A better zip bomb - <AUTHOR> https://www.bamsoftware.com/hacks/zipbomb/ <comment><USER4> I recently created a zip validator and decoder for scanning email attachments, @ronomon/zip.

It's not yet open-sourced but it has defenses against excessive compression ratios, mismatching local and central directory headers, ambiguous filenames, directory traversals and symlink traversals, and anything ambiguous that could exploit differences in zip implementations, e.g. some zip implementations decode from the front while others decode from the back. Most importantly, it balks at deviations from the zip format, including any kind of overlapping or sparseness, buffer bleeds etc.

At least it detected all three of the author's samples as malicious.

<comment><USER5> Now might be a good time to open-source it, even if it doesn't "feel ready" yet. There may be developers who would install it today, as zip bombs are on their mind, and upgrade it in the near term, but would otherwise forget about zip vulns entirely as they go about their days.

<comment><USER4> Thanks for the encouragement:

[https://github.com/ronomon/zip](https://github.com/ronomon/zip)

<comment><USER6> Make a Show HN!

<comment><USER7> [https://news.ycombinator.com/item?id=20362479](https://news.ycombinator.com/item?id=20362479)

</comment></comment></comment></comment></comment><comment><USER8> Pretty powerful! Lots of breakage with things that touch this file. Simply downloading it in Chrome caused issues, Chrome began extracting it to a temp folder (presumably for some malware scanning?) and quickly started filling the disk.

Windows 10 then began doing the same thing for Windows Defender, but some sane limits aborted it after a few seconds.

<comment><USER9> Why would Chrome automatically begin unzipping the file?

I'm afraid to even download it now...

<comment><USER10> Safari always unzips any downloaded archive, wraps it in a folder and puts it into ~/Downloads.

I prefer this functionality as most of the time I do want to unarchive it. I can rearchive it later (or remember to use another browser) when I need to.

<comment><USER11> How can you for instance verify the checksum of the file when it's deleted?

<comment><USER12> Wouldn't the decompression fail in that case?

<comment><USER13> The idea is to publish the checksum of the archive separately. After downloading the archive you can calculate its checksum and compare with the published checksum. If they differ you known something is up (possibly bad).

When a browser helpfully decompresses the archive you can no longer perform this check.

<comment><USER12> If it fails to decompress because the file is corrupt, the browser would more then likely keep the archive?

But if someone replaces the archive with a malicious file that decompress normally, he will also probably change the listed checksum on the download page....

<comment><USER14> There are signature schemes that can fix that issue, and cases where it's useful anyway, like:

Many linux distro isos are available from several different mirrors. Having a secure hash on the original site with the links to mirrors means I don't have to trust the mirror(s).

Another case where the archive hash is useful is when there's some public key crypto involved. I can have a public key from a publisher (gotten either out- of-band or in the past) and the hash can be signed so I can verify it. These schemes would mean that an attacker would at the least need to have compromised a site for an extended period of time (if I have history with the site, the first visit it doesn't do anything extra), or in the case of out-of- band key sharing, multiple communication methods might need to be compromised for an attack to succeed.

But yes, in the common case a hash next to a file link hosted on the same domain really doesn't do anything.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> Just don't go posting about this on YouTube!

</comment><comment><USER16> Is there a way to automatically send this to SSH spammers/directory scanning bots?

<comment><USER17> SSH has some kind of compression, so if you can write a Twisted ssh server sending the file as a compressed ssh packed. For detection, fail2ban provides a plugin architecture that allows it to do any action once it noticed an abuse, so you could switch the regular ssh implementation with you tricky one on the fly.

Fun project.

One should also do a lua nginx plugin for that: aggressive crawler ? Comment spammer ? Take this nice gzip HTTP response...

<comment><USER18> This file exploits the zip container format, not the actual compression algorithm. SSH only uses the latter, not the former, so it is not applicable.

<comment><USER19> Would it be possible to do it just exploiting the algorithm?

<comment><USER18> You can make some limited deflate bombs, but they are nowhere near as massive as this one.

</comment></comment></comment></comment></comment><comment><USER20> lovely... its on my "collection" along with the "one square kilometer" pdf :

[https://www.librarystack.org/one-square-kilometer-for- walter...](https://www.librarystack.org/one-square-kilometer-for-walter-de- maria/)

<comment><USER21> Compressed files that contain themselves:

[https://research.swtch.com/zip](https://research.swtch.com/zip)

</comment></comment><comment><USER22> I remember being so excited when the zip format came out. Prior to zip, we suffered with the arc format. At 2400 baud, the difference in compression was very very significant.

<comment><USER23> I always preferred ARJ; I remember it having both better compression and more useful options than ZIP.

<comment><USER24> And later came RAR

<comment><USER25> RAR was great at the time because it offered "solid" archiving like a tar/gz combo. Zip and ARJ both compressed at the file level rather than the archive level.

<comment><USER23> > _Zip and ARJ both compressed at the file level rather than the archive > level._

No. You may be thinking of gzip, a spiritual successor and replacement for the Unix compress/uncompress (and even earlier pack/unpack).

But both ZIP and ARJ, and the earlier ARC, all made multiple-file archives.

Or did you mean that the _compression_ was "carried over" from file to file inside the archive?

<comment><USER24> The latter.

</comment></comment></comment></comment></comment></comment><comment><USER26> Not currently detected by anyone, according to VirusTotal: [https://www.virustotal.com/gui/url/d98f43e8a91f1ddb4980d4602...](https://www.virustotal.com/gui/url/d98f43e8a91f1ddb4980d46020139ee3eb4d862beabfc31ac0449d85a7de2475/details)

</comment><comment><USER27> A lot of modern formats - jar, Apple's pages, etc, come to mind - are just zip files with a different extension.

So which of these files which are really zip do browsers or mail programs auto-open? Anyone think of any?

<comment><USER4> DOCX, XLSX are also just ZIP files with the extension renamed.

</comment></comment><comment><USER28> Out of curiosity, does Google open zip files to properly index what's inside them when it crawls websites?

</comment><comment><USER29> Did anyone notice how neat the HTML was for this article? For once HTML5 elements are in use, sections, asides, figures, correct use of tables - <USER2> nice!

Only this week did I discover that yahoo and gmail don't let you send zip attachments. I thought this was a bit silly but now I am agreeing with them!

<comment><USER4> Gmail do let you send zip attachments. It just depends what's in them.

<comment><USER29> Well it wasn't happy with some source code files I tried to send the other day. None of which were natively executable and all text only. They may have had the 'x' flag set in the permissions. But I was surprised by that, not allowing me to send a bunch of php files.

</comment></comment></comment><comment><USER30> Is there any way to detect these things before unzipping them?

<comment><USER31> Whenever you download any untrusted file and attempt to parse or unpack it (and this includes zips, tarballs, PDFs, even images) your program should fork off some kind of sandbox which limits CPU time, memory, disk space, and access to local resources such as the filesystem and system calls.

There are various sandboxing technologies from using simple rlimit, or a cgroup, or even running a full VM (see libvirt-sandbox) depending on the threat level and the amount of effort you want to put in vs the perceived risk.

</comment></comment><comment><USER32> All deflators need memory allocation and CPU counters that trigger errors on massive resource utilization. Guessing it is uncomputable like the Halting Problem to detect all zip bombs.

<comment><USER33> It's an interesting point. For classical ZIPs I actually disagree that it's needed. And then again I do agree for some other potential compression algorithms :)

In case of ZIPs: an implementation can look through the Central Directory index of files and sum up "uncompressed size" fields of all the files, and then check the sum vs the set limits - no prior decompression is needed (this is neither CPU intensive nor requires a lot of memory allocations).

The obvious "gotcha" here is that the "uncompressed size" might be declared low, while the actual data inside the compressed stream might be much higher - this is detectable only when trying to decompress, so it would seem we would fall into your idea (memory allocation / CPU counters). But that actually is not needed, as all good decompression libraries have functions to "decompress at most N bytes" \- so the implementation just uses the previously declared "uncompressed size" as the limit, and therefore guarantees that the actual total decompressed size is within the checked (in previous step) total limit.

That said, I do recognize that some decompression algorithms might have possible inputs which get really CPU intensive even for a single byte, though that's not the case for typical "DEFLATE"-using ZIPs (i.e. you probably might structure the decompression stream in a way that does a lot of cache misses, but that's about it).

For non-DEFLATE compression YMMV and your method comes to mind as a decent solution.

</comment></comment><comment><USER34> Gmail detects this as an unsafe file.

<comment><USER35> Gmail detects almost every zip as unsafe file...

</comment></comment><comment><USER36> Great hack! It will take a long time before all installations everywhere are updated to check for such overlaps. This is a powerful weapon with many uses.

</comment><comment><USER37> Are you able to theoretically look at compressed data without size Metadata and estimate its final size without actually uncompressing it?

<comment><USER38> At worst you can just run the decompression algorithm while piping the output into the void, only counting the length. If you want to be slightly more efficient you can probably write an optimized stream parser for the compressor's format and sum up the lengths of dictionary/literals/back- references while skipping any other processing, but that depends on how amenable to fast-forwarding the stream format is.

If the goal is to avoid zip bombs you can't get any more sloppy than that because then an attacker could exploit inaccuracies in your estimator.

<comment><USER39> I was thinking that you could just go through the process without writing anywhere, and show a growing "estimate". I feel like if you can get a size of each kernel and follow the instructions you could do so much faster, but I don't know enough about the in's and out of the DEFLATE algorithm and the edge cases.

</comment></comment></comment><comment><USER40> Nice. Decades age we used zip bombs to destroy BBSes that were not well protected.

</comment><comment><USER41> what happens if you put this in dropbox? (does dropbox open archives?)

</comment><comment><USER42> The comparison table would look a little better if it nested a copy of the Cox quine inside, so that the recursively decompressed size was also infinite. :)

</comment><comment><USER43> i have a Nigerian prince in my inbox why might be in for a treat....

<comment><USER44> In my time as a scambaiter, one of the most important lessons taught to everyone was: "Don't weaponize them"

<comment><USER45> Honest question: why? Seems like there is a nice story behind this claim.

