Streaming Is Laying Bare How Big ISPs and Big Tech Work Together Against Users - <AUTHOR> https://www.eff.org/deeplinks/2020/06/streaming-laying-bare-how-big-isps-big-tech-and-big-media-work-together-against <comment><USER4> I live in a country in which all internet is divided by a vertically- integrated duopoly.

One of the companies (let's call is "Bell") owns a national fibre network, the last mile of copper or fiber to the home, ISP service, mobile phone service, and several national content networks. It receives significant subsidies from the federal government for providing national backbone service, fixed wireless service in rural areas from its extensive network of towers, and content production on its networks. The other duopolist is similar, but started in the cable TV business instead of the telephone business.

These duopolists are required by law to allow third-party ISPs to use their backhauls and last-miles in exchange for some of the government subsidies. They do this grudgingly, using loopholes like providing twisted copper pairs to the third-party offices even when fibre passes outside their door. Regulations allow (and there is plenty of admission of, and lawsuits over) deep packet inspection to allow "traffic shaping" based on content and connection. At one point the cable company was successfully sued because they throttled all encrypted traffic on the assumption that it was VPN streaming pirated video content in competition with their own service., causing gaming to be useless for half the country.

I understand these are first-world problems. I own shared of some of these companies, and they pay good dividends. It doesn't mean they are not unethical.

<comment><USER5> > I understand these are first-world problems.

They are. Second (and some of the third) world countries often have much better internet, both in terms of competition, prices, and overall quality, than US and Europe, in my experience.

<comment><USER6> I have the same impression and don't understand why. Maybe it's because it's such an important part of the infrastructure that having slow internet is not the biggest concern.

I have my bunch of anecdotes from the time I lived in Berlin, one of the best was how on my building I had access to 500mbps fiber and a friend living on a building one block from me had to register on a wait list, wait for more than 3 months to get a 50 mbps ADSL, this was the only provider still accepting new customers at the time for his address. And this was happening just 3km from city center.

<comment><USER7> Comms infrastructure is often greenfield in emerging-markets so there's no legacy systems getting in the way, and the companies doing the deployment have the incentive to deploy the then-latest-and-greatest. But in 20-30 years' time they'll be having the same problems we have :)

Another issue is a lack of the kind of regulations (or their enforcement) that comms companies really dislike: things like regs about how to correctly bury cables and land-use rights or how to share overhead cable line poles - <USER2> most importantly: minimum service requirements. It's easy to focus your entire org on a flashy new FTTP set-up in one single rich urban city when you're not legally required to also keep a 75+ year-old unprofitable rural copper system running.

(No, I'm not a libertarian - and I'm happy to pay more for my service with the understanding that I'm subsidising a system that keeps isolated and vulnerable people connected.)

Certain types of corruption at the local level also play a part - <USER3> ordinarily would lead to worse outcomes overall, but in my case, at least, I'd love it if the suits that run BT's OpenReach could be bribed to stop propping up copper :/

</comment></comment></comment></comment><comment><USER8> Yeah we have similar things here in The Netherlands. Vodafone acquired one of the major cable internet providers (Ziggo), and are giving benefits to people who are customers of both; effectively a discount on the bills + a free cable tv package, which includes HBO Go.

The good thing is that it's not expensive (I'd argue that they are giving a deal that's cheaper than anything else out there), but they do make it nearly impossible for eg ADSL providers to compete.

I'm not sure how to feel about this. I consider the root problem the monopoly the cable providers have, as its by far the fastest way to driver internet compared to ADSL. As such, I've put my hopes on fiber optical arriving soon, which exposes a much larger market on which multiple providers can compete.

Incredibly annoying by the way that HBO Go is not available for Apple TV, so it's pretty much worthless to me and I just end up torrenting anything of HBO I want to watch. Not sure about the legality about it, but it sure as hell is a better experience.

<comment><USER9> > I've put my hopes on fiber optical arriving soon, which exposes a much > larger market on which multiple providers can compete

I live in Lithuania which has a pretty good fiber rollout, and has fair rules for consumers on common access to physical infrastructure by different providers.

In reality though it means you still only have one choice on who your internet provider is. It's not worth it for multiple providers to wire up an apartment or neighbourhood when there is already an existing provider there.

<comment><USER10> "It's not worth it for multiple providers to wire up an apartment or neighbourhood when there is already an existing provider there."

Except that it __is __kinda worth it if they 'd think for a moment just how many folk would __instantly __switch to any competition that arrived in an area that 's been consistently screwed over by the __only __provider there… All they 'd have to do is offer honest services at a fair price and they'd steal a massive chunk of the area's subscriber base.

<comment><USER11> Imagine the cost of providing fiber is $50/month, and Company A has wired up a town and charges customers $100/month.

You're the CEO of Company B, and you have two choices:

You can wire up the same town, charge $60/month, Company A will drop their prices to match, and you get to make a profit of $10/month from half the town.

Or you can wire up a different town, and charge $100/month - giving you a profit of $50/month from the entire town.

Which one would you do first?

<comment><USER12> It's actually more like "Company A will drop prices to $40/mo in your coverage area as soon as you start your build-out". Company A has already sunk cost into the infrastructure so they can afford to do this and remain cash-flow positive. As soon as you go out of business they know they can just raise the price again.

For this reason, "overbuilders" tend to target high-income areas where additional bundled services increase the ARPU (annual revenue per user) beyond the base service. There's also usually a higher "take rate" (subscribers per total homes served) in high-income areas. The up-front capital investment required to build out telecom services is absolutely staggering -- we're talking billions for even a small area of a city.

</comment></comment></comment></comment></comment><comment><USER13> I'm still shocked that AT&T's acquisition of Warner Bros and HBO was approved. I think a fair rule would be that if you're a company that wants to be a "natural monopoly" like AT&T, you shouldn't be allowed to enter other verticals like content production or advertising.

<comment><USER14> (Disclosure, my mom works for AT&T.)

For better, or for worse, content is the new strategy at AT&T. The physical layer of the internet is a margins game and it's getting harder and harder for large organizations to compete. I'm not for it either, but it is understandable that AT&T would want to be more like Disney than the reverse.

<comment><USER15> > The physical layer of the internet is a margins game and it's getting harder > and harder for large organizations to compete

This is only true because AT&T arbitrarily decided it so.

AT&T could easily make more money by offering a better internet service. They just willingly gave away their market to Comcast, and have decided it was easier to compete against Comcast in content than compete against Comcast in infrastructure.

</comment></comment></comment><comment><USER16> Let me give you an example of expensive.

At home in Texas I pay $70 for 1gbps internet. It actually performs at around 890-920mbps both up and down. Perhaps that is expensive compared to other countries, but I am happy with the price and the customer service/response is fantastic.

I am currently in Kuwait (modern first-world nation) where the pricing tiers in my location are $30 for 1.5mbps, $50 for 3mbps, or $90 for 6mbps.

<comment><USER17> Let me give you an example of expensive.

I live in MA USA where my only option is Verizon DSL 3mbps down and 0.8mbps up for $74.57

<comment><USER18> Until I moved west in 2017, I lived 4 miles from Madison, WI (one exit south of the beltline) and the best I could do was a WISP that was $62/month for 2 Mbps down and 250Kbps up

</comment></comment></comment><comment><USER19> The article conflates mobile and home internet. It correctly claims that most people don't have a significant choice for home internet, but doesn't say that for mobile because it's obviously not true - there's at least three major carriers plus over a dozen resellers. But then the article complains about zero rating, which as it concedes only applies to mobile, and tries to argue it's a result of lack of competition.

<comment><USER20> The trend is within the next year that at least in major metropolitan areas, wireless 5G providers will compete for home Internet. It's a dumb way to solve the problem, that becomes the smart way to solve it once the regulatory/protective measures around the last mile overwhelm the other inefficiencies.

<comment><USER19> It won't be cheap enough for a couple of years, I think, but agreed. Tech solving thorny political problems is always my favorite.

<comment><USER20> Here in LA, Verizon's 5G Home Wireless plan is $50/month if you already have a Verizon mobile plan that is $30/month or more. It includes a year of Disney+, and the first three months free. That's very competitive in the LA market.

</comment></comment></comment></comment><comment><USER21> That's one problem. The other problem is that the fragmentation of streaming (HBO has 3 streaming services now ?!?) will make the pirate bay popular again.

<comment><USER22> I wish I could find that viral image passed around for decades demanding the ideal à la carte cable tv - just want a handful of good channels not 1000 channels of crap.

I guess we got what we wanted but not quite the way we expected.

<comment><USER23> People want high quality content that takes risks, but don't want to pay for it.

I find it a lot cheaper to just pay the $2 to $20 to rent/buy the media from the various vendors since I consume so little of it.

The situation is vastly improved from my childhood when you had to deal with one company having control of delivering all the media into your home, and it was on a schedule you couldn't control and with ads.

Now I just tap a few buttons and it's on.

<comment><USER21> $2 to $20 sounds reasonable. But the trend now is to have 20 services with different content, each costing $2 to $20. Will you subscribe to them all?

<comment><USER24> It means $2 - 20 per title.

Streaming services are a bargain compared to that.

Netflix really did give everyone daft pricing expectations while it burnt venture capital to price itself artificially cheaply.

<comment><USER25> I didn't watch Netflix last month and I was still charged for it. Streaming services are only a bargain if you watch a lot of TV. If you watch <5hours/month/service than the value proposition begins to become questionable.

</comment></comment></comment></comment></comment></comment><comment><USER26> The EFF continues to conflate zero-rating and "sponsored data". Both _can_ be anti-competitive, but in different ways.

Zero-rating is an ISP not charging for data from a particular source. Sponsored data is someone other than the user paying the ISP's charge for user's data from a particular source (usually data from the entity paying for it). (In cases like HBO and AT&T, where the company paying for the data and the ISP are part of the same company or subsidiaries of the same company, I'd count that as a form of disguised zero rating rather than sponsored data).

