Fortnite Boycotts Google Play Store; Teaches Kids to Sideload - <AUTHOR> https://arstechnica.com/gaming/2018/08/fortnite-on-android-may-drive-its-battle-bus-past-googles-30-cut/?comments=1 <comment><USER2> Could they build the Play store cost into the Play store option? The same game would be available through their website with two links, one for direct download from the website, and one link 30% higher to the play store. Let consumers decide how much inconvenience / insecurity that 30% is worth.

<comment><USER3> I don't know about Play Store policies, but Apple's App Store definitely doesn't allow the app listing or the app itself to link to an external site for subscriptions or payment methods. See <[https://gizmodo.com/5761383/apples-new-subscription-model- is...](https://gizmodo.com/5761383/apples-new-subscription-model-is-evil>) (I couldn't find a better reference after doing a quick search.)

<comment><USER4> Yes these are not comparable. Google favors user freedom and is diametrically opposite of Appples app store.

</comment></comment></comment><comment><USER5> Discussed here: [https://news.ycombinator.com/item?id=17681734](https://news.ycombinator.com/item?id=17681734)

</comment><comment><USER6> If this slows down kids adoption of Fortnite, it's a loss for the addictions treatment industry.

</comment><comment><USER7> Good for them! This will make an excellent case study.

<comment><USER8> Teaching people to bypass normal security measures, especially kids, is a really horrible idea.

I agree 30% is too high. But this is not a good idea.

<comment><USER9> There is no security benefit to Google's scare tactics of calling other companies "untrusted sources". Both because Google scans apps installed from untrusted sources on your phone anyways, and because Google's malware scanning is literally industry-worst: [https://www.av-test.org/en/antivirus/mobile- devices/](https://www.av-test.org/en/antivirus/mobile-devices/)

Imagine if Microsoft made you enable "untrusted sources" to install Steam on a PC.

<comment><USER8> Google scans apps before they are listed in the Play Store.

That's why scanning on the device is such a wasteland of awful.

</comment></comment></comment></comment><comment><USER10> A decision with a lot of confidence. Good luck to them.</comment>


Followup: Google contacts the Trese Brothers, doesn't axe their games - <AUTHOR> http://www.wired.co.uk/news/archive/2012-08/10/trese-brothers-google-play

<comment><AUTHOR> Following up on this link from last week: <http://news.ycombinator.com/item?id=4333542></comment>


Miniature 1959 IBM 1401 Console handmade polystyrene scratch build - <AUTHOR> https://imgur.com/gallery/yCh4BNv <comment><USER2> Nice. What would make this _really_ amazing if was also fully emulated (using some basic robotic kit for the tape drives and, say, a Raspberry Pi). Myself, I was thinking about maybe making a _paper_ miniature of IBM System/360 running on Hercules.

<comment><USER3> The IBM 1401 emulator we use is ROPE: [http://ibm-1401.info/#1401-Software](http://ibm-1401.info/#1401-Software)

The Computer History Museum in Mountain View, CA does demos of the real 1401 (at least until the coronavirus hit), so once things open up again, anyone who is nearby should check it out.

</comment></comment><comment><USER4> A side attraction to this would be Johann Johannsson's excellent ambient electronica tribute to his father's work on the 1401: [https://en.wikipedia.org/wiki/IBM_1401,_A_User%27s_Manual](https://en.wikipedia.org/wiki/IBM_1401,_A_User%27s_Manual)

I often listen to it while coding. Lots of glacial build up and voice samples of someone calmly instructing how to use the machine.

</comment><comment><USER5> Building miniature mainframe installations is very cool. Much better than a model railway set. I'd like one that works, of course, with blinky lights and tape drives spinning. The electronics can be modern and buried in a box under the table, but I'd like all the lights and switches to behave like the original.

<comment><USER6> Have you seen this replica of Cray 1A? [http://www.chrisfenton.com/homebrew- cray-1a/](http://www.chrisfenton.com/homebrew-cray-1a/)

</comment></comment><comment><USER7> This is great to see. Congratulations on your effort. As an older (60) software engineer, your modeling brings back some pleasant memories for me.

</comment><comment><USER8> I look at these pictures and can't fathom how anyone could have the patience to place all those tiny "keys" when I can barely finish reading an article without getting bored and skipping to the next thing. How can I learn patience?

<comment><USER9> Practice.

I think I would call it focus instead of patience. It's often useful to have a goal that is motivating.

</comment></comment><comment><USER10> I've always loved polystyrene models.I'm curious how the chair was done.

<comment><USER11> The chair has its own series of images: [https://imgur.com/gallery/TymP8M5](https://imgur.com/gallery/TymP8M5)

</comment></comment><comment> modal-soul Is there a name for the aesthetic of the equipment being modeled here?

<comment><USER3> IBM put a lot of work into a detailed corporate design aesthetic. Itis described in detail in the book "The Interface: IBM and the Transformation of Corporate Design". The design principles were developed by Edgar Kaufmann, Jr (whose father owned Frank Lloyd Wright's Fallingwater), and they were developed by Eliot Noyes, a notable industrial designer.

Some design concepts in the computers were recessed pedestals for a feeling of floating and lightness, the concealment of most of the circuitry, expressing the "inherent drama" of computers, the carefully controlled color scheme, and modern materials for the cabinets. The tape drives in particular were wildly successful at expressing the "inherent drama" of computing, to the point that spinning tape drives became a movie cliche .

</comment></comment><comment><USER12> What is that typewriter-like console thingy? I have seen a lot of pictures and literature about IBM 1401 installations and have never seen anything like that. I thought the card reader and tape drive were the only input devices for the 1401. Can anyone point to a contemporary picture or description of it?

<comment><USER12> It's the 1407 Console Inquiry Station, pictured and described on p. 29 here:

IBM 1401 System Summary, Sept 1964. [http://bitsavers.trailing- edge.com/pdf/ibm/1401/A24-1401-1_1...](http://bitsavers.trailing- edge.com/pdf/ibm/1401/A24-1401-1_1401_System_Summary_Sep64.pdf)

</comment></comment><comment><USER13> Love it. Sadly scratch-building from styrene is an art that's losing ground to 3D printing. Here's a guy who scratch-builds toy trucks [https://www.wittenburg.co.uk/Rc/FordF5Coe.html](https://www.wittenburg.co.uk/Rc/FordF5Coe.html)

</comment><comment><USER14> Here is an example of a plastic miniature Vax 11/780 with emulator [https://vxcompany.com/2016/02/13/a-working- vax-11780-revisit...](https://vxcompany.com/2016/02/13/a-working- vax-11780-revisited/)

</comment><comment><USER15> That typewriter/terminal thing: Wow!

</comment><comment><USER16> Beautifully done.

"50% of my time spent sanding"

I totally get that. Same with wood furniture and sculpture. Easily half the work.

And now that I think about it, also true with writing projects... back to the Q10.

</comment><comment><USER17> Just get it to run cobol and you're golden.

<comment><USER3> Here's a video of Fortran running on the IBM 1401 at the Computer History Museum: [https://www.youtube.com/watch?v=uFQ3sajIdaM](https://www.youtube.com/watch?v=uFQ3sajIdaM)

Because memory was so limited (8000 words), the Fortran compiler operates in 63 phases, where each phase consists of 150 to 300 instructions. In other words, the compiler's code was broken into chunks of 150-300 instructions, and that's all that could run in a phase.

I'll also mention that memory was 8000 words and not 8192 words, because the IBM 1401 used decimal arithmetic.

<comment><USER18> I thought it had 53 phases.

<comment><USER3> The paper lists all 63 phases: [http://ibm-1401.info/1401-IBM-Systems-Journal- FORTRAN.html](http://ibm-1401.info/1401-IBM-Systems-Journal-FORTRAN.html)

<comment><USER19> 30 years of programming and it never occurred to me that DIM derived from DIMENSION.

</comment></comment></comment></comment></comment><comment><USER20> (non-functional)

(hahah)

Beautiful, still, excellent craftsmanship

</comment><comment><USER21> Charming and aesthetically pleasing.

</comment><comment><USER22> Very nicely done. Takes me back...

</comment><comment><USER23> This is so amazing. Respect!</comment>


The fourth industrial revolution: a primer on Artificial Intelligence - <AUTHOR> https://medium.com/mmc-writes/the-fourth-industrial-revolution-a-primer-on-artificial-intelligence-ai-ff5e7fffcae1 <comment><USER2> Oof this article is atrocious, ill-informed hype. Most of it is so high-level that it's essentially a paraphrase of Wikipedia, with some ridiculously specific details like gradient boosting and sigmoid activation functions sprinkled in for extra confusion.

>The breakthrough in deep learning is to model the brain, not the world... Artificial, software-based calculators that approximate the function of neurons in a brain are connected together.

This comparison is criminally incorrect.

And don't even get me started on figures 2+3 - 2 adjacent figures, with different horizontal _and_ vertical scales, that use highly technical terms without introduction?? It's really hard to see how a lay-reader could get anything useful out of those plots.

Despite the author's promise to "get behind the headlines" and "cut through the hype", this is just a regurgitation of "intro to machine learning" cliches.

<comment><USER3> I have no expertise in this area, so I have no idea if you are right or wrong.

That said, I think you comment would be more useful to people like me if you said for several specific points what is the truth that the author got wrong, and also gave a link to an article for non-experts that gets things right.

</comment></comment><comment><USER4> Nothing new to discover here.

Bits of AI history and the current state. But no current or future applications of AI in industry.

The guy who discovers the first killer application in the space will be rich and famous. Until then, most efforts will go the way of scheduling theory.

Theoretical results are nice. But 90% of effort for building applications goes into domain and project specific details. So every new client project is starting nearly from scratch.

This is a consultant project-business. Not a startup product-with-market- fitness business.

<comment><USER5> Tech company stocks are going crazy. Nvidia more than doubled it stock in one year. I think it's still early but the premise holds true.

Once we thought human flight is impossible. Now we can fly 500+ people half way around the planet in a single aircraft because we discovered fundamentals of flight.

We're discovering some fundamentals of the human brain. Atleast the audio and visual cortex. Being able to achieve human level imagenet recognition is an amazing milestone.

Go was thought to be a human only skill. A skill of reasoning and intuition that could never be achieved by computers. We did it.

Technology grows exponentially. With better sensors, labelled data and cheap faster computers we can achieve parity with some parts of the brain.

The big question is how can we use it to build a better world. Privacy, security, income disparity and joblessness are very sensitive subjects that need to be tackled in a way that benefits everyone.

</comment></comment><comment><USER6> HN should have a downvote button so that we can dispose of this kind of recycled, echo chamber content.

<comment><USER7> They do, it's called flagging.</comment></comment>


Edward Gibbon and the importance of great writing to great history - <AUTHOR> https://www.commentarymagazine.com/articles/best-scribblers/ <comment><USER2> Anybody here actually make it all the way through "Decline and Fall"? I've tried a couple of times but given up each time.

<comment><USER3> As a piece of writing it's excellent. Quoting it in the company of (most) contemporary historians is not going to end well, though.

<comment><USER4> Why?

<comment><USER5> Because contemporary historiography has moved on and refutes many of Gibbon's propositions. So _Decline and Fall_ is a good read, but also old enough to be a part of history itself.

<comment><USER5> Examples of contemporary Gibbon discussion:

[https://www.reddit.com/r/AskHistorians/comments/10xtf2/theor...](https://www.reddit.com/r/AskHistorians/comments/10xtf2/theory_thursdays_edward_gibbon_and_the_decline/)

<comment><USER4> That doesn't refute Gibbon's position. At best, it shows opinions to be divided.

</comment></comment></comment></comment></comment></comment><comment><USER6> > an odd mistake for a historian to make.

[final footnote, wrong temple]

Well, the text also swaps eastern for western when referring to an emperor ...

I don't think I ever read a text so ambiguous about its own declared thesis - the good writing bit - when it makes abundantly clear how much the writer's prejudices flawed the result.

</comment><comment><USER7> To quote (approximately) from Clive James (essay in _Cultural Amnesia_ ) on Gibbon's style "the Grand National, with fences 10 yards apart, each to be jumped forward and backward; and you have to carry your horse."

<comment><USER8> If one reads the U.S. Declaration of Independence, published in 1776 (the same year as Volume 1 of D&F), it's written in the same Latinate periodic style. That's just how they wrote in the 18th century. Dinging Gibbon for failing to stand outside his historical period is not really fair.

Or try the Federalist Papers, or anything written by the U.S. founding fathers. Same style. Even better, try Fielding's "Tom Jones." Prose as masterly as Gibbon's, but you'll laugh yourself silly at the ribald and bawdy humor, not equaled again until the 20th century. Gotta love the English Enlightenment.

</comment></comment><comment><USER9> > A married historian, productive in the way Gibbon was, is not so much a joke > but perhaps an impossibility. One can be the author of a vast historical > work of the kind of The History of the Decline and Fall of the Roman Empire, > which was 20 years in the composing, or be happily married, but one is > unlikely to bring off both.

Will Durant was both, in my estimation.

<comment><USER10> He wrote with his wife, winning a joint Pulitzer, [https://en.m.wikipedia.org/wiki/Will_Durant](https://en.m.wikipedia.org/wiki/Will_Durant)

<comment><USER11> You should include both of them:

[https://en.wikipedia.org/wiki/Ariel_Durant](https://en.wikipedia.org/wiki/Ariel_Durant)

And yet, this is the exception that probes the rule. The above quote has an element of humor in it, and it is basically saying "No modern marriage would allow this, as no modern spouse allow themselves to be ignored for so long." But Will and Ariel Durant did not have a modern marriage. Such a marriage is now illegal everywhere. Will Durant would now get 10 years in jail for announcing his feelings.

<comment><USER9> I'm sorry, I don't follow. What do you mean?

<comment><USER12> Presumably that Will met, and fell in love with, Ariel when he was 26 or thereabouts and she was a 15-year-old schoolgirl at the school where he taught. So saith Wikipedia, anyway.</comment></comment></comment></comment></comment>


I'm Too Old for This - <AUTHOR> http://www.nytimes.com/2015/08/09/fashion/im-too-old-for-this.html?_r=0 <comment><USER2> I generally try to abstain from criticizing articles too much, but this one bothers me a little bit — mainly because it is one among many of the numerous articles and blog posts popping up nowadays that advocate for the same general behavior: "focus on yourself".

I felt uncomfortable after I finished reading this and looked up some of the author's other work. See the reviews of her most recent book here:

[http://www.amazon.com/Slow-Love-Pajamas-Found-Happiness- eboo...](http://www.amazon.com/Slow-Love-Pajamas-Found-Happiness- ebook/product-reviews/B0052RGBW2)

In addition to having nominating her own work for national awards, there's an odd discrepancy between the generally positive distribution of ratings and the sheer number of upvotes on the _lowest rated_ reviews as sorted by "Most Helpful".

I feel that articles that encourage people to have higher self-esteem and more self-confidence are, generally speaking, a good thing; however, the problem starts occurring when the focus is _entirely_ on yourself. I feel like this theme of "be good to yourself; you deserve it", "sorry not sorry", and "you don't need anyone else to make you happy" falls only on the ears of those who are already far too absorbed in themselves.

It's peculiar because (at least in my experience), I've found that the people who actually _need_ to read articles like this are those who already give too much of themselves to other people, yet secretly wonder if they are too selfish. Whereas those who _are_ too selfish read these articles and think, "Hey that's me! I need to quit letting other people walk all over me. I need to care about myself more", when in reality they need to move in the other direction and care _less_ about themselves.

<comment><USER3> I didn't read it like this at all. I read it as: the older you get the more you realize that the things that were important to you when you were younger weren't that important after all.

The older I get, the more I realize how silly many things are. There are ideals I'd tell you I would die for at 20. At 35, I don't even remember what those ideals are.

It is so much easier to forgive and let things go later in life. That's my take on the article anyways.

<comment><USER4> "you realize that the things that were important to you when you were younger weren't that important after all."

On the other hand nothing wrong with having aspirations and if people didn't have aspirations many things in society would never be accomplished. Aspirations drive people.

I think there is a saying something like "the difference between men and boys is the size of their toys".

And in fact many of those "toys" don't matter once you get older simply because you are in a different place in life with different needs and outlook. Can't imprint that thought pattern when younger and quite frankly why would you? What fun would that be?

I remember when I was in my 20's I was able to afford a really nice car one that I had always wanted in my teens. About a week after getting the car I was very aware of the fact that I wasn't any happier than I had been prior to getting the car (and actually thought I would be) and maybe even a little less so (anticipation effect if you want to call it that). I was still glad that I got the car though and have always had nice cars since and never regretted it. But part of my motivation has changed. Back then it was to get a girl by having a nice car and to impress people (used to be like that, the "get a girl" part many older folks will tell you). Now I like it just because its a nice thing to have. And in some cases having nice things helps with business as well in the bricks and mortar world at least.. I can tie a few deals to the fact that I drove a nice car. Plus getting random comments from strangers does provide a boost.

As you get old you do become more mellow because you can be more mellow. Because in many cases you have either "arrived" or your needs have changed. The kids college is already taken care of and all of that, have a vacation place, nice house and so on.

But don't think for a second that it would be possible to "not care" "now" if the effort hadn't been put in earlier to insure at least some financial security. And I am not talking about living richly either. But having enough that you don't have to be concerned with money is a nice thing don't let anyone tell you differently.

<comment><USER5> "the _only_ difference between men and boys is the size/price of their toys" \-- ie men don't grow up.

Edit: I guess that should be _boys_ don't grow up.

</comment></comment></comment></comment><comment><USER6> I'm 60. Of course it'd be great to have my 21-year-old body and brain back (assuming I could keep all my experiences and learnings). And I'd love to be around to see what life will be like 50-80 years in the future, which I know is unlikely to happen.

Otherwise, though, I wouldn't trade. I'm fortunate to be very healthy, and life is better now than it's ever been. (I know, not everyone can say that --- as I say, I've been fortunate.)

<comment><USER7> I'd like my body and brain from around 28 back. In my particular case at 21, I don't think they hadn't quite finished growing up yet.

</comment></comment><comment><USER8> A lot of the advice in this article comes down to having perspective. E.g. I don't think the author misjudged her looks when she was younger--she just realized now that she's older it never mattered as much as she thought.

Getting married and having a kid was liberating for me in that regard. My desire to impress people who didn't matter or come across as cool and not derpy went almost to nil.

</comment><comment><USER9> I've heard a similar idea expressed using more colorful language:

"Often you hear people say they have a 'bucket list'. Well I also have a 'fuck it' list. The older I get, the longer it grows."

<comment><USER10> I think that's likely a 'healthier' approach - i.e. to be at ease with where you are in life an not feel like there's a set of things you need to do to make life worthwhile. There's a similarity there with the Buddhist approach to desire or 'thirst' for experiences - i.e. to some extent they can't satiated because satiating one gives rise to another, that seems to be how the human brain is wired. It's the same with wealth, i.e. no matter how much people have they generally want more.

</comment></comment><comment><USER11> > Only when you hit 60 can you begin to say, with great aplomb: "I'm too old > for this."

Hmmm... for me, that'll be in just under a month, then ;-)

<comment> why-el Happy 60th birthday then. :)

</comment></comment><comment><USER12> Insightful article. I'm only halfway to 60, so I still do a lot of the worrying and mistakes the author mentioned, but even looking back on my 20's there's some situations where I now think "I'm too old for this." Avoiding some of the storms definitely feels nice.

</comment><comment><USER13> Yup. Ruminating is probably the fastest way to arrive at depression. Make a concerted analysis, fine, but then move on.

</comment><comment><USER14> I've come to my own realisation: if I never read the NYTs again, I'll be net better off.

</comment><comment><USER15> A secret of happiness : you don't have to wait until you're 60

<comment><USER16> I agree! As I read this I kept thinking--she was saying exactly how I feel. I'm too old to:

       * follow the latest fashion fads
       * deal with BS in relationships
       * not pursue what I find interesting, instead of what others find interesting
       * etc.

It doesn't matter what age you are, having the attitude that you are "too old" to put up with "it" will make your life better.

</comment></comment><comment><USER17> Love this.

