Be Careful when Speaking to Federal Agents - 18 U.S.C. Section 1001 - <AUTHOR> http://library.findlaw.com/2004/May/11/147945.html <comment><USER2> The most important paragraph if you're not interested in reading the whole thing:

Is there an intelligent alternative to lying or telling the truth that we have not yet examined? Yes. In our hypothetical interview, you can politely decline to be interviewed by the FBI agent. Tell the agent that you have an attorney and that "my attorney will be in contact with you." If the agent persists, say that you will not discuss anything without first consulting counsel. Ask for the agent's card, to give to your attorney. If you have not yet hired a lawyer, tell the agent that "I want to consult a lawyer first" or that "an attorney will be in touch with you." The absolutely essential thing to keep in mind is to say nothing of substance about the matter under investigation. It is preferable to do this by politely declining to be interviewed in the absence of counsel. If the agent asks "why do you need an attorney?" or "what do you have to hide?" do not take his bait and directly respond to such questions. (Do not even say that you have nothing to hide.) Simply state that you will not discuss the matter at all without first consulting counsel and that counsel will be in touch with him. If the agent asks for a commitment from you to speak with him after you have consulted or retained counsel, do not oblige him. Just respond that you will consult with your attorney (or "an" attorney) and that the attorney will be in touch. And by all means do not get bullied or panicked into making up a phony reason for refusing to talk. You are not obliged to explain your decision to anyone.

<comment><USER3> But also note: Part of why Bernie Madoff lasted so long was that he arrived for an SEC investigation without a lawyer. Everyone in the room thought he had nothing to hide, so they didn't pursue him.

Whether we want to admit it or not: It's ingrained that you are inviting an investigator to hassle you further by invoking a right to counsel. (For the record: I think that sucks too.)

<comment> Anti-Ratfish The Mandoff saga reflected more on investigators abilities than on Mandoff's in my opinion. The SEC having botched 6 investigations of Mandoff so badly that even Mandoff couldn't understand it. [http://www.nytimes.com/2009/10/31/business/31sec.html?pagewa...](http://www.nytimes.com/2009/10/31/business/31sec.html?pagewanted=all)

<comment><USER3> > The Mandoff saga reflected more on investigators abilities than on Mandoff's > in my opinion.

That is exactly the point. Nobody shows up with a lawyer because they want transparency above and beyond the call of duty.

Investigators will take the need for a lawyer as having something to hide. Arriving without a lawyer says the opposite.

But apparently several posters above don't believe so.

<comment><USER4> I think regardless of what investigators think if you bring a lawyer, you have a much better chance of avoiding incriminating yourself (even if you don't believe you've done anything wrong!) if you bring one.

If you _have_ done something wrong (again, whether you know it or not), you'll likely have a better outcome with a lawyer present from the start that without.

But if you actually haven't done anything wrong, the lawyer can still help you avoid accidentally telling a "lie" or getting yourself into a situation you don't know how to handle. Even if the investigators believe you're hiding something just because you lawyered up, if you genuinely did nothing wrong, there's not much they can do... aside from making up evidence and framing you, or believing unreliable witnesses telling lies about you... which could happen in any case.

The bottom line (as stated in the article) is that you are _not_ qualified to know whether or not you have or have not truly done anything illegal. A lawyer will be much better able to help you make that determination and guide your interaction with the authorities for your benefit.

</comment></comment></comment></comment></comment><comment><USER5> Since you have nothing to hide, is it safe to talk? There can still be real danger in speaking to a government agent in these circumstances. To begin with, _you are not qualified to know whether you are innocent of wrongdoing under federal criminal law_.

 _Critical system failure._ There should be red lights blinking and klaxons wailing.

<comment><USER6> > Since you have nothing to hide, is it safe to talk?

Since you typically have nothing to gain by talking to law enforcement, why would you? It's all downside.

<comment><USER7> The problem is if _nobody_ talks to law enforcement, it's going to be very difficult for society to function properly.

<comment><USER8> Tell them: "If you really feel that way, you can always write your local congressman to repeal 18 USC Section 1001. Until that law is removed, I really do not have a choice."

</comment></comment></comment></comment><comment><USER9> This advice also applies to any situation involving law enforcement officers, not just federal agents.

Remember, "Don't Talk to Cops": <http://www.youtube.com/watch?v=i8z7NC5sgik>

<comment><USER10> So let's say a kid goes missing. The cops come around the area she was last seen asking people if they saw her. They are trying to narrow down where and when she disappeared.

Everyone else is cooperative, but I'm not.

I've now drawn attention to myself and am probably going to be in for a lot of scrutiny, and at some risk for getting into trouble even if I had nothing to do with the girl's disappearance.

<comment><USER11> >if I had nothing to do with the girl's disappearance.

care to elaborate how your talking would help then?

<comment><USER10> Telling them something like "Yes, I saw the girl ride by on her bike this morning while I was getting the mail--I don't know the exact time but I usually go get the mail around 10ish", or "Sorry, Officer, but I was indoors most of the day and don't recall seeing anyone go by" or similar things helps me because it makes me fit into the herd (the rest of the neighborhood).

Being the only person who won't make such a simple statement is practically shouting out "INVESTIGATE ME! I SHOULD BE A MAIN SUSPECT!". At the very least that will lead to considerable hassle and expense.

<comment><USER12> Again, with this scenario you don't realize they have a security video of her a mile away at 10ish. You actually saw a different girl, but since you testified you saw her at 10 at a certain location and they have proof she wasn't there, that proves you are lying and have something to hide. Clearly you are the killer who has inserted himself into the investigation with the goal of misleading them.

<comment><USER13> What do you mean "again"? That's _your_ scenario and it and even its variations are rare. In the likely scenario, you stand out like a sore thumb every single time.

Whenever this comes up on HN, I find the pattern of comments to be a little baffling, in that very few people want to acknowledge that there are significant downsides to this.

One that isn't mentioned is that, frankly, I don't trust cops nearly as much as you'all seem to. I've been in dodgy situations with cops. I've been pulled over by cops on a dark, out of the way road, and it made me nervous. There is zero chance I'm not cooperating with him as much as I can under those circumstances.

<comment><USER14> I believe that would be a good case for driving the normal speed until you get to a well lit area. If you want, get out your phone and inform the police of your intent.

I would never pull over on a "dark, out of the way road".

<comment><USER15> That could get you arrested: <http://www.insideedition.com/news.aspx?storyId=371>

<comment><USER14> Might be why I've heard the advice of informing 911 of the situation. They would tell the police officer, and everything would probably be ok.

> Mary Ann Viverette, the President of the International Association of Cheifs > of Police [...] but she also thinks Karen was smart to follow her instincts > in that situation.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> The most rational strategy for a US citizen is to treat an officer like the worst enemy, a sleazebag who will go out of their way to fuck said citizen over? There is something deeply wrong with this country.

<comment><USER17> What reason is there to assume any differently?

For that matter, what advantage is there for _you_ to assume any differently? (tip: there is none.)

<comment><USER18> That's his point. In a well run society, this would not be the case.

<comment><USER17> It doesn't matter how fucked up or well run the society is. So long as the justice system is implemented anything like it currently is this will be the case.

<comment><USER19> Oddly enough I was thinking about this very thing today. IN a society, laws are established to invoke precision, but people tend to operate on generalities. For example, speed limits on roads have to be a precise number so that there is an established standard, and in general a cop won't pull you over for doing 37 mph in a 35 zone. However they technically can throw the book at you if they want due to the precision of the law.

I don't know how this can be fixed though. At the moment we have to rely on judges to save us from the precision of the law, and we all know that judges can be just as corrupt/resentful/bored/petty as the rest of us.

<comment><USER18> I think that is not true in general. Consider, for example, the charge of reckless driving.

I think (although have no data) that there are probably more laws requiring human judgment than are based on strictly numerical criteria. Off the top of my head, the various degrees of murder, perjury, hate crimes, divorce settlements, and probate court. These all may have very specific criteria to meet them, but there is no way an algorithm could determine innocence or guilt.

The only numerical laws I can think of are speed limits and the lines between grand theft / theft.

</comment></comment></comment></comment></comment></comment><comment><USER20> what bothers me the most about these kind of articles is the underlying assumption that I can find a good criminal lawyer when the need arises.

