Researchers install world's highest webcam to provide a view of Everest - <AUTHOR> http://www.gizmag.com/worlds-highest-webcam/20004/?utm_source=Gizmag+Subscribers&utm_campaign=81c4ce8ef3-UA-2235360-4&utm_medium=email

<comment><USER2> I remember stumbling on this map a while back,

<http://www.newscientist.com/gallery/small-world/2>

<http://www.newscientist.com/gallery/small-world>

The Tibetan plateau, according to it, is one of most remote places left. It'd be interesting to see an update on the map in a few more years.</comment>


Anyone used janrain or gigya for socnet authentication? - <AUTHOR> http://www.janrain.com/janrain-products-overview <comment><USER2> You can see a list of some of Janrain's customers at <http://www.janrain.com/customers/customer-showcase></comment>


Ello Is No Facebook Killer - <AUTHOR> http://mashable.com/2014/09/29/ello-is-no-facebook-killer/

<comment><USER2> Can someone share some invites please? Ello doesn't look too bad either.</comment>


Night sky from eye to telescope: Milky Way panaroma at 800 mega-pixel [swf] - <AUTHOR> http://www.sergebrunier.com/gallerie/pleinciel/360.swf

<comment><USER2> Really cool, but why is the progress indicator right in the middle of the display!?

</comment><comment><USER3> This image of the sky is really a mosaic consisted of about 300 photographed fields each four times, what represents right by 1200 photos there. All were taken with a digital case Nikon D3 and its objective of 50 mm of focal diaphragmé in 5,6.

Every image was exposed for 6 minutes, the visible movement of the sky, due to the rotation of the Earth, being corrected by a small equatorial frame, the axis of rotation of which, turning in 24 hours, in the inverse direction of the movement of the Earth, was strictly aligned on the axis of rotation of our planet.

<http://sergebrunier.com/gallerie/pleinciel/>

</comment><comment><USER4> Does any one have any idea why there would be 14 "rays" coming off each of the bigger stars?

Also, Microsoft's WorldWide Telescope is one of the best "Google Earth for outer space" things I've seen. <http://www.worldwidetelescope.org/>

<comment><USER5> <http://en.wikipedia.org/wiki/Diffraction_spike>

</comment></comment><comment><USER6> This has taught me that if I want to show 800 million pixels then I need a CDN.

</comment><comment><USER7> I get a permission error when I click the link.

<comment><USER8> Me too, but here's the APOD story from that day: <http://apod.nasa.gov/apod/ap090926.html>

</comment></comment><comment><AUTHOR> * ESO GigaGalaxy Zoom <http://www.gigagalaxyzoom.org/about.html>

* NASA Astronomy Picture of the day <http://apod.nasa.gov/apod/ap090926.html>

</comment><comment><USER9> i want to see well known constellations highlighted!

maybe I'm just spoiled by Google SkyMap [http://googleblog.blogspot.com/2009/05/planetarium-in- your-p...](http://googleblog.blogspot.com/2009/05/planetarium-in-your- pocket.html)

</comment><comment><USER10> What about zooming in?

<comment><USER11> the + key seems to work for me...

<comment><USER12> Scroll wheel works too</comment></comment></comment>


Ask HN: Please increase the width of expand/collapse button - <AUTHOR> I browse HN several times a day on my mobile phone. It is difficult for me to collapse and expand the comments to reach the last read comment after a few hours.
More than half the time I can't tap on the Toggle anchor, and when I do, I accidentally tap on the timestamp instead of the [-] or [+].
I think adding a space around - and + would save me (and probably many others) a lot of frustration.
NB: Ask HN, because I am also looking for feedback from the community. Thanks! <comment><USER2> Agreed. Actually, almost all links are too small on mobile. For example, it's easy to log out when you try to go to your user page, or downvote a comment you intended to upvote.

<comment><AUTHOR> I don't have enough Karma to downvote a comment, but I can understand what you mean. That's probably worse than what I am facing.

</comment></comment><comment><USER3> I have found it effective to mail firstname.lastname@example.com with requests like these. They are responsive.</comment>


Consul 0.7 - <AUTHOR> https://www.hashicorp.com/blog/consul-0-7.html <comment><USER2> Have to say consul is one of the most useful tools for service discovery i've ever used. Only feature I want is better support for multiple environments in the same cluster set.

<comment><USER3> When we used this, we used the first directory to be the env, so it looked like.

        /prod/...
        /stage/...
        /dev/...
        /feature-xyz/...

It's not elegant, but it made for really simple scripts that let us prepend /${env} to every key to access what we needed.

And of course, each service per env had different access tokens so apps in the stage env couldn't read prod keys.

</comment></comment><comment><USER4> I've released the latest .NET API too for the dozens of us that use .NET with Consul. It features full (.NETStandard 1.3) support of Core in this version! [https://www.nuget.org/packages/Consul/0.7.0](https://www.nuget.org/packages/Consul/0.7.0)

</comment><comment><USER5> Consul combined with consul-template for dynamic config changes in your environment is an extremely powerful solution which just works with minimum fuss.

Works well when deploying clusters such as zookeeper, allows all the nodes to discover each other automatically and work out their id number.

<comment><USER6> I am curious, why you are using both ZK and Consul as there is much overlap there.

<comment><USER7> There's lots of software you might operate that requires zookeeper: kafka, solrcloud, the hadoop ecosystem, etc.

Meanwhile, consul has lots of functionality built in that makes it a snap to use for service discovery within your existing infrastructure. You would have to build all this yourself on top of zookeeper, which just provides a distributed, consistent key-value store.

So it's easy to see why you could end up with both.

[https://www.consul.io/intro/vs/zookeeper.html](https://www.consul.io/intro/vs/zookeeper.html)

</comment></comment></comment><comment><USER8> The underlying Serf update was also just released: [https://www.hashicorp.com/blog/serf-0.8.html](https://www.hashicorp.com/blog/serf-0.8.html)

Awesome company with awesome products.

</comment><comment><USER9> Thanks for some great tools guys, and a shout out to Fabio another great tool built on top of Consul [https://github.com/eBay/fabio](https://github.com/eBay/fabio)

<comment><USER6> How does Fabio handle being a single point of failure?

<comment><USER10> This might be naiveté on my part, but I would assume you run multiple Fabio instances and treat it like you would any other LB.

Do you mean something else by your question?

<comment><USER6> Yes I meant something different. Generally with a load balancer the load balancer hosts that VIP(s) that your public facing DNS A records resolve to. In order to avoid a single point of failure you employ things like keepalived or ECMP/BGP etc.

<comment><USER11> The general setup seems to be that you have a public facing LB which just forwards all incoming traffic to any available fabio instance which handles the dynamic routing. fabio does not solve the public VIP problem for you.

Disclaimer: I'm the author.

</comment></comment></comment></comment></comment><comment><USER12> Glad to see both etcd and consul support changing multiple keys atomically which I think is a critical feature.

Has someone recently compared the two in production?

Both projects have made some bigger changes in their Raft implementation since the last Jepsen test. I'd love for Kyle to re-do the test and also take into account the transaction feature.

</comment><comment><USER13> The new Lifeguard feature looks really neat. False monitoring alarms are a big issue. If they happen a lot you begin to not trust a real alarm and ignore them - the boy who cried wolf as the cliche goes.

</comment><comment><USER14> Wish they would fix the issue with the watch triggers.

<comment><USER6> What issue is that?

</comment></comment><comment><USER15> A great release with lots of important bug fixes that were giving us issues.

</comment><comment><USER6> Has anyone upgraded from 0.6.x yet? Care to share your experience?

</comment><comment><USER16> Grats Mitch and team!</comment>


Extracting 10 years of USAspending.gov data into CouchDB - <AUTHOR> http://www.full360.com/blog/Extracting-Government-Spending-Data-Talend-Stored-CouchDB <comment><USER2> off topic, but that logo sure looks familiar...

<http://images.google.com/images?q=xbox+360+logo>

<comment><USER3> And the domain is "www.full360.com" as well. Perhaps they originally wanted to be a games blog :-)

<comment><USER4> ha! no we were never meant to be a games blog - full 360 was about touching all points of analytics in the enterprise. There are only so many ways to represent 360 degrees - so it ended up that way unintentionally

</comment></comment></comment><comment><AUTHOR> Disclosure: Part of my responsibilities at AWS include the AWS Public Data Sets program

<comment><USER5> Nice. As an aside, would it be possible to share your thoughts about the performance of CouchDB when loaded-up with that much data?

<comment><USER4> Loading the data, including parsing the xml and converting it to json was about 50,000 records per hour on a c1.medium aws instance.

Just transforming the data from one json format to another and loading to a new couchdb is much faster - about 200,000 records per hour. The server does trip over sometimes on the bulk load, and requires a restart. This happens once every 600-700k records

Reading the data is extremely quick, While creating the views on an existing database is slow, once created, accessing the data is very fast using the keys in the views

<comment><USER5> Thanks!

</comment></comment></comment></comment><comment><USER6> this would be a great addition to public data sets, though I imagine for that to happen it would need some sort of viable plan to keep the data in sync

<comment><USER4> Now that I have this up, I was hoping to be able to work with the usaspending.gov team to get a feed or extension to the api, that gives me the changed records since the last upload. Then update the aws snapshot with this. Do this on the same timeline that the usaspending.gov does it, monthly</comment></comment>


Is Python emerging technology? - <AUTHOR>

Is Python lately becoming mainstream in everyday development in startups vs. say ruby and RoR?<p>What are the FOSS libraries & recent developments saying so? <comment><USER2> >Is Python lately becoming mainstream in everyday development in startups vs. say ruby and RoR?

[http://jakevdp.github.com/blog/2012/09/20/why-python-is- the-...](http://jakevdp.github.com/blog/2012/09/20/why-python-is-the-last/)

> What are the FOSS libraries & recent developments saying so?

Python has universe of libraries. Just google "What's new in python"</comment>


Show HN: I built a domain name generator for your side-projects - <AUTHOR> https://www.phracy.com <comment><USER2> The first result it generated was polyacetlyne (or something similar). I didn't check if it was actually available.

The second was musey.com which was already taken.

Third was koreatown.com, also taken.