> Only when you hit 60 can you begin to say, with great aplomb: "I'm too old > for this."

But you definitely don't need to wait until sixty. :)

<comment><USER18> I'm already saying that, and I'm not even 40 yet.

<comment><USER19> I am not even 25 and joined the club already. People tend to forget the concept of circulation.

<comment><USER20> I'm 35 and have an established reputation as a curmudgeon. When people my age were first getting cell phones, I kept a landline. I eventually came around -- now I have a flip phone ;)

It might help that I'm from a religious tradition closely affiliated with the Amish (Mennonite), and have developed a mentality of being intentional about both adopting new technology and how I use it once I have it. Likewise with social trends -- there are certain sports I enjoy and therefore watch quite a bit, but I have no idea what clothing or TV shows are "hot" this year.

</comment></comment></comment></comment><comment><USER21> This made me smile and laugh. And I have to agree, it's amazing what a little bit of resilience and the ability to see the "same old crap" coming can do for you.

</comment><comment><USER22> No, old grumpy woman, you should care how you look. And fat body is a problem too, not only in terms of "look", but in terms of health. Athletic body is the aim - not fat and not anorexic. And "just be yourself" it's not an excuse, it's just laziness. You just too lazy for this.

I know you will downvote it and I don't care :) I more care about young people who allow themselves to be fat or ugly because of "be yourself" mantra. You will NEVER return these golden years, don't miss it - make your body beautiful (athletic) and enjoy it.

<comment><USER23> Hm, she doesn't seem grumpy but you sure do.

</comment></comment><comment><USER24> > Take a pass on bad manners, on thoughtlessness, on unreliability, on > carelessness and on all the other ways people distinguish themselves as > unappealing specimens.

I've also moved in that direction as I've got older, but I think it's because I've also got wealthier and gained more options. If I still had to choose between sharing my kitchen with thoughtless people and living in a ditch, I would still choose the former.

</comment><comment><USER25> I'm not over 60 but I'm too old for Scrum. Can anyone over 30 take that Scrum kindergarten serious?

<comment><USER10> I don't think it's for the type of person that reads HN. I recently asked what a spike was and what the word relates to. I didn't get a clear answer i.e. I don't think anyone properly understood what it meant. I later did some digging - it's basically research. Quite why we have to invent a new word when there's a perfectly good one already I don't know.

<comment><USER26> I suspect too many people would interpret "research" as (their view of) academic research: no definite goal, no time limit, no constraints. A spike is supposed to be a time-limited investigation of something specific. After that time, either you learned enough to go ahead with implementation, or you didn't, and you have to decide what to do instead.

FWIW, I've worked at a few places that used Scrum (my current employer uses less formal processes), and I and some of my co-workers also read HN. I guess I don't know if we're "the type of person that reads HN", though, whatever that is.

</comment></comment></comment><comment><USER10> "By now I've learned, the very hard way, that what you see in someone at the beginning is what you get forevermore."

I've heard this a few times over the years. Slowly I'm beginning to learn this first hand, from observing others but also myself.

</comment><comment><USER27> Profound.

But not in the way the author intends.</comment>


Bitcoin's Technical Flaw - <AUTHOR> https://medium.com/@nanzhong1/bitcoins-technical-flaw-3569fc0f7c2d <comment><USER2> This reads like an ad for a closed source messenger only available in a few countries. Have no idea how its related to bitcoin. Clicks perhaps?

I have plenty of criticisms for bitcoin and cryptocurrencies in general but some of the claims here are amazingly absurd.

Note to author: I have used a bitcoin wallet with no troubles in China, it has better uptime in the last decade than Amazon where you worked with "distributed computing systems", can your messenger app do the same?

> just imagine that the Great Firewall blocks Bitcoin packets for a week, > creating a Chinese fork and non-Chinese fork. Then it unblocks. All of a > sudden, the non-Chinese fork would disappear. The Bitcoins that went into > your wallet six days ago would vanish

The fact that the author doesn't understand how wrong this is despite apparently studying Bitcoin as an AWS employee back in 2010 is scary.

<comment><AUTHOR> I am the author. I'd love to understand your point. Can you give specifics? Thanks.

<comment><USER2> You essentially point to a very large reorganisation and say all the tx's on the global chain will disappear once the GFW opens up again. All orphaned transactions go back in the mempool as unconfirmed and will be processed later.

Simply blocking all global traffic already creates a huge monetary incentive for miners to sidestep the rules and it's easily achieved with obfuscated transports.

Such an action would be noticeable and considered hostile. Were they causing network disruption you'd likely see a hardfork to memory hard algorithms or clients blocking Chinese IP ranges.

There's certainly attacks they could try but I'm not convinced of the effectiveness. Miners need the outside world to pay their bills as exchange for RMB is impossible.

<comment><AUTHOR> Yes, you can put the orphaned transactions back in the mempool to be processed again. But what if the Bitcoins in those transactions are already spent on the "winning" fork? Does it now mean that the wait for a transaction to be considered "confirmed" needs to be longer the conventional six blocks and potentially arbitrarily long?

China already banned non-state sanctioned VPNs in 2018. Anyone circumventing the Great Firewall via "obfuscated transports" could get into legal trouble by the Chinese authority. The Chinese government successfully suppressed all dissidents and millions of protesters in 1989. Underestimate its force at your own peril.

The whole point of the article is that a centralized entity (the Chinese government) may be able to attack Bitcoin without controlling any mining power. A hard fork in response to actions of a centralized entity could shatter people's confidence in Bitcoin's promise of being decentralized. Blocking Chinese IP ranges in a 100% reliable way is going to very difficult. This defense is also rendered useless if someone does use a VPN to propagate the Chinese fork (perhaps intentionally by a centralized entity).

</comment></comment></comment></comment><comment><USER3> _> If the Great Firewall blocks Bitcoin packets, the Bitcoin network would be partitioned and thus fork. Upon unblocking, the shorter Bitcoin chain would be wiped out. Ignoring complicated attacks, just imagine that the Great Firewall blocks Bitcoin packets for a week, creating a Chinese fork and non-Chinese fork. Then it unblocks. All of a sudden, the non-Chinese fork would disappear._

Is that true? Is it only based on how long the fork's chain are?

<comment><AUTHOR> The Bitcoin protocol resolves conflicting forks by choosing the longer one while dropping the shorter one.</comment></comment>


Mind your Logs: How a build log from a Jenkins leaked everything - <AUTHOR> https://firstname.lastname@example.com/mind-your-logs-how-a-build-log-from-a-jenkins-leaked-everything-603cf07fa85 <comment><USER2> > _As I was reading the article, I found the author mentioned some of the > dorks for Jenkins and Sonarqube._

I wonder if anyone could explain what "dork" means in this context? My searches are only finding the common derogatory meaning, e.g. "a socially inept person."

<comment><USER3> Did some Googling myself and found some related links:

[https://www.wsj.com/articles/a-hacker-and-the-perils-of- dork...](https://www.wsj.com/articles/a-hacker-and-the-perils-of- dorking-1459536135)

[https://pentestmag.com/zeus-scanner-advanced-dork- searching/](https://pentestmag.com/zeus-scanner-advanced-dork-searching/)

[https://github.com/E4rr0r4/XGDork](https://github.com/E4rr0r4/XGDork)

[https://github.com/GuestGuri/dork-scanner](https://github.com/GuestGuri/dork- scanner)

[https://www.darknet.org.uk/2017/10/sqliv-sql-injection- dork-...](https://www.darknet.org.uk/2017/10/sqliv-sql-injection-dork- scanning-tool/)

<comment><USER4> Also [https://www.exploit-db.com/google-hacking-database](https://www.exploit- db.com/google-hacking-database)

</comment></comment></comment><comment><USER5> Why are these Jenkins servers exposed to the public internet?

Serves them right for such sloppy ops

<comment><USER6> Are there any good guides for setting up private networks? Google results are overwhelmed by setting up VPNs for private browsing.

<comment><USER7> Set up a network, don't make it public. Block everything incoming except your VPN tunnel should you need remote access. That's how a private network works.

<comment><USER8> > Block everything incoming except your VPN tunnel should you need remote > access

With the slight caveat that you should have at least a second out-of-band access method for when you bork your VPN config :)

<comment><USER7> True, but you know you have done your private network correctly if borking your VPN config means no access.

</comment></comment></comment></comment></comment><comment><USER9> I feel like the poking around on Slack crossed the line a bit. Should've gone to be disclosed responsibly before it go to that point.

<comment><USER10> +1, significantly over the line IMO. Seems (maybe?) OK to check token permissions if only to avoid the hassle of reporting a dead token.

</comment></comment><comment> o-__-o The only thing that keeps popping into my mind as I read this: is it illegal to hack foreign computer systems?

What are the varying levels of legality? (e.g. hacking a French company would see you extradited, hacking Iran/North Korea could bring Federal charges, but Russia.. China..?)

<comment> kube-system There are enough laws in most places thoroughly covering these kinds of activities that you can safely assume it's breaking at least some law in some jurisdiction.

And even if you wouldn't be in the jurisdiction that prohibits it and/or wouldn't be extradited for it, that doesn't technically make it legal.</comment></comment>


Ask HN: How can I this (Drupal code audit and project planning)? - <AUTHOR>

http://drupalcheck.com<p>I feel that there is a market for this, based on my years of experience with for-client Drupal development, but I'm not sure the best way to market it. Is adwords my best option here, or is there another way? <comment><AUTHOR> Clickable <http://drupalcheck.com></comment>


Scalar typing in the PHP world - <AUTHOR> http://lwn.net/SubscriberLink/633203/40c7d412a07bc317/

<comment><USER2> I love weak type PHP, please leave PHP as it is in terms on strong/weak types...

We dont need the language to be changed. You can simply use ===</comment>


Why a Brit chose to start a business in Berlin - <AUTHOR> https://medium.com/@alicelthwaite/why-a-brit-chose-to-start-a-business-in-berlin-b1d395854dee#.68b5prop2 <comment><USER5> Welcome to Berlin. :)

I came to Berlin roughly 5 years ago before the investment started pouring in and most startups were existenz grundungs, this is when you get 50k from the government and you underpay some interns to build your MVP. It was pretty shabby back then, and things have changed dramatically in the intervening years, but most people came for this vague idea of living cheaply and doing what they want - you could say they washed up here as tourists and stayed. Not that there's anything wrong with that, but these people are being replaced with people coming here for startup jobs that pay real salaries. It used to be that ~500 euros a month was a good startup job, now it's more like 4-5k.

