Show HN: Triflet – Short shareable podcast clips - <AUTHOR> https://triflet.com/ <comment><AUTHOR> Hi HN!

I always thought there's no good place to share interesting bits from podcasts. I was searching for a place where I could discover new podcasts because itunes charts turned out not to be the best place to go (for me at least).

The idea is to post new bits, preferably couple of minutes long, that can then be shared with a link, like: [https://triflet.com/view/33-bill-burr-on- sunglasses](https://triflet.com/view/33-bill-burr-on-sunglasses)

An extra benefit would be that the audio content can be discoverable through search engines.

Triflet began as a pet project to learn angular (back then it was in beta) and it kinda dragged out. I might work on it more if it turns out that it can be an interesting idea to other people too.

Let me know what you think!</comment>


On Ed Witten and innate talent: a winding digression - <AUTHOR> https://kew1beans.wordpress.com/2014/10/24/219/ <comment><USER2> Quanta magazine has good recent interview with Witten

A Physicist's Physicist Ponders the Nature of Reality [https://www.quantamagazine.org/edward-witten-ponders-the- nat...](https://www.quantamagazine.org/edward-witten-ponders-the-nature-of- reality-20171128/)

Witten comments Wheeler's 'It from bit' essay, ponders dualities and says: 'I tend to assume that space-time and everything in it are in some sense emergent.'</comment>


Show HN: 12perks – Reach your target audience on Twitter - <AUTHOR> http://www.12perks.com

<comment><AUTHOR> If anyone has any feedback please don't hesitate to comment.</comment>


Microservices in Erlang - <AUTHOR> https://github.com/videlalvaro/gen_microservice

<comment><USER2> How is this better than the battle-tested `gen_server`?

I like that the only usage example is in doc/ and uses a `gen_server`…

Where are the tests?

`modern_async`? Really?

<comment><USER3> It's exactly the same as gen_server but with handle_call() and handle_cast() renamed, as far as I can tell.

<comment><USER4> And, also relevant: gen_microservice was first committed to Github today, April 1.</comment></comment></comment>


Most Contacted HBGary Emails and Domains - <AUTHOR> http://www.michaelbommarito.com/blog/2011/02/19/most-contacted-hbgary-emails-and-domains/

<comment><USER2> I am curious if any of the communication show discussion about the ethical repercussions of this kind of work? I would like to believe a company like Palantir (in those 1000 emails) at least mention some kind of concern on the part of their engineers. Any thoughts?

<comment><AUTHOR> If you download the email dump and search through the attachments (requires pre-processing or loading into a mail client), you'll see that Palantir does market their software as helping agencies better respect civil liberties while getting results. Who knows what they say in person or whether this is true.</comment></comment>


Ask HN: How to monetize 10 hours a week? - <AUTHOR>

Here's the deal - I work as a technical lead and have cca 10 hours a week in approx 2 hour chunks (mornings or evenings) which I normally spend reading or playing around with some tech project. I am looking for a way to earn some money on the side during this time.
I can think of following ideas:

  - application prototyping
  - library development
  - code review as a service
  - <USER2>
  - system documentation
  - data cleaning/exploration scripts
  - developer mentoring
 Do you have advice on how to get the projects that would fit my schedule? Any idea if there are online services that offer high quality gigs like this? Alternatively how do you get across such gigs in real life? (odesk etc don't cut it - I don't want to compete on price or speed of delivery)
My profile: I am an experienced software developer (12 years). Your projects can be in Java, JavaScript (browser+Node.js), Clojure, Android and some years ago I've built few data marts. Projects can come from startups or enterprise as I have experience from both. Suggestions for non-tech companies would be welcome as well (maybe even more than tech ones).
I am looking forward to your suggestions and perspective <comment><USER3> I can't speak to what it's like to "sell" time on [http://www.airpair.com/](http://www.airpair.com/) \-- never tried -- but it might be worth a look

</comment><comment><USER4> you might be interested in Toptal ([http://toptal.com](http://toptal.com)) the enrollment process is a bit long but there are a good amount of short-term, low-hour jobs available</comment>


Writing Tetris in Clojure - <AUTHOR> http://codethat.wordpress.com/2011/09/10/writing-tetris-in-clojure/ <comment><USER2> Somewhat related: Tetris in Clojure and Penumbra[1]

[1]: [https://github.com/ztellman/penumbra/blob/master/test/exampl...](https://github.com/ztellman/penumbra/blob/master/test/example/game/tetris.clj)

<comment><USER3> That's much better. But they're still writing programs in 250-300 lines of code using fancy libraries in a higher-level language that would take around 100 lines of simple and direct C code.

<comment><USER4> I am absolutely sure you can write Tetris in 100 lines of C. Would you be able to maintain it in half a year? Would anyone except you at the moment of writing be able to understand it? I wrote this implementation in January, found it and understood again in one go. There is even no comments in the source file. The Clojure code is mostly self-documenting (sure thing, you still have to write comments for bigger projects). And yes, I also liked the OpenGL version more. It is very nice except some logic being based on try..catch blocks.

<comment><USER3> > Would you be able to maintain it in half a year? Would anyone except you at > the moment of writing be able to understand it?

A C programmer? Yes and yes.

</comment></comment></comment></comment><comment><USER5> I would love to see that in ClojureScript.</comment>


Show HN: Open source hardware platform for Bluetooth hacking - <AUTHOR> http://nordicsemiconductor.github.io/puck/ <comment><AUTHOR> Hello HN! We, a group of summer interns at Nordic Semiconductor, have made an Internet of Things-enabling platform based on ARM's mbed technology. We make it easy to rapidly prototype and develop Bluetooth LE enabled devices - get up and running in under 10 lines of code, written directly in the browser.

We hope to create a community around BLE devices where developers share their ideas designs with each other. Everything is open-source, of course, with lots of supporting materials, together with companion apps for both Android and iOS.

<comment><USER2> I have spent 10 minutes trying to find an actual working "buy now" or "add to cart" button, but sadly, those are no where to find.

I followed the link from Location Puck Tutorial Page[1] to mbed.org page[2] which does have a "Buy Now" button, but clicking on it took me back to the vendor page where it was completely unclear how am i supposed to buy this!

I understand you have this amazing bluetooth board, that I can do wonderful magic with it. But how do I get one? Give me a straight direct link to buy this thing.

How can you possibly think that this can be called "The Raspberry Pi of Bluetooth" when even buying this looks like an impossible mission.

As I said it looks pretty cool and I congratulate you for taking it so far. I think there is a lot of work to be done to enable hobbyists/hackers to buy this device easily without jumping through numerous corporate hops.

Also if I understand it correctly, I need a special IDE to be able to hack on this device? If that is really the case, I think there should be some work to decouple the device from the IDE to increase the openness and remove any kind of vendor lock-in.

But then again, i might be completely off and this device is not what i thought it was. Good luck anyway!

[1] [http://nordicsemiconductor.github.io/puck/tutorials/location...](http://nordicsemiconductor.github.io/puck/tutorials/location.html)

[2] [https://mbed.org/platforms/Nordic- nRF51822/](https://mbed.org/platforms/Nordic-nRF51822/)

[3] [https://www.nordicsemi.com/eng/Products/Bluetooth-R-low- ener...](https://www.nordicsemi.com/eng/Products/Bluetooth-R-low- energy/nRF51822-mKIT)

<comment><USER3> I was curious as well, here's a shop I found with what appear to be the products from the tutorials..

[http://www.semiconductorstore.com/Nordic- Semiconductor/](http://www.semiconductorstore.com/Nordic-Semiconductor/)

<comment><USER2> Wow, thanks! That's what I was looking for. Why the article didn't link to the exact product page on this store is really beyond me.

Edit: They added a direct link to the store. Great!

</comment></comment></comment></comment><comment><USER4> Please mark in the title that it's about BLE, not the "usual" Bluetooth. Those are two different technologies.

</comment><comment><USER5> Neat project. It would be even greater if the IDE was working natively on OSX/Linux.