I'm having enough trouble finding good engineers, and that is something that I am qualified to do, as well as able to spend several months on, under very little pressure.

I have very little experience with lawyers, but at least for corporate lawyers, my impression is that the average lawyer doesn't know everything about their field, just like the average programmer doesn't know everything about _their_ field. I wonder how many of these pitfalls are something that an average lawyer wouldn't know to avoid.

<comment><USER12> Here's the solution. You need at least one good lawyer in your life that you trust. You must have an attorney that has set up your investments, your estate, perhaps a family attorney that helped your parents. A competent, honest attorney. These are hard to find so like with a good car mechanic when you find one you hold on to them and treat them well.

Now when you need a specialty attorney at short notice because you've been arrested for murder or are being sued for patent infringement you ask your trusted attorney for a recommendation. The recommendation will go to a good attorney and not the fly by night shyster that advertises at 2AM on the local TV station. This attorney may be extremely expensive of course, but this is how I have found specialty lawyers at short notice. It is critical you have a trusted attorney that you have a relationship with though, otherwise you risk ending up flipping through the phone book at the jail some day.

<comment><USER21> How would I find such a lawyer? So far, the closest I've ever come to needing or wanting an attorney is when I bought my house. At this moment, the only outstanding legal issue I can think of is that I need a will drawn up. Is that sufficient for approaching a lawyer and "seeing how it goes?"

<comment><USER12> Yes, that's a good start, if in most US states you'll want a living trust set up in addition to a will which avoids the legal costs of probate court for your heirs. Last time I changed towns I went through three lawyers to talk about setting up a living trust in the new state. The first three had serious issues. The fourth didn't and is now my basic attorney. I think batting 0.25 isn't bad all things considered, it really is like looking for a good contractor or mechanic, most of whom are either not competent or are dishonest. But there are always competent honest people out there if you can find them. Competent, honest and cheap you can't get. You'll have to pick 2. Once you have a professional you know you can trust, stick with them.

It's not possible to just pick a good one randomly the first time yourself except when you are lucky. However, it's not any more difficult than getting a good mechanic, which is why I keep using that analogy.

I should mention that when in a new town do not trust recommendations made by others who are not professionals who work in the system as peers. Others will recommend their friends or relatives, or someone that helped someone they know in a bind once. This is very different from the high respect of an honorable peer, which is why you want a good attorney to be recommending the specialty lawyer and not your coworker, pastor, or waitress.

Consider the $800-$1500 you'll spend on a routine living trust a down payment on a good lawyer.

</comment></comment></comment></comment><comment><USER22> _For example, if you lie to your employer on your time and attendance records and, unbeknownst to you, he submits your records, along with those of other employees, to the federal government pursuant to some regulatory duty, you could be criminally liable._

Is there anything in the law that makes the "pursuant to some regulatory duty" relevant here? For example, if you wrote something on Wikipedia that you knew was inaccurate, and years later a federal official read it and found it somehow relevant to his job, would you theoretically be breaking this law?

<comment><USER12> IANALOAJ, but yes, technically that would be a crime in those circumstances. It seems unlikely you'd be prosecuted of course but who can say?

</comment></comment><comment><USER23> When members of congress lie when speaking to other members of congress, why aren't they held to this law?

<comment><USER24> The government, and its agents, are exempt from most laws.

<comment><USER25> How so? I can't think of where that would hold true, aside from certain liability issues and other circumstances where it would be impractical or contrary to the public interest.

<comment><USER26> Because the government is sovereign entity and can only be sued if it allowed itself to be sued. In fact it is exactly the opposite, the government allows itself to be sued in some tort cases (the liability you mention), in some cases involving IP, and even there you don't get a trial by jury -- a federal judge will decide if the federal govt. is guilty or not (yeah I know...).

<comment><USER25> Right but we're not talking about lawsuits. We're talking about criminal law and government agents being bound by laws.

</comment></comment></comment></comment></comment><comment><USER27> It saddens me that the best advice for so many situations is "Get a lawyer". Besides the fact that they are expensive I find it frustrating that society has become that adversarial.

<comment><USER28> No, it's not society that has become adversarial, it is the vague and far- reaching laws.

</comment></comment><comment><USER29> Tangentially related - [http://www.nytimes.com/2011/03/26/business/26nocera.html?pag...](http://www.nytimes.com/2011/03/26/business/26nocera.html?pagewanted=all)

 _In March 2009, still unsatisfied, Mr. Nordlander persuaded his superiors to send an attractive female undercover agent, Ellen Burrows, to meet Mr. Engle and see if she could get him to say something incriminating. In the course of several flirtatious encounters, she asked him about his investments.

After acknowledging that he had been speculating in real estate during the bubble to help support his running, he said, according to Mr. Nordlander's grand jury testimony, "I had a couple of good liar loans out there, you know, which my mortgage broker didn't mind writing down, you know, that I was making four hundred thousand grand a year when he knew I wasn't."

Mr. Engle added, "Everybody was doing it because it was simply the way it was done. That doesn't make me proud of the fact that I am at least a small part of the problem."

Unbeknownst to Mr. Engle, Ms. Burrows was wearing a wire._

</comment><comment><USER30> Reminds me of the awesome lecture "Don't talk to the police" by Prof. James Duane (J.D., Harvard Law):

<http://video.google.com/videoplay?docid=-4097602514885833865>

</comment><comment><USER31> I am so glad this article is out and I read it. It may be extreme but as someone who has witnesses this type of thing go down, I live with the knowledge that we are all one false accusation away from complete ruin. EVERYTHING can be made to look malicious and calculated, and we should all, in this context, live in fear of the government. Stay out of their crosshairs and keep your attorney phone number close by.

</comment><comment><USER13> This is an interesting and useful perspective, and it's not the first time it's come up on HN, but it's unfortunate that it doesn't draw any thoughtful criticism.

This advice is best when one is implicated or thinks there's any chance they'd be implicated...but then anyone with the slightest awareness of the legal system learns about this at a pretty young age. This particular advice gets its sensationalism and counterintuitiveness by claiming that it's a universal rule. As a universal rule, it has its downsides.

One downside is that, if everyone does this, we make it far harder for law enforcement to do worthwhile investigations. Programmers hate when roadblocks prevent us from iterating quickly during development. Understand, other occupations also suffer from the same crunch on their time that we do and, as a community that's all in this together, we benefit from their work.

Another downside is promoting an adversarial role between law enforcement and its citizenry. This is an intangible, but I think its costs are real.

Also, you'd better be very confident that the cop(s) will simply respect your rights under the law. I know of situations where that has not been the case. I've seen videos where it wasn't the case. We've all read stories where it wasn't the case.

It's easy to fantasize stories about you being wrongfully singled out or, heaven forbid, convicted. We've also all read stories about that. Just like everything in life, then, it's a cost/benefits analysis. But don't pretend that one choice is all benefits and no costs.

I think the speed of modern news dissemination is warping our risk assessment software. Things that you'd only hear of rarely are reported several times a day now, because there's 6 billion people having bad things happen to them, the news only cares about those bad things, and our attention for those bad things is the same size as ever. The bad things per attention minute is rising all the time. Partly because of this, and partly because we are the way we are, there's a penchant by some in my geeky, libertarian community to withdraw as citizens, and overestimate downside risk. Yes, you expose yourself to risk by rescuing that drowning man; yes, you expose yourself to risk by finding that lost girl's mom; yes, you expose yourself to risk by cooperating with authorities. And, you know what, I think it should be worth it to you.

As a side note, attorneys are very familiar with the system and feel confident about fighting it head on, and many attorneys are willing to lead a high stress, confrontational life style. One should bear that in mind when taking advice about how to lead one's life.

<comment><USER32> > _Another downside is promoting an adversarial role between law enforcement > and its citizenry. This is an intangible, but I think its costs are real._

This is caused by law enforcement/state prosecutors taking an adversarial role against citizens, not citizens responding in kind.

It's like the classical prisoner's dilemma. Yes, it would be better for all involved if everyone chose to co-operate. But when one side persistently takes the adversarial approach, it would be stupid for the other side not to do the same.

