Quantifying the Impact of "Cloudbleed" - <AUTHOR> https://blog.cloudflare.com/quantifying-the-impact-of-cloudbleed/ <comment><USER3> The wording of the post seems to be tilted towards limiting Cloudflare's potential liability as opposed to objectively quantifying the impact. For example, the author mentions that the 100th largest website handles less than 10B requests per month - which positions near the median of the table of likelihood anticipated leaks.

I'm not surprised at this approach as the CEO has a background in law. I think that, combined with his hubris, shaped the tone of this post from an objective post mortem to a goal of minimizing the damage to Cloudflare itself.

I met Mr. Prince once at a tech conference. I mentioned that I followed him on Twitter, to which he freaked out a little bit and said "Oh I hate that when I run across people who tell me that". When I heard him tell his name to someone else there, he said his last name was "Prince, like King". I suspect that his attitude is prevalent at Cloudflare, and may have shaped not only the source of this issue, but the response to it as well, since CEO's generally influence the culture.

<comment><USER4> > his attitude

I don't quite follow from your description of his reaction. What sort of attitude were you attempting to describe/how'd you perceive his attitude to be?

<comment><USER5> I think his attitude, as described, was that he manipulates for his own perceived self importantness and perceived gain. If you mention you follow him on twitter the response is "oh that's so beneath me and I hate it", if you don't know him, he is "prince, like a king, and an important one of that so remember me" kind of attitude. Like a person you wouldn't want to meet in a bar.

That is how I understood it anyways.

</comment></comment></comment><comment><USER6> > 3) after a review of tens of thousands of pages of leaked data from search > engine caches, we have found a large number of instances of leaked internal > Cloudflare headers and customer cookies, but we have not found any instances > of passwords, credit card numbers, or health records; and

Downplaying how bad it was that customer cookie's were leaked is what I found particularly egregious in the original response. A session cookie is _almost_ as bad as a password leak. Usually it'll let you everything except change your password (as most sites require your current one as an extra validation).

<comment><USER7> Session cookies can be reset much more easily than asking a user to reset their password. Session cookies also aren't used on multiple sites. It's still a big deal, but leaking a session cookie is much less dangerous than leaking a password.

<comment><USER8> >Session cookies can be reset much more easily than asking a user to reset their password.

This statement is making an assertion about the behavior of vastly different software backends and the skill-set of the people administering the systems. Things that may appear trivial to you may not be for the sysadmin in charge of servers running healthcare applications that have an opaque internal state.

</comment></comment></comment><comment><USER9> Was talking with colleagues about cloudbleed and S3 problems yesterday.

I don't feel like many people are actually concerned of the implication of having an internet that isn't an internet anymore, but merely a handful of big companies hosting everyone.

Or maybe it's me who don't understand.

<comment><USER10> What are you proposing? We should all serve off of our DSL lines?

<comment> ezequiel-garzon Collocation, dedicated servers, even VPS. There's plenty of a middle ground between serving off your home server and AWS, Cloudflare et al.

<comment><USER11> And to be blunt, I'd even claim that the middle ground is superior for most people than AWS, Cloudfare et al.

I have limited experience with AWS, but they always seem to be having problems that ruin everything that they don't acknowledge. That's what I get from people at the office who have to use it to support a particular customer. Nothing we do ever seems to run properly on it, even though our software is fine everywhere else. We're trying to push that customer off to using their own hardware, and they agreed with us that it's necessary but for different reasons.

Cloudfare, I don't even understand why anyone would use it. I understand the benefits it claims to provide, but you can get those without having an external MITM proxy that can spew information all over the Internet with one bug.

</comment></comment></comment></comment><comment><USER12> Not everything Cloudflare has written about this breach has been good, but this is solid. In particular, I'm satisfied that commercially reasonable efforts have been made to ensure there wasn't deliberate exploitation of the bug.

What remains now is an accounting of how some of the most sensitive C code on the Internet was tested prior to the discovery of this bug (by Cloudflare's own accounting, the underlying error seems to have been present long before it became symptomatic), and what they're doing about that now.

<comment><USER8> >I'm satisfied that commercially reasonable efforts have been made to ensure there wasn't deliberate exploitation of the bug.

How would you classify people using all of the crawled data though? It seems sort of hand-wavy to claim nobody deliberately exploited the bug if they used leaked session tokens in crawled data to get access to user accounts.

</comment></comment><comment><USER13> One aspect I haven't seen mentioned yet is that there is a geographic dimension to what ends up in search engine caches; their crawlers end up talking to the nearest Cloudflare point-of-presence so any leaked data is also going to be from requests served in that same general area.

For example, my Cloudflare-using site is in the 1B to 10B requests a month bracket, meaning 112–1,118 anticipated leaks per Cloudflare's calculations. It's enough that you'd expect to possibly find some in the search engines, but we haven't.

One potential explanation is that our usage is heavily concentrated within a geographic area (the Nordics), and this just isn't where the big search engines are doing their web crawling from.

<comment><AUTHOR> Yes, that's correct and not something our analysis has taken into account. Search crawlers are more likely to hit certain PoPs. If your content was less likely to be in one of those PoPs then you're less likely to have leaked data to one of them.

We also didn't take into account that the distribution of the ~6,500 sites that triggered the bug weren't even across our infrastructure. We distribute load for any site across some fraction of all the servers in any given PoP. Based on whether you're on a cluster of servers with more or fewer vulnerable sites you'd have been more or less likely to leak data.

For the general case the stats are directionally correct and, if anything, conservative (we believe, if anything, overstate the risk). But a particular customer's situation could deviate from the expected probabilities for a number of reasons.

</comment></comment><comment><USER14> The problem is that CloudFlare encourages a fundamentally insecure architecture. CDN should be used to host static files on a separate, cookie- less subdomain. With such architecture consequences of any data leak from a shared CDN infrastructure are limited.

With CloudFlare all the requests are passed through the CDN. With dynamic, authenticated requests the benefits of this are dubious. The responses can't be cached anyway, an additional HTTP(S)-level hop is required for each request (and many additional IP-level hops). The drawbacks are now obvious: sensitive, unencrypted data of thousands of different sites resides in the same, not isolated, shared process memory. With such architecture we will always be one C pointer manipulation bug away from another leak.

<comment><USER15> The reason CloudFlare encourages this is because it isn't meant for use as a traditional CDN - they're not a CDN at all really. You don't upload content to them. They're meant as a cache and anti-DDoS proxy more than anything else.

Look at what happens when anyone gets hit with a large scale DDoS attack these days, the first thing people will tell them, myself included is "CloudFlare". How do you handle a massive spike in load on a tiny, usually empty server? CloudFlare is the go-to tool for this purpose, especially for people who can't afford to pay Akamai, BlackLotus, Amazon or others. And they're impressively cheap for small businesses too. You can't hide from a DDoS attack or save your tiny DigitalOcean box if your web server isn't hidden away behind a service like this.

I have nothing against CloudFlare, they've proven themselves extremely trustworthy in many ways and even in handling of past security issues they've been very responsible. But this time that's not the case - the downplaying of the issue is really damaging their reputation in my eyes. I'm a paying customer and I'm quite disappointed to see this.

<comment><USER14> > They're meant as a cache and anti-DDoS proxy more than anything else

You can't cache responses to authenticated requests, so in case of DDoS attack against an HTTP end point that requires authentication the best CloudFlare can do to safe the back-end is to drop requests, which makes the attack successful. I really can't see benefits of passing authenticated traffic through CloudFlare.

<comment><USER15> That assumes all users who are performing the attack are authenticated - <USER2> extremely unlikely scenario. All said users would also have to be able to pass a captcha which gets engaged in the case that a site is under active attack.

> the best CloudFlare can do to safe the back-end is to drop requests, which > makes the attack successful

It can also drop the attack requests, which is generally not from authenticated users, and pass the real traffic to the backend.

Only in the case of real user, authenticated traffic is CloudFlare not a solution. In cases of high unauthenticated user or high fake user traffic or in cases of attacks not operating on HTTP at all, CloudFlare will solve the problem perfectly. Some of the nastiest attacks, like reflection attacks, don't even touch HTTP at all but will quickly knock most servers offline - even lead many server providers to nullroute you to protect their other customers. It'll also get you out in cases of high real user, unauthenticated traffic - like being posted on HN, reddit, etc.

</comment></comment></comment></comment><comment><USER16> It was my understanding that people were finding numerous examples of leaked data that included Authorization headers, which don't always leak _passwords_ but which still leak session keys. Maybe if espadrine from this linked comment reads this, he could explain more?

[https://news.ycombinator.com/item?id=13719455](https://news.ycombinator.com/item?id=13719455)

FWIW, as an example, Grindr uses CloudFlare: do a Google search for "authorization: grindr3" and you will find a URL which (no longer cached but you can still get snippets) contained an authenticated grindr request, which would be enough to have had temporary access to that person's account.