All of this change is happening while Berlins administration is still the bureaucratic and slow machine that it always has been, they haven't built affordable housing in 25 years, there's no plan on how to reduce congestion or prevent gentrification from wiping out existing communities. Registration takes ~3-5 months to get an appointment, god forbid you're a foreigner and have to also register at the ausländerbehörde and wait from 3am for the 1 of 50 tickets available that day.

It's nice that people still see a future here, but i take an issue with such a rosy picture of what it's like to live here, because it really isn't the case.

<comment><USER6> >Registration takes ~3-5 months to get an appointment, god forbid you're a foreigner and have to also register at the ausländerbehörde and wait from 3am for the 1 of 50 tickets available that day.

Your bureaucracy makes American bureaucracy seem amazingly efficient in comparison. I did not know such a thing was possible outside defunct communist states.

<comment><USER7> > Your bureaucracy makes American bureaucracy seem amazingly efficient in > comparison.

Yeah, and I thought waiting at the DMV in the USA was a bit of a pain as a foreigner. :)

"Wait from 3am for the 1 of 50 tickets available that day" makes Berlin sound worse than even the third world country I come from.

<comment><USER8> Check out the driving license process in Germany.

<comment><USER7> Yes, but I was under the impression that getting a driver's license was kind of optional in Germany, with good public transport. Being a foreigner is not :)

<comment><USER9> Yeah, the DMV is probably the most difficult and time consuming part about getting a license in this US.

</comment></comment></comment></comment></comment></comment><comment><USER10> The benefits she mentions are legitimate, even though two of them have nothing to do with Berlin and could be obtained by moving to any new city. (no distractions, and changing environment equals greater creativity)

So it really boils down to this for her: Berlin is affordable and it has a good meetup scene. Affordable is relative, salaries are lower in Berlin than in many other cities and the cost of living has been on a rise as more people move in, but at the moment she is absolutely right about this much: cost of living is still significantly lower in Berlin than in London ([https://www.numbeo.com/cost-of- living/compare_cities.jsp?cou...](https://www.numbeo.com/cost-of- living/compare_cities.jsp?country1=United+Kingdom&city1=London&country2=Germany&city2=Berlin&displayCurrency=EUR)) [1]

Depending on your product Berlin can be good or bad. I think its almost always a great fit if your product targets the German market initially and you want to eventually expand out from there. The other way around will be much more difficult, mainly because you're sitting in Germany and you're whole business side of operations must be run in German, under German law, rules, and regulations.

Having said this, as far as her specific product idea goes, I could see Berlin being a good fit for her. The super young hipster culture is pervasive throughout Berlin, and it seems like an idea that would work well in that market.

1\. I worked on a German startup for 3 years in Berlin

<comment><USER11> Thanks - I agree with everything you've just said. The thing I didn't mention is that I love the Berlin culture. I knew I'd feel at home here. So there's a subjective reason too.

</comment></comment><comment><USER12> "My business is called The Echo Chamber Club — we curate articles that counter a traditional metropolitan viewpoint and send them to our hundreds of subscribers. It makes sense that I remove myself from London to understand new points of view and communicate them with my subscribers."

With regards to "liberal metropolitan" viewpoints, Berlin won't challenge you anymore than London did. It's just another global city where inside your group of people you are likely to meet (given what you work in) they will more than likely be liberal and metroplitan.

<comment><USER11> Hmmm I kind of disagree there. I'm having to make new friends and get out of my comfort zone. In time I'm going to start exploring other areas. I'm really keen to get collaborators on board for instance.

Nothing is perfect - this was just the best move for me at the time :)

<comment><USER13> As someone who is looking to make moves soon (possibly international), I quite enjoyed your post.

RIP Fabric...you'll be sorely missed. Now you'll have to wait in line for Berghain. Best of luck on the new business!

<comment><USER11> Haha Berghain is yet to let me in. I wonder what the record is for consecutive refusals? I'll try and beat it... :)

</comment></comment></comment></comment><comment><USER14> I'm planning on moving from London to Berlin within 6 months (I'm British), and mostly for the same reasons (RIP fabric). I have a couple of German citizens as friends who are also seriously considering doing the same. My main concern is how to avoid joining the English-speaking bubble. Although nothing has charged my motivation for learning German more than the recent government responses to Brexit. It does feel a bit ironic that I'm fleeing to Germany from a fascist government.

<comment><USER15> Respecting a democratic vote is fascist?

<comment><USER14> Not exactly. But there are definitely overtones of nationalism and anti- liberalism in what ministers were saying at the Conservative party conference and in recent anti-immigration proposals. They're also insisting on denying MPs and the public a vote on the exact terms of our withdrawal when many people are calling the referendum irresponsible and the result a flippant protest. So currently "respecting" this vote is not exactly the height of liberal democracy either.

</comment></comment></comment><comment><USER16> Why Western Europe if you want to get cost of living down and move somewhere ? Eastern Europe is 1/3 cost of living, usually has very good tax rates (Bulgaria has 10% flat tax on income + local tax for example, Hungary is close AFAIK) and there are startup accelerators trying to take advantage of that.

If you're using your own money to fund it and have customers who don't care about your location you'll have much easier time finding employees, especially non-technical staff like art/marketing/sales/customer support.

<comment><USER17> How do you define "very good tax rates" though? Is it the same thing as "low taxes"? Are high taxes in Northern Europe "bad taxes"?

Taxes are not theft you know, they're supposed to buy you and your fellow citizens things (health care, infrastructure, cheap education, services, etc), some of them highly beneficial to a startup.

<comment><USER16> Depends on what you need, but from a startup perspective they are stiffing and offer very little in return, if you're not dependent on the local market you're just increasing costs.

<comment><USER18> Proper health care, good infrastructure, all those sorts of thing can make a difference if the startup wants to have local employees - or even if the founder wants to benefit from them.

<comment><USER16> If we're talking about supporting a family then having subsidized nurseries, good pediatric care, schools, social support structures etc. are definitely worth it.

If we're talking about single healthy people working for equity trying to cut cost of living in hope of big payout down the road then the difference between 40% and 10% income tax is huge and you're not really getting much out of your taxes.

</comment></comment></comment></comment></comment><comment><USER19> While the author makes good points about the relative affordability of Berlin, one does have to wonder what the general plan for newsletter profitability is.

<comment><USER11> Hey! I'm the author! This is pretty cool to be number one on Hacker News. The idea behind the newsletter is to build a brand which makes liberal metropolitans comfortable with hearing viewpoints outside their own. Then I can monetise it! :)

<comment><USER20> No offence intended as I enjoyed reading your article and it wasn't really about your business, but if a liberal metropolitan wanted to experience viewpoints outside their own, couldn't they just browse to dailymail.co.uk? It's free and monetised already.

If the idea is something more highbrow, again, surely they could just subscribe to the Telegraph? Or watch Fox News?

Or heck, just use reddit? Lots of different viewpoints there.

Providing people with news that violates their own political biases and then getting them to pay for it seems very difficult. The more open minded ones who are willing to pay for views different to their own have lots of places they can seek out such views already.

<comment><USER11> I would say that my target market aren't really familiar with twitter - <USER2> alone Reddit. Also it's just a time thing - I spend about 15 - 20 hours researching each newsletter.

</comment></comment></comment></comment><comment><USER21> Wow, 20 square meters for €480? That doesn't register as affordable on my books (even with utilities included).

<comment><USER22> Yeah. If you're shooting for affordability, Athens is a much better bet. 20sqm studios below €100/month in the heart of the capital.

(Good luck getting decent internet, though.)

<comment><USER23> There's Lisbon, as a middle point. 300-400€/m for a 60m² and you can get a 1Gbps/100mbps connection to your home.

<comment><USER24> From what I've heard Lisbon is about the same cost as Berlin. But the economy is worse, the tax system seems more complex and it's less accessible to foreigners. I guess the weather is nicer, but the location is worse. To legitimately compete with Berlin I think one really has to offer something special, otherwise Berlin wins by default in the low-medium cost category. Lisbon would still be on my shortlist for European bootstrap cities, but there are also at least half a dozen other cities that could be equivalent.

<comment><USER25> Why do you say it's less accessible to foreigners?

<comment><USER24> For people to choose something it first have to be a realistic option. Berlin is much more established as an international and "tech" city. You hear about people moving there all the time. For whatever problem you'll face there's bound to be someone else who has done it. When it comes to moving you don't want to be a pioneer and spend thousands of euros finding out if it's doable and ending up not liking it. Being in the same boat as other people helps with that uncertainty.

</comment></comment></comment></comment></comment></comment><comment><USER26> Dresden is even better. I moved from Houston, TX to Dresden and I'm very happy with my choice. Technically it's more interesting, as the University and high tech companies here are much more advanced (i.e the l4 microkernel is from here), prices are the same, and Dresden is a much more beautiful town than ugly Berlin. Lots of English speaking foreigners, and people are more friendly. For startup's there's only one or two meetup points and helpers/investors but still better than Houston or Austin.

If going for cheap, Wroclaw or Prague would be better.

<comment><USER21> > Dresden is a much more beautiful town than ugly Berlin.

That is certainly subjective (and offensive). I have not been to Dresden but I found Berlin to be quite an interesting aesthetic environment and hardly sore on the eyes. It has huge, lovely green parks and I find the wide open spaces throughout the town rather refreshing.

<comment><USER27> It's a big city, there are ugly parts, and there are pretty parts. Same for Dresden, it has some really lovely buildings, but anything that was built after the 50s is ugly as sin.

<comment><USER28> How much of Dresden was rebuilt 45-60 and how much was rebuilt later? I presume most land was made usable pretty quickly however I can't imagine they were high quality long term buildings.

I need to go to Dresden.

</comment></comment></comment></comment><comment><USER29> The conversation focuses on price, but the other points are key.

1\. There's a huge tech scene in Berlin and it's easy to meet bright people.

2\. People want to live in Berlin. The art and music scene attract people.

Affordable alone can be found in many places. Combined with 1 and 2 is a pretty unique proposition.

<comment><USER11> Hey Cheriot! I totally agree!

</comment></comment><comment><USER30> Genuine question, Whats the business model for The Echo Chamber Club? I've always seen newsletters as a marketing tool for a business, rather than a business itself. Very interested to how you'd make money with it as a standalone business.

<comment><USER11> Hey Tam - thanks for your question. So my target market don't generally want to hear the topics I'm posting. They have to trust that I'm as liberal as they are before they start taking me seriously.

So it became clear that the most important part of the ECC was to create a trusted brand.

Otherwise, I spent about a year trying to figure out a solution to the filter bubble. I was looking at RSS feeds, new types of algorithms, and it was all very complicated. The idea of a newsletter MVP made sense.

After I get to about 5k subscribers I'll be putting on events - with the aim of creating a B2B qualitative research firm. But that's a long way off - <USER3> knows where the journey will take me.

Feel free to add me on twitter so we can discuss more - would love your thoughts! @alicelthwaite

<comment><USER31> Just to check, you've seen this?

[https://news.ycombinator.com/item?id=12557500](https://news.ycombinator.com/item?id=12557500)

<comment><USER11> Oh dear - I've since moved hosting providers. Are you having issues now?

<comment><USER31> Wasn't me. Just pointing it out in case you wanted to follow up. ;)

</comment></comment></comment></comment></comment><comment><USER32> She must also speak German right?

<comment><USER33> She must learn German. The thing with Berlin is that there are a lot of startups with foreign people, and a lot of Germans speak English. But when you want to do normal day things as going to the market you need German to understand what are you buying and to talk with the people. It is not like other countries where you cannot get a job or life if you don't speak the language. You can get a job in Berlin as a English speaker but you must learn the local language for the day to day things.

<comment><USER21> I agree, my experience after a week of work in Berlin was that a lot of the restaurants I visited, the waitress couldn't speak English at all. Or taking a cab was sometimes quite an effort to communicate as well.

Even more strange, Berlin (and perhaps much of Germany, I don't know), places much greater emphasis on cash than on electronic payments like credit cards. I gave a credit card to a vendor once and they looked like they couldn't figure out what it was. In fact, as they were trying to understand it, I motioned that they were in fact studying it upside down! Other restaurants would tell me it was the first credit card they had seen in weeks, and the owner simply hadn't bothered to bring the credit card machine in from his house in a long time. Not a problem, just a bit strange to me.

Berlin is a neat place, though, and I love German food (and beer) a lot, but it cannot be overstated how you quickly come to realize that you currently take for granted speaking the same language as everyone around you, and unless you know German already, that convenience will evaporate immediately upon moving there. Even all the Holywood movies and U.S. TV shows are dubbed into German -- it is the largest overdub market in the entertainment industry, because Germans generally place low emphasis on learning other languages (just like Americans do).

<comment><USER34> Cash is much more popular however another big factor is that credit cards aren't really a thing. Instead Germany has its own system of EC cards which are directly tied to your bank account (which most people get as a child here) and work more like debit cards.

The only reason to have a credit card as a German is for buying this outside of Germany.

<comment><USER35> I live in Germany, and I always wondered: how Germans buy online and/or book hotels/tickets online, if most of them don't have credit cards and only have this EC-Karte?

<comment><USER36> This differs quite a big on the size of the respective business (of sales).

Amazon.de e.g. offers the choice of * credit card (as internationally) * direct withdrawal (meaning you give them your bank account details and they withdraw the amount directly - sort of sketchy from the customer's point of view, but no different from credit cards - if anything goes awry, you just challenge the charge directly with the bank instead of the card issuer) * bill-based (generally only for small amounts or trusted customers - <USER4> involve a "credit score" check from Schufa ([https://en.wikipedia.org/wiki/Schufa](https://en.wikipedia.org/wiki/Schufa)) to deter fraud)

</comment></comment></comment></comment></comment></comment><comment><USER37> Why didn't you move to Birmingham?

</comment><comment><USER38> "Business": Weekly Newsletter. BS Medium strikes again.

</comment><comment><USER39> Let me guess: because the UK is a rentier hell hole?

</comment><comment><USER40> Before I click the link: Berlin is cheaper than London.

Edit: And I was right, haha.

While London is one of the most expensive cities in the world, Berlin is cheap for German conditions. At least the parts that haven't been gentrified yet ;)

Berlin is really cool and has lots of alternative people and seems to be the only german city with a bigger start-up scene, but it's poor AF. I'm living in Stuttgart and while I prefer to hang in Berlin, the money is in the south.

<comment><USER41> Yup. Although I would note that there are also cheaper UK cities! Consider Liverpool or Bristol, for example.

<comment><USER42> The peculiarity of Berlin is that it has lower cost than many other German cities.

This is unusual, because typically you pay a premium for working in the capital of the nation. In Berlin, that is explained by the history (West Berlin was an enclave within DDR and the capital of BRD was in Bonn; Berlin was subsidized and had lots of relatively cheap housing which is not yet fully priced up 25 years after German unification).

<comment><USER43> If your customer is a German business, and you would like to visit them, it's very likely their headquarters are in West Germany, which is far away. So you don't have much country offices of multinational companies in Berlin. It's very different from other countries' biggest cities.

I guess it works better for pure internet companies that sell directly to consumers.

<comment><USER42> This is true, but I expect the situation will slowly change, and more business will concentrate in Berlin, because the federal administration is a big customer now that more of it is relocating in Berlin.

</comment></comment></comment></comment></comment><comment><AUTHOR> For clarity: This is not my work. The author is my most excellent friend alicelthwaite ([http://echochamber.club/](http://echochamber.club/))

</comment><comment><USER44> Does this have anything to do with BREXIT?

<comment><USER11> Ha - I'm the author - I would say that Brexit is a minor factor for leaving. The main one is affordability. Also Berlin is more fun...

<comment><USER45> So Brexit does impact your decision? I'm interested to know why, and how, it impacts you.

<comment><USER11> Hello Simon! I'd say no not really - I did think that I may only have 2 years to travel around Europe. But it was a minor reason.

</comment></comment></comment></comment><comment><USER46> I wish I had a startup and I could just throw a dart at a map and go live and work there.

<comment><USER40> Well, someone who could live and start a business in London probably has much money to start with.</comment></comment>


Browser Javascript performance vs. adoption - <AUTHOR> http://awesomegeekblog.blogspot.com/2009/05/browser-javascript-performance-vs.html

<comment><USER2> When I viewed the examples at <http://raphaeljs.com/> I noticed that Opera has the smoothest graphics rendering, followed by IE, then Firefox. Didn't test safari or chrome.

It's especially noticable on this one: <http://raphaeljs.com/chart.html></comment>


Tracking weight and what you eat with Twitter - <AUTHOR> http://flowingdata.com/2008/10/30/tracking-weight-and-what-i-eat-with-twitter-self-surveillance-made-easy/

<comment><AUTHOR> _"... Now for lesson 2: make data collection and analysis easy. I chose Twitter as my data entry point. I use Twitter already (especially with my new phone with the QWERTY keyboard), so it wasn't a huge burden to start tweeting what I eat. I created my own Twitter bot and created my own basic language. ..."_

An interesting article not so much because of it's application but method. This is pretty much what Stikkit (Rael Dornfest ~ <http://www.raelity.org/blog/> ), now working for Twiiter was doing - <USER2> data, parsing it and trying to make some sense of it. The key bit here is how. If you try using regex, NLP or some other novel technique that relies on understanding ... it will probably not work. Now if you have a big enough data set, machine learning techniques might be a better tack.</comment>


Ask HN: Chatbot startup in middle east is in need of investment - <AUTHOR> Hello, I am not sure if this is allowed here or not but we are really running out of cash, and we need an investment to survive!
we never received any kind of investment before! we have over 300 sellers signed up for our chatbot. our chatbot is an ecommerce chatbot for sellers on facebook, and we plan to expand to other social media.
our target market is latam and middle east and parts of Asia.
I am an Arabic speaker, and I am already in Egypt, so I can easily manage and access the market of middle east, where most of clients reside.
And it's clearly a B2B startup! <comment><USER3> Apart from all the features chatbots have, what we need is more feasibility and accessibility of paths. The idea of a CONVERSATIONAL MODELER is very relevant as one can edit from any part of the path without deleting nodes. It is empowering as it is two-dimensional. It is much more fun than traditional paths... more color, more ease, more sense. DON'T MISS OUT ON THIS - <USER2> today [http://s.engati.com/145](http://s.engati.com/145)</comment>


ContainerShip 1.3.0 released with native persistent data support - <AUTHOR> https://github.com/containership/containership/releases/tag/1.3.0 <comment><USER2> I've been tracking this through release candidates, and glad it has finally landed. Good work ContainerShip team!

<comment><AUTHOR> Thank you! We believe with native support for running persistent applications, ContainerShip leads the pack in simplicity for a full-featured containerized workload platform.</comment></comment>


Hacker Monthly's Startup Stories (free digital edition) - <AUTHOR> http://hackermonthly.com/startup-stories.html <comment><USER2> Would it be possible reading it without having to download it?

<comment><AUTHOR> Try this: [http://www.scribd.com/vacuum?url=http://hackermonthly.com/ha...](http://www.scribd.com/vacuum?url=http://hackermonthly.com/hackermonthly- startupstories.pdf)</comment></comment>


A Docker Container Pattern – Compose Configuration - <AUTHOR> http://blog.levvel.io/blog-post/a-docker-container-pattern-compose-configuration/ <comment><USER2> WARNING that compose file gives the container ALL, SYS_ADMIN and NET_ADMIN capabilities, effectively giving it root on your machine. Doing that for some random image seems like a very bad idea.

OP why are these needed? Can you remove them?

<comment><AUTHOR> I totally agree and this is not a great idea for new comers. I do find it easier to debug things with all the bells and whistles turned on, but yea the CAP adds are NOT production ready. I will remove them to prevent confusion for those looking to get started with docker.

</comment></comment><comment><USER3> Database choice: MySQL over Oracle or PostreSQL: suboptimal due to silent data corruption issues and lack of OS authentication mechanism in MySQL.