<comment><USER6> With mbed you can compile everything from the browser, and Nordic's userspace code can be compiled on any platform with GCC.</comment></comment>


What is a Rockstar Programmer? - <AUTHOR>

Quite often the term "Rockstar Programmer" is mentioned in comments or posted articles. It seems to be a short term for a programmer with numerous qualities, which are still obscure to me (since I'm quite new to HackerNews and the startup world in general).
And that makes me wonder - in my ears, a "rockstar programmer" rather has negative connotations.
When I think of qualities a good programmer (or developer, engineer, hacker...) should have, I just can't connect these to the characteristics of my image of a rockstar (these are subjective, of course). For example:
A good hacker should be a skillful coder.
Which skills does a rockstar need? Does he really have to be that good a musician? Granted, you may have to posess a certain amount of musicality to become a rockstar, but the rockstar business is really not a contest of who can play the guitar the most virtuosly. I personally know several people who are better rock musicians than lots of those who are rockstars. And I wouldn't know how to translate skills like stage performance or a thrilling voice into the programming world.
A good programmer should be passionate about the product he works on. Ok, this would be true for a rockstar too. But not only for a rockstar. This should be true for every person who is a "builder", whether he creates software, essays, a painting or a skyscraper. Passion about his music is not a defining quality of a rockstar.
In fact, the word rockstar does not describe any personal quality whatsoever - the defining attribute of the word is fame. And no rock musician gets famous just for his skill, you have to want to get famous. For what I can tell, this is true for 90% of all famous people. Fame and skill do correlate, but so does fame and PR. Some people even are more famous for their escapades than for their great abilities. Now how should that be important for a good programmer? I would rather consider it harmful if someone has the unstoppable will to outshine everyone including those who are just as skillful und passionate. And being too focussed on one's own reputation can significantly distract the sight to the best solution for a problem, which would be another strength of a good hacker: open-mindness and out-of-the-box thinking.
Or is "rockstar" trying to express something like "extraordinary", "outstanding"? Then say outstanding, that's more precise. Even better would be so say "outstanding in <insert skill here>".
Or "excentrical but genius"? The better term for that would be nerd.
So what is meant by "rockstar programmer"?
Maybe there is something I don't get, and I'm happy for every clarification since it would help me understand the conversations and articles better. <comment><USER2> The term "rockstar" is used across many disciplines for a top performer. Don't get too hung up on the analogy: a rock star programmer isn't one who's into sex & drugs & loop unrolls.

The main origins of this meme revolve around some studies done many years ago that show there's a productivity difference of 10x to 20x from mediocre programmers and the top performers. It's been noted that the salary range is much smaller, often in the 2x range. So why not hire top performers, paying them twice as much and getting ten times the productivity?

There is and has been ongoing controversy about this on several fronts. The most substantial criticisms have to do with the validity of the studies. The rest of the criticisms seems to revolve around pushback from people because hiring rockstar programmers is difficult and care and feeding of such doesn't fit within the management structure of most companies.

<comment><AUTHOR> If rockstar programmer equals top performer, then I must say the term is both blurry and misleading.

Well, I think I'll have to translate it on the fly whenever it appears, and I will not use it until it hopefully wears off as time goes by - I hate unaccuracy :)

</comment></comment><comment><USER3> I might be wrong, but I think the term "rockstar programmer" originated to describe a certain type of programmer who's outspoken, interesting, and possibly controversial. The first person who comes to mind for me is DHH from 37signals, who's a very good programmer, but who's also known for arousing vast kerfluffles with things he says in public.

The fact of the matter is that programming is very unglamorous. It's not a job that often entails the sort of creative passion associated with making music or film or literature; even when we're talking just about the kind of programming that's meant to serve that kind of creative function, it's still rarely as visceral as a good rock song. (The only piece of programming that ever moved me like that was We Feel Fine.) So using the term "rock star" serves to inflate the egos of people who might otherwise not feel like their work was important or meaningful.

When I hear a company say they're looking for "rockstar programmers" I usually take it to mean that they're looking to genuinely _care_ about the programmer they're hiring. They don't just want a code monkey, they want somebody awesome and colorful who'll really be a meaningful part of their team. (Whether these companies actually believe that is another question. I'd bet most of the people who use the phrase are full of shit.)

<comment><AUTHOR> Fearlessness of being controversial could indeed be a good charactistic of both a rockstar and a programmer who wants to make a difference. Yet, I can't image that's the quality a company is looking for when they search for a rockstar programmer. And if they do, I can't image that's what they will get.

Being egomanic and making a difference for the better is hardly the same.

<comment><USER3> Well, that's why looking for a "rockstar programmer" probably isn't the best thing to actively seek in an employee. Not unless you're only looking to be a "cool rad" company and not an efficient company that gets things done.

</comment></comment></comment><comment><USER4> It's a different matter in a job posting; in that case, it's a synthetic PR move, where the posters think they are showing how hip and cool their company is. Usually also a sign of unrealistic expectations.

</comment><comment><USER5> A "rockstar" programmer, simply put, is a manager's wet dream. There isn't a competent programmer, experienced with those that use this term, that want to be seen anywhere near it.

The term started as a marketing tool to get people in the door, and is now overused and loaded with unhappy feelings.

Before the BS, a rock star programmer is what every front end dev aspired to be (or thought they were): the best.

</comment><comment><USER6> Beats me! Prbly a programmer who gut lucky and is now so successful she barely has to do any work anymore, commands outrageous fees, does a lot of drugs, smashes hotel rooms and tends to find underwaer on her keyboard...

<comment><AUTHOR> Sounds like a great person to work with ;) That said, maybe there is some truth to that: Programmers often don't get the recognition and/or salary they feel they deserve. Maybe the "rockstar" expresses the wish to get more appreciation and honoration for their abilities. It would be interesting to know who actually coined the term. A hacker or a salesperson or who?

</comment></comment><comment><USER7> Not a programmer, but my guess is that it means someone with 'dazzling' skill that can pull off stuff you wouldn't really expect. That kind of skill usually has qualities/skills that go with it beyond the "normal" skill-set you think of. As you noted, being a rockstar is not really about raw musical ability but involves a number of other things, such as playing to a crowd. Someone who can write amazingly good code and also play corporate politics well enough to get his code instituted, instead of settling for some more prosaic solution, is probably the kind of person that gets called a "rockstar". To me, it suggests unconventional but brilliant solutions, not just solid coding ability. The qualities that lead to those types of solutions tend to be hard to quantify. I think that is a big part of why they get euphemistic labels like "rockstar".

</comment><comment><USER8> one that doesn't read hacker news all day.

</comment><comment><USER9> On a slightly off topic note, rockstars need a lot of skills to be successful. As you said it isn't only about music (I beg to differ that it does not relate to music at all), but a lot of different stuff. A rockstar has to catch the attention of millions of people and that is a skill which not everyone can master. This actually relates a lot to college professors. You might have noticed that there are some professors which just fail at catching your attention even though they might be expert in there subject while there are some which may not be the best in content but just catch attention of a huge student body in a lecture hall.

</comment><comment><USER10> For me, a 'rockstar' programmer is a kind of hacker that I look up too (or other programmers look up to).

It's just like how maniac teens (or just any 'metal-heads') patronize or look at some favorite rockstar as their icon / model (or something close to this).

To demonstrate my point, I'd say people like Linus Torvalds, Richard M. Stallman, Donald Knuth, Ray Kurzweil,... are RockStars! Even Jeff Atwood could pass for one to some extent :-)</comment>


Smartphones and Dematerialization - <AUTHOR> https://www.wired.com/story/iphone-environment-consumption/ <comment><USER2> > _Total electricity use in America, for example, has been essentially flat > for almost a decade. For decades prior to the Great Recession plastics > consumption in the US grew more than 50 percent faster than the overall > economy did, but since 2009 the situation has reversed, with plastic use > growing almost 15 percent slower than the economy as a whole.

For most other natural resources, the rate of consumption growth hasn't just slowed down; it's actually gone negative. Year after year, America is now generally using less total steel, copper, gold, fertilizer, water, cropland, timber, paper, and other physical building blocks of an economy._

Does this trend stay if you look at _global_ data instead of only the USA? The most obvious cause of the lowered resource need would IMO not be dematerialisation but outsourcing to other countries.

If all your factories are moved to China, you can certainly get yourself stellar environment ratings in the _USA_. However, this won't actually help the planet in any way.

<comment><USER3> Details are missing, but straight quote from the article:

> These changes have not come about because of globalization or outsourcing.

<comment><USER4> Just because the author claims so, doesn't mean it is so.

<comment><USER5> See the post from dredmorbius, it looks like the assertion is based on evidence.

<comment><USER6> Did you misread the link from dredmorbius? I understood it to mean that the main argument made in the article, that economic growth has decoupled from resource usage, is false, and globalization is a big factor in this.

</comment></comment></comment></comment></comment><comment><USER7> The trend described in this article was written about by Buckminster Fuller in 1938, except he called it _ephemeralization_ [1].

Paul Graham wrote an essay on the same subject (iphones and ephemeralization) in 2010 and, unlike this piece, made reference to Fuller's early identification of the trend. [2]

Im my opinion, _ephemeralization_ is a better descriptor of the trend than _dematerialization_. Bucky was an extremely careful user of language, to the point of coining his own words when he didn't feel any existing words served his purpose. I think he was right to not use _dematerialization_ to describe the trend because it is manufacturing where you are not removing material (dematerializing it), rather you are simply not using it, or using less of it, in the first place.

[1] [https://en.wikipedia.org/wiki/Ephemeralization](https://en.wikipedia.org/wiki/Ephemeralization)

[2] [http://www.paulgraham.com/tablets.html](http://www.paulgraham.com/tablets.html)

<comment><USER8> I'm not real happy with either of the two. They both have connotations that are irrelevant: "ephemeral" tends to mean brief/transitory, while any negation of "material" leans toward either non-existence or "not-mattering."

There's already a 90s-origin term that considers this same phenomenon, in the same context, and addresses it in the way we want it to: _virtual_. Software on phones "virtualizes" our clocks/cameras/etc. Wired of all publications should remember that one. Actually maybe they're explicitly avoiding it after spending years saying "virtual" seemingly every 3rd or 4th word!

N-gram of "virtual":

[https://books.google.com/ngrams/graph?content=virtual&year_s...](https://books.google.com/ngrams/graph?content=virtual&year_start=1800&year_end=2019&corpus=15&smoothing=2)

The line really starts sloping upward in the 90s and peaks in the early 00s.

<comment><USER9> Virtualization has helped immensely in many ways to reduce resources used and to eliminate costs.

People used to buy books, games, music, movies, in addition to clocks, cameras and others you mention in a physical form but now are moving to virtual products. Many products are virtual now from play/entertainment to work/administrative (file cabinets, storage, etc). Just looking at my own purchases, most are virtual when they used to fill book shelves, cabinets and trash bins eventually.

Ultimately virtual goods will help solve, and is helping solve resources used, while allowing growth. Lots of pushing resources previously was about getting to that growth metric, growth can now happen, and even in greater numbers exponentially in virtual worlds like apps, games, movies, offices, government, businesses and more.

Virtual goods have also helped 'clean up' areas like many think the crime reduction after the 90s was the result of some policy, but ultimately it was the internet that cleaned it up and reduced crime. People are indoors, more aware, more access to information that they need/want. Even Times Square cleanup was attributed to oversight, when in actuality the porn went online which led to less crime and less out in the open products.

Virtual goods and products moving this way is helping us not just to dematerialize, but move to virtual resources that are bits on a disk not physical content, bookshelves and cabinets.

</comment></comment></comment><comment><USER10> >By one estimate, a data-hungry user's smartphone can consume as much electricity in a year as her fridge does.

Bull-fucking-shit. At minimum a refrigerator uses 150 watts and averages over 200. In comparison, a flagship gaming smartphone with an overclocked SoC like the Asus ROG phone uses 3.8 watts while benchmarking. Nobody with two brain cells to rub together could be stupid enough to think a phone uses more power than a goddamn refrigerator. The fact the author treats that as a serious possibility should make you question the credibility of every single thing they've ever written.

<comment><USER11> _The average iPhone, according to Mills' calculations, uses about 361 kW-h a year once the wireless connections, data usage and battery charging are tallied up._

[http://science.time.com/2013/08/14/power-drain-the- digital-c...](http://science.time.com/2013/08/14/power-drain-the-digital- cloud-is-using-more-energy-than-you-think/)

<comment><USER12> So if we are going to account for all of the things making my smartphone possible as consuming electricity, I think we should account for all of the things associated with running my refrigerator such as the energy it takes to make the food I want to store and the refrigerated trucks it took to get to me.

<comment><USER11> The power utilisation of a refrigerator scales at best poorly with the quantity of food moved through it, unlike a smartphone (door openings is a far greater predictor), and human food consumption is generally constrained (1800-3200 kcal/day per person, more or less), whilst data appetites both vary and have grown markedly.

You do raise a good point that behind msny. products is a long chain of either embedded manufacturing or complementary products costs. But the avoidable costs of food vs. data (refrigerated or not, people need food to eat; we'd survived 200,000 years before iOS) argues against your comparison.

</comment></comment></comment></comment><comment><USER13> The article talks about energy and resource consumption in the US, but production of most electronics happens in China, whos emissions are exploding. Energy used in production of electronics is often greater than the energy consumed during the entire lifetime of a device [1].

1: [https://solar.lowtechmagazine.com/2009/06/embodied-energy- of...](https://solar.lowtechmagazine.com/2009/06/embodied-energy-of-digital- technology.html)

</comment><comment><USER14> Can't read this apparently.

> Continue reading with a WIRED membership.

> Get unlimited access to an ad-free WIRED.com and the print and digital > editions of the magazine.

I don't use AdBlock. I even consent to some tracking, because I know economics have forced these websites to resort to such things and I want to support them, but apparently this isn't good enough for Wired. Oh, but ads loaded anyway I see.

Edit: Apologies for off-topic.

</comment><comment><USER15> Yea, maybe they have helped but I don't think they are doing as much as they could do for the planet. I wish they would do more so their products are as close to 100% recyclable as possible. Their relenting push towards upgrades for-profit can't be good for the planet.

<comment><USER16> _> I wish they would do more so their products are as close to 100% recyclable as possible._

Recyclability fundamentally _does not matter_. If we eventually run out of aluminium or cobalt or whatever else, we can use landfills as mineral mines when that becomes economically viable.

What we really need to care about right now is CO2 emissions; in that respect, smartphones represent exceptionally good value. Including the energy used to charge it, an iPhone Xs results in 70kg of CO2 emissions over its lifespan. The average American produces 16,500kg of CO2 per year.

A smartphone _feels_ like it should be really bad for the environment, because it's expensive and shiny and new. It actually does less damage to the environment than half a tank of gasoline or a few meaty meals. Turning down your thermostat by 2 degrees feels insignificant, but it could save as much as 1,000kg of CO2 per year.

[https://www.apple.com/environment/pdf/products/iphone/iPhone...](https://www.apple.com/environment/pdf/products/iphone/iPhone_XS_PER_sept2018.pdf)

[https://en.wikipedia.org/wiki/List_of_countries_by_carbon_di...](https://en.wikipedia.org/wiki/List_of_countries_by_carbon_dioxide_emissions_per_capita)

<comment><USER17> > we can use landfills as mineral mines when that becomes economically viable.

Is economics really the primary obstacle standing in the way of "mining" landfills? I've never been to one, but just trying to imagine it, I'd would be a hell of a lot more worried about diseases, toxins, and all the other awful stuff that ends up in landfills one way or another and that would stand in the way of separating the materials you want effectively/efficiently/cleanly/etc... the economics seem like the last concern.

<comment><USER18> Economically viable in this sense would mean when it is cheaper to mine from landfills than otherwise. That incorporates safety costs to do it.

<comment><USER17> My question was, do you not see bigger obstacles than money?

<comment><USER12> Any obstacle can be overcome with money. Everything has a value.</comment></comment></comment></comment></comment></comment>


Show HN: Look Just Phone an event to test "phone-preneurship" - <AUTHOR> http://lookjustphone.tumblr.com

<comment><AUTHOR> Hi, we wanted to see what company or product people would build entirely from their smartphone, so we are launching an online dare, starting next Monday. Feedbacks and help making this online event better are much appreciated!

Also, if you think an app should be added to the list of tools people could use to build their project, we'll add it to the tumblr page.</comment>


Why the United Kingdom leaving the EU would infuriate the tech industry - <AUTHOR> http://www.recode.net/2016/6/22/12004586/uk-eu-brexit-bad-for-tech <comment><USER2> I'd love nothing more than for US tech companies to stop making their "EU headquarters" in UK, and move to Germany or even Ireland or some other EU country. It's annoying that UK is automatically considered because of its use of English language. It doesn't seem that it's gaining these new headquarters in a "fair way" or based on merit, which seems to be Silicon Valley's big thing.

If UK was out of the EU, I think most US companies wouldn't automatically consider a soon-to-be totalitarian country that's on its way to become the western version of China, through mass surveillance and censorship, for their European headquarters. I could only see that as a _good_ thing (sorry Brits, but fix your shit first).

And if so many UK politicians and UK citizens don't want to be in the EU anymore and if they keep trying try to change the EU to work "their way", maybe UK deserves a "time-out" from the EU.

<comment><USER3> Aren't most Euroepan headquarters of US companies in Ireland anyway? It has certainly the more preferable tax situation and most big US tech companies I can think of are legally operated from Ireland for EU users.</comment></comment>


HTTP Response Splitting: A Common, But Frequently Unknown, Security Issue - <AUTHOR> http://avatraxiom.livejournal.com/104105.html

<comment><USER2> Can anyone think of a common case where a request variable is included directly in a header? I can see why it would happen (in terms of the programmer misusing his easily available tools) but I can't think of a likely case for it in practice, other than perhaps including raw request data in a cookie header.</comment>


Venturocket - <AUTHOR> http://www.venturocket.com

<comment><AUTHOR> To everybody at HN: excuse me for having missed the "approach to comments" section and for having ignorantly posted a comment to my link. I'm new to posting on HN and will make a point to follow the guidelines.

</comment><comment><AUTHOR> By the way, we are now accepting people for our closed beta: the first 100 sign-ups will be granted access.</comment>


Darwin Was Wrong About Dating - <AUTHOR> http://www.nytimes.com/2013/01/13/opinion/sunday/darwin-was-wrong-about-dating.html?pagewanted=all&_r=0

<comment><USER2> This is a link-bait title, and a surprisingly poor guide to the professional literature on the subject of evolutionary influences on human mating behavior. First of all, "Darwinians" is the wrong category to use to name the scientists who think about evolutionary influences on human behavior. All competent psychologists, biologists (whether zoologists or botanists or specialists of some other kind), medical doctors, and other scholars of human behavior are "Darwinians" in the sense of knowing that species Homo sapiens originated by a process of macroevolution from earlier living things.

<http://www.talkorigins.org/faqs/comdesc/>

As Theodosius Dobzhansky wrote, "Nothing in biology makes sense except in the light of evolution,"

<http://www.pbs.org/wgbh/evolution/library/10/2/l_102_01.html> and the "modern synthesis"

<http://evolution.berkeley.edu/evosite/history/modsynth.shtml> combining Darwinian evolution from common descent including a mechanism of natural selection and Mendelian inheritance of discrete units of heredity is the standard point of view among all people who have a current scientific understanding of biology.

It is rather what is properly called "evolutionary psychology" (which at its core

<http://www.cep.ucsb.edu/primer.html>

[http://homepage.psy.utexas.edu/homepage/group/busslab/pdffil...](http://homepage.psy.utexas.edu/homepage/group/busslab/pdffiles/evolutionary_psychology_AP_2010.pdf)

is much more recent than Darwin's thought) that is actually controversial at the moment, with some very Darwinian biologists not liking evolutionary psychology well at all

[http://scienceblogs.com/pharyngula/2012/12/10/ep-the- fundame...](http://scienceblogs.com/pharyngula/2012/12/10/ep-the-fundamental- failure-of-the-evolutionary-psychology-premise/)

while other biologists who are friends of those biologists like evolutionary psychology as an attempt to explain human behavior.

[http://whyevolutionistrue.wordpress.com/2012/12/10/is- evolut...](http://whyevolutionistrue.wordpress.com/2012/12/10/is-evolutionary- psychology-worthless/)

Charles Darwin made few assertions about "dating" in the current sense and hardly any settled assertions about human behavior, even in his book-length treatments of the subject, but raised a lot of questions. Some of the answers are still tentative and debated, and the overall approach of what fans call "evolutionary psychology" is controversial, but that evolution happened and had something to do with the current human condition is not controversial at all among scientists.

<comment><AUTHOR> Looks like you just read the title, thought it must be crypto-creationist and decided to dump in your link collection. The article is not anti-Darwinian, it's a survey of criticisms of the "ultra-Darwinian" position on gender differences. The criticisms come from evolutionary psychologists and such respected biologists as Stephen Jay Gould. The title is not link-baity since it pointedly refers to Darwin's position that men are more about "inventive genius" and women about "greater tenderness".

</comment></comment><comment><USER3> It turns out you can deny evolution and still get published on the New York Times op-ed page. Dan Slater did just that, in a piece yesterday called "Darwin Was Wrong About Dating."

Slater–who has a new book out in which he claims that online dating, of all things, is revolutionizing the sexual marketplace–sets out to debunk a subspecialty known as evolutionary psychology, which seeks to explain differences between men and women in terms of Darwin's theory of sexual selection.

In brief, the theory of sexual selection posits that members of each sex will employ different evolutionary "strategies" in order to ensure that their genes survive into future generations. Since the male makes the lesser investment in reproduction, men are driven to favor quantity over quality. They are especially attracted to youth and beauty because these are signs of fertility. But one man can reproduce with many women, so that there is no evolutionary need to be selective. The most efficient way to pass on his genetic legacy is to have intercourse with as many women as possible.

Reproductively speaking, that's not an option for a woman, whose potential number of offspring is much smaller because she must endure the demands of carrying, bearing and nurturing every child she produces. Thus it is in her evolutionary "interest" to value quality over quantity–that is, to be selective, choosing men who enhance her offspring's chances of survival via some combination of their own genetic endowment and the resources they can contribute to the rearing of children.

It is crucial to understand that these are only metaphorical "strategies" and that evolutionary "interests"–the interests of one's genes–are not the same as individual interests. Evolutionary psychology posits not that men decide to be promiscuous and women hypergamous because they want to have as many or as robust children as possible, but that these sexual and emotional instincts developed because they were conducive to reproduction over many generations in the ancestral environment.

Yet Slater claims "a new cohort of scientists have been challenging the very existence" of such sex differences:

Take the question of promiscuity. Everyone has always assumed–and early research had shown–that women desired fewer sexual partners over a lifetime than men. But in 2003, two behavioral psychologists, Michele G. Alexander and Terri D. Fisher, published the results of a study that used a "bogus pipeline"–a fake lie detector. When asked about actual sexual partners, rather than just theoretical desires, the participants who were not attached to the fake lie detector displayed typical gender differences. Men reported having had more sexual partners than women. But when participants believed that lies about their sexual history would be revealed by the fake lie detector, gender differences in reported sexual partners vanished. In fact, women reported slightly more sexual partners (a mean of 4.4) than did men (a mean of 4.0).

Which proves . . . absolutely nothing. The average number of sex partners by sex is a meaningless statistic. To illustrate why, we shall establish an uncontroversial empirical fact and then proceed to prove, by means of pure logic, that the average female human has more lifetime heterosexual partners than the average male human.

The empirical fact is that more boys are born than girls. "In mammals, male live births exceed female ones," according to a 2002 study published in the British Medical Journal. "In humans, the ratio of male births to total births is expected to be 0.515." That translates into a male-to-female ratio of just above 1.06. Data on sex ratios at birth from the CIA World Factbook confirm this expectation. Of 228 countries (including dependent territories like Greenland and Puerto Rico), 226 had sex ratios at birth greater than 1. The only exceptions were little Liechtenstein, with a ratio of exactly 1, and negligible Nauru, a genuine outlier at 0.837. The practice of female abortion and infanticide in China and India skews the ratio upward, but the trend is clear in countries where such practices are unknown.

Now for the proof. If one had access to perfect information–a database that compiled and cross-referenced the sexual history of every human being ever born–how would one go about calculating the average number of sex partners? One would begin by compiling a list of all unique heterosexual partnerships (hereinafter UHPs)–that is, every couple that has had sex one or more times. Since each such pair by definition includes one male and one female, the aggregate number of both sex's partners would be equal to the count of UHPs.

To calculate the average number of partners per female, you would divide the UHP count by the total number of females. Likewise, to calculate the average number of partners per male, you would divide the UHP count by the total number of males. The numerators are the same; only the denominators differ. Since there are fewer females than males, the number of partners per female is necessarily higher than the number of partners per male.

The key to understanding this is the Hoffman-Manning Axiom: "It takes two to tango." A man cannot add a sex partner unless a woman also adds one. Thus an uneven sex ratio is the only factor that can account for a difference in the sexes' actual average number of partners. If we assume the sex ratio is 1.06 and the average male has 4.0 sex partners, then the average female has 4.24 partners.

Lo and behold, that's very close to Alexander and Fisher's figure of 4.4 partners per woman. Big deal. Their study is analogous to an empirical investigation demonstrating that 2 and 2 equal not 22, contrary to popular belief, but somewhere in the vicinity of 4.1.

What they do seem to have demonstrated is that if earlier studies found mathematically impossible variations in the reported number of sex partners, it is because the survey subjects were dishonest: Either men wishfully overreported their numbers of partners, women regretfully underreported them, or both. That would confirm the evolutionary psychology hypothesis that men have a greater desire than women for sexual variety.

Darwin 1, Slater 0.

Slater also purports to refute "the assumption that an enormous gap exists between men's and women's attitudes toward casual sex":

Evolutionary psychologists typically cite a classic study published in 1989. Men and women on a college campus were approached in public and propositioned with offers of casual sex by "confederates" who worked for the study. The confederate would say: "I have been noticing you around campus and I find you to be very attractive." The confederate would then ask one of three questions: (1) "Would you go out with me tonight?" (2) "Would you come over to my apartment tonight?" or (3) "Would you go to bed with me tonight?"

Roughly equal numbers of men and women agreed to the date. But women were much less likely to agree to go to the confederate's apartment. As for going to bed with the confederate, zero women said yes, while about 70 percent of males agreed.

Terri Conley, a University of Michigan psychologist, thought this was baloney:

Ms. Conley found the methodology of the 1989 paper to be less than ideal. "No one really comes up to you in the middle of the quad and asks, 'Will you have sex with me?' " she told me recently. "So there needs to be a context for it. If you ask people what they would do in a specific situation, that's a far more accurate way of getting responses." In her study, when men and women considered offers of casual sex from famous people, or offers from close friends whom they were told were good in bed, the gender differences in acceptance of casual-sex proposals evaporated nearly to zero.

