being dominated by crime. Meanwhile they are doubling down and making blog posts that describe police operations as "attacks". This has the feeling of a slow motion train wreck in the making.

<comment><USER5> > that describe police operations as "attacks"

Is there a more reasonable way to describe "police operations" whose goal is to disable portions of or function of a network?

<comment><USER6> Good point. It _is_ the standard term in security and cryptography.

<comment><USER7> It doesn't matter. You can't use in-group specialized vocabulary when talking to out-group audiences. You must either use common vernacular or somehow give new, commonly accepted definitions to the words you want to use.

<comment><USER5> I don't think "attack" is specialized vocabulary meant for an in-crowd.

For reasonable, common definitions of "attack," seeking to disable something or cause it to malfunction is an attack against that thing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Did anyone else initially read this title as implying that 20% of Tor traffic IS child porn?

Edit in case it's changed: The title is, "80 Percent of Tor Traffic Is Not Child Porn."

<comment><USER9> Unsurprisingly, the original title, "No, Department of Justice, 80 Percent of Tor Traffic Is Not Child Porn," is quite a bit clearer.

<comment><USER10> What about the actual url...

`/department-justice-80-percent-tor-traffic-child-porn`

</comment></comment></comment><comment><USER11> The internet community as a whole is going to have an uphill battle against telecoms, spy organizations, and law enforcement agencies ...probably forever.

I hope that at some point John Q Public realizes that digital privacy and free flow of information are more akin to advancing society scientifically and spiritually much more so than terrorism, child porn, human/drug/weapon trafficking, et al.

After the Snowden revelations it was quite apparent that the average citizen would gladly exchange a lot of privacy in order to fight an enemy that doesn't exist.

I hope we can stop going to war with ghosts and focus on moving society forward. An open internet can be a great tool for this.

<comment><USER12> The average citizen doesn't care as long as they get their bread and circuses.

<comment><USER11> Well the average citizen cares about certain things such as "jobs are good" or "terrorists are bad" where they don't necessarily _care_ but they at least make associations with certain topics. I guess I hope that privacy/open internet will become one of those simple things people can understand.

</comment></comment></comment><comment><USER13> _I made clear at the time that the study claimed 80 percent of traffic to Tor hidden services related to child pornography, not 80 percent of all Tor traffic._

This is also a bogus number. An estimated 80% of Tor hidden service _directory lookups_ are for those sites. Long-lived connections only make one lookup, and sites that people check multiple times in one session only get looked up periodically. The ones that are looked up the most often are the ones where people open Tor, visit the site, then close Tor. This does not correlate with volume of Tor traffic at all.

<comment><USER14> It probably correlates really well with random research projects that are tracking those hidden services...

<comment><USER15> It is only natural that people with things to hide will be overrepresented among early adopters of technologies for hiding things. The solution isn't to weaken hidden services, so that evil can be more readily exposed. Far more useful will be increasing the accessibility and usability of hidden services for protecting human rights. In this case, dilution is truly the solution.

</comment></comment></comment><comment><USER16> And while we're discussing it, 80% of people carrying cash are not drug smugglers, and 80% of people using Waze to watch for traffic cops are not cop- killers. Are we seeing a trend here?

<comment><USER3> Wait, is that actually a criticism levelled against Waze? That can't possibly stick, right?

Almost everyone in the U.S. drives and everyone who drives hates getting traffic tickets. I thought allegations/criticisms like these only really worked when you could separate the users into some group identified as "other".

<comment><USER17> Yes that is a real criticism against Waze. The thought is that the "show where the cops are" feature can be used by those who wish to assassinate cops (by finding them when they are alone I guess).

The obvious conclusion being that the feature must be removed (obvious to a certain Orange country sheriff at least). [http://www.npr.org/blogs/thetwo- way/2015/01/28/382013185/off...](http://www.npr.org/blogs/thetwo- way/2015/01/28/382013185/officers-ask-map-app-to-remove-police-tracking)

<comment><USER18> That's not saying that "80% of Waze users are cop killers" though. Just that some people could use it to locate cops in order to attack them.

I don't know if that makes really sense but it's much less outrageous than what the OP implied.

<comment><USER19> I think what the OP implied is that things will always be used by criminals for other purposes than intended.

</comment></comment></comment></comment></comment><comment><USER20> Wouldn't you have to decrypt and inspect all Tor traffic to accurately determine what percentage of it is _anything_?

If the DoJ could do that, they would necessarily have the ability to track and capture the CP-traffickers without bothering to "inform" the news media that such people are crawling all over Tor, _in your Internet pipes, coming to get your children_.

CP is such a universally reviled thing that whenever someone brings it up in an unrelated argument, I automatically suspect that they are losing it, they know it, and they are falling back to rhetoric. It is the "won't someone please think of the children" appeal to emotion, turned up to 11.