Putting aside that most of these names are probably not something I'd randomly go with, the fact that they're taken means they aren't available for use anyway.

<comment><AUTHOR> Thank you for your feedback. Problem fixed! Now the site only display words with length <= 8 and unregistered.

<comment><USER2> Nice. How are you pulling the dictionary terms for each word?

</comment></comment></comment><comment><USER3> Very well done. I got names that really surprised me that they were available. Good job!

</comment><comment><USER4> I love clever domain name projects. I got bobicle.com, pretty good!

<comment><AUTHOR> I'm glad to hear that! :)

</comment></comment><comment><USER5> I got "interbilateral"

<comment><AUTHOR> If you're not satisfied, you can refresh to get another one ;)</comment></comment>


Bcrypt Step-by-Step - <AUTHOR> https://qvault.io/2020/08/24/bcrypt-step-by-step/ <comment><USER2> I was curious about why OrpheanBeholderScryDoubt was chosen, found a unanswered question on security.se[0]. Did some more research, and found out the likely reason:

Most probably just a nod to OpenBSD (look at the initials), since the algorithm was made for it. Here[1] is the original commit that introduced the string.

[0]: [https://security.stackexchange.com/a/237690/2876](https://security.stackexchange.com/a/237690/2876)

[1]: [https://cvsweb.openbsd.org/cgi- bin/cvsweb/src/lib/libc/crypt...](https://cvsweb.openbsd.org/cgi- bin/cvsweb/src/lib/libc/crypt/bcrypt.c.diff?r1=1.2&r2=1.3&f=h)

</comment><comment><USER3> > Why not compare passwords directly?

Back in the days before hashed or encrypted passwords, there was an interesting security hole in TOPS-10 on the PDP-10 due to direct password comparison.

Guess the password "aaaaaaaa", but put it in memory so that a page boundary falls between the first and second "a", and the second page is not resident.

TOP-10 allowed a user process to ask to handle its own page faults. Do that.

Now get the system to check the password. If your page fault handler gets called, you know that the password comparison got past the first "a" and tried to check the second "a". If you get a "wrong password" error, you know that the first "a" was wrong.

In the latter case, bump the first character and try again. You can discover the first character this way in at most N tries, where N is the number of characters in the character set used for passwords.

One you have the first character, repeat, this time with the page boundary between the second and third characters. Similar for the rest of the characters.

TOP-10 had lots of interesting security oversights. For example, the login system call, which was used by the login program to actually log you in once it verified your credentials, did not actually require any privileges. Its only restriction was that it only worked when executed by a process that was not logged in.

It turned out the login program was not the only program that could be run without logging in. You could also run the program to show the print queue. That program had a command to run other programs. Thus, you could walk up to any terminal that no one was logged in on, run the queue program telling it to run the debugger, and then from the debugger execute a login system call to login to any account you wanted. Oops.

TOP-10 also had some security things it did way better than Windows or Unix do today, such as access control lists. It used a totally different model than the "ACL as part of the file metadata for the file the ACL controls" model.

Instead, the way ACLs worked is that first the system checked the normal file permissions. If they allowed the access, it was allowed. If they denied the access, it then checked a flag that said the caller wanted to check ACLs. If that flag was not set, the access failed. If the flag was set, the kernel sent a message to a user-mode daemon, FILDAE, describing the desired access. FILDAE then got to decide if the access should be allowed or not.

The way FILDAE worked is that a user could have a file, ACCESS.USR, which FILDAE consulted. I don't remember if it looked for ACCESS.USR in the same directory as the file someone was trying to access, or the home directory of the file owner, or something else.

ACCESS.USR contained access rules, one per line. An access rule could specify a file or files (wildcards were allowed), a user (wildcards allowed), a group (wildcards allowed), an accessing program (wildcards allowed), type of access, and whether it was allowed or not.

So for example, if you wrote a game and wanted to maintain a high score file, you could put rules in ACCESS.USR that specified that anyone could write to that specific file if and only if they were running your game.

You could develop simple naming conventions that fit your security model, such as files whose name started with "pub" in a directory were publicly readable, and files whose names started with "prv" were not, and you could easily make exceptions for particular files or people or programs.

I think this fits in a lot better with the way most people naturally thing about access rules, making it a lot easier to avoid ACL mistakes.

I'd like to see a FILDAE for current systems. (Although to be fair, it does add some complexity that ACLs in metadata do not have. Because it was a separate daemon, there was the issue of communication between it and the kernel. People found some bugs that let them get FILDAE and the kernel confused about which FILDAE replies went with which requests).

<comment><USER4> That page fault issue is mentioned in books about OS design as an example of how some features (like being able to register user space callbacks for page faults) can have unintended consequences.

<comment><USER5> Indeed; I've always known it as the Tenex bug [1], the Tenex being the system designed by BBN prior to being bought by DEC and renamed to TOPS-20.

[1] [http://www.bwlampson.site/33-Hints/Acrobat.pdf](http://www.bwlampson.site/33-Hints/Acrobat.pdf)

</comment></comment></comment><comment><USER6> Step 1) Use Scrypt instead

Step 2) There is no step 2

<comment><USER7> For the vast majority of developers, bcrypt, scrypt, argon and PBKDF2 provide functionally equivalent security.

It's not generally productive to nitpick between secure password hashing/key derivation functions. Unless you specifically know you can't use one of these in particular, you should just pick whichever one has a safe implementation in a secure cryptographic library that you can use.

Basically, just don't use MD5, SHA1, SHA2, SHA3 (including Keccak and the other contenders) or some non-cryptographic hash function.

<comment><USER6> While I agree with the _sentiment_ of what you're saying, I take issue with this part specifically:

> _For the vast majority of developers, bcrypt, scrypt, argon and PBKDF2 > provide functionally equivalent security_

1) The "vast majority of developers" should not be implementing login systems, period. The chances most people have of not falling for any OWASP gotcha, making sound security choices, and implementing them correctly, is pretty much nil. Leveling the argument to this makes many things that should not be done sound passable.

2) They do not, categorically, provide "functionally equivalent security" (especially not for bare PBKDF2). This is a myth people believe in because they normalize their perception of deviant behaviour[0], and frame the situation as "if my database never gets pwned, any one of these is fine", which is just an argument based on wishful thinking, akin to "I can drive recklessly as long as I don't crash", but we don't use this reasoning to nullify seat-belts: the choice of algorithm is important precisely, and perhaps exclusively, for when all your other security mechanisms failed.

The reality though, is that more often than not, when databases gets pwned you never find out about it because monitoring and security practices is often lackluster, and then you keep believing that these things don't matter.

[0] [https://en.wikipedia.org/wiki/Normalization_of_deviance](https://en.wikipedia.org/wiki/Normalization_of_deviance)

As a general rule for their security properties: _Scrypt > Argon2 > Bcrypt, and PBKDF2 should be avoided_. You should prefer the first one of these you can find with a robust implementation (which as @lanecwagner pointed out may not always be Scrypt, and that's fine, as is Bcrypt if you have implementation constraints)

<comment><USER8> No. Your parent was right, it doesn't really matter.

The password hashes buy you an improvement for the narrow range of passwords that are bad but not _that_ bad against adversaries who are powerful but not _that_ powerful. It's pretty much the definition of a marginal win. Which hash you choose slightly tweaks the margin.

It's essentially impossible that this is the lowest hanging fruit for your system security and so "use a different password hash" ought to be nowhere near close enough to the top of the TODO pile to get done if you're already using _any_ of these decent password hashes listed such as PBKDF2.

If your users have strong passwords (e.g. a 20 alphanumeric random password from a typical password manager) it makes no difference at all. Even plain MD5() of such a password is as safe for the user and for you as Scrypt or Argon2 or other choices.

If your users have very weak passwords then once again it makes no difference. Your heavily tuned Scrypt password hashing doesn't prevent me guessing that Steevo412's password on your site might be something obvious like "letmein" \- on a lowly mid-range laptop before I get bored.

So all this work is to achieve a marginal improvement in the middle. Maybe if Steevo412 has picked "LetMeInNOW" and maybe the script kiddies who stole the database ran out of stolen Amazon credits, they don't "crack" his password this time. Maybe.

And none of this makes you any safer from inadvertently leaking the plaintext passwords, which your system unavoidably needs to know during authentication, or numerous other pitfalls that have nothing to do with dick-measuring contests about which hash is better.

 _OR_ if security actually is important you could deploy something that's actually a clear improvement such as WebAuthn and stop trying to sweep the problems with password storage under increasingly complicated rugs.

<comment><USER6> > _Which hash you choose slightly tweaks the margin_

Yes, but only if you assume that an adversary's power is stable over time, and that it's safe to amortize the risk over an extended period of time, both of which are wrong assumptions.

> _If your users have strong passwords (e.g. a 20 alphanumeric random password > from a typical password manager) it makes no difference at all_

Yes, except that is not the world we live in, which makes this a pointless argument.

> _If your users have very weak passwords then once again it makes no > difference. Scrypt password hashing doesn 't prevent me guessing that > Steevo412's password might be something obvious_

> _None of this makes you any safer from inadvertently leaking the plaintext > passwords, which your system unavoidably needs to know during > authentication_

Yes, if you frame the question as "being able to defend against threat models you can't effectively defend against under this authentication model" then indeed none of this matters, but that's a self-propelling argument, and also not the discussion we're having.

The discussion we're having is that given we _know_ password-based auth is a bad security model, and that people have shit security practices, how do we squeeze the most value out of whatever entropy is given to us, in a way that will last as much as possible, since passwords are often recycled, rarely rotated, and you can get pwned decades into the future because of a leak that happened in 2004.

Password-based auth is a reality, and will keep on being for a long time. It's just not a defensible position to argue that there is no point in leveraging given entropy to the max because "we're all doomed anyways", or that since it's a bad model we shouldn't care.

The goal is explicitly to protect knowingly reckless users from themselves. Saying that "if they all used random passwords from a password manager it wouldn't matter" is not realistic or helpful.