It's unclear why we should think that responses to hypothetical proposals, such as those in the Conley study, would be a better guide to actual behavior than responses to play-acts that the experimental subjects believe to be genuine proposals. Do words speak louder than actions in Ann Arbor?

That objection aside, the results of Conley's study are in no way inconsistent with those of the famous 1989 one. The latter found that men are far likelier than women to say yes to a proposal of sex on the basis of no information except physical appearance and a fleeting first impression. The former found that women are as apt as men to say yes to an offer of sex with a high-status partner, one who has proved himself either by becoming famous or by sexually satisfying a presumably trusted common friend.

Men incline toward promiscuity, women toward hypergamy. Darwin 2, Slater 0.

Why would the New York Times, which scoffs at creationism, publish such an intellectually slipshod attack on evolution? Because evolutionary psychology contradicts the feminist dogma that the sexes are created equal, that all differences between men and women (or at least those differences that represent male dominance or superiority) are pure products of cultural conditioning.

Feminism is the new creationism. The left loves to scoff at people who believe that Genesis is literally true, but these days feminist beliefs are a lot more influential.

James Taranto - <http://on.wsj.com/RVT8Sj></comment>


Ask HN: End-to-end encrypted online spreadsheet tool - <AUTHOR> I'm trying to identify end-to-end encrypted alternatives to the tools used by an NGO I work with that deals with sensitive data.
Tools for cloud storage ([Tresorit](https://tresorit.com/)), email ([Protonmail](https://protonmail.com/)), instant-messaging ([Signal](https://signal.org/)), collaborative text documents ([CryptPad](https://cryptpad.fr/)), collaboration between teams ([Keybase](https://keybase.io/)), hard drive encryption ([VeraCrypt](https://veracrypt.fr/)) abound, they're free, easy to use, secure, and overall amazing.
The one obstacle I haven't been able to tackle in several days of searching is an alternative to Google Sheets, a secure online spreadsheet with end-to-end encryption and collaborative editing, like what CryptPad (https://cryptpad.fr/) does for Google Docs.
Is there a ready-made alternative, or do I need to build a custom solution? <comment><USER2> Why are you trying to encrypt online spreadsheets? It's very unlikely that you're going to get much operational security out of the encryption features in a spreadsheet application; you will get far more security out of careful use of sharing and authorization controls, which are things you can get from Google Docs and not so much from other platforms.

Remember too, if the tool you're looking at works entirely in a browser, without an extension (sometimes even with an extension!), it's _not_ "end-to- end encrypted"; it's as encrypted as the server wants you to be as you run it.

<comment><USER3> Even if the encryption and decryption is done client side like with Mega?

<comment><USER4> Yes, the server can straightforwardly, any time you load the application, serve to you (including to specifically you, a single target, making it much less likely to be noticed), a modified version of the JavaScript powering that client-side encryption which will send the plaintext off to the server.

</comment></comment></comment><comment><AUTHOR> Cool, I've found a future alternative, from no one else but the CryptPad team: spreadsheets are among their [goals][1], but will require quite a lot of time and funding, I'm continuing to look for a current alternative, but this is great news

[1]: [https://blog.cryptpad.fr/2018/07/13/CryptPad- Roadmap/#Goal-1...](https://blog.cryptpad.fr/2018/07/13/CryptPad- Roadmap/#Goal-1-Spreadsheets-amp-Office-Documents)

</comment><comment><USER5> Not sure you need it (and not ready yet), but I am including e2e encryption into my 1:1 meeting note-taking app: [https://www.oneonemeeting.com](https://www.oneonemeeting.com)

I am working on the feature right now, but as it is still a side-project, it will take some time.</comment>


Robocalls have triumphed over the Do Not Call list - <AUTHOR> http://www.slate.com/articles/business/the_bills/2016/05/robocalls_have_triumphed_over_the_do_not_call_list_whose_fault_is_it.html <comment><USER3> For the past 3 years I've adapted to the point where I just don't answer numbers I don't have in my address book (unless I'm expecting a call). If I don't know you and you don't leave a message than I likely won't hear from you.

Every once and awhile I get nervous that I'm missing something important but the few times I have given in and answered an unknown call it is always unimportant (car warranty companies, comcast, etc).

<comment><USER4> I followed that rule religiously until my father's boss called saying he'd collapsed on a business trip and nobody would answer their phones. Now I just put up with the junk calls. :/

(He ended up surviving ventricular fibrillation with no organ or brain damage because they got an AED on him within a minute.)

<comment><USER5> The solution in that scenario is to text message if possible. People will read texts from unknown numbers.

<comment><USER6> Isn't the solution to that to call the emergency number?

<comment><USER7> But once you've called the emergency number, and are in an Ambo on your way to hospital, or are in the hospital, you want to let people know that you're not dead in a ditch.

Some hospitals are stricter about cell phones than others.

</comment></comment></comment></comment></comment><comment><USER8> In the UK/the rest of the world where everyone has to pay calls by the minute, things maybe a a little different here than in the US of A, and Canadia.

My approach is a little different than to hang-up as quickly as possible, as this is a behaviour that the telephone solictors use to their advantange. In short, I try to soak a call for as long as possible. The best tactic is to be a little bit dumb, but fean interest in whatever the person is calling about. I generally find that getting them to explain each sentance they say about 3 times is about right, before moring on to the next sentance.

Anyway, I answer all calls, and press the button to talk to a human, then try to keep the human on the line for as long as possible.

The cost centre for these automated calls is for a human to talk to me. On at least 4 occasions after being an affible fool for about 20 minutes, without the sales person on the other end, they have said "okay, I get it, you don't want us to call you, and we will put you on our 'do not call list'". At which time they promptly hang up in a huff.

I my numbers, work, cottage/holiday home, mobile, work mobile, and work line now only get about 1 call a month, of which I am more than happy to take, and generally ends with the above result. Previously I used to get 4 or so random unknown calls a day.

I also notice that after calling for a taxi, the number of unwanted calls goes up.

<comment><USER9> Straight asking to be put on the do not call list has the same result (for the callers that maintain one).

Just talk over their opening spiel. 15 seconds, no more calls from that caller.

<comment><USER10> Most of the calls I get are people doing surveys, or lying about how I was in an accident and could make money from a legal claim. Neither pay any attention to the UK TPS (no call list); the former because that type of call isn't covered, and the latter because criminals don't tend to obey the law.

I get a lot of calls from Indians. Any solution has to take into account the international nature of the annoyance. I'm perfectly happy with a whitelist system, or where anyone who has not called me before needs to sign up with my phone company using verifiable credentials.

<comment><USER8> Honestly, soak the calls for as long as possible. Always press the button to get connected to someone. Don't answer any of the questions in the survey. Just generally try to waste as much time on the callers end. The "surveys" are not real surveys, but rather a way to try to get to opt in to a sales calls.

I love trying get to the PPI callers to explain to me what bank accounts, insurance, credit cards are, finally saying that I might have had a bank account, or credit card, then try to get them to explain to me what the PPI is. I had a guy on the phone for about 40 minutes one day while I was waiting for the ferry.

The best thing you can do is get connected to a human as quickly as possible, so you can soak the call.

The other day I didn't really have time to take one of these calls, but I pressed 3 to be connected to someone, and left the phone. After about 5 minutes of being on hold, leaving the phone off the hook, I then heard someone going hello for about 2 minutes.

Another tactic I have is to claim some interest, but that I have to call them back as I am changing phone numbers/jobs/houses, or that I don't have time in the next few weeks, but when I find a moment I will call them back. I refuse to give a 'good time to call' because I am so busy, but when I have a moment I will return the call. This is an amusing tactic because most of the they claim they can only make outgoing calls, and that I will have to give them a time. I generally suggest that them must have an incoming phone number for other purposes, so surely they could give me that number. Usually they decline, so then finally I try to get the persons phone number on the other end of the call. They generally say that is their private number number, to which I say that this my private number, so it really would be quite fair for me to contact them on their 'personal' number.

This seriously works, as I only get one call every month or two. I have also gotten a bit of a reputation at work for these types of calls and my co- workers have not end of amusement that I engage with these callers in this way.

</comment></comment></comment></comment><comment><USER11> Robocalls used to happen to me weekly and now monthly or less after signing up to the Do Not Call list.

What currently tortures me several times a day is certainly some sort of legal grey area, but mostly legal. I have Indian IT recruiters calling me several times a day for positions irrelevant to my job role and also in remote locations (I am US-based and it's a very large country, the US, for leisurely moving from the coasts to the Midwest). Here's why I think there's something fishy going on:

* They are 100% Indian, sometimes with limited English skills, suggesting that the US number they are calling from is just a reroute. Conversations are strained and you can tell they read from a script.

* The emails they send before they call contain a specific template that, even though they represent numerous different companies/agencies, the 'This is not spam' type disclaimer (starts with Please allow us to reiterate we chose to contact you because you had your profile online..) is IDENTICAL. The other thing that is identical is the Unsubscribe link, which takes you to the same templated page, with yet another agency name filled in.

