Mir in Kubuntu - <AUTHOR> http://blog.martin-graesslin.com/blog/2013/05/mir-in-kubuntu/

<comment><USER2> There's a mirrored version of the article in planet kde: <http://planetkde.org/#item-f97a50b7>

</comment><comment><USER3> There's a lot of truth here but the article seems to overstretch at times. The benefits of TDD are many, and I don't understand the logic of refusing to use a GPLv3 component because you're worried about GPLv4.

<comment><USER4> TDD is controversial. Mir is GPLv3; lots of free software, including KDE, is GPLv2+. Incorporating Mir into KDE would move everything to GPLv3; if there is ever a GPLv4, no software under that license could ever be integrated into KDE (since Mir does not have the usual "or a later version" phrase.)

<comment><USER5> I don't really understand why TDD is controversial.

When we build software we are building a machine with components. In every other industry where a machine with components is being created they apply test-driven-development. A component is rigorously tested over and over and over again until it meets the specifications.

I would not trust a car where every component inside of it wasn't rigorously tested in such a way. Otherwise I cannot credibly make the claim that a bug won't show up when I'm driving the car around on a highway that hadn't appeared in development. TDD doesn't eliminate this risk, but it gets us a lot closer.

<comment><USER6> It's free software. There is a large overhead when doing TDD. Such overhead is not practical given the low, voluntary, resources such projects get. Free software project velocity is based on contributions. If you require such contributions to also make tests before committing the code, then you kill the project in a few months. This is why TDD based projects are so few and controversial in the FLOSS world.

<comment><USER7> > There is a large overhead when doing TDD.

I don't think that's true.

There may be a requirement to do unsexy tasks that volunteers aren't interested in, but the actual overhead to create software that works as intended is lower doing TDD than without it, which is the whole _point_ of TDD.

<comment><USER8> TDD creates a large maintenance overhead. It more than doubles the code that has to be maintained for the lifetime of the software. This is by design since any modification to the codebase should start with a modification to the tests.

In reality though the tests often bitrot faster than the actual code does. The cost of the very large set of unittests generated by TDD only grows over time without contributing to the actual feature set of the software being developed. For this reason TDD does in fact introduce a large overhead with a potential savings in safety.

The controversy is introduced when people start to realize that the most bang for the buck comes from tests that exercise the public interfaces of the various parts of the software and that less and less benefit comes from the tests covering the internal parts of the software. Often the fine grained tests covering the internal details cause the internals to ossify and increase the cost of changes until finally they get abandoned.

TDD has it's place but taken too far it can do just as much harm as the lack of tests.

<comment><USER7> > The controversy is introduced when people start to realize that the most > bang for the buck comes from tests that exercise the public interfaces of > the various parts of the software and that less and less benefit comes from > the tests covering the internal parts of the software.

That's not TDD being controversial, that's details of how to apply TDD being controversial at most (and, really, its seems to be a "controversy" that amounts to saying "doing things that TDD doesn't ever call for is excessive", with no other side, which isn't a controversy, its a non-sequitur; if you are creating unit tests for internal details that aren't exposed, you are _preventing_ refactoring, rather than _enabling_ by testing all and only the required exposed behavior so that you can refactor the implementation of that behavior _without changing tests_ , which is a central part of TDD. I suspect the problem with this is bad _metrics_ used by some people who say they are doing TDD but have adopted measurements that imply standards that forget about the entire point of TDD, such as looking to ensure that every method is directly tested, which is clearly inappropriate.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> From all that verbiage I was able to extract that Mir might screw up community supported Ubuntu-derived distributions. I can see how some people would like their road map explained.

I was hoping there would be a real comparison of Wayland and Mir development. It seems like they may be identical in effect, and both will enable using Android HAL implementations in mobile devices.

I had an occasion to ask a Linux kernel developer about this and got an answer long the lines of "Why ask? Only Ubunutu will use Mir."</comment>


Penny Arcade Sells Out - <AUTHOR> http://www.kickstarter.com/projects/575109064/penny-arcade-sells-out <comment><USER3> This is interesting territory for Kickstarter. They've been clear throughout that they'd like to fund specific, time-limited projects, e.g. someone producing a book, and _don't_ allow general fundraising to operate a business, e.g. raising funds to pay a year of salaries and rent for an ongoing business.

There's a way you can squint and call this a specific project, a time-limited "remove ads from PA for a year" experiment. But it sure looks like it's getting close to that raise-general-funds line that Kickstarter claims to not want to cross. In particular, the "costs" of the project that are being funded are entirely notional opportunity costs (foregone revenue), not actual expenses, whereas KS claims to be oriented towards raising funds for actual expenses that are needed to complete projects.

I doubt they'll pull this particular one, even if they determine it does violate their ToS, because PA is too high-profile (and, perhaps, because PA has fans known for being somewhat vindictive). But it seems like they'll have to either do something to prevent more of these kinds of Kickstarters going forward, or else just drop that language in the ToS and agree that anyone can use KS to raise a year of operating funds for their business.

<comment><USER4> > I doubt they'll pull this particular one

As I understand the process, applications on Kickstarter go through a screening period that can take weeks. You're right that this "project" is on the borderline of the site's intended use, but I think if they didn't judge it appropriate we'd never have even known it existed.

<comment><USER5> "Takes weeks" seems high. As a data point, my May Kickstarter submission was approved after 27 hours.

But your point is true--Kickstarter almost certainly approved this project before it launched.

</comment></comment></comment><comment><USER6> Looks like the arts patronage is back.

People often ask what there could be instead of copyright, and patronage is one of the options.

Besides targeted donations like this, you could have a general fund (restricted geographically, or worldwide), and pay a portion of it out based on viewership.

Anyone who donated anything at all to the fund gets to go to the performance/movie/play/circus, etc. They count how many viewers they had, then they get a proportional amount.

In exchange they don't claim copyright, only moral rights.

To encourage donations people above certain funding levels get extras, like backstage visits, lunches, public thanks, etc.

<comment><USER7> So under the pay-proportional-to-viewship model, artist A runs an intimate orchestral music performance and 10 people donate $100 each (because hey, orchestras are expensive to run); and artist B runs a punk performance in a warehouse where 1000 people pay £1 each. Under your model, the punk performers would make $1980 and the classical performers would make $20 - right?

<comment><USER6> Under this model yes, but no one said this was the only possible model. It's an idea, not a fully fleshed out proposal.

First, people can give directed donations if they like.

There would be multiple funds, so presumably the funds would differentiate based on genre. And people would sign up for the funds that have the type of entertainment and art (or even lectures) they prefer.

Everything here is completely voluntary. The funds would act as agents, and advertisers.

A fund would attract a performer based on how good a job the fund does on getting that performer an audience. A performer would attract a fund based on how happy people are with the performer. People would sign up with a fund based on the quality of the performers.

So if a performer is not happy with his cut of the donations they would find a different fund. If a fund is not happy with how many people are donating they would try to find better performers. And if the donors are not happy with the types of shows they would find a different fund.

So the incentives are all aligned properly. (As long as people are actually willing to donate.)

It would probably require some fine tuning to get it right. In particular there is a strong network effect, and positive feedback (the larger you are the larger you get), so this will have to be toned down somehow.

This is sort of like a subscription model, but for live events. This could of course be done while maintaining copyright, but the whole idea is to find an alternative to that.

<comment><USER8> It seems to me that you have introduced an unnecessary third party to the problem (the agent) that holds the same power and position as the current problem party in the copyright arena (the publisher/label). The interesting development in recent years has been the removal of this party from the equation (self-pub ebooks, kickstarter etc.) so it would be a shame to bring it back.

<comment><USER6> I would solve that by either not allowing exclusive contracts (so a contract is only for a specific performance) or by limiting all contracts to a maximum of one year.

I would also legislate that all agents get the same percent of the donations as fees. Not sure how much, but under %25. By not having to negotiate this part of the contact agents would be motived to compete on quality - <USER2> like how often they would advertise, how good the venues they could get, etc.

</comment></comment></comment></comment></comment><comment><USER9> Interesting take on the crowd funding issue.

I expect to see more of these sorts of creative things. Advertising debt is annoying. And sadly people like PA with their 2 ads get nailed because people have been so massively inundated with ads all day that even one more is painful.

Another experiment they haven't tried, but would be good to run, would be to make the site subscriber only with the long tail free. So imagine a site where if you subscribed it was ad free and every few days you got a new comic. There is the 'free' site which is content that is a year old and has advertising on it, and there is a totally free site which has the two years old or later and its got no ads on it.

Of course its not as useful for topical content but its an interesting experiment.

<comment><USER10> Unfortunately for PA, their content is probably 90% games/pop culture topical. After a month it'd be completely stale and irrelevant (with exceptions of course).

I think the better move would be to have pay users not have to see any ads. Simple web re-design to remove that for pay users, otherwise free users still have to look at the ads. There are a ton of sites that do this and are quite successful.

<comment><USER11> What's a site that _only_ offers "no ads" as their paid-upgrade benefit? I haven't seen one offer just that, it usually comes with a grab-bag of other features that can't be replaced with a client-side script/extension. (DeviantArt's premium account is the upgrade I thought of. (<http://sta.sh/047k5sokcr2>) The two major client-side features of no ads and more thumbnails are solved with NoScript and AutoPager respectively.)

<comment><USER10> Off the top of my head, Wowhead offers an ad-free version for premium customers. I guess you also get custom forum avatars for being a premium customer.

The point is, free site that is ad-supported but those go away with a membership - whether you get extras or not.

</comment></comment></comment></comment><comment><USER12> What's wrong with the lwn model of subscription? Don't subscribe and you get info a week old (lwn is a 'current affairs' site like PA is, hence time- dependent), subscribe a small amount and get your benefits.

<https://lwn.net/subscribe/Info>

The kickstarter thing for a year's business costs are basically an old- fashioned subscription drive - who wants to see brand-name websites doing this every year? Welcome to a new form of spam.

</comment><comment><USER10> I enjoy Penny Arcade. That said, it seems like an awful lot of money for an ad-free website.

Aren't they making enough off of merchandise, their expo, their games, etc., to make the site ad free? From what I understand they are wildly successful (monetarily as well as publicly) so why do they need the public to literally give them money?

<comment><USER13> From the FAQ:

Advertising paid for rent, wages, health insurance, utilities, all the normal stuff that you pay for when you have fourteen souls working together. That money keeps the lights on while we do the things people expect from us: thrice weekly content drops, two annual shows, the scholarships, Child's Play, etc.

<comment><USER10> > two annual shows, the scholarships, Child's Play

The shows make money, otherwise they wouldn't do them. By most accounts they make _a lot_ of money. PAX Prime 2011 had 70k attendees (according to Wikipedia) and at $65 a pop that's a hefty (~$4.5 million) in revenue not to mention what exhibitors pay (which can't be cheap for the target audience). They make more than enough money off of this to go ad free.

The scholarships are their problem, the comic reader gets nothing out of those except warm fuzzies.

Child's Play should be able to maintain itself on low overhead and a non- profit status. It should cost them a minimal amount of money and any it does the company can directly write off.

<comment><USER14> Raise the price of a PAX ticket $15 to take a bite out of the scalpers, and boom, $1 million.

</comment></comment></comment></comment><comment><USER15> For $500, they will retweet one of your tweets "within reason".

Wow, put me down for TWO!

<comment><USER16> The rewards are totally lame, and insanely priced. I love the comic, and really it's not worth a dollar of mine to remove the ads I don't even look at. The Kickstarter goal doesn't even remove the ad from the Comic page.

<comment><USER17> You aren't really paying to remove the ads.

There's a couple of comics I'd like to see on Kickstarter this way, because I wouldn't mind tossing them some bucks, but all they have are merchandise (which I've already bought) and PayPal links. Sorry, no, no PayPal. I wouldn't really care about the rewards, I've already received them.

<comment><USER18> I'm curious: why no PayPal? Unless I'm misreading your tone it sounds like you're pretty adamant about NOT supporting a comic through PayPal. Why?

<comment><USER17> I'm not interested in using PayPal again, and my desire to support the comics does not rise past that threshold. Wouldn't call myself "adamant" about either, but I definitely do not wish to use PayPal.

<comment><USER18> Fair enough - I appreciate the explanation. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER19> I really _really_ wish the flattr model would take off for stuff like this. Each and every site having a huge fundraiser once a year like this seems unsustainable.

<comment><USER20> It works for public television.

<comment><USER21> It works because you have only one public television organization in your town.

<comment><USER22> There are many listener supported radio stations in single markets. e.g. WBUR, WGBH, and WBAI in Boston.

</comment></comment></comment></comment><comment><USER23> How is this a "project"? This sounds like crowdfunding on-going business costs.

</comment><comment><USER24> Weird, I never minded the ads on PennyArcade. They were usually cool games or at least gaming related merch. It was clear they didn't let just anything on there...

</comment><comment><USER25> An internet without ads would be amazing.

<comment><USER26> A $45 billion kickstarter for 2013 should do the trick for the US market.

<comment><USER27> I'll link you to adblock for $44 billion and 50 cent.

In fact, let me write up a kickstarter proposal.

<comment><USER28> I lol'ed ;)

But in seriousness, an internet without ads is about way more than just not seeing banner ads. Penny Arcade puts it very well:

"Not having ads would create a chain reaction that would lead to a bunch of other interesting stuff. Without the almighty 'pageview' to consider, why not populate the RSS with full comics and posts? Why not enable and even encourage apps, first and third party, for people to read it however they damn well please?"

<comment><USER27> I recognize that and I think it's an interesting question (and translates well to all the "twitter is screwing its app ecosystem again" drama), but the way Penny Arcade are going at it is a kickstarter project where they're effectively selling the privilege of not seeing ads for $250k a year. There is competition for that niche, and I think PA would have done well to actually over a product for what they're asking.

<comment><USER29> The penny arcade guys aren't exactly here as business men. Hack when they finally got someone on board to mange their site he was shocked that they nearly got bought twice, and that they still barely had an idea of how their income worked.

I think they are appealing to their community, and people who find stuff like child's play, pax and the rest to be great.

</comment></comment></comment></comment></comment></comment><comment><USER30> Honestly, those I know who read PA don't find it annoying. Those who do, have an AdBlocker.

(While I am anti-AdBlocking software, that is a conversation for another time.)

</comment><comment><USER31> Somebody really needs to make a startup where, when you visit a page, you can either view ads, or opt out by paying a really teeny tiny amount of money. (And where you can set it to "always opt out and just pay for my damned content.")

Problem? You can't really charge people tiny fractions of a cent effectively. Solution? Bit... wait for it... coin.

<comment><USER32> Does that then make somebody with an ad blocker a thief? Because I don't like the sound of that at all.

<comment><USER33> These days you could simply cover the right side of your monitor with a small piece of cardboard and never see ads again. OR - simply don't look. A part of me thinks non-adword based advertising is going to implode because we are creating a generation of internet users that have been trained through high- use to simply ignore ads.

<comment><USER34> A solution (e.g. used in newspapers) is to make the ads like normal content (just saying "ad" above in fine print).

(On the other hand, I have trouble reading the webpage of a big electronics store because their whole site looks like an obnoxious ad and is filtered by my brain.. )

</comment></comment></comment></comment><comment><USER35> I love PA. I hate kickstarter because it is operated in a disorganized manner so I feel like I have been bait & switched.

See comment by "Joseph P. - PLEDGE THIS. "

Penny Arcade's violations of Kickstarter guidelines:

1) This is for an open-ended project 2) The funding covers business expenses 3) The rewards are not produced by the creators

</comment><comment><USER36> is that the Penny Arcade mailchimp.com password on the whiteboard at 3:10?

<comment><USER37> Maybe it once was, but it is not the current password (tried a moment ago).

<comment><USER36> I'm not surprised. if I noticed it while snickering, I'm sure they noticed it before posting and changed it back then. easier to do that than refilm.

<comment><USER38> I tried to log in with it too and got a "too many bad signins" error. I'd assume people all over the place will be trying, even if it's not their password they've effectively locked themselves out of that account for a while from the stream of people trying. Should have refilmed or blurred it

</comment></comment></comment></comment><comment><USER39> Can anyone describe the types of people who bid+pay 5 and 10 thousand dollars for these projects? I can't imagine devoting that much money to a playdate at PAHQ or to hang out for the day with the designer of the OUYA. It doesn't seem like real money at that point but I know these peoples' credit cards will be charged. I don't get it...

<comment><USER40> Well one of the OUYA ones is Notch who's famous for liking to help projects he finds interesting thanks to his own success from minecraft, so for him 10 grand to help something he likes isn't as crazy as for some of us.

And I'd assume anyone doing it for PA are hardcore fans who've loved the site for years and have serious disposable income to hand.

</comment></comment><comment><USER41> I don't understand what is wrong with advertisement?

Nobody pays attention to them anyway, so WTF?

<comment><USER42> It takes time and effort _for them_ to keep on top of, as they _don't_ just push any random ads. They'd rather use that time and effort on other things.

</comment></comment><comment><USER43> I already get it ad free - thanks to AdBlock.

<comment><USER44> Their site is one of the few where I disable AdBlock. First, it supports a comic and a site which I love, and second I actually like their ads. They have stated they play every game that is shown in an ad, and don't allow terrible games or terrible ads for a game at any price.

<comment><USER45> Seems like the exact opposite of the standard practice in old-school journalism of strictly separating editorial and advertising staff in order minimize conflicts of interest.

The fact that they are seem eager to get rid of ads makes it seem like worrying about these kinds of thing are at least a constant nuisance.

<comment><USER46> It read to me more like it was annoying for them. They want to get rid of ads so they can quit spending time writing reports for advertisers/vetting ads, and spend that time working on new content instead.

</comment></comment></comment></comment><comment><USER47> Uhhhh....Ad Block Plus anyone??

</comment><comment><USER48> I guess the people funding this project haven't heard of a free browser extension called AdBlock Plus?</comment>


People Willing to Pay $125 to Downgrade to Windows 7 - <AUTHOR> http://www.cultofmac.com/211604/people-hate-windows-8-so-much-theyll-pay-125-to-downgrade-to-windows-7-image/

<comment><USER2> So someone saw that an independent PC repair shop is offering to downgrade from Windows 8 to Windows 7 for a fee, and took a photo of it. A site called Cult of Mac writes some breathless commentary, slaps a rather sensationalistic title on it, and posts it on a page with a 3:1 advertisement-to-content ratio.

Not to disparage the good people at Cult of Mac, but color me unexcited. One technician disliking an operating system and seeing an opportunity to make a few hundred bucks in it is absolutely great fodder for an amusing photograph. And it's no secret that Windows 8 isn't winning any popularity contests. But it wasn't too long ago that manufacturers were actually shipping new PCs with a Windows XP downgrade disc included in the box. Call me jaded, but compared to that, this seems pretty tame.

</comment><comment><USER3> If I recall correctly, it used to be that a Windows license entitled the user to instead downgrade to any previous Windows version, if they so desired. I wonder if this is still the case with Windows 8.

<comment><USER4> Yes.

[http://www.microsoft.com/oem/en/licensing/sblicensing/pages/...](http://www.microsoft.com/oem/en/licensing/sblicensing/pages/downgrade_rights.aspx#fbid=5gV4sRBSXmH)

</comment></comment><comment><USER5> Yeah Windows 8, it is that bad. Apple has nothing to worry about from Windows 8, might even cause some defections to Apple from Microsoft users.</comment>


Why Runners Get Slower with Age - <AUTHOR> http://well.blogs.nytimes.com/2015/09/09/why-runners-get-slower-with-age-and-how-strength-training-may-help/ <comment><USER2> This is very interesting to me. I'm 48 and play hockey 3 days a week, often against guys in there 20's currently playing college or Juniors. I have been actively increasing my leg workout for the past year and it's noticeable, esp. in my quickness and overall speed.

I'm actually about to start doing squats which are something I've never done much of because I've been lucky genetically and have always had very large calves and thighs. I picked up a book recently espousing the benefits of squats in particular (Starting Strength for those interested) and I think that's the next thing for me to keep or maybe even increase my speed.

The other thing I started doing about a year back now is a upright bike 'sprint' where I basically peddle easy for around 20 seconds, then 10 seconds of full-on max aerobic type sprint. I then rest another 20 seconds peddling easy, followed by 10 more seconds, and finish the same on a final third sprint. When I say full on sprint I mean to the point where I nearly barf every time I complete this part of my workout; you really have to push yourself and not just go a little faster. Prior to switching to this sprint type workout I did a rotation of long day/short days on an elliptical; on my long day I did 40m and on my short I'd do 20m.

What I noticed as I've gotten older is that my endurance remained fairly consistent but my 'explosiveness' was going away. Just switching to the sprints has helped me regain a lot of my speed. In fact a good friend that I've skated with on and off for about 15 years remarked that he thought I was faster now than I've ever been. Considering I've been chasing down 20-something Junior players on break-aways, it seems about right to me.

I think adding in the squats will further help diminish my leg muscle decline and hopefully give me a bit more quickness my first three 'chops' from a dead stop.

I write about all this stuff on my personal blog which focuses on fitness, health and most of all hockey such as this recent post: [https://existentialquandary.wordpress.com/2015/09/07/sunday-...](https://existentialquandary.wordpress.com/2015/09/07/sunday- night-sept-6th-drop-in/)

Edit: Book title was wrong - link is in another comment - thanks for linking to it!

<comment><USER3> Your bike sprint workouts sound similar to Tabata cycling intervals: [http://britishcyclesport.com/2013/training/tabata- intervals/](http://britishcyclesport.com/2013/training/tabata-intervals/)

Got to agree workouts like that are _really_ hard!

<comment><USER2> Thanks I hadn't seen this before.

I got the idea from a BBC program on fitness, I think it was a Horizon's where they had the host doing these sprints and they equaled much longer endurance workouts. I was dubious at first but the results seem to hold up.

</comment></comment></comment><comment><USER4> Mechanisms to think on:

1) Stiffening of tendon tissue via cross-linking and calification.

2) Loss of muscle mass and strength via all of the varied mechanisms implicated in sarcopenia, ranging from mitochondrial dysfunction to extracellular matrix disruption via cross-links and senescent cells, to fatty infiltration of muscles, diminished stem cell activity, etc, etc.

3) Inefficiency in blood flow to muscles, either through neurological impairment in the normal blood vessel dilation process or through cross- linking and calcification to stiffen blood vessel walls.

4) Dysfunction in cartilage for all the reasons implicated there, such as cross-linking, loss of stem cell function, and so on.

There are others, but note that all of these are secondary consequences of types of primary damage that occur as a result of the normal operation of metabolism. They are all targets for repair treatments yet to be constructed.

</comment><comment><USER5> Can't recommend this book enough: [http://startingstrength.com/](http://startingstrength.com/)

</comment><comment><USER6> Running speed for any event beyond a few seconds is not limited or determined by muscle strength, but the much much much more important aerobic capacity (as they discuss in the beginning, but of course don't bother to make the connection).

Performance in endurance sports also peaks around 27 years of age, so most people will naturally get faster until then and only decline afterwards. So you don't simply get slower with age.

<comment><USER7> Exactly. Your cardiac output is a function of age, routinely stated as "220 minus your age in years is your maximum heart rate." (Or: maxBPM(age) = 220 - age)

When I'm going all out, my watch says I hit 180 bpm which is pretty darn close to my (220-32=188) max rate.

<comment><USER8> Source: "endurance sports also peaks around 27 years of age" I have seen most triathletes hitting their best time in their early 30s. Chrissie Wellington actually only started professional ironman in her 30s. She was ironman champion in 2007(30),2008(31),2009(32),2011(34).

Also cardiac output is more correctly a function of stroke volume, how much blood is pumped for each stroke. Therefore very well trained athletes actually have a lower max hr.

Also cardiovascular drift can increase your max HR, this happens when it's very hot or you have lost a lot of water due to sweating, this causes stroke volume to decrease and heart rate to increase while you still at the same physical output. You hear ppl saying my heart rate was so high and i didn't feel like i was working that hard, it's usually due to cardiovascular drift.

<comment><USER6> Triathletes are a odd group to base this on. In any case, the exact age isn't important and you would of course expect this to vary dramatically. The point was that it is very far from being as simple as "performance decreases as you age".

But you are correct to point out that your parent is very far off the mark. Max HR is not a useful predictor of performance, and you can not calculate it with a formula. What you want is a test to exhaustion to determine it, