Leaked Catalog Reveals a Vast Array of Military Spy Gear Offered to U.S. Police - <AUTHOR> https://theintercept.com/2016/09/01/leaked-catalogue-reveals-a-vast-array-of-military-spy-gear-offered-to-u-s-police/ <comment><USER2> US police definitely has to stop seeing itself as another form of military. Here in LA I see billboard ads for police recruitment with some super fit people and words like "Courage" and others. Pretty much the same style as the Marines ads. They never mention "Service" or "Peace". Seems they want to attract wannabe soldiers.

<comment><USER3> I agree with you but it could also get much worst... for example if Soros' plan to federalize US police[1] becomes a reality, I think that it would get worst. But at least, Obama banned some military equipment sales to police[2].

I think that citizens should be allowed to own whatever police officers are allowed to use without warrants.

1\. [http://www.anonews.co/soros-leaked-memo/](http://www.anonews.co/soros- leaked-memo/)

2\. [http://www.usatoday.com/story/news/politics/2015/05/18/obama...](http://www.usatoday.com/story/news/politics/2015/05/18/obama- police-military-equipment-sales-new-jersey/27521793/)

<comment><USER4> I don't think either of those documents says that Soros wants to federalize US police. Soros is a progressive, and progressives want to limit the power of police, and limit the militarization of police forces. I believe Soros is on board with both of those things.

If I sent a letter to the secretary of state or my own representatives in govt asking for something, like say changing our govts investigation about Syria, you could claim that I somehow influenced the govt. Of course Soros is really rich and could convince people to do things. But HRC is really rich too.

<comment><USER3> With his "letter", he also sent millions of dollars to Hillary Clinton's campaign... but I get your point (ie: of course you don't necessarily need money to influence)

</comment></comment></comment></comment><comment><USER5> This is extremely dangerous tech in the hands of any law enforcement or government agency. We've already seen multiple cases of police in the US destroying video evidence, disabling dashcams, and deleting videos from people's cell phones. Given the ability to jam people's cellular signal it's all but certain it will be misused to cover up wrongdoing.

Technology like this will also undoubtedly be used to disrupt and harass activists and protesters.

And really, what risk is there for law enforcement in using this stuff? If they get caught, maybe a few cases get thrown out but as it stands no one is likely to go to jail for illegal surveillance.

</comment><comment><USER6> "For geo-locating and tracking purposes the UMTS target phone is 'pushed' onto the GSM-XPZ cell and then placed into blind call mode." [1]

Oh, yeah, of course blind call mode.... wait, what?

Does anyone have more information on "blind call mode"? It sounds like a standard feature of some devices, perhaps where the phone actively transmits as if in a call, but without the user knowing. I definitely don't want a device that will help someone spy on me...

Also it's great that people are beginning to question the values of law enforcement, but don't forget too that good old fashioned criminals will have this tech too. Sometimes, the two will be the same entity.

[1] [https://prod01-cdn07.cdn.firstlook.org/wp- uploads/sites/1/20...](https://prod01-cdn07.cdn.firstlook.org/wp- uploads/sites/1/2016/08/Screen-Shot-2016-08-30-at-12.04.19-PM.png)

<comment> ju-st Page 7: [https://info.publicintelligence.net/Gamma- GSM.pdf](https://info.publicintelligence.net/Gamma-GSM.pdf)

<comment><USER7> I'm not seeing anything on page 7 that details "blind call mode" and only one mention of "blind call mode" in the document-- Do you have any further reading on this?

<comment><USER8> Page 7 doesn't detail how it works, but does seem to describe what it does. From cell base station creates a connection to a target cell phone without the user of the cell phone being aware. Can then use RF direction finding to identify location of cell phone. Obviously multiple base stations required to be more accurate.

More explanation available in this patent application - [https://data.epo.org/publication- server/rest/v1.0/publicatio...](https://data.epo.org/publication- server/rest/v1.0/publication- dates/20101229/patents/EP1908318NWB1/document.html)

</comment></comment></comment></comment><comment><USER9> I just think that's it's nuts how law enforcement can mess with radio waves(jamming), but if I did it I would have fines/jail time. BONKERS.

<comment><USER10> Serious follow up question: what part of the legal code allows this? Are there exceptions written into laws for the police? Or is that it's illegal but would never be prosecuted?

<comment><USER11> Here in the UK there are exceptions written into the law. For example, here's the speed limit exception [0]. If the government want to give the police new powers contrary to existing laws they will pass a bill making amendments to the old laws.

[0]: [http://www.legislation.gov.uk/ukpga/1984/27/section/87](http://www.legislation.gov.uk/ukpga/1984/27/section/87)

</comment></comment></comment><comment><USER12> This is the catalog referenced in the article: [https://assets.documentcloud.org/documents/3038285/2014-Cobh...](https://assets.documentcloud.org/documents/3038285/2014-Cobham- TCS-Catalog.pdf)

</comment><comment><USER13> think that is bad, check out Baltimore's "pre search" system that was detailed over at CATO [http://www.cato.org/publications/commentary/pre-search- comin...](http://www.cato.org/publications/commentary/pre-search-coming-us- policing)

Face it, without specific laws blocking the use of military grade hardware by the police we will end up with a police state. First came over militarization of SWAT teams to the same with nearly all police. They even have tracked military vehicles in some jurisdiction as well as military transports never designed for road use (one of my neighboring counties has a tank and was ridiculed over it after someone put a training video to death metal; search for Doraville tank)

<comment><USER14> I find the focus on "military grade hardware" to be a red herring in the police conduct issue. In many cases, the hardware being discussed (tracked vehicles? okay, I guess they're good in mud?) have nothing to do with offensive capabilities, and are quite often defensive. (Armored vehicles).

If anything, the better defended our cops are, the less excuse they have to use lethal force. If a cop knew his life was never in danger, he would have almost no reason to use lethal force.

In many cases, this hardware's already built, it's built to survive a lot tougher duty than the police put it through, and it makes no sense to me why they wouldn't use it.

<comment><USER15> A really good reason not to use them is that they are expensive to maintain and operate and they don't really need them.

<comment><USER14> And that is an absolutely fair point. Police departments will need to evaluate the cost/benefit of any equipment they use. (And damage that equipment can cause to roadways also factors in as well.)

</comment></comment></comment></comment><comment><USER16> Apparently SkyMall & Popular Science conditioned me to believe that all hidden cameras are obviously hidden cameras. The realism of the concealments in this document was sort of jarring.

<comment><USER17> "If the taps are good enough you'll never find them."

</comment></comment><comment><USER18> Lots of dangerous stuff here. But the camera systems are mostly available on the internet already? Except they've painted it all black. Anybody can make a dyi surveillance kit just shopping on Amazon.

</comment><comment><USER19> Anyone live in a country where the military is the police? I think it's a really bad idea, and Allende probably agrees.

<comment><USER20> So may Aristide.</comment></comment>


To start a billion dollar startup, start looking for problems - <AUTHOR> http://startupstunned.blogspot.com/2017/08/want-to-start-billion-dollar-startup.html <comment><USER2> What you really want to find are the 25 million dollar problems that you can turn into a monopoly. Sure you won't ever be famous, but you will have a great lifestyle that is 99% of what a billionaire has on the upside with none of the downside.

<comment><USER3> > turn into a monopoly

Sure, but how do you do that? There's lots of textbook stuff (patents/copyright/trademark, consumer habit etc), but in practice, you must continuously improve it, promote it etc, to _keep_ that "monopoly".

There's no monopoly; only temporary monopoly. [But I'm interested to hear your thoughts]

<comment><USER4> The more complex the solution, the easier it is to lock it in permanently. People don't want to learn a new complex thing. Note that this means the minimal complexity (or close to it). If you implement something that _could be_ simple, and you make it complex, someone else will come along and make it simple and kick your ass at market.

Imagine you've got a warehouse automation system (this is not an example of a $25 million dollar business, just an example of a problem that has no simple solutions) that is ten times as efficient for employees as the current pad- and-paper solution. If you arrive first and lock in that industry with the market leaders in owning warehouses, you don't have to worry about a competitor coming along five years later with a system that is eleven times more efficient than pad-and-paper and that costs 20% less than your system. It cost the company a half a million dollars to train all of their staff to use your system. It'd be crazy to migrate.

So...not a monopoly, but a comfortable lock on a significant portion of the market.

<comment><USER5> You do know that there are _thousands_ of companies in the warehouse automation space, right? And that "pad and paper" (whatever broad brush that is supposed to mean) isn't really used anymore for anything but small warehouses that wouldn't be a profitable target for warehouse automation software? And that there aren't any "market leaders" that own most of the warehouses...you'd have to lock up thousands of the biggest companies even before you got to 10% market share?