> _If security actually is important you could deploy something that 's > actually a clear improvement such as WebAuthn_

I don't think anyone at any point in this thread defended passwords as a solid threat model, and I made this same point in another comment. WebAuthn is awesome, but passwords are a reality and will keep on being for a foreseeable future, we just have to deal with it</comment></comment></comment></comment></comment>


Infolio: Clean and simple task management (and free forever!) - <AUTHOR> https://www.infolio.co/ <comment><AUTHOR> Infolio is tailored for collaboration with its dedicated project chats and visual boards for information sharing. Advanced features include custom data fields for lightweight CRM activities, multiple views (board/table/calendar view) and integration with popular cloud services like Google Drive, One Drive, and Dropbox.

</comment><comment><AUTHOR> Infolio is a task and project management solution for teams and individuals, packed with features, yet easy to use. Built from the ground up to be intuitive and simple, but flexible enough to accommodate teams of various sizes.</comment>


NetBSD Network Security Audit - <AUTHOR> http://blog.netbsd.org/tnf/entry/network_security_audit <comment><USER2> Maxime Villard has been doing great work finding lots of bugs, many with a code scanner he wrote called Brainy. As an OpenBSD user I've been watching with interest from the sidelines. More info on Brainy results:

[https://www.m00nbsd.net/474b193ce624a19d39a2286d73f06826.htm...](https://www.m00nbsd.net/474b193ce624a19d39a2286d73f06826.html)

Take a look! There is likely software that you use in the list - for instance, one of the bugs is a memleak in OpenSSH.

I don't use NetBSD but I just donated $20 to the NetBSD Foundation anyway. Thanks for sharing code/patches!

<comment><USER3> What is this site supposed to show? There isn't any information/documentation about Brainy, what it is all about or even a way to download it.

<comment><USER4> Brainy isn't open source or publicly available, you can click on the project names in the list to see its scan results.

</comment></comment></comment><comment><USER5> How does one go about conducting such audits? Is it just a case of looking at the code long with an experienced eye to spot potential flaws? Or are there standard techniques and tools that people follow?

<comment><USER6> There are a bunch of different approaches.

The simplest and probably the most common is to simply read the code. With experience, patterns of vulnerabilities pop out at you; also, you get good at quickly eliminating code that isn't likely to be in the critical path of a vulnerability, allowing you to focus on the code that is.

Some people start from patterns and work backwards through code looking for reachability. 10 years ago, you might have done that by sweeping for memcpy's and working back to inputs. Nowadays you'd probably be looking for pointer/length math, or allocations and frees.

A primitive automation technique is get the target hooked up to a debugger and then run a blind fuzzer at it looking for faults. More advanced fuzzers will track basic block coverage and tune inputs to reach new paths.

If you're really committed to a particular project (like, someone's paying you to do it, and you have a fair bit of time), you might hoist the code out of its natural setting and build a test harness for it, so you can fuzz it "in the abstract" without having to deal with any of its surrounding code. I've done that for OS work before (you'd be surprised how much of a kernel you can "port" back to userland, if all you need to do is exercise logic).

Peers of mine have also instrumented virtual machines like QEMU to do this kind of testing.

Finally, the most modern way to do this kind of work is to generate models for the code and then use provers to verify things about them. SMT solvers were all the rage for this a few years ago; my sense is that code proving tools have gotten more interesting than that since then.

<comment><USER7> You can already run NetBSD in userland (rump kernel).

<comment><USER6> Right, I'm not being very precise; you don't necessarily want the whole kernel (because then you have to model inputs for all the interactions with all the kernel subsystems), but rather to isolate the one component under test.

</comment></comment></comment></comment><comment><USER8> >I stumbled across a PR from 2010, which was briefly saying that PF's TCP-SYN entry point could crash the kernel if a special packet was received. Looking at the PF code, it was clear, after two minutes, where the problem was.

I wonder how often problems like this languish in bug trackers (due to a shortage of developer availability? flood of low-quality bugs? other problems?)

<comment><USER9> Maybe such things could be solved by having a bug tracker linked to a sort of CI system where you could upload code/tests/etc to _demonstrate_ the bug in question

<comment><USER10> That already exists. Simply create a failing test as a separate commit then have the fix be a subsequent commit.

</comment></comment></comment><comment><USER11> Glad he is sharing his findings with OpenBSD and FreeBSD too. Great work.

<comment><USER12> Since he is paid to work on NetBSD, I wonder if his work on OpenBSD and FreeBSD will earn him anything. But really glad they are shared among BSD lands.

Off Topic Questions, is NetBSD still being used in Appliance? Apple AirPort used to use it as OS, but now it has been discontinued.....

</comment></comment><comment><USER13> it would be great if FreeBSD could fund some more research/auditing!

</comment><comment><USER14> This is great news. Since they took a beating in the last security findings in code that was not even enabled by default. Leading to it seeming much more serious than it was.

</comment><comment><USER15> More proof that networking should be separated from the kernel.

<comment> yjftsjthsd-h If we want anybody to buy into it, this needs to not crater performance. Now, in some cases kernel bypass is actually used to increase performance, so I have hope; we just need a fast communication method in user space so other programs can use our new stack. And for adoption, we should ideally be able to intercept existing network calls (library override?).

...huh, that actually sounds plausible. Have I missed anything?

</comment></comment><comment><USER16> I thought an audit was just analysis but it looks like the author is also making changes to the code as well.

</comment><comment><USER17> Why don't they just write the network stack in Rust? Then we would know it's secure with no audit required.

<comment> yjftsjthsd-h If they rewrote it in Rust, we would have reasonable assurance that there were no memory safety errors. This is not the same thing as secure.</comment></comment>


Clinton's Private Email System Gets a Security "F" Rating - <AUTHOR> http://politics.slashdot.org/story/15/03/10/1519220/clintons-private-email-system-gets-a-security-f-rating <comment><USER2> This is all a poor excuse. The government should seize her personal servers immediately and look through the emails.</comment>


Case Study: How We A/B Tested Our Way to 72% Opens and 23% Click Through Rate - <AUTHOR> Over the past 2 months, we've sent thousands of emails and A/B tested everything from our copy, subject, send time and sender name. Instead of wasting your time with the boring stuff, let me get to the result of all that testing, our best email campaign yet:
<comment>--- Subject: Quick Question, [First name]
Copy: Hi [First Name],
I'm Soroush, founder and CEO of Slik, and I wanted to reach out and connect.
Slik is a tool that let's you find anyone's email in less than a second(how I found yours). I personally know the pain of having an email bounce, and not being able to connect, which is why our emails have a 95% deliverability rate.
I know you're working to accelerate growth at [Company Name], we've helped everyone from startups to enterprises grow faster. Is this something you're interested in as well?
Here's the link to signup: https://slik.ai/. You'll get 10 free emails to try it out, and after that, you can upgrade starting from only $30/month.
Looking forward to hearing any questions or feedback from you, [first name].
Best, Soroush </comment><comment>---
This email got a 72.32% open rate and got a 22.87% click through rate. Although this was our best email, here are all the pieces that went into it and everything we tested:
- If more than 7-8% of your emails bounce OR the number of people who unsubscribe is more than 2.5% you will start to ruin your SMTP reputation and your emails will go to spam
- Only have 1 link in your email - Make your pitch very fast and focus on one main selling point(95% delivery in our case) - Make the last line personalized - Personalize the subject line - Ask a question right before your call to action
Feel free to copy our template, hope you benefited from our experience in some way. Don't hesitate to ask any questions, I know more than I should about email. </comment><comment><USER2> This feels like a cold email to the HN community vs. a case study or even outline of what you did to A/B test.

</comment><comment><USER3> @wilozxc, thanks for this!

what did you use to A/B test, adjust, and track?</comment>


Show HN: Find great brandable domains thanks to Randator AI - <AUTHOR> https://randator.com <comment><USER2> That is so cool. I like the way it combines words. Does it also check domain availability at the same time?

<comment><AUTHOR> Yes, I am also surprised. In fact, Randator was generated by itself, I introduced the keywords: brand, name and generator, and one of the suggestions was Randator :-)

Yes, domain availability can be checked with the kind of circled arrow, domain extension can be also change with the arrow close to the current extension.

It also checks name availability on social media and provides an estimated value of the domain, besides the current domain cost.</comment></comment>


Universal ancestor of all life on Earth was only half alive - <AUTHOR> https://www.newscientist.com/article/2098564-universal-ancestor-of-all-life-on-earth-was-only-half-alive/ <comment><USER2> Interestingly, I only learned about proton gradients and the relation to the vents a few days ago - in the documentary series "Wonders of Life" [1]. As a non-biologist, I've been enjoying the show a lot. It's on Netflix (at least in the UK).

[1] [https://en.wikipedia.org/wiki/Wonders_of_Life_%28TV_series%2...](https://en.wikipedia.org/wiki/Wonders_of_Life_%28TV_series%29)</comment>


Control Bootcamp – A lecture series on optimal and modern control - <AUTHOR> https://www.youtube.com/watch?v=Pi7l8mMjYVE&list=PLMrJAkhIeNNR20Mz-VpzgfQs5zrYi085m&index=2 <comment><AUTHOR> I found this lecture series and I'm very much enjoying it, but the presenter's whole youtube channel is a gold mine for anyone interested in linear algebra topics as well.</comment>


Hacker Jobs Meets... Toby White - CTO - Timetric - <AUTHOR> http://hackerjobs.co.uk/blog/2012/7/9/hacker-jobs-meets-toby-white-timetric

<comment><AUTHOR> Toby White is the CTO of London-based Timetric; he still occasionally finds time to produce open-source software, mostly in Python.

Timetric produce tools for managing and visualizing economic and business data; all their visualizations are web-based, and you'll see their work regularly in places like the Guardian's Data Blog.

He shares his insights into what tends to peak his interest when hiring developers in London.</comment>


Free virtual phone numbers - <AUTHOR> http://www.ring4.com/ <comment><USER2> Should state it's for iOS only.</comment>


Ask HN: How do I build a community like Hacker News and Reddit? - <AUTHOR> <comment><USER2> Its simple. A community is where people exists. So you can create a WhatsApp Group, FB Group or Telegram Group where people can join in. It can be regarding to what you are interested in. Like some people like Games so create one for that. One recent example is WIP [0]. It started few months back for shippers & now is making around $2000 MRR. Its just a telegram group.

[0]: [https://wip.chat](https://wip.chat)

<comment><USER3> Thanks for the hint. I had a look at WIP, and I can't really see how it is generating revenue. Any ideas?