The case for regulating zero-rating is much stronger than the case for regulating sponsored data.

Note that a company could in effect do sponsored data without even having an arrangement with an ISP. E.g., a company could keep track on its end of how much data from them each customer used each month, map that to ISPs based on IP address, and then give each customer a discount on their monthly bill based on that ISPs rates and that customers use.

Let's call this "manual sponsored data".

It's hard to make a case that manual sponsored data is automatically bad, of even usually bad. Companies are usually allowed to bundle products from other companies or provide discounts on products from other companies that go well with theirs.

In particular, its hard to make a case that even if someone does do manual sponsored data in a way that is bad, we need separate regulation for it instead of letting it be dealt with under antitrust just like you do for other third-party bundling arrangements.

But if manual sponsored data is allowed, it is then hard to make the case that it is bad to allow ISPs to facilitate it by offering a service where they track the usage for you, and then bill you for your customer's data usage instead of billing the customer.

Zero-rating, on the other hand, because it is the ISP itself choosing what to zero-rate, and because the ISP is providing last mile infrastructure for which there is very little competition in most areas, is much more likely to be anti-competitive.

It could still also be dealt with by antitrust, but because it is already taking place under highly constrained competition you can make a decent argument that it is worth specialized regulation.

Conflating the two just makes it much less likely that such regulation will happen.

<comment><USER27> Both are bad. They hide the real cost from the user.

The manual thing would never work because the rates I pay as a user are astronomically higher than the rates that would get paid for sponsored data. That's half the reason the huge companies like it. It costs very little to sponsor data where I'd normally pay inflated rates, so it's "good value" for me. The problem with that is you need to be a huge business to have a chance of negotiating those deals, so it disadvantages anyone who wants to compete as a startup.

Both are bad and should be illegal imo. Let users pay for their data. There's no reason to obfuscate the costs.

</comment></comment><comment> daniel-s Correct me if I'm wrong, but aren't the ISP monopolies in the US all/mostly the result of government monopoly protection/non-compete agreements with cities?

When governments grant monopolies the consumers get screwed. There's nothing new or mysterious about this.

<comment><USER28> You are correct - but also note government in this case also includes city, county, and state governments, not just the federal government.

If you ignore the cases in which a town has granted a monopoly to any given provider, we also have many cases where the ISPs own the poles the lines are on, or own the underground cable channels. They are not required to provide a way to buy or rent space on the poles or in the underground channels.

You end up in a situation where any upstart competitor has to duplicate the entire infrastructure in order to begin competing. It's one of the reasons the ISPs have been super freaked out by the high bandwidth microwave links (AirFiber for instance), because it significantly reduces the cost of establishing baseline service.

I'm fairly envious of the European countries that forbid ISPs or cell providers from owning (or at least having a monopoly on) the infrastructure (such as poles, cell towers, underground channels, etc.)

</comment></comment><comment><USER29> AT&T fiber customer here, I didn't even know I had HBO* until I got a paper mailing from them. I would never have purchased it otherwise as I find their pricing out of line with their content; pretty much what I think of every offering other than Disney+

Yeah, no app on my LG C9 but I can stream perfectly fine from my Verizon connected phone with the AT&T app and it looks and sounds great.

If anything the HBO debacle isn't a Net Neutrality issue but more of how bad a management team can fuck up a product launch. It is a product people know exist but don't know exactly what it is or how you get it and the confusion multiplied by too many names.

fwiw, my neighbor has three kids and between him and his wife they stream everything under the sun. Neither he nor I have ever seen cap issues so these might be regional or softly enforced.

also, be careful what you wish for, all utilities are metered and there is no guarantee a final construct for internet being a utility does not inflict that along with all sorts of associated fees to insure access beyond those we have now.

<comment><USER30> Sewage isn't normally metered, but yes.

<comment><USER31> In my experience, sewage is billed based on water usage, which makes sense to me.

If you use some water, presumably it has to go _somewhere_.

<comment><USER32> What if you're just watering your plants?

<comment><USER33> Here your max sewer bill is set based on the average water use of 3 winter months. If you go over that in the summer, we assume it's mostly landing in the yard and not the sewer.

</comment></comment></comment></comment></comment><comment><USER34> This is a little bit of my ignorance to public works and how much these companies invest in infrastructure. Please correct me.

But the way I understand it, the ISP pays for right of way access to the city/county/state to put in infrastructure to deliver internet access, right? They also pay for the labor/material cost to get the work done, right?

If we really want net neutrality and a stop to the pseudo monopolies, wouldn't the municipality have to buy the infrastructure from the private company?

<comment><USER35> > If we really want net neutrality and a stop to the pseudo monopolies, > wouldn't the municipality have to buy the infrastructure from the private > company?

Not necessarily. From a legal perspective, no. Laws could be passed mandating someone as long as it's not unconstitutional.

Additionally, there are two different things you're conflating here. First is the forcing of someone who is grated a limited monopoly to lease their infrastructure to competitors. The infrastructure doesn't have to be public to mandate some kind of sharing. The company that seeds the investment still gets some form of limited exclusivity and gets to charge competitors a (regulated) fee for their use.

Net Neutrality is different. It's stating that the service you provide must be neutral in nature. This doesn't seem directly relevant to an investment in infrastructure. It's just consumer protections because these companies are grated limited monopolies.

In my mind, any further public sale of spectrum, copper, fiber access should come with a neutrality clause. If any traffic they want to send over the new property must be neutral, then it could start to change things without help from our toothless FCC.

<comment><USER27> > In my mind, any further public sale of spectrum, copper, fiber access should > come with a neutrality clause. If any traffic they want to send over the new > property must be neutral, then it could start to change things without help > from our toothless FCC.

Or take it a step further and include a requirement for infrastructure sharing at regulated rates. Selling exclusive access to the rights of way for an essential service is a type of regressive taxation. The government reduces the tax revenue needed, but the costs get passed along to the public at flat rates. The poorer you are, the higher the relative cost for that infrastructure.

It should be illegal to sell exclusive access to infrastructure related resources because it's a system designed to benefit the wealthy more than anyone else.

</comment></comment></comment><comment><USER36> Is this because ISP's can see DNS traffic? as it's in the clear over UDP...

If so, then perhaps DNS over HTTPS would make it impossible for an ISP to rate-limit certain services. Since all DNS requests would be encrypted too...

(apologies for all the acronyms!)

<comment><USER37> Traffic shaping can still occur as they see your data volumes and the networks your connecting to. Sure it might not be as specific to the streaming service, but it should be decently possible to identify other streaming services, and any ISP-owned one.

<comment><USER38> They can also do a reverse DNS lookup of the IP addresses that you are connecting to, since you can not hide that.

</comment></comment></comment><comment><USER39> I recently switched from a 3G wireless router to a copper ADSL-like physical line (not fiber). To be honest, ... I don't notice a lot of difference. Some days it's better (less ping, more bandwidth) other days it's worse (remote desktop being barely usable). I'm using it for remote work / remote desktop, video conferences, and streaming (movies), but not gaming.

Whenever I get too frustrated I switch to my iPhone's hotspot. The service is _always_ better, but maybe that's because the line is less contested then (unfortunately I have low data caps on my phones).

</comment><comment><USER40> Ah... zero-rating. Somehow that also slipped through the cracks here in Europe. I was terribly surprised the union could even agree upon some form of net-neutrality.

For some time European citizens somehow made some good choices at the voting booths AND there must've been some strong business reason to introduce it. Without economic incentive it never would've passed.

<comment><USER41> There's "unlimited WhatsApp, Messenger and Facebook" in data plans in some EU countries. Which is kinda nice, but probably only cements their monopoly.

<comment><USER42> Also kind of odd because messaging apps use a trivial amount of data unless you're doing video. But most people may not know that and then switch to them for "unlimited" and there you go.

<comment><USER41> There's this new pattern of communicating where you talk with multi-megabyte reaction gifs back'n'forth instead of writing two or three words. Unlimited data may prove useful in that scenario.

Also exchanging pictures/selfies with the family/friends generates quite a bit of data if you do it on a daily basis.

<comment><USER43> It is amazing what can be done with 20+ year old technology.

</comment></comment></comment></comment></comment><comment><USER44> in india, the recent internet boom due to reliance JIo and others like airtel have brought incredible change in a short amount of time but sadly, FUP remains. This is somehow seen as "part of the game" when it need not be. [https://www.jio.com/fiber/en-in/plans](https://www.jio.com/fiber/en-in/plans) here speeds range from 100 mbps to 1 gbps but with stupid stupid data caps. like seriously, what is the need for 1 gbps when you can only use high speed internet till 5 tb? same for smaller plans as well. stupid. [https://www.airtel.in/broadband/delhi](https://www.airtel.in/broadband/delhi) here the word "unlimited" is used but defined in FAQs as meaning "3 TB" of data.

</comment><comment><USER45> We are living in the times of digital oligarchy. Guess we need to start a revolution to reach democracy.

</comment><comment><USER46> >AT&T is already making money hand over fist on you,

AT&T doesn't make that much money. Their profit margin is consistently around 10% which is pretty much dead on average for the S&P 500. Half of what Apple does and about 1/3 of Facebook.

<comment><USER25> Amazon's profit margin is small, but only a fool would say they aren't making money hand over fist. Profit isn't the only measure of 'making money'.

ATT's revenue was $181B in 2019.

<comment><USER47> You could looks at return on capital, but AT&T isn't that great in that measurement either.

It makes a pretty fair return in a very large investment. They certainly work for their money.

<comment><USER48> All the more impressive when they're also one of the better dividend stocks out there.

</comment></comment></comment></comment><comment><USER49> In my opinion, there is really only one valid complaint in the article:

> We need more choices for our ISPs

If you fix this, e.g. by requiring all last-mile owners to offer the last-mile access at or below their (audited, sufficiently-profitable) input cost to their retail products, most of the remaining problems would sort themselves out, without having micro-managing of ISP features.