Database provisioning: why not implement a generic createdb(1M) program with required command line switches which OS packages delivering the required filesystem structures could call in their postinstall phase? I wrote such a program (for Oracle DB) in shell and AWK and it works great for all sorts of OS configuration packages which create all kinds of databases; it makes Docker completely unnecessary, not to mention superflouous;

Substrate choice: what techical advantages does Docker provide over imgadm(1M) and zones built into SmartOS ("people might be more familiar with Linux and Docker" is not a technical advantage)?

<comment><AUTHOR> These are great points, but with the post I wanted to share how I approach designing and building docker containers, because I hope it saves others time building them. When I started trying to deploy containers on production without Docker Compose it was painful. Now that I know what that time sink feels like, I try to focus on using configuration management during initialization inside the container instead of at the Dockerfile RUN directive (which requires a rebuild).

Back to your points, can I ask if you are interested in using this container approach to build a database container cluster in docker and then benchmark against a working imgadm(1M) + SmartOS environment? From the docker-side when I scale out a cluster of database runtime-only containers, I utilize the volume mounting attribute that is commented out in the repo's compose file ([https://github.com/jay-johnson/docker-schema-prototyping- wit...](https://github.com/jay-johnson/docker-schema-prototyping-with- mysql/blob/9ae4155632e4162efe6eaaad0ca0a400f9d1e180/docker- compose.yml#L24-L25)) and then host the database files outside of the containers in a persistent storage location that is mounted + available on the hosts where the docker containers are running. As for building the database container for this proposed solution I would still utilize this Docker Compose-centric approach in development and then in production because I can build the container one time and not deal with a rebuild which invalidates testing a container within my DevOps artifact pipeline.

Wrapping up, I live more on the application development side so I cannot speak specifically to SmartOS or imgadm(1M), but I know the docker documentation and community are pretty helpful for getting/finding technical solutions that helped me build + launch products (go team!). If you are interested we can discuss more details about how I would approach bench marking these two database environments. I am a big proponent of testing everything and I would enjoy discussing how to tackle a db perf/load/ha + test harness like my message simulator ([https://github.com/GetLevvel/message- simulator](https://github.com/GetLevvel/message-simulator)).

Feel free to connect with me on LinkedIn anytime: [https://www.linkedin.com/in/jay- johnson-27a68b8a](https://www.linkedin.com/in/jay-johnson-27a68b8a)

<comment><USER3> imgadm(1M) fetch time depends on the type and size of the image, as well as the speed of one's network connection. This is performed only once.

vmadm(1M) provisioning can take anywhere from 5 to 25 seconds.

Oracle DB provisioning with my program takes 45 minutes, as it performs a CREATE DATABASE and is constant irrespective of hardware.

</comment></comment></comment><comment><USER4> looks like you just reinvent wheel called kubernetes (secrets, mounted volumes). Also when following [http://12factor.net/](http://12factor.net/) there shouldn't be issues with production/testing

<comment><USER5> kubernetes seems like it could be overkill for many situations.

this seems like it has fewer moving parts.

<comment><USER6> Kubernetes solves some things that Compose fails on. It's not that Kubernetes is overkill, but that Compose is an inadequate solution.

<comment><AUTHOR> I am pretty new kubernetes. What are some of the gaps with docker compose vs kube's deployment orchestration? I am pretty happy with docker 1.10.3, but am always interested in hearing about something better/cleaner (I don't know what I don't know). I'm looking over your github for some samples at the moment.

<comment><AUTHOR> So if I take a sample out of your Matsuri repo, how does this get changed as an "Overridables": [https://github.com/shopappsio/matsuri/blob/f966480380b685d34...](https://github.com/shopappsio/matsuri/blob/f966480380b685d34e7c161fbb89ad55505cf571/lib/matsuri/kubernetes/service.rb#L6-L13)

<comment><USER6> let() is define a memoized method. When you inherit or include that module into a new class, you can redefine that same let() and the new class will use the redefined method instead of what is inherited. You can do that with any of the let() that gets defined. This lets you use as much or as little of the shared code that you want.

</comment></comment></comment></comment></comment></comment><comment><USER6> I wrote something like that for Kubernetes, called Matsuri: [https://github.com/shopappsio/matsuri](https://github.com/shopappsio/matsuri)

I had tried Compose in a previous incarnation of Matsuri, but Compose has flaws in it that Kubernetes solves.

<comment><USER7> Please add a description to your code. Yes, we can read the source, but at least a few sentences about what your work is about and what it will do will motivate many more people to take a closer look. Adding good docs values your own work!

<comment><USER6> You are right in that adding good doc adds value to my work. However, there are a lot of other things I need to do, and the value of those outweighs the value of documenting this code.

Besides, that code doesn't make sense without an example. The best example is locked behind proprietary code. Feel free to ping me if you want me to walk you through what it is about.

<comment><USER7> Ah, so you are that one guy on the internet that has so many other things to do, nice to meet you!

It is not about time. We have 24 hours every day, everyone has lots of things to do.

If I could read just one or two sentences describing what your code does, I had at least some basic information to consider if it is worth spending some time on this.

As there is nothing and you think it is a waste of time to document that code, why should I spend my time with some code that you think is a waste of time to document?

Anyway, have a nice day!

<comment><USER6> I never asked you to look at it. You choose to look at it or you don't. What social contract do you think I am violating here?

</comment></comment></comment></comment></comment><comment><USER8> Just be careful about where "docker-compose.yml" ends up...the examples have database credentials.

<comment><USER4> yeah, also, isn't composed file part of docker layer and thus can be traced back even if you change them?

<comment><USER2> No. A docker-compose.yml just provides runtime configuration.

In other words, a Dockerfile specifies what you want to build, and a compose file specifies how you will run it.</comment></comment></comment>


Two habits of budding entrepreneurs - <AUTHOR> http://www.nevertryneverfail.com/two-habits-of-budding-entrepreneurs/

<comment><USER2> Some insightful comments. I think another habit of successful entrepreneurs is knowing when to give up and when to power through.</comment>


XPS 13 2015 Developer Edition (with Ubuntu) is out in Europe - <AUTHOR> http://www.dell.com/ie/business/p/xps-13-linux/pd?refid=xps-13-linux&baynote_bnrank=0&baynote_irrank=1&~ck=dellSearch&isredir=true#overrides=

<comment><USER2> Is US coming?</comment>


Scam YouTube livestream pretending to be Linux Foundation - <AUTHOR> https://www.youtube.com/watch?v=B7dBowj9Hdc <comment><AUTHOR> This popped up on youtube today, it's a Livestream with 24k live viewers, claiming to be a Linux Foundation Livestream that gives free bitcoin to people who send them some first.

<comment><USER2> Thanks. I work with the LF and we'll try to get it taken down.</comment></comment>


Wanna know what product your competitor is working on? Try Slack - <AUTHOR> http://www.tanay.co.in/blog/wanna-know-what-product-your-competitor-working-try-slack.html <comment><USER2> While I'm unable to comment on the content of the article, I really have to applaud HostGator's error page marketing strategy here.

 _We 've met with a horrible fate_ (status code 500) _while generating what appears to be a static page. This site is hosted by HostGator! Get yours now!_

<comment><USER3> If they're generating 500 errors while serving up static sites, someone is doing something very wrong.

<comment><USER4> Is there a HTTP code for when you've taken the piss with your cheap as dirt shared web host?

<comment><USER5> 402 Payment Required? :P

</comment></comment></comment></comment><comment><USER6> My response to all the people who says it is nothing just the team names

Check this screenshot of google teams [http://m.imgur.com/a/eWLEf](http://m.imgur.com/a/eWLEf). There is a team name called viber and google doesn't own viber.

Check this news that came 2 days back:[http://www.jbgnews.com/2014/10/google- looking-to-rival-whats...](http://www.jbgnews.com/2014/10/google-looking-to- rival-whatsapp-viber-with-their-own-mobile-chat-software/222512.html)

Connect the dots. You can infer a lot. It is information disclosure at the finest.

Smart thing is to accept it is a problem and address it. Defending to say it is nothing doesn't make the problem go away. The fault is on both slack and the companies who are using it.

<comment><USER7> How is this the fault of companies using Slack? That's nothing more than victim-blaming.

<comment><USER8> Victim-blaming? This isn't an assault or a crime, it's a shortcoming of the service. It falls well under the umbrella of "caveat emptor".

<comment><USER9> Is caveat emptor something they sold the company when trying to land that enterprise contract? Or did they sell them security of their information?

</comment></comment></comment></comment><comment><USER10> This is something that could definitely have been reported to Slack before disclosing it publicly. Maybe he did that, but it's not mentioned in the blog post so I assume he didn't.

It's just a nice thing to do and they might reward you for it. You can still post it on your blog after they released a fix.

<comment><USER11> The way companies handle security disclosures lately (i.e. laughing it off, or paying $6 reward), it seems like shaming them would work much better. Plus, this is truly a beginner-level failure, the kind you'd get insulted for by Linus.

<comment><USER12> Completely untrue about the people at Slack. I disclosed a pretty trivial vulnerability to them and got a $100 reward.

How about next time you stop generalising?

<comment><USER13> Well considering other people posted a tweet about someone trying to report it as a vuln on August 13th and getting told it's a feature, I'd say he's not exactly generalizing in this specific instance.

</comment></comment></comment></comment><comment><AUTHOR> Sorry that the site was down for long. The site was on poorman's hosting (hostgator) that could not take HN traffic and bogged down.

Cloudflare, along with flatfile caching by Drupal's Boost module came to the rescue. Hope that stays alive for a while now.

Regarding not having disclosed this one discretely to Slack:

* I have considerable experience in a couple opensource projects including Drupal and have reported multiple vulnerabilities on various occasions for various modules discretely (though mostly of lesser significance and a very narrow/rare attack vector) to the right teams through various channels meant for this purpose. As such I am aware of the SOPs for the righteous to follow in case of discovering a vulnerability.

* I don't think this one is a security issue that would take a professional security expert to crack. Nor could this have been not noticed when Slack tested their product. This is an issue with 'common sense'. I am pretty sure that Slack designed it this way. It is just the customers that are surprised now. Not Slack.