<comment><USER4> You have to subscribe to join, $20 per month, $150 per year

</comment></comment></comment><comment><USER5> I think I am right in saying that Reddit did it by the founders posting lots of content as fake users. They even had a quick sign up form that their staff could use to create a new user and post. I think by creating the illusion of a very active community it made it easier to attract both search engines and new users. I am not going to comment on the morality of this. This has been discussed on HN before if you want to search.

</comment><comment><USER6> We try to do that around irc and programming.

The idea is to propose to people to be involved in the process by doing tools that can communicate.

It's also inspired by the how Jeff Besos did to make AWS (you can use whatever tool/language you like but projects must talk programmatically).

[http://dpt.slasheva.com/](http://dpt.slasheva.com/)

</comment><comment><USER7> You can start off by using something like this: Telescope: Build your own Hacker News, Reddit, or Product Hunt. [http://www.telescopeapp.org](http://www.telescopeapp.org)

</comment><comment><USER8> With a bit of tech and a lot of (good) marketing.

<comment><USER9> And lots and lots of luck</comment></comment>


The Computer and the Brain (1958) [pdf] - <AUTHOR> https://ia800800.us.archive.org/4/items/TheComputerAndTheBrain/The%20Computer%20and%20The%20Brain_text.pdf <comment><USER2> Von Neumann was a frightfully bright guy. He's also why I don't trust the predictive power of a model based on data fitting rather than an actual theory about the underlying mechanism. "With four parameters I can fit an elephant, and with five I can make him wiggle his trunk."

I found this book a great read, but people who are emotionally invested in the error that the Church-Turing thesis implies brains are Turing machines will probably not like it.

<comment><USER3> Whether brains "are" TM's may be mostly moot from a simulation/emulation/modelling standpoint. We may not need a perfect model to get a "good enough" model. Biological systems are generally designed to handle a degree of noise and damage and still function fairly well. Thus noise introduced by the imperfections of a model may similarly not sufficiently degrade its ability to act like a normal brain.

On a really small scale our models may lack certain properties of biological brains, but it may not matter for most emulation. How much detail and/or actual "mirroring" is necessary to get good-enough emulation is still an unknown but key question.

And, I suspect we may find that fully mirroring biological systems is not the most efficient way to design good AI similar to how flapping wings were not the best way to get powered flight.

<comment><USER4> I like how Dijkstra put it:

"[...] whether Machines Can Think, a question of which we now know that it is about as relevant as the question of whether Submarines Can Swim." [1]

[1] [http://www.cs.utexas.edu/users/EWD/transcriptions/EWD08xx/EW...](http://www.cs.utexas.edu/users/EWD/transcriptions/EWD08xx/EWD898.html)

<comment><USER5> Why is that not relevant , its pretty clear that Submarines cant swim since they don't have a will of there own, they are only propelled to where the people inside them, who can think ,want them to go.

<comment><USER3> Depends how one defines "swim". That'll probably turn into a meandering philosophical debate, based on my experience debating "intent" with other IT people.

</comment></comment></comment></comment></comment><comment><USER6> I highly recommend this book (talks) for anyone interested in a computation approach to neuroscience. I found it remarkable how far seeing Von Neumann was in relating computation to the understanding of the brain. Here is the physical copy if anyone is interested.

[https://yalebooks.yale.edu/book/9780300181111/computer- and-b...](https://yalebooks.yale.edu/book/9780300181111/computer-and-brain)

</comment><comment><USER7> Von Neumann died before he finished writing this book.

Another unfinished work of his that's worth checking out is _Theory of Self- Reproducing Automata_ where he introduces his conception of self-replicating automata [1].

[1] [https://en.wikipedia.org/wiki/Von_Neumann_universal_construc...](https://en.wikipedia.org/wiki/Von_Neumann_universal_constructor)

</comment><comment><USER8> IIRC this book was difficult/boring so I haven't read it yet, but I remember that I bought it because this article that mentioned it was quite exciting:

 _You do realize that John von Neumann spent the last 10 years of his life singlehandedly developing a theory of computing based on cellular automata? The computer you 're reading this blog rant on was his frigging prototype! He was going to throw it out and make a better one! And then he died of cancer, just like my brother Dave did, just like so many people with so much more to give and so much more life to live. And we're not making headway on cancer, either, because our computers and languages are such miserable crap._

Source: [http://steve-yegge.blogspot.com/2006/03/moores-law-is- crap.h...](http://steve-yegge.blogspot.com/2006/03/moores-law-is-crap.html)

</comment><comment><USER9> thanks, will read this.</comment>


Keybase: Public, Signed Files - <AUTHOR> https://keybase.pub/ <comment><USER2> Related from yesterday: [https://news.ycombinator.com/item?id=22202740](https://news.ycombinator.com/item?id=22202740)

</comment><comment><USER3> It might be worth clarifying that, if you're using that keybase.pub website, you're trusting the Keybase server that hosts it to honestly serve the files. But if you run the Keybase client locally, and browse the same files under `/keybase/public/`, your client will check the signatures on everything, and you are _not_ trusting the server.

<comment><USER4> That's an important clarification, and I would add: it's easier to trust when you can verify.

That is to say, the website is https, so I trust that the server I'm asking for the file is the same one that gives it to me. And since I can verify signatures locally, any time I choose, it would be hard for that server to get away with modifying file contents only when served through the site, sooner or later someone would catch them out at it.

But yes, if it's important, definitely get the files from a native client, CLI or GUI shouldn't matter.

<comment><USER5> The time between them modifying the files and someone noticing isn't a trivial detail. It's the same idea behind 0-day exploits: perform an attack until someone catches you.

<comment><USER6> Except in this case keybase can only be caught once. Then all of their usage, prestige, funding, etc goes away.

Considerably different than an anonymous attacker.

<comment><USER5> This assumes that Keybase are the attacker

</comment></comment></comment></comment></comment><comment><USER7> Serious question, what is keybase? It started as a identity key verification service (which I use), then went on to be an encrypted file store (which I use), then went to be a chat service (again I still use it though it has its issues), then they added some weird crypto currency thing (feels scammy), and now they're adding another file serving option (which looks really cool). So, what do I call keybase when I'm trying to get people to use it?

<comment><USER8> A study case in feature (and scope) creep. I really wish they had just stuck to being an identity verification service as that's the main use case I've given them, but I feel they're stretching themselves too thin (and just being that would be probably difficult to monetize)

<comment><USER7> This is my worry for them, quantity over quality. Though I have to say their quality is pretty good. It just feels like too much and really confuses people when I start to tell them. My issue is still, how can I describe keybase without people saying to me it looks bloated. Maybe it is and that's the problem.

</comment></comment></comment><comment><USER9> I created a site to test it out, it seems the site is immediately updated after a file change: [https://songz.keybase.pub/](https://songz.keybase.pub/)

Cool!

Accessing the folder, creating a file, and even simple unix commands like `ls` feels significantly slower than other folders.

The default instructions did not work for me, my file path is actually:

/Volumes/Keybase/public/username

It is different from the one provided in the blog:

/keybase/public/your_username/

When reading the blog, it wasn't obvious how I can find the path to the correct folder. I had to open the Keybase app and find a notification.

<comment><USER10> Yeah starting from Catalina the / is now read-only. Upgrading from an old macOS also kills any previously created files or directories at root that were not shipped with the system. So `/keybase` is gone on Catalina.

</comment></comment><comment><USER11> Can anybody explain use cases for Keybase? Why would I choose it over, say, Telegram group chats? What are some good use cases for public files?

<comment><USER12> Telegram group chats are NOT end to end encrypted. Telegram has an option for e2ee chats but they won't sync across devices, last I checked, ans nobody uses them.

Keybase has an amazing, user friendly e2ee story.

</comment></comment><comment><USER13> Is there an easy way to use this without a mounted drive on my PC? Like a gpg sort of command line thing to expose the file on the Keybase servers like Firefox Send does?

</comment><comment><USER14> Dumb question: why would I want signed public files? (Esp. on a system where the crypto is home-grown and so is the CA?)

<comment><USER15> The crypto is not home grown, its standard.

Because other people can trust that the files are from you. Lets say you have some C project on github, you want to release a binary. Put it on Keybase and people can trust it is from you.

</comment></comment><comment><USER16> Dear Keybase, can you compete with Auth0?

</comment><comment><USER17> Seems like keybase resolved their account recovery process(you had to effectively directly contact a staff member prior to this).

Might start using keybase again.

</comment><comment><USER18> Keybase claims to be a modern replacement for PGP yet I don't think they even have some SDK that acts like gpgme. This is a very rudimentary feature to implement but it can unleash a whole new world for applications that use signatures and E2EE.

Keybase is a good idea and they got lucky with getting popular but they haven't really implemented features that would make them essential. Most people just sign up and forget about it.

EDIT: Seriously why the downvotes without clarifying? Has Keybase adopted astroturfing on HN like Brave and DuckDuckGo?

<comment><USER19> They're building out plenty of applications themselves. That's the right approach. PGP didn't unleash a whole new world for applications because it didn't attack usability, which isn't something you do with an API.

<comment><USER20> You don't unleash a whole new world, period. The old one still exists.

The only way I see us migrating away from our current gpg use cases is if all the integrations we use somehow went unsupported. There's simply no reason to assume the risk of inserting Keybase (or anyone else's) dependencies.

<comment><USER21> Approximately nobody uses PGP or GPG, there's no reason to backfill those features or use cases.

<comment><USER20> Approximately no one, except anyone who commits code at the F100 company I work for, several other F100s I know people at, Debian, Ubuntu, and a number of other infra projects.

I'm willing to believe nobody in your corner of the world does. That's not the only corner of the world.

<comment><USER21> That must be literally dozens of people.</comment></comment></comment></comment></comment></comment>


Show HN: I made my own free Javascript blogging engine over the weekend - <AUTHOR> http://blahsay.com/

<comment><USER2> Interesting. I like the clean styling. Needs a repo. Timing is interesting as Ghost just shipped and that is node.js.

<comment><AUTHOR> Just put it up on GitHub: [https://github.com/benwasser/blahsay](https://github.com/benwasser/blahsay)

Timing isn't too interesting as I doubt what I could build in 2 days could really compete with the year-long development of Ghost. This was just something I wanted to use, so I built it.