Unless you are going to start regulating OTTs in what features/value they can provide, I think it's unfair on (non-monopoly) ISPs to prevent them from providing innovative features because of "net neutrality should trump all" opinions.

<comment><USER50> There is two sides to this. The ISP basically becoming a monopoly (or duopoly in many cases). Your idea could have the effect of creating a third one. I think it would need to be something where all the ISPs have some sort of financial stake in making that company/gov org work correctly. That could however create more regulatory capture (which we already have).

The other side is the giant walled gardens these companies have created. To fix that would mean that each of the companies would have to want to be federated. I do not see that happening. These are the same companies that are heavily filtering everyone and they said the ISPs would do it. What is the point of having a 'freedom ISP' if the other end is not? We have to have the whole chain working.

</comment></comment><comment><USER51> This article is using a really unusual definition of "Big Tech", isn't it? Isn't AT&T alone the only bad actor here?

</comment><comment><USER52> Here's hoping that Starlink will resolve some of these problems instead of just making them worse.</comment>


Have We Reached Peak Sprawl? - <AUTHOR> http://www.theatlanticcities.com/housing/2013/10/have-we-reached-peak-sprawl/7102/ <comment><USER2> Washington D.C. has height caps on buildings. It's no wonder they have so much sprawl.

[http://en.wikipedia.org/wiki/Heights_of_Buildings_Act_of_191...](http://en.wikipedia.org/wiki/Heights_of_Buildings_Act_of_1910)</comment>


Ask HN: Unpaid job at a startup. What can be done to get the most out of the xp? - <AUTHOR> My friend has no professional experience but has been coding for several years. Through networking, he was able to land an unpaid job.
It's a dating startup, which means the competition is fierce. The founder has a programmer and a couple people in India on board.
They have not discussed anything like being paid in shares. What's the best strategy to maximize this?
Also what can he do to get the most out of the experience? We both thought he should stay at least 3 months.
Thanks! <comment><USER2> The most productive thing is to quit. Anyone who, in 2014, is still not paying interns is most likely not someone who can teach you anything. There is still plenty of time to find another internship for the summer.

<comment><AUTHOR> Well the thing is he's never used the framework so he won't be hitting the ground running. He's not in school.

<comment><USER3> Most employees starting at a new business have no idea what the internal processes are. That applies to programming frameworks just as much as the procedures for refilling the coffee maker.

That basic learning is takes place in the first days/weeks of anyone's new job. There is no basis that the employer should not pay him just for not knowing how to 'hit the ground running'.

He would be much better off taking the time to look for other opportunities.

</comment></comment></comment><comment><USER4> If it's unpaid, then he should be getting lots of educational value even to the extent that it interferes with the business of the employer. I'm not making that up, it's one of the requirements of an unpaid internship [1]. If he's not getting education out of it, then he's working for free and he should not be working for free.

So the best strategy is to sit down with the boss and outline a plan that either a) clearly explains the things that your friend is going to learn during this internship (and it is an internship) and a timeline for learning them.

That's a lie, actually; the best strategy is for your friend to find somebody who's willing to pay him money for services rendered. But assuming for some terrible reason he absolutely has to stay with this startup, then he should figure out what he's going to get from it and the timeline for said getting.

[1]: [http://www.dol.gov/whd/regs/compliance/whdfs71.htm](http://www.dol.gov/whd/regs/compliance/whdfs71.htm)

</comment><comment><USER5> This is the most ridiculous thing I have heard of. Why not just apply for jobs on elance, odesk or guru.com?

</comment><comment><USER6> The question for me is whether the friend is in it for the earning or the learning?

See this for more: [http://www.bothsidesofthetable.com/2009/11/04/is-it-time- for...](http://www.bothsidesofthetable.com/2009/11/04/is-it-time-for-you-to- earn-or-to-learn/)</comment>


Apple Expands California Self-Driving Test Fleet to 27 Cars - <AUTHOR> https://www.bloomberg.com/news/articles/2018-01-25/apple-expands-california-self-driving-test-fleet-to-27-cars <comment><USER2> Project Titan is such a funny thing. Back when Chauffeur, Google's self driving car project was the only game in town, automakers found it pretty easy to dismiss, but when rumours of an autonomous Apple car began to circulate, the tone amongst car people began to shift. It's what got the automakers thinking "Is this self driving car jazz for real? Omg it might be for real! The tech companies are going to eat our lunch".

It took the carmakers a while to figure out which way was up. The Germans spent $3 billion acquiring Here maps, which was a misfire. Tesla was quick to implement Mobileye's EyeQ3 chip and single camera system and then promptly burned their bridges with Mobileye by pushing the system's capabilities way beyond it's safe design constraints.

Ironically, Apple had succumb to irrational exuberance themselves in moving so aggressively on Titan. Analysts notes a $10 billion dollar bump in Apple's R&D budget during the 2 years when Titan was big. Supposedly the project was a clusterfuck. Steve Zadesky, who was put in charge wanted to make a fairly conventional car with autonomous features, but Jony I've and a group of engineers were adamant about developing a robotaxi, which offered the best opportunity to "reinvent the mobility experience". They couldn't come to terms and executive leadership of Titan was broken from the start.

So however much things were scaled back, the project definitely isn't dead. 27 test vehicles isn't small potatoes. Maybe Apple still intends to build their own vehicle, I guess we'll see.

<comment> hi-im-mi-ih You make some great points here. However, isn't 27 vehicles small potatoes? Tesla has almost 500,000 cars on the road and it also has 5 billion miles driven. That's a lot of training data. The approach to self-driving cars is largely training a model, so the data from 27 cars is actually extremely underwhelming.

<comment><USER3> Those Tesla cars aren't collecting training data, that's preposterous. They have a mobile phone connection and some flash storage, so where is all this data going to?

It's not going over the mobile link, you would need many magnitudes the bandwidth, and it's certainly not going on the flash storage, because if you continuously stream raw camera data to flash you will kill it in a year at most.

(That is before you consider that you want a $100k sensor suite with lidar, precise wheel odometry and a GPS/INS system to get a ground truth for training anything)

<comment><USER4> That's incorrect. Tesla's connect to home WiFi and use that to transmit large volumes of training data. Owners have tracker huge packets being moved via their home connection

</comment></comment></comment></comment><comment><USER5> It's kind of cool seeing tech behemoths battle each other.

They aren't strapped for cash, hire brilliant people, so you really get to see the impact of different strategies and other factors at play.

I'm, at least, enjoying the show.

</comment><comment><USER6> It's interesting how the incumbent auto companies are competing with Apple/Google. They have a lot of ways to go to be able to compete for talent.

</comment><comment><USER7> To be honest, I'd be pretty happy if apple would just let me use google maps with carplay. Can we make that happen before we figure out robot cars, apple?

<comment><USER8> I can't speak on car play, but I switched back from GMaps to Apple.

I hadn't used it since it first came out (when it sucked) but have found it's a lot better now. I especially like that it gives me the speed limit, a feature I wish Google had. I have removed Google Maps from my phone altogether now.

<comment><USER9> I think outside of the US Apple Maps is still super average.

<comment><USER10> In Germany it works well. I actually think the lane indicators for navigation on the Autobahn are superior to Google Maps. If only I found a way to always have north up. I get super confused and lose orientation if my map is not properly aligned with north up.</comment></comment></comment></comment>


Ask HN: Is submitting links to blogs with ads frowned upon? - <AUTHOR>

Looking through the blogs that have reached the front page the last couple of days, I noticed that very few, if any, had an ad anywhere on the site. Is this because submitting a blog with an ad on it is frowned upon or something else?<p>I want to have a place, a blog, where I can share my projects and ideas with communities such as HN but also a small return on my time investment, if only to cover the cost of running a blog. <comment><USER2> No.

I'd argue there's a relationship between good bloggers and an aversion to ads. Maybe they dislike the impact on design and usability. Maybe they think blindly endorsing stuff is wrong.

Finally, running a blog shouldn't cost money. If it does, you are doing something wrong. I use github, but there's probably literally a million free options.</comment>


Feds OK Fee for Priority Web Traffic - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2007/09/06/AR2007090601262.html

<comment><USER2> It's extortion.

From a consumer point of view, net neutrality is what we're paying for. Let's say I pay $50 a month for a certain connection speed. I expect to be able to surf on the internet at that speed.

Unless I'm incorrect about how it would work, I'd be pretty pissed if certain types of sites or content were throttled by my ISP simply because they didn't pay up. I mean, I already paid money to reach that content. I don't see why an ISP should make money off of the content providers too.

</comment><comment><USER3> This title is a little misleading...not your fault, since it's the same headline the article has. The Justice department told the FCC they're against net neutrality. The decision rests with the FCC and from what the article says it doesn't look like they've decided anything yet.

</comment><comment><USER4> I've been following this "net neutrality" debate for a long time, and both sides have made some decent points. I used to be a hardcore in the camp of pro net-neutrality, but the more I think about it, the more it seems that there are some things that regulation does not solve efficiently. I guess the most frustrating thing is that _lack_ of regulation is not going to solve anything either.

One thing that lack of regulation on this issue does is make it substantially more difficult for small innovators to reap the benefits of their efficiency. Those tiny, seemingly insignificant increases in efficiency go practically unnoticed by the large monolithic telecos, but the people who are in the position to innovate further upon those marginal efficiencies (increasing rate of return on efficiency, if that makes sense) cannot do so when the ISPs themselves are taking more than a reasonable share from the people who are doing the innovating (whether the innovators are customers or competitors is important to the ISPs in that I imagine most ISPs would rather have innovative customers than innovative competitors). And that is essentially why I think that a Laissez-faire approach cannot be good news for the tiny, tech-oriented startup whose lifeblood depends upon an Internet connection.

</comment><comment><USER5> This all goes away with bigger pipes. If there's enough room to provide all of the content customers demand, then this whole debate won't matter. But if the FCC stays out and the netops are allowed to decide how they want to manage the tiny pipes they currently have, they can stave off upgrading them for a lot longer.