* The positions always say, US citizens and green card holders only.

My conclusion: H1B employers are utilizing phone and email spam via Indian call centers to justify having advertised the positions in order to be able to fulfill the legal requirement. What better way than to contact someone in Boston or New York for a low paying role in Lansing, MI or Dayton, OH or whatnot.

Am I the only one?

<comment><USER12> > My conclusion: H1B employers are utilizing phone and email spam via Indian > call centers to justify having advertised the positions in order to be able > to fulfill the legal requirement.

The legal requirement is usually fulfilled by ploacing an ad in the classified section of the local newspaper (preferably print only), asking candidates to submit their resume via the mail with a reference number.

<comment><USER11> So what's your theory as to why this Indian Call Center Recruitment Situation (tm) is so prevalent? One big agency, Mitchell Martin, just got on board. Surely they would know that contacting a NYC or SF resident for a job NOT in NYC or SF but in a small town in Rhode Island, Ohio, Texas, etc. is truly a needle in a haystack? Someone is paying someone else money to get people to talk on the phone with people who live in the former places, to chat about positions in the latter places.

Either the world has gone mad, or there's a business reason for the above discrepancy given how extremely widespread (I say, daily and via numerous agencies) it is.

<comment><USER12> No idea, I don't think cold calling people about a job meets any advertising requirement (which on further looking actually looks like it's related to sponsoring a green card application, not an H1B).

Perhaps, they're phishing for more information to target scams? I've heard the IRS scams are more effective against immigrants, for example. The caller may not realize that's the purpose for the call.

Could also just be annoy 1000 people, get one positive response, and that's good enough?

</comment></comment></comment></comment><comment><USER13> Someone pointed me to NoMoRobo, which is a free service that intercepts landline calls and screens them. You configure your phone to forward calls to it, and it hangs up the phone on robocalls.

It works pretty great. You get a single first ring, which I thought would be annoying, but every time I get a single ring and then nothing I actually feel a sense of elation.

</comment><comment><USER14> This is why the telephone is "broken". My 9 year old daughter gets random calls all the time. My parents get scam calls all the time. Why does it make sense for permissionless access into my personal life?

Think about it. Someone can disrupt any moment of your life for any reason just by making a phone call. If your phone blinks, vibrates, or rings you are distracted. That's like an app you didn't install sending you push notifications. Taking this further... since you don't know anything about the app you have to judge on a case by case basis whether or not to engage further. Except in this case all you get as context is 10 digits. If you choose to engage further you hear someone's voice. Then you have to decide whether to remain civil and give the other person the benefit of the doubt or just hang up. It's all very gross.

<comment><USER15> It'd be pretty cool if numbers were unguessable: then they'd become cryptographic capabilities in which anyone who knows your number could contact you and pass your number on to others, but no-one who doesn't know it could figure it out.

Granted, it'd take awhile to get used to numbers like YheXuVtGf/sxxXFYxZD7bY5nI2Tf/ylNrgBf9b5IA5Q, but if it's combined with a petname system (where I just see names like 'Bill' and 'Bill's wife's sister Susan') then I think it could work.

<comment><USER16> Nah, this is the direction I'd hate for it to go. I don't think isolating people in bubbles of their direct social networks is good for society. Being able to get called by someone you don't have in your phonebook is a _feature_ , not a bug.

Now I would very much appreciate if calling meant sending _a lot more_ metadata. Like full name/surname and organization to which the number is registered. And then make phones capable of creating filters based on that data. Oh, and companies faking the metadata should be open to lawsuits.

<comment><USER14> I'm sure we could figure out a way to intelligently establish identity and reputation before my phone interrupts me.

</comment></comment></comment></comment><comment><USER17> Why aren't these kinds of calls straight up illegal in the first place? Telecom companies who hand out numbers to spammers should get fined like crazy, and the burden of proof goes on them for dealing with the people they give US phone numbers to.

But for now, I use the iPhone's Do Not Disturb option and allow calls only from contacts. I used to get harassed daily by shit companies selling me stuff, and I'd report them to the FTC, and it was a huge annoyance. Now I have to see the missed call from an unknown number, but at least my phone doesn't ring.

<comment><USER18> > Why aren't these kinds of calls straight up illegal in the first place?

Free speech.

You may not agree, but that is at least the reason.

<comment><USER19> Nope - Freedom of speech isn't a blank check for communication.

It only protects from government censorship, and even then, situations deemed harmful (such as death threats against individuals) are exempt.

<comment><USER20> It is a lot more complicated than that unfortunately:

[https://en.wikipedia.org/wiki/Rowan_v._United_States_Post_Of...](https://en.wikipedia.org/wiki/Rowan_v._United_States_Post_Office_Department)

The consideration of a "captive audience" is relevant to the topic under discussion, prior restraint (in general) as well.

<comment><USER19> That's not complicated at all. That's people censoring what they receive, not the government.

<comment><USER20> "people" aren't "censoring", they don't have the power to do so. In this specific case the state acts at the behest of those who fill out a USPS Form 1500. It is complicated when you consider what is actually happening, the rationale behind it, and the convoluted exceptions. To say otherwise would be like saying that the internet is uncomplicated, as it is simply a series of tubes.

<comment><USER19> >In this specific case the state acts at the behest of those who fill out a USPS Form 1500.

That is "people" "censoring". This really isn't as complex or difficult as you're trying to make it be.

<comment><USER20> I'll give it one more shot. You are a child at the store and you ask your mommy for a lollipop, she hands you one and pays the cashier... who bought the lollipop?

<comment><USER19> Hahah, nothing in what you just said adds up to censorship. Since the direct marketers are paying for it, I guess they're the mother? Is the government the lollipop? Is censorship the grocery store?

 _Ahem_ \- "You have a duck in a pond with a frog, and an elderly couple is throwing bread... Who threw the bread?" Lol.

<comment><USER20> While trying to understand what attribution means to you I accidentally tested your skills in reading comprehension.

<comment><USER19> But who threw the bread, woodman? You still haven't passed your reading comprehension test.

This is very important for the discussion of human-selected censorship.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> A couple things that would be really useful:

1\. A "Google This Number" button when an unknown call comes in, or something that pulls the equivalent "is this a scam?" information that I always seek out.

2\. Rather than only having the option to Accept or Decline, I want a "silently wait until they hang up" option. I don't want them to _know_ I am declining their call (as that sends information that I exist and am a valid person); I want them to sit there and wait for me to pick up. Really what I want is for the phone to return my display to me; I don't want my entire screen covered with the incoming-call message.

<comment><USER16> > _2\. Rather than only having the option to Accept or Decline, I want a > "silently wait until they hang up" option._

I think every Android phone I ever had featured this option (and probably every phone before that too). On Android phones I used, you have to press one of the volume buttons - it silences the incoming call without declining it.

I use that feature very often, not just on telemarketers.

</comment></comment><comment><USER22> Spammers may be able to call from outside the US, but they're not getting US numbers by using magic. The government is perfectly capable of making and using rules against whoever is attaching robocalls to these numbers.

<comment><USER23> The caller ID numbers are fake. There is no security against inputting a fake caller ID.

<comment><USER22> If that's the only thing they're doing, then it's downright _trivial_ to fix.

</comment></comment></comment><comment><USER24> On the internet, ISPs who host spammers have their IP ranges blocked or have their peering relationships terminated. I presume that the telephone system works on peering relationships as well. The solution to this should be simple. Block VOIP providers who harbor robocallers and do not provide timely abuse handling.

<comment><USER25> > ISPs who host spammers

That would be _all of them_.

No ISP wants to support spammers, but without Jetsons robots to individually vet every single customer, having to deal with some is inevitable.

</comment></comment><comment><USER26> Many years ago, I had a land-line service that allowed my phone to ring only if the number was available via Caller ID and was on a white-list of numbers.

Any other caller would hear a message prompting for a touch-tone code to ring our phone. ( Critical people knew this code in case they called from a phone outside of the white-list ). If the caller couldn't enter the touch-tone, they went right to voice mail.

The phone wouldn't ring, but the voice-mail indicator would show if they had taken the time to leave a message.

</comment><comment><USER27> Is it possible to go sans cell phone?

I ditched the land line about 17 years ago. I'm now wondering, in an age where land lines and email is obsolete, a cell phone number is also obsolete because of so many other available forms of communication.

With just a google voice (or similar) number it might be possible. I just need a connected device that I can use to receive those 2-factor access codes, but other than that I am down to ditch my cell phone at this point.

<comment><USER28> I've pretty much gone this route, though with a few caveats.

I've got a tablet, WiFi only. It's possible for _that_ to be used for various messaging and email, where necessary (though email is also badly polluted, and a sufficient surveillance / profiling / security risk I've all but abandoned it as well). A 4GL hotspot extends the tablet onto wireless services when needed.