<comment><USER44> Because anything you give them to fool them (such as fake passports or fake documents to comply with their initial demand), they will turn around and use on innocent victims.

Same goes for files that can crash your computer, they can send that to non- complying victims. Key is to waste as much of their time as possible while giving them as little value as possible.

</comment></comment></comment></comment><comment><USER46> Can it be packaged as a png?

<comment><USER33> No. This ZIP bomb workings rely on two important facts:

1\. ZIP archive has multiple files.

2\. ZIP is an "index+pointers" based format (meaning the Central Directory index of archive files is basically a table of pointers - or rather offsets - telling where to look for data inside the file).

Thanks to these two properties David could create a very clever compressed stream that could be (partially) re-used by multiple files inside the archive.

While one could argue that PNGs do meet the first criteria (multiple compressed separate blocks - <USER3> [https://www.w3.org/TR/PNG/#10CompressionOtherUses](https://www.w3.org/TR/PNG/#10CompressionOtherUses) \- do note that multiple IDATs make a single compressed stream, so one has to use these other separate blocks like iTXt, iCCP or zTXt; YMMV for animated PNGs extensions), it certainly doesn't meet the second one - it's a block/chunk format (and by definition blocks are unable to overlap).

One note here is that in case of a faulty block/chunk format parser implementation - one with integer signess/overflow problems related to block size - one might be able to pull an overlapping block trick (see Bug 2 in [https://gynvael.coldwind.pl/?id=533](https://gynvael.coldwind.pl/?id=533) for an example in a different file format).

</comment></comment><comment><USER35> afk, sending some mails ;)

</comment><comment><USER47> Surprised nobody commented on this before:

> A final plea

> It's time to put an end to Facebook. Working there is not ethically neutral: > every day that you go into work, you are doing something wrong. If you have > a Facebook account, delete it. If you work at Facebook, quit.

> And let us not forget that the National Security Agency must be destroyed.

Personally I do agree. By the way, I got to meet the author (David Fifield) in person. An extremely bright mind!

<comment><USER48> Yeah, was quite a pleasant surprise, albeit the outlook is not very comforting.</comment></comment>


IBM's Red Hat acquisition moves forward - <AUTHOR> https://www.zdnet.com/article/ibms-red-hat-acquisition-moves-forward/ <comment><USER2> Their new logo is now up on their building here in Raleigh as of a week ago. Slightly interesting that they still chose to go through with their rebrand. I'd almost expected them not to, to sort of assuage peoples' fears that this is no longer their dad's Redhat.

<comment><USER3> Maybe _" hurry up and do the rebrand before some IBM exec decides to meddle with it"_

</comment></comment><comment><USER4> Linux taking over the world? Article kind of portrays that, and I'm not entirely unconvinced...</comment>


Ask HN: Best way to accept payments without extra transaction fees? - <AUTHOR> I'm building out an application for a customer-base, where they already accept payments in-person today.  I'd like to allow them to accept payments online, but they can't tolerate the extra percentage charge that a service like Stripe adds.<p>What's the best path forwards for accepting payments online without any fees beyond standard credit card fees?  This is for Canada & USA, which may complicate things a bit. <comment><USER2> \- bitcoin (transaction fees)

\- snail mail cash (postage costs)

\- accept credit cards yourself, which I wouldn't recommend

<comment><AUTHOR> I'm just looking to provide an online payment experience to supplement their in-person payments, so I'm looking for integrating credit card payments specifically, rather than bitcoin or snail mail</comment></comment>


Learn How to Find a Good Designer or How to Design Yourself - <AUTHOR> https://medium.com/p/design-basics-how-to-design-c6e896a4e2a0

<comment><AUTHOR> A 10-step how-to guide on what the design process really requires. Use this to inform your understanding of design (so you can hire better) or start designing yourself.</comment>


Launching developer Q&A on Stack Overflow - <AUTHOR> https://hacks.mozilla.org/2013/11/launching-developer-forums-on-stack-overflow/ <comment><USER2> In principle, it is good to go where the community is. Let's just hope they don't get slowed down too much by the questions police.

<comment><USER3> Or maybe the "questions police" is the reason the community is there and not in yet another weed-infested forum.

Disclosure: Card-carrying member of the "questions police".

<comment><USER4> That's very close to a tautology. People who are on S.O. ("the community") are there because they like how it is run, overall, and the questions rules and police are a big part of the experience. People who are disgruntled tend to leave.

Personally, I tend not to post because of the stress of having a question policed. You guys should have a full fledged StackExchange site (not Meta) where people can ask which other SE site to post their question on. I'm not kidding. Because of the complexity/sophistication of the software, the rules on SE/SO are far more baroque than the rules on Usenet ever could have been.

<comment><USER5> Agree. My (one and only) experience with using Stack Overflow for Facebook questions was not especially positive, and after having my motives impugned and my question derided as purposeless I just deleted it. (No point arguing with the police.) Sadly this was not the first time I'd had this experience on SO, even if it was my first time using it as any kind of official-looking support channel, and I would therefore look askance at any organisation using SO proper for their support.

On the other hand, I've noticed a couple of companies using their own Stack Overflow install for their support forums, and I'm sure that could work pretty well. It's not a question of the software, just whether or not the community is right, really. SO's has ended up with too many volunteer bureaucrats, I think, and to make things worse there's even a meta site where they can gather and make up more rules for people to follow. You say organised, I say ossified... well, let's call the whole thing off. I stopped posting on SO after my last experience.

I don't expect anybody to care about one person leaving (and nor should they!) but if enough individual people leave, then I guess eventually nobody will be left.

<comment><USER6> > after having my motives impugned and my question derided as purposeless I > just deleted it.

I had the same experience awhile back, it was like a pedantry competition. Ok, so perhaps I didn't word the question perfectly, but I did provide a lot of information and examples (spent like 15m just making the post itself). They need to realize that the people who're going to most frequently ask questions _are most likely not actually experts in that subject_ , or else they wouldn't be posting.

> and to make things worse there's even a meta site where they can gather and > make up more rules for people to follow

If you think that's bad, did you know that they now have chat? When I tried to delete my aforementioned question, it wouldn't let me, so I went into chat to see if I could find a mod to ask for help. Well guess what... there I found a group of mods/powerusers actively deriding me behind my back. Once I let my presence be known, they quickly shut up, like a bunch of school girls caught gossiping in class. I must say, that left a horrible taste in my mouth, to think that they get their kicks making fun of users behind their backs.

</comment></comment></comment></comment></comment><comment><USER7> Besides the dino head on the tag buttons what exactly does this mean? All the article says is "We are now happy to announce our presence on Stack Overflow!"

<comment><AUTHOR> It means that we are sponsoring those tags on Stack Overflow, have a landing page there and that people at Mozilla actively monitor and take part in discussions marked with that tag.

<comment><USER8> Do you know why Mozilla's Stack Overflow tags are using the dino head logo instead of the fox?

<comment><AUTHOR> Yes, I do. :-) That logo is the new logo for MDN, our network for developers at Mozilla. Since Stack Overflow is a resource for developers we see a direct connection to that. Also, we have different foxes for different products, so that would probably be confusing - rather have one consistent look.

<comment><USER9> I could barely recognize what that tag icon means. A small odd white shape on another odd blue shape. You can spot the Google Chrome and Android icons from a mile. Come on.

</comment></comment></comment></comment></comment><comment><USER10> I'm not sure why other companies even use forums instead of StackExchange.

<comment><USER11> It's vaguely scary to think people will be putting all their traditional forum stuff in SE or Reddit.

Yahoo, Myspace, and Digg all used to be pretty big.

<comment><USER12> why not reddit? Topical threaded conversation like miles better then the classic forums, they can't die fast enough.

<comment><USER11> Reddit is great. People used to say that about Yahoo search, and about Digg.

</comment></comment></comment></comment><comment><USER13> From what I can tell, this means they will be monitoring the tags to spot potential bugs and strange behavior.

Well done! I rarely have to report some problems with Firefox and trying to remember my bugzilla password is a major PITA. Most of the time I had to reset it. OTOH, I'm using SO almost daily. I just hope they will be able to really monitor it and not get overwhelmed (I have no idea how many questions are opened for those tags daily, hopefully not too many).

<comment><USER14> Bug reports should still end up in Bugzilla. Sorry; that's what it was built for.

The goal here is to encourage _development_ questions - folks writing code targeted at HTML5 or Firefox OS.

Not that bug reports never draw on problems identified in development questions of course... But don't throw away your Bugzilla account just yet.

<comment><AUTHOR> I second that. Stack Overflow is to discuss problems when developing, whereas Bugzilla ([https://bugzilla.mozilla.org/enter_bug.cgi](https://bugzilla.mozilla.org/enter_bug.cgi)) is for reporting actual bugs and the support site is more about product support: [http://support.mozilla.org/](http://support.mozilla.org/)</comment></comment></comment>


The Henry Ford of Heart Surgery - <AUTHOR> http://online.wsj.com/article/SB125875892887958111.html

<comment><USER2> I think someone ought to pitch building a hospital to the Iroquois League. They already issue passports, rejecting health law seems in line with tribal sovereignty claims. I'm sure a US-located low cost hospital could dwarf other income sources like gambling and tourism.

<http://en.wikipedia.org/wiki/Iroquois_passport>

<comment><USER3> The difference between issuing passports and building a large-scale hospital is that only in the latter case is a large amount of money risked. It would be tricky to find a source of funding for a hospital that may not be able to operate due to a dispute over health law applicability.

From the perspective of anyone considering funding such a hospital, better to just locate in a nearby country, such as the hospital mentioned in the article that is being built in the Cayman Islands.

</comment></comment><comment><USER4> Why did this innovation happen in India and not the US or Europe?

Dr Shetty is planning to build a similar hospital in the Cayman Islands for Americans so I have to assume it has to do with government regulation. Is the health care system less socialized in India? I would guess it is.