</comment></comment><comment><USER3> lol, I wrote something like this, too.

This jekyll/octopress "compile your blog every time you post" crap didn't get me...</comment>


How the forced sale of TikTok could splinter the internet - <AUTHOR> https://www.theverge.com/interface/2020/8/18/21372087/tiktok-sale-ramifications-splinternet-china-trump <comment><USER2> YES, damn it, yes. Is there really not enough information about how much data it collects about its users to finally ban it forever?[https://utopia.fans/privacy/tiktok-collects-users-data- delet...](https://utopia.fans/privacy/tiktok-collects-users-data-delete-it- right-now/) It really looks like massive user tracking ... although, I'm just silent about everything that Facebook owns.</comment>


Ask HN: How do you ensure that your customers are profitable? - <AUTHOR>

I offer a daily deal platform for anyone to start a hosted daily deal website, kind of like Shopify/BigCommerce for Groupon clones. Revenue is growing, and we are seeing some traction, but since most of our customers are first-time online business owners, they naturally have a harder time trying to make a profit. They have little clue about, say, SEO, email marketing, social media, etc. and are generally more easily disillusioned and dispirited (because of certain preconceived notions about how easy it is to make money online).
The problem with my business model is that I can't be profitable unless my customers are profitable (and rightfully so). A lot of times I feel that I can offer some help (e.g. by reminding them that selling something people want is more important than a perfect web design or that building an opt-in email list is usually more important than building Twitter followers), but we are a platform provider, not an advisor/consultant. A landlord can only do so much to ensure that his tenants are making money and thus able to pay rent every month.
I think it was Paul Graham that said that startups shouldn't sell to startups and, if they do, bad things happen. My question is how do companies like Shopify, Volusion, and other ecommerce platforms out there tackle this problem? How do they make sure that their customers do well -- apart from improving their platform, which they have already been doing all the time? <comment><USER2> 1) Charge more.

2) If you are hypothetically doing $0 + X% of Y pricing right now, change that to $MONTHLY + Z% of Y. You'll qualify away the worst possible "customers" and get money to keep the lights on.

You'll note that virtually everyone who sells to businesses is forced to do this, because otherwise the wanna-run-a-business-to-make-moneys crowd will suck all your time.

<comment><AUTHOR> Hi Patrick, thanks for your suggestions. I am already charging more than before, and I'm not sure that charging even more will help me get the feedback that my product sorely needs (even when we're at >40% "very disappointed" using Sean Ellis' product/market-fit survey) or even increase revenue. Most of my customers are, in fact, bona fide business people who want to build something long-term; they just have no clue w.r.t. most aspects of business.

Also, with my current pricing structure ($MONTHLY + 0%), it is actually already incentivizing them to make more revenue to at least cover the monthly fees. The other thing is that -- I suppose this is a peculiarity to myself -- my morale is directly proportional to the number (and not necessarily the dollar amount) of PayPal "new subscription profile created" emails I receive each day.

But I suppose I also need help in charging more: what is the best way? Just do it + grandfathering, or grandfathering + add massive perceived value and then hike the price? I went with the latter, but it again seems that people are wanting premium features for standard price, which may mean that I'm pricing a little too high and leaving money on the table again.

<comment><USER3> "my morale is directly proportional to the number (and not necessarily the dollar amount) of PayPal 'new subscription profile created' emails I receive each day."

Have you considered insulating yourself from these emails entirely? If your morale is so deeply affected by something that doesn't directly affect your bottom line, it will probably cause you to optimize for the emotional boost rather than the bottom line.

Perhaps you could instead set a daily email with projected revenue or some other number that _does_ impact your bottom line so that optimizing for the emotional boost and optimizing for the bottom line are the same thing.

</comment></comment></comment><comment><USER4> How about a video resource library? If you've got the cash, you can work with people who are experts on particular topics (email marketing, etc...) to prove you the tutorials. Alternatively, you can block out a weekend to put some videos together. It's acts as a marketing tool, ("Learn Everything You Need to Succeed With Daily Deals!") and a retention tool. In fact, having a big link to the video library on the cancel page would probably distract people away from cancelling.

</comment><comment><USER5> If you have already found that your customers are first timers, i can tell you one thing

Guide them step by step

With the problems. For example, for marketing, outline the process for Facebook marketing and ease it in their accounts. If you see they have problems with lets say accounting, integrate Freshbooks.

Your customers will be profitable when they put effort, and for that to happen, they need to know what they are doing and connect actions to results.

My 2c

</comment><comment><USER6> Sign up for a Light CMS account and learn from the nurture marketing email campaign they run which tells you how to be a profitable web designer, it's a fantastic example.</comment>


Ask HN: Why should or shouldn't someone do MBA? - <AUTHOR> And will your answer will be different if a person is from tech background? <comment><USER2> Do an MBA if you want to enter middle-management in a firm that values MBAs. (This is the majority of large companies by the numbers, although certain industry-leaders like Google, Facebook, and all of Elon Musk's companies tend to prefer to promote high-performing domain experts from within.)

An MBA is a master's in _business administration_. It teaches you how to administer an existing business effectively. It does not teach you how to start a new business, nor does it really teach how to innovate or develop new products. Coursework includes things like accounting, corporate structure, financing, market strategy, leadership, power & politics, and a general grab bag of skills that help you optimize the efficiency of an existing enterprise where the customers are known, production processes are in place, and you have a lot of data available. The networking opportunities are often very important as well, although like most networking opportunities, they are what you make of them.

Some of the skills can be mildly useful for an entrepreneur or technologist that's just looking to plan out their career and build cool things, but the price tag is really steep if you don't need it as a credential. You can usually get the knowledge for a fraction of the price if all you want is the knowledge. And it won't teach you the core skills needed to innovate and bring new products to market, which largely depends upon comprehensive domain knowledge, technical skills, and courage.

(It actually could be counterproductive in that regard...my wife is doing an MBA, and her boss told her "Y'know, doing an MBA at a top school self-selects for the most risk-averse people you can get, because it is probably the _least risky_ path to career advancement.")

</comment><comment><USER3> Does the idea of more debt excite you? In my opinion, it's too costly, and not a good return on your investment.

The things you'd learn from an MBA track can be learned from books, much more cheaply.

I'd start with "The Personal MBA" by Josh Kaufman. He's got several other books in there that he recommends.

<comment><USER4> Came here to recommend the same book.

I've also sat in on a couple MBA courses on leadership and management. One thing you miss out on in this book is that level of critical analysis and discussion about real problems from real businesses in the news. Case studies are useful too, but I enjoy the very fresh stuff more myself.

There it was quite interesting to hear the variety perspectives and approaches from how business undergrads going straight to the MBA vs. those with decades of experience in business management. I particularly enjoyed being the oddball engineering undergrad in the room. Josh's book is useful too, but it doesn't hit that level of discussion you have in real MBA classes with dozens of other students IMO.

<comment><USER3> To that, I'd suggest MeetUp groups. There's _definitely_ a way get the same discussion and forego the mountain of tuition debt. ;)

I'm much slower to recommend college these days, unless some form of licensure/credentials are required (law, medicine, engineering).

I think it was Mark Twain who said something to the effect of "Don't let schooling interfere with your education."

<comment><USER4> Meetups are a great point. Similarly, I wonder if there are any MBA related MOOCs out there with strong discussion forums.

<comment><USER3> I think the MOOCs seem the be on the wane. Excellent idea, but not getting as much traction as hoped? At least the MeetUp stuff would cover the face-to-face conversation piece.

</comment></comment></comment></comment></comment><comment><USER5> Most of business schools are a graveyards for talent IMNHO.

I've heard many comments that are confirmed by my own experience that bright people enter business schools to spent few years of their life to learn very few useful skill, most of which can be learned in a month by reading "... for Dummies" style book.

</comment><comment><USER6> It depends on what your goals are and what you're looking to do.

Broaden your horizons beyond the actual material that's being taught. Value is what you make of it.

From my personal experience, I enjoyed my MBA experience more than others. Many felt it was wasting time but since I was already part of the program, there is no point complaining about life. I also have some experience trying to start a company and an MBA is mildly useful.

I got a very broad education on what functions there are business. Some I agree and some I don't. Coming from an IT background, it seems like IT is not very well understood from a business perspective. All of this is fairly useful for an entrepreneur when it comes to strategic thinking. However, when it comes to execution of new products, an MBA won't be as helpful. In fact, you can get stuck analyzing things and becoming risk averse.

Entrepreneurship is a journey and there's really nothing to analyze at the beginning. You can make educated guesses but ultimately, it's an experience that you need to walk to discover.

</comment><comment><USER4> An MBA from an elite school has a lot of potential for your network.

If you're just seeking the knowledge and skills of an MBA, you might look to open material instead. I'm currently reading a book called The Personal MBA for a similar passion. It's pretty unorthodox, but I do recommend it so far. It might help you decide too.

You can see my outline of all the chapters and subsections here:

[https://github.com/tedmiston/notes/blob/master/books/The%20P...](https://github.com/tedmiston/notes/blob/master/books/The%20Personal%20MBA.md)</comment>


Ask HN: How to escape from mediocrity? - <AUTHOR>

 There are moments in which I feel strangled in mediocrity, surrounded by very smart and intelligent people.
I know that these feelings don't last, and in this special case there are not objective reasons to such feelings, but reason is of no avail.  Have you felt that same sensation and if so, how do you overcome those moments of low self-esteem?
Edited: Mostly Grammar and to suggest an irrational sense of mediocrity. <comment><USER2> If I'm reading you right you are:

1\. In a great position 2\. Have a great attitude and self awareness

I developed very strong programming skills by being in a situation where I was the weakest member of the team and felt like you do.

In my opinion just work hard and ask lots of questions. Take advantage of being around smart people and find ways to use their intelligence and experience to make yourself better!

On the other hand- I'm feeling something similar with my whole team. We're all very smart but only a couple of us (none in management) care about code quality and our lack of any testing or even a modicum of QA causes many bugs to be repeated and lowers our morale. In this case I feel surrounded my mediocrity and people who don't care and I'm looking for another job where I can join a team who takes pride in the craftsmanship of their work.

</comment><comment><USER3> 1\. Work at your full potential. Top mental work requires significant time uninterrupted by texts, phones, humans, etc. It also requires sleep and is inhibited by alcohol and drugs. You can get by with less or poor sleep, but you won't perform at your full potential.

2\. Don't waste time on office politics or squabbles. Express your opinion with superior work.

3\. Think things through. Like chess, think a few steps ahead before you decide on a course of action. Put yourself in the position of others -- clients, users, associates, and competitors.

</comment><comment><USER4> Add to winning situations. Cut your losses from losing ones. Don't drink or do drugs. Maintain your edge.</comment>


Looking at Productivity as a State of Mind - <AUTHOR> http://www.nytimes.com/2014/09/28/upshot/looking-at-productivity-as-a-state-of-mind.html <comment><USER2> I have come to exactly the opposite conclusions than the one proposed in this article. For me, not working when I don't feel like it, and really exploiting the times of high energy yields the most productivity.

If I force myself to trudge through moments of low energy, it saps all my energy. Moreover if I finish my alloted time of work, and then hit upon a high energy moment, it forces me choose between working even more and having any kind of leisure.

Of course, I think this has to do with the work one does. I'm in academia and the article discusses data entry. You don't really need creativity or initiative to do data handling.

<comment><USER3> Have you tried meditating?

<comment><USER2> Haha, this comment could nearly pass itself as parodic :)

But as a matter of fact, I do from time to time, although I don't really see it as a way of improving my productivity.

But I think you're onto something in the sense that often not feeling energetic of focused comes from the presence of parasite emotions or a sense of disorder. So it actually might help.

</comment></comment></comment><comment><USER4> Ultimately disappointing article ... discusses productivity in the purview of line-workers/data-entry type jobs, and clumsily tries to extrapolate to contemporary work environments/jobs that require more creativity and mental skill to perform :\

</comment><comment><USER5> Follow up study: women physically abused by their spouses claim to appreciate the treatment, agreeing that it helps them to "control their impulse to speak when it is not appropriate or wanted".

<comment><USER6> That reads like an Onion satire. If it's literally true, it's very depressing. And I suspect it's literally true, at least for some women.

<comment><USER5> It is _definitely_ satire, meant to highlight the fact that it is _abhorrent_ to abuse people, or set up perverse incentives that may result in abuse, for non-performance, _regardless_ of how the worker perceives the abuse. The fact that the workers in the study _wanted_ the increased risk without any increase in compensation makes me sick to my stomach.

<comment><USER7> _The fact that the workers in the study wanted the increased risk without any increase in compensation makes me sick to my stomach._ The way it was described, they may have made less before, and by (in the au courant jargon of our day) "gamifying" it their earnings may have increased. For example if they typically entered 4800 fields a day, the extra "all or earn half" incentive of making it to 5K might actually spur them to more productivity, and hence more earnings.

That is what Clark meant when he used MBA-speak to describe the workers as having "hired" their employers.

This article comes across as describing a discovery while in fact so far it's merely an interesting hypothesis or even simply model, which might ultimately prove to be informative. Since the author is one of the people doing the work I don't know if this is accidental or intended.

</comment></comment></comment></comment><comment><USER8> These conclusions seem to be focused on a very 19th century vision of "work", where productivity is just a function of efficiency and not, say, creativity or risk-taking.

<comment><USER9> I delved into some papers (and one author's body of work), and they seem quick to slap bizarre ideological interpretations on their results.

For example, I happily game-ified tedious BS jobs/classes by introducing elements of danger triggered by poor productivity. I thought the work was utterly pointless, and cheered whenever the corporation got hurt. But I needed some twisted motivation to show up and get through the damn day. And feel that my excellence was recorded somewhere.

The Kaur/Kramer/Mullainathan paper seemed to only use a barebones "endline survey," with easily-steered responses. Not in-depth interviews led by the subjects, which might've uncovered inconvenient info. (Or did I miss them?)

I also looked at economist Greg Clark's work. It's... weird... but at least his work is refreshingly honest about its political underpinnings. In a way others try to hide. And there's some interesting bits if you squint and remove the weirdnesses. For example, workers may take over a factory. But under a market economy, they may reasonably decide to oppress themselves by hiring a manager who sits in an air-conditioned room and is immune to the worsened workplace he develops.

<comment><USER10> Tl;DR: Management Anti-Patterns are rife in the industry because they appear to solve problems at first glance - and they do work because they reach a local maxima. See the six-sigma cults that are little more than cargo cultists running around with checklists.

</comment></comment></comment><comment><USER11> The average business fails to provide staff the autonomy they need to be productive. Articles like this don't help one bit.

 _I_ need a couple of hours of peace/alone time every day to focus on the important parts of my work. I'm lucky enough that my work is ok with me going to the local coffee shop for hours at a time. Most workplaces aren't. They claim to care about results but take such a short term view.

Don't evaluate me on my daily performance or the number of story points I have completed this sprint. Look at my performance month to month and year to year.

Of course some places have such high turnover (20%+) that they can't evaluate on a year to year because people aren't around for long enough but they have bigger issues.

</comment><comment><USER12> The most horrible article I have read at NY Times so far. Pushing workers to work harder and faster by motivating them with punishment is not about productivity at all. Alienating workers, saying that they "wanted" punishment and backing up all these "business" rhetoric with science is just sick. I wonder what "state of mind" the author was in when producing this article. Did he also hired the Ivy League College he is working in to help with his "self- control" issues? And providing workers with a "wellness program" just because it "reduces health costs" was the most chilling part. We are all human beings, not quantities or rats in a maze.

<comment><USER13> > Pushing workers to work harder and faster by motivating them with punishment > is not about productivity at all.

I don't like this idea either. Unfortunately, this kind of "motivation" is state of the art in many jobs. It kind of reminds me of Brandson's "take as much holiday as you like". That sounds positive at first but also motivates people to not take holidays at all because of the fear of being less productive than their co-workers.

<comment><USER14> it's state of the art in society. that is, because someone long ago discovered it working and society isn't pushed to try out better means, because the bad effects aren't overall noticably punishing enough for the pusher, ironically, and because negative feedback is a cheap basic part of the constant learning process. It's pretty productive, because it's focused on the product.

</comment></comment></comment><comment><USER15> No mention of the Hawthorne Effect[1] on the Indian data entry workers? A bit of an omission.

1 [https://en.wikipedia.org/wiki/Hawthorne_effect](https://en.wikipedia.org/wiki/Hawthorne_effect)

<comment><USER14> interesting read but not really substantial, given that the theories are inconclusive. the observer effect is something i'd be more willing to believe, e.g. the relay assembly women might just increase productivity to be sufficient enough for all the changes to stop already, to be polite or being reminded of productivity being actually important.

</comment></comment><comment><USER16> I agree this article is bad on many levels. But I also think it catches one important point. People who are pursuing a goal, that they themselves have committed to will be more productive

</comment><comment><USER17> Productivity is based on a ton of different factors. For example aptitude, experience, confidence in the task at hand, expected value, expected time frame, state of mind, peer pressure, "fitting in" (being surrounded by people who are working), belief systems about what you "should" do, role playing.</comment>


Apple's Cash Dilemma - <AUTHOR> http://www.aboveavalon.com/notes/2015/6/13/apples-cash-dilemma <comment><USER2> It's not a dilemma at all, it's a simple trade off. Either pay the tax to repatriate or pay interest on debt. If the former becomes more attractive than the latter, they'll do it. They can borrow at extremely low rates today so it boosts their earnings to borrow.

I was hoping for a little more information on the reason Apple's foreign subsidiaries can't buy Apple stock without repatriation of funds (and whether or not this would require Apple shares to be tradeable on a foreign exchange), or what it would take for Apple to reincorporate where the money is as a way to eliminate the need to repatriate at all.

EDIT: For everyone who thinks Apple is somehow in the wrong for this, your energy would better be directed at getting the tax laws changed. Apple's board and management have a fiduciary responsibility to pay only the tax they actually owe.

<comment><USER3> _your energy would better be directed at getting the tax laws changed_

How? Who among us can outspend lobbyists from the corporations?

<comment><USER4> He's suggesting the lobbyists are in the right in this case, and the tax rates for repatriation should be lowered to something more reasonable. Then companies would be paying more tax than they are currently giving the govt getting more revenue, as well as bringing more money into the U.S. for investment in local economies. Everyone wins if they lower taxes. At the current rates, it's simply irresponsible to bring the money back instead of leaving it where it is.

</comment></comment></comment><comment><USER5> I'm confused why "Pay the US tax" is not being seriously considered. I guess no one would even hope that a corporation would do the sensible and legal thing when there are loopholes to be abused.

<comment><USER6> Is it really that surprising? Let's make a highly simplified analogy with easy numbers.

You have two bank accounts, only in this example they're different currencies. One in Pesos, one in Francs. Let's make things easy and pretend that 1 Peso is worth 1 Franc.

Your customers pay in the currency they have. Lots of people pay in you Pesos, but some pay you in Francs. So after a while you have 100 P but only 20 F.

Now most of your bills have to be paid in F. You have some you can pay in P but the money comes in fast enough that will never run dry. Unfortunately the F account may not be so steady between paychecks and you may overdraft. If that happens people with pitchforks will come after you. You need to do something to make sure that you always have enough in the F account.

So there are two obvious options. You can move some of your Pesos over to Francs, but there is a BIG FEE for transferring to that account. You'd like to move 80 Pesos over, but after the fee you only get 40 P in your account. So instead of 100 P and 20 F (for 120 units, since it's a 1:1 exchange) you have 20 P and 60 F (for only 80 units). You can still pay all your bills, but you just lost 1/3 of your money and now your spouse is mad at you.

Or you could do something else. You could take out a loan in Francs when your balance gets low so you can pay your bills until more F come in. Banks are happy to lend you F because you have a nice house and plenty of P and they have a lot of money to lend right now. You have to pay interest, but that's like 5 F so it's not a big deal. Do things this way and in the end you have 100 P + 15 F (a total of 115 units of value) so you've only lost about 4% of your total net worth and you were still able to pay your bills on time.

Did that help? After reading it back over I get the feeling I just spent 10+ minutes but it's not going to clear things up for people.