> _As a side note, attorneys are very familiar with the system and feel > confident about fighting it head on, and many attorneys are willing to lead > a high stress, confrontational life style._

This is, in fact, why you should always talk to an attorney when it comes to dealing with law enforcement.

</comment></comment><comment><USER33> There's a new book out about the complexity of American law. It's titled "Three Felonies A Day: How the Feds Target the Innocent" by Harvey Silverglate

[http://www.amazon.com/Three-Felonies-Day-Target- Innocent/dp/...](http://www.amazon.com/Three-Felonies-Day-Target- Innocent/dp/1594035229)

</comment><comment><USER34> This is an unjust law, period.

<comment><USER35> This law is broader than I'd prefer but I don't see how it's clearly unjust. Do you feel the same way about perjury? If not, what's the dividing line between the two?

<comment><USER36> Perjury requires you to be giving testimony under oath. This law covers any and all conversations however casual.

Furthermore perjury requires the act to be willful and the item under question to be of material importance to an investigation. This law requires only that the statement be known by the speaker to be incorrect and however trivial.

</comment></comment></comment><comment><USER37> Wait, so let's say I'm at the post office buying stamps, and I hand the cashier a $20, and she says, "Don't you have anything smaller?" and I say no, even though I do, because I want the change.

Could I be convicted under this law?

<comment><USER38> If the cashier is a federal agent.

<comment><USER37> I'm pretty sure all USPS employees are.

<comment><USER38> I thought USPS is a "private" company, just heavily regulated.

Edit: Never mind. It has a complicate ownership, as a US government-owned corporation. <http://en.wikipedia.org/wiki/United_States_Postal_Service>

</comment></comment></comment></comment><comment><USER39> The terrible point in the complete article is that basically, you need first to assume that the authorities will screw you and not help you.

For me, the "todos in this case" are just a cure for a dead man, because if you cannot trust the authorities anymore the basic assumptions of a working judiciary system are broken.

</comment><comment><USER8> Related: overcriminalization. Looks like this story relates to the same statute:

<http://www.economist.com/node/16636027>

</comment><comment><USER40> What's the situation in the UK on this whole Dont Talk to Cops thing? Does anyone know of any equivalent legal advice?

</comment><comment> buff-a Does this apply to Congresspersons?

<comment><USER8> Does this apply to federal agents? In other words, if an officer says something false in a statement that is later read by another officer can they be charged?

</comment></comment><comment><USER41> Does anyone know of a similar quality article for dealing with UK law enforcement?

</comment><comment><USER42> Just _reading_ this makes me nervous.

</comment><comment><USER43> I assume that most people who post here are smarter than the average citizen or at least more informed. The real "spaghetti code" problem here is that this obscure statute can easily be violated in advance of being told your rights. And you only get ready your rights a.k.a. mirandized when you're bordering on already in trouble with the law. Coupled with the fact that this is a federal statute it only applies to federal agents not city or state. And since you can lie to city or state officials up until you are under oath (which most people know) you might be inclined to believe he can do it to federal agent until it's too late. Which means their first encounter with a federal agent will be a crash course in the finer points of the law. One which they will unlikely be able to walk away from. I believe the spirit of v. Miranda is being violated the statute, I believe the beginning of any contacts with the law enforcement official should begin with the reading of your rights which should now include information on statute 18 sec 1001.

</comment><comment><USER44> As interesting as this article may be, it does not belong on HN.

<comment><USER45> People I know who have run internet startups have had contact with federal agents on various occasions.

EDIT. This response is getting so many upvotes I'm going to clarify it a bit, particularly for people who may be reading this from other countries:

Yes, you can start and run a business in America without ever having direct interaction with the US Federal Government, other than mailing off your taxes. It's not like every business one day gets a visit from the KGB and they tell you to do things a certain way (or else).

Nevertheless, if you are for example an ISP or provide messaging, as you grow big enough it's probably a matter of time before you'll end up getting a subscriber who's being investigated. You may have a former employee that goes on to apply for some sort of special security clearance and they follow up on his background (or you go out of your way to hire a talented hacker with a mysterious background). You may simply meet such agents due to ordinary shared interests, like say at a trade show or a conference. Of course, you could also meet them when they are also actually investigating something with the aim of prosecuting people.

I don't know which of these situations fall under the law described in the article, possibly all of them do.

<comment><USER46> _> if you are for example an ISP or provide messaging, as you grow big enough it's probably a matter of time before you'll end up getting a subscriber who's being investigated_

That is not what Hacker News is for. If your company is that big, you should have counsel on retainer, and they should be advising you of the proper behavior in the face of potential federal investigation. Moreover, it's our job as American citizens to be aware of our legal exposure and to know the proper way to proceed. It's a shame that this is not taught in our high school Government courses.

It is not the role of Hacker News to educate us on these issues. There are other sites for that. You can tell by the quality of the comment thread that it's not something that appeals to "our inner hacker." An article is not HN material simply by appealing to some (or even a majority) of the members here; it must satisfy other criteria, and this one does not.</comment></comment></comment>


Japan's 'Disaster Parks' - <AUTHOR> https://reasonstobecheerful.world/japans-disaster-parks-help-explain-its-coronavirus-response/ <comment><USER2> Here's a tweet with a photo of a stove bench [https://twitter.com/tokyo_gov/status/841438900824473600](https://twitter.com/tokyo_gov/status/841438900824473600)

And this apparently is an example of a manhole toilet design, [https://www.pixtastock.com/photo/27778801](https://www.pixtastock.com/photo/27778801)

</comment><comment><USER3> > _What you'd never notice about Hikarigaoka Park, however, is that 36 of its > benches conceal stoves that can be used to cook food, boil water or provide > heat. The park's 52 manhole lids can be removed to reveal emergency toilets. > Its solar-powered lamp posts have electrical outlets for charging phones in > a blackout. There are water tanks for fighting fires, and bunkers stocked > with days' worth of non-perishable food._

Can't help but think in the US the homeless would set up shop quickly and defeat the purpose.

How do the Japanese keep things so... orderly?

<comment><USER4> Social shaming 'anti-social' behaviors from an early age such as not cleaning up after yourself or taking care of yourself combined with incredible emphasis placed on the importance of maintaining good standing in your social group and less emphasis placed on individualism? Confucianism?

Look at how Japan or Korea deal with fat-shaming (or in a non-western culture - you'd probably just call it motivating people you care about to take care of themselves). Watch Terrace House to see a snapshot / slice of regular Japanese life and you'll see how often people who have only known each other for a couple of months will stage group interventions to tell someone the way they are living in unacceptable, that they need to work harder or find a dream to chase or clean up after themselves better. It's part of the culture to feel shame for letting the group down and to shame others for letting the group down and all of that is taught culturally from the day you're born.

Western individualism has its benefits but also motivates people to feel the freedom to act out negatively as well and to feel fine being ostracized.

<comment> dan-robertson I don't buy a lot of arguments about a culture that's somehow magically much more orderly. Obviously there are cultural differences but I'm not sure they're the main reason for the differences between places one sees. I think bigger reasons tend to be structural (and those structural differences often seem to come from essentially random differences in history)

The reason the streets are clean is that there is an army of street cleaners picking up litter. If one ventures away from regularly cleaned areas, one will see litter along the sides of main roads, much like America.

I don't know about the homeless situation. Perhaps there are fewer homeless people. Perhaps they are forced out of public spaces by the police. Perhaps they sleep in 24h McDonald's instead of outside (perhaps it is much too cold in winter).

Similarly I hope people don't look at the difference in healthcare between the uS and Canada and say that it's because Canadians somehow have some magically nicer culture.

I feel that there tend to be larger structural issues between countries that are more significant than a vague argument about "eastern collectivism and western individualism." For one thing, such an argument lumps china, North Korea, South Korea, and japan into the same bucket when the countries are clearly quite different. It also lumps together the USA, Canada and European countries together when they are also quite different between themselves.

One big difference one sees between the US and Japan is the apparent prevalence of petty crime. Statistics may be different because the likelihood of crimes being reported are quite different but it is common in Japan to leave a phone/handbag unattended at a cafe table whereas this would be very unlikely to happen in America. On the other hand it is socially accepted in Sweden to leave babies unattended in proms outside shops whereas this would be unthinkable and likely classed as negligence in America

<comment><USER5> > The reason the streets are clean is that there is an army of street cleaners > picking up litter. If one ventures away from regularly cleaned areas, one > will see litter along the sides of main roads, much like America.