Sounds like an opportunity.

</comment><comment><USER6> Two questions:

1\. Why exactly do they care? Isn't their job to enforce policy rather than create it?

2\. Other than being a dominant opinion in the department, how does this actually affect net neutrality?

</comment><comment><USER7> its not something you just dump something onto, its not a big truck, its its a series of tubes!!

</comment><comment><USER8> Why do companies need permissions to charge for web traffic?

<comment><USER9> Networks want the right to decide which packets they send and which they don't (right now, all packets are "neutral", sent at the same speed and priority).

If granted, it would allow networks to extort, essentially, payment from any web site, to make sure their service is accessible by its users.

This article is a good summary of what's at stake: [http://www.washingtonpost.com/wp- dyn/content/article/2006/06...](http://www.washingtonpost.com/wp- dyn/content/article/2006/06/07/AR2006060702108.html)

<comment><USER8> I think competition would take care of that problem?

<comment><USER3> Except there's little to no competition in the ISP industry right now. In my area at least, you either have Comcast or Verizon, there's no other options.

</comment></comment></comment></comment><comment><USER10> :(</comment>


Google Tweaks Its AdWords Algorithm - <AUTHOR> http://www.techcrunch.com/2008/09/15/adwords-quality-judging-on-its-way/

<comment><AUTHOR> The official blog post: [http://adwords.blogspot.com/2008/09/quality-score- improvemen...](http://adwords.blogspot.com/2008/09/quality-score-improvements- to-go-live.html)

</comment><comment><USER2> Perhaps more importantly for us - how does this effect _publisher_?

Can we expect eCPM rates to go up since the AdWords rates have been raised? Will it be noticeable?</comment>


Ongoing DDoS on the Tor Network: Status - <AUTHOR> https://lists.torproject.org/pipermail/tor-project/2017-December/001604.html <comment><USER2> Since all TOR traffic is encrypted, how can they differentiate between legitimate TOR traffic and DDOS traffic?

<comment><USER3> I assume the DDOS is not a generic flood of traffic, but rather a particular kind of traffic that causes a disproportionate ammount of work (or, rather, memory usage) in the target. In this case, the offending component would necessarily be part of the unencrypted portion of a TOR packet that the relay is processing.</comment></comment>


Ask HN: Suggest me some good materials to learn AI programming from scratch? - <AUTHOR>

<comment><USER2> I studied Artificial Intelligence at the University of Birmingham (England, not Alabama) and we were taught the Pop-11 programming language[0] – whilst it's not extensively used in industry it might introduce some concepts that are otherwise missed during a Computer Science degree.

[0] [http://www.cs.bham.ac.uk/research/projects/poplog/primer/](http://www.cs.bham.ac.uk/research/projects/poplog/primer/)

</comment><comment><USER3> There's a related "Basics of Machine Learning" submission here:

[https://news.ycombinator.com/item?id=7762979](https://news.ycombinator.com/item?id=7762979)

</comment><comment><USER4> [http://intelligence.org/courses/](http://intelligence.org/courses/)</comment>


How many hours do you reCAPTCHA per week? - <AUTHOR> I didn't count, but I've spend too much time solving reCAPTCHAS. Google should be paying us for that. I'd guess an AI creates the tasks and x humans verify it -> the AI learns. Whatever their profitmodel is besides tracking, we should get money for that. For giving our data (another topic) and for every hour of solving those damn captchas https://www.youtube.com/watch?v=7B4bEXLJIl8 <comment><USER2> I use [https://github.com/dessant/buster](https://github.com/dessant/buster) if I need to.

<comment><USER3> Cool project, but I'm afraid it can't always be reliably used. Whenever I'm travelling and using VPN services, the audio challenge option isn't available; I think something about VPNs increase the risk profile perhaps. Of course if you happen to be blind and using a VPN you're just out of luck I guess.

<comment><AUTHOR> I'm using it with a VPN rn, it's working fine. But yeah using a VPN/TOR increases the risk profile (or whatever they call it). It even slows down the animation of loading new images, it drives me crazy.

</comment></comment></comment><comment><USER4> Basically zero. Most sites I use I have accounts on, so I don't get captchas there. And those I don't... well my Gmail account basically means I skip the captcha altogether (at the cost of being tracked by Google).

</comment><comment><USER5> Zero. I stopped using sites that use recaptcha.

<comment><AUTHOR> I'm trying to do so too, but it's hard. But it's hard to find alternatives for some sites...

<comment><USER5> Agreed. In fact, there's still one that I use which has recaptcha, but it won't be a problem unless I ever have to log in again. As long as I still have a valid cookie I won't have to, but I guess I can't count on that lasting forever...</comment></comment></comment>


Unofficial Binance lag and downtime compensation giveaway - <AUTHOR> https://airdrop.stacktical.com/10131 <comment><USER2> Glad to hear that the funds are safu.</comment>


Don't raise venture capital - <AUTHOR> http://www.startable.com/2008/09/26/dont-raise-venture-capital/ <comment><USER2> If only the bootstrapping option weren't so damn hard. Quitting your day job is quite a bit easier when you've got a war chest of VC funds that will carry you through for a year or two.

<comment><USER3> I agree, but this can be offset by saving more money while you are employed.

<comment><USER2> Assuming you go this route, and save 50% of your income (no easy feat...), you have to work your regular job for a day for each day you want to work full- time on your startup.

So, if you work for 2 years, saving like crazy, you've got living expenses for 2 more years. There are plenty of business that are still not profitable after 2 years. Growth just takes time.

</comment></comment></comment><comment><USER4> I agree with the post that not only is VC funding hard when you're working with a web-oriented project (I've tried), but in many cases its unreasonable. The relatively low operations cost has lead to making it a more viable option to make a Web 2.0 company and still keep your head without VC funding.

More appropriate, which the article failed to mention, would be Angel funding.</comment>


The Startup Resume - <AUTHOR> http://justinkan.com/the-startup-resume <comment><USER2> This is the resume that has gotten me at least a call-back from every startup I have ever sent it to: [paraphrased since I type the email every time anew]

Hi,

I'm a coder from Slovenia.

I like writing JavaScript and Python. I'm learning Haskell.

Here is my github: <http://github.com/Swizec>

I have a blog at <http://swizec.com>

Most recently I did cool thing X <relevant link, this changes every couple of months>

Cheers, ~Swizec

<comment><USER3> Has it worked? Which startup are you with now? I see from your blog you are interviewing with Google (not a startup anymore), but still not bad. Are you still open to finding the right fit with a startup? Are you "startup friendly" (appropriate expectations of work hours, pay, and equity)? I find the latter to be the biggest hangup in folks that we're looking to add to our team. They like the tech challenge, but can't really grok the startup work environment.

<comment><USER4> I'm not sure why but the phrase "Are you 'startup friendly' (appropriate expectations of work hours, pay, and equity)?" just rubs me the wrong way.

Joining a startup is a two way street. If you are considering joining one, you should do as much diligence (or even more) than they are doing on you. I, personally, love startups -- the energy, the diversity of problems, the ability to learn and grow. But, I've also been bitten by all the glitz (early in my career during bubble one) as well as people that thing "it's a startup" is an excuse to demand above and beyond efforts on a regular basis.

In general, you are going to work more at a startup, you may or may not get paid less, and you will need to weigh the whole work/life balance thing, most likely. You might be asked to make a tradeoff between equity and salary.

The tangibles you have control over (salary, time you are willing to commit, etc) are the ones you need to weigh. But, you also need to understand as much as you can about the expectations of those in management.

Poor planning, for instance, should never be excuse by "this is a startup" -- I don't mean pivoting, I don't mean tweaking as new information comes along, I mean those people that can't make up their mind on what constitutes the expected deliverable by a particular date.

<comment><USER3> I think you have it reverse -- I'm not in search to join a startup, I'm in search of others to join me. Basically, what I'm finding is that many of the candidates I'm interviewing have entirely the wrong expectations for joining a startup... at least in my geographic region (mid-Atlantic US). I'm sure it's different in your locale. But around these parts, many candidates for the startup positions simply aren't "startup friendly".

</comment></comment></comment></comment><comment><USER5> Am I correct in interpreting this post as saying that generalists don't get hired at startups, and that you should optimize your resume to look like a specialist? That seems pretty counter-intuitive, since at an early stage startup, employees end up wearing many hats.

<comment><USER6> Generalist programmers get hired all the time at startups; as someone else mentioned, requirements are always changing and it often doesn't make sense to specialize immediately. At Justin.tv, we hired a ton of generalists before we ever hired any specialists.

What I meant in the post was that if you are going to be programming then you need to demonstrate that you are a good programmer, hopefully with some specific abilities or experience that demonstrates you'll be able to work on the actual problems of the company. We hire people all the time that don't have massive experience in web development, but they demonstrate skill in some related way (e.g. maybe they talk about how they've used Python for scripting in their phd work). Anyways, the point is that even a generalist has specific projects that demonstrate they are a good programmer, and this goes beyond just listing a ton of languages they've dabbled in. Good programmers are generally very good at specific stuff they have experience in, and aren't necessarily good yet but can become good in other areas.

<comment><USER7> I read your post and this comment as arguing for resumes to focus on achievements ("this awesome thing is my fault") rather than tasks ("I did thing X as a means to an end while in role Y"). Is that a fair summary?

If so, I think you're off the mark a bit when you say this applies only to startups; I think this applies when you are applying to specific roles at a company, regardless of the company's size. I don't work at a startup at all, but resumes with lists of papers with no direct relevance where the candidate is one of 10 co-authors, academic honors, TA positions that are irrelevant to the job at hand, lots of description about a former team's job rather than what the candidate did, etc. make my brain glaze over. I have to spend more time looking for the core nuggets of achievement buried within, and that's generally not time I have. It's not necessarily a killer for someone's interview process, but it's certainly not fun and drains my time.

Meanwhile, people I encounter outside of the normal resume-submission process who simply point out something really cool they've done? If it's something really awesome, they get recruited, no real resume required.