<comment><USER2> If you lined up all the words contained in US law, the median word would be health care related, that has to matter for something. Also AMA enforced under supply of specialists. Also direct and indirect costs of health care liability. Also requiring hospitals to serve the ER without regard to ability to pay. Also low reimbursement rates for medicare, lower for medicaid. Also third party payment system that makes consumers price insensitive. Also huge overhead to third party payment system. Also enormously expensive FDA approval process recovered through drug costs. Also service business in a high wage country. Any others for the list? I don't mean to be totally negative, we get a lot of good things out of all that inefficiency, but it doesn't surprise me that quality can be higher and costs an order of magnitude lower under a different regulator regime.

</comment></comment><comment><USER5> The US is unfortunately one of the highest spenders on health care with the lowest outcome per dollar spent. It's all part of a severely broken system that needs reinventing, badly.

<comment><USER6> > The US is unfortunately one of the highest spenders on health care with the > lowest outcome per dollar spent.

Umm, no. The outcomes are actually quite good considering the population. (No, you can't just look a lifespan.)

<comment><USER5> [http://content.healthaffairs.org/cgi/content/abstract/22/3/8...](http://content.healthaffairs.org/cgi/content/abstract/22/3/89)

[http://www.scielosp.org/scielo.php?pid=S0042-968620000006000...](http://www.scielosp.org/scielo.php?pid=S0042-96862000000600009&script=sci_arttext&tlng=en)

It's not just lifespan. Medication and procedure cost, access, technology use, availability, number of hospital beds and health care workers etc.

The US does however have the access to the most advanced technologies (probably where the large funds are going), I'll give you that but numerous other reports show poor outcomes for other general health indicators (teen pregnancy rates, obesity rates, suicide rates etc..)

<comment><USER6> > I'll give you that but numerous other reports show poor outcomes for other > general health indicators (teen pregnancy rates, obesity rates, suicide > rates etc..)

None of those things are affected much by health care. (Birth control is free in the US It's readily available at the local county hospital and other places.)

They do, however, affect health care spending, lifespan, etc.

</comment></comment></comment></comment><comment><USER7> Dr. Shetty has exactly the right ethos in a cumbersome and bureaucratic industry: "Japanese companies reinvented the process of making cars. What health care needs is process innovation, not product innovation."

Improving processes in this case will naturally generate better products (health services). But will also increase the knowledge of these processes, which will ultimately pave the way for the creation of improved supporting technologies.

</comment><comment><USER8> I don't understand _what_ he is scaling? the amount of concurrent operations?</comment>


Praying mantis seen hunting for fish in wild for first time - <AUTHOR> https://www.independent.co.uk/news/science/praying-mantis-eats-fish-discovered-india-a8548981.html <comment><USER2> > mantises appear to have evolved impressive learning abilities too

I found a mid-sized mantis on my porch the other day. These things are fascinating. It seemed to have genuine curiosity. I kinda waved my hand in front of it, and its gaze followed for a bit before it seemed to get bored with my hand and then looked me straight in the eyes. Then it casually walked away without breaking its gaze (its head turning nearly 180 degrees as it walked the other way). I'm sure I was projecting and it was just trying to avoid being eaten, but it seemed way more intelligent than other insects.

Thankfully these things aren't dangerous to humans otherwise I'm sure they'd have us enslaved by now.

<comment><USER3> > _Thankfully these things aren 't dangerous to humans otherwise I'm sure > they'd have us enslaved by now._

There's still hope. We may get discovered by a warlike spacefaring species.

<comment><USER4> If history has taught us anything, it's that we are the most likely to enslave ourselves.

<comment><USER3> Yes, some intergalactic conflict against a hostile alien species would be welcome if it meant getting a breaking from fighting over the same old shit between ourselves.

</comment></comment></comment></comment><comment><USER5> [https://youtu.be/ooZtzyHTX7g](https://youtu.be/ooZtzyHTX7g)

Maybe first time in the wild, bit we've known they eat fish for a long time. The above is a video of one catching and eating a fish, posted to YouTube 10 years ago.

<comment><USER6> Disturbing that it does not kill its prey first.

<comment><USER7> Often though they tend to target the head or neck for their first bites, I think with the intent that biting there will make the meal stop struggling[1]. Not all the time though, sometimes they grab the prey and just start chowing down, butt first :P

[1] I had an African flower mantis as a pet ;)

<comment><USER2> How'd your mantis do with human interaction? I've been fascinated with them since I met one outside a couple weeks ago. They seem like they could do some real damage if they wanted to but all the reading I've done it seems like they're pretty tolerant of being handled and rarely/never bite.

<comment><USER8> > They seem like they could do some real damage if they wanted to

A mantis could do real damage to a human?

<comment><USER9> I have had this memory from some time ago about a scene from a podcast. Scientists in a lab are trying to wrangle an insect (which I remember to be a mantis of some kind) with a glass rod. The insect bites the rod with such force that it snaps and the arc of the motion lacerates the bugs middle (thorax?). From the cut fat begins to come out. Instictually the bug begins to eat it's own fat while dying.

I wish I could remember or find the podcast. I feel like it was radio lab, but can't find it.

<comment><USER10> [https://www.wnycstudios.org/story/185551-killer- empathy/](https://www.wnycstudios.org/story/185551-killer-empathy/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I love the last sentence of the article:

> Adult females are known to eat their mating partners after sex.

Just thought they'd throw that one in before signing off! But I do suppose a writer would be remiss not to remind you of that fact given the opportunity.

And a fascinating comment (which I haven't confirmed yet) from a reader below the article:

> Sigh, females HAVE to eat the head of the male to remove the inhibition > stopping him from climaxing. > > It doesn't happen AFTER sex, it is required > for the sex to be successful in terms of conception.

I never knew that. This behavior has only ever been explained to me as some kind of vindictive or inexplicable act by the female mantis.

I wonder how the female mantis knows that this is a way to disinhibit the male's climax?? Nature can be so strange.

<comment><USER12> That's wrong, they don't _have_ to do it. But it sure does help if they're not otherwise getting enough to eat!

[https://en.wikipedia.org/wiki/Mantis#Sexual_cannibalism](https://en.wikipedia.org/wiki/Mantis#Sexual_cannibalism)

Apparently it happens more often under laboratory conditions than in the wild.

<comment><USER13> > Early researchers thought that because copulatory movement is controlled by > a ganglion in the abdomen, not the head, removal of the male's head was a > reproductive strategy by females to enhance fertilization while obtaining > sustenance. Later, this behavior appeared to be an artifact of intrusive > laboratory observation. Whether the behavior is natural in the field or also > the result of distractions caused by the human observer remains > controversial.

</comment></comment></comment><comment><USER14> Source: [https://jor.pensoft.net/articles.php?id=28067](https://jor.pensoft.net/articles.php?id=28067)

</comment><comment><USER15> > The research team were surprised by the visual capability of the mantis, > which could see its prey underneath the surface of the water.

According to this 2010 video[0] of a mantis catching a goldfish, the mantis has no problem doing this, however it was a human-manipulated situation during daylight.

[0] [https://www.youtube.com/watch?v=ooZtzyHTX7g](https://www.youtube.com/watch?v=ooZtzyHTX7g)

</comment><comment><USER16> shouldn't the title be "preying"?

<comment><USER17> > _" [Their] upright posture, while remaining stationary with forearms folded, > has led to the common name _praying mantis _. "_

[https://en.wikipedia.org/wiki/Mantis](https://en.wikipedia.org/wiki/Mantis)</comment></comment>


North Korea announces successful hydrogen bomb test - <AUTHOR> http://www.bbc.com/news/world-asia-35240012 <comment><USER4> Is there any reason to believe they actually tested an H Bomb? Wouldn't that be a pretty big leap from low-yield atom bombs? It seems like the only evidence it was thermonuclear is that the North Korean government said so, and they're not exactly reliable.

Meanwhile, CNN is proclaiming "N. KOREA TESTS H-BOMB" on their front page, which is a pretty far cry from them _claiming_ to have tested one.

<comment><USER5> Listen to the audio of the event:

[http://ds.iris.edu/ds/nodes/dmc/tools/event/5170265](http://ds.iris.edu/ds/nodes/dmc/tools/event/5170265)

[http://ds.iris.edu/ds/nodes/dmc/tools/event/](http://ds.iris.edu/ds/nodes/dmc/tools/event/)

<comment><USER6> For comparison, here is the link to the recent quake off the BC coast. You don't need to be an expert to realize the differences between a bomb and a natural quake.

Natural: [http://ds.iris.edu/ds/nodes/dmc/tools/event/5169662](http://ds.iris.edu/ds/nodes/dmc/tools/event/5169662)

Bomb: [http://ds.iris.edu/ds/nodes/dmc/tools/event/5170265](http://ds.iris.edu/ds/nodes/dmc/tools/event/5170265)

</comment></comment></comment><comment><USER7> The 5.1 earthquake for this bomb would suggest a smaller explosion than the bombs at the tail end of WW2, however that depends on a lot of things. Looking at this list it would suggest about a ~600 ton explosion [http://self.gutenberg.org/articles/richter_magnitude_scale](http://self.gutenberg.org/articles/richter_magnitude_scale)

<comment><USER8> I wonder if they could just wait until a suitable earthquake happens, and then just lie it was a bomb they detonated?

<comment><USER9> Seismic, acoustic, and, especially, _radiation_ signatures tend to strongly differentiate natural and nuclear device events.

Earthquakes virtually always develop over both time and space -- the "epicenter" of an earthquake is the center or origin of the movement. Some quakes occur over very long rupture zones -- the 2004 Boxing Day quake off the coast of Indonesia involved several _hundred_ km of fault line, and moved along that fault at several hundred km/hr (this is among the reasons why major quakes can be felt over several minutes -- the rupture is literally happening over that duration, and, depending on the location of the observer, the seismic waves have to travel back to them).

An atomic blast begins and ends within a few thousands of a second -- at the seismic scale it's both instantaneous and a point event.

A bomb will vent radioactive fission/fusion products and their decay products, many of which are radioactive, and have signatures specific to the type of weapon and design used. Even underground blasts will typically vent detectable quantities to the surface and atmosphere.

<comment><USER6> Bombs also do not have any for/aftershocks. Not all quakes do, but it is a tell.