There's voice chat systems. I've used Google's, which is good, though I usually remain logged out of _that_ , simply because I hugely dislike _any_ distractions.

I'm leaning to the idea that Google, Skype, and Apple iChat simply bite the bullet and interconnect. At this point they could take down the existing POTS and Mobile service in another few years.

I've a fallback phone message service through an organisation I've been associated with for some time. Absolutely crucial messages can come through that, though I don't make it easy.

The result is an exceptionally high level of nondistraction.

<comment><USER29> Offhand, do you know what you'd do in the case where someone would call 911? (Or whatever the local equivalent is?)

That's one of the benefits of the POTS and Cell networks that the various IP- only services have yet to provide. I'm just curious as to if you do without, or have a deactivated cell phone or something like that that you use instead.

<comment><USER28> A no-service phone can still make 9-1-1 calls in the US, it's a legal requirement. Many other nations have similar requirements.

Free-riding off the target-rich environment of available phones is another option.

I've made precisely one true emergency request call in my life, and that was when employed in a safety-supporting role. I've used emergency phone services on other occasions, but in those cases, the situation was either not life- threatening, others had reported the event, or the involved party was already clearly dead.

And if I need a burner (trip/travel), I can pick one up / refill an otherwise unused phone for a few euros.

</comment></comment></comment></comment><comment><USER30> They have pretty much killed voice calls for me. I won't answer unknown numbers and I will not break a conversation or walk across a room to answer a telephone. Such a shame. Spam, DDOS, robocalls, phishing and malware are crimes I really want pursued with vigour.

<comment><USER31> Isn't the new etiquette to send a text first, then if both people have time, you dial the phone? Most things can be resolved asynchronously anyway.

<comment><USER16> It's getting there. I try and teach everyone that too, in a direct way - <USER2> just don't pick up phone calls when I don't feel like it. Want something from me really fast? Text me. I want to know whether or not the thing is important enough to warrant dropping whatever I'm doing right now. And frankly, most of the time _it isn 't_. Some people simply think their random bullshit is the most important thing in the world, and everyone should treat it as priority.

</comment></comment></comment><comment><USER32> For my home phone I use asterisk + blacklist module + Its Lenny! which wastes the telemarketers time and really frustrates them.

Wheneve a telemarketer comes through i punch ##66# abd that adds them to the blacklist ( in case they call back ) and sends them to the lenny script.

<comment><USER33> Any chance you could share (or point us towards) the Lenny audio and scripts. The only resources I can find seem to be outdated and unavailable.

<comment><USER32> I have a github page with the lenny code I use ( its for FreePBX ) but can be easily adapted.

[https://github.com/bshep/freepbx-Its_Lenny](https://github.com/bshep/freepbx- Its_Lenny)

Edited to add:

\- The nerdvittles links did not work for me last time I tried, I got the sounds from the repo I forked

\- The original repo was missing one sound which I found somewhere else ( dont have the source anymore )

\- The module is unsigned due to ridiculous terms for module signing for FreePBX so if you use it you will get a scary warning, if you decide to sign it please let me know ;-)

<comment><USER33> Awesome, thanks.

</comment></comment></comment></comment><comment><USER34> There are a few apps mentioned for helping with this problem. In my experience Should I Answer? is the best by far.

* [https://play.google.com/store/apps/details?id=org.mistergrou...](https://play.google.com/store/apps/details?id=org.mistergroup.muzutozvednout)

None of the apps solve the random VoIP callers. I would be perfectly happy with an app that outright blocked many VoIP providers.

<comment><USER35> Yes should I Answer is great. It seems obvious as a solution once you start using it.

</comment></comment><comment><USER28> There are some crucial lessons here, many underappreciated.

 _Communications providers are the problem._ Just as the USPS supports junk mail (it pays the bills), phone carriers support telemarketing (likewise). It's a case of perverse incentives and impunity, and the way to fix the problem is to hurt the carriers themselves.

 _Lowering prices often makes a thing worse._ "Cost" means "what you've got to give up for something", and it can be inverted to "how badly do you want to accomplish some X?" In a large number of cases, mostly involving _network technologies_ \-- transport, communications, data, commercial and trade networks -- reducing costs means that those who provide little overall social benefit seek to use a service. Highway congestion, Usenet and email spam, social network trolling, telemarketers and robocalls, hazardous or unsafe products or materials transported or transacted. _Unless you can impose very effective regulation or restriction mechanisms, those uses will dominate the system._

 _Phones are ripe for disruption._ Both POTS _and_ cellular networks. I've _not_ carried a phone for months now, in part made possible due to specific circumstances, but it's _wonderful_. There's one use-case I miss: on-the-go access to transit information. The lack of access, filtering, blocking, voice- to-speech, and similar features on traditional services is inexcusable. The complicity of major carriers in global warrantless surveillance and data collection is another huge trust-buster.

We've had VOIP technologies for over two decades, and several large providers: Skype, Apple's iChat, Google's Hangouts (still a lousy name), and others. The biggest problem is that these don't interconnect. If they did, and bridged to legacy voice comms, they could take out the voice comms market in a few years. I suspect customers would flock to them with the offer of control over interruptions alone.

 _Coordinated campaigns against providers are powerful._ A coordinated set of efforts to drop vendor service on account of phone spam might elicit a faster response from providers.

The combined effect of the last two elements also makes phone providers subject to the evaporative cooling effect. This is the inverse of network effects, and is why social networks often collapse so rapidly: defection by valued members and customers leaves lower-quality prospects and more noise on the channel, leading to ever more defections. Eventually it's just spammers and those who must retain service for regulatory or statuatory reasons who remain, and the system dies.

</comment><comment><USER36> My "super senior" mother gets at least five robocalls a day on her land line. It's getting totally out of control, and I worry that someone will take advantage of her. I really wish someone would come up with something like a spam email black list for phone numbers ...or any technical solution to this problem that is _simple and accessible_ to seniors.

<comment><USER37> I want to get my 8-year-old son a phone and I see the same problem. My dream would be that I could put a password on calls to him - that is, if somebody phones him not on a whitelist, they get a request for a PIN. If they can't do it, it gives them my number.

</comment></comment><comment><USER38> I get calls regularly from a number that shares the same area code and first 3 digits of my number. For example, if my number was (579) 832-6671 the calls would constantly come from different numbers in the (579) 832-xxxx range.

What options do I have? Numbers are not like IP blocks with cidrs registered somewhere. Who do I even complain to?

<comment><USER17> You can complain to the FTC. I haven't had much luck with it actually stopping the calls but it's better than nothing and gives the government something to work with.

[https://www.ftccomplaintassistant.gov/](https://www.ftccomplaintassistant.gov/)

<comment><USER39> What do you even tell them, though? The Caller ID number is fake, and it's difficult to get any information from the caller. (I've tried; they hang up if you ask them to identify themselves.)

</comment></comment></comment><comment><USER40> No surprise though is it? I've definitely noticed an uptick in these recently. They seem to come from local numbers that are a permutation of my actual number.

I think far worse than this though is that my regular mailbox regularly gets filled up with junk mail that the US post offices delivers on behalf of it largest demographic - direct marketing(junk mailers) - almost none of it is actually addressed to me it always "our neighbor" or "resident", there is nothing you can do about this either, I have opted out from every possible consumer list. There is no way to tell the post office you would like opt out. This is the business they are in these days. It seems odd that there is federal agency generating this kind of waste and nuisance.

</comment><comment><USER41> Am I the only one who enjoys these calls?

I have these frequently and I enjoy nothing more than attempting to keep them on as long as possible.

One new trend not mentioned in this article is the "soundboard" telemarketer, where the telemarketer is hired from a low-wage country, but can respond to you by pre-recorded responses. Here's a good way to deal with these people:

[https://soundcloud.com/user-630893114-106605627/speaking- to-...](https://soundcloud.com/user-630893114-106605627/speaking-to-a-stupid- autodialer)

<comment><USER23> That's great! Lenny vs Sales Soundboard. Our computerized agents battling it out autonomously.

</comment></comment><comment><USER42> Why are the cellphone companies not responsible for these calls? I am paying to receive these calls, in coming calls are not free. Isn't there a class action lawsuit here?

</comment><comment><USER43> This is an area where Apple could really improve iOS and add API support to enable apps to screen calls, like what Android already has.

Telecom companies don't have any incentive to fix this.

<comment><USER17> Do Not Disturb mode is surprisingly great at this.

<comment> dj-wonk I'd like to see Apple and other mobile phone companies to actively build functionality to screen calls that works all the time -- whether or not I have enabled "Do Not Disturb". I _never_ want (nor need) a telemarketer call.