I understand the point you're trying to make, but that was a terrible example. Even then, I don't agree with the answer. Complexity isn't a deterrent to market, otherwise some company would have locked up international import/export by now. The market's response to complexity isn't typically a monopoly but rather very fragmented hyperspecialization (which is the case for both international import/export _and_ warehouse automation).

What people are suggesting here is very well studied in economics: it's called a natural monopoly. And suggesting that you just focus on building a natural monopoly is about as facile as suggesting you just become a billionaire. Building a natural monopoly takes a mountain of time, money, and expertise. It's way harder to build a natural monopoly than it is to build a $1B business that has to compete.

<comment><USER4> It was a hypothetical example. I know nothing about warehouse automation (though I know it is not using pad-and-paper as I assumed any intelligent reader would understand I was making up a hypothetical world where warehouse automation didn't exist yet), but I know it's complex and I know that if a company with a lot of employees trains them in a complex system, the odds of them changing that system are very low.

And, as I said above: It's not a monopoly. But, it is a comfortable place to exist profitably without a lot of risk of losing your customers.

Also, you've wholly missed my point about complexity. Some problems are hard because of external, uncontrollable, unpredictable, complexity. Import/export is _that_ kind of complexity. I'm talking about predictable complexity. Again, to come back to warehouse automation as an example, which you hate, but makes my point. A warehouse has a lot of moving parts (people, machines, inventory, shelves, whatever TF), but it is finite and is a mostly closed system. The inputs and outputs usually match up, and you can predict what's going to happen with ins/outs and all the people and things that make the things move in and out. It is complex because it is large and there are a lot of people involved and many of them would need to be trained to use any new system that automates it. It is _not_ , however, chaotic, and involving many competing factions, like import/export.

<comment><USER3> Unpacking that a bit, training costs are to do with interface complexity (in the sense of "necessary" complexity) due to integration with other systems, and other information. i.e. it's not 100% automated; you can't just press a button. It's more "amplification", where you must be trained and practised to use it effectively - a tool for skilled labour. If you're super-successful, yours becomes a de facto standard, which others copy (usually, you still command a premium; but for the life-style idea here, we'd want to avoid that).

This might be included as "installation" costs, along with and engineering integration with other information systems, Related is the organizational purchasing process, expensive for larger transactions: determining requirements, evaluating alternative vendors and solutions, sign-off from legal and upper management, and so on. Change itself is disruptive, there'll be teething problems, other systems will have to adapt, and other knock-on effects apart from training itself. These are one-off costs that you'd prefer not to incur again, unless there's a very large benefit (your example of 10x is worth it, but not (11/10)x).

All are switching costs.

</comment></comment></comment></comment></comment></comment><comment><USER6> > Want to start a billion dollar startup?

> basically what you have to do

Just.. cringe. The book recommendation reminds me of this joke: [https://www.amazon.com/How-Made-290-Selling- Books/dp/B073DMV...](https://www.amazon.com/How-Made-290-Selling- Books/dp/B073DMV56J)

<comment><USER7> As an aside... For those not in the know, the "author" of said book is a member of funk group Vulfpeck, which I highly recommend listening to.

</comment></comment><comment><USER8> When I took my optimization and design class in college, our professor would tell us "It's always smarter to find the market then design the product, rather than designing the product and finding a market for it".

</comment><comment><USER9> What I this misses (in it's rather click-baity title) is that most problems are not going to be companies that are worth $1b. There is a very small slice of problems that end up at $1b. Most, I would imagine, end up being one time problems that are worth very little.

<comment><USER10> Or that a large portion of the solutions to said problems require R & D spend in the hundreds of millions, if not billions.

</comment></comment><comment><USER11> It is far more easier to create problems for whatever you are trying to solve.

<comment><USER12> Now this is funny, 5 stars.

<comment><USER13> This is also the tried and true strategy - the favourite technique of sales & marketing people. Create a (usually _perceived_ ) problem, sell the solution.

</comment></comment></comment><comment><USER14> This is exactly the right strategy but finding big enough problems can be an issue.

I asked this question in Hacker News two years ago.

What problem in your industry is a potential startup.

[https://news.ycombinator.com/item?id=9799007](https://news.ycombinator.com/item?id=9799007)

It was a very interesting experience and I wrote an essay about some of my findings.

[https://medium.com/black-n-white/the-problem-with- problems-4...](https://medium.com/black-n-white/the-problem-with- problems-47ee63bb3511)

</comment><comment><USER15> > come up with a solution which is easy to implement

This might be better phrased as, "a solution that's easy to scale". I don't think the implementation part of most valuable things is remotely easy; at least from my experience.

<comment><AUTHOR> Thanks for the advice. I've edited the blogpost.

</comment></comment><comment><USER16> For examples of ideas in search of a problem (rather than addressing a problem), see the vast majority of projects that have done an ICO this year.

</comment><comment><USER17> That's the problem, haha :P

We all got a big bunch of ideas and probably not 1% of them make any money. I mean just look at Twitter ;)

The problem are finding people who...

...think I can help them, so they talk to me in the first place

...have problems I can solve

...can formulate their problem

...don't want to own the solution and sell it on their own

<comment><USER18> You're not going to suddenly build a logistics system for dairy farmers, because you're not a dairy farmer and you don't know what kind of problems they have. But look at your own daily life. Your kids school might have some problems you could fix? Your daily shopping might have some annoyances you could invent a solution for? Look at your own life and stop ignoring the boring problems, while looking for the glamorous opportunities. Maybe keeping a pet has some annoying obligations that could be easier?

Talk to people in your everyday life, your doctor for example and find out what annoys them in their lives, doesn't have to be at work.

</comment></comment><comment><USER19> Even better than observing yourself is watching other people and trying to figure out what their problems are. If done with empathy, the side benefit is that you further develop abilities you will need if you ever have employees.

</comment><comment><USER20> As a side project, I've begun collecting ideas and posting them at [https://oppslist.com](https://oppslist.com)

Most, if not all, are NOT billion dollar ideas though.

<comment> FLUX-YOU Those descriptions and prices don't sound like they resemble anything close to what you should be charging people. You'd have to put an extra zero or two on most of them.

</comment></comment><comment><USER21> If people were more open about their problems, we wouldn't need to find them in the first place.

<comment><USER22> try searching for problems on bloomberry.com

<comment><USER21> Could you give an example of how a query could lead to a product idea?

</comment></comment></comment><comment><USER23> In my locality connecting to small cities, transportation is big issue. There is no reliable service. Is starting a transportation service like Uber or Lyft viable? How should I evaluate the market?

</comment><comment><USER24> I wonder if a profitable niche would be a startup that helps other startups or people looking to start a startup find Billion dollar maker segments ;-)

</comment><comment><USER25> my problem is the whole development lifecyle, there's no "code n run" anymore, when you have to continually deploy and test.

<comment><USER26> So build your own things and do it your own way. I find that is what works best for me. Put food on the table through contracting, build my own things around the contracts to provide recurring revenue. Keep going till it's enough. I hated everything about office culture and have never been happier. Right now for me that's about 20-30hrs per week freelance to make a great income, and I spend 20-30hrs per week working on my own projects.

<comment><USER27> So, this is something that I would really like to do, mind answering some questions :D?

When you say "freelance" are you contracting 'on location', or 'remote'?

On location, I can't seem to find anything that isn't basically a 40+ hour gig, negating the benefit of 'freelancing', and remote seems to be highly competitive/lowest common denominator.

I'm a decent developer (backend), in a decent tech city and I'm struggling to find a way to ditch my 9-5 in favour of doing my own thing.

Any resources/advice would be appreciated.

<comment><USER26> all remote.. i scower the web for RFP's and people looking for developers and pitch my services.

</comment></comment></comment></comment><comment><USER28> Want to start a $1 startup? Start finding problems instead of ideas.

Works at any scale

<comment><USER29> Back to the drawing board then, pg says to do things that don't

</comment></comment><comment><USER21> Does scratching your own itch count as finding problems?

<comment><USER30> I think if you're talking figuratively, yes. Literally, no.

</comment></comment><comment><USER31> why is this on the front page? It is devoid of content.

<comment><AUTHOR> And why do you think so?

</comment></comment><comment><USER32> Snapchat, bitch!

</comment><comment><USER33> Or you could create a problem to solve! Uber is trying to underprice the taxi industry into bankrupt, then there will no more taxis and only Uber! Capitalism!

<comment><USER18> Or Snapchat. Did kids and teenagers have problems connecting with other kids and teenagers before Snapchat existed? I know I didn't. My parents didn't. Their parents didn't and so on. Until Snapchat showed us that we couldn't live without it, nobody had a problem connecting to each other.