</comment></comment></comment></comment><comment><USER10> Perhaps worth noting that North Korea wouldn't be the first country to bluff that they had exploded an H-bomb when they hadn't - the UK did this with some tests in the 1950s:

[https://en.wikipedia.org/wiki/Operation_Grapple](https://en.wikipedia.org/wiki/Operation_Grapple)

<comment><USER11> The Soviets did it too: [https://en.wikipedia.org/wiki/Joe_4](https://en.wikipedia.org/wiki/Joe_4)

<comment><USER10> I think you could argue that the Joe 4 design was an attempt to design a H-bomb using a different approach that turned out to be a dead end - the US was aware of this design but never tested it.

Whereas the UK just plain lied and continues to be evasive about the matter to this day - probably because the exercise was mostly aimed at the US.

<comment> m-i-l The Grapple X on 8 November 1957 (a few months after the Grapple 1 on 15 May 1957) was a successful thermonuclear device[0], so it was only a short term bluff.

Bear in mind that this was in the context of the British feeling betrayed by the Americans on nuclear research - <USER2> [https://en.wikipedia.org/wiki/Atomic_Energy_Act_of_1946](https://en.wikipedia.org/wiki/Atomic_Energy_Act_of_1946) :

 _" Implementing the McMahon Act created a substantial rift between United States and Britain. The new control of 'restricted data' prevented the United States' allies from receiving any information, despite the fact that the British and Canadian governments, before contributing technology and manpower to the Manhattan Project, had made agreements with the United States about the post-war sharing of nuclear technology. Those agreements had been formalized in the 1943 Quebec Agreement. In the case of the United Kingdom, these were developed further in the 1944 Hyde Park Agreement, which was signed by Winston Churchill and Franklin Roosevelt"_

[0] [https://en.wikipedia.org/wiki/Operation_Grapple#Grapple_X](https://en.wikipedia.org/wiki/Operation_Grapple#Grapple_X)

</comment></comment></comment></comment><comment><USER6> My money: a boosted device. A fission weapon with a drop of liquid hydrogen thrown in to qualify it as "thermonuclear".

It had to be an h-bomb. The korean people have been told that the regime already has nuclear weapons. So any test has to be a marked improvement. The only way up from nuclear is thermonuclear. Whether that H contributed anything meaningful to the force of the blast is very much secondary (pun intended).

<comment><USER12> > The only way up from nuclear is thermonuclear.

Antimatter. Thankfully we have no idea how to make them yet.

<comment><USER6> That isn't too far in the future. Using antimatter as a neutron source to prime a fission device is not total fantasy. With sufficient resources it could probably be done today on the bench (ie not a weapon). Such technology would allow for possibly very much smaller and/or more efficient fission weapons.

<comment><USER13> Antimatter annihilation produces gamma, not neutrons. Priming a pure fusion device seems far more likely.

</comment></comment></comment></comment><comment><USER14> Every time when North Korea wants to bargain for something, it tests a bomb. Nuclear crisis is the only chip for the DPRK to survive in between the US, Russia and China.

<comment><USER15> I was under the impression that the whole reason North Korea existed at all was because China wanted it to be there?

<comment><USER16> As I understand itg North Korea is there because China doesn't want to have to deal with what will happen when North Korea collapses.

<comment><USER15> I thought the point of North Korea was as a buffer zone so China wouldn't have to share a border with a potentially hostile country like US-friendly South Korea. That may be obsolete, but I'm pretty sure that was the reasoning of the time.

<comment><USER17> The reasoning of the time was that China was trying to help North Korea conquer South Korea completely. Remember the Korean war was during Mao Zedong's rule of China and he was fully committed to a global Communist revolution. Where others might see a buffer, he would see a staging area for further revolution.

By the the time of Deng, North Korea was well established and successive Chinese leaders have simply tried to maintain the status quo.

</comment></comment></comment></comment></comment><comment><USER18> If as a nation, you wish to be safe from US invasion/arm-twisting, you _must_ have nuclear weapons. It is the best possible deterrent against US interference. Countries that do not have nuclear weapons must depend on US benevolence - which tends to change from year to year depending on the policies being followed by the US state department and administration.

If Saddam _really_ had nuclear weapons, there would have been no Iraq war and no ISIS today.

<comment><USER19> On the 'arm-twisting' side, the UK has nuclear weapons but are regularly treated as a US 'bitch'.

Nuclear weapons are far from the only thing that can be used as leverage.

Totally agree with you about the Iraq war and ISIS though.

<comment><USER20> Perhaps arm-twisting is more effective when the power doing the twisting is known to have used nuclear weapons.

<comment><USER19> ...Except, in this case the power having the arm twisted also has nuclear weapons.

</comment></comment></comment></comment><comment><USER21> What happens if the rest of the world decides to strike first with e.g. a massive wave of conventional missiles and bombers, combined with a ton of defensive mines air-dropped into the DMZ?

Would it be enough to take out North Korea's nuclear capability and cripple troop encampments on the DMZ enough that they can't immediately launch a massive counterattack on South Korea?

<comment><USER22> I think the road to destabilization would be for the US to give nuclear weapons to South Korea, Japan and Taiwan, and then tell China to deal with it.

<comment><USER23> South Korea and Japan are already under our nuclear umbrella. It would be a major change in our nonproliferation stance to give weapons out.

<comment><USER24> Well accept them into NATO and you can give out nukes like candy under the strategic arms sharing clause.

</comment></comment></comment></comment><comment><USER25> George Carlin explained this here [https://www.youtube.com/watch?v=jMwXR-1oajE](https://www.youtube.com/watch?v=jMwXR-1oajE)

<comment><USER26> Carlin neglected to make use of the Bush 41 statement "this will not stand" \-- how could Carlin miss that opportunity!

<comment><USER27> When did we stop calling him Junior? There's not even a new actual presidential candidate with the name.

Calling him "Bush 41" makes him sound more like a nu metal band than a former president.

<comment><USER28> Bush 41 is George H. W. Bush. Junior is Bush 43.

<comment><USER27> Senior then. I guess my comment serves as evidence for why the numbering is useless for anyone not paying close attention to the sequence of US presidents.

</comment></comment></comment></comment></comment><comment><USER29> Surely the first hydrogen bomb was constructed in 1952, not 1958?

<comment><USER30> Yes, Ivy Mike was in 1952.

<comment><USER31> depends on the definition of bomb: Ivy Mike was not a weapon, was a nuclear device, as big as a building

<comment><USER10> The Ivy Mike "Sausage" was big but it didn't fill the entire building - <USER3> was a lot of instrumentation for that test. There was actually a weaponized version of the Ivy Mike Sausage planned which was cancelled when they found out how to make "dry" bombs using lithium deuteride.

You can see the Sausage in the pics on the Wikipedia page:

[https://en.wikipedia.org/wiki/Ivy_Mike](https://en.wikipedia.org/wiki/Ivy_Mike)

<comment><USER31> that's the point, was not a weaponized device, does not mean it did not go boom.

</comment></comment></comment></comment></comment><comment><USER32> I wonder if this would have happened if the US hadn't been meddling so much? For example Bush's "Axis of Evil".

<comment><USER33> After watching documentaries about North Korea with smuggled film, it would surprise me if the country could have turned out much different than it is now.

</comment></comment><comment><USER34> The myth of nuclear deterrence is an interesting concept [http://setbpbx.nuclearfiles.org/menu/key-issues/nuclear- weap...](http://setbpbx.nuclearfiles.org/menu/key-issues/nuclear- weapons/issues/policy/PDFs/153_wilson\[1\].pdf)

<comment><USER17> I don't find the linked document at all convincing. To qualify as 'City Attacks' we would expect that those bombs would have been dropped on the largest population centres available as targets. In fact they were dropped not on the most populous cities, or on the most populous parts of Hiroshima and Nagasaki, but actually they were dropped on the port and navy facilities at Hroshima and the arms manufacturing facilities in Nagasaki. In fact the second bomb was originally intended to be dropped on the arsenal at Kokura and was switched to Nagasaki due to bad weather. yes they are cities, but they were prioritised on military grounds.

For civilians, we generally think and worry about bombs targeting cities, but most nuclear weapons are actually aimed at military targets. The primary targets are the enemy's own nuclear weapons, military assets and infrastructure come second and population centres last of all. The point of nuclear deference isn't that if we have a war mum and dad will be killed, it's that everyone will be killed.

The fact is we have vast amounts of direct testimony from US and Russian military personnel and leaders, both at the time and in subsequent interviews books and testimony, that deterrence was the primary consideration in their defensive and offensive planning.

<comment><USER35> >The primary targets are the enemy's own nuclear weapons, military assets and infrastructure come second and population centres last of all.

Humbug:

""The authors developed a plan for the 'systematic destruction' of Soviet bloc urban-industrial targets that specifically and explicitly targeted 'population' in all cities, including Beijing, Moscow, Leningrad, East Berlin and Warsaw," Burr pointed out. "Purposefully targeting civilian populations as such directly conflicted with the international norms of the day, which prohibited attacks on people per se (as opposed to military installations with civilians nearby)."

But other contemporary sources make it abundantly clear the Pentagon saw any person tied to a war effort as a viable military target. A now declassified 1952 U.S. Navy film on chemical and biological warfare specifically states a goal "to incapacitate the enemy's armed forces and that portion of his human population that directly supports them." With similar thoughts in mind, the U.S. Army had looked into radiological warfare and built deadly dirty bombs."

([http://warisboring.com/articles/this-cold-war-study-is-a- cat...](http://warisboring.com/articles/this-cold-war-study-is-a-catalog-of- nuclear-death/))

Civilians have always been targets and always will be.

<comment><USER17> Of course they are, and "Purposefully targeting civilian populations as such directly conflicted with the international norms of the day" is complete and utter guff. This was immediately after the systematic, thorough going population centre bombing campaigns of WW II. Which planet are these people from?

nevertheless the fact remains that most nuclear weapons are tactical or mid- range and therefore not primarily suitable for population attack. The primary reason Russian tank divisions didn't swoop through Germany in the 1950s wasn't because atom bombs would rain down on Moscow (although they would) it was because atom bombs would rain down on the tank divisions.