Curious if you have you been to Japan and spent time in residential areas. My experience differs significantly—specifically this not simply being due to "an army of street cleaners." Even in America, when hanging out with Japanese ex- pats—whether grilling at parks, going camping, or simply hosting a kids for a play-date at home—there's a focus on "cleaning" that goes beyond whatever I was taught as a kid to pick up after myself, or even the Boy Scout "leave no trace"—its something deeper.

Also worth noting is how difficult it is to find a trash can in Tokyo.

</comment></comment></comment></comment><comment><USER6> Creative ideas in Japan for natural disaster preparedness

However the article has little to none about coronavirus as its titled. Glad HN posted revised the title here.

I think the high density, many residential buildings aspect in Japan lend to creative public space preparedness to deal with disasters.</comment>


Meet as many people as possible (you're already paying for it) - <AUTHOR> https://medium.com/life-tips/be32b33d04c9

<comment><USER2> It is so annoying to meet random people that I just don't do it often. Because you have to put a lot of effort into the conversation usually.

<comment><AUTHOR> I agree completely random is not good. I meant random in the sense that there is not a set agenda and you are meeting them for the first time. But yes, there has to be some context. In these meetings I have done 100% of the people have been in tech.</comment></comment>


JetBrains ReSharper hires Clippy, reaches unprecedented annoyance level - <AUTHOR> http://blog.jetbrains.com/dotnet/2014/04/01/clippy-for-resharper/

<comment><USER2> Can't wait to use this! :D</comment>


Maciej Ceglowski: Fan is a Tool-Using Animal [video] - <AUTHOR> http://archive.dconstruct.org/2013/fananimal

<comment><USER2> It's sickening how talented Maciej is. Have you gotten up on stage a bunch and delivered a talk? It's not easy. Notice how all the jokes work, even the throwaways.

It's sickening. Sickening! I am sickened!

<comment><AUTHOR> It could just as well have been a TED talk, he really killed it.

</comment></comment><comment><AUTHOR> Some moderator has evidently taken it upon himself to change the title and append "[video]" to it, and I would very much love to know where the fabled video is on the submitted page, because I haven't managed to spot it.</comment>


It looks like the state of California is bailing out Tesla - <AUTHOR> http://www.businessinsider.com/tesla-stock-price-california-state-government-bailing-out-2017-7 <comment><USER2> Here's the evidence behind the claim that California's EV subsidy is a Tesla bailout.

>In California, the largest EV market in the US, 2.7% of new vehicles sold in the first quarter were EVs, up from 0.4% in 2012, according to the California New Dealers Association. California is Tesla's largest market. Something big needs to be done to help the Bay Area company, which has lost money every single year of its ten years of existence.

<comment><USER3> There's also:

> And for instance, a $100,000 Tesla might be deemed to have the same features > as a $65,000 gas-powered car. The rebate would cover the difference, minus > the federal rebate (so $27,500). Because rebates for Teslas will soon be > gone, the program would cover the entire difference – $35,000. This is where > Senator Vidak got his "$30,000 to $40,000."

Seems Californians will be footing a significant chunk of all Tesla sales once the standard Federal $7,500 rebate expires on Tesla vehicles.

This does seem to largely be targeting Tesla's since, according to the article, are the only US EV maker nearing the 200,000 vehicle sales limit for Federal subsidies.

<comment><USER4> This doesn't make sense. Couldn't the car company just arbitrarily raise the price? Why sell it for 100k? Why not 200k or whatever. The cost to the consumer is the same, the state just pays you more. Doesn't seem well thought out.

</comment></comment></comment><comment><AUTHOR> Note that most of the Californians (and people in other states) are also subsidizing electric cars by not collecting the gasoline tax which is (at least partially) used to fix roads.

<comment><USER5> What really makes me angry is that a bunch of places have lower rate tiers for EV charging...

[http://austinenergy.com/wps/wcm/connect/2ec866e7-4556-407b-b...](http://austinenergy.com/wps/wcm/connect/2ec866e7-4556-407b-baed-207b227c9441/ResidentialPilotPrograms.pdf?MOD=AJPERES)

10Kwh for $30 vs >$100 if you were to just add it to your electric bill.

Frequently now, I've considered getting an electric car on lease, and then buying a big inverter and running my house off the car parked in the garage... If it weren't for the price of the car it would be an excellent way to save a couple hundred dollars a month in electric service.

<comment><USER6> why does this make you angry? I think these are policies that are designed to encourage electric vehicle usage. Which if you care about air quality (which you should since air pollution kills people, albeit in a quiet way) then presumably people using an electric vehicle in lieu of an internal combustion engine driven vehicle is a good thing? I doubt at this moment the lost revenue is significant due to low market share. Maybe when electric vehicles are a large percentage of cars on the road we will have to reconsider tax structures but we just aren't there yet I think.

<comment><USER5> The air quality excuse is _VERY_ dependent on where you live. On average ([https://www.eia.gov/tools/faqs/faq.php?id=427&t=3](https://www.eia.gov/tools/faqs/faq.php?id=427&t=3)) ~30% of the power in the US is derived from coal, another ~30% is natural gas. So basically for cars your just relocating where the exhaust happens. And in the case of coal the byproducts are massively more harmful and long lasting compared with the byproducts from gasoline (which is really quite clean at this point). So you then have to consider the efficiency of the generation/transmission/charging/driving which isn't so much better that electric cars are a mirracle cure for global warming/etc. Particularly in the case of tesla, which has been repeatedly shown that in most places in the US actually polite more than a modern econobox mostly due to being such a heavy car.

So, beyond that, I'm sort of irritated by tax subsidies, because they are really no different than paying someone cash because someone else has to makeup the shortfall, be it through worse education systems, or simply paying more taxes. (I'm also in the camp that believes toll roads are just a convenient way to raise taxes while simultaneously claiming to cut them).

But back to electricity generation, electric cars are _NOT_ an insignificant load, and further subsidizing them to the tun of tens of thousands of dollars in electric charges (assuming a ten year lifespan for the car) on the backs of the common ratepayers, is about as regressive a tax as is possible. The same is true of the loss in gas taxes. People who can afford $100k teslas (teslas are well over 50% of the electric car market in the US given rough estimates, the leaf being the other significant player with ~30k cars a year) don't need further subsidies on the backs of people who on average are earning less than $50k a year.

So, yes the discounted rates are the final tipping point, $7.5k a year in tax incentives + 1-3x that much again over the life of the car paid for generally by those that can least afford is is the worse kind of policy.

<comment><USER7> So to address just one of your points: you're going to judge the environmental value of an electric car by the mix of fuels today, even though the car lasts 20+ years?

Electric cars are also extremely useful in that you can choose to charge them at times when wind and solar are producing "too much" power.

<comment><USER5> "Electric cars are also extremely useful in that you can choose to charge them at times when wind and solar are producing "too much" power."

Which sounds great, but is 100% BS in most cases. That Austin energy EV charging system I linked doesn't turn off the charger when the wind isn't blowing. Instead its strictly time based, so while much of the information is public ([http://www.ercot.com/mktinfo](http://www.ercot.com/mktinfo)) it is pretty much impossible to say "There is spare wind capacity feeding my house, lets charge the car". I would be interested if anyone actually has such a system, and further what would such a system do when there isn't sufficient wind overcapacity for days? Then oddly enough, I see a bunch of tesla's charging on the chargers at work, which of course is during peak power usage times (aka when all the NG peak plants are running).

<comment><USER7> Sorry that you are blowing off future benefits based on today's actions.

<comment><USER5> What future benefit is gained by having people driving around 5,441+ lb electric vehicles given that we will likely (given the current political climate) still be getting more than 50% of our electric (maybe more) from carbon emitting sources in 20 years?

No, you want to start solving this problem by attacking it directly. The problem is too much CO2 emissions, so start taxing CO2 emissions from _ALL_ sources, don't try to pick winners (electric cars) and subsidize them, when the next big breakthrough might be a petrol engine that can catalyze out the carbon, or hydrogen fuel cells. Neither of those choices seems likely, but hey... Much like I think the "environmentalists" are as much at fault for climate change by fear mongering nukes in order to wish for renewable sources for the past 40 years as the deniers, I think the electric car people with their "zero emissions" bumper stickers are preaching a lie.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> All this shit talking on the people who can afford to buy 6 figure cars fails to take into account the reality that these terrible people who can afford these cars are subsidizing the development of mass market electric vehicles by taking a big risk on very expensive and experimental cars. Beyond that I don't think that California leading from the front by offering financial support for a budding technology that will make a huge difference in pollution is a bad thing. Plenty of states offer absurd amounts of financial support for far less noble enterprises.

</comment><comment><USER9> This seems like a smart move on California's part, given it is deeply committed to slashing carbon emissions, and if the Tesla 3 succeeds, the state will become home to a major auto manufacturer.

</comment><comment><USER10> I think it's much better to tax the cars you don't want rather than to subsidize the cars you do want. Why? Because the state is not doing well financially, and they are not in the place to drop 3 billion on subsidies.

I think it also makes more sense from a moral standpoint. If using a gasoline powered car contributes more to the environment's woes, paying the tax is giving back to society in return for having made it a slightly worse place via pollution. It is also better to directly tax the undesirable car that way the tax is directly associated with the undesirable car, as opposed to a general income tax. This may be less politically feasible for that reason though.

<comment><USER11> let's compare apples to apples

[http://archive.is/DCWp1](http://archive.is/DCWp1)

are we sure Tesla's are better for the env? Don't get me wrong, I want an alternative to gas. But let's make fair comparisons.

<comment><USER12> Subsidize toys for the rich ? With a good story about why it's saving the planet ?

This is like claiming parks in big cities are good for the environment. Well they are. For about 2 blocks or so. And especially good for the house values around there. Which is of course the real reason they're built.

You're acting as if the purpose of environmental policy is to rescue the planet, and there's your mistake. Giving free money to rich people with lots of influence is the only factor in those decisions.

If you check, you'll find that all of Elon Musk's companies after paypal share this characteristic. They are barely working at all, and there's no way in hell they'd work without this free money. So really, this is about transfering your taxes to Elon Musk's company so mostly him, and of course quite a few rich people can get free money and tell a story to themselves about the environment.

</comment></comment></comment><comment><USER13> It would be one thing if the gov said they were gonna subsidize Tesla and cited all the pros. Claiming its an across the board subsidy when it's pretty damn focused on Tesla and only Tesla is slimy.

This is exactly the quality of work I expect in a 1-party state.

<comment><USER14> Counterargument: not Tesla's fault that the other offerings suck in comparison.

Another consideration: if it was GM or Ford that was up against that 200k limit, you think their lobbyists couldn't wrangle a similar deal?</comment></comment>


Unraveling the Enigma of Nintendo's Virtual Boy, 20 Years Later - <AUTHOR> https://www.fastcompany.com/3050016/unraveling-the-enigma-of-nintendos-virtual-boy-20-years-later <comment><USER2> I've been curious about the story of the Virtual Boy for a while -- it's Nintendo's console-that-shall-not-be-named, only brought up occasionally in "history of VR"-esque stories. This was a very good and detailed writeup of the the console's history and the events leading up to release.</comment>


Suggestions for text-based network topology framework - <AUTHOR> Looking for something that:<p>- Is easy to create/maintain (like markdown) - Can be easily understood in text form - Easily versioned (text is) - Mostly concerned with logical topology elements and their interactions - (Optional) Can be updated from network mapping software - (Optional) Can be easily converted to graphics <comment><AUTHOR> This was very helpful: [https://news.ycombinator.com/item?id=21566776](https://news.ycombinator.com/item?id=21566776)

It's about the C4 model for visualizing software architectures: [https://c4model.com/](https://c4model.com/)

Using PlantUML and a set of !include PlantUML "C4" files, this satisfies most of the items on my list: [https://github.com/RicardoNiepel/C4-PlantUML](https://github.com/RicardoNiepel/C4-PlantUML)

Gaps: Have to extend it a bit to support network topologies. No integration (that I see) with network mapping software.</comment>


The Wealthiest Person In Each State - <AUTHOR> http://www.movoto.com/blog/opinions/wealthiest-person-map/ <comment><USER2> Click on them to check their wiki page! most of them are philanthropist!

phi·lan·thro·pist: the desire to promote the welfare of others, expressed especially by the generous donation of money to good causes.

ARE THESE CUNTS ON CRACK!!! WTF ARE THEY SMOKING..I WOULD LIEK SOME!!

The audacity to call yourself that is FUCKING mind-boggling</comment>


Facebook's Like Buttons Will Soon Track Your Web Browsing to Target Ads - <AUTHOR> http://www.technologyreview.com/news/541351/facebooks-like-buttons-will-soon-track-your-web-browsing-to-target-ads/ <comment><AUTHOR> Go here

[https://www.facebook.com/settings?tab=ads&view](https://www.facebook.com/settings?tab=ads&view)

and change "Adverts based on my use of websites and apps" to "No" to opt-out.

<comment><USER2> Of course, this is only a problem is you're not using ad-blocking software.</comment></comment>


Show HN: termwm: A floating WM of terminals inside your terminal - <AUTHOR> https://gitlab.com/jD91mZM2/termwm <comment><AUTHOR> Getting I/O errors uploading the asciinema cast, but here's a preview: [https://streamable.com/4hoqh](https://streamable.com/4hoqh)

<comment><USER2> You have an interesting setup for your desktop environment, care to share some of the details? I see an XFCE icon but I'm not sure if it's only XFCE being used there.

<comment><AUTHOR> I use xmonad but with xfce4-panel. Dotfiles: [https://gitlab.com/jD91mZM2/dotfiles](https://gitlab.com/jD91mZM2/dotfiles)

</comment></comment></comment><comment><USER3> "Make sure to pipe the output to /dev/null when running this program. This is because the redox ransid ibrary keeps spamming stdout..."

Signs of quality software.

<comment><USER4> The readme does make it seem like a super serious project.

</comment></comment><comment> em-bee > If you're seriously considering using this I recommend going to a > psychiatrist. This program is so pointless, I even needed a mouse pointer to > help me out find a point.

the author makes it sound as if this is an elaborate joke of some sort, but if that's the case, someone else has been laughing for almost two decades: [https://github.com/cosmos72/twin/](https://github.com/cosmos72/twin/)

greetings, eMBee.

</comment><comment><USER5> This is fantastic. I'm not installing it.

</comment><comment><USER6> This is cool! I wanted to do something similar a while back, but decided I want out of the term, instead of trying to bring more robust UIs into my term.

My goal was to have an editor, like Vim/Kakoune, use a window manager like tmux to provide more rich GUI features, such as popups and overlays. All of that in an ideally easy to use dev UX, making scripting information plugins intuitive and easy.

As mentioned, in the end I just said I probably want a GUI proper.

Very cool! :)

<comment><USER7> Some DOS textmode IDEs used to have window management like that.

</comment></comment><comment><USER8> This is neat :)

Check out dvtm for a tiling version of this. Some people pair dvtm with dtach to get just the parts of GNU screen that they care about.

</comment><comment><USER9> I want you to know that I love you for doing this.

Thank you, thank you, thank you!

Now I have to go read Frankenstein, so thanks for that as well. :)

[https://archive.org/details/frankensteinorm02shelgoog/page/n...](https://archive.org/details/frankensteinorm02shelgoog/page/n6)

</comment><comment><USER10> The use case is brilliant:

> Use case? If you're seriously considering using this I recommend going to a > psychiatrist. This program is so pointless, I even needed a mouse pointer to > help me out find a point.

<comment><USER11> It is hilarious.

If it has session save/restore, it can compete in the same space as screen/termux/byobu.

<comment><AUTHOR> It doesn't. Would be an interesting thing to add perhaps, but then I'd need to add some kind of daemon I believe. I also don't want to compete with the existing software as there's no winning over them.

</comment></comment></comment><comment><USER12> Ah, reminds me of the old Turbo UI.

A few years back I got RHIDE working again and... Went back to emacs.

</comment><comment><USER13> Sorry for asking something that might be obvious to others, but what is WM?

<comment><USER14> Window Manager, basically a program that manages your windows. (This is more well-known in linux because you can swap to different window managers regardless of distribution, while in Windows and Mac you're forced to have one canonical window manager provided by the OS)

</comment></comment><comment><USER15> That's cool!

Are there other versions of this idea around? Maybe older, more stable and trustworthy solutions?

<comment> em-bee [https://en.wikipedia.org/wiki/Twin_(windowing_system)](https://en.wikipedia.org/wiki/Twin_\(windowing_system\))

<comment><USER15> Searching for it on Youtube brings up videos of a pretty ugly interface. With 80s style text windows.

I like OPs version because it just puts a one pixel border around the window and except everything is black.

<comment> em-bee that's a good point. i agree. but i never used twin, maybe it's configurable.

greetings, eMBee.

</comment></comment></comment></comment><comment><USER16> GitLab should collapse that left menu as default, just saying.

<comment><USER17> It is, at a breakpoint. Seems to be plenty of width at the point at which it expands to me.</comment></comment>


Google will abandon Android - <AUTHOR> http://ceklog.kindel.com/2012/03/31/google-will-abandon-android/

<comment><USER2> I really do not like this writing style. Everything is presented as fact, without any attributions or reasoning or proof. This way I do not know what is an actual fact and what is just speculation and conjecture on part of the writer.

For example while reading the article I thought that Google had actually announced a tablet called play. Then towards the end I started getting suspicious, and did a Google search and seems like there is no such announcement. Play is just a name of a marketplace as far as i can tell.

I still am not sure whether there is an announcement or a rumor of a tablet called Play.

If you want to be taken seriously you should qualify the more drastic assertions you are making. You can use terms like "I believe", or "so and so announced" or "as my analysis below shows", etc. Even the more wimpy "sources say" or "rumor has it" is better than reporting rumors as facts.

Of course it does not seem that the writer is even reporting rumors as facts here. He is reporting wild-ass speculations or even fantasies as facts.

<comment><AUTHOR> OP here.

Totally appreciate feedback on writing style. It's valuable to me.

FWIW, though, the very first sentence of the post links to this WSJ article about Google launching a tablet:

[http://online.wsj.com/article_email/SB1000142405270230340470...](http://online.wsj.com/article_email/SB10001424052702303404704577312043639469540-lMyQjAxMTAyMDIwOTEyNDkyWj.html)

I have a (likely unfounded) bias against writing "I think..." or "I beleive...". I think (!) it comes from being railed against by an English teacher to be less wordy.

<comment><USER3> I was always taught the same thing. Most people use "I think" or "in my opinion" in a way that weakens their persuasive argument (what high school students typically have to write), so forbidding it forces them to write with confidence in their position. It's part of the formality of that type of writing.

In contrast, blogs are much more personal. I think it's ok to say that your statement is your opinion in that context, especially when you're writing a prediction like this.

Personally, I like it as it is. You took a bold stance and made a radical prediction, forcing the reader to think about how your inevitable future contrasts with their own predictions. If only that happened more on the internet.

</comment></comment></comment><comment><USER4> It's an interesting move but not sure how well it will work. The heft of Android adoption was due to marketing and promotion from device manufacturers and carriers blocked out of the new wave Apple/ATT smart phones. That marketing heft is likely move to Win8, leaving Play in a very weak position.

<comment><USER5> Why do you expect anyone to have a significant interest in marketing Windows 8? I can think of at least half a dozen reasons why they would want to studiously avoid it: For one thing, the impetus behind the original Android push has expired, because now most everyone has got both Android and iOS available as options, so there is no need to claim something new as the answer to a competitor who has something you don't. Moreover, Windows is non- exclusive, so even if it was something "new and different" it wouldn't be anything your competitors can't also provide. At the same time, Microsoft's sweetheart deal with Nokia provides a significant disincentive for non-Nokia OEMs to push Windows. In addition to that, adding a third major platform would increase costs for exactly the same reasons that everyone is always complaining about Android fragmentation. And because Windows-on-ARM doesn't run "real Windows" programs, people who bought ARM tablets expecting them to do so will be returning them in droves, creating huge headaches for anyone who sells them in quantity. There is also the problem of Microsoft being a bit of a dangerous character; if other companies allow them to claim a significant foothold in the tablet market, there is no small chance that they will eventually be able to leverage the desktop Windows monopoly into a mobile monopoly, which would leave the OEMs and carriers at Microsoft's mercy going forward.

I mean why do you think nobody is pushing WP7?

</comment></comment><comment><USER6> This post is about branding, only.

<comment><AUTHOR> OP here.

Is it? Yes, the thrust of the article is about GOOG abandoning the Android brand. However, it follows that if GOOG is to focus on Play as the brand for tablets (and phones) they will also further invest in Play exclusive technologies.

Today all new platform features GOOG builds are put into "Android". If they are serious about a new brand they will start building platform features that will NOT go into Android.

<comment><USER7> I know I'm playing devil's advocate here, but perhaps as events play out I'll prove right...

Google won't stop producing Android releases with new Android features for manufacturers.

If they even thought it wasn't worth the effort just to hand it off to manufacturers to destroy, they would be putting their main properties at the mercy of two fierce competitors: Apple and Microsoft.

Android sucks. I'll talk about that in a different blog post.

Nevertheless, compared to nothing at all, Android is awesome for Google, for the casual phone owner (have you noticed that "feature phones" are vanishing?) - and that includes the teen demographic - and awesome for open source.

Android's open source strategy sucks too - note Honeycomb or the lack thereof. But Google is a white knight in shining armor compared to Apple...

<comment><USER8> What do you mean by lack of Honeycomb? It was released with ICS, so not in a timely fashion (Honeycomb seemed like a rush job), but it is certainly available.

<comment><USER7> I know the commits are in the commit log, so yeah, you can dig out Honeycomb if you want...

I'm referring to all the drama when Honeycomb was _shipping_ on tablets but the source wasn't released yet.

</comment></comment></comment></comment></comment><comment><USER9> I dislike the idea of authors submitting their own articles. It could be argued that the point was to produce an interesting debate on the subject on HN, but: 1) there is no news here, only speculations, which are, as hristov said, badly put in a matter-of-fact way 2) the title is misleading to think that the problem is in the platform, not the brand, which is in fact discussed

As far as Android branding is concerned, I would say that the brand is still solid, it seems that the "android phone" idea is becoming widely spread (and the only idea that can parry iPhone, since Nokia is taking a nose dive, and Windows phone is not living up to the expectations), and changing to something new at this point seems like a bad idea. Sure, Google could even push "Google Tracktor" brand, but why waste all the marketing and re-starting, when you could go with "Android certified", or similar term that will be familiar and clearly note the prestige of the new product in some way?

<comment><USER10> It could be argued that it is you who needs to read the HN Guidelines.

If anything, your comment directly contradicts the Guidelines, while the OP's post does not and has clearly garnered significant interest based on its content otherwise it would not have been upvoted to the front page. Here is the relevant Guidelines entry:

"Please don't submit comments complaining that a submission is inappropriate for the site. If you think something is spam or offtopic, flag it by going to its page and clicking on the "flag" link. (Not all users will see this; there is a karma threshold.) If you flag something, please don't also comment that you did."

</comment></comment><comment><USER11> I think this is confusing two issues.

Firstly, no matter how much various techies might desire Android to be similar to the iPhone ecosystem and the way Apple updates it's products, it isn't going to happen because handset manufacturers can't recoup the cost of maintenance in the same way Apple does (via services - the AppStore / iTunes etc).

Secondly, where there is a hint of reality in the article, Google are freaked out by the relative success of Amazon with it's tablet offering vs the piss poor generic Android tablet sales. Amazon and Google are in competition with each other much more than Google is with the handset vendors so I could understand a pure play Google tablet to compete on the basis of it's services vs Amazon.