<comment><USER7> > You could take out a loan in Francs when your balance gets low so you can > pay your bills until more F come in.

Sorry if this is obvious but just want to clarify this for myself: Do you plan to pay back the entirety of the loan, with interest with the account in French Francs? If not, aren't you just delaying the inevitable? If yes, is there any reason to keep the peso account locked up (for lack of a better term) in liquid assets? Perhaps you'd be better served by taking risks with that money?

<comment><USER8> >Do you plan to pay back the entirety of the loan, with interest with the account in French Francs?

Of course. You earn more than enough Francs to cover your expenses; it's just cheaper to borrow money right now than to convert from Pesos.

> If yes, is there any reason to keep the peso account locked up (for lack of > a better term) in liquid assets? Perhaps you'd be better served by taking > risks with that money?

The problem is precisely that: there's no good place to put that much money. Apple literally can't think of enough things to put all that money to use. Interest inflation rates are pretty low, so keeping it in TBills or whatever isn't really hurting them.

That at least, is my understanding.

</comment></comment></comment></comment><comment><USER9> Thanks for the post! It makes complete sense but I never realized a large majority of their cash holding is outside of the United States. Though I'm not entire surprised I didn't realize this; every week someone is talking about huge company X or huge company Y that Apple could easily buy in the U.S. but in reality they really couldn't unless they wanted to take a big tax hit.

I'm curious what they'll end up doing with all of that foreign cash. Are the options outlined in this article realistic / the best or only choices? Are there other possibilities?

<comment><USER10> Foreign R&D centers are the most obvious approach. If you make say, lots of money in China, open up an R&D center there as an investment; as a side effect it also makes the host country happier as you are giving jobs to locals (not just making money, but helping to develop the economy!). This has adverse side effect of shifting R&D from the country of origin, but it can also be expansive (do more vs. taking jobs from the US and putting them in China).

People talk about foreign cash as if it somehow belongs back in America. But if you are Chinese, you definitely wouldn't see it that way (Apple makes more money selling iPhones in China, why does that money need to go the US? Ridiculous!).

<comment><USER11> To take that one step further why aren't Apple putting that money into building its own overseas manufacturing facilities and reducing its reliance on 3rd parties?

Building and running factories in China with the money it is making from Chinese consumers seems a more prudent choice than paying a chunk of US taxes so it can do share buy-backs?

<comment><USER12> Why doesn't Apple just buy Foxconn (or a majority stake)?

This is not without precedent in other industries; owning the entire vertical would be hugely advantageous from a strategic perspective.

<comment><USER13> Because owning plant and equipment and capital assets is very risky; everything gets obsolete within months and now you're stuck with illiquid items that you have to amortize.

<comment><USER12> Compared to capital that's fairly illiquid at the moment? Better to have a manufacturing base for your next products instead of sitting on capital that's earning close to 0 returns and that you're probably never going to repatriate to the US unless an unlikely tax holiday occurs.

<comment><USER13> Disagree. The GT Advanced Technologies debacle is a concrete example. Sure Apple lost money on that one, but it would have been a bigger hit on their bottom line had they full invested in their own sapphire plant and tooling. In the big scheme of things, fighting a lawsuit with an external supplier is a small price ot pay as compared to missing an iPhone launch window.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Apple benefits from the US court system, US copyright/trademark law (for the most part) being respected worldwide, and a US military which projects a fair amount of hegemony around the world.

So yeah, it's time for Apple to pay for its 35% share in funding the above items.

In the end, Might secures your rights. Freedom against someone subjecting their rule over you and how your domestic businesses are able to operate internationally is paid for with having the biggest guns.

<comment><USER15> Do they not pay tax in the US at all? You make it sound as if they just don't pay tax. As it stands, they've paid tax in any country where they've earned money. That pays for the court systems and IP laws in those countries. Any revenue in the US has been taxed in the US and the funds used similarly by the government.

Now, you want to take money that's already been taxed elsewhere and return it to the US, subjecting it to _further_ tax. Why? As I said, they've already paid taxes here in the good ol' USA.

<comment><USER16> First of all this double taxation thing is hogwash. US corporations (and people for that matter) only pay the difference between any foreign tax collected and our own federal tax when they move it to domestic books.

Probably more importantly, the foreign profits are disproportionately gains baised on research and development conducted in the US which the foreign subsidiaries pay no royalty for at all.

If, for instance, 50% of the value of an iPhone sold in China represents the value of the engineering of the device, we have a tax loss which adds up to half of the nearly $200 Billion held as foreign profits by Apple.

Apple should be forced to pay these taxes. This represents a real and tangible loss to the people in the US and an unnecessary subsidy handed to the most valuable public company on earth.

<comment><USER15> I've known individuals pay the difference between foreign tax and US federal tax, but I'm not so sure that also applies to corporations. I'll need to research that.

You really can't start dictating the terms of contract agreements between domestic and foreign entities with regard to "royalties" or other such payments. It would adversely affect any other companies as well that are not subsidiaries. And before you attempt to limit the rules to "subsidiaries" consider that although "Apple Ireland" is somehow affiliated with "Apple, Inc" in the US, they are wholly separate companies with a contract to behave in certain ways. Should Apple Ireland, being a separate company, decide to 'go rogue' breaking the contract and doing whatever they will with all 'their' money, they just get cut off from the Apple, Inc ecosystem and a new entity is created that will play the game correctly.

So how do you force "Apple, Inc" which is a separate company from all the other "Apple $PLACE" around the world to pay tax on money that, legally, it doesn't have ... without also adversely affecting any number of smaller companies that couldn't possibly bear such a tax burden?

</comment></comment></comment></comment><comment><USER17> Who wants to bet as a part of TPP (now that it's fast-tracked) there will be plenty of tax holidays or even tax reductions for moving foreign cash back into the US?

</comment><comment><USER18> Another option would be to list their stock in a country without this profit double-taxing issue (or less of one), and pay dividends there instead.

</comment><comment><USER19> It seems like such a no-brainer for IRS policymakers to offer Apple (and companies like it) a tax holiday on foreign cash reserves. Smart for US, smart for them. What countervailing political forces hold that back? Is it simply that the US feels like it shouldn't have to negotiate how much a company like Apple should pay in tax?

<comment><USER20> I don't see how it makes sense at all to offer a tax holiday. If the IRS is going to give Apple a tax holiday, can they give me a tax holiday too?

<comment><USER4> what is 0% of 100 billion? 0

What is 10% of 100 billion? 10 billion.

10 billion is more than 0 dollars, so it makes sense. 0 is what they will get if the keep the rate the same as it is now.

>If the IRS is going to give Apple a tax holiday, can they give me a tax holiday too?

That sure would be nice, I wouldn't mind one. That being said, we don't have billions of dollars to offer, and it's unlikely we have money overseas that needs repatriated.

</comment></comment></comment><comment><USER21> Why can't the foreign subsidiaries buy Apple stock? I am sure that isn't allowed or else they would do it but what is the regulation preventing it?

Alternatively borrow money for the buybacks from their own foreign subsidiaries either at zero percent or very low or at prime and then default?

</comment><comment><USER22> I'm curious about share buybacks. If a publicly-traded company amasses a pile of cash, isn't that cash owned by the shareholders? If the company uses that cash to purchase its shares, aren't shareholders being paid with their own money?

<comment><USER23> Those who want to sell will just "exchange their stock for cash". Some might want to do so, others might not. The bought back shares are destroyed so the overall stock price rises: nothing is gained, nothing is lost (in value), it's just cash that came out.

</comment></comment><comment><USER24> That's the problem with corporate tax holidays, now companies wait around for another one. Instead the government should permanently reduce the tax rate for overseas corporate profits.

</comment><comment><USER25> TBH, I'm more intrigued by the business model behind this site than the story itself. Research content on one 1 subject, membership at $10 a month. Who are its customers? Small traders and investors who can't pay for more costly info? I wonder if revenue is covering the cost of research.

<comment><USER26> I'm a small investor in Apple and a (former) member of Above Avalon. I enjoyed reading the free content on this site for a few months, so I decided to try out the paid version. So far I'm not convinced that the paid content is worth the cost. That said, I think Neil does a fine job and I recommend the site to anyone with an interest in Apple as a company.

</comment></comment><comment><USER27> I would have liked to have seen some other options explored: a) decrease share buybacks/dividends, b) bring cash back and pay the tax, c) invest in foreign markets.

</comment><comment><USER28> Noob question: what about letting the valuation crash Ann buying back at a discount and then progressively going out of the market ?

<comment><AUTHOR> So in the end, they'd have intentionally destroyed their company in order to make their share value cheap-enough to buy them all up so they could own all of a company they intentionally destroyed? That doesn't sound very wise.

</comment></comment><comment><USER29> They could use it to open R&D centers in foreign countries.

<comment><USER30> They do. There's only so much that's productive unless you're funding basic research, which Apple, for better or worse, doesn't do.

</comment></comment><comment><USER31> I noticed "give to charity" was no where on the list. Imagine the good $200 billion could do.</comment>


18' Canoe from One Sheet of Plywood - <AUTHOR> http://koti.kapsi.fi/hvartial/oss3/oss3.htm <comment><USER2> So I actually built something quite similar (same materials, different plans) about five years back. Great experience and a lot of fun to paddle around in the nearby marshlands.

All told I spent just over $100 and the project took about 2 long weekends. I used fiberglass to cover the exterior and the boat is still in great shape today (though sadly underused).

<comment><USER3> How much does it weigh?

<comment><USER2> I'm not sure, it was easy enough to carry by just myself, so the fiberglass weight wasn't significant.

According to this chart: [http://www.boatdesign.net/forums/attachments/fiberglass- comp...](http://www.boatdesign.net/forums/attachments/fiberglass-composite- boat-building/3985d1126213824-fiberglass-thickness-chart.jpg)

The fiberglass weight would be under 3lbs.

For the plywood - 3 pounds per square foot per inch of thickness according to APA Plywood Design Specification so

= .25 thickness * 8 width * 4 height * 3 lbs

= 32/4 * 3

= 8 * 3

= 24lbs plywood weight

So I'd say the boat was between 25-30lbs and that feels about right.

<comment><USER3> That's quite light, considering my cannondale mtn bike is ~25-30 lbs.