</comment></comment></comment></comment><comment><USER6> What is the significance of the depth being reported as 10km?

Is that some sort of minimum for a quake, or did they dig down 10,000m to fire this thing off? That seems rather deep even for a large bomb, which this wasn't.

<comment><USER36> Initial reports had it at 10km deep -- which would've been far too deep for a bomb test -- they've since been revised to 0km deep, which is what you'd expect for a test beneath the surface.

The 10km was interesting since if it held up, it would have likely ruled out a test, but it turns out that the first readings were wrong.

</comment></comment><comment><USER37> Wouldn't this cause some kind of an earthquake that's detectable?

<comment><USER38> Yes, USGS has detected it. The question is whether it was a nuke or conventional explosive or something else.

[http://earthquake.usgs.gov/earthquakes/eventpage/us10004bnm#...](http://earthquake.usgs.gov/earthquakes/eventpage/us10004bnm#general_summary)

</comment></comment><comment><USER39> Imagine a world where every country has nuclear weapons and methods of their delivery - a true democracy, or a diversity of democracies you could say.

</comment><comment><USER40> Maybe they should focus their efforts on getting their food production going so their people don't starve to death. Just sayin'...

<comment><USER41> You don't run a totalitarian regime in the interests of your people.

Its profitable to be a kingpin in the NK chain of command. Its what the dick waving of nuclear arms is - look, we have a bomb, give us more free shit.

And it isn't even the threat of war. Its a threat of jumping the shark so they have to be conquered, leaving the region with 25 million destitute refugees to somehow deal with. Just for comparison, the EU is having huge trouble dealing with 11 million Syrian refugees and only 4 million have fled the country.

</comment></comment><comment><USER42> Not for long.

</comment><comment><USER43> Any time discussion of the DPRK comes up, I inevitably see many people repeating blatant lies about the country.

[http://anti-imperialism.com/2014/08/14/western-dprk-propagan...](http://anti- imperialism.com/2014/08/14/western-dprk-propaganda-the-worst-occasionally- hilarious-and-often-racist-lies/)

<comment><USER44> There is plenty of propaganda, sure. However that doesn't mean NK isn't a state dangerous to the world in which you and I live.

</comment></comment><comment><USER45> Good for North Korea!

It's important that there be Mutually Assured Destruction between North Korea the imperialist US-backed South Korea.

We have nuclear weapons. Who are we to say that North Korea shouldn't have them? That just wouldn't be fair.

<comment><USER46> Me. I'll say it.

Any regime which systemstically implements slave labor, mass starvation, and utter lack of human rights should not be allowed to have a nuclear weapon.

We do not want mutually assured destruction, especially with a nation controlled by a non-rational actor. The principle won't operate.

Unfortunately, it is now too late. North Korea has a fusion bomb. Once second closer on the doomsday clock.

<comment><USER47> I would go further and say "nobody should have a nuclear weapon". We only have the one planet.

Can we hurry up and create strong AI already, before someone gets everyone killed?

EDIT: Somehow I didn't expect that offhand ha-ha-only-serious comment to kick off a massive discussion about the capabilities of AI. Fun, but not my intention.

<comment><USER48> Nuclear weapons aren't primarily a threat to the planet, they're a threat to densely populated cities.

Five countries detonated 2,000 nukes over 35 years. You could simultaneously set off every existing nuclear warhead inside of Wyoming and it would have a negligible health impact on most of the rest of humanity. You couldn't come even remotely close to killing everyone with nukes, unless the global arsenals were vastly expanded; the US alone has 27,000 cities. Russia's entire stockpile could kill at worst 1/3 of all Americans, assuming they all worked properly and hit their targets. The notion that nuclear war could end the human race, is entirely a myth (which _is not_ to downplay the actual damage such would cause).

<comment><USER49> Then what's with the "enough nukes to destroy the world x times over" numbers I remember hearing? Have we really disarmed that much? Or were the numbers exaggerated?

<comment><USER48> Nuclear war would severely harm the nations hit. Russia as a nation for example would all but cease to exist, as their population is extremely tightly clustered in the west; the US by comparison is far more spread out (Russia would have to hit every single US city that they could, in order of population, and that still wouldn't destroy the US, but it would clear out their entire arsenal on just part of one nation).

The desire has always been to make sure everyone is properly afraid of a nuclear war, because of the destruction it would indeed cause. It's desirable for it to be considered off the table entirely, a true last resort response. There is a large gulf between an outcome that destroys all of the relevant cities in the US and ending the human race. The 'mistake' is an intentional over-estimation of how much destruction the whole can cause (Why? To properly cause immense fear, so global nuclear war is thought of as a humanity ending event; and that's probably sane reasoning). Back in reality, only a few nations would be heavily destroyed, and the amount of radiation most of the rest of countries would absorb wouldn't matter in regards to _survival_.

Some will claim it would cause nuclear winter, destroy the global food and fresh water supply etc. It wouldn't come close to causing that. Nearly the entire planet would remain fundamentally just fine (the nukes would be focused on urban areas anyway). We know for a fact that large numbers of nuclear detonations (eg 178 in 1962) don't just magically spread globally and start killing everyone via destroying the food supply or other similar mass outcome events. Specific small areas of the planet would not be fine of course, they would be completely destroyed. An extremely small percentage of arable land could be destroyed, even if it was specifically targeted. Within less than a century you'd never know a global nuclear war occurred as far as obvious signs in nature are concerned, outside of the specific areas that were hit.</comment></comment></comment></comment></comment></comment>


We shouldn't let people get used to the idea that software fails - <AUTHOR> https://rakhim.org/2018/07/software-shouldnt-fail <comment><USER2> I've always assumed this will get better with time naturally. There is actually quite a decent expectation on business tools. If GitHub, Jira or our Wifi goes down our whole company knows about it right away and is often crippled by it. That being said, it doesn't happen that often. I grew up having more "snow days" on a regular basis than "all of our tech is down" days today. If anything I find it's more frustrating that software keeps changing on me when I don't expect it. I have old, solid appliances at home and I never expect my fridge or dishwasher will suddenly work differently than it did yesterday. For me, the constant evolution of software gets in my way more than simply bad quality.</comment>


Globally, roads are deadlier than HIV or murder - <AUTHOR> https://www.economist.com/international/2020/01/13/globally-roads-are-deadlier-than-hiv-or-murder <comment><USER2> But unlike either, they make commerce, travel and emergency services possible. What an asinine comparison.</comment>


Life-Hack: Purging Your Closet for Clarity - <AUTHOR> https://www.untuckedstyle.com/life-hack-purging-your-closet/

<comment><AUTHOR> As a follow-up to the BI article about capsule wardrobes ([http://www.businessinsider.com/what-are-capsule- wardrobes-20...](http://www.businessinsider.com/what-are-capsule- wardrobes-2015-4)) I wanted to share the method I use to keep my closet clean.

Does anyone else find routine purges useful? Every time I go through my stuff and clean out things I haven't seen or used in months I feel way better and am able to focus much more effectively. I know this isn't tech related but I wanted to share, does anyone else have a similar habit or routine they do?</comment>


Let's Encrypt, Comodo blamed for issuing phishing SSL certificates - <AUTHOR> http://www.cso.com.au/article/617612/let-encrypt-comodo-blamed-issuing-apple-paypal-phishing-ssl-certificates/?utm_campaign=online-data-security-briefing-2017-04-13&utm_medium=newsletter&eid=-302&utm_source=online-data-security-briefing <comment><USER2> Good! Encrypt everything.

A valid cert should not be an indicator that the content on a given site is verified to not be harmful. It serves as verification that the content you received came from the domain you requested. The role of Certificate Authorities is not to censor content and never should be.

<comment><USER3> Encryption isn't any good if clients and servers can't nonrepudiate the other party.

A web-of-trust overlay, which is non-authoritative, can help against most attacks...

It would make more sense for an international, community-supported nonprofit to take the lead on _opt-in_ , high-confidence identity verification of persons and companies (thorough physical and documentation checks).

Issuing certs to random people without any checks or barriers at all makes it easy for crooks to obtain certs. Comodo/LE are going to have to do some basic checks or major vendors will simply block them until they do.

<comment><USER4> From my experience, until recently, all a SSL certificate meant is you're competent enough to receive mail for postmaster@, and you have a working credit card. With LetsEncrypt, the bar is even lower.

Given the push for 100% HTTPS, of course scammers are going to get certificates for their sites if the cost is low enough (still higher cost than using a lock favicon, but hey). While a traditional CA might require human review to issue a cert for paypalscam.example.org, they would probably issue *.example.org, so a scammer would just have to pay a little more for the wildcard.

Since LetsEncrypt participates in certificate transparency, a benefit is that paypal can watch for all certificates issued with their name in the hostname, and check if they need to start a takedown sooner than if they wait for reports of phishing.

</comment></comment></comment><comment><USER5> A DV certificate does not certify that example.com is trustworthy; it only certifies that the content you're seeing is indeed from example.com. If users are mistakenly assuming DV certs have more meaning than that, then that is a UI issue with browsers, not an issue with the CAs.

</comment><comment><USER6> "Anti-phishing firm Netcraft [...]"

Is this a pivot or just a bad article?</comment>


Ask HN: How do you manage part time projects? - <AUTHOR>

Hi,
We are a team of 3 developers who are working on a part time project (our own product idea), which started as a very simple weekend project, but over the time has grown into a mammoth, which is getting hard to tame.
We do cut down the scope again and again, but it doesn't seem to help. We are struggling with visibility, estimations and eventually control. Everyone is motivated in the beginning, but eventually ambiguity creeps in, which kills the motivation of team with time.
My question is to all startup founders, particularly those who are building MVPs in part time, out there:
* How do you manage your projects so you don't lose control?
* How do you keep ambiguity at bay?
* How do you keep motivation of your founding team up when you're slogging?
Thank you. <comment><USER2> I know it's old fashioned and out of style with kids these days, but I believe there is real value to PM style shown in the book The Mythical Man Month by Fred Brooks. Here is what Brooks might recommend to you:

1\. How do you keep ambiguity at bay?