</comment><comment><USER21> How would anyone really know? Isn't the point of Tor to make that kind of study damn near impossible? For all we know 80% of Tor traffic is hot sexy manatee action.

<comment><USER22> Unencrypted data passing through an exit node can be read by the operator of the node. Deploy x amount of nodes, analyze traffic and perform some basic statistical analysis?

Granted your data will be biased towards unencrypted traffic, but you should get a small picture of whats going on. Plain jane http and ftp traffic should be sniffable.

<comment><USER23> There is no amount of statistical analysis that you could do to extrapolate the amount of traffic with anything even approaching accuracy. I also have approaching zero confidence that any government agency or even a contractor funded by the government would be able to approach adequate methods to allow even an attempt at statistical analysis.

The "small picture" you would get, is very well probably the 80% we are talking about, e.g., 80% of all traffic that is associated with kiddie porn and is also unencrypted because the perpetrators are unsophisticated is actual kiddie porn traffic, which says nothing whatsoever about the overall amount of traffic that is kiddie porn. On top of that, what are we talking about here? What is this definition of o kiddie porn? Does that number include subjects that "appear" to be underage? If I know anything, I know that the government will skew numbers to fool others and even themselves; because that's how you get money and how you build your little fiefdom.

</comment></comment></comment><comment><USER24> At this point, it's not outside the realm of possibility that some or many of the hidden services are being run by three letter agencies themselves.

<comment><USER25> These agencies used fronts to donate money to cold war cultural institutions. I think your speculation is entirely possible, even though it sounds tinfoil- hattish now.

The Cold War example that comes to mind is _Partisan Review_ , a broadly left- oriented journal that published Susan Sontag's "Notes on Camp" and Clement Greenberg's highly influential art essays ([http://en.wikipedia.org/wiki/Partisan_Review#Funding_by_the_...](http://en.wikipedia.org/wiki/Partisan_Review#Funding_by_the_C.I.A.)), which (it was later found) accepted multiple donations from CIA fronts.

As time went on, some viewed these donations as a tool these agencies found to bolster the intellectual stature of the "New York School" of heroic AbEx painters versus their Soviet counterparts ([http://en.wikipedia.org/wiki/Abstract_expressionism#Abstract...](http://en.wikipedia.org/wiki/Abstract_expressionism#Abstract_expressionism_and_the_Cold_War)).

</comment></comment><comment><USER26> Has anyone actually _seen_ that "study" from Portsmouth University?

I tried to google it but all I get is useless soundbites and fear-mongering, all over the mainstream media, with everyone linking back to Wired.com.

No one links to the actual study or to any evidence to support the claim.

Shame on you Wired.

<comment><USER27> The statistic comes from a talk at this year's 31C3 In Germany and was delivered by a professor from the University of Portsmouth -- Dr. Gareth Owen.

His personal site: [https://ghowen.me/other.html](https://ghowen.me/other.html)

And a direct link to the video: [https://www.youtube.com/watch?v=oZdeRmlj8Gw](https://www.youtube.com/watch?v=oZdeRmlj8Gw)

I'd imagine he'll publish a full write-up soon but the talk was only a few weeks ago so il not surprised it's not out yet.

</comment></comment><comment><USER28> How do we know how big a percentage of Tor traffic is child porn? Who logs that traffic?

Also, this is definitely one of the reason I can't see myself using Tor. If I were to be a proxy for something like this :(

</comment><comment><USER29> While the DOJ should, but probably won't, correct it self, and should have gotten it right the first time, Andy Greenburg deserves a significant amount of fault for this misinformation. Both articles use somewhat ambiguous language, and have titles that are unclear.

The most important distinction is between "Dark Web" and "Tor". A reader not intimately familiar with Tor could easily assume that those are used interchangeably.

</comment><comment><USER30> How would it be relevent even if it was? You either accept the fact people are free or you don't. Whatever is your judgement on a specific topic should not matter when talking about tor. Be it child porn, human traficking, banned journalism.

Why would US's judgement against child porn be better than <insert a country>'s judgement on journalism.

</comment><comment><USER31> I've heard it said that the way to win a debate is to show the opposing position ultimately leads to genocide, nuclear war, or child pornography. It's depressing to witness the government's fear momgering reach its nadir.

</comment><comment><USER32> Beware. This is how they shut down Usenet.

</comment><comment><USER33> Who writes these headlines? 80% of the TOR traffic is not-child porn, so only 75% is? Shouldn't the headline mention how much of it is child porn(its close to 1%, from the article).

<comment><USER13> Usually it's an editor, not the author, who picks headlines. Some sites even A/B test their headlines to see which gets more clicks.</comment></comment>


Retina MacBook Pro image-retention test - <AUTHOR> http://www.marco.org/2012/09/18/rmbp-image-retention-test

<comment><USER2> Wow. I left that up for 2 minutes and experienced significant ghosting. I've had my rMBP for about a month and hadn't noticed any retention issues until now. On the upside, its unnoticeable under normal conditions (in my experience, at least), and the ghosting dissipates fairly quickly. I don't regret buying it under the circumstances but this is still an issue I shouldn't have to experience when paying $2k+.</comment>


The Racial Wealth Gap Is About the Upper Classes - <AUTHOR> https://www.peoplespolicyproject.org/2020/06/29/the-racial-wealth-gap-is-about-the-upper-classes/ <comment><USER2> The most underrepresented demographic at tech companies is people who grew up in poverty. If you work at a tech company I challenge you to find a colleague who had significant housing or food insecurity growing up. There are a few, but it's extremely rare.

</comment><comment><USER3> Another link related to racial wealth gap: [https://socialequity.duke.edu/wp- content/uploads/2019/10/wha...](https://socialequity.duke.edu/wp- content/uploads/2019/10/what-we-get-wrong.pdf)</comment>


Android Root App - <AUTHOR> http://kingrootapk.info/ <comment><USER2> Highly suspicious: phone stops being "rooted" without network connection, seems to be constantly transmitting to Chinese IPs.</comment>


Intel Ships (hopefully Stable) Microcode for Skylake, Kaby Lake, Coffee Lake - <AUTHOR> https://arstechnica.com/gadgets/2018/02/intel-ships-hopefully-stable-microcode-for-skylake-kaby-lake-coffee-lake/ <comment><USER2> I'm disappointed that Intel is getting all the attention here.

ARM64 chips like A72 have meltdown/spectre issues too. Chips like the ones the current lineup of ARM Chromebooks. Nobody is backporting Meltdown fixes to kernel before 4.16(?)[1], Google isn't updating Chrome OS kernel from 4.4 for these Rockchip devices, and that's because the closed source Mali GPU drivers only work on a fixed kernel version: 4.4. Furthermore, a kernel update isn't sufficient, there needs to be an update to the firmware too.[2] I suspect this means the chromebook must be opened, and a write protect screw will need to be removed to flash a new read only BIOS.

Intel has 32[3] separate class action lawsuits over this issue. AFAIK, nothing is happening to the companies selling broken hardware, with no fix, or plans to fix.

Very disappointed.

[1] [http://kroah.com/log/blog/2018/01/06/meltdown- status/](http://kroah.com/log/blog/2018/01/06/meltdown-status/)

[2] [https://developer.arm.com/support/security- update](https://developer.arm.com/support/security-update)

[3][https://arstechnica.com/gadgets/2018/02/32-class-action- suit...](https://arstechnica.com/gadgets/2018/02/32-class-action-suits-filed- against-intel-over-spectre-and-meltdown-flaws/)

<comment><USER3> >ARM64 chips like A72 have meltdown/spectre issues too.

meltdown/spectre are two different exploits (as much as intel likes to group the two together distribute blame). meltdown only affects intel.

<comment><USER2> You are wrong. See [2] above. Variant 3a is meltdown. A proof of concept is here,

[https://github.com/lgeek/spec_poc_arm](https://github.com/lgeek/spec_poc_arm)

I've tried it personally. It is vulnerable.

</comment></comment></comment><comment><USER4> Here's the full PDF from Intel, showing the status of microcode updates for what looks like CPUs going back to what looks like the first 64-bit Core CPUs -- [https://newsroom.intel.com/wp- content/uploads/sites/11/2018/...](https://newsroom.intel.com/wp- content/uploads/sites/11/2018/02/microcode-update-guidance.pdf)

(Disclaimer: I work for Intel, but not on anything related to this and have no knowledge on the topic outside of this PDF)

</comment><comment><USER5> Intel ships, but only to vendors, while they could ship those damn microcodes directly on their website. We now have to wait for vendors to put those microcodes in their BIOS and release them...

<comment><USER4> They release a microcode package for Linux. The kernel will load it from an initramfs, so no need to flash your BIOS. First lines in my dmesg are:

       [    0.000000] microcode: microcode updated early to revision 0xc2, date = 2017-11-16
       [    0.000000] Linux version 4.14.14+ (mattst88@p50-ethernet) (gcc version 6.4.0 (Gentoo 6.4.0-r1 p1.3)) #19 SMP Sun Feb 4 00:20:02 PST 2018

<comment><USER5> As you can see, your update is outdated (from the 20171117 bundle, pre- Spectre).

</comment></comment></comment><comment><USER6> This might be a silly questions, but it's not addressed by the article, I don't know the answer, and I suspect I'm not the only one: Is the microcode update likely to help reverse performance degradations that resulted from kernel-level remediations?

<comment><USER7> No, it adds new branch history controls that let you make things even slower.

</comment></comment><comment><USER8> What about Broadwell-E chips?</comment>