</comment><comment><USER12> I just picked up an Android phone and one of the first updates changed the Android Market to Google Play, which first of all was very confusing, and second of all, struck me as a desperate rebranding of the App Store at a time when Google (I think) should have been marketing it's existing app store and exerting control over the perversions that carriers were/are inflicting on Android handsets, a Genuine Android certification program or something of that sort.</comment>


How to Search Google for Information That 96% of People Don't Know About - <AUTHOR> https://brightside.me/wonder-curiosities/10-ways-to-search-google-for-information-that-96-of-people-dont-know-about-256760/ <comment><USER2> If you're going to change the title, it should be, "How to leverage the Google search DSL"</comment>


In praise of continuous deployment: The WordPress.com story - <AUTHOR> http://toni.org/2010/05/19/in-praise-of-continuous-deployment-the-wordpress-com-story/

<comment><USER2> I seriously would like more people to explain their experience if they tried this, but unit test and integration tests are no substitute for QA. Especially for a young startup trying to get traction, I seriously can't see how this is beneficial to have possibly a buggy to low quality app with possibly several bad deployments. How do you avoid the problem of continuously putting out small fires, rather than looking at big picture type problems with this continuous deployment cycles ? Am I misunderstanding the process ?

<comment><USER3> Continuous Deployment has been a tremendous boon to us at CollegeJobConnect. We make it work by:

        - Being maniacal about integration tests
        - Manually testing key flows (user registration in particular)
        - Hoptoad exception tracking coupled with push email
        - cap deploy:rollback

When you have production database migrations things get a little trickier. We are still looking for better ways to handle migrations in general, including leveraging systems like MongoDB.

<comment><USER2> are you manually testing, on your production environments ?

<comment><USER3> When we make significant changes to elements that affect certain critical aspects of our site (a very limited number of specific places, like user registration) we sometimes walk through manually just so we can sleep a bit easier. To date, our test coverage has been sound and we haven't caught anything this way. It may be redundant but we like to see it for ourselves just to be sure.

</comment></comment></comment></comment><comment><USER4> They forgot: Optimize for security.

<comment><USER5> I think it's worth pointing out that while I suspect you may have intended that as pure snark, there is a deeper point lying under it. Assuming this continuous deployment is something like "developer picks up bug, hacks out whatever solution works, deploys it five minutes later", then you are punting on any issue that may require a bit more introspection. This most notably includes security, but there's other things that this procedure will fry too, like longterm maintainability and such. Not to mention offloading QA onto your customers, which may work for a free webservice holding nothing of particular value but hardly works for everybody. (And I hope they have good backups.)

With this logic, it's perfectly fair to point out that WordPress's security record is absolute shit (tptacek: "There are unforced errors in Wordpress. Every web application will have a cross-site scripting mistake. It takes a special one to have "anonymous commenter" -> "admin" privilege escalation, or executable style templates." - <http://news.ycombinator.com/item?id=1328583>) and it's fair to conclude that this "We systematically and deliberately fail to check our code before deploying it!" approach to development may be a contributing factor.

Now, nothing stops you from implementing "take bug, code solution, run it through code review and QA, deploy" on a patch-by-patch basis, but I have a hard time imagining making 20 releases a day with that procedure, so I'm assuming that's not what they are doing with some reason.

Basically, what I'm saying here is that hearing WordPress advocate this model is a strong argument against it. If they honestly think it's not costing them anything, or even just a net benefit, then I call their judgment into question. Or perhaps rather, further into question, since I think their security track record was already calling their judgment into question.

<comment><USER6> Not surprisingly, I disagree. First of all, you are lumping WordPress the open source software and WordPress.com the hosted service together. My post is about WordPress.com which uses the continuous deployment model and has a very solid security track record (as good or better than any other large scale web service like Facebook, GMail, etc). Also, our fast deployment model helps to very quickly fix whatever problems there may. Finally, though I can't speak for WordPress.org because it's separate from Automattic, they have developed a very effective model of responding to security issues and auto-notifying and -updating people.

<comment><USER5> "First of all, you are lumping WordPress the open source software and WordPress.com the hosted service together."

Yes I am, and I apologize. I did not realize there was much of a distinction. I would edit away much of my message now if I could.

But...

"Also, our fast deployment model helps to very quickly fix whatever problems there may."

Security problems do not work that way. Rapid deployment does not recover your user database that the hacker got, just as one example. Rapid deployment may close XSS holes, but doesn't undo the damage they did while open. And you don't need rapid deployment to close XSS anyhow, historically lots of people have managed that without rapid deployment. I still see it as potentially beneficial on some fronts but an enormous risk on other fronts I care about a lot.

</comment></comment></comment></comment><comment><USER7> Like many a member here, I am building something. In my case in PHP.

I have lovingly crafted ( wasted ) a system which is still in its infancy to handle a form of automated test driven development and from what I can see so far, the times I break it or discover a bug ( logic bug ) in my code later it is usually due to week tests.

Clearly I am not a large site like wordpress.com, a part of me thinks its the right thing to do. It certainly makes deploying a breeze and gives a little more "confidence" that the system didn't just fall over.

The sad part, at least in the PHP world, there are no libraries with an explanation on how best to use it with your site / application structure.

The database part is the biggest hiccup. My solution is a duplicate database with no data. First it confirms that the "fake db" matches the "real db" and warns if the table structure is different.

Then with my blank "fake db" using functions in my tests to "setup" and "destroy" I purposly build data to test with.

Once my site is operational, I will look to using live data in the "fake db" to simulate with real data. But so far it has been an interesting journey.

Clearly, TDD would become a bigger issue if you have to test sphinx/couchdb/mongodb etc setups but like with all creations its starts with a blank.php. ( in my case )

Not that this covers "Optimise for security".

But my test suite, after the first "test time" the test has been run, will warn if the "library","model", "controller" it is linked to has been altered without the "test" file changing, which at least warns me to the idea that maybe I need to refine my test.

All very padantic, but reading from the side lines of patio11, I can't help but see logic in "automating" things to make your life easier, more efficent and less likely to add human error into the equation.

I leave with what I consider a valid point.

Once upon a time, people looked at the "MVC" approach as time consuming and wasteful. At least from my understanding of watching the web evolve from the earlier days.

</comment><comment><USER8> I can't really see this working in my current line of employment, warehouse automation. Once a system is in production we're lucky if we can deploy a bug fix once a fortnight.

</comment><comment><USER9> Sounds alot like what I like about App Engine. Hit the upload button and you've got a new version uploaded and live within minutes.</comment>


San Francisco, Oakland, San Jose: Three of five costliest rental markets in U.S - <AUTHOR> http://www.siliconvalley.com/news/ci_29797026/san-francisco-oakland-san-jose-three-five-costliest <comment><USER2> Now that Oakland is getting so expensive, it'd be interesting to see where people in the bay area spill over to next. Berkley? Hayward? Daly City? The way these things work is that now some broke 22 year old with an art degree (and I mean that in the best way) is now realizing that he can't live in Oakland. Where he decides to move to will be very interesting and will probably end up creating millions, perhaps billions, in real estate value.

This obviously presumes the growth rate the bay area (and many urban centers in the USA) will continue.

<comment><USER3> Lol. Try Tracy. Penninsula and Berkeley are $$$$. East Palo Alto may finally gentrify. This will rely on the cops evicting gangs though.

</comment></comment><comment><USER4> Thanks, I've set this link to autoreply to all LinkedIn requests from the Bay Area.</comment>


A proposed API for full-memory encryption - <AUTHOR> https://lwn.net/Articles/776688/ <comment><USER2> > Total Memory Encryption (TME) ... uses a single, CPU-generated key for all > of memory; users can control the usage of TME in the boot-level firmware. A > new standard ... MKTME ... supports different encryption settings ... at the > page level, and more keys. Different keys can be used at the same time for > different memory regions.

While using multiple keys has legitimate advantages for the user, it's also a step towards unbreakable DRM and other malware. It's easy to think about how a new technology is _useful_ , but it is prudent to also consider how the technology might be used as a _weapon_.

Memory encryption has obvious niche uses, but seems slightly outside the common threat model for most people (users). The more likely use-case (for the average user) is probably user-hostile: DRM, "Denuvo"-style tamper resistance.

edit: Forgot to mention: the single-key variation (TME) can provide a lot of the user-focused benefits, without the DRM proliferation risk.

<comment><USER3> > While using multiple keys has legitimate advantages for the user, it's also > a step towards unbreakable DRM and other malware.

No it's not. With MKTME, the kernel can read all memory, ptrace still works, etc. I don't even see how a future MKTME v2 would be useful for DRM.

<comment><USER2> > the kernel can read all memory

That's great, _iff_ you have root-level access.

> I don't even see how a future MKTME v2 would be useful for DRM.

Intel already tried that with SGX. (Intel's documentation for SGX was all about creating a "Trusted Computing" environment, using the old Palladium/NGSCB DRM-sense of "trusted".

<comment><USER3> > That's great, iff you have root-level access.

And if you don't have root access, then you can't read other users' memory. The MMU must be an evil scheme for DRM!

</comment></comment></comment></comment><comment><USER4> >> In a virtualized environment, if attackers can find a way to read memory from neighbor virtual machines, they can access the data from those machines.

I would not advocate memory encryption as a defense against this kind of attack. It's added complexity to fix a different problem (untrustworthy virtualization). OTOH it is useful to protect against physical access at the hardware level - and that's not really a common concern but is valid is some cases.

<comment><USER5> > It's added complexity to fix a different problem (untrustworthy > virtualization).

How do you fix the "untrustworthy virtualization" problem then?

<comment><USER6> Oh, that's easy. Just fix all the bugs.

<comment> yjftsjthsd-h _Including_ bugs in the hardware itself, of course:)

(There's a reason why Spectre and Meltdown were a horror show for virtualization.)

</comment></comment></comment></comment><comment><USER7> Does this mitigate any kind of rowhammer attacks? The kernel will be managing the keys, but if normal programs don't have access to them they would be unable to predict the actual bytes written, which I think is necessary for rowhammer.

<comment><USER8> I would venture that it does. It's much, much more likely that forced bit- flips via RH would break decryption vs cause some malicious code execution.

<comment><USER9> If the encryption has no authentication, an attacker could still conceivably flip individual bits, much like they can when attacking a stream cipher.

Does the spec say that the encryption be authenticated? If so, where are the MACs stored?

<comment><USER10> I don't think this proposal supports authenticated encryption, but if you're using ECC RAM, you could batch up groups of 8x72bit DDR lines, giving you 64 non-data bits: 10 bits for single error correction on a 576bit batch, and 54 bits for MAC. If your L3 uses 64-byte or larger cache lines, this is mostly free; you could also scale this up or down depending on how many MAC bits you want versus how large youre cache lines are.

</comment></comment></comment></comment><comment><USER11> Correct me if I got this wrong, but what we are talking about is basically having a hardware encryption processor and tmp-like module within the cpu chip itself, sitting between the memory controller and the cpu. Does that also cover the L caches?

<comment><USER12> Yeah, it's done at the memory controller level. No the caches won't be encrypted, but it wouldn't make sense to; any threat model that says L* caches can be read by an adversary should also allow the register file itself to be read, and that's going to contain unencrypted data (after all, you have to decrypt the data at _some_ point).

I do wonder, though, whether the memory remains protected against adversaries who can put rogue devices on the PCIe or UPI buses; it seems that these would be able to get decrypted data.

<comment><USER13> >I do wonder, though, whether the memory remains protected against adversaries who can put rogue devices on the PCIe or UPI buses; it seems that these would be able to get decrypted data.

is that an issue when you have IOMMU?

<comment><USER12> I don't believe Intel (whose implementation of encryption this targets) have an IOMMU for PCIe. For UPI (or whatever inter-socket protocol is going on), it wouldn't make sense to have an IOMMU since cores need permission to do arbitrary reads anyway.

<comment><USER3> Intel has an IOMMU for PCIe. And DMA sees cleartext with (MK)TME.

<comment><USER14> There are hardware based cheats for CSGO. It's a PCI card with some custom CPU/FPGA on it that scans and changes values inside the memory of the game.

When I read the title I hoped it would protect against that too, but no such luck then, I guess?

<comment><USER15> TBH if you have to resort to bus-based cheating in a game then I'd say it counts as a win for the anti-cheat software.

<comment><USER14> There are plenty of cheats that are seemingly impossible to detect. I play Team Fortress 2 and there's at least one cheat there that, from what I've read, uses code that's unique to each instance used by a cheater. VAC seems to scan for code signatures so it doesn't detect it.

This hardware cheat makes it even harder to detect since it reads and writes directly to main memory using DMA. No drivers or software needed at all. All you possibly could detect is the PCI-ID(which can be changed) and possibly the DMA if there's an IOMMU.

[https://blog.esea.net/esea-hardware-cheats/](https://blog.esea.net/esea- hardware-cheats/)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I don't really understand the threat model in which this provides a real security benefit. If someone can inspect the contents of memory, can't they also recover the encryption key somehow?

</comment><comment><USER17> What are the performance implications with memory encryption?

</comment><comment><USER18> All the discussion ITT so far has been about the concept or hardware implementation of full-memory encryption. I'm wondering if anyone has thoughts about the proposed API.

</comment><comment><USER19> I guess this would help with Meltdown/Spectre type bugs.

<comment><USER20> Apparently not because of what is said above about caches being unencrypted.

Past Intel architecture allows two threads to share a physical core in such a way as the cached data of the first thread may be probed with a timing attack to reveal confidential data.

</comment></comment><comment><USER21> What is the encryption algorithm Intel is planning to implement? I can't seem to find any references to it.</comment>


An 800M solar mass black hole in a [] neutral universe at redshift 7.5 - <AUTHOR> https://arxiv.org/abs/1712.01860 <comment><AUTHOR> Published 6 December in Nature

[https://www.nature.com/articles/nature25180](https://www.nature.com/articles/nature25180)

The crucial thing is how they develop their argument that this supermassive black hole (SMBH) and a pair of others (out of a selection of high redshift SMBHs) must have been forming in the "dark ages" between the surface of last scattering (that forms the cosmic microwave background) and the age of reionization, when collapsing matter's radiation began stripping electrons from neutral hydrogen atoms.</comment>


Raphael.js 2.0 beta release is out - GitHub - <AUTHOR> https://github.com/DmitryBaranovskiy/raphael/tree/2.0 <comment><USER2> Which is really and genuinely great, except the author is still releasing the code in essentially impossible-to-review code drops: [https://github.com/DmitryBaranovskiy/raphael/commit/164c349e...](https://github.com/DmitryBaranovskiy/raphael/commit/164c349e13326ce41eca13cb4318b5be52c8f002)

<comment><USER3> It's also difficult to contribute. Because of the one-commit-per-release strategy, Pull Requests aren't accepted (though the changes normally end up in the next release).

<comment><USER4> I've had a one-line bug-fix pull request rejected with the answer of something like "that's fixed in version 2". Well, I'm glad it's fixed in v2, but now I have to maintain my own fork until v2 is released and is stable enough for production use.

I have massive respect for Dmitry's pure abilities and the library as a whole, but trying to contribute is pretty frustrating.

</comment></comment></comment><comment><USER5> There's a list of changes on the Google group. [http://groups.google.com/group/raphaeljs/browse_thread/threa...](http://groups.google.com/group/raphaeljs/browse_thread/thread/f76614f79da88478)

• New transformation API and implementation, dramatically faster and flexible (full support for matrix transformations) • New animation API extension • Fix for subpixel rendering in IE • New arrowhead attributes • Improved getBBox calculation • Fix for HSB and HSL • Added viewBox support • New built-in event system • and lots of tiny bug fixes

</comment><comment><USER6> round = function (num) { return +num + (~~num === num) * .5; };

What does ~~num do?

<comment><USER7> Bitwise operations coerce the value to a int32. If a value cannot be reasonably coerced to an int (e.g. 'foo'), you get zero. It's basically the same as parseInt(x,10) but is generally faster, you don't need to remember the radix, and you don't get NaN. The downside is that trying to coerce numbers outside int32 will give incorrect answers.

The other way to write it is 0|num which has the advantage of only applying one bitwise op.

These tend to crop up most often in graphics oriented libraries.

<comment><USER8> Thanks. Anything quicker than parseFloat?

<comment><USER7> You'd have to bench it, but the only thing I could think of that'd be faster is the standard +num coercion that's also used in the code snippet. Unfortunately, that does generate NaNs.

Edit: Double checked the spec (it's quite readable) and the main difference is that + will coerce ignoring whitespace while parseFloat will ignore leading whitespace and parse leading digits. E.g. var x = '1.23foo'; parseFloat(x) is 1.23; +x is NaN. Neither looks like it should be faster than the other.</comment></comment></comment></comment>