You have a nailed specification. If there isn't one stop everything and put one into place right away.

2\. How do you manage your projects so you don't lose control?

Someone needs to be the Project Manager. By the way Peter Drucker would tell you that it's hard to be the maker and the manager (in fact he advises against it).

So as a PM you have to estimate man hours (vs. calendar time). Break down every feature and figure out how many hours are required. A trick I use as a PM is I ask my team members "Is this something that takes an hour, a day, a week, a month or a year?". I then track their estimated time based on track record and make adjustments (some coders are good at this, some are bad).

If you add or change a feature, revise your estimate.

3\. How do you keep motivation of your founding team up when you're slogging?

It depends why it's going south: Is this a death march, or is it just a lack of a plan? It also depends on why the team members are doing the project to start with.

<comment><AUTHOR> Thanks @michaelpinto, your comment is helpful. I know some bits of project estimation, but I'm looking for some cohesive strategy that'd help us develop an operating rhythm. I'll read the book you suggested. Thanks for the pointers.

<comment><USER2> You know I think I may have read that book almost 20 years ago and it really changed my life -- good luck w your project!

</comment></comment></comment><comment><USER3> I just have 1 question.

Is the product already out there? (as in a literal MINIMUM viable product?)

If not, then that should be your only goal and 1 strategy towards reaching that goal is to cut-down the time to reach the market.

If your market isn't some advanced technology (like a new performance-enhanced DB), then you should already be out there.

</comment><comment><USER4> Do you all live near each other, or are you remote?

If you live near enough each other, take a whole day off from your project to do something fun, like go to an amusement park.

<comment><AUTHOR> Thanks Michael. We live in same city, but how does taking off a day help in project management?

<comment><USER4> "All work and no play makes Jack a dull boy."

My point is that if you take some time off to do something fun together, then on the days when you are working you'll be more productive.</comment></comment></comment>


Building a Serverless Production-Ready Python Data API on Google Cloud - <AUTHOR> https://medium.com/dataseries/building-a-serverless-production-grade-server-to-server-python-data-api-3ae5eac46784 <comment><AUTHOR> Learn how to start handling security, scalability, access, and documentation in a modern Data API.</comment>


Books Every Geek Should Read - <AUTHOR> http://www.amazon.com/gp/redirect.html?ie=UTF8&location=http%3A%2F%2Fwww.amazon.com%2Flm%2FR1642MCSMBRRWU%3Fie%3DUTF8%26ref_%3Dcm_srch_res_rpli_alt_1%23&tag=offigadg0bb-20&linkCode=ur2&camp=1789&creative=390957

<comment><USER2> Decent start; I've read twelve of them, and none of the biographies. I'm a geek, I guess.

The absence of the Jargon File / Hacker Dictionary must be noted, and ideally, corrected.

Gödel, Escher, Bach would seem to belong as well.

<comment><USER3> Agreed with GED.

</comment></comment><comment><USER3> As much as I love Ender's Game I've turned my head away at it since I found out that Orson Scott Card was an extreme right-wing mormon. While I don't like to attribute a book's content to it's author I feel like this sort of ruins a bit of the book's magic.

Hackers: Heroes of the Computer Revolution was an excellent read and then of course you can't go wrong with Douglas Adams. Excellent stuff.

<comment><USER4> "While I don't like to attribute a book's content to it's author"

Where else should it be attributed?</comment></comment>


Show HN: Have a pug sent to your Snapchat every day - <AUTHOR> https://pug-o-matic.me/ <comment><USER2> I wish they'd use the leaked database to get my phone number and then have pugs call me.

</comment><comment><USER3> I subscribed my wife to it, then discovered she doesn't like pugs. Consider this a feature request for "doodles or corgis maybe".

</comment><comment><USER4> So could we take the list of leaked usernames and subscribe everyone to pugs? Or does it confirm.

<comment><USER5> Thanks for signing up for Pug-o-matic! You will now receive fun daily pictures of PUGS!

</comment></comment><comment><USER6> Who has the copyright for these images?

</comment><comment><USER7> <sarcasm> OP just wants to harvest Snapchat usernames to harvest mobile phone numbers. </sarcasm>

<comment><USER8> That should possibly be <cynicism> rather than sarcasm.

I think it's not a valid concern though... The maker of this app would gain no new information. If the mobile numbers are already leaked, then that information is already out there.

At the most the app maker would be able filter down to the list of snapchat ids which also use hackernews... and this would be less and less accurate as the app spreads and is reposted on other social networks.

<comment><USER9> That was the sarcasm, I think. That there's no need to harvest usernames and phone numbers anymore.

</comment></comment></comment><comment><USER10> There is something going on with pugs. Since getting one we've discovered some sort of cult following - in which we've become victim. For instance, one night I couldn't help myself so I hacked up a quick app - pugrodeo.com for posting pug photos.

</comment><comment><USER11> I started to build something similar myself. Just send a snap to "kittenbot", and you'll get a random kitten everytime you send a snap to it.

</comment><comment><USER12> before i sign friends up for this, i need to know: is there an unsubscribe option?

<comment><AUTHOR> OP here. At the moment, there isn't such an option built in, but removing the friend "pugomatic" on Snapchat directly will do the job.

If anyone has any concerns along these lines, or any other comments, feel free to drop me an email at firstname.lastname@example.com.

</comment></comment><comment><USER13> Signed up for this. Fantastic idea.

</comment><comment> mkr-hn Why snapchat?

<comment><AUTHOR> OP here - it's just an idea that I had at work following GibSec's full disclosure [1] of Snapchat's (ostensibly) private API.

Pugs are a favourite and long-running meme, and Snapchat is very much a part of current internet culture, so combining the two in a new way seemed like an interesting thing to do.

[1] [http://gibsonsec.org/snapchat/fulldisclosure/](http://gibsonsec.org/snapchat/fulldisclosure/)</comment></comment>


Show HN: Papyrus,a simple way to create ebooks - <AUTHOR> http://papyruseditor.com <comment><AUTHOR> Hello HN, I have been building Papyrus for the past few months. It is a simple web app that allows people to create ebooks easily. Would love to hear your feedback.

<comment><USER2> Cool looks very nice! I might use it for my new years' resolution to write something:p I would only be cautious because I'd be afraid of losing data (what if I write a whole book with your site & suddenly you go offline) & on the pdf version there 's also a white border around the book, it might be nice to be able to remove this or change it. For the rest it looks very awesome! Nice templates, easy to use etc=)

</comment></comment><comment><USER3> I recently made a service named Docverter[1] that attacks this from the other end, where you write your book in Markdown or various other markup formats and produce ebook files via pandoc and calibre. It's way more do-it-yourself, but it could be a useful backend for this or other services.

[1]: <http://www.docverter.com>

<comment><USER4> Great tool, thanks for sharing!

</comment></comment><comment><USER5> It's black and white and red all over. Please tell me you deliberately chose that color scheme for that reason. You'd be my hero if you did.

<comment><AUTHOR> To be honest, I am not a designer myself.Experimented with a few colors, this looked decent and pushed it.

<comment><USER5> Oh no, I wasn't commenting on the design really. I think the design is just fine. I was referring to the joke that a comment above me refers to.

"What's black and white and red all over" A newspaper. It's a play on words where "red" is supposed to be "read". I thought maybe you had that in mind when you chose the colors. It would be really clever and funny if you did. If anyone ever asks you that you should totally tell them yes. I bet they'd get a kick out of that.

</comment></comment></comment><comment><USER6> I've wanted something like this for going on two years. I even went so far as to start building it (wireframe: <http://basseq.com/fun/epub/>; some epub publishing code written), too, but lost momentum back in September and it's been sitting in my project folder.

So I'm excited someone took this further. I'll be playing with this more. Drop me a line if you're looking for more thoughts, feature ideas, or help.

<comment><AUTHOR> Thanks ,sending you an email.

</comment></comment><comment><USER7> This looks like a nice service. I could see myself using it. One thing I noticed on the front page is that you do strange things with punctuation. Examples:

"Import the contents from the web . Convert your blog to a book in one click."

Notice the space before the first period.

"Papyrus lets you create books in pdf,epub,kindle formats."

No spaces after commas and no 'and' before 'kindle'. Also, there is no space between the last period and "(Coming soon)" in the two rightmost feature sections.

<comment><AUTHOR> Thanks for the feedback. Will fix it soon.

<comment><AUTHOR> This has been fixed.

</comment></comment></comment><comment><USER8> The terms of service discuss a monthly subscription payment but I cannot find any fees listed anywhere on the website. I assume it's free for now and sometime in the future they'll announce pricing. What if I don't like the pricing model? Can I export my content and sell my book somewhere else? How easy is it to get my book out of Papyrus?

<comment><AUTHOR> The books are available as epub,pdf and mobi as of now.All the content that you would create will be yours forever. You could always sell the books on any platform you like.(Like iBooks,Kindle,Nook). Example of a book created using Papyrus and being sold on Amazon <http://www.amazon.com/dp/B009OU5E3K>

</comment></comment><comment><USER9> Looks great!

One note - I happened to have my screen quite narrow when I opened it and as the menu-bar wrapped around it obscured the "Import Chapter from Url" button. The introductory guide pointed to where it thought the button should be but it was just highlighting a corner of the "Feedback and Support" button.

</comment><comment><USER10> Tried creating an ebook out of some of my old blog posts. Import from URL feature is pretty cool. Loved it. The frictionless way to try the app is also great. Bookmarking the site. Can I import a couple of my Dropbox docs directly?

</comment><comment><USER11> Looks great. Nice feature that you can import content from any url. It's good that you can get started and see the product without signing in. Also a good guide.

<comment><AUTHOR> Glad that you liked it.The guide was inspired from <https://github.com/Gild/bootstrap-tour>

</comment></comment><comment><USER12> It should probably have a word counter. Also a spellchecker? Chrome seems to identify the spelling errors, but I don't know if all browsers have this.

<comment><AUTHOR> Thanks. We will try and add these features soon.

</comment></comment><comment><USER13> Nicely done - I too was looking for pricing information but after reading comments here see that its still in development. Bookmarked - good luck!