</comment></comment></comment><comment><USER8> Sounds like an excellent in-comment writing exercise.

Zack's Resume (ala Justin Kan):

If I could, I would spend all day rolling around in data. I have fond memories of spending a weekend graphing the comments of top posters on Hacker News[0]. In the next week or two, I will be opening a pull request for d3.js for an easy way to do fisheye distortions on geographic maps[1]. I got a beating over winter break trying to convert the R project into JavaScript via emscripten[2].

Hire me so I can make your data beautiful[3].

[0]<https://github.com/zmaril/HN-Visual-Comments>

[1]<http://mbostock.github.com/d3/>

[2]<https://github.com/zmaril/emscripten/tree/herecomesdrtran>

[3]<https://www.odesk.com/users/~~80bea7ba2750c34b> (Shameless misdirecting plug)

<comment><USER9> That's a cover letter.

You're not helping an overworked/exasperated resume reader by writing prose in your resume, IMO (for what it's worth...). Resume should be bulletized chronological work history with most relevant/interesting stuff getting a sentence or two of explanation.

Leave long-form prose to the cover letter. And that is a pretty good cover letter, zackzackzack.

<comment><USER10> Sometimes I'd much rather have a little bit of detail on an accomplishment or point than a couple sentences of a bullet point. If I end up confused because of someone sticking to this rule, I get annoyed.

<comment><USER9> Yeah but it's so hard to tell when it's appropriate. It's subjective. I think everyone just has to find what works for them and go with it, hopefully achievements speak for themselves (with the help of a good cover letter).

</comment></comment></comment></comment><comment><USER11> Your cover letter (i.e. email) is far more important. Four short (1-2 sentences) paragraphs:

      1. why you are choosing *them*
      2. your basic competence for the job
      3. what special talent you bring, that makes you outstanding
      4. why you'll get along with them, be a good fit socially

</comment><comment><USER12> As the CTO hiring my first developers, I'm looking for people who will integrate with my company and my tech stack with the least amount of friction possible. This means that (a) you're a full-stack RoR/JS programmer, (b) you're smart as hell, and (c) you're not annoying.

The only thing that's really going to come through on a resume is (a), and I might be able to glean some of (b) and (c) from your cover-letter. It's rare enough to see full-stack RoR programmers on the job hunt though, so (a) alone is enough to get a call from me. Your resume almost doesn't matter, as long as it doesn't violate (c).

For me at least, just put together a generic resume and write a frank, friendly email/cover-letter. Even though I'll probably call you regardless of the cover-letter, a good one may give me enough confidence to skip right to on on-site (or coffee).

</comment><comment><USER13> Programmers: you should be founding not applying. Don't waste your time on other people's ideas. Bag groceries if you have to. As an employee you will probably get nothing or some small token amount if the company is sold.

</comment><comment><USER3> What happens to the resumes that don't make the cut? I know that I'm always in search of some great additions to our team and while the resumes might not be a fit for you, they might be a great fit for me, and YCombinator is an amazing magnet / funnel that attracts a relatively higher quality of candidate, regardless of whether or not they made the cut. Around these parts, it's hard to convince tech talent to join a startup at all, their skills notwithstanding.

I know that resumes are probably shared with a reasonable expectation of privacy, but perhaps you can let it be known that there are other, non-YC startups that might be interested in these resources if you would be willing to share and float a few other boats with those that weren't a good fit.

Just a thought.

</comment><comment><USER14> Also worth reading: <http://andrewhy.de/resumes-for-startups/>

</comment><comment><USER15> The principle applies elsewhere, too. He's right - tailor your resume.

Also, make sure what you rock at is big and clear and up-front and featured. Because you _hope_ your resume is being read by somebody who doesn't just read resumes all day.

Then put keyword soup at the bottom for recruiters, if you need to.

<comment><USER16> I've been reading Land the Tech Job You Love [1] recently, and he says the same thing about putting "keyword soup" at the bottom. But he also recommends naming the section something like "Buzzwords" so that human readers know to skip that section. "Oh, this is obviously to satisfy the automated resume screeners." I'm not so keen on the idea, but probably because I usually apply to companies that are too small to use the automated resume screeners.

[1] <http://pragprog.com/book/algh/land-the-tech-job-you-love>

<comment><USER17> It's not for the human readers to skip the section so much as to simply acknowledge that you're doing it for the machines.

If I'm a human and I'm reading a skills section that includes PostgreSQL, PL/pgSQL, SQL and RDBMS, I might think "Aw, she's padding her resume, those are all related." But if I slap a "Buzzwords" section on there, now it's clear why it's there.

And I do think that's important. Say you've got an HR drone who is told to look for candidates who know SQL. He might see a resume including Oracle, Postgres and DB/2. We all know those require knowing SQL, but the HR guy doesn't. He won't see the magic word "SQL", so there's a good chance your resume will get ignored.

That example is also why I suggest that no hiring manager ever let HR screen resumes. It's just too important to be left to a filter that doesn't have the proper knowledge set. Sure, your recruiters at Google and Microsoft and other big operations know these tech things. But most tech jobs aren't at tech companies like that.

<comment><USER16> _> It's not for the human readers to skip the section so much as to simply acknowledge that you're doing it for the machines._

Yes, exactly. That's a much better way of wording it.

</comment></comment></comment></comment><comment><USER18> One thing to keep in mind is that the resumes looked at were for YC's "Work At A Startup" event. This means that while it is possible to tailor your resume based on the kind of job you want or your strengths, you can't at this stage tailor it to a specific company.

</comment><comment><USER19> The irony of having three separate points that all say the same thing... and that thing is keep it brief, don't use filler.</comment>


Cake Health Wants To Be The 'Mint For Health Insurance' (Beta Invites) - <AUTHOR> http://techcrunch.com/2011/05/13/cake-health-wants-to-be-the-mint-for-health-insurance-beta-invites/ <comment><USER2> Banks have spreadsheet level account information - debits, credits, categories and labels. Not a very broad set of information to parse. Most banks offered several common formats for this data and it was readily available online - albeit with some caveats. Health insurance on the other hand is nothing like that.

For example - Showing a BCBS logo is hardly representative of the 39 separate companies which are part of the BCBS Association. Good luck trying to wrangle connecting to each of these companies and then trying to decipher the individual plan-level benefits of thousands of customized plans at each specific insurer. Employer's routinely customize benefits for their employee offered plans. These benefits are detailed in your benefit booklet or member guide which you probably get by mail and maybe have access to in a PDF online. Parsing and then reporting on that info is a tall order and that's if you can even get access to it.

This is in addition to the legal hoops that you'll have to jump through to even explore the ramifications of transferring PHI(Personal Health Information) from insurers and storing it elsewhere. Once explored you have to get permission to acquire this information - another difficult hurdle if its even possible.

TLDR - They're in for a long climb up a very steep hill.

<comment><USER3> This is a great point, and something we're definitely aware of. The short story is that we think it's worth the trouble to build something that provides this for the end user, and we've made some significant progress on that path already. As a shameless plug, if you're interested in helping us get there, we're hiring: cakehealth.com/jobs

<comment><USER2> Oh yeah - and I forgot to mention state health exchanges coming in 2014.

One question I'm really curious about - how do you plan to make money? Are you going to try to achieve agent/broker status? Sell ads to different insurers? Or just wait and see?

</comment></comment></comment><comment><USER4> This is a space ripe for innovation. There is such a lack of transparency in healthcare pricing and what your insurer--if you have one--will actually cover on your behalf.

</comment><comment><USER5> Anything that makes it easier for people to buy their own health insurance is a good thing. There's something about employers buying products for employees that makes those products tend towards crappiness (cf. enterprise software).

</comment><comment><USER6> I have been to the doctor 2 times in 20 years, and managing something like this just seems like an unnecessary pain. I have catastrophic with a high deductible, and I don't care to even bother with the topic unless mandatory. This just isn't like managing one's finances.

Edit: To be clear, I manage the finances of 22 subcontractors and 3 general contractors. It's a very big deal. I don't manage their healthcare at all. Much like Microsoft's strategy in mobile, healthcare needs to be as maintenance free as possible.

<comment><USER7> Any family with kids is going to be in to the doctor many times per year. They need immunizations, they break bones, they get cavities that need to be filled, etc. Then as you get old, you're on heart medication, hyper tension medication, etc.

I'm a generally healthy 27 year old, and in the last two years I've had to get cavities filled, catch up on some immunizations required by my graduate school, get my contact prescription updated twice, etc.

<comment><USER6> I truly appreciate your response, and I realize it is quite common. However, you'll have to forgive me if I consider you "needy" because I come from the minimalist mindset. I once broke up with a girl I thought I might marry because she turned out to be allergic to bees. I spend far to much time in the back-country to be attached to someone so vulnerable. I am trying to give my true opinion, and I don't think I've made any generalizations or poor logical assumptions, I've just shown how idiosyncratic I am about certain topics. I welcome opinions, and I love intelligent debate.

EDIT: Cool. Down-voting for disagreement is not supposed to be how this works[1], but you people can't help yourselves? Grow some balls and make an argument.

[1]<http://ycombinator.com/newsguidelines.html>

<comment><USER6> If you are trying to be part of the HN community and add value, why can't you state your reasons for disagreement?

<comment><USER6> All I see is down votes. Does anyone have logic to explain the reasoning or does only the fact that you disagree count?

This is not what I've come to believe the HN community is about.

P.S. The max neg number I have is -2 since you can't see the specifics.

Edit: Now (9:50 PM PST) neg 3, no logical response, however.

</comment></comment></comment></comment></comment><comment><USER8> Carriers have different systems for group and individual insurance. And they have various constraints when they offer plans to groups. And that's what a typical carrier's underwriting system does. It would be interesting to see how this recommendation system would work with employer/group plans.

</comment><comment><USER9> A hard problem but yeah if you can solve it then it'll help out a lot of people.

</comment><comment><USER6> That's what I thought, minimal interest on HN. 8 points? Only unhealthy people care, and they clearly have no arguments or they would make them, since it is easy to do here on this forum.

EDIT: Nice rebuttal: down vote. You are part of the HN plague.

<comment><USER6> Simply down-voting without an argument doesn't strengthen your position. It makes you seem without argument.</comment></comment>


Transgender teens become happy, healthy young adults - <AUTHOR> http://www.cbsnews.com/news/transgender-teens-become-happy-healthy-young-adults/ <comment><AUTHOR> Here is the link I wanted to post but it came up dead: [https://news.ycombinator.com/item?id=8332018](https://news.ycombinator.com/item?id=8332018)

Anyway, I'm intrigued by this from a trans-humanist perspective. Delaying puberty might be an interesting strategy in an era of longer lifespans.</comment>


Microsoft Code Digger - <AUTHOR> http://channel9.msdn.com/coding4fun/blog/Digging-into-your-code-with-the-free-Microsoft-Code-Digger-and-the-power-of-Pex

<comment><USER2> A similar tool exists for Java, although it doesn't rely on symbolic execution (but IIRC it is able to use it for integer constraints) but evolutionary test data generation [1]. There's a plugin for Eclipse too.

[1] : <http://www.evosuite.org>

</comment><comment><USER3> Anyone know something similar for C/C++ or Python ?

<comment><USER4> Or for Java.

<comment><USER5> Pex is based on the Daikon dynamic invariant. This document explains some results and examples in certain languages.

[http://groups.csail.mit.edu/pag/daikon/download/doc/daikon.p...](http://groups.csail.mit.edu/pag/daikon/download/doc/daikon.pdf)

<comment><USER6> Is it? I was under the impression it just uses symbolic execution rather than invariant detection.

<comment><USER5> Your are right. I mixed up dynamic symbolic execution with invariant detection. I know there is something called DySy which does do invariant detection using dynamic symbolic execution.

</comment></comment></comment></comment></comment><comment><USER7> I tried it. Doesn't usually work all that well though, and basically only works on built in .Net types. If you pass in your own object containing only .Net types, it's not smart enough to fill those in with potential test data. Interesting idea, but I found it completely worthless

<comment><USER8> It would be very, very useful if only it worked with regular expressions. Or if you could run it against F# functions.

<comment><USER9> I just tested it using Pex for fun and - to my surprise - Pex was able to deal with regular expression and this AFAIK without any build-in knowledge of regular expressions.

      using System;
      using System.Text.RegularExpressions;

      public class Program
      {
        public static String Puzzle(String input)
        {
          if (new Regex("123(foo|bar){3}456[0-9]{5}789").IsMatch(input))
          {
            throw new ArgumentException();
          }
          else
          {
            return input;
          }
        }
      }

Pex reported three test cases.

      null                         ArgumentNullException
      ""                           okay
      "123foobarbar45600000789bb"  ArgumentException

Try this example yourself.

[http://www.pexforfun.com/default.aspx?language=CSharp&co...](http://www.pexforfun.com/default.aspx?language=CSharp&code=HgHsvQdgHEmWJSYvbcp7f0r1StfgdKEIgGATJNiQQBDswYjN5pLsHWlHIymrKoHKZVZlXWYWQMztnbz33nvvvffee__997o7nU4n99%2f%2fP1xmZAFs9s5K2smeIYCqyB8%2ffnwfPyLWTbG8SF9fN22_OEz8v8Zv8nft_FV_sS6z_vTdqs6bpqiWzWGSrNaTspim0zJrmvRlXV3U2SL5xUma6hdNm7X043VbA9zL9Q9_UOZb_lexXK3bO9QW7dO0OE_3lvlVSv3k77Y_2t27t3VeVT8zyeo7v%2fjeL9m%2f%2f_n3drYffv8X3%2f8lDw4efnRnfNZ8kbXT_ZZAucMgBFCatvO6ukoB7Li_WC%2fyZXv6bpqvWkJ6684hN%2fol%2fG9eNnnwZp2363opqLmGvyT5Jf9PAAAA%2f%2f8%3d)

UPDATE: I was wrong - Rex was integrated into Pex in 2010 and this made Pex much smarter when it has to deal with regular expressions.

</comment></comment></comment><comment><USER10> I'll prefix my question by saying I'm unfamiliar with QC beyond knowing of its existence and roughly what it does in terms of generating test values:

Am I misunderstanding, or is this akin to QuickCheck for C#?

<comment><USER9> The QuickCheck manual states that they are randomly generating test cases [1]. This tool is build on top of Pex [2] which analyzes the byte code and uses the Z3 theorem prover [3] to systematically find inputs covering all code paths. This is really a impressive and powerful tool. You can have some fun with it at the Pex for fun site [4]. There is some secret code and you have to reimplement that code based on the test results generated by Pex comparing your implementation to the secret implementation.

[1] <http://www.cse.chalmers.se/~rjmh/QuickCheck/manual.html> [2] <http://research.microsoft.com/en-us/projects/pex/> [3] <http://research.microsoft.com/en-us/projects/z3m/> [4] <http://www.pexforfun.com/>

<comment><USER11> The pexforfun thing seemed pretty clever:

      // What values of v and i can cause an exception? Ask Pex to find out!
      public static void Puzzle(int[] v, int i)
      {
        if (v[i + 2] + 5 == v.Length + i)
          throw new Exception("hidden bug!");
      }

and then it automatically finds the breaking input:

      {-6} 	 -2 	 Exception 	 hidden bug!

</comment></comment></comment><comment><USER12> Anything similar for JavaScript?

</comment><comment><USER13> I've noticed here and on reddit that Microsoft stories don't get much attention. Rightly so?</comment>


Show HN: Tool for WebSocket benchmarks with Millions of concurrent connections - <AUTHOR> https://github.com/oatpp/benchmark-websocket <comment><AUTHOR> This tool was successfully used to setup 5 Million connections benchmark for oat++ - [https://oatpp.io/benchmark/websocket/5-million/](https://oatpp.io/benchmark/websocket/5-million/)

<comment> mr-dotter I've seen the 2M benchmark before, nice to see you are going further and now its C5M. Impressive work. Congrats</comment></comment>


Ask HN: Why do some websites need to be taken offline for maintenance? - <AUTHOR> I was just browsing italki.com and there has been a notice since morning that the website will be going down for maintenance (it is completely offline now)
It's a pretty huge site I think with lots of revenue and users and it's probably losing money for the time it's down.
So I was just wondering why do some websites need to be taken down while others like Facebook, Gmail, etc never once have shown me such notice yet upgrade seamlessly? <comment><USER2> This used to be normal, you'd see an email come out a couple weeks in advance and a banner notice on the site, and then a site would go down on like a Sunday or Monday morning night between 1 and 3-4am ET in the US to try and minimize disruption.

The key reasons were as others said, but in my personal experience generally data service/schema related where a key data source would be offline for a period of time was the primary cause. One thing not mentioned is hardware upgrades has always been a key driver of this type of maintenance. Self hosted systems have to be transferred across hardware and brought back online and tested. This still happens today for many larger enterprises as upgrading to the latest hardware to support your SQL Server or Oracle database comes down to cost. They can go down for 2-3 hours for the switchover, OR spend 6-8 weeks engineering & testing a non-downtime failover. And the math is simple, most businesses don't have a true 24/7 need to be online and the don't make money 24/7 online, so this is still a solid reason and solution in those cases.

At one company I consulted at we gave them an option to upgrade their relational database solution (hardware + software) with 0 downtime, but it would take around 700 man hours to setup and test, or they could go offline for `4 hours and be back online. They were a B2B company and said the difference in cost was not worth it and went down for a few hours over a weekend instead, which honestly made far more sense to me. They did have clients that accessed the system overnight, but they just sent out a notice and no one cared.

<comment><AUTHOR> I guess that makes most sense that they are hosted on their own servers and not cloud. I'd also bet it's mostly a database thing. Better to not let users write anything new than to lose their data which I'm sure would cause more hassle.

</comment></comment><comment><USER3> Bigger sites are more likely to use microservices and multiple failovers so individual components can be upgraded without downtime. Smaller sites likely have a single point of failure that needs to go down to make changes (e.g. 1 single master database that needs to be write locked for a schema change).

<comment><USER4> This isn't limited to just smaller sites. Many slower-moving organizations, e.g. government and banks, aren't yet up-to-date with zero-downtime deployments.</comment></comment>


Are Your Friends Making You Fat? - <AUTHOR> https://www.nytimes.com/2009/09/13/magazine/13contagion-t.html <comment><USER2> The main link has some junk on the end that is causing a 404, the corrected link is:

[https://www.nytimes.com/2009/09/13/magazine/13contagion-t.ht...](https://www.nytimes.com/2009/09/13/magazine/13contagion-t.html)

HTH</comment>


Classic Shell hacked with compromised update that erases your partition table - <AUTHOR> http://www.classicshell.net/forum/viewtopic.php?f=12&t=6434 <comment><USER2> It looks like this is on Fosshub (at time of writing is offline) which could imply that there's a much larger compromise in progress depending on what popular software is hosted there.

<comment><USER3> It looks like they have a dump of the Fosshub user database.

Audacity was also affected: [http://www.audacityteam.org/hacked- download/](http://www.audacityteam.org/hacked-download/)

<comment><USER4> Damn. You have no idea how close I was to reinstalling Audacity last night.

<comment><USER5> Downloaded it a couple days ago in my case! Close call, though I do backup my important files offsite.

<comment><USER4> I keep two offsite backups!

</comment></comment></comment></comment></comment><comment><USER6> Interesting to see malware in this day and age that actually kills your computer instead of installing adware or joining a botnet.

<comment><USER7> From their Twitter page

 _Fun fact: We actually had an EFI payload. We just had issues with the installer and it was left unadded._

<comment><USER8> Damn. With the state of most consumer mainboards, an EFI "payload" could leave the system "bricked". I know I've got one el-cheapo laptop that can't boot because I made a mess of the EFI environment and there's no way to reset it.

<comment><USER9> I'm begin to think that EFI is a very wrong turn way on modern computers.

<comment><USER6> You're a bit behind the curve on this. EFI has been criticized for being horrendously complicated and gross since its inception.

<comment> semi-extrinsic Obligatory Matthew Garrett quote from a Linux kernel EFI patch in 2011:

UEFI stands for "Unified Extensible Firmware Interface", where "Firmware" is an ancient African word meaning "Why do something right when you can do it so wrong that children will weep and brave adults will cower before you", and "UEI" is Celtic for "We missed DOS so we burned it into your ROMs".

[https://lkml.org/lkml/2011/5/25/228](https://lkml.org/lkml/2011/5/25/228)

<comment><USER10> Even on servers, I noticed that HP (now HPE) began locking access to server UEFI updates soon after [http://lkml.org/lkml/2013/11/11/653](http://lkml.org/lkml/2013/11/11/653) was posted.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Audacity was also affected for a brief time, and the Audacity page about it ([http://www.audacityteam.org/compromised-download- partner/](http://www.audacityteam.org/compromised-download-partner/)) has much more information including the FossHub statement.

It's described there as the Audacity portion being a compromise of an Audacity developer's account, with another reference to two compromised accounts. There were also other attack attempts going on at the same time, so the FossHub folks took things down for a time - not sure if they're done with their checking or not.

According to FossHub there were only ~300 downloads of Classic Shell during this time, and they may have caught the Audacity one faster.

</comment><comment><USER12> A youtuber who usually does videos of classic DOS viruses made a video of this one in action.

[https://www.youtube.com/watch?v=DD9CvHVU7B4](https://www.youtube.com/watch?v=DD9CvHVU7B4)

</comment><comment><USER13> This comment ([http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=...](http://www.classicshell.net/forum/viewtopic.php?p=27961&sid=e793bf88f4ac6301869fea98aab54756#p27961)) on the forum thread posted md5/sha1 checksums of clean & infected 4.3.0 installers (though it's not clear if those are only infected checksums).

       ClassicShellSetup_4_3_0_clean.exe
       MD5: e10881b65c27c6e09e5a33cd8bcd99c6
       SHA1: a6b06d07fe3b1a7204b1b62c67fbf3c602385364
       File size: 7220496 bytes

       ClassicShellSetup_4_3_0_infected.exe
       MD5: c67dff7c65792e6ea24aa748f34b9232
       SHA1: 438b6fa7d5a2c7ca49837f403bcbb73c14d46a3e
       File size: 7148732 bytes

<comment><USER14> Are the people over there sure that it's a good idea to rely on the broken[1] MD5 and the close-to-be-broken[2] SHA-1 for verifying checksums in the context of malicious actors? Though I guess the hashes and file sizes differ, so I guess this is just being pedantic.

[1] [https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities](https://en.wikipedia.org/wiki/MD5#Collision_vulnerabilities)

[2] [https://sites.google.com/site/itstheshappening/](https://sites.google.com/site/itstheshappening/)

<comment><USER15> It seems more reliable to check the developer signature in Properties on the EXE - the correct developer is "Ivaylo Beltchev". The infected download is unsigned and requires you to click through a warning.

<comment><USER13> Though annoyingly it's signed using sha1, not sha256.

So if they were gonna put effort into making an sha1 collision, they'd probably target the signed payload, not the overall exe.

Though it doesn't look like sha1 is _that_ broken yet, for the budget of this grade of attacker.

</comment></comment></comment></comment><comment><USER16> FossHub was compromised and only downloads from there were affected, various other projects were also affected.

</comment><comment><USER17> Apparently the hacked one wasn't signed. Users would have clicked through a (very prominent) warning to install it.

<comment><USER18> Unless SmartScreen complains, the order of dialogs and buttons on those dialogs is exactly the same for both signed and unsigned programs. They only differ in content/design elements. That's not what I'd call prominent.

There's nothing like HSTS for signed programs, so it can't be helped, though.

<comment><USER19> On Windows 10 you cannot install unsigned installers at all without disabling SmartScreen.

<comment><USER18> That's not true. Although the screen wide dialog thingy is a little tricky, you can still choose to continue. It doesn't even appear most of the time.

</comment></comment></comment></comment><comment><USER20> So this appears to be a compromise of the download site, and probably could've been avoided with a hash verification, blah blah blah. Finger wag at developer.

Moving on, I've been thinking about the problem of file integrity and how verifying the MD5/SHA sum creates extra gruntwork for the end-user, particularly for your average Windows user.

How difficult would it be for the installer to compute its _own_ hash and present it to the end-user when the installer starts, so that they can verify it against the hash posted on the front of the software's webpage?

EDIT: Although I suppose if the binary itself is compromised, the hackers could always modify the hash function so that it shows the same hash as an existing "good" version even with the malicious code added. Hmm.

<comment><USER21> Piggy backing on ayuvar's comment, it would be better to sign your installer, and then have your front page/download page tell the user to be sure the installer is signed (show pictures, tell them what to look for, etc).

<comment><USER22> Per the developer at that forum thread:

"To be safe, always check the digital signature of EXEs you downloaded, before you run them. The official Classic Shell installer has a signature for "Ivaylo Beltchev", and the fake one doesn't even have a signature."

And per another user (silmar), my sentiments:

"The problem with signed installers is: many software developers don't sign, so you install even if Windows warns you. Even if someone signs and then stops signing, it may be that he forgot about it. But you want to install NOW, so you skip the warning."

Admittedly the download page doesn't mention signing or how to look for that, though, per the comment I referenced above, I doubt it would make much difference to the vast majority of users.

<comment><USER23> I doubt it as well, and I completely agree with what you and others have said. While I rarely use Windows, it's unsurprising to see software from smaller development shops release software with no signature (or at least historically it's been unsurprising). So, this complacency sort of breeds the habit of simply clicking through and installing anyway. Heck, I even remember when installing certain drivers often required clicking through similar warnings since they occasionally weren't signed.

While I'd like to think things are generally better now, I think the historical inertia of Windows' ecosystem and how conditioned users have become to ignoring such warnings is at least partially (mostly?) at fault. There's no easy way to correct people's behavior, and enforcing certain settings (e.g. only installing signed software) would mean either 1) upsetting power users or 2) users still finding a way to disable such checks.

</comment></comment></comment></comment><comment><USER24> This is another reminder of how the security model of desktop OSes is pretty terrible. Every time you install software on Windows, you trust it with everything on your computer by giving it administrative rights.

OS X doesn't have this problem usually, as most apps don't require admin rights to install, you just copy them to /Applications, but it still has some apps that use installers.

<comment><USER25> There still is not (AFAIK) much partitioning between apps on most desktop OSes. So even if a malicious app doesn't have admin rights, it still can run under your UID, which is almost as bad as it then has access to nearly everything you care about.

Obligatory xkcd: [https://xkcd.com/1200/](https://xkcd.com/1200/)

<comment><USER15> Apps on OS X that have been installed through the App Store are sandboxed which is pretty close to the partitioning on iOS - for instance they can only access files the user has explicitly given access to (open dialog, double- clicking, drag and drop onto the app).

That doesn't help you with apps you downloaded through the web though, which for me is all my apps because the App Store is a PITA.

<comment><USER26> UWP apps installed via the Windows Store have many of the same limitations (can only access own files, runs in a limited security context, etc).

</comment></comment></comment></comment><comment><USER27> Related thread on reddit: [https://www.reddit.com/r/pcmasterrace/comments/4vw21h/massiv...](https://www.reddit.com/r/pcmasterrace/comments/4vw21h/massive_psa_do_not_download_classic_shell_read/)

<comment><USER28> The fix: [http://www.classicshell.net/forum/viewtopic.php?f=12&t=6434&...](http://www.classicshell.net/forum/viewtopic.php?f=12&t=6434&p=28007#p28007)

Close one for me: I was downloading WinDirStat when I came across that post.

<comment><USER11> Semi-unrelated: WinDirStat is amazing, but you might also look at WizTree for speed - it does its space analysis based just on reading the MFT, so it's quite fast.

</comment></comment></comment><comment><USER29> I must have gotten very lucky, because I downloaded and installed installed Classic Shell on a fresh Windows 10 install yesterday afternoon and was not affected - the installer bore the right signature and my system is intact and boots fine. If I had tried a few hours later, I would probably be reinstalling Windows 10 for the second time in 2 days.

</comment><comment><USER30> I hope the auto update wasn't affected. I just did this at work, no big warning screen. Now I'm paranoid to reboot..

Update: Looks like I wasn't affected. There was an official update (4.3.0) which was released on the 30th leading to unfortunate timing.

<comment><USER11> The thread on Classic Shell specifically notes that the auto update pulls from a different source that was not affected.

<comment><USER31> It also verifies signatures before it will execute the update, so even if that source were hacked it wouldn't have been affected.

</comment></comment></comment><comment><USER32> Twitter account of the hackers: [https://twitter.com/CultOfRazer](https://twitter.com/CultOfRazer)

<comment><USER33> I'm not sure it's appropriate to give that kind of people unwarranted publicity.

<comment><USER34> What "kind of people"?

They had the power to abuse that data and ship malware to millions, but decided just to give people a scare.

That's just the average grey-hat, or how most hackers were in the 90s.

Compared with the profit-obsessed and abusive hackers and companies on the web today, which try to shove actual malware, sometimes installers with tons of preselected options, sometimes bitlocker, they're not bad.

<comment><USER33> Black hat hackers who bask in people calling them names in response to their mischievous adventures.

Deleting the partition table is not grey hat, it's black hat. The bad guy in a Western isn't suddenly neutral just because he isn't literally Josef Stalin.

</comment></comment></comment></comment><comment><USER35> Classic Windows. I miss the 90s.</comment>


Ask a North Korean: what's life like in the army? - <AUTHOR> http://www.theguardian.com/world/2015/sep/11/north-korea-army-life-defector-question <comment><USER2> There is big difference between elite North Korean army and regular army. Totalitarian regime would never trust their citizens with guns. Regular army is basically forced labor camp. Some of them might train shooting, but at level three shots per week, in heavily guarded area.

Source: my father served in communist army.

<comment><USER3> Yeah, this is an important part of the picture as well. In NK, "being in the army" is basically being a slave.

Maybe some people are siphoned off from the labor pool to be trained in actual warfare, but most aren't.

</comment></comment><comment><USER4> Whenever I hear about disadvantaged North Koreans, it confuses me how they can survive- Some of these people say they had never eaten any other food besides ground corn, even rice was an unobtainable luxury. How is it possible for a person with that type of diet to remain alive, from just a pure medical/physiological standpoint?

<comment><USER3> There is a rationing system for rice and corn. It's highly unlikely that this is enough food to live on, so people probably turn to the black market for food-- but even that is probably quite thin, and extremely expensive.

Eating edible grasses/herbs (even ferns), very weak bone-based soup/tea, gutter fish, frogs, roadkill, rice roots/tubers, tree bark (the NKs have been known to make pine bark "cake"), wild mushrooms, oysters/clams (if near the ocean), wild berries/fruits, lichen, bugs, rats, wild hemp (extremely nutrient rich and unregulated in NK), and sparrows, all of which are plentiful in NK. Knowing Koreans, they probably also have family gardens where they grow garlic and shallots (relatively easy to do), provided that they can retain viable seeds. I'd imagine that these private gardens are frequently stolen from by other hungry people, so they may be clandestine a lot of the time. No kimchi, though-- they can't grow the cabbage.

You see this kind of food pyramid a lot during famines-- most recently, during the Cambodian genocide but also during the Great Leap Forward in China and the Holodomor in Ukraine. Scavenging low-density calorie sources from wherever, with increasingly lowered standards for what constitutes food. The problem becomes when effectively everyone is scavenging, which leads to sparse finds and increased calorie usage during harvesting. I assume they have been in this state of extremely scarce scavengeables for years now.

There's effectively no access to dairy items or fresh fruits from what I can tell. This probably results in near-endemic calcium deficiency, and is supported by their tragically reduced heights and high infant mortality.

During the last NK famine in the 90s, there were widespread rumors of abduction of children for the purpose of cannibalism, and people were told not to eat meat unless they knew the source. It's tremendously sad.

<comment><USER5> This is fascinating - do you know what books/articles I can read to learn more about NK diets?

<comment><USER3> My informed conjecture about NK diets is based off of a few survivor accounts from expats and a lot of background information about NK that I've picked up over the years, paired with a lot of information I learned about various other famines via Wikipedia and college. I can't suggest any specific books or articles though-- too many articles to list, and I wouldn't remember what factoid came from which article anyway. In general, I just ask a question to myself, then use the internet to find the answer.

If you want related books to help think about what sorts of things happen during these times, I'd start with Maus. It's not at all related to NK, but it captures the desperation and ingenuity of long term crisis.

</comment></comment></comment></comment><comment><USER6> _> The main difficulty conscripts must endure is constant hunger. Soldiers in the special units are well taken care of but those stationed outside the capital Pyongyang are only given two or three potatoes a meal, or are fed solely on raw corn kernels or corn rice... North Korea may be the worst place in the world to do military service._

I don't doubt it, but it's probably worth noting that those North Koreans inside the army still live better than those outside it. The official ideology of the modern North Korean state is _songun_ ([https://en.wikipedia.org/wiki/Songun](https://en.wikipedia.org/wiki/Songun)), "military first," meaning that the military's needs are prioritized when allocating the nation's extremely scarce resources. (Which makes sense, considering how critical the army is to maintaining the regime's hold on power.)

So if soldiers are only getting two potatoes, that doesn't mean that they'll be looking enviously upon the diets of the civilian population. The civilians will be having to make do with even less.

</comment><comment><USER7> _North Korea may be the worst place in the world to do military service._

Eritrea also seems to be solidly in the running for this questionable record:

[http://taskandpurpose.com/eritrea-is-the-last-place-in- the-w...](http://taskandpurpose.com/eritrea-is-the-last-place-in-the-world- you-would-want-to-serve-in-the-military/)

<comment><USER8> From the article:

 _In the United States, individuals join the military as a way to serve their country with honor and pursue new career opportunities. But that's not the case in Eritrea, where men and women risk their lives and those of their families just to escape military service._

Both are nation-states though, and both have governments that pass laws and then punish the masses for disobeying them.

In other words, the people of both countries have rulers, and the main difference is in the rulers' degree of "benevolence" towards their subjects.

You're fine with your particular government ruling over you because you think they would never do what Eritrea and North-Korea are doing.

But that's how German people thought before Germany turned into a mass- murdering Nazi-Germany, so that kind of thinking is clearly misguided.

Any nation-state is just a police state waiting to happen. Then it does happen, and years or decades pass until tyranny subsides, and then people go back to "it could never happen here!"

How crazy is that?

<comment><USER9> I guess if you're more of an Anarchist, you could go to Somolia, or Afghanistan, parts of both are considered fallen states with no actual government.

<comment><USER8> Are you trying to make an argument? What is it?

</comment></comment></comment></comment><comment><USER10> "Thanks to these diets, North Korean soldiers are said to be several inches shorter than their South Korean counterparts"

Diet early in life has the determination if you are going to have a stunted growth. By the time you finish high school you are about as tall as you are going to be.

<comment><USER11> You can also get stunted growth if your mother is malnourished during pregnancy or even before. In fact, it can take several generations for the effects malnourishment to be eliminated.

<comment><USER12> My grandparents and granduncles were all Irish farmers who immigrated after WW2. None were over 5'9\. From photographs, it appears that their parents were noticeably shorter. None of the males of my generation is under 6', and most are > 6'2". None of the females are shorter than 5'8" or so.

</comment></comment></comment><comment><USER13> Also related, I have a friend that runs a nonprofit to try to get information about the outside world into North Korea. Running a fundraiser currently: [https://www.indiegogo.com/projects/6-000-miles-to- freedom#/s...](https://www.indiegogo.com/projects/6-000-miles-to- freedom#/story)

</comment><comment><USER14> > Thanks to these diets, North Korean soldiers are said to be several inches > shorter than their South Korean counterparts

If people join after high-school, how does that work?

<comment><USER4> They starve even before their military service- The only reason this comes up for the military is because soldiers from both sides appear near each other on the borders, making the height comparison easy.

<comment><USER15> south korea specifically picks only tall soldiers to stand guard at the border. They do it on purpose to intimidate the north koreans. It is consider special duty in south korean army and you must be hand picked. The US does this shit too, to be a flag bearer or part of official honor guard you must be over 6 feet tall

<comment><USER7> So why wouldn't North Korea do the same?</comment></comment></comment></comment>


Cross-Browser Development Tips (or how to make JS work in IE8) - <AUTHOR> https://www.tinfoilsecurity.com/blog/cross-browser-development-tips-javascript

<comment> martin-adams I've done a lot of UI work for an embedded device which explicitly supported IE8. Compare IE8 to Chrome for anything of complexity and you really do realise how slow it is. What would take about 30 seconds in Chrome would be over 10 minutes in IE8.

This of course was doing a lot of XML data processing with XPath and using the Dojo framework. But all in all, JavaScript is mostly compatible, it's the DOM you have to watch, trailing commas and some subtle XML properties such as 'hasAttribute', and of course, don't leave in those console.log statements.

Wrapper the low level stuff and make sure all your developers write consistent code and life will be a lot better.

</comment><comment><USER2> Good article...your service?

You make me sit there and wait for the results of a scan of a website and then don't show me it? You then ask me to create an account to view my 2 "borderline-unsecure" vulnerabilities? Ok, account created with dummy email. Oh whats this? I still can't view the results? I have to upload shit to my production site in order to just view the results? Did you even actually find anything wrong?

I understand the security implications of having someone verify they do indeed own the site scanned...but this bait and switch crap is infuriating. If you are going to go down that route, at least message it somewhere...clearly.

<comment><USER3> You're right regarding the security implications. We can't show vulnerabilities to someone who hasn't verified they own the site they've scanned, unfortunately. We're working on ways to message this better (specifically, having a "Step N of M" with titles for what each step is.

We have some one-off checks that are more 'instant gratification' like our Rails YAML vulnerability check ([https://www.tinfoilsecurity.com/railscheck](https://www.tinfoilsecurity.com/railscheck)) and we'll be adding more like these in the future.

Sorry you felt it was a bait-and-switch...we'd love to make it up to you. Feel free to email us at firstname.lastname@example.com and we'll definitely try to make it right. :)</comment></comment>


Battery Cell Production Begins at the Gigafactory - <AUTHOR> https://www.tesla.com/blog/battery-cell-production-begins-gigafactory?redirect=no <comment><USER2> It's going to be very interesting to see how this impacts global battery supply pricing. Will external factors (limited supply of raw materials for example) limit the impact to Tesla only, or will having a huge consumer of batteries leave the market open up supply to the point that prices drop dramatically?

<comment><USER3> It seems that is the goal and intent: to increase both the supply and demand of batteries, infrastructure will improve, commoditization will increase, and prices will be driven down.

While it may be a profitable business in itself, Tesla does not seem to be targeting battery sales as its primary revenue source of the future. Instead, their stated and apparent goal is to sell many more electric vehicles once the cost of production reaches an inflection point where an electric drivetrain is cheaper to produce than an internal combustion one.

</comment></comment><comment><USER4> You can see a pic of the new battery cell:

[https://electrek.co/2017/01/04/tesla-2170-battery-cell- produ...](https://electrek.co/2017/01/04/tesla-2170-battery-cell-production- gigafactory-model-3/)

</comment><comment><USER5> Interesting new form factor 21mm x 70mm.</comment>