Also, it looks like this was reported earlier to Slack by [https://twitter.com/rootlabs/status/499723782244675584](https://twitter.com/rootlabs/status/499723782244675584) a couple of months ago and it was rejected by Slack as "Not a bug". However I do acknowledge that I was not aware of this report when I first published the post and hence can not say that I disclosed it only after being rejected by Slack. I would say it was not a security vulnerability to report but just bad design that Slack had put in being totally aware of what it means.

<comment><USER14> I also want to add on that I do not view this as a security issue. There are a myriad of things that should be done:

1) Your company should not be using SaaS services for sensitive projects w/o codenames. (Codename FishSauce = Viber M&A) -- obviously just obscurity, but still solid opsec.

2) I'd love to see your write-up on HipChat uploading all files directly to an S3 bucket accessible to the world.

3) Every user w/ that companies domain sees this each time they sign-in.

4)I just think it's overhyped and not a big deal.

5) It only impacts companies who have multiple slack TEAMS (not the same thing as channels, no channel names are disclosed)

Also, this is a decision Slack admins make: [http://imgur.com/FCUE1mY](http://imgur.com/FCUE1mY)

<comment><USER15> > I also want to add on that I do not view this as a security issue

This is absolutely a security issue. What companies I do business with is protected under NDA.

</comment></comment></comment><comment><USER16> The site seems to be down at the moment.

Here is a cached version [1]

The gist of it: the slack mac client seems to ask you for your groups before properly authenticating you - hence if you put in the email address of a competitor (or famous person), you can see which groups they belong to, which might be valuable information.

(haven't tried it myself, just summarising the post)

[1] [http://cc.bingj.com/cache.aspx?q=http%3a%2f%2fwww.tanay.co.i...](http://cc.bingj.com/cache.aspx?q=http%3a%2f%2fwww.tanay.co.in%2fblog%2fwanna- know-what-product-your-competitor-working-try- slack.html&d=209021454366&mkt=fr-FR&setlang=en- US&w=jBvUCoMsbckf6gBacpPmVHzRptKPbtw4)

<comment><USER17> 1) The slack web sign up seems affected too

2) Any email address, valid or not with a valid domain name works

</comment></comment><comment><USER18> [http://webcache.googleusercontent.com/search?q=cache:7u-bEJP...](http://webcache.googleusercontent.com/search?q=cache:7u-bEJPVOAkJ:www.tanay.co.in/blog/wanna- know-what-product-your-competitor-working-try- slack.html+&cd=1&hl=en&ct=clnk&gl=uk)

cache version as link broken.

</comment><comment><USER19> I just realized that any facebook user can signup on [https://facebook.slack.com/](https://facebook.slack.com/) with his fb username.

<comment><USER20> And this is why you should silo customer domains from internal domains as github did (smartly)!

<comment><USER21> I am curious. Could you elaborate on this?

Edit: I wonder how Github distinguish their own "internal" email doing.

<comment><USER22> Well, this flaw is one example: Slack assumes that someone with an @facebook.com email address must be a Facebook employee. However, Facebook issues @facebook.com email addresses to regular users, too.

</comment></comment></comment></comment><comment><USER23> This is ugly, and probably much more of a disclosure than most of these companies were expecting.

That being said, everyone railing about "unreleased product names" seem to have forgotten this is exactly the purpose of code names: they're pretty much expected to be leaked at some point, but it's okay since the stakes are intentionally low. Use code names!

<comment><USER24> Except it will forever be called that. A quick example is where I work we have a 'new product x billing' system and it is still called the 'new' one five years later when it is also the only one.

There is some debate internally over whether 'new' refers to 'new as in old' or 'new' as in the opposite of 'renewal'. No one knows why it is called what it is called.

<comment><USER25> The solution is to use a name that will never get pass legal, like a trademark of another company.

That's what Sun did with Swing, which was originally called Kentucky Fried Chicken[0] internally.

[0] [https://blogs.oracle.com/thejavatutorials/entry/why_is_swing...](https://blogs.oracle.com/thejavatutorials/entry/why_is_swing_called_swing)

<comment><USER24> In this case, it is an internal project so it never would have touched legal.

</comment></comment></comment></comment><comment><USER26> Seriously, just the idea of keeping ALL your company internal conversations on a 3rd party server is quite crazy, but to get access without even hacking anything.. I wonder if situations like this will result in business customers more carefully evaluating SaaS solutions that deal with sensitive data, because "in-house" solutions may be old school, but at least a) no one will suddenly terminate the service and b) all data is kept locally.

<comment><USER6> It beats me to see so many Microsoft and google teams. Don't they have their own tools to do this securely.

Leaking of business conversations can have serious implications on many areas from financial to legal. If an employee leaves the company how that will be handled.

<comment><USER27> What conversations are being leaked? It's a list of team names.

<comment><USER28> By using slack or any other external chat system, you're leaking metadata and comms content.

<comment><USER27> Leaking to where? By using the internet you're leaking [meta]data. It's a question of degrees and trust.

<comment><USER29> They are leaking potentially confidential information to a third party company running the service, in this case Slack. For all you know they could be doing stock trades based on all the insider info they can glean from their chat traffic as their business model.

If the communication includes material insider information, like companies/products they are considering buying, and they are flinging it all over the internet so third parties can read and act on it the SEC can charge them.

If you use cloud services for company communication then you at least need to have provably secure encryption so only the people you want to see the conversation can.

Of course this criticism applies to all the suckers who use Google and Microsoft cloud services for their business.

<comment><USER30> >For all you know they could be doing stock trades based on all the insider info they can glean from their chat traffic as their business model.

From the Slack TOS:

>Your acceptance of this TOS gives us the permission to do so and grants us any such rights necessary to provide the service to you, only for the purpose of providing the service (and for no other purpose).

They _could_ be breaking the TOS (and thus the contract between you and the them), but I doubt it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> You don't have to use the mac client: [https://slack.com/signin](https://slack.com/signin) and firstname.lastname@example.com yields the same result.

</comment><comment><USER32> Here are the ones for:

\- amazon \- ebay \- facebook \- apple \- google

[http://imgur.com/a/eWLEf](http://imgur.com/a/eWLEf)

<comment><USER19> Bad thing is that every facebook user has email id `email@example.com`. So you can easily get into any team you want.

<comment><USER33> Facebook employees use @fb.com

</comment></comment></comment><comment><USER34> I haven't tried the hack, but it's something that had occurred to me for a while. We're using Slack internally and I've been wanting to get everyone in our larger organization to use it. Anyone with an email using our domain would be able to join. Which is ok with me. The only real flaw here is showing which groups are available (many of which can be client names or project names or product names that have yet to be launched). This is a serious lapse on their part

<comment><USER35> Private channels could help with this. I believe they aren't visible unless you're explicitly invited.

<comment><USER36> This doesn't list channels at all, private or public, it only lists teams.

</comment></comment></comment><comment><USER22> This issue actually seems to be even worse: You don't need a valid email alias to get a list of all teams. Just the domain name.

</comment><comment><USER37> This seems like one of those things that was intentionally a 'feature' and not an oversight. The oversight was probably not making it clear to users that the team names were effectively public.

I think the "this is why not startups|cloud" posts are a bit heavy handed given the actual details of what we're talking about here.

</comment><comment><USER38> Sometimes the site isn't available, so voila:

[http://webcache.googleusercontent.com/search?q=cache%3Awww.t...](http://webcache.googleusercontent.com/search?q=cache%3Awww.tanay.co.in%2Fblog%2Fwanna- know-what-product-your-competitor-working-try- slack.html&oq=cache%3Awww.tanay.co.in%2Fblog%2Fwanna-know-what-product-your- competitor-working-try- slack.html&aqs=chrome..69i57j69i58.1317j0j4&sourceid=chrome&es_sm=91&ie=UTF-8)

</comment><comment><USER39> Fun to scan down this list: [http://www.siliconvalley.com/SV150/ci_25548370/](http://www.siliconvalley.com/SV150/ci_25548370/) Naturally the biggest companies have the most teams.

<comment><USER40> I wrote a node script[1] you could use for this.

[1] [http://pastebin.com/raw.php?i=NgTeseN1](http://pastebin.com/raw.php?i=NgTeseN1)

<comment><USER41> Here's a streaming version that runs through the top 1m Alexa sites. It looks like it gets throttled after a while though, but you can fix it with some trial and error by dialing down the concurrency in concurrent-map-stream and by introducing pauses.

[https://gist.github.com/anonymous/4e34a10f1552dd8ede96](https://gist.github.com/anonymous/4e34a10f1552dd8ede96)

<comment><USER40> Cool idea to use the alexa top 1m.

Got this error though:

phantom stdout: TypeError: 'null' is not an object (evaluating 'element.value = text')

    	  phantomjs://webpage.evaluate():3
    	  phantomjs://webpage.evaluate():4
    	  phantomjs://webpage.evaluate():4
    	TypeError: 'null' is not an object (evaluating 'element.value = text')

</comment></comment></comment></comment><comment><USER40> It's not just the mac app, even the website signin[1] is affected. Also any email address works, it apparently just checks the domain.

[1] [https://slack.com/signin](https://slack.com/signin)

</comment><comment><USER22> Wow. This is a very serious security flaw. You should never assume that usernames (especially email addresses) are unknown to attackers.

<comment><USER36> It doesn't even require a valid email address. It's an obvious side-effect of Slack's completely weird account system.

</comment></comment><comment><USER42> Somebody already posted some screenshots:

[http://imgur.com/a/wLShq](http://imgur.com/a/wLShq)

<comment><USER40> It was fun guessing who each company was based on the groups.