</comment></comment></comment><comment><USER44> My phone (LG G3) finally has a built in block list that works. Any time I get a call from a number I don't recognize, I first Google the number to see if it's legit - like my mechanic, or a company that I recently bought something from, or someone offering me a job interview. If it's not, it goes straight on the block list. I would be very happy to open-source my block list and get access to everyone elses's blocked numbers as well.

</comment><comment><USER45> If you are plagued by robo calls, especially from Julie your local google specialist, I highly recommend the Jolly Roger Telephone Company as a countermeasure.

<comment><USER46> I agree - I pay $2/month to Jolly Roger and since then my robocalls have dropped to nothing. I actually miss getting them because it's so fun to hear Jolly Roger frustrate them.

</comment></comment><comment><USER47> My wife gets numerous calls and I deflect them in a devious way. After she answers and discovers it's an unwanted caller, she gives me the phone. I demand to know who is calling and why, and then tell them they have called my 8 year old daughter's phone, and if they won't stop harassing her I will call the FBI. Gets her number removed from their call list every time.

</comment><comment><USER48> Is it really that bad in the USA?

Over here in Russia it's the SMS of all sorts, can't remember ever getting called like that.

But there the difference ends - the "no advertisements" lists tend not to work too, and asking a friend at the cellphone company to put your number into the hardware works too well - the messages with the bank codes stop getting through.

There is no middle ground, and the only salvation is to turn off the SMS sound.

</comment><comment><USER49> I use VoIP.ms for my landline, and I've just set up a their free IVR to block telemarketers very easily: It plays a recording telling the caller to dial 1 to ring our phones. Very effective, since bots won't parse it.

(I've considered going mobile only, but the costs for VoIP.ms are miniscule enough that it doesn't really register anymore.)

</comment><comment><USER50> Like others, I will often let a call go if I don't recognize the number. Robots tend not to leave messages. Also, if yo do answer, robots wait for you to say hello before starting the recording. If you wait a couple of seconds, a human on the other end will say 'hello?' but a robot won't.

</comment><comment><USER51> Doesn't work because it was left to the telecoms to enforce and they lose money by enforcing it.

</comment><comment><USER52> Like others here, I receive many many spam calls despite being registered on the Do not call registry. My approach lately has been to let calls go to voicemail and now I notice that I can predict with good success if number is a scam, based on the area code.

</comment><comment><USER53> Just answer and say you will call the police because you are on the "Do Not Call list". Or just say you are not interested, not interested, not interested, good buy. They will not put you off the list until they have got an answer.

</comment><comment><USER54> You can try Truecaller (www.truecaller.com). This is one of the essential problems we are addressing and it works quite well for +200 million users worldwide..

<comment><USER55> I tried Truecaller. I'm not sure if it automatically updated itself occasionally, but I found myself having to manually click the button to download the new list of blocked numbers.

I got tired of that and replaced it with Mr. Number, which seems to keep itself updated and allows me to ratchet up the blocking all the way to "everyone not on my contact list." That's not ideal, because I might miss calls from my credit card company, bank, etc, but the 2-3 scam calls I was getting every day were driving me crazy.

</comment></comment><comment><USER56> My company makes phone calls to past customers when their subscription expires. Switching to text message + phone call increased response rates 10-fold.

</comment><comment><USER37> I wish there was a way to whitelist known contacts only on my phone, and shunt all unsolicited phone from strangers to a passcode-controlled answer bot.

</comment><comment><USER57> Give an unused phone number to companies (like a Google voice #) and always block caller ID when you call them.

</comment><comment><USER58> This is why I started giving businesses and retailers my Google Voice number, instead of my personal number.

</comment><comment><USER59> Captcha test? You reached John, please press 4 to continue phone call.

</comment><comment><USER60> nomorobo + nonstandard sip port + voip.ms has weporked pretty well here.

<comment><USER61> How does the nonstandard sip port help? I'm in the middle of a large-to-me Asterisk install, and I'd like to know if there's something I'm missing.

<comment><USER60> If you use a standard sip port without filtering you will get a load of autocalls from people just portscanning and calling open IP addresses, probably looking to gain access to unsecured pbx boxes. I just have a single sip phone, no pbx, so they come across as calls. Nonstandard port fixes that. Probably not the most secure solution though, intended to be temporary.</comment></comment></comment>


Ask HN: Best Credit Card Present Merchant/Gateway - <AUTHOR>

Hey all,
I'm working on a system that will accept swiped credit cards. I have done a ton of work with other CNP (Credit Card Not Present) providers in the past, but i'm having a really hard time finding quality Credit Card Present merchant providers. I've contacted several, but they all seem sketchy or have insane rates.
I would really appreciate any recommendations! <comment><USER2> Hey jdelgado- I'm working on the same thing, wondered if you found anything in the 9 days since this post?

<comment><AUTHOR> Hey,

I actually haven't - I have called several places, all guarantee low rates yet have shady fees. I'm investigating becoming a Merchant Provider myself, that might be more that I am personally looking for.

Best of luck to you!</comment></comment>


Ask HN: How to store user/pass securely in the browser? - <AUTHOR>

I'm working on a web app that will let the user interface with a 3rd party site via my service. In order for my service to utilize the API of the 3rd party, it requires the username and password for each individual user's account. I don't want to store people's private information on my service though. Not only do I feel personally uncomfortable doing that when other services want me to, and I don't want to be like that, I don't want to be in a position where someone potentially hacking my service can get all of my users' info.
I will have SSL setup for all communications between the user's browser and my service, and the API servers for the 3rd party are also via SSL.
I know I can very easily store the user's U/P in a cookie on their local machine(s), but that in itself presents security problems for them.
So, I need to be able to store the U/P somewhere. I don't want to make it so the user has to retype their info every single time they use my service, because it then reduces the click-and-go functionality of my service to zero.
What's the best approach in this kind of situation? Am I missing something obvious, or do I just have to bite the bullet and take the least-onerous option that's available? <comment><USER2> First, I think the idea of you making API requests using your users' credentials is a bad one from the start. If the third party in question wants to allow requests-on-behalf-of, they should provide a proper API for it; if not, you shouldn't be working against their wishes by impersonating your users.

That said, if you really really have to do this: Have your users provide you with their username and password; generate a random symmetric encryption key; store (username, encrypted password) on your systems and send (username, encryption key) to the user as a cookie.

This will give you safety against an attacker who can steal your database or the user's cookies; it won't give you any protection against an attacker who can steal both of those (that would impossible), nor will it give you any protection against an attacker who controls your server at a time when a user tries to use your service (again, that would be impossible).

But I still think this is a really bad idea.

<comment><USER3> _First, I think the idea of you making API requests using your users' credentials is a bad one from the start. If the third party in question wants to allow requests-on-behalf-of, they should provide a proper API for it; if not, you shouldn't be working against their wishes by impersonating your users._

This is true, but unfortunately we live in the real world, and hacks are sometimes necessary. Look at Mint.com, for example. Give some site all your banking details? WHOA THERE. But it turns out the service is very useful, and it works with pretty much every bank. If they had waited for proper APIs to exist, someone else would have beaten them to market.

</comment></comment><comment><USER4> If you can convince the third party site to adopt OAuth, do that.

Otherwise, one technique you could use is to encrypt their password using a key derived from a hash of the password they enter. When they log in, set that hash as their cookie. Each time you need to use the third party password, read that cookie and use it to decrypt the stored password.

Since you don't know their real password for your own app (as you only store a different hash of it), you won't be able to derive the hash used for the decryption process (note that this means you need to store a hash of their password for your own authentication using a different salt from the one you use to protect their encryption).

With this technique, having access to your database is not enough to decrypt their third-party password.

Unfortunately none of this resolves the root problem. Firstly, by asking users to trust you with their passwords for other sites you are teaching them to be phished. Secondly, if you turn evil (or someone evil acquires your site in some way) the server-side logic can be changed to steal the user's password.

<comment><USER5> Don't do this: do what Colin said. Let k be 32 random bytes (using your OS's _secure random number generator_ ), store AES-256-CBC(k, [user, pass]), send k in a cookie over HTTPS with the "secure" flag set (that "k" is password- equivalent, and can't leak over an HTTP connection).

Repeating Colin's caveat: the fact that you had to type "A-E-S" into your code to make the scheme work is strong evidence that you are doing something bad.

</comment></comment><comment><USER6> Store it encrypted on their computer then decrypt it each time it's sent to you? Maybe I'm missing the problem.

One way or another you're going to have to hold it as plaintext to submit it to the other site. It's nice to hold it only in RAM, but the vulnerability is always there.

<comment><USER7> Exactly, and use public key crypto:

1) Generate public/private key pair for user.

2) Send public key to client.

3) Encrypt PW on client, store as cookie.

4) Store (user, private key) on your server.

5) Client now sends the encrypted PW whenever it is needed.

6) Server decrypts on demand, but does not store a local copy.

Since you never relinquish the private key this is pretty much unbreakable for spyware going through a client's cookies. (Nevermind key loggers...)</comment></comment>