<comment><USER34> Snapchat's value prop has nothing to do with connecting with one another. It originally lay in its proclaimed transient nature and ability to communicate off the radar from parents/relatives which at the time had begun to "infest" other social media.</comment></comment></comment>


Stack Recommend – recommendation for stack overflow posts - <AUTHOR>

Hey
I have just put online my final project for a Data Science course I am doing. Check out and tell me what you think. (http://recommender.im)
The idea is, based on your profile or tags you are interested in recommend posts that you could be interested in reading.
I am still fine tuning it, put it is already pretty usable. <comment><USER2> That's awesome. One feature I'd personally love to see is number of responses/if any response is accepted so that this could be used to trawl for things you could help solve

<comment><AUTHOR> That's actually the next feature planned... posts you should answer.

If this is really useful, I'll do it</comment></comment>


Twitter Apps? - <AUTHOR> http://techcrunch.com/2012/06/13/twitter-expanded-tweets/ <comment><AUTHOR> It seems this is the beginning of developing apps for Twitter - very similar to how people started developing apps for the Facebook platform in 2007.

The nature of the apps will be quite different on Twitter given how Twitter works. Initial partners are newspapers like NYTimes, WSJ, MSNBC.</comment>


Study: Believing You've Slept Well, Even if You Haven't, Improves Performance - <AUTHOR> http://www.theatlantic.com/health/archive/2014/01/study-believing-you-ve-slept-well-even-if-you-haven-t-improves-performance/283305/ <comment><USER2> Placebo Sleep Affects Cognitive Functioning.

Paywalled article: [http://psycnet.apa.org/doi/10.1037/a0035546](http://psycnet.apa.org/doi/10.1037/a0035546)

Abstract:

The placebo effect is any outcome that is not attributed to a specific treatment but rather to an individual's mindset (Benson & Friedman, 1996). This phenomenon can extend beyond its typical use in pharmaceutical drugs to involve aspects of everyday life, such as the effect of sleep on cognitive functioning. In 2 studies examining whether perceived sleep quality affects cognitive functioning, 164 participants reported their previous night's sleep quality. They were then randomly assigned to 1 of 2 sleep quality conditions or 2 control conditions. Those in the "above average" sleep quality condition were informed that they had spent 28.7% of their total sleep time in REM, whereas those in the "below average" sleep quality condition were informed that they had only spent 16.2% of their time in REM sleep. Assigned sleep quality but not self-reported sleep quality significantly predicted participants' scores on the Paced Auditory Serial Addition Test and Controlled Oral Word Association Task. Assigned sleep quality did not predict participants' scores on the Digit Span task, as expected, nor did it predict scores on the Symbol Digit Modalities Test, which was unexpected. The control conditions showed that the findings were not due to demand characteristics from the experimental protocol. These findings supported the hypothesis that mindset can influence cognitive states in both positive and negative directions, suggesting a means of controlling one's health and cognition. (PsycINFO Database Record (c) 2014 APA, all rights reserved).

</comment><comment><USER3> Actually, this just shows that believing you will perform better improves performance. They weren't just told they'd slept better, they were also told that sleeping better improves performance:

>The researchers then gave the participants a quick, five-minute lesson about sleep's effect on cognitive function, telling them it was just background information for the study.

<comment><USER4> Yeah; it could very well have been the case that had the researchers given a quick, five-minute lesson about how "short bouts of sleep deprivation improve cognitive function ...because SCIENCE [wave hands frantically]" that they could have shown the opposite result as well ;P.

</comment></comment><comment><USER5> How it is different from superstitions or religions?)

Study: Believing that Lord Shiva helps improves performance.

Study: Doing Kora around mt.Kailash when moon is full improves performance.

It could be a very long list.

Study: Believing that I am capable while I'm not improves performance. (Look at these overconfident "finance guys").

And finally generalization about "why believers have better life than infidels" \- believing in something improves performance.)

<comment><USER6> It's all related to placebo effect and positive attitude - perhaps throwing in the concept of hope. You could throw the idea of intent in there as well. Basically along the lines of once you initiate positives-feel-good thoughts then those will impact everything else you do - and things like exercise that increase good feelings physically, then those associated thoughts and memories will have more feel-good attached to them. Bit of a tangent I went on..

</comment></comment><comment><USER7> Nobody mentioned anxiety? Everyone's heard of all kinds of stupid accidents, well, I'd never do something that dumb. Well, after being awake 24 hours either you understand it could happen, or you're not very self aware. Being told you've got plenty of sleep and should be able to do the job just fine reduces anxiety and the lack of anxiety improves performance.

I own a table saw and still have all my fingers. I know all about doing dangerous stuff while well rested, sober, calm. As an example, had a board kickback on Friday evening, I know what I'm doing and work safely so I know nothing will happen when it kicks back so I can focus 100% on other things, like keeping my fingers well away from the blade. If I was all anxious in general or about kickbacks I'd probably end up sticking a finger in the blade, or I'd work at about 1/10th speed just to make sure.

</comment><comment><USER8> I have been on Ambien (Zolpidem here in the UK) for 5 years now after being diagnosed with insomnia due to PTSD (actually diagnosed by three doctors at a psychiatric hospital where I had to spend 4 months in 2009 not some self- diagnosis) and I am not too sure on this evidence. I know a lot of people who suffer true insomnia (as in doing several days with perhaps 15 minutes sleep) and thinking you got good sleep does not make up for the fact that you are actually going several days with awful sleep. I am sure there is some kind of psychosomatic side that makes you perform better because you think you will but suffering _real_ lack of sleep cannot be "tricked" better with positive thinking just like how depression cannot be fixed by just "thinking happy".

<comment><USER9> The study population was undergrad students, not insomniacs (I mean, maybe self-styled, but you know what I mean). Therefore, you're probably right that this finding might not generalize to a distinct population with disordered sleep. But for the typical HN reader, it might be of more interest.

</comment></comment><comment><USER10> I wonder for how long the experiment was done.

I found out that under-sleeping had a very bad impact on me after _several_ months, not in a short/mid term. And I have the feeling this placebo effect would not be the same if you've been under-sleeping for months.

The original article link is broken though, too bad.

<comment><USER11> How do you tell that the 'bad impact' is due to under-sleeping, and what effects do you notice?

I have sleep issues with some regularity, so I'm very curious to hear of your experiences.

<comment><USER10> This is just my gut feeling, things are probably more complex, but here's why I think sleep deprivation deeply impacts us:

I used to have a crazy schedule, commuting very early and coming back quite late at home, sleeping between 4 to 5 hours a day. I've noticed I was often in a bad mood, dropping things, feeling anxious. gaining weight and so on... After a couple of years I was feeling depressed and getting sick all the time.

Then I had a new job and started to work remotely from home, and started to sleep 8 to 9 hours per night. Both works were interesting, and commuting to the first one was done by train, so I think the only noticeable difference was the amount of sleep I was getting.

With more sleep, after a month, I became more focused in everything, the depression feelings went away, and had so much more energy. Overall I was more successful in what I was doing - happier and healthier.

I guess all of this sounds obvious, but going through it, making sure I get my 8-9 hours of sleep most of the time is something I am now careful about.

</comment></comment></comment><comment><USER12> Speaking for myself; believing I slept too short/badly (like when I think I lay awake most of the night while my wife saw I slept solidly) impairs my performance worse than believing I slept well while I haven't improves it.

</comment><comment><USER13> Very true. I noticed that if I stop looking at the clock before I go to sleep and I assume I'm getting 8 hours of sleep I wake up feeling great. A few times I glanced at the time when setting my alarm and just knowing how many hours I'm going to get makes me wake up tired. So I went around the house and put tape over the clocks I couldn't turn off (microwave). Turns out life without knowing the time is a lot more calm, productive, and enjoyable.

</comment><comment><USER14> And: _Keep Telling Yourself, 'This Workout Feels Good'_

[http://well.blogs.nytimes.com/2013/11/06/keep-repeating- this...](http://well.blogs.nytimes.com/2013/11/06/keep-repeating-this-workout- feels-good/?_php=true&_type=blogs&_r=0)

</comment><comment><USER15> There is some other research that suggests that placebo works even when you know it's placebo.</comment>


What it takes to build 18-Mpixel basic phones - <AUTHOR> http://www.embedded.com/underthehood/220600299?cid=RSSfeed_embedded_news <comment><USER2> Great, 18M pixels, but how are you going to get enough photons per second through the tiny cell phone lens to keep the signal to noise ratio up?

Maybe we will have to carry phone tripods and use 5 second shutter times, or we could use giant pans of flash powder to make really bright flashes.</comment>


Bennis v. Michigan: Forfeiting the Due Process Rights of the Innocent Owner - <AUTHOR> http://www.nesl.edu/userfiles/file/lawreview/vol32/2/BROWN.HTM <comment><USER2> So the idea is "innocent" co-owners of property are being treated unconstitutionally because of civil forfeiture. But who is REALLY affected by this; the legions of innocent wives? Or the vast banking and loan industry who lose property every day to illegal acts. Whomever, it definitely reeks of Michigan.</comment>


Windows Subsystem for Linux is out of beta - <AUTHOR> https://blogs.msdn.microsoft.com/commandline/2017/07/28/windows-subsystem-for-linux-out-of-beta/ <comment><USER2> I hope my Macbook days would be over soon. After using Macbook Pro many years, I find good Windows machines are as reliable as Mac's ones. Apple products are usually overpriced, much less options for hardware accessories and upgrades, very expensive to fix. I have to keep running both Mac & Windows machines which is very inconvenient sometimes.