Made a little script[1] that generates a screenshot and outputs the groups formatted like this:

microsoft.com groups: Yammer, Mihafa, Somex, iOS Team, China South CAM-S, DSE- Ireland, FUSE Labs, GroupMe, MozTeam, OCS Design Studio, OSS Studios, Priya's Team, FAST, Office PM, DMX, UK Apps, Bobbyk test, ExPGTeam, Team Wolf, BD&E, BingTV, OS Services, DMX, Kudu, EE COE, web, UI Team, Office BP, OneNote, VOX, CPG, India LRP, FooBar, Capture, Capptain, RoleClarity, asterix, Dragonslayers, SignalR, Office Mix, patterns & practices, DX, XD, TEDCOM, Exchange Ecosystem, CSI, PowerBI-ng, ODP, Compete, My Life & Work - China, Azure Active Directory, Census, MeetingsHVS, APEXOutlook, [FUN]CTION, Tempe, Arcadia, OEM, SharedPlatDev, #hashtag, Universal Apps, Modern Attachments, DLDW, Windows client, ESocialGP, MEA HQ Windows, Azure CAT PMoR, OneDrive, Azure Compute, QuestPersonalization, The Size 7 Italian Team, MMCOM, DLTC, ATMS, TED Strategic Engagements, Async Media Distribution, MAW team, APLD

[1] [http://pastebin.com/raw.php?i=NgTeseN1](http://pastebin.com/raw.php?i=NgTeseN1)

</comment></comment><comment><USER43> Even if they fixed this flaw, you could still reverse this technique by using a dictionary attack against {{ name }}.slack.com (e.g. eng.slack.com), and parse out the given domain name.

<comment><USER44> I reported that issue to Slack 6 months ago. Their response was "This is an intentional part of the product design.".

</comment></comment><comment><USER45> This is a capitulation - even Google uses Slack instead of Hangouts (although just a few teams); even Microsoft instead of Skype.

<comment><USER46> Neither Skype nor Hangouts are intended to compete with Slack. They're consumer products, while Slack is intended for business teams.

<comment><USER45> I'm sure way more businesses use Skype and Hangouts than Slack and HipChat.

<comment><USER47> Skype is actually pretty good for teams. I used to work at a company where it was our primary medium of communication, and we were almost forty people. It's extremely easy to create a group chat in Skype and destroy it with IRC OPs like features. It is also tempting to use since Skype provides a way to initiate a voice call right there from the chat. And one can always access the chat history as well. People have also written Skype bots.

<comment><USER5> Skype bots that have to be hosted with someone clicking the buttons in the UI, or that get broken every time Skype updates, no?

I wouldn't want to trust any business use to something that doesn't provide a documented API that I can use from my own code.

</comment></comment></comment></comment></comment><comment><USER48> As previously stated, this isn't listing the rooms or groups inside a slack account, it's listing the slack accounts that you might potentially be trying to login to.

IMO, this seems like more a security issue of the individual creating slack accounts for, a) naming the accounts for a specific (potentially revealing) sub-set of their company, and b) turning on the feature that allows anyone to create an account if their e-mail matches the domain.

The company I work for uses Slack but has this second feature turned disabled and our company is not listed when you try and sign in with a bogus e-mail account.

</comment><comment><USER49> Its difficult to balance ease of use with vulnerabilities like this one. Our product Sococo requires a moderator to enter email addresses of invitees to a group. This is more secure, but slows down our adoption rate. We've resorted to a more direct marketing approach to overcome this, but in the end our clients are more secure.

</comment><comment><USER50> I can see that both Microsoft and Google have tried Slack at least. This doesn't mean they are still using it (vice versa).

Since Skype is not really light-weight anymore and Google chat did not really take off, It looks like that Slack found himself a good spot in between.

<comment><USER51> My 'Open Source Strategic Engagements' team at MSFT is totally using it. Slack is awesome. It has a good Skype integration, which is how we can call each other. It's the best chatroom solution I've seen in a while. Skype and Lync are trying to do something else and we're very happily using all of them!

</comment></comment><comment><USER52> We use Slack and I always thought this was an odd behavior. We're a part of a major university so our domain is quite large and we can see dozens of other departments and projects using Slack just by putting in our email.

</comment><comment><USER53> So this is just IRC with lipstick it didn't need?

Talk about reinventing the wheel.

</comment><comment><USER54> Slack has a setting that allows anyone with an email address in your domain name to join without being invited. I imagine if you turn that setting off, this problem goes away.

</comment><comment><USER55> I suspect channel names would be much more damaging than team names. This isn't really a big deal as long as people know it's out there.

</comment><comment><USER28> WTF - "that matches your domain". Big ouch.

</comment><comment><USER56> Slack is on HackerOne, better report to them next time :)

[https://hackerone.com/slack](https://hackerone.com/slack)

</comment><comment><USER57> Nice, they eat their own dogfood [http://imgur.com/Xs2QRZa](http://imgur.com/Xs2QRZa)

<comment><USER27> Slack is super dogfood in the sense that it was built and used internally while building another product, and only productized when the original idea failed (like the founder's previous project Flickr).

</comment></comment><comment><USER58> In the US that could be probably prosecuted as "hacking a computer system". Very similar to what Aaron Schwartz did.

</comment><comment><USER59> Wow, certainly a big punch on the company face

</comment><comment><USER60> Metadata collection at it's finest!

Seriously this is very interesting and could be valuable. Expect that it will get fixed soon though.

</comment><comment><USER61> firstname.lastname@example.com also works. (╯°□°)╯︵ ┻━┻

<comment><USER62> Yes, even firstname.lastname@example.com works!

</comment></comment><comment><USER63> Actually, is Microsoft really using Slack if they have Lync and Skype?

<comment><USER64> With that many employees, they probably use and experiment with a variety of products

</comment></comment><comment><USER65> How can someone use this to their advantage?

<comment><USER66> Depending on the group names, it could reveal product features or business activities these companies expected to remain confidential.

</comment></comment><comment><USER67> The issue seems to be solved

<comment><USER68> Do you have any link to an announcement?

</comment></comment><comment><USER69> try email@example.com

</comment><comment><USER70> link is dead

</comment><comment><USER71> I cannot believe the incompetence.

</comment><comment><USER72> THIS SITE IS TAKEN DOWN..... THE LINK IS NOT PRESENT EVEN IN CACHED SITE..... WONDER WHY...........

</comment><comment><USER73> Therefore I prefer using encrypted platforms like [https://telegram.org/](https://telegram.org/) or [https://stackfield.com](https://stackfield.com) \- they really take care of privacy and data protection.

<comment><USER74> Encryption avoids a lot of problems, but this has _nothing_ to do with encryption

</comment></comment><comment><USER27> While I understand how disclosing group names of customers is a bad idea, everyone here jumping on how serious of a security vulnerability this is is missing the fact that it is a feature, not a bug. It's not disclosing anything that was ever intended by the Slack UX designers to be undisclosed, they clearly thought about it and decided to make this tradeoff. This is arguably bad judgement, but it's far from the gross incompetence and negligence that most comments here seem to be frothing at the mouth to proclaim. These are _group names_ , not any internal communication or private data. In a world of Shellshocks and 8-figure credit card thefts direct from PoS systems, there is simply no way this qualifies as a "serious security vulnerability".</comment>


Show HN: Give tiled maps interactivity in phaser.io - <AUTHOR> https://github.com/Morabaraba/Prison/

<comment><AUTHOR> Saw phaser getting some love a week or two ago and I wanted to show this toy. But I dragged my feet with sharing it.</comment>


China launches strict new Internet controls - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/n/a/2010/02/23/financial/f091003S40.DTL&tsp=1

<comment><AUTHOR> Nutty:

"China's technology ministry moved to tighten controls on Internet use Tuesday, saying individuals who want to operate Web sites must first meet in person with regulators."</comment>


Tearful Tech Mogul Jailed After Probation Revoked in Domestic Violence Case - <AUTHOR> https://sanfrancisco.cbslocal.com/2018/08/31/tearful-tech-mogul-jailed-domestic-violence/ <comment><USER2> A significant event for the #metoo movement signifying the hubris and deification of a startup founder and sad to see the coverage focusing on his resume rather than the actual heinous crime he committed</comment>


Go and gRPC: building a C language project faster - <AUTHOR> https://gophers.postach.io/post/go-grpc-decyan-yu-puroziekutonobirudowozao-kushitahua-qiita <comment><USER2> "WARNING: This is a Google translated (originally Chinese) and reposted article that probably is mostly comfortably understandable for senior Golang developers."

The article is translated from Japanese, not from Chinese since Qiita is for the Japanese community.</comment>


Ycombinator.com has expired [Google domains oversight/bug] - <AUTHOR> http://domain-registrar.storage.googleapis.com/expired.html?ycombinator.com <comment><USER2> This is not related to YC. I get the same error for every domain they don't manage. For example:

[http://domain- registrar.storage.googleapis.com/expired.html?...](http://domain- registrar.storage.googleapis.com/expired.html?ycombinatorxyzxyzxyz.com)

</comment><comment><USER3> Maybe it's only pining.</comment>


Crown Sterling sues over being booed at Blackhat - <AUTHOR> https://arstechnica.com/information-technology/2019/08/company-accused-of-crypto-snake-oil-sues-black-hat-anonymous-detractors/ <comment><USER2> Is this whole thing just an attempt to get their name mentioned as many times as possible, and hoping that ends up meaning something?

I honestly don't understand what else they could even be attempting.

<comment><USER3> They're definitely not standing on bedrock as far as the defensibility of their complaints go, but they may argue that they didn't receive the full benefit of the time they were entitled to in the sponsorship package. It's hard to suss out what the intentions are here.

</comment></comment><comment><AUTHOR> Oh, here's the complaint for easy reading:

[https://drive.google.com/file/d/1e8owdaynxoRWxTckjmQRLTwD1CP...](https://drive.google.com/file/d/1e8owdaynxoRWxTckjmQRLTwD1CPRgwTH/view)

</comment><comment><USER4> Apparently they have never heard of the Streisand effect?</comment>


Did Steve Jobs ever mention his thoughts on free software? - <AUTHOR>

I read a pile of citations from Steve Jobs, comparing Apple with other companies like Microsoft, Dell, Google.
Did he ever express his thoughts about Linux and free software in general?
Seems to me like he ignored this movement completely. Recall his (in)famous prediction of Explorer/Safari market share where he blatantly ignored Firefox (at the time 2nd) But at the same time OSX is using a lot of free/Apache/BSD software. <comment><USER2> You should ask this on Quora.</comment>


Advanced Web Applications with Symfony - <AUTHOR> https://advancedwebappsbook.com/

<comment><USER2> There is no content here..</comment>