</comment><comment><USER14> Neat Design! Great UI Experience!! Really dig the "origin of species theme" and in app walk over.

Really Usable Product. Would love to publish some books with this.

</comment><comment><USER15> How does this differ from Pressbooks? <http://pressbooks.com/>

<comment><AUTHOR> Its different from Pressbooks

1)Has a cover designer built into the app

2)You could import content directly from anywhere on the web. (File import coming soon)

3)There are a set of themes,you could choose from.(Abilty to customize themes and a few more themes will be rolled out soon)

4)This might not be a differentiating factor,but we have tried to keep the editing process simple.

</comment></comment><comment><USER16> I have to admit that I prefer <http://leanpub.com>

<comment><AUTHOR> Would like to know your thoughts. Your feedback would be very helpful

<comment><USER4> Why don't make a small comparison table vs other similar products to clearly show the benefits of using your product?

</comment></comment></comment><comment><USER17> this is neat - all went good, until I incidentally pressed the 'clear canvas' button on cover page. no undo there?

looking forward for more advance features - full screen, double page editing, collaborative editing and review comments ?

<comment><AUTHOR> Thanks for trying out Papyrus. Will try and add these features soon.

</comment></comment><comment><USER18> Firefox user here. What technology do you use to limit the page to WebKit only?

<comment><AUTHOR> The editor is basicaly, a div with contenteditable. The implementation varies across Gecko and Webkit. We are working hard to add Firefox support.

<comment><USER18> Good to hear! I'm curious to see the result.

</comment></comment></comment><comment><USER19> Seems like a nice utility for fast ebooks. Going to my bookmarks :)

</comment><comment><USER20> Great app... Liked the import from url feature..

</comment><comment><USER21> looks great, is it going to be a free service ? i don't see any pricing page!

<comment><AUTHOR> We are still building the product. We will add pricing plans soon.

</comment></comment><comment><USER22> Finally out! Congrats!

</comment><comment><USER23> Great !! All the best!

</comment><comment><USER24> I went straight into book editing mode, since I plan on publishing an ebook in the following months.

The experience has been slightly frustrating. For instance, Shift+Enter when editing the contents of the title doesn't work as advertised. And when trying various things in desperation/frustration, a section of text popped up on me from nowhere, and I couldn't find a way to remove it.

I'd say the product has a lot of promise, but you have a long way to go until you reach MVP stage.

<comment><AUTHOR> Apologies that you had face issues while using Papyrus. I agree the product is still far from perfect. We are working hard to fix the bugs.

Thanks again for trying it out.</comment></comment>


Jsfiddle with 500 Internal Server Error, Twitter with Overcapacity - <AUTHOR>

What's going on? <comment><USER2> Start by checking Twitter's API health page:

<https://dev.twitter.com/status>

Which links to, e.g., what looks like big problems with the home timline:

[https://status.io.watchmouse.com/7617/125017//statuses/home_...](https://status.io.watchmouse.com/7617/125017//statuses/home_timeline-\(OAuth-1.0a\))

I realise that I do a lot of Twitter and other API development, and so it's easy for me to say, but I don't think it's too crazy to suggest you should be looking in their general direction for answers first.

<comment><AUTHOR> Thanks mootothemax!</comment></comment>


Hackers Build a Skype That's Not Controlled by Microsoft - <AUTHOR> http://www.wired.com/2014/09/tox/

<comment><USER2> Oh, they're talking about a Skype _network_ alternative. I was excited for a moment to hear about a Skype _client_ alternative. Oh well.

<comment><USER3> There are Tox clients and in many ways they are on part with Skype. You can use it today.

Edit: oh wait, I see what you mean now. Sorry I read that on my phone at first, missed what you where getting at.

Yes, it's a new IM client/network. However, it's much more secure, and decentralized. It's pretty cool.

<comment><USER4> if switching IM _networks_ was as easy as that, Skype would already be on the way out. We use skype because everyone else uses skype.

</comment></comment></comment><comment><USER5> Sounds like either they're not aware of Retroshare (uses Qt for GUI), or they think developing in C++ is too much of a hurdle.

It's peer-to-peer, uses web-of-trust, completely encrypted, already has chat/mail/"www"/voice chat/file sharing/etc. Still missing the video chat plug-in though, but it's on the to-do list.

<comment><USER6> I'm more surprised there is no mention of Jitsi, a project that has been around for years. Tox is barely usable across multiple platforms.

</comment></comment><comment><USER7> So how is this an improvement over things, like, for example, XMPP?

It's easy to stand out when comparing to the worst alternative out there.

<comment><USER8> Very little configuration required seems to be one main idea. The most important reason I have been interested in Tox is that I got the impression early on that they intend to make it resistant to traffic analysis as well (and judging from this thread [http://4chanarchive.net/threads/g/Tox- Thread/43340618](http://4chanarchive.net/threads/g/Tox-Thread/43340618) there are still such plans) but that isn't emphasized in the page at tox.im any more.

I'm guessing they're prioritizing getting something that the average Skype user would be capable of installing and configuring, and saving the onion routing feature for later.

<comment><USER9> I do think that a directory service for search/lookup may be desired as well... where people can upload their device key(s) and bind to say their email address or other handle for search/discovery.

</comment></comment></comment><comment><USER10> I've seen Tox before and looked into it. Think I've commented on it before, but maybe not, so here's my take: Nice sentiment. Doesn't yet quite live up to what it wants to be. But if the project can listen and adapt to advice like this, it has scope to improve and be a really important contender.

Firstly, it _needs_ metadata protection with onion (or, better, garlic) routing. Without that, it still has a pretty big mass-analysis flaw. Please look at I2P for an example of the kind of architecture that would work well: two DHTs with decoupled garlic routing in between? You may, or may not, leverage an existing network for that; there are some obvious cover-traffic advantages if you do, but it's less synergistic.

Secondly, I don't see a full forward-secure messaging ratchet in there, it's really per-session. Look into Axolotl, and in particular what TextSecure v2 aka Signal has done for group chats too. Tox - using libsodium - already has every tool it needs to do that, it just doesn't do it fully yet.

Thirdly, more stability. The susceptibility of the DHTs to resource-starvation attacks. (I don't think I2P ever actually implemented the hashcash it planned for?) But there's been some further work on that. Scalability is tricky, especially in the face of on-path attackers...

Skype is pretty awful. It's actually pretty much centralised now, using TLS, but still runs much like the bad P2P network it used to be: closed-source software with a bad reputation for eating 100% CPU and awful chat desync. Most people who use it would rather be using something better, and I think there's plenty of scope there - people _would_ switch if there _was_ something better. Let's make sure an alternative is _much_ better?

Oh, maybe look into a distributed consensus protocol of some form for name registration - _if_ it's possible to do a light one which can impose ordering...

I've not performed a full security review. It's too young for that, and it's too young to rely on. When the above are addressed, then it's time to give it a more thorough look. /akr

</comment><comment><USER11> Ok, my grandmother can use Skype now. And yes, she has to use an instruction guide I printed out for her. My question: Would my grandmother recognize this as an alternative to Skype?

<comment><USER12> Will she recognize Skype next month? I find printed manuals have to be changed every time Skype updates something...

<comment><USER13> Being on a Mac, I wasn't aware that Skype updated very often.

And to the OP, it doesn't sound like this product is grandmother-friendly yet.

<comment><USER11> Thank you!

</comment></comment></comment></comment><comment><USER14> Here's a little more technical information: [https://github.com/irungentoo/toxcore](https://github.com/irungentoo/toxcore)

</comment><comment><USER15> Isn't [https://appear.in/](https://appear.in/) and it's ilk "a skype not controlled by Microsoft" to some extent? AFAICT it creates an SSL secured peer-to-peer connection.

</comment><comment><USER16> So it's a Skype that's controlled by hackers?

<comment><USER17> 4chan'rs.

</comment></comment><comment><USER18> seems like a good project. how is it different from say, mumble? [http://wiki.mumble.info/wiki/Main_Page](http://wiki.mumble.info/wiki/Main_Page)

<comment><USER19> Mumble is a low latency chat server. You join a server, people join your channel, you chat. Its designed for public group conversations, like in games.

Tox is more like Skype, but it has no central server. You add friends to a buddy list and chat with them, you add more people to the chat and it becomes a group chat.

</comment></comment><comment><USER20> What's wrong with WebRTC?

<comment><USER21> Some context please?

<comment><USER20> WebRTC allows peer-to-peer video conferencing through a web browser without a third party server. Which means there is no intermediary server to record the data.

<comment><USER22> Actually any peer-to-peer communication system has the property, regardless of the existence of a 'rendezvous' server to get them connected.

<comment><USER20> OK so what's wrong with WebRTC? Why do we need this other client they just invented?

<comment><USER22> WebRTC is just a protocol. You can use it any way you like. Lots of folks use it to talk to a switching server, probably because P2P IP connections can't always be made, while a server connection is guaranteed to work.

</comment></comment></comment></comment></comment></comment><comment><USER17> This is on the same level of security as OpenSSL and CryptoCat.

<comment><USER23> The crypto appears to be fairly standard - it uses NaCl's crypto_box to encrypt and decrypt almost everything, with a per-session keypair authenticated by the user's long-term key. Code quality is a bit OpenSSL-esque though.</comment></comment>


Hacker News: Welcome (repost) - <AUTHOR> http://ycombinator.com/newswelcome.html <comment><AUTHOR> I listed these things in response to a question elsewhere[0], but I thought it would be useful to have them in one place. Many people here registered before the welcome message[1] existed, certainly I did, so I thought I'd gather various bits of advice in one place.

The welcome message[1] is worth reading and keeping in mind - it tries to help impart the intended culture of HN. I know I've fallen short of its standards at various times, I felt a little embarrassed re-reading it.

There's obviously the FAQ[2], but that's lunk to at the bottom of most pages.

Perhaps less well known is jacquesm's[3] Unofficial FAQ[4]. It's a little out- of-date and there are more things that now could be added, like the new(ish) flamewar detector, but it's still useful, and it really does answer some common questions.

What will you add to HN in 2014?