[https://costumla.com/wild-west-costumes-for- men.html](https://costumla.com/wild-west-costumes-for-men.html)

"... U Edge Certificate Authority1 0 U San Francisco1 0 U California�1p ���U� N��U � � �f"�0! %���U@ @GET /v3/profiles/ _[REDACTED]_ HTTP/1.1 CF-RAY: 33282514b8d957d7 FL-Server: 15f76 Host: grindr.mobi X-Real-IP: _[REDACTED]_ Accept-Encoding: gzip Client-Accept-Encoding: gzip X-Forwarded-Proto: https Connect-Via-Https : on Connect-Via-Port: 443 Connect-Via-IP: 220.127.116.11 Connect-Via-Host: grindr.mobi CF-Visitor: {"scheme":"https"} CF-Host-Origin- IP: _[REDACTED]_ Zone-ID: 22252132 Owner-ID: 2607399 CF-Int-Brand-ID: 100 Zone-Name: grindr.mobi Connection: Keep-Alive X-SSL-Protocol: TLSv1.2 X-SSL- Cipher: ECDHE-RSA-AES128-GCM-SHA256 X-SSL-Server-Name: grindr.mobi X-SSL- Session-Reused: . SSL-Server-IP: 126.96.36.199 X-SSL-Connection-ID: 15d1b8de6025864d-DFW X-SPDY-Protocol: 3.1 authorization: Grindr3 ... accept: application/json user-agent: grindr3/220.127.116.1190;16790;Free;Android 6.0 CF- Use-OB: 0 Set-Expires-TTL: 14400 CF-Cache-Max-File-Size: 512m Set-SSL-Name: grindr.mobi CF-Cache-Level: byc CF-Unbuffered-Upload: 0 Set-SSL-Client-Cert: 0 Set-Limit-Conn-Cache-Host: 50000 CF-WAN-RG5: 0 CF-Brand-Name: cloudflare CF- Age-Header-Enabled: 0 CF-Respect-Strong-Etag: 0 Set-Proxy-Read-Timeout: 100 Set-Proxy-Send-Timeout: 30 CF-Connecting-IP: _[REDACTED]_ Set-Proxy-Connect- Timeout: 90 Set-Cache-Bypass: 0 Set-SSL-Verify: 0 CF-Force-Miss-TS: 0 Set- Buffering: 0 CF-Pref-OB: 1 Set-Keepalive: 1 CF-Pref-Geoloc: 1 CF-Use-BYC: 0 CF-IPCountry: _[REDACTED]_ CF-IPType ..."

edit: I have spent the last fifteen minutes pulling the search snippet (edit: and now an hour; but all on my phone, so this is harder than it should be, and I also am distracted by other stuff). The way you do this is by walking through the parts you can see to get nearby context. (I do this a lot to pull content purged from or inaccessible to or simply updated in Google's cache.)

In so doing, while I haven't been able to still have access to the session key (likely too long and unique for a snippet), I _have_ pulled the X-Real-IP address field of this Grindr user and a profile identifier they were checking out (both of which I redacted above, but you could trivially get yourself now using that context).

CloudFlare: if you think there isn't private data that was leaked, _OR EVEN PRIVATE DATA STILL ACCESSIBLE_ , you are a bunch of fucking idiots. 1) Clearing the cache isn't sufficient, as for anything built from short plain text words we can pull the snippet. 2) IP addresses and session keys count as "private data". 3) GET requests actually _are_ often sensitive information :/.

<comment><USER17> I don't see anywhere in the post where they claim private data wasn't leaked. In fact, they explicitly state that authorization cookies were leaked. What they said they didn't find was passwords, CC info, health records, SSNs, and customer encryption keys.

They even have a paragraph talking specifically about cookies in GET requests:

> _This is not to downplay the seriousness of the bug. For instance, depending > on how a Cloudflare customer's systems are implemented, cookie data, which > would be present in GET requests, could be used to impersonate another > user's session. We've seen approximately 150 Cloudflare customers' data in > the more than 80,000 cached pages we've purged from search engine caches. > When data for a customer is present, we've reached out to the customer > proactively to share the data that we've discovered and help them work to > mitigate any impact. Generally, if customer data was exposed, invalidating > session cookies and rolling any internal authorization tokens is the best > advice to mitigate the largest potential risk based on our investigation so > far._

<comment><USER18> It's still weird to enumerate things not found, but no mention of examples like dating site messages that were found. They're obscuring that by focusing on internal headers, etc. Why does the table with "0 health records" not have an entry for "X private correspondence"?

<comment><USER17> There's 3 classes of information:

1\. Information where improper disclosure is illegal. For example, health records. Or credit card details, which would presumably be a violation of PCI DSS.

2\. Information that can be actively exploited, but can also be fixed so the previous disclosure is harmless. This means passwords, authentication tokens, etc.

3\. Information that is merely private in nature.

Cloudflare is focusing on the first two items. The third one is hard to quantify; what one person may consider private, another person might not care about. And there's not much that can be done about this kind of disclosure (beyond scrubbing caches which they're doing anyway). Also, it's difficult to automatically identify this type of content (whereas cookies, passwords, credit card numbers, etc are pretty easy to detect) and Cloudflare probably doesn't want to have their employees spending their time reading through all of the cached data they can find looking to see if there's private info (both because it's a lot of work and a huge waste of time since it won't affect anything, and because it's private info; chances are nobody's going to see it normally, and having employees reading your private messages doesn't help anyone and is a violation of your privacy).

<comment><USER19> _2\. Information that can be actively exploited, but can also be fixed so the previous disclosure is harmless. This means passwords, authentication tokens, etc._

I wouldn't call the disclosure harmless. It's unknown if anyone made use of the leaked information before Cloudflare knew, so accounts should be treated as compromised unless it's shown otherwise.

Also, leaking user credentials to any system that handles payments and health info would also breach PCI/HIPAA . This broadens the scope of systems effectively breaking the law.

Another thing to keep in mind is that many(most?) token based authentication systems don't invalidate tokens. So any tokens captured will be valid until they expire, and they can't be "changed" without invalidating every outstanding token (changing the server key)

<comment><USER17> No I mean after it's fixed, the previously-disclosed information becomes harmless. Obviously anyone who exploited it before you reset your password/tokens may have caused you harm.

> _Another thing to keep in mind is that many(most?) token based > authentication systems don 't invalidate tokens._

In my experience, changing your password generally invalidates all outstanding tokens. And yes, this does mean invalidating all of them instead of just the leaked one, but that's not usually a big deal.

</comment></comment></comment></comment></comment></comment><comment><USER20> It seems to me like the point of this post was to clarify whether the vulnerability was being actively exploited prior to the announcement, and I think it does that well.

Just think of how easy it would have been to exploit this bug: buy a load of random domains, host some plausible looking but malformed content on it then setup a few thousand bots to hit those sites and harvest the responses. Keep that plugging away for a few months and you'd easily collect a lot of supposed-to-be-private info.

That would have been an order of magnitude worse than having to sift through caches for scraps. Not to say that what's happened is 'good', but it could have been a whole lot worse.

</comment><comment><USER21> Disappointing that their response is "damage control" and downplaying impact.

<comment><USER22> Why? As long as they come along with facts and data, then that's a good thing.

<comment><USER19> they only sampled a few thousand leaked responses out of over a million. The margin of error is 2.5% on conclusions because they didn't use enough data, not even close.

</comment></comment></comment><comment><USER23> But also, we gotta start writing stuff like this parser in safer languages where this class of bug simply can't happen, right? Every time one of these breaches occurs, it's basically the same thing. "Data wasn't what we expected, we read a bunch of extra junk that had nothing to do with the input." It's kind of crazy it's acceptable at all.

At this point, these kind of problems are on us as a community that we keep using unsafe tools. Every time we choose one of these languages we are implicitly trading security for performance (a.k.a. money).

<comment><USER24> If things aren't written in a "safe language" then they should at least be tested. Valgrind should have picked this issue up.

</comment></comment><comment><USER25> I've linked to this post from the top of the pirate/sites-using-cloudflare README. I'm glad that it's a refreshingly level-headed response that isn't placing the blame on Google or other caches. It's still down-playing the potential impact slightly, but at least it's a more thorough response than some of the HN comments we've been seeing from CF employees.

My advice to friends and family currently is to use their "log out all active sessions" buttons, and to reset only crucial passwords. As Techcrunch mentioned in their coverage, many sites will likely pay for identity theft insurance to cover the change of a leak, rather than force password resets and lose their users trust. It's a risk analysis that each site needs to make individually, and it may be the right call to eat the losses of ~10 possibly compromised users instead of forcing millions to reset their passwords.

</comment><comment><USER19> _In total, between 22 September 2016 and 18 February 2017 we now estimate based on our logs the bug was triggered 1,242,071 times._

Wow, so just as bad as we thought.

 _We did not find any passwords, credit cards, health records, social security numbers, or customer encryption keys in the sample set._

BUT WAIT, THERE'S MORE

 _The sample included thousands of pages and was statistically significant to a confidence level of 99% with a margin of error of 2.5%._

Oh, so it could actually be as a high as 2.5% leaking encryption credentials. And if none of the data was found to leak anything sensitive where the fuck is the dataset? I've been around way too long to take a "study" like this at face value without third party verification.

I also enjoy the straight up lie at the end:

 _We are continuing to work with third party caches to expunge leaked data and will not let up until every bit has been removed._

That sounds great right? Well, its too bad that a lot of 'third parties' are a box sitting on the corporate network edge that hasn't been touched in 5 years. Deleting all of this data from third party caches is not physically possible. In fact it might actually make things worse because it's destroying evidence of which credentials were leaked.

<comment><USER26> 1.2 million page views over 5 months is almost nothing for the amount of traffic going through Cloudflare.

<comment><USER27> It seems to me that the absolute number is what's relevant, not how it compares to the total amount of traffic. That's 1.2 million potential data leaks. That's it "out of a bazillion" doesn't change it.

<comment><USER28> Correction: It's 1.2 million definitive leaks.

The only question is what is in these leaks exactly.

</comment></comment></comment></comment><comment><USER29> Just consider all the private crawlers whose caches _weren 't_ purged.

Anything short of invalidating any and all tokens, cookies and sessions is irresponsible and CloudFlare should communicate is as such.

</comment><comment><USER30> These exact looking numbers are based on extrapolating a look at 1% of all requests, for the sites they think were leaking, for a 10 day period.

They don't get into the full detail of how they knew which sites to look for. For example, if I created a site with these settings, used it for a week, and then deleted it...is my site counted? What if I changed the settings back to normal? Does it slide under their radar? Did they really look for every site that had those settings at any time, or just any site that had those settings at the specific time they looked?

To me, it still feels like there's a window where a bad actor could have created a site that triggers this behavior, and then pumped it with a scraper, over and over.