Still, I'd love to see what additions such as AeroGel powders and carbon nanotube fibers would do to the weight of a rigid boat such as a canoe.

I think another design challenge would be a fold-able plastic one ala camping flatware (<http://www.orikaso.com/>)

</comment></comment></comment></comment><comment><USER4> If you liked that canoe, check out the The Windward Sharpie "Cricket". True skill, craftsmanship.

<http://www.jimluton.com/boats.php>

<comment><USER5> All handmade boats show that type of craftsmanship... this story was more about an interesting artificial constraint to engineer against.

<comment><USER4> Thank you, point taken. Speaking of constraints, the concrete canoe competition held by the American Society of Civil Engineers shows that concrete is not really a constraint. Also, it would be interesting to see if you could repurpose Ikea furniture and make a boat.

<http://content.asce.org/conferences/nccc2011/index.html>

<http://content.asce.org/conferences/nccc2011/gallery.html>

Winning team design papers 2000-2010:

[http://www.engr.wisc.edu/studentorgs/canoe/designpapers/inde...](http://www.engr.wisc.edu/studentorgs/canoe/designpapers/index.htm)

<comment><USER5> I grew up in the Madison area, and the UW's canoe team was legendary.

</comment></comment></comment></comment><comment><USER6> <pedantic> It's an amazing project but that's a kayak, not a canoe. </pedantic>

<comment><USER7> <more pedantic> In some parts of the world, such as the United Kingdom, kayaks are considered a subtype of canoes. Continental European and British canoeing clubs and associations of the 19th Century used craft similar to kayaks, but referred to them as canoes. This explains the naming of the International and National Governing bodies of the sport of Canoeing.</more pedantic>

<comment><USER8> <less pedantic>A kayak is a decked boat that one sits in with one's legs extended. A canoe has no deck and one kneels or sits on a seat.</less pedantic>

<comment><USER9> <exception>Surf Kayaks are closed hulls that you sit _on_ with your legs extended: <http://www.google.com.au/images?q=surf+kayak> </exception>

</comment></comment></comment></comment><comment><USER10> Genial work, that. Now, if only plywood alone would be suited for submerging in water... :)

</comment><comment><USER11> that's fantastic, I'm so going to make one</comment>


Is California's Budget Endangering Silicon Valley? - <AUTHOR> http://loganfrederick.com/blog/is-californias-budget-endangering-silicon-valley/

<comment><USER3> As an investment, educating, retaining, and attracting talented students in California would seem like a fundamentally positive way to raise the tax revenue in the state. Those university students will often work and start businesses where they are educated. We've seen recent articles with charts on individual ROI for college education cost vs additional future income - <USER2> should translate to long term increased state revenue.

I think the mistake of the article is to focus to much on budget costs, and too little on where value generation could be - not just as an abstract social good, but as a way to prioritize and or structure funding which yields a very real return on investment.</comment>


Nate Silver Is a One-Man Traffic Machine for the Times - <AUTHOR> http://www.tnr.com/blog/plank/109714/nate-silver-the-times%E2%80%99-biggest-brand <comment><USER2> First - this is taken from [http://www.tnr.com/blog/plank/109714/nate-silver- the-times%E...](http://www.tnr.com/blog/plank/109714/nate-silver-the- times%E2%80%99-biggest-brand#)

Second (as is clear from source article but, once more): via <https://twitter.com/JanetCoats/status/265925450696642561>

@fivethirtyeight did not account for 20% of NYT traffic; 20% of visitors to NYT looked at 538. Big difference, my math-challenged friends.

<comment><USER3> yes, but as @bdbreedlove mentions, "NYT must have some goddamn impressive stickyness for that not to be a very similar number."

<comment><USER4> Many people check out a news site a few times a day, so it's hard to tell. Either way, it's impressive.

</comment></comment></comment><comment><USER5> Man he's hated by a lot of the media. Whole diatribes are being written about how it's impossible to boil an election down to numbers on a spreadsheet. It's crazy that these are the same people that ask us to respect their opinions. Not even a basic understanding of mathematical thinking.

<comment><USER6> As a counterpoint, there is of lot of knee jerk rejection of any criticism of Nate Silver. A lot of people protray anything that questions Nate Silver's work as rejection of math.

<comment><USER7> Well, if you just reject his conclusions without refuting any of his methods, you haven't really made any argument against him. Those rejections _are_ pretty much all rejections of math in favor of wishful thinking. Mere intuition can never be an effective argument against quantitative analysis.

</comment></comment></comment><comment><USER8> At this rate, Nate Silver will be responsible for 50% of NYT traffic by next week!

<comment><USER9> <http://xkcd.com/605/>

<comment><USER10> <http://xkcd.com/1130/>

</comment></comment></comment><comment><USER11> FiveThirtyEight is actually leased by The New York Times.

Nate, brand, and all can leave the New York Times in the middle of 2013 once his contract is up.

Depending on the election results, I wouldn't be surprised to see him ask for a whole lot more money, jump to a new highest bidder, or go independent again.

<comment><USER12> He's actually said that he doesn't intend to be doing this again in four years time, but that FiveThirtyEight (the algorithm/brand) may continue without him.

<comment> shawn-butler Probably wants to get back to poker.

<comment> brown9-2 Judging from what he wrote about poker in his book, doesn't seem likely - talked about how much the game has changed and how he couldn't win with his old strategies/style any more.

From the book I get the feeling he'd like to use his forecasting skills in something that is a bit more demanding, he chalks up baseball and political forecasts as falling in the 80/20 pareto rule.

</comment></comment></comment></comment><comment><USER13> Tangential: If you believe in Nate Silver, Intrade is underpricing the Barack Obama contract by 20%+.

The contract that pays out $10 if Obama wins is currently trading at $6.70 per contract, implying a 67% chance Obama wins vs Nate Silver's 90%+.

Unfortunately, Intrade and American gambling regulations don't play nice so they don't accept US transactions. They also won't write you a margin account so you actually need to have funds in their system to execute a trade today.

Hard to say which party is inaccurately estimating the outcome, but given the regulatory hurdles around Intrade and the seemingly low volumes, I wouldn't be surprised if they're off.

<comment><USER14> Intrade is just one such place to bet. See others listed here: [http://www.oddschecker.com/specials/politics-and- election/us...](http://www.oddschecker.com/specials/politics-and-election/us- presidential-election/winner)

SkyBet and Ladbrokers for example both have payouts closer to 538's forecast.

What is peculiar is that Intrade is the outlier. In a liquid market this shouldn't happen because it allows for risk-free payouts. So something seems a bit odd about Intrade.

It's possible the campaigns have caught on to Intrade's impact on the media and will now step in when prices fall to much. </conspiracy>

<comment><USER15> It isn't entirely liquid. It's a pain to get money into Intrade (esp. for an American).

IEM (<http://iemweb.biz.uiowa.edu/quotes/Pres12_quotes.html>) and Intrade were up until yesterday off by 10%. Eventually things moved closer, but regulatory hurdles in actually getting money in (+ limits on funding) really hurt arbitrage opportunities.

<comment><USER16> It's really not difficult at all to get money into Intrade as an American. I had wires show up day-of if I did it early enough or next-day in every other case.

Also of note is that other betting markets were consistently higher than Intrade was for all of the last 6 months basically- there are a lot of theories as to why this may be, but it's regularly been 5%+ lower on Obama.

</comment></comment></comment></comment><comment><USER17> Possibly relevant: <http://www.isnatesilverawitch.com/>

</comment><comment><USER18> And Mike Bostock, and the rest of the team!

I am still sad that fivethirtyeight got swallowed by NYT. fivethirtyeight has a much better reputation in my mind, I would have loved to see it grow into its own powerhouse.

<comment><USER19> Maybe they would have done better on their own, but I was much happier to see them get swallowed by the NYT rather than a site like the Huffington Post, where the association would lose them much more goodwill.

The things that annoy me with the NYT are the monthly article limit that I have to workaround and how painfully slow 538 is on my iPhone.

<comment><USER20> Yeah, it's such a terrible limitation too when all you need to do is remove the variable, and it goes back to normal. I wonder how many customers that inconvenience actually gets for the NYT?

<comment><USER21> Can't tell if you're being sarcastic or not...

Regardless, they've landed more than 500k digital subscribers in the past 18 months. I'm sure there are a number of things at play here (bundling home delivery and digital, including app subs in these numbers, etc), but that's still pretty impressive.

Source: [http://paidcontent.org/2012/10/12/investors-like-new-york- ti...](http://paidcontent.org/2012/10/12/investors-like-new-york-times- paywall-progress/)

</comment></comment></comment></comment><comment><USER22> That percentage is probably going to fall in the next few days.

<comment><USER23> Along with the rest of their web traffic.

</comment></comment><comment><USER24> And now we know why: Nate Silver correctly predicted _every state_ in the presidential election (Electoral College). So much for the pundits who criticized him, Rasmussen's party ID results that supposedly showed Republicans with a commanding lead in Republican party identification, and "UnSkewed" polls.

</comment><comment><USER25> Slightly off-topic, but I found this was an interesting article on Nate Silver:

[http://www2.macleans.ca/2012/11/04/tarnished-silver- assessin...](http://www2.macleans.ca/2012/11/04/tarnished-silver-assessing- the-new-king-of-stats/)

</comment><comment><USER26> The accuracy of Nate and other quantitative modelers' forecasts depends on the quality and accuracy of the polls they use. Drew Linzer of votamatic.org has written some really good pieces the past few days examining poll accuracy and the potential for "systemic polling failure":

<http://votamatic.org/can-we-trust-the-polls/>

<http://votamatic.org/another-look-at-survey-bias/>

<http://votamatic.org/pollsters-may-be-herding/>

<comment><USER27> Nate's model accounts for presumed inaccuracy in the polls but it is partly reliant in those polls' historical leanings. I think it would be more correct to say that his model depends on the quantity and consistency of polls.

</comment></comment><comment><USER28> I don't really buy all this. 538 is a great resource and Nate Silver is a smart guy doing interesting things with data, but millions and millions of people were going to hit the NYT for election stuff regardless and 538 is the site's big election brand right now. It's great for him and the times, but not really remarkable.

</comment><comment><USER29> Heh.. I was just reading his blog before coming to HN.</comment>