<comment><USER3> Which laptop manufactures have you found to be as reliable and well put together as macbooks? I haven't had too much luck with dells or lenovos.

<comment><USER4> Surface Book and Surface Laptop are quite good.

<comment><USER5> +1 on Surface Book. Great build quality, good dev machine and decent gaming laptop as well.

<comment><USER6> Was thinking about getting one for work, and gaming is a nice perk

What kind of specs/graphics/resolution do you get on that for games?

<comment><USER5> Just make sure to grab one with the discrete GPU(dGPU aka Performance Base). It's not going to be anything near a desktop(no laptop will) but I can run most things at 1080p pretty well and some of the lighter stuff(like Pyre) at 3Kx2k(native resolution).

</comment></comment></comment></comment></comment></comment><comment> nv-vn Barely related, but what's with the whole "Creators Update"/"Fall Creators Update" thing? It's not "Creator's Update," so I guess it's supposed to be targetting "Content Creators," right? But looking at the changes in these updates, I'm really not sure what's been added for any sort of content creator. Windows Movie Maker hasn't turned into Premiere, Paint hasn't turned into Photoshop, etc. So where the fuck does the name come from? And why not just name it with some Apple/Google-esque codename like Snow Leopard or Jellybean instead of making some half-baked marketing scheme?

<comment><USER7> Yeah, at the time I could still understand them calling the original Creators Update that way, just to have some marketing buzzword to throw at people, but "Fall Creators Update" is really just the dumbest thing I've seen in a while.

Not only is its meaning just as nonexistent as the first time around, it also just seems like something that some guy thought up on the spot in a meeting, after remembering that he was still supposed to ask the marketing department about that.

It's not in any way a remarkable name and it's going to be confusing to many people as well as to search engines, making troubleshooting any issues with it unnecessarily hard.

</comment></comment><comment><USER8> I really hope they make WSL's /home/. symlink to /mnt/c/users/. by default. What's the point of having a separate filesystem and home directory? I want native POSIX in Windows. The WSL implementation feels like... not that.

<comment><USER9> The linux filesystem has to be segregated from the windows filesystem. If I remember correctly, the linux FS can read from windows FS, but not write to it, due to locking issues. Or something like that. Whatever it was, it made me discount it as a way to write windows code. Instead, I'm using Git Bash, which is based on mingw

<comment><USER10> I believe you got it inverted. You cannot write on the WSL file system from Windows, but the other way (writing on windows from bash) is ok.

<comment><USER11> How do they expect developers to write code if windows can't write to the file system? Do they expect everyone to use vim or other text based editor?

<comment><USER12> Just host the code in Windows-land.

Symlink ~/code to /mnt/c/Users/jamie/code, run whatever editor I want in windows to edit the code, and run my app from linux-land in the console. Hasn't given me a hiccup yet, even with a local sqlite database and such.

If you just treat your linux homedir as a spot for dotfiles and symlinks out to windows, it shouldn't give you much trouble unless you're doing stuff that relies heavily on owner/write permissions.

</comment></comment></comment></comment></comment><comment><USER13> Rich Turner and his team has pretty much done the impossible. Huge congratulations to them.

</comment><comment><USER14> finally I can remove the win32 specific code from all the open source software I maintain

not sure that was what Microsoft was going for though...

<comment><USER5> Unless you're going to force your users to install WSL up front(which is a pretty poor first contact) I think you might be better served by keeping it around.

<comment><USER15> Why? The Linux sub-system is the best part of Windows. He's doing them a favor.

<comment><USER16> Extra dependencies are rarely ever doing anyone a favour. Yet another thing to keep up to date, occupy disk space, memory...

<comment><USER17> That's a pretty flimsy case when it's bundled with the OS and the performance and memory cost is in their court to improve.

</comment></comment></comment></comment></comment><comment><USER18> So is this complementary to the linux subsystem in windows, or a completely unrelated option?

<comment><USER19> I think you've fallen victim to Microsoft's somewhat awkward naming scheme - the Windows Subsystem for Linux is the name of the "linux subsystem in windows" that you're referring to. It's not complementary or unrelated, but the same thing.

<comment><USER20> The fundamental abusiveness of the naming of this product isn't lost on people. Every time I see "Windows services for Linux" I know very well that it's just Microsoft doing what their public manipulation thing.

I've actually heard this issue discussed by the Windows admins in my company, without them having first heard my own opinion on the matter.

"Why didn't they name it 'Linux services for Windows', or something sane?" My Exchange/storage admin asked. "Because that would make sense", our other Windows admin says.

The discussion moved on to how Microsoft was afraid of the very notion of a product name that made it clear that Linux was doing something useful on Windows. They had to make it seem that Windows was offering services to Linux, because Linux needed the help of Windows, not the other way around.

<comment><USER17> Because they want the first word to be Windows, their brand. They do the same thing with Server for NFS.

</comment></comment></comment></comment><comment><USER21> Great news, this will hopefully allow our developers to make code on Linux since they've been forbidden from running VMs and it's extra overhead.

I hope Visual Studio gets good integration here because it truly is a first class IDE and it's hard for me to tempt our windows developers away based on that fact combined with the "We don't support linux on desktops" and "No VMS" attitude of my company.

<comment><USER22> I'd like that too. The main thing holding it back is the file interop. If a windows program creates a file in a Linux directory bash literally can't see it. I've worked around this by putting my real work in Windows directories and symlinking then into my WSL home, but I can see this biting me at some point in the future.

</comment></comment><comment><USER23> As a web developer why would this be useful to me. I know Linux and run it for years and now at this job i am on windows. My stack is usually python flask, postgres, vuejs/react, ...

All of these things run natively on windows is there another advantage to moving to the WSL?

I know there are advantages but specifically for my tool chain is there something i am missing?

TIA

</comment><comment><USER24> Can someone point to a decent X server for windows?

<comment><USER25> From the article:

> _NO current plans to support X /GUI apps, desktops, servers, etc. at this > time_

<comment><USER26> No plans to support specifically, but a surprising amount of things work simply due to their effort making the rest of it work.

</comment></comment></comment><comment><USER27> Now all we need is a terminal emulator as good as iTerm/Terminal.app/urxvt.

<comment><USER28> I've been quite happy using Cmder

[http://cmder.net/](http://cmder.net/)

</comment></comment><comment><USER29> WSL needs access to the wifi adapters for network security testing!!!

</comment><comment><USER30> Has anyone tried to use visual studio Open Folder feature [1] along the WSL to work in that IDE with big C++ cmake built projects targeting linux?

[1] [https://blogs.msdn.microsoft.com/visualstudio/2016/04/12/ope...](https://blogs.msdn.microsoft.com/visualstudio/2016/04/12/open- any-folder-with-visual-studio-15-preview/)

</comment><comment><USER31> Every time I read about WSL I can't help but wonder why cygwin is never mentioned. Cygwin provided all this over a decade ago.

<comment><USER32> Cygwin was able to run unmodified elf binaries on windows? And it was doing it a decade ago? Wow, that's really impressive.

<comment><USER31> No, but it ran all the Linux applications and shells and utilities. I was running Xemacs in X11 on Windows XP using cygwin years ago.

But to your point they were built for cygwin, not linux.

</comment></comment></comment><comment><USER33> I use a Mac. And I also use this when I'm using Windows. I try to use both so I stay up to speed on the latest developments of both platforms.

WSL leveled the playing field for me. WSL makes Windows a decent dev machine out of the box.

I wish Visual Studio would integrate better with it though. e.g. if I run a project in VS, I want the option of running in WSL.

</comment><comment><USER34> In my experience, emulators are never quite the same as the real deal. Has anyone used this, and if so how was it?

<comment><USER35> It is not an emulator and the experience is pretty great for anything involving Linux as a workstation.

Even though they say "NO current plans to support X/GUI apps, desktops, servers, etc. at this time", this is achievable by installing VcXsrv.

<comment><USER34> Perhaps emulator was a poor descriptor in this case -- I haven't used it. But it is running a subset of functionality non-natively, correct?

<comment><USER36> It's a pretty interesting design -- Microsoft created a new class of processes called pico processes; these are native processes run without the normal Win32 overhead and are managed by a special pico process driver. For WSL, the driver implements the Linux kernel API and process loading. Linux API calls are mapped to existing Windows APIs or implemented directly in the driver.