<comment><USER31> Yeah, exactly - this _" look at a 10 day period and extrapolate"_ idea is based on the assumption that the rate of hits to the triggering pages was constant over the whole time, but in the case of looking for a malicious actor that's essentially begging the question. If there was unnatural traffic in there you _can 't_ assume its rate would have stayed constant over the whole period.

</comment></comment><comment><USER32> I'm glad to see an article that isn't all puppies and kittens, this wasn't a fun thing to deal with and certainly wasn't anticipated. The CloudFlare team did a great job responding to it IMHO.

"Of the 1,242,071 requests that triggered the bug, we estimate more than half came from search engine crawlers."

This is very important to sort out, most people don't think about security much less the storing of credential or identifying data by search engines, this is a huge part of the incident response.

I think that what we should take away from this is that even though the bug existed it was responded to in a reasonable manner.

</comment><comment><USER33> tl;dr excerpted:

In total, between 22 September 2016 and 18 February 2017 we now estimate based on our logs the bug was triggered 1,242,071 times.

1) we have found no evidence based on our logs that the bug was maliciously exploited before it was patched;

2) the vast majority of Cloudflare customers had no data leaked;

3) after a review of tens of thousands of pages of leaked data from search engine caches, we have found a large number of instances of leaked internal Cloudflare headers and customer cookies, but we have not found any instances of passwords, credit card numbers, or health records;

and 4) our review is ongoing.

<comment><USER30> >we now estimate based on our logs the bug was triggered 1,242,071 times

Based on looking at 1% of their log entries for 10 days of the total ~150 day period.

</comment></comment><comment><USER34> >In total, between 22 September 2016 and 18 February 2017 we now estimate based on our logs the bug was triggered 1,242,071 times.

So uh, Cloudflare has logs of all page loads since september at the very least? And I guess with response sizes, since that seems like the most reasonable way for them to come up with such a number.

Awesome.

<comment><USER28> Doubt that they have any log, they have explained before that they only keep 4hours of logs because it's too much volume of data. FYI: Traffic is over 4M requests per second.

Guess they only kept a counter of requests. A bit of maths and you get an estimate for the amount of leaks.

</comment></comment><comment><USER35> Their messaging is a bit strange. They write:

> For the last twelve days we've been reviewing our logs to see if there's any > evidence to indicate that a hacker was exploiting the bug before it was > patched. We've found nothing so far to indicate that was the case.

right after they explain:

> Cloudbleed is different. It's more akin to learning that a stranger may have > listened in on two employees at your company talking over lunch. ... you > can't know exactly what the stranger may have heard, including potentially > sensitive information about your company.

So they say they've found no evidence after explaining that the situation is analogous to a case where no evidence can be found even if information were stolen.

</comment><comment><USER36> I'm not going to comment on the methodology of CloudFlare's analysis, but just the fact that they are logging millions of unencrypted HTTP requests (cookies, headers and all) is just scary! Wasn't the point of SSL/TLS that intermediate proxies cannot peek into requests?

<comment><USER37> We're not logging "cookies, headers and all".

<comment><USER36> My bad! Just re-read the article and it did say information about requests and responses. Thanks for the clarification.

</comment></comment></comment><comment><USER38> A theoretical question.

There seems to be some question about whether any passwords were actually leaked, but in principle some password data could have gotten out.

What would actually have been leaked, a cleartext password or the encrypted/hashed password stored on an affected server (or both)?

I have accounts on a number of sites that were affected by Cloudbleed, as indicated by [http://www.doesitusecloudflare.com/](http://www.doesitusecloudflare.com/), and I've already changed my passwords on those sites. But the passwords I use are randomly generated and should be practically unguessable given a hashed version. Would I have been at risk if I had left my passwords alone?

<comment><USER39> > What would actually have been leaked, a cleartext password or the > encrypted/hashed password stored on an affected server (or both)?

Depends on the app. The apps I write will do a PBKDF2 w/ 20K rounds on a password _before_ sending to the server, which then hashes that hash again before storing/comparing. I suspect most apps just sent the username/password plaintext over SSL, meaning the plaintext passwords would have been leaked if the app used Cloudflare to terminate SSL.

That said, if someone got the PBKDF2ed password hash from the SSL payload, they could just as easily use that to log into an account, but they'd have to at least do a little bit of work to break the hash if they wanted to actually crack the password.

In other words, you were absolutely right to change all your passwords.

</comment></comment><comment><USER40> If users were discerning based on the inner workings of this organization, they should be switching their nameservers away from Cloudflare. Quantifying the number of domainnames CF has in their zones before and after this reported incident would be interesting. Sadly, I doubt there will be much change.

</comment><comment><USER41> TL;DR: "Since this is just a sample, it is not correct to conclude that no passwords, credit cards, health records, social security numbers, or customer encryption keys were ever exposed."

</comment><comment><USER42> My website gets 75,000,000 total requests per month through CloudFlare, so they estimate 6-11 leaks.

I am happy with the way CloudFlare have responded to this.

</comment><comment><USER19> Tagging along on the top reply here, but does anyone else notice some serious HN gaming going on in this thread?

Accounts commenting that have made 10 comments in 5 years, people defending CF that, after going through their profiles, are clearly linked to CloudFlare or maybe even employees. Top relies suddenly being near the bottom and replaced by posts supporting CloudFlare with statements that don't match what was actually in the blog post.

Just seems really really fishy to me

<comment><USER43> I doubt anything more nefarious is happening than a flood of CF employees hitting the thread. Is that gaming?

<comment><USER44> It's, at the very least, disingenuous.</comment></comment></comment>


Ask HN: Do you separate your online presence? If yes, then how? - <AUTHOR> Are your online accounts immediately linkable to your real name? Do you use different identities for different communities or services? If you order pizza online, do you use your real name? Etc., etc. You get what kind of answers I want.<p>Throwaway accounts are obviously welcome, but not necessary. <comment><USER2> I make no effort to disguise my identity. I think if more people posted under their own names, discourse would be more polite.</comment>


Show HN: #Startup – A global startup community, on Slack - <AUTHOR> http://www.hashtagstartup.co/ <comment><USER2> The domain is dumb, Slack's hash logo is a nod to IRC and not Twitter. It doesn't represent tagging, it represents IRC channels.

Edit: hey hastagstartup.co downvote brigade, hashstartup.co is still available. So is hashstartups.com which is even better.

<comment><USER3> Wrt your edit, do you really think that people downvote you because they _disagree_ with you?

<comment><USER2> It's more than a little suspicious that I immediately got 5 down votes for my critical comment, but have since broken even on karma again. I'd like to think my further arguments below did it, but more likely this thread was posted in one of the hashtagstartup channels.

<comment><USER4> Don't usually do this, but I'll explain the downvotes (I've never heard of this project). Your original comment felt needlessly aggressive and had nothing to do with discussing the project's merits. The follow-on comments were in the same vein, and the entire comment thread felt like a flame war for no reason.

So I downvoted because I wanted to signal that I'd like to read less content like that on here. I went and checked the HN guidelines on content, and here's a few points which I felt supported the downvote:

"When disagreeing, please reply to the argument instead of calling names. E.g. "That is an idiotic thing to say; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."

"Resist complaining about being downmodded. It never does any good, and it makes boring reading."

"Please don't bait other users by inviting them to downmod you."

And now I have contributed in uselessness to this comment thread, the cycle is complete :).

<comment><USER2> You explained your downvote not the downvotes. 5 down within 5 minutes happens, but if it was that egregious the comment should not have recovered.

</comment></comment></comment></comment></comment><comment><USER5> The signup has really bad UX. Can't even use it.

There is a secret (or you will find it later):

\- You have to pay 10$;

\- or write a "great motivation";

to sign up.

<comment><USER6> True, since it is handwork, we give priority access to those that are willing to contribute.

We also check every motivation, and sometimes they're just bad or a couple of words and we don't let that person in.

I will take a look at the UX, thanks!

</comment></comment><comment><USER7> Speaking of #startups, that channel is free to join on irc.freenode.net.

<comment><USER8> Yeah no thanks. I've been on there a few times. That channel is filled with a bunch of sweary and self-centered people. It's probably the anonymity but I'd rather hang out in r/startups before I'd go back to the IRC chat.

<comment><USER7> It's got its plusses and minuses. People sometimes shoot the breeze rather than narrowly focus on the topic at hand, so yeah, sometimes there's a lot of noise compared to signal.

I prefer here, or, as of late, [http://discuss.bootstrapped.fm/](http://discuss.bootstrapped.fm/) for more serious discussions, although occasionally something interesting comes up on #startups. Sometimes the informality is helpful, as you can chat about something you don't particularly want plastered all over HN...

</comment></comment></comment><comment><USER9> For those who are wondering the slick UI for the sign up was made with Typeform out of Barcelona :)

<comment><USER10> FYI that form fails hard on Mobile Safari if you happen to rotate. Form elements go offscreen and you can't pinch zoom your way back to them.

[https://www.dropbox.com/s/yyykioemk8z0pqy/Photo%20Dec%2030%2...](https://www.dropbox.com/s/yyykioemk8z0pqy/Photo%20Dec%2030%2C%204%2038%2052%20AM.png?dl=0)

[https://www.dropbox.com/s/6jbmiifu9y5qabd/Photo%20Dec%2030%2...](https://www.dropbox.com/s/6jbmiifu9y5qabd/Photo%20Dec%2030%2C%204%2038%2058%20AM.png?dl=0)

[https://www.dropbox.com/s/q7sq5ztyrafkyly/Photo%20Dec%2030%2...](https://www.dropbox.com/s/q7sq5ztyrafkyly/Photo%20Dec%2030%2C%204%2039%2012%20AM.png?dl=0)

<comment><USER9> Thanks, our dev team is on it :)

</comment></comment></comment><comment><USER11> I was ready to donate the €10 but found it just wants me to enter credit card details onto the application form and I was on a non-https page. It said it uses Stripe but it's tricky to tell if that's really the case (I don't believe there's bad intent here at all, but the UX for taking the payment doesn't inspire confidence).

<comment><USER6> We've heard this once before. And I totally get the concern. I'll make sure someone at Typeform hears about this, as they are on #startups. We'll embed stripe checkout on the homepage soon I guess. Thanks.

<comment><USER12> Great idea with #Startup, guys! An insecure HTTP address is a concern though, which gave me a bit of a pause --- the developer in me speaks here --- although it's great a TypeForm page is offered at the bottom of the "Apply" panel (except it's not easy to notice; maybe a bigger font or highlight color will do the trick)... I believe an HTTPS-hosted page will do wonders, guys! :)

</comment></comment></comment><comment><USER13> The concept of a global community of startup people is nice, but why do I have to use your platform to be a part of it?

That question felt unanswered to me after 60 seconds on the landing page.

<comment><USER6> You don't have to become a member of our community, but I might be able to give you a couple of reasons why it is what it is today, if you can let me know which one we should put up on the page according to you?

\- hosted/organised by an independent non-profit with the goal to help founders \- using slack, easy and unobtrusive cross platform system \- members are selected upon their motivation

Or because it already exists in a great form? There are multiple others, but we are open to anyone that can provide a motivation.

<comment><USER13> I mean in my mind I'm comparing it to a well moderated IRC channel.

Is there a technical limitation of IRC you're overcoming or is it a user interface choice?

</comment></comment></comment><comment><USER14> Cool!

Shameless plug: If you're interested in the actual hashtag on Twitter, you could like to use of our free embeds:

[http://hashtagify.me/explorer/embed_wizard?hashtags=startup&...](http://hashtagify.me/explorer/embed_wizard?hashtags=startup&mode=basic)

Also let me know if you'd like to get detailed analysis of the #startup hashtag, I'd gladly contribute it for free.

<comment><USER6> Ha, that could be cool to share with the group :) Could you send me the detailed analysis on hello startupfoundation co ?

<comment><USER14> Just sent it - let me know if you get it (you never know with the spam filters).

</comment></comment></comment><comment><USER15> Pretty cool! I just signed up. I think its an interesting line of dialog to have going in the background, and am hopeful it will make the path to starting and running a startup clearer for me.

The signup process is kinda neat, but some of the questions made me go "errr..."

edit: i see they(you?) use typeform for the signup form; never heard of them before, but pretty neat!

<comment><USER6> Which made you go "errr..."? We try to get an idea of who a person is. Also, if they have founders in their network, or if they are just lazy and skip questions ;-)

<comment><USER16> All of the questions around "What can you bring to #startup?" or "What do you want from #startup" or "What #startup founder do you want to connect with" fell extremely flat with me - I abandoned the form.

I'm on the page because you posted it here, on HN, and I started the flow because the premise seemed interesting, and I have a startup. I don't have any goals, and frankly, the pitch made it sound like more value would be flowing from the community to me. I don't have goals I need met from #startup because I have no idea what it will be like.

Those questions made it seem like you guys are just in it for a PR grab or a pivot into an incubator, which I am absolutely not interested in at all.

<comment><USER6> We know it's a ton of questions, and not all of them are very important. But the goal here is to separate those who are truly motivated from those who will come in and just lurk, self promote or scout.

I'm sorry if you think we have some hidden agenda, which is certainly not the case as screening the applications is an extreme amount of work. The way the application is set up we will also have a lot less applications being submitted, which is a nice side effect as we already have hundreds waiting.

</comment></comment></comment></comment><comment><USER17> We've been making something during our internal hackathon with a similar goal in mind, but perhaps a different approach. Hopefully I can get some feedbacks: [http://jiver.co/startup](http://jiver.co/startup)

It's a rough alpha (desktop web-only, mobile support in January).

</comment><comment><USER18> Why you always use weird slack for private community chats? It has really slow performance everywhere.

</comment><comment><USER19> I see that you ask for 10 euro donations. What is the money used for?

<comment><USER6> It goes to the Startup Foundation, an independent non-profit supporting founders building more successful startups, of which I am the Chairman.

#startup is our latest initiative, but we're working on a progress report tool (enabling founder to give peer feedback and to report to investors and coaches).

We also have a weekender format like Startup Weekend or Lean Startup Machine, which we have done 10 of to date and will roll out in 2015. Next to that we have an incubator in Rotterdam, the Netherlands and a big meetup group for that city.

Our goal is that all of our initiatives generate surplus revenue to be able to roll out new initiatives and improve existing ones.

But for #startup, it is also a great way to find out who is motivated to get in and contribute. Most of the contributions are actually from people who have heard about what it is like on the inside.

You see, we normally get tens of applications per day, and some people just want to get in ASAP. This way they can, without us having to screen everyone that wants to get in directly.

Now that we're on PH, HN, Reddit and Betalist, we've got hundreds of applications just today. And we will screen them all, so it might take a week to get in.

\+ not every motivation is good enough to get in, cash tells us you are at least slightly dedicated.</comment></comment>


Launch of Mypoolin Google Chrome Extension - <AUTHOR> https://chrome.google.com/webstore/detail/mypoolin-payments-with-fr/imigmmaibiaahbmfgkljgabkjjpkfppk <comment><AUTHOR> Flow for creating a pool - Install this extension and experience sharing money & splitting the cost as easy as 1-2-3 1) Browse any product on major shopping sites in India (Amazon, Flipkart, MakeMyTrip, ClearTrip, BookMyShow, Myntra, Jabong, Nearbuy & Weddingz. More to come very soon!) 2) Create a Pool with friends in few seconds by clicking on the automatic notification received on that page 3) We will pre-fill all your details like product name, amount and description link automatically on the pool page. Invite your friends using our gmail plugin (or manually), chat with them and split the cost for everyone to pay their share 4) Get collected amount as cash code immediately of our partner sites or in any bank account within 1 working day. In case of movies, events and deals, get the booked group voucher / tickets directly in your inbox within a few hours!</comment>


Machine Learning: Curse of Dimensionality - <AUTHOR> http://www.edupristine.com/blog/curse-dimensionality

<comment><USER2> As a counterpoint, the Blessing of Dimensionality is that local minima are mostly as good as the global minima.

In David Silver's RLDM 2015 talk @20 mins in

[http://videolectures.net/rldm2015_silver_reinforcement_learn...](http://videolectures.net/rldm2015_silver_reinforcement_learning/)

he recounts this as his experience.

the paper _The Loss Surfaces of Multilayer Networks_ goes in depth [http://arxiv.org/abs/1412.0233](http://arxiv.org/abs/1412.0233)

[edit] and the paper _Qualitative Characterisation of Neural Net Optimisation_ [http://arxiv.org/abs/1412.6544v4](http://arxiv.org/abs/1412.6544v4)

<comment><USER3> Local minima are only nearly as good as global minima in very very deep networks.

<comment><USER2> And yet Goodfellow et al's paper only uses 2 hidden layers and 1 softmax output layer (on MNIST) which is not so very deep but the effect is still present.

( _Qualitative Characterisation of Neural Net Optimisation_ ICML 2015) [http://arxiv.org/abs/1412.6544v4](http://arxiv.org/abs/1412.6544v4)

On p.6 Goodfellow et al. compare the neural nets to linear solutions by removing the non-linear layers, so that a single linear function is learned and find for Deep Linear Networks that :

" All minima are global minima, and are linked to each other in a continuous manifold. "

Which is pretty exciting because the received wisdom was local-minima are a really big problem.

</comment></comment></comment><comment><USER4> Another problem worth mentioning is that computing e.g. Euclidean distance you end up adding up things of completely different types, and their relative weights are often entirely arbitrary, e.g. adding distance and weight.

Imagine three points on two-dimension plane: A(1,1) B(5,10), C(2,100). Clustered like this, A and B will end up in one cluster, while C is in another. Now let's scale down the second axis by a 100, now we have A(1,0.01) B(5,0.1), C(2,1) so A and C are clustered together, while B is the second cluster. And that's just liner scaling, imagine how much havoc I could wreck with a logarithmic scale?

I haven't done anything to research this problem, it's just something I came across that made me uneasy about clustering as a whole.

<comment><USER5> You're supposed to normalize the value of your range on all dimensions so that they are the same numerical magnitude/range (as the simplest normalization).

The issue is definitely not specific to clustering, you would have the same problem with one dimension dominate the weight without normalization even for simple regression too.

</comment></comment><comment><USER6> The curse of dimensionality is real and problematic, but it only applies to the real dimension of the problem, not the measured/perceived one.

Let's say you have samples with 5 dimensions. That's still not (usually) considered within the realm of the curse.

Now, let's assume that because of the way they are measured, you actually have 10,000,000 measured dimensions for each sample. Now, it starts to be a problem - especially if you don't know how that expansion happens -- it might be linear, nonlinear, with noise, etc.

Even though we are now working in 10,000,000 space, and it looks like the curse of dimensionality applies, it does not. You just have to find a reasonable way to compact everything back down to the _real_ problem dimension, or somewhere close enough to it.

The most popular tool for this is called Random Projections, that follows from the work of Lindenstrauss and Johnson in 94. Compressive Sensing is a complementary field.

<comment><USER7> What you want to get down to is the intrinsic dimensionality. Go below that and you start discarding useful information.

</comment></comment><comment><USER8> Relevant HN post from some time ago:

[https://news.ycombinator.com/item?id=3995615](https://news.ycombinator.com/item?id=3995615)

The problem with the super simple explanation at the beginning (searching for the penny) is that it doesn't really expose the error of our insight in higher dimensions: everybody knows intuitively that as the dimensions goes up there's more "space". Insight fails, I think, in trying to understand what this statement really means and its effects on point distributions aka objects.

</comment><comment><AUTHOR> Curse of Dimensionality refers to non-intuitive properties of data observed when working in high-dimensional space, specifically related to usability and interpretation of distances and volumes.

<comment><USER9> I remembered someone telling me that they prefer cosine similarity over euler many times. I was looking into reason why and found an interesting paper "On the Surprising Behavior of Distance Metrics in High Dimensional Space"[1] which at some point argues that fractional metrics are perform better than more widely used distance metrics on high-dimensional space

[1] [http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.23....](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.23.7409&rep=rep1&type=pdf)

<comment><USER10> There is a cornucopia of distances to choose from. It's not as simple as "just use the best one." Cosine similarity assumes a certain projection of data (by ignoring distance of points are from the origin). It preforms well whenever that's a good projection. I think it's best to think of it as one way to reduce dimensionality, and should be used when you think that's the right way to reduce dimensionality.</comment></comment></comment>


Show HN: A christmas story (with programming and logic) - <AUTHOR> https://jindosh.com/demo <comment><USER2> Alice likes candy

Children who read are well read

Kids who like candy have red hair

Well read children do not misbehave

Children who don't misbehave are nice

Books are read by children with red hair

\</comment><comment>----

Conclusion: Santa's a nutjob.

<comment><AUTHOR> [http://www.math.hawaii.edu/~hile/math100/logice.htm](http://www.math.hawaii.edu/~hile/math100/logice.htm) :D

</comment></comment><comment><AUTHOR> The creator here, happy to answer any questions, or comments you may have :D</comment>


The Angry Programmer - <AUTHOR> https://hackernoon.com/the-angry-programmer-52a93bfcbc3c <comment><USER2> Although the MBTI is widely criticized/weak, I've found it to be quite a lot of fun for having discussions about personality with friends/family.

The MBTI makes strong statements about personalities which inevitably leads to inaccuracies, but it does make for an interesting starting point to talk about the way that people interact.</comment>


You Don't Have to Like Assange to Defend Him - <AUTHOR> https://www.theatlantic.com/ideas/archive/2019/04/julian-assange-arrested-journalists-defend/586936/ <comment><USER3> Assange is accused of working with Manning to crack a Linux password hash of a government computer so Manning could gain access. It's not about publishing any data obtained; he was, it seems, not a passive receiver.

[https://games- cdn.washingtonpost.com/notes/prod/default/docu...](https://games- cdn.washingtonpost.com/notes/prod/default/documents/3add1fee-2dcb-40d9-b260-a5bf4eee3e56/note/584d0e06-4701-4fee- ad79-82c4e6509c83.pdf)

<comment><USER4> This is _the_ critical difference. If the NY Times stole the Pentagon Papers themselves, they committed a crime regardless of whether or not they choose to publish the material. If Daniel Ellsberg steals the Pentagon Papers and the Times and Washington Post choose to publish them as part of their reporting on the Vietnam War, they are not somehow made accessories to his crime through publication.

Assange can publish whatever he wants* (*according to the US laws that govern freedom of speech, etc.) but as soon as he becomes actively involved in the exfiltration of classified material he is breaking the law.

<comment><USER5> > *according to the US laws that govern freedom of speech, etc.

He's an Australian currently in the UK though. I don't like the global reach of US laws.

<comment><USER4> The US isn't special in this regard. Many nations have extradition treaties with each other and they are often invoked in cases of espionage. To paint that as US law "reaching the globe" is a bit facetious; everyone is entangled in everyone else's law—especially when it comes to espionage.

<comment><USER5> I couldn't find any good comparative statistics, but I hear about people being extradited _to_ the US a lot more than _from_ , giving the appearance of a rather one-sided relationship. The treaties may be the same, but they don't seem to be used the same.

<comment><USER6> According to the UK's Home Office, the US requests more extraditions of UK citizens than vice versa, but that might be due to the relative population sizes.

[https://www.gov.uk/government/publications/extradition- reque...](https://www.gov.uk/government/publications/extradition-requests- between-the-uk-and-us-from-april-2007-to-may-2014/extradition-requests- between-the-uk-and-us-from-april-2007-to-may-2014)

<comment><USER7> Your link doesn't list the reason for extradition, doing some research on this issue, I see parental kidnapping generates a fair number of extradition requests.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> The attempt of the US government to prosecute Assange is the gravest possible threat to press freedom imaginable.

People are talking about a hashed password like its something new, but this is not new information at all. The Obama justice department had all the same chat logs - no new evidence has been discovered since then - and knew all about this but decided they couldn't prosecute without endangering press freedom.[1]

So if you don't think this is a major assault on press freedom, you should at least realize you are disagreeing not only with me but literally the Obama justice department which looked at this for _years_. Why is it that they came to this conclusion and never moved forward with the case, but now the __TRUMP __administration is pursuing it anyway?

It's not just american journalists that are at risk, but this is meant to send a chilling message to anyone anywhere on earth that you better not report on the US government negatively or else we will have you extradited, prosecuted as a spy, and thrown in solitary.

Anyone cheering on the US government as they try to set a precedent for prosecuting journalists as spies needs to think more carefully about this issue.

[1] [https://www.washingtonpost.com/world/national- security/julia...](https://www.washingtonpost.com/world/national- security/julian-assange-unlikely-to-face-us-charges-over-publishing- classified- documents/2013/11/25/dd27decc-55f1-11e3-8304-caf30787c0a9_story.html?noredirect=on&utm_term=.871739c8b0c9)

<comment><USER9> The article you posted highlights exactly what's happening here, he's being charged with hacking, not publishing.

> One former law enforcement official said the U.S. government could bring > charges against Assange if it discovered a crime, such as evidence that he > directly hacked into a U.S. government computer. But the Justice officials > said he would almost certainly not be prosecuted for receiving classified > material from Manning.

<comment><USER8> The indictment is not only about hacking, but about aiding the source in avoiding detection, and encouraging them for more documents.

There is zero allegation of hacking. Rather they are saying Manning sent a hashed password and Julian said in the chat he sent it to his team and then it never went anywhere. Calling this hacking is a big stretch.

This article from 2011 shows the Obama justice department knew all about this[1], check out the last two paragraphs which I will post here:

"In the exchange prosecutors showed in the courtroom, Manning appeared to have sent Assange a "hash," or encrypted, password. Assange said he'd passed it on to members of his team, but the exchange prosecutors showed did not indicate whether WikiLeaks ever actually helped Manning with the password.

That chat could be a critical one for the parallel criminal investigation the Justice Department is pursuing into Assange and WikiLeaks. If Assange gave Manning advice or assistance in breaking into computer systems, that could transform Assange's role from a mere recipient of secret data to a conspirator in efforts to steal it."

I am curious why you think the Trump administration is pursuing this now whereas the Obama DOJ declined to prosecute sighting the "new york times problem" as described in the previous link.

[1] [https://www.politico.com/story/2011/12/defense-manning- was-o...](https://www.politico.com/story/2011/12/defense-manning-was- overcharged-070787?paginate=false)

<comment><USER9> I've always assumed Obama's DOJ would act once they were able to, and that the DOJ itself was always intent on pursuing. He finally wore out his Ecuador welcome and so it's happening now. Had Clinton won, I think the outcome would be the same, if not far more aggressive (due the DNC email leak).

</comment></comment></comment></comment><comment><USER10> Being given government secrets and publishing them for the public interest should not be a crime, and it isn't. The New York Times won that case 8-1 or 9-0 at the Supreme Court for the Pentagon Papers.

Assisting with the exfiltration of that data is clearly a different beast. Professional journalists know the difference, and stay clear of it to protect themselves, their employer, and the trust journalists are granted.

Helping to crack a password clearly crosses the line, even if it's minor in the scheme of things, or unsuccessful. There will be endless handwringing here on HN over the precise definition of "assistance", because somehow the tech community cannot handle the ambiguity of non-binary real world situations. Would it be material assistance to let your whistleblower use your USB stick? What if you bought them a coffee on the morning they did the deed? etc... But the inability to precisely define the single tree that makes the forest doesn't stop us from making any "forest or desert?" decisions.

Of course this sets an ugly precedent. To the ignorant, it suddenly becomes far less extraordinary to see a publisher of secrets in jail. The Atlantic is rightly worried here, because who knows how long the courts will still operate independently, considering the current trajectory of other institutions like DoJ?

<comment><USER11> So he helped crack a password like, what a decade ago?

Time served for having to live in an embassy for the last several years?

You're right, it's illegal, but it just doesn't feel that _bad_ to me. Not even remotely on the level of the problems we face as a country this day. It almost feels petty.

<comment><USER9> He didn't have to live in the embassy. Sweden was by all accounts far less likely to extradite him, but he choose to flee rather than face his rape charges.

Even if he had been convicted in Sweden he would have been out by now.

</comment></comment></comment><comment><USER12> I don't think the fact that he once worked with a sincere whistleblower to release information in the public interest should automatically excuse anything else he may have done.

<comment><USER13> Well, he is only being extradited to the US because of the time that he worked with the sincere whistleblower.

He hasn't been charged for anything else "bad" that you think he has done.

So it seems like it would be pretty easy to denounce this extradition, because it specifically relates to the sincere whistleblower "crime".

<comment><USER14> It would be unfair to say that we must grapple with the particular, legal questions of the current charges but don't have to speak about the general, not-necessarily-legal, questions of Assange's overall behavior.

Al Capone was indicted under charges of tax fraud, though that was not primarily why authorities wanted him. We must consider both consider the justice of _those particular_ charges as well as the justice of general punishment of Capone, whatever the source.

What I mean is that we have to consider both things separately and simultaneously. You're correct that we need to think about if we agree with this particular charge. I'd also say that you have a similar responsibility to say if Assange should be charged for, as you said, "anything else 'bad'" he's done.

<comment><USER15> Are you saying that, like Al Capone, Assange has somehow threatened people with knowledge of some greater crime?

If you're referring to the Swedish allegations, keep in mind Assange constantly made himself available to the Swedish prosecutor to answer questions at any time the prosecutor asked: via video conference, in person or otherwise. The prosecutor declined.

To compare that behavior to Al Capone is odd.

<comment><USER14> > Are you saying that, like Al Capone, Assange has somehow threatened people > with knowledge of some greater crime?

I'm not sure what you mean by this, so I'm not sure how to answer - if you expand I'm happy to respond.

I'm not an expert on Assange or Capone. I invoked the example because I understand that people dislike Assange for reasons related that are unevenly covered by the law. That seemed similar to Capone who, as I understand, operated at a time where little of his actual behavior violated the law (though he was at the top of a violent criminal organization).

The things people dislike Assange for may or may not be narrowly legal - <USER2> their feelings towards him will affect how they treat these charges against him.

> The prosecutor declined.

This is a longer discussion, which we can have. Generally, for the Swedish legal system to be able to take action, it must have power over the object of its action. Saying you will "cooperate" as long as you aren't subject to the power of a process which demands power over you seems, to me, like a rhetorical maneuver than genuine effort to engage. His arrest illustrates why he was nervous about leaving the embassy, of course, but doesn't make evasive representations more true.

<comment><USER15> > I'm not sure what you mean by this, so I'm not sure how to answer - if you > expand I'm happy to respond.

People were unwilling to testify against Capone due to fear of violent retribution. That's the basis of going after him for tax evasion.

Saying you must have power over someone before you can talk to them gives the lie to the Swedish prosecutor aim being determining the facts of the Ardin case

</comment></comment></comment></comment></comment></comment><comment><USER16> > The effort to extradite and prosecute the WikiLeaks founder threatens the > free media.

No, it doesn't; press freedom is the right to publish, not the right to actively participate in breaches of non-social (e.g., physical or technical) security measures.

> The charges leveled against Assange stem from the 2010 Manning leaks, which > were judged to have been in the public interest by some of the world's most > significant and thoughtful news publishers, who ran some of the revelations > in their pages.

News publishers don't have any binding authority to decide what is in the public interest; there is no Constitutional prerogative to an institutional press pardon for criminal offenses. Further, this claim is outright dishonest: the decision to publish _some of_ the information as being information whose publication was in the public interest _is not_ a judgement that the leaks themselves were, on balance, in the public interest.

</comment><comment><USER17> I love this quote:

> Assange may be an asshole. Scratch that, Assange is an asshole. But we're > going to have to stand up for him anyway.

That being said, the more I read into the story, the harder and harder it is to defend him.

</comment><comment><USER18> True, I don't have to like him to defend him. I do, however, have to feel confident that I know the facts -- and I don't feel confident at all about that.

<comment><USER19> Actually this is the opposite of the American system of justice.

People are presumed innocent until the facts are known. So it's only afterwards that we should, according to our culture, give up his defense.

<comment><USER20> The judicial system presumes innocence. The media, and public opinion, does not. It's debatable if the court of public opinion should presume innocence as well.

<comment><USER21> It _should_ but does not. The court of public opinion should be subordinate to the judicial system. When it isn't, you end up with a kind of cognitive dissonance where someone is legally declared not guilty but still suffers social consequences due to bad optics.

<comment><USER18> > The court of public opinion should be subordinate to the judicial system.

I don't think I agree with this. The legal system decides whether or not an action was legal, not whether or not an action was acceptable in society. The court of public opinion decides whether or not an action was acceptable in society, not whether or not it was legal.

They address two different things, and I think that's proper. You don't really want the legal system deciding social mores, and you also don't really want legality to be determined based on the public's emotional reaction to things.

<comment><USER22> > The legal system decides whether or not an action was legal

This isn't quite right. The legal system decides if a person is guilty of committing an illegal act, and if so, what the sentence should be. The system may find that the person did not actually perform the act they were accused of doing, regardless of the legality of that act.

</comment></comment></comment></comment></comment></comment><comment><USER23> I think there is the small chance the extradition won't go through.The UK courts are particularly considerate when it comes to extraditions -- when compared to other countries, it's not just a a hand-stamp (usually). In fact, Google the term "uk refuses to extradite" and there's pages upon pages of results.

It's probably his best hope. The current charges are thin -- based on one statement he made to manning -- and the feds know this. BUT the reason you never talk to the feds is that it is way, way to easy for them to get you on other charges: purgery (generally the main one if they can't get you for anything else), conspiracy, racketeering, and of course with this one they have a litany of government security charges they can cherry pick as well.

If he doesn't have excellent legal representation (even with) he's in real trouble. His best shot is to fight to not come here in the first place -- if he can make a case that they may bait and switch the charges to national security, and somewhere put the death penalty into play, that could work.

Note that I don't know how it works being that he is actually an Australian citizen -- does the UK care if it's not one of its citizens facing what their courts would consider unfair charges overseas? (which is their standard for denying extradition -- I'm not judging the charges either way)

<comment><USER24> > ... purgery (generally the main one if they can't get you for anything else)

Perjury (for the benefit of those who were as confused as I was).

<comment><USER25> A rather spooky Freudian slip that suggests purging Assange...

<comment><USER23> I won't fix it for that reason...

</comment></comment></comment></comment><comment><USER26> Barrack Obama pardoned Manning on his last day in office. If Assange's only crime is assisting Manning, and Manning's sentence has been commuted by the very President of the United States and is now free, why are we on a hunt for Assange?

It may sound a bit silly but is an honest question.

It's like... if I commit a robbery and you drive the getaway vehicle, I am (the actual robber) deemed innocent and let go, but you still go to prison for being an accomplice. It makes little sense?

<comment><USER27> a president commuting a sentence is orthogonal to whether or not a crime actually occurred. imo, the president was reacting to the political reality that, in the public eye, manning was becoming a sympathetic character and had already been punished enough. there's no particular reason why the same deal would be extended to assange, who has essentially spent the last several years thumbing his nose at the US government.

> it's like... if I commit a robbery and you drive the getaway vehicle, I am > (the actual robber) deemed innocent and let go, but you still go to prison > for being an accomplice. It makes little sense?

it could easily be the case that there's enough evidence to show that a robbery occurred and that I drove the getaway car, but not enough to convict you of the robbery itself. the fact that one of the accused in an alleged conspiracy is found not guilty really has no bearing on whether others can still be convicted.

<comment><USER26> Got it, thanks for your comment. Makes sense.

</comment></comment></comment><comment><USER28> > As an organization that believed in radical transparency, WikiLeaks wanted > all the material in the public domain.

Wikileaks and Assange only believe in radical transparency when it isn't applied to themselves.

</comment><comment><USER29> What I particularly don't understand is how his government, my government, Australia, has left him hanging for all this time with never a reproach about the situation. I can only assume that the 5 eyes network is so tightly knit that it's inconceivable to our politicians to do the right thing and say "No, he's one of ours: you might have grievance with him -- but tough luck".

Instead, he's been holed up in the embassy of a country that initially had the fortitude to say just that. But since the Equidorian political landscape had shifted, so has the message it has sent. Sadly it shifted to what the Australian government has been doing all along, and has colluded in hanging him out to dry.

Tragically, when he arrives on US soil I suspect he in for a very bad time.

I don't particularly agree with Assange's methodology, but I find the actions of the Australian and UK political landscape utterly deplorable.

</comment><comment><USER30> Indeed - I don't like him (but on this basis I'm not a great fan of myself either) - but what wikileaks exposed is important. I'm not even saying it's true, or of importance, or of anything.

Just, as an example:

[https://collateralmurder.wikileaks.org/](https://collateralmurder.wikileaks.org/)

Here's something I hadn't seen before. I didn't see this on my "morning news" \- and I'd really just like to know if this is:

a) true b) if it is, somebody I've employed will step up and defend/explain it.

<comment><USER31> What do you mean is this true?

</comment></comment><comment><USER32> I don't have to defend him either.

</comment><comment><USER33> There was no principle at play when Assange choose to publish the material he did. I fail to see what principles we're defending by choosing to defend him.

</comment><comment><USER34> I don't dislike him, but I won't defend him. I feel that what he did was wrong.

</comment><comment><USER35> The idea that Wikileaks and Assange are members of the "free media" is a joke.

<comment><USER5> Yeah, if the free media is told something is classified, they will do the _responsible_ thing and not pursue the matter any further. They know the government has everybody's best interest at heart, and that if something is classified, it's probably classified for your own good.

<comment><USER36> > They know the government has everybody's best interest at heart, and that if > something is classified, it's probably classified for your own good.

I really hope you're being facetious

<comment><USER5> I think I laid it on pretty thick.

<comment><USER37> Poe's Law. It's impossible to lay it on so thick that someone doesn't already believe that version.

</comment></comment></comment></comment></comment><comment><USER38> I don't think we have all the facts, though I think he's going away longer than Noriega when the US gets their hands on him.

</comment><comment><USER39> Imagine these comments in pre-Obama era, I remember when the left and liberals considered Assange a hero because he exposed the American right wing government back then, no wonder that the tech industry is so left wing to an unbearable and dishonest degree, just because they lost an election to a TV celebrity that they can't imagine despite controlling the entire media and government, the American people could dare challenge them and elect an outsider even if he's a joke like Trump, it must be a Russian conspiracy! it must be everything except that there are other people with other views, right?! The people can't have a another view when we control everything? how dare they? We must destroy even the heroes we made to make sure the people don't dare and have a choice we don't like again ever!

</comment><comment><USER40> [https://www.youtube.com/watch?v=UDnt_CYDiuE](https://www.youtube.com/watch?v=UDnt_CYDiuE)

This debate totally changed the way I look at Assange. So no, I don't have to defend him.

<comment><USER41> glad you're persuaded by a one-sided "debate".

<comment><USER40> Congratulations on finding yourself in a bubble, where no argument can persuade you. Maybe you should watch the whole debate before declaring it one- sided.</comment></comment></comment>


Why Americans Are Having an Emotional Reaction to Masks - <AUTHOR> https://www.bloomberg.com/opinion/articles/2020-06-27/coronavirus-why-won-t-americans-wear-masks <comment><USER2> This article leaves much to be desired. It should be titled "Why _are_ Americans Having an Emotional Reaction to Masks?" \- it asks a lot of the same questions going on through our minds about American culture and acceptance/protest of complying with public health policy without providing compelling reasons for why this is a uniquely American phenomenon.

For example:

> _That is true at least within the context of American culture, admittedly an > outlier, both for its paranoia and for its infatuation with popular > culture._

Is America an outlier for its paranoia? What is the basis of this claim? Is it more infatuated with its popular culture compared to other countries? I do not know and would love to be convinced either way.</comment>


Physics as a Way of Thinking (1936) [pdf] - <AUTHOR> https://kb.osu.edu/dspace/bitstream/handle/1811/72567/OSLJ_V2N3_0241.pdf <comment><USER2> Professor Smith was, at the time of the publication of this essay (in the Ohio State University's law journal), midway through a 20-year span as chairman of the Ohio State physics department.

He basically works his way through history to demonstrate the development of the modern experimental method and extrapolates that society would be best served by extending the scientific method to many more aspects of society (social and cultural issues, etc).

</comment><comment><USER3> Prof. Smith describes how social sciences could benefit from the modern, coordinate-free approach in physics. He also wishes for a tighter coupling in social sciences as we've seen historically with physics (theory) and engineering (practice).

Interesting article.

<comment><USER4> I only skimmed the article but I didn't see the word "coordinate" mentioned.

When you say "coordinate-free" do you mean "independent of any fixed frame of reference"?

Because AIUI coordinate-free actually means something else, it's really just a mathematical detail: the choice to work with vectors as first-class objects rather than arrays of coordinates. It's a question of elegance rather that meaning.

Given the date of this article, the history of the Technocracy movement may be relevant to those who find these ideas appealing.

<comment><USER3> > When you say "coordinate-free" do you mean "independent of any fixed frame > of reference"?

Yes. Einstein's field equation can be derived using differential geometry, e.g. a coordinate-free approach. Prof. Smith discusses the evolution from egocentric (early Greek) to absolute fixed-frame (Newtonian) to coordinate- free (relativistic).

<comment><USER4> As thanatropism said, "coordinate-free" is not synonymous with (Einsteinian) relativity. It's a general mathematical approach, and it doesn't have any philosophical consequences that I'm aware of. Just because spacetime is a curved manifold doesn't mean it can't be dealt with using coordinates in a higher space in which it is embedded.

<comment><USER3> Sometimes, symmetry reductions become easier using a coordinate-free approach. This means that you could better determine invariances in the system without having a bias towards a particular coordinate system. Philosophically, finding commonality in systems is powerful and any bias (coordinates) distorts those commonalities making them harder to perceive. From the article, I inferred that finding coordinate-free approaches in social sciences could be fruitful.

<comment><USER4> I'm not a mathematician or physicist, but (after a bit of googling) I do find some material that advances coordinate-free approaches as a kind of ethical discipline. Relations, understood as ordered pairs, for example, don't have a "natural order", we should mentally maintain the symmetry and absence of priority between statements like "the cat sat on the mat" and "the mat was sat on by the cat".

There's always, in discourse, an origin--a speaker. We can't escape that (see e.g. the linguistic notion of deixis) I think the article risked patronizing the non-hard sciences by assuming that they couldn't see that, being somehow blind to objectivity. Pretty dangerous territory.

<comment><USER3> The focus is on the subtle impact of using some framework for analysis rather than the gross impact of individual bias (obviously that's an issue every scientist should be and probably is aware of).

For example, statistical causal models are widely used in the social sciences. After searching within the field, I looked for a problem associated with explanation ambiguity due to how the models were framed (or could be equivalently framed leading to alternate explanations) and found this paper:

MacCallum, R. C., Wegener, D. T., Uchino, B. N., & Fabrigar, L. R. (1993). The problem of equivalent models in applications of covariance structure analysis. Psychological Bulletin, 114(1), 185-199. doi:10.1037/0033-2909.114.1.185

I'm not sure if they could extend their approach using manifold theory and an equivalence class for the set of models, but I wouldn't be surprised if someone did something similar. It could then be an example of a coordinate- free approach to data analysis in psychology.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> a tldr would be welcome

<comment><USER6> c+p of 252-253:

"The world of physics is then," as Planck says, "a deliberate hypothesis put forth by a finite mind in an attempt to reduce the facts of observation to a system based on certain physical principles such that known phenomena are necessary consequences of the system."

The basic principles are chosen on experimental grounds. Whether they are true or false in the absolute sense is not a pertinent question. Their consequences must agree with nature. They are working hypotheses which are to be discarded whenever they cease to be effective or helpful.

Progress means bringing new sets of observations with the system in a way to give a complete mathematical description of physical phenomena in terms of the fewest principles or entities, that is to find in a variety of physical phenomena essential relations from which future phenomena can be predicted.

Physics is thus a result of our quest for order and harmony among physical phenomena. It is man's best attempt to think vigorously whatever permits of vigorous thinking. It is not fixed but is subject to change and evolution. Whatever comes out must go back to enrich the soil from which it came

I think it's worth the full read, 20 pages of pretty good physics history

<comment><USER5> Thank you.</comment></comment></comment>


Show HN: SSL Decoder – An open-source alternative for the SSL Labs server test - <AUTHOR> https://tls.so <comment><AUTHOR> My weekend project.

* Tries to give all the information you need instead of a rating.

* Open source, so you can self host it.

* Does the entire certificate chain.

* Allows to paste a CRL/Cert

* Validates the certificate, chain, CRL and OCSP (of every cert in the chain)

* Has easy copy-pastable PEM versions of certs

* Ciphersuite enumeration as an option.

* Fast.

<comment><USER2> Thank you so much for this. Can I fork it to add the ability to accept an HTTP POST for the domain/hostname, and return the persistent results URL back to a webhook? (Slack integration)

<comment><AUTHOR> I do have a JSON (plain text, readable json) output endpoint planned, but that will be GET as well. Pull requests are welcome though.

</comment></comment></comment><comment><USER3> These services always dock me for including RC4 ciphers. I understand that these are bad because RC4 is broken or near broken; I shouldn't be using it.

However, I'm simply using load balancering sevices provided by AWS and Rackspace; my understanding is that (since they perform SSL termination) it is their software on the load balancer that chooses the ciphers, and as far as I know, I cannot change this. Are they misconfigured? (why?) Is there any way to work around it short of doing the load balancing myself?

<comment><USER4> It appears AWS lets you configure this[1]. You may have chosen a policy and never changed it. A note on that page says if you don't choose a policy, you'll always use the latest one. It looks like you can create a custom one, as well.

[1][http://docs.aws.amazon.com/ElasticLoadBalancing/latest/Devel...](http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/configure- ssl-ciphers.html)

</comment></comment><comment><USER5> Thanks, looks great!

I'd like to see a check for SSLv2. For instance this site supports sslv2 and it should be flagged: download.biscom.com.

[https://www.ssllabs.com/ssltest/analyze.html?d=download.bisc...](https://www.ssllabs.com/ssltest/analyze.html?d=download.biscom.com)

</comment><comment><USER6> I've tweaked my Apache configuration but don't seem to be able to trigger a rescan--the cipher list doesn't appear to change. I guess it's cached for a little while, but the UI doesn't make that clear.

Also, it's flagging the following ciphers:

      ECDHE-RSA-DES-CBC3-SHA
      EDH-RSA-DES-CBC3-SHA
      DES-CBC3-SHA

These are triple-DES though, rather than just single DES. Is that considered weak these days?

<comment><USER7> They have 112-bits of security and are considered fine until 2030 by NIST. ( _insert opinion of NIST here_ )

The real reason to disable them is because of how slow they are. The only thing that is gonna actually use 3DES for TLS is MSIE on XP, its the last remaining secure cipher.

</comment></comment><comment><USER8> Feature/bug: It doesn't seem to attempt to explicitly negotiate older protocols. For instance, I'm dealing with a site that still has SSLv2 and export ciphers enabled if a client requests it. (Like, if I run openssl s_client -ssl2.) SSLlabs detects this, but tls.so doesn't.

<comment><AUTHOR> Known issue. Have to look in to that...

</comment></comment><comment><USER9> I started to build a similar thing, for the command line, last year but did not get as far.

[https://github.com/jamescun/ssltest](https://github.com/jamescun/ssltest)

</comment><comment><USER10> Few notes:

\- Does not enumerate ChaCha20

\- Doesn't detect BoringSSL - try running it on certly.io

<comment><AUTHOR> ChaCha20 support is not in Openssl 1.0.2 yet, only an outdated dev branch. When it's in, it'll support it.

How would I detect boringssl?

</comment></comment><comment><USER11> Nice.

Friendly suggestion: Show a prominent summary at the top of the report of any areas of concern.

<comment><AUTHOR> That's a good idea. Chain issues are already reported, but expiry or validation errors should be prominent as well.

</comment></comment><comment><USER12> I really like the nice big horizontal check marks for the "health" of each aspect of the certificates. Thank you for releasing this.

</comment><comment><USER13> Why are certificate serials highlighted in red?

<comment><AUTHOR> No particular reason. What would you do different?

<comment><USER14> Maybe he meant that coloring them red means that something went wrong or that there's something that you should pay attention to.

Of course I'm just speculating here.

<comment><USER15> Yes, that's the same impression I got skimming through the page for a domain.

</comment></comment></comment></comment><comment><USER16> Thank you for putting this all together and making it open source. By the way, will you be releasing an API? I think this API would be really valuable.

</comment><comment><USER17> Funny, looked up Gmail and they are still allowing SSL3

<comment><USER18> With browsers supporting TLS_FALLBACK_SCSV the SSL3 risk isn't that great since an MITM attack can't force a downgrade. Therefore SSL3 should only end up being used by old clients that don't support anything newer.

Organizations running such huge websites need to be conservative about dropping support -- even if it only bites 0.01% of users that can be a huge population!

<comment><USER19> Damn you IE8 and Android 2!!!

</comment></comment></comment><comment><USER20> Nice work. This will help a lot of people who audit sites.. and its great to have an open alternative to the closed source ssllabs tester.

</comment><comment><USER21> "PHP must allow shell_exec and remote fopen."

ouch.

<comment><USER22> Not a big deal if you're self-hosting. Put it in a Docker container (on your own machine or one of your servers), run it when you need it, and then shut it down.

For a permanent solution, get a very small Digital Ocean server, install this with the requested unsafe settings, and let the machine be dedicated to this. Even if someone compromised the machine, they wouldn't get anything of interest.

<comment><USER23> It's not about finding anything of interest in the server. It's the negative impact this server and many others like it have on others when they're leveraged in an attack.

<comment><USER22> I definitely do not support having unmonitored servers. If your server is used in an attack, you should see a traffic spike and shut it down.

I also meant to say that any server used for this purpose should be firewalled so that only your IP can access it.

<comment><USER23> An outward attack from this server against another doesn't necessarily register in bandwidth graphs. It all depends on the type of attack.

</comment></comment></comment></comment></comment><comment><USER24> Nice work. How do you determine the destination SSL library?

</comment><comment><USER25> Thanks. Just needed something like this last week.

</comment><comment><USER26> Seriously, nice work!</comment>


I Happen to Like Heroic Coding - <AUTHOR> http://www.codinghorror.com/blog/archives/001251.html <comment><USER2> Abrash's Dr. Dobbs article is much more interesting: [http://www.ddj.com/article/printableArticle.jhtml;jsessionid...](http://www.ddj.com/article/printableArticle.jhtml;jsessionid=Z44EC3OCNDTWAQSNDLOSKHSCJUNN2JVN?articleID=216402188&dept_url=/hpc- high-performance-computing/)

</comment><comment><USER3> I think Attwood missed the point of Abrash's Dr. Dobb's article: CPUs are changing. They will certainly be multicore, and they will likely be heterogeneous multicores, like Larabee, Cell or AMD Fusion. Basically, they're going to be a CPU and a GPU on the same chip.

(If he did get this point, then he decided a different point was more interesting.)

</comment><comment><USER4> So what is the point of this? Why not post a link to Abrash's article instead? ... Atwood posts article without a point. News at 11.

</comment><comment><USER5> _My current box is a Core 2 Duo (wolfdale) running at 3.8 GHz._

That's interesting, as the Core 2 line only goes up to 3.33GHz.

<comment><USER6> Overclocked, perhaps?

<comment><USER5> Good point. I had forgotten that people still do that :)

</comment></comment></comment><comment><USER7> Does he explain what is " _heroic coding_ " in the article anywhere ?!

<comment><USER8> <http://c2.com/cgi/wiki?HeroicProgramming>

<comment><USER9> The meaning in the article is different; it's more like "really clever code that only the smartest programmers can understand".

<comment><USER5> I think Atwood means heroic programming is programming that does something really neat, but is not worth the time it took to write. It is nice to emulate a GPU in software and get good performance, but it's easier to walk over to Best Buy and get their $20 graphics card instead.

</comment></comment></comment></comment><comment><USER10> When I first saw the headline, I thought the "heroic women" meme had crossed over to HN.</comment>


Why is the tallest skyscraper in western europe being built in rural denmark? - <AUTHOR> https://www.designboom.com/architecture/bestseller-tower-brande-skyscraper-denmark-dorte-mandrup-04-04-2019/ <comment><USER2> The lack of capitalization and the random bold words and links make the text really hard to decipher.

Since this is a design blog, it is probably on purpose, but still, this looks bad and probably limit user engagement (I did not even finish the extremely short article).

</comment><comment><AUTHOR> Can add this [https://www.smithsonianmag.com/smart-news/tiny-danish- town-p...](https://www.smithsonianmag.com/smart-news/tiny-danish-town-plans- build-western-europes-tallest-skyscraper-180971874/) and [https://www.theguardian.com/cities/2019/apr/01/like-the- eye-...](https://www.theguardian.com/cities/2019/apr/01/like-the-eye-of- sauron-western-europes-tallest-building-planned-for-tiny-danish-town-brande- bestseller) which leads off with 'Like the Eye of Sauron'</comment>


Ask HN: What came first: the hacker or the program? - <AUTHOR>

In other words, do you define hackers by what they do or how they think/act? <comment><USER2> Assuming you mean the positive sense of 'hacker', the basic concept predates computer software. The MIT model railroad club is the best example off the top of my head.

</comment><comment><USER3> Think and act

</comment><comment><USER4> It's a fun question to ask yourself. "If I was born 100 years ago, what would I be doing?"

Hackers have always existed. The difference is now we have the ability to amplify our creativity through technology. The end result is what we've seen over the past 60 years: people rapidly building on other people's ideas, generating accelerating technologies, returns, and wealth along the way.</comment>


Openstreetmap map with clickable POI Wikipedia articles, displayed in sidebar - <AUTHOR> http://www.geopedia.de <comment><USER2> I'd like to have a GPS navigation app that volunteers to read the names and maybe the short description of nearby landmarks. It would be like a tour guide.

It could also announce the name of the streets in order to help memorizing them.</comment>


Whitman's political obsessions spell disaster for HP - <AUTHOR> http://www.itworld.com/hardware/209825/whitmans-political-obsessions-spell-disaster-hp

<comment><USER2> The mistake that this article makes is assuming that purely business decisions are what make or break large corporations these days. When it is, in fact, quite clear under the current system that politics can greatly determine such a corporation's success. Companies that play the game well, like GM, can get away with a shoddy performance on the business side of things; and companies that try to stay out, like Microsoft in its earlier years, simply cannot.

In the case at hand, Whitman is apparently going all in for a Romney win in 2012. If it doesn't happen, she'll probably go the way of Hurd and Apotheker. But if her bets do pay off, HP can expect to be showered with enough governmental benefits to more than cover up any deficiencies on the business side.

Bad business decisions, political obsessions, corrupt system? Maybe so. Disaster for HP? Not necessarily.

</comment><comment><USER3> Whitman was tapped on September 22nd. As best I can tell, this dinner was "last Wednesay", September 26th. Did she plan a $7,500/plate dinner in 4 days? Would Nerny rather she have cancelled it?

Is this really enough reason to pillory a former politician over? I mean, up until mid-September, that was her main job. What do you do when you're a defeated politician with rich friends? Raise money.

It seems a little ridiculous to jump from this fundraiser to the idea that "Whitman's political activities will accelerate along with presidential campaign. That's obvious."

edit: I don't disagree that she'll still care deeply about politics, but saying they'll be priority one based on one dinner is an extrapolation of the worst kind.

</comment><comment><USER4> Whitman's political ambitions died in the Governors race she lost in California. She spent over $100mm of her own money and couldn't get more than 41.7% of the vote. It wasn't even close and she out-spent Jerry Brown by more than 5:1.

She may be distracted by her desire to be a political insider, but she can't be so delusional to believe she would be a VP candidate or even a presidential hopeful, now or in 2016. She's far too polarizing of a figure. To put it another way, if Hillary, who was already a multi-tenured Senator couldn't get the democratic nomination then there is no way a non-politico from California would ever get a piece of the GOP pie. That was cemented after her loss in the Governor's race.

I think she's fine for HP, though I wasn't unhappy with Léo Apotheker. Then again, I wasn't an HP shareholder either. :-)

<comment><USER5> I can't think of anything more toxic to an already struggling company than for the leadership to not be fully engaged. HP needs full-time adult supervision, and whether or not she's got dreams of getting elected again Whitman will continue to try to be a rainmaker at least for the California GOP. Not going to end well.

</comment></comment><comment><USER6> Meg told us specifically (yes, "us" -- I am an HP employee) that she would drop her political activities while CEO. But as others have pointed out, this fundraiser was surely already scheduled.

</comment><comment><USER7> I'm not a fan of Whitman in charge of HP but this article is a joke. She hosted a dinner? Whoop, a lot of very successful CEO's host political dinners. You know who else is extremely involved in politics? The Koch brothers and their companies seem to be doing just fine. *

* I'm not making any judgement on the Koch brothers here, I'll leave that for other outlets on teh interwebs.

<comment><USER8> >You know who else is extremely involved in politics? The Koch brothers and their companies seem to be doing just fine.

Indeed, they've carved out a very large market for their enterprises, which has freed up time for them to dabble in politics as well. HP is not in such a comfortable position, they have serious challenges in a fast paced market.

In addition, Koch industries is a family business. There's a big difference between hired help (Whitman) and having real skin in the game. I'm sure if a competitor came along and started eating their lunch, the Koch brothers would scale back their political work.

</comment></comment><comment><USER9> I've always felt that corporate managers beyond a certain grade were career politicians anyway, so what's the difference?

</comment><comment><USER10> It's fair to question a new CEO and have concerns about performance or if they're the right person, etc.

I think it's very unfair to suggest all the things this post does based on the fact that a new CEO is and/or has been politically active on their own time, in their own home, with their own money.</comment>


Exploring the Utility of Memes for US Government Influence Campaigns [pdf] - <AUTHOR> https://apps.dtic.mil/dtic/tr/fulltext/u2/1052398.pdf <comment><AUTHOR> I've really enjoyed digging into this report, commissioned by the US military.

Examining how memes can inculcate, infect and treat information in an influence campaign is relevant to governments, citizens and marketers alike. Part of the reason memes are so effective is that they are innocuous.

Important to the evolution of a literate society will be understanding the strategy of propaganda. Asking the platforms to save us from ourselves is not a winning strategy. Knowledge is the best way to defend yourself from propaganda, foreign and domestic.</comment>


Momentum Grows for Jack Dorsey of Square to Also Run Twitter - <AUTHOR> http://www.nytimes.com/2015/09/29/technology/momentum-grows-for-jack-dorsey-of-square-to-also-run-twitter.html?_r=0 <comment><USER2> I really think that jack will be the best person for Twitter; sometimes a c company just needs it's founder's vision.</comment>