</comment><comment>==

[0] [https://news.ycombinator.com/item?id=6965891](https://news.ycombinator.com/item?id=6965891)

[1] [http://ycombinator.com/newswelcome.html](http://ycombinator.com/newswelcome.html)

[2] [http://ycombinator.com/newsfaq.html](http://ycombinator.com/newsfaq.html)

[3] [https://news.ycombinator.com/user?id=jacquesm](https://news.ycombinator.com/user?id=jacquesm)

[4] [http://jacquesmattheij.com/The+Unofficial+HN+FAQ](http://jacquesmattheij.com/The+Unofficial+HN+FAQ)</comment>


Imaginary Numbers are Real - <AUTHOR> https://www.youtube.com/watch?v=T647CGsuOVU <comment><AUTHOR> A great series that explains how imaginary should be thought of as, not imaginary, but "lateral" to real numbers - meaning they extend real numbers into another dimension.</comment>


Colonising Mars is unlikely and a bad idea - <AUTHOR> https://theconversation.com/sorry-elon-musk-but-its-now-clear-that-colonising-mars-is-unlikely-and-a-bad-idea-100964 <comment><USER2> I found this article incredibly frustrating to read. It doesn't do anything to support either of its two titular stipulations.

The best I could find as to why colonizing mars is unlikely:

> But according to a new study, published in Nature Astronomy, Mars has lost > so much of its potential greenhouse gases to space over billions of years > that there is now no possibility of transforming the remaining atmosphere > into a breathable one with available technology.

... of course terraforming Mars would be difficult with available technology. Certainly the author doesn't imagine technological process standing still?

On the second stipulation, that colonizing Mars is a "bad idea," could we please get there first then figure out the ethical issues? Does the author really think we should have a perfectly correct ethical plan of moving off of the planet?

<comment><USER3> I thought there was one clear assertion in there:

1) Previously, terraforming was thought to be possible, given there being enough trapped greenhouse gasses to establish an atmosphere

2) Recently, it was shown that there is not enough trapped greenhouse gasses to establish an atmosphere

3) Therefore, terraforming Mars is seen as far less possible (or alternatively, would require much more advanced technology) than before.

<comment><USER4> We've long known that we need more nitrogen. One idea is to use ammonia asteroids, which do double duty as a greenhouse gas ...

[http://www.users.globalnet.co.uk/~mfogg/zubrin.htm](http://www.users.globalnet.co.uk/~mfogg/zubrin.htm)

</comment></comment></comment><comment><USER5> Searching for life robotically would take centuries not "years or decades." And the idea that human colonization will wait until we're sure we're not disturbing nature is a non-starter. We'll go to the moon when we are technically and financially able.

And nothing in the article indicates why terraforming is unfeasible, except the caveat of "with available technology."

</comment><comment><USER6> This reads like a piece that is just meant to garner attention since Tesla is high up in the news cycle (as usual).

</comment><comment><USER7> The primary points the article raises are:

* Potential life after recent detection of suspected liquid deep water

* Not enough reserves of gases remaining to eventually thicken the atmosphere

* Lack of a magnetic field to preserve the remaining and new atmosphere if created

1\. Life has always been possible on Mars. The discovery of liquid water improves this but doesn't affect possible colonization efforts. Short term, people will be setting up to survive either on or near the surface. It will be important to stay away from such areas except for study, but that doesn't preclude human settlement efforts.

2\. Terraforming in any form is a long term (centuries) goal. The state of the atmosphere won't degrade in anymore significant way in the mean time. There are more than enough resources in the solar system to import material if that ever becomes a goal for Martians.

3\. There are proposals already for satellites in Lagrange points between Mars and the Sun to generate artificial magnetic fields to slow down and prevent the stripping of the atmosphere. By the time technology like this is required, millions of people will already be living there for at least a century or more.

So overall the gist of the article would be like telling colonists to the Western Hemisphere in the 1500's that it's not worth trying because building a highway across the continent is impossible with current technology. While true at the time, there was no need for such a long term goal back then and wasn't for centuries.

Plus one thing about Mars is that no one's there to displace. Scientifically I care a lot about planetary protection and discovering if life exists there, but that is ultimately less important than colonizing Mars. It's not like it's going to spring complex life on its own and we would ruin those chances. It's a planet's worth of gravity and natural resources that aren't going to do anything on their own.

</comment><comment><USER8> Really terraforming Mars in itself is peripheral to if we can colonize it. Creating a vast possibility subterranean "bubble-city" is technically also a possibility that would reduce the needed gases by orders of magnitude. It would probably also call for a lot of design work to be psychologically tolerable to its residents long term. The why bother remains the same however - unlikely to pay off directly in itself but the research from trying will likely have other applications. Emergency backup for humanity is likely the biggest "practical" reason.

Technically we could theoretically recreate a magnetosphere and import gases from other sources but calling it recordbreakingly expensive would be a massive understatement. Even attempting it calls for a degree of megalomania.

</comment><comment><USER9> Honestly, I see no point in colonising Mars when there are still places like the Antarctica and ocean floor which are, with all the difficulties, much more hospitable and easier to reach.

</comment><comment><USER10> Article mentions nothing about why it's a bad idea...

<comment><AUTHOR> I didn't even realize that. I guess that with hopes of finding new life at their highest ever, we wouldn't want to contaminate that (if that's the right way to say it).

<comment><USER11> I'm not sure that is the right way to see it. If we did find life on Mars would that mean humans could never travel there? I don't so. More than likely we need to transplant Earth life to Mars for large scale terraforming.

</comment></comment></comment><comment><USER12> Let's get to Mars first before worrying about whether colonizing it is feasible.

</comment><comment><AUTHOR> The part that I've been asking myself for years, is how do you create an atmosphere without (or almost without, can't remember) a magnetic field. Is it possible or we would have to generate one?

<comment><USER4> > While it is true that the solar wind has stripped Mars of much of its > original atmosphere (due to the lack of the planet's magnetic field), and > that any man-made atmosphere on Mars would eventually be dissipated by the > solar wind - the speed at which this occurs is measured over geological time > frames - on the scale of tens, if not hundreds of millions of years. If > humanity were to create an artificial, life-conducive atmosphere on Mars, > any atmospheric output due to economic activity (CO2 + other gases) would > easily exceed any atmospheric losses. Thus, the atmosphere would be stable.

From ... [https://www.reddit.com/r/SpaceX/wiki/faq/mars#wiki_what_will...](https://www.reddit.com/r/SpaceX/wiki/faq/mars#wiki_what_will_colonists_do_to_stop_mars.27_terraformed_atmosphere_being_lost_to_the_solar_wind.3F)

</comment></comment><comment><USER13> The idea that humans shouldn't expand into the cosmos for fear of displacing some xenoplanktons is nuts. I'm not anti-xenoplankton, but I'm very pro-human. We will inherit the stars.

</comment><comment><USER3> I thought the plan to bomb the poles wasn't just to melt ice, but also to restore the magnetic field to help trap the atmosphere from escaping, is that true?

</comment><comment><USER14> Clickbait nonsense. Remove this article.

<comment><AUTHOR> I understand that this isn't a very great article, but like I thought would happen, it started a nice discussion here. I love the quality of comments on HN.

</comment></comment><comment><USER15> tldr; The author wishes to speak for " _the world_ " but only shares an opinion with people who would not be interested in risking, indeed, devoting their lives to forging civilization in an inhospitable environment.

Truth be told, lots of people would be interested in giving it a shot. This leaves the idea in a space of political hazard, as a high risk zone for cults of various flavors, each according to leaders that manage to establish themselves or stir vectors of internal influence.</comment>


ProtonVPN - <AUTHOR> https://protonvpn.com/secure-vpn <comment><USER2> For the free version, the speed is "low". How low exactly? What does it limit download speed to? If it is good enough to stream videos, this might be truly disruptive. Good, free(without a data cap) and secure VPNs don't really exist, so This VPN, especially with Proton's reputation with their mail, might become my go-to VPN

<comment><USER3> Hopefully it is not fast enough to stream videos. Because if it is, it certainly won't last. No one can afford that kind of bandwidth without monitization.

</comment></comment><comment><USER4> The only real distinction from other VPNs I see is this:

> ProtonVPN's Secure Core architecture gives our secure VPN service the unique > ability to defend against network based attacks. Secure Core protects your > connection by routing your traffic through multiple servers before leaving > our network.

Sounds a bit like a private-label Tor.

<comment><USER2> > Sounds a bit like a private-label Tor.

Aka: insecure Tor

<comment><USER5> AKA: Tor without websites blocking you for accessing through Tor.

<comment><USER4> For a minute.

</comment></comment></comment></comment><comment><USER6> What are the "interesting security features" vs using, say, IPVanish?

</comment><comment><USER7> Note: "interesting" parts are not included in the free offer.

</comment><comment><USER8> Excuse my ignorance, but how does this compare to a service like PIA?

<comment><USER9> From what I've read, there's a fair bit of concern about the trustworthiness of other VPN providers [1]. Perhaps this is more trustworthy because it's from the people who did ProtonMail.

[1] [https://arstechnica.com/gadgets/2017/05/how-to-build-your- ow...](https://arstechnica.com/gadgets/2017/05/how-to-build-your-own-vpn-if- youre-rightfully-wary-of-commercial-options/)</comment></comment>


Saving 9 GB of RAM with Python's __slots__ (2013) - <AUTHOR> http://tech.oyster.com/save-ram-with-python-slots/

<comment><USER2> Some interesting discussion from about a year ago:

[https://news.ycombinator.com/item?id=6750187](https://news.ycombinator.com/item?id=6750187)</comment>


Nearly Half of Men Say They Do Most of the Home Schooling. 3% of Women Agree - <AUTHOR> https://www.nytimes.com/2020/05/06/upshot/pandemic-chores-homeschooling-gender.html <comment><USER2> Seems like flamebait.

A modestly more interesting set of questions would ask how spouses _feel_ about their level of contribution. If you don't feel like you're getting the short end of the stick, you're probably not. Couples continually strike a balance as to what's fair overall, and few marriages survive when this doesn't happen.</comment>