Everything else in the WSL is the regular Ubuntu user land. So all the processes are "native" and they make calls to a kernel that acts just like Linux.

<comment><USER37> This is possible because Dave Cutler and the rest of his VMS team built Windows NT to support multiple personalities. From day one the Win32 subsystem was just one of several. That idea got sidelined when Windows became so popular but the core has always been there.

It's kinda funny: the Windows NT kernel (and Executive, the actual native API) are a single-root object hierarchy where everything gets mounted - much like unix - only even moreso. Mutexes, Registry Keys, etc are all objects mounted in the root filesystem.

I guess everything old is new again. Microsoft used to have a server product called Services for Unix that replaced the built-in POSIX 1.0 subsystem with a legit Unix environment but it was always a neglected product that only existed to get people to port server apps to Windows. This time they're doing the integration on end-user desktops and have spent more time getting Win API integration working smoothly.

<comment><USER36> > This is possible because Dave Cutler and the rest of his VMS team built > Windows NT to support multiple personalities.

Although it would seem logical, the WSL doesn't actually use this system. The whole pico process engine and how it interacts with Windows is all new and not related to that design. I'm not really sure the reasoning behind it; perhaps it didn't allow them to do the level of integration they wanted.

</comment></comment></comment></comment></comment></comment><comment><USER38> Regarding security, it increases attack surface but besides that is there any critical issues?

</comment><comment><USER39> Please support FUSE!

</comment><comment><USER40> MS Word and Excel

</comment><comment><USER41> Does anybody use this?

<comment><USER42> I do, for Ruby/Sinatra development, it works very good.

<comment> justin--sane What about PostgreSQL? Last time I tried it I had to install it on Windows because of some reason I cannot remember...

<comment><USER42> I do not use Postgress, I use Firebird SQL and I had no problems installing it in WSL.

</comment></comment></comment></comment><comment><USER43> Why is it called Linux, though? There's no Linux there at all IIRC, in the sense that it's not using the Linux kernel.

<comment><USER44> If you're going to be pedantic shouldn't it be "GNU/Linux"?

<comment><USER45> I guess technically MS need to start referring to Windows 10 as GNU/Linux/Windows now.

<comment><USER46> More like GNU/Linux/Microsoft/NT. Windows is more of a distro name such as Ubuntu.

</comment></comment></comment></comment><comment><USER47> Only $300 a license.

<comment><USER48> Isn't there a way to get a free beta version? I got an image once for Virtual Box.

<comment><USER47> Why would you want to?

Windows is for corporates putting spreadsheets in front of coin counters.

For everything else there is Linux (or FreeBSD), which is probably why Micro$oft is porting SQL server to it.

<comment><USER49> Are you being facetious? It seems like you are. I'm 99% sure you have to be, but some people do think and write like that.

Notably the cringeworthy second paragraph and substituting $ for s like this is Slashdot in the 00s.</comment></comment></comment></comment>


Proposal to Add Apple II Chars, PETSCII, ATASCII, Teletext, etc to Unicode [pdf] - <AUTHOR> https://www.unicode.org/L2/L2018/18275-terminals-prop.pdf <comment><USER2> I'd also want MacRoman (and other Mac encodings) -specific characters including the Apple logo in unicode!

If there's shit emojis, why not for-profit companies logo?</comment>


Show HN: Guided Recipe Creation - <AUTHOR> http://recipelabs.com/add/

<comment><USER2> That's awesome. I didn't expect to be guided through the recipe so well. The functionality is cool, but the design doesn't do it justice.

Slap a sleek design on it and this could be something special.

<comment><AUTHOR> Thanks for your feedback. I will definitely be working on the design.

</comment></comment><comment><USER3> "What are the Ingredients?" is a very nice feature in its usefulness and simplicity.

Maybe offer this as a (white-label) service to other sites?</comment>


GoFundMe Bans Anti-Vaxxers Who Raise Money to Spread Misinformation - <AUTHOR> https://www.thedailybeast.com/gofundme-bans-anti-vaxxers-who-raise-money-to-spread-misinformation <comment><USER3> Starting this with a few disclaimers:

1) I unequivocally believe all anti-vaxxers are wrong, 2) I absolutely support efforts to fight their misinformation, 3) I don't even necessarily think it was a bad decision by gofundme to do this;

Now, what I'd like to question is the effectiveness of taking down those campaigns. My points:

1) I doubt that an average user scrolling through gofundme would see and decide to support such a campaign, I'd imagine most of the funding comes from the links being directly shared

2) The above makes me think such campaigns will simply move to a GoFundMe competitor and be equally (un?)successful, effectively nullifying any changes

3) Gives more attention + victim points to anti vaxxers

4) If their discourse is further pushed out of mainstream platforms, does it actually reduce the spread of their ideas or just limit their exposure to counter-arguments and public condemnation?

Edit: formatting

<comment><USER4> Anti-vaxxers are like terrorists: they don't really _do_ much per se, but the FUD they spread does immense harm to society. Defunding & deplatforming such groups is a methodology that is practically inescapable for as long as laymen are liable to believe anti-vaxxers or be afraid of terrorists.

Of course, the real solution is education: both of the purveyors of misinformation and of those who fall victim to it. That's a multi-generational process that should ideally happen in parallel with short-term fixes.

<comment><USER5> >[Anti-vaxxers] are like terrorists: they don't really do much per se, but the FUD they spread does immense harm to society. Defunding & deplatforming such groups is a methodology that is practically inescapable for as long as laymen are liable to believe [anti-vaxxers] or be afraid of terrorists.

You could replace that phrase with many different ideologies. Would you?

<comment><USER6> They're not like terrorists, they are terrorists. Some of these diseases we have vaccines for are vicious and could kill more than any suicide bomber could dream of.

<comment><USER5> What about climate-change deniers? Aren't they killing us all with their ideology?

<comment><USER6> Yes, on an even larger scale.

</comment></comment></comment></comment></comment></comment><comment><USER7> This misinformation is literally killing people. A private company fighting that is absolutely something to celebrate; GoFundMe gets my full support here.

<comment><USER8> Countering "misinformation" by correct information is a far better approach than censorship.

The logical fallacy of "censorship is okay when I know it's wrong" sets such a dangerous precedent, yet it's downright celebrated by America's left.

It's quite frightening.

<comment><USER9> Is this really censorship, though? They aren't removing information, GoFundMe isn't a blogging site, they are simply refusing to do business with people they disagree with. That's more or less a boycott. Is boycotting something or someone censorship?

<comment><USER8> It is in a world where monopolies are a thing.

</comment></comment></comment></comment><comment><USER10> The anti-vaxx delusion is a contagious viral illness of the brain that enables the spread of biological viruses that do physical harm. This is not a free speech issue, it's a public health issue.

<comment><USER11> Did you know that vaccine protection doesn't last a lifetime?

And that all the adults that got vaccinated as a child in the 50s, 60s, 70s, 80s and maybe even the 90s are no longer immune? But none of those people have been required to get immunized again to maintain herd immunity.

This means we've been at 50% coverage or less for decades. Maybe there is some missing information that needs to be discussed?

<comment><USER12> You are saying people are not getting booster shots? My parents and I have ours roughly every other decade...

<comment><USER11> No one that I know (adults) have. When was the last time you got a booster shot for smallpox?

Also, Merck has been caught falsifying their data on at least one of their vaccines for decades. But this is not commonly shared or known.

<comment><USER13> Do you have a reference you can cite for that?

<comment><USER11> Two virologists that worked for Merck:

[https://www.courthousenews.com/Class-Says-Merck-Lied- About-M...](https://www.courthousenews.com/Class-Says-Merck-Lied-About-Mumps- Vaccine/)

</comment></comment></comment></comment></comment></comment><comment><USER14> The one question 'pro-vaxxers' can't answer is: If vaccines work, why would someone fear non-vaccinated people?

Isn't that just taking 'anti-vaxxers' out of the gene pool?

I say this as someone who isn't anti-vaccine _per se_ but only anti-unsafe- vaccines. And the safety of vaccines is very much in question today, which you wouldn't know if you only read and believe the mainstream media.

<comment><USER15> Illnesses killing non-vaccinated people is a health hazard to the innocent. People who can't get vaccines (too young, too sick, immunocompromised) rely on herd immunity to protect them. People who can get vaccines but don't endanger those who can't get vaccines. They also put a unneeded strain on the medical system.

We also have the power to eliminate some illnesses completely so that vaccines are no longer needed in the future generations. We've done this with smallpox and we are close with polio.

As far as "safe/unsafe," that's disingenuous, there's no such thing - <USER2> medical intervention is completely without risk, but we know that the benefits of vaccines on the marketplace today unequivocally outweigh the (very minor) risks for the vast majority of healthy people.

</comment></comment><comment><USER16> I'll stop being anti-vax when the corporations that manufacture vaccines can be held for legal liability. You do know they lobbied congress in the 1980's for legal immunity right? Would you actually drive a car who's parent company had legal immunity against any manufacturing defects? Probably not... Either way, the insert that comes with every vaccine bottle is a great resource. If you're too lazy to dig up the inserts on the FDA or CDC website there is a nice website that correlates many of them here: [https://vaccine.guide/](https://vaccine.guide/) Its a huge money making machine that cannot be sued for medical malpractice. That should raise anyone's flag. To say vaccines are 100% safe means you are either ill-informed or you don't have kids and therefore don't care.

I highly doubt gofundme had a personal conviction over this issue. This is a company that is being influenced by an outside source. That should be concerning.

<comment><USER12> Every time I get a flu shot I get an info packet about the Harm Compensation Program [https://www.hrsa.gov/vaccine- compensation/index.html](https://www.hrsa.gov/vaccine-compensation/index.html)

Is this not a trivial counterargument to your claims: anyone that was harmed by a vaccine is eligible for a lot of money. Yet few people reach for this fund.

<comment><USER16> Not at all. You can spend tons of money to put your case before a special "vaccine court" who rarely does anything while the case drags on and on until you run out of money to fund your own case.

</comment></comment></comment><comment><USER17> What bothers me about the ban is that anti-vaxxers - at least the ones I've read - are not Luddites.

I've never heard an anti-vaxxer say things such as "It's God's (or Gaia's) Will that Johnny died of measles."

They believe, wrongly in my opinion, that vaccines cause other medical problems serious enough to justify not using vaccines. To me, that's legitimate dissent.

Given the stakes, maybe GoFundMe did the right thing.

But what's an acceptable threshold of risk?

Because, for various reasons, anti-vaxxing has become a political problem as well as a health problem. Maybe more so.

The political aspect - i.e. GoFundMe being vulnerable to political charges of endangering the public - is probably what drove GoFundMe to institute the ban.

Which leaves other politically charged uses of GoFundMe vulnerable.

<comment><USER18> > They believe, wrongly in my opinion, that vaccines cause other medical > problems serious enough to justify not using vaccines. To me, that's > legitimate dissent.

I don't get it. How is this any more legitimate than actually being a Luddite and saying "technology and modern medicine is bad"?

Would you say that racism and bigotry against minorities becomes legitimate if it's phrased as "this minority group will give you a disease if you let them near you"? Because that's actually a pretty classic feature of racist propaganda.

<comment><USER17> >that vaccines cause other medical problems serious enough to justify not using vaccines = talks about vaccines.

>this minority group will give you a disease if you let them near you = talks about people.

HN, just fucking delete my account and ban my IP address, as you obviously have a huge fucking problem with my fair-mindedness.

<comment><USER18> Both examples are about diseases. Your claim was that their argument is of a legitimate form because it makes a claim about medical risk. My rhetorical argument was of the same form.

</comment></comment></comment></comment><comment><USER19> I get that anti-vaxers are considered dangerous. Equally dangerous is the revolving door between the CDC and vaccination companies which prevent correct levels of scrutinization when batches of vaccinations or specific vaccines are deemed unsafe. Without this comfortable level of accountability, vaccine companies can move forward indefinitely without supplying realistic testing which could prevent detrimental affects that very rarely occur, but can happen. Furthermore, sending bad batches of vaccines downstream to poorer countries should be illegal. Certainly things like this have happened historically.

Additionally, the way the government has cozied up to vaccination companies to prevent nearly any lawsuit from taking place related to vaccines seems ridiculous. Vaccines do represent a public good, and as such some protection seems appropriate, but to make it seem like the best possible thing we could ever do to protect populations? I think that's a touch overreaching.

People should use vaccines, absolutely. However, vaccine tech has not progressed much in 50 years and part of this may be attributed to the protection of vaccine companies.

<comment><USER7> Evidence?

<comment><USER19> [https://www.cdc.gov/vaccinesafety/concerns/recalls.html](https://www.cdc.gov/vaccinesafety/concerns/recalls.html)

[https://www.cnn.com/2018/07/23/asia/faulty-vaccine-china- int...](https://www.cnn.com/2018/07/23/asia/faulty-vaccine-china- intl/index.html)

[https://www.nytimes.com/2014/09/18/world/middleeast/syrian-c...](https://www.nytimes.com/2014/09/18/world/middleeast/syrian- children-die-after-vaccinations.html)

[https://www.reuters.com/article/us-merck- gerberding/former-c...](https://www.reuters.com/article/us-merck- gerberding/former-cdc-head-lands-vaccine-job-at-merck-idUSTRE5BK2K520091221)

[https://en.wikipedia.org/wiki/National_Childhood_Vaccine_Inj...](https://en.wikipedia.org/wiki/National_Childhood_Vaccine_Injury_Act)

<comment><USER7> Your links don't say what you think they do. 1) You're blaming the CDC for not holding people accountable, then linking the CDC ... holding them accountable. 2) The second two links don't have anything to do with the US, thus aren't in the CDC's purview.

Additionally, none of these talk about intentionally bad vaccines, which is one of your claims.

<comment><USER19> None of your rebuke is actually accurate.

The CDC acknowledges that batches of bad vaccines do occur. How can a vaccine be bad except that (1) it doesn't work or (2) it actually hurts the patient?

Also, people from the CDC do leave to work for pharma companies. That is true...so a revolving door exists. Decide for yourself if that could produce unwanted collusion.

The other links support my claims that Vaccine companies send shoddy vaccines to other countries even if they are rejected here. World health should be about more than profit. Vaccines can be helpful, but not without honest discussions which Vaccine suppliers seem unwilling to have.

</comment></comment></comment></comment></comment><comment><USER20> I don't think this is a free speech issue. What's the difference between promoting a scientific falsehood that puts public health at grave risk and yelling "fire" in a crowded theater other than the proximity of damage done?

<comment><USER21> > yelling "fire" in a crowded theater

Can we stop invoking unsupported non-binding dicta offered to illustrate the decision in a case which has since been overturned and is widely regarded as a travesty infringing on core political speech as if it were some kind of firm legal principal useful as a yardstick against which speech can be measured to determine if it is unprotected?

</comment></comment><comment><USER22> It's weird how much the anti-vaxxers have become the whipping boys of the current US. Is it because they've got both the smell of dirty hippies and also anti-science religious conservatives and also annoying soccer moms so everyone can love to hate them?

Not giving your kid vaccinations is stupid. But on the scale of "ways you can mess up your kid," it's pretty mild. In terms of the amount of harm that non- vaccinated kids do to everyone else, it's extremely near zero. Almost certainly, if you drive a car more than a few times a year, you're endangering those around you more than any anti-vaxxer is.

And if you actually want to convince anti-vaxxers to change their ways, this is clearly not the right way to do it. Pouring hate on people feels (scarily) good in a lot of ways, but it doesn't change the minds of the people you're demonizing. Is there any clearer demonstration of this than the complete persistence of anti-vaxxing sentiment in the face of steadily increasing screams of protest over the last 5 years?

<comment><USER23> > Not giving your kid vaccinations is stupid. But on the scale of "ways you > can mess up your kid," it's pretty mild.

Measles and other dangerous diseases returning to the US after being iradicated is not a small issue. This effects other children's lives. It's selfish and harmful and we have a safe reliable solution.

People have become complacent to the horrible effects of diseases because of the protections vaccines have provided them over the last 50+ years.

<comment><USER22> I don't disagree that people are complacent, but on a factual level, most kids who don't get vaccinations do not get measles. Most who do get measles have a few weeks of discomfort and get over it. Most who do get measles do not give it to anyone else except maybe other unvaccinated kids.

In the years before a measles vaccine, there were about 500 deaths per year from measles (in the US). This was when the population was about half of what it is now, so if we returned fully to that rate, there would be about 1,000 deaths per year from measles today.

There were no deaths from measles in the years 2016 or 2017, per this document from the CDC: [https://www.cdc.gov/measles/downloads/measlesdataandstatssli...](https://www.cdc.gov/measles/downloads/measlesdataandstatsslideset.pdf)

As I said, it's dumb not to get your kids vaccinated. I wish I could get vaccinated to more things! It's like a super power!

But the amount of actual harm that anti-vaxxers are causing is miniscule, certainly deeply out of proportion with the hate that they're getting.

And if you do sincerely desire to keep as many people as possible from getting the measles, rather than desire to feel the rush of heaping hate on people, then again, let me suggest that the current tactics _are not working_ , and that de-escalating the rhetoric around this will do much more to let anti- vaxxers relax and start listening to your data.

<comment><USER24> > I don't disagree that people are complacent,

Good, because you're an example of someone who is complacent. This is what complacency looks like:

> but on a factual level, most kids who don't get vaccinations do not get > measles. Most who do get measles have a few weeks of discomfort and get over > it. Most who do get measles do not give it to anyone else except maybe other > unvaccinated kids.

"Most." "Most." "Most."

Let's say only one child in the entire U.S. will die of measles over the next 10 years. Now, let's say you know it will be your child, or your neice, or your friend's child. Still seem acceptable?

The point is, there is _no_ acceptable level of measles incidence in the U.S.

Zero. Period.

> de-escalating the rhetoric around this will do much more to let anti-vaxxers > relax and start listening to your data.

This is not true. The rhetoric around vaccines started out de-escalated, because everyone thought the benefits were so obvious they did not need defending. That's what allowed anti-vaccine scammers to gain mindshare in the first place. Only by aggressive counteracting the anti-vaccine message will that be reversed.

<comment><USER22> My child won't get measles because my children are vaccinated. But my children will get other diseases because most diseases can't be vaccinated against. And also because I'm not willing to sacrifice every part of my life to make sure that my children have the minimal possible risk of disease.

So my kids will, for example, go to school rather than be home-schooled or tutored.

My kids are allowed to travel on BART, despite their propensity for touching everything and putting their hands in their mouths. And, like, I'll try to teach them not to do that, but it's not like I'll smack their hands.

My kids will probably at some point travel abroad to places where there are disease risks that there aren't in the United States, and while if travel vaccinations are available we'll certainly take advantage of them, we won't refuse to travel to Africa because malaria exists.

Also, my children are allowed to travel by car -- even in the cars of say their friends' parents who I haven't extensively vetted for maximally safe driving habits.

And they're allowed to go into San Francisco and Oakland, cities that are statistically more violent than their home town of San Bruno.

You can't remove all risk from people's lives -- even your own children's -- and if you try to, you end up making bad decisions.

This is a microcosm of what happens when you try to make policy around zero tolerance policies. Look, I wish that everyone would vaccinate their kids. But it simply doesn't make sense to sacrifice every other priority in the world to try to chase down a very small number of people who object to doing that.

And aggressively countering the message isn't working -- which we would have expected if we had seen every other case of aggressive messaging, which broadly speaking is more about virtue signaling than convincing people. Anti- vaxxers today are much, much, much more rooted in their opinions than they were at the beginning.

</comment></comment></comment></comment></comment><comment><USER11> This will inevitably lead to 1984 style censorship. The next 5 things censored en mass will all be "objectionable", but then finally something good, normal or simply against the orthodoxy of the day will be censored that no average person would object to.

But then it will be too late, because everyone supported censoring ideas they simply didn't like being spread.

Then it will be against the law to object to anything that is official censored.

<comment><USER25> Your alternative suggestion then? All services are required to carry all content, regardless of their owner's views?

<comment><USER26> Or make owner-less decentralized platforms where a few humans can't be coerced into cherry picking content to fit a particular agenda.

<comment><USER25> Yeah, you've just created a global child pornography network.

<comment><USER26> Thanks for displaying Ad hominem 101 !

<comment><USER25> I think you might need to look up the meaning of that, pal. The point is – a globally decentralised publishing network also has obvious, quite possibly terminal, problems.</comment></comment></comment></comment></comment></comment>


Why was "goto fail;" added without any other change to that part of the code? - <AUTHOR> Looking at the diff between the two versions of sslKeyExchange.c released by Apple http://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslKeyExchange.c and http://opensource.apple.com/source/Security/Security-55179.13/libsecurity_ssl/lib/sslKeyExchange.c I was trying to come up with a reasonable explanations of how this could have happened, but failed.
Here the relevant part of the diff:

  @@ -627,6 +628,7 @@
           goto fail;
       if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
           goto fail;
  +        goto fail;
       if ((err = SSLHashSHA1.final(&hashCtx, &hashOut)) != 0)
           goto fail;
 How could this ever happen? It does not look like a copy & paste error as suggested in other places, it does not look like refactoring. Was it added intentionally to test something and commited by accident? Is there any possible non malicious explanation someone could come up with? <comment><USER4> Stop this nonsense. There are plainly dozens of reasons that this could have happened accidentally. Literally every single developer has made similar stupid mistake, and literally every organisation has released stupidly broken code.

Yes, there should have been code review, static analysis, and testing in place to prevent that. That'll probably start happening, and you can bet that there will be serious discussions internally about what happened.

If this was the action of a malicious government agency, then it was horribly hamfisted execution. It might offer plausible deniability in some sense, but it's hard to imagine a situation where such an action would be worthwhile, given the resources at the disposal of any such actor.

<comment><USER5> >it's hard to imagine a situation where such an action would be worthwhile, given the resources at the disposal of any such actor.

This needs more defense. I find it hard to imagine a situation where such a minimal and deniable action with such a massive effect _wouldn 't_ be worthwhile.

<comment><USER6> No, it doesn't need a defense. There is no evidence to back up the idea that the bug was malicious. People that have worked on large C codebases have seen crazier things than this. _Routinely_.

I understand that Rails developers believe that all the TLS stacks must have dense rspec test coverage and zero-warnings static analysis passes in their builds, but that isn't the reality for any TLS stack. These aren't Rails apps (and, hate to break it to some of you, but your Rails test coverage isn't doing as much for your security as you'd like to think it is).

This is a nutball conspiracy theory, another example of the tech "community" eating its own rather than focusing on anything that would help mitigate state-sponsored surveillance. And it's happening solely in the service of an "exciting" narrative. The people promoting this bullshit conspiracy theory are, by and large, doing it because they _want_ it to be true.

<comment><USER7> 1\. It is certain that NSA has some very smart people playing with the sources of the Apple crypto-modules.

2\. If you're a NSA boss, and some of your experts told you that you can break SSL in Apple products with adding one line that could be almost certainly attributed to inconspicuous human error, would you try to make a deal with Apple?

3\. If you're an Apple boss, and NSA offers you cache (or other benefits, like competitor intelligence) for adding plausibly deniable bug in your code, would you turn it down?

There is no direct evidence for this case, sure. There is however ample evidence in the Snowden docs that this scenario happens too often for this to be called bullshit conspiracy theory.

<comment><USER8> Remember how Diaspora was supposed to be the private peer-to-peer encrypted Facebook but peers private keys could be read or overwritten by anyone on the Internet? Doesn't your argument suggest "Well we can't rule out the NSA having a man on the inside trying to undermine their encryption"? Heck, why not go all the way: the NSA funded Diaspora to bring Facebook to the negotiating table?

Down this path lies madness. Software has bugs.

<comment><USER7> Yes, we can't rule that. But we could clearly see that the Diaspora codebase screamed incompetence. Apple, on the other hand, has some very high quality products and decades of experience.

Yes, it is quite possible that this is a simple bug. The other option is also quite possible :)

<comment><USER6> It is equally possible that Apple is a giant conspiracy dedicated to concealing the grey aliens who actually control human civilization and are harvesting our brainwaves, which actually function as the raw compute for a giant intergalactic payments call center application, via Flappy Bird. Think about it.

<comment> luke-stanley That's not equally possible, due to Occam's razor: [http://en.wikipedia.org/wiki/Occam's_razor](http://en.wikipedia.org/wiki/Occam's_razor) Plus, the security services have a proven ability and intent. Be serious now.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> It's not true that there was no other change in the code -- there was a change eight lines earlier. It could be a mismerge of the latest upstream code. There was refactoring nearby, and people can make stupid mistakes while refactoring.

I disagree that there's no "reasonable explanation", and so do most other people who've looked at it. That doesn't mean it wasn't malicious, but it means that it has reasonably plausible deniability. (Of course, if you _were_ being malicious, plausible deniability might be important to you.)

<comment><USER10> ++ on mismerge. The change likely won't impact the output binary - <USER2> should issue a warning, which devs might ignore; then the optimizer would remove it as unreachable.

Perhaps the developer deliberately allowed that mismerge to give himself an aura of incompetence/sloppiness, enhancing his plausible deniability when it is discovered that one of his other changes led to an insidious vulnerability. But more likely it was just an accident - if he were malicious, the effect of bringing attention to his code would be highly undesirable.

<comment><USER11> > The change likely won't impact the output binary - compiler should issue a > warning, which devs might ignore; then the optimizer would remove it as > unreachable.

It's not unreachable - it always executes if the if condition is false.

<comment><USER10> D'oh. That's what I get for not paying attention and looking at the indentation instead of for braces. Still, my bet's on mismerge first - <USER3> it'd be worth reviewing that committer's other changes.

</comment></comment></comment></comment><comment><USER12> If you are wondering whether there is a massive conspiracy to make software weaker and to hijack the work of everyone writing networked software and construct a massive surveillance apparatus and use it against enemies of Freedom™ and randomly chosen accidental targets: the answer is _yes_. It has been demonstrated beyond doubt.

If you're wondering whether this particular code is a consequence of all that: probably not, but if it were it would prove anything that isn't already known.

</comment><comment><USER13> A lot of code editors (Xcode doesn't by default, but you can easily configure it to) have a keyboard shortcut for duplicating the current line. I have plenty of times accidentally made changes at the wrong place in a file because I was mistaken about where the cursor was.

The lesson is to always make sure to look at your diffs before you commit your changes.

<comment><USER14> And to have someone else look at your diffs and sign off on them before it's merged into master.

Google / Chrome does this, and so should everyone else, even more so if they're dealing with security.

<comment><USER13> That's a good measure too, although I think with a mistake like this, the person writing the code might be more likely to spot the mistake than someone else.

It also makes me wonder if the diff display shouldn't have a specific notation for duplicated lines, since they are a special case that can easily be mistaken for a trivial _change_ to a line with the way diffs are typically shown.

</comment></comment></comment><comment><USER15> Looks like they also introduced a reference leak on allocation failure:

        @@ -198,10 +198,8 @@
                sslDebugLog("SSLEncodeRSAKeyParams: modulus len=%ld, exponent len=%ld\n",
                        modulusLength, exponentLength);
             OSStatus err;
        -    if ((err = SSLAllocBuffer(keyParams,
        -                       modulusLength + exponentLength + 4)) != 0) {
        -        CFReleaseSafe(exponent);
        -        CFReleaseSafe(modulus);
        +    if ((err = SSLAllocBuffer(keyParams,
        +                       modulusLength + exponentLength + 4, ctx)) != 0) {
                 return err;
                }
             uint8_t *charPtr = keyParams->data;

Note the removed CFReleaseSafe(exponent) and modulus. All other return paths in SSLEncodeRSAKeyParams() call CFRelease(exponent) and modulus.

This is why you use goto fail and not early returns.

</comment><comment><USER16> Maybe another check was done between those two goto fail but later was deleted because didn't make sense. The extra goto fail was left behind.

</comment><comment><USER17> Yes people make mistakes.... that is why code in a file called sslKeyExchange.c ffs can be expected to be reviewed by another person at apple BEFORE the commit enters a release candidate. A double goto fail; is something that sticks out to anyone looking at that commit line by line. Seems like apple handles application security like any 6 dude valley startup.

My commit suggestion: \- goto fail; \+ fail;

</comment><comment><USER18> More importantly, why Apple doesn't run test suites, basic checks? Test driven development must be everywhere

<comment><USER19> TDD might be useful for unit tests (even that I'm not convinced of) but not for integration tests.

The bug happens very deep inside the handshake protocol and it's extremely hard to test it automatically.

<comment><USER20> Right, this is a much stronger case for static analysis and warning-free builds. This change caused dead code. If that code was supposed to be dead, comment it out.

<comment><USER21> If the code is supposed to be dead, DELETE it. Do not comment it out.

If the code doesn't belong there, get rid of it. If, for whatever reason, you want to show the reader that code used to be there, delete it and leave an explanatory comment. If you're commenting it out because you're not confident in taking it out or you plan to re-enable it in the future, well, that's what you have source control for.

<comment><USER20> I don't agree. Or I do to a point, but it's a relatively weak point. I agree code should be yanked if there's no reason to be keeping it around. I don't think there's never reason to be keeping it around. Sending people to figure out which version of the repository had the relevant piece of code (which is now correspondingly less likely to have been updated at all when surrounding code changed) doesn't make sense if you genuinely expect it will be relevant again soon.

</comment></comment></comment></comment></comment><comment><USER22> Think of change, copy, paste, do something else that you suddenly thought of, forget because lunch, commit without looking. (TODO: Write unit test.)

Or a conspiracy. At this poing, I just don't know any more.

</comment><comment><USER23> Braces, y'all!

This is why you always, always, ALWAYS put braces around your if()s.

(I'm not religious about what line the open brace goes on, but I will reject any code review that skips the braces entirely.)

<comment><USER24> Also, you almost never need to use goto.

<comment><USER25> This isn't goto's fault. A return, or a "finished = true;" or a ton of other code could have had the same result. Using a goto means it is easier to find it than some other similar mistakes.

<comment><USER26> All three of those patterns are something which would lead me to consider is there a more functional-style option available to rewrite the method in question. I'll take a gigantic nested if over a split-end method (multiple exit points) any day of the week ;) But of course, such things cannot be avoided completely, nor will avoiding them magically eliminate all bugs in the universe..

<comment><USER23> Hm, and I'm of the opposite opinion. I like methods that fail early. Gigantic if-chains are hella-hard to parse.

I should go consult Code Complete again, actually...

</comment></comment></comment></comment></comment><comment><USER27> This kind of mistake is why I always use curly braces with if() statements when I write C, and double-check the results through Vim's auto-indentation.

</comment><comment><USER28> A few years ago, my son would watch "Finding Bigfoot.". Someone said they saw a bigfoot running off into the woods the narrator would say, "The bigfoot must have been frightened, so it's exactly what I would expect a bigfoot to do."

Another person would say, they saw a little bigfoot standing on the river bank and the narrator would say, "That's exactly the sort of place we would expect to see a baby bigfoot." [1]

If someone said they saw a bigfoot shopping in Walmart, we could expect to hear, "That's exactly the sort of a place a bigfoot would shop."

The conspiracy theorists and the honest mistake theorists are both finding bigfoot. On the one hand, it's exactly the sort of exploit a state security organ would like to create and on the other its exactly the sort of error a programmer can make in C. And neither side believes in the other's Bigfoot.

[1] We talked about the actual words that were used by bigfoot hunters to advance the story

</comment><comment><USER29> I had an accidental line duplication in git the otherday trying to do a by- line commit with a visual tool.

</comment><comment><USER30> I'm 100% convinced it's malicious... But otherwise, it could be explained by the coder adding another check

       If(err==my_dev_string)
         goto fail;

Then before committing, sending the diff to a colleague who emails back "you forgot a debug there, besides that ship it"

He removes only one line of two and ships.

And of course i always try to attribute those things to incompetent other than malice, but since in this case there was probably money and bribes involved so i tend to the later.

<comment><USER31> > but since in this case there was probably money and bribes involved

The cognitive process above is really sad: "I speculate this is what happened as a natural outcome of my other speculation"

<comment><USER30> my two speculations are really opposite (and most believable one to defend the coders innocence, if that was the case). i presented both and pointed out the one i have a gut feeling towards.

</comment></comment></comment><comment><USER32> I appreciate the coding standard at a previous employer ([http://www.astronautics.com/](http://www.astronautics.com/)) a little bit more now, that INSISTED that braces always happen, even for one line conditionals like these. It was kind of irritating at the time though.

</comment><comment><USER33> i do this all the time in vim. all it takes is one extra keystroke 'p' to do this.

if i were to take a guess, the programmer first typed out all the if conditional expressions, then went in and pasted 'goto fail' out of a buffer after each one, and accidentally did it twice there.

<comment><USER34> That didn't happen - look at the diff in the OP.

<comment><USER33> that's bullshit. you don't know that it didn't happen - there's no telling what he did with the code in the time between commits. he could moved things around 20 times, finally ending up in the same place, with the exception of the accidentally pasted a line.

plese use some imagination before jumping to conclusions. a diff tracks changes at points in time, not an editing session.

</comment></comment></comment><comment><USER35> Common just say, we all know you what you are thinking. Bruce Schneier said it. You should know that we know what you are thinking -- yes there is a very high chance it was put there deliberately.

</comment><comment><USER36> that's like telling programmers that Apple doesn't use a repo system, so there could not be any trace of this.

And why don't we hear anything the guy who might have done this mistake IF IT WAS AN ACTUAL MISTAKE ?

I don't like conspiracy theories, but I'd be apple, I'd fire the guy for incompetence. I mean of all the code that has to be secure, you have to check this one.

</comment><comment><USER37> this looks exactly like a copy paste error - there are also plenty of shortcut keys for duplicating lines or transposing them...

</comment><comment><USER38> Sometimes people make mistakes.

<comment><USER39> Don't know why you got voted down. You make a very decent point!</comment></comment>


Amazon relaxes return policy for holidays - <AUTHOR> https://www.cnn.com/2019/12/18/business/amazon-expands-free-return-policy/index.html <comment><AUTHOR> Such a contrast to an article two days ago about woes of online returns: [https://www.bloomberg.com/news/articles/2019-12-16/how-to- re...](https://www.bloomberg.com/news/articles/2019-12-16/how-to-return- online-purchases-for-free-retailers-hate-it)</comment>


Evil Code Competition - <AUTHOR> http://www.wired.com/wiredenterprise/2013/04/underhanded-c-contest/

<comment><USER2> $200 seems like a rather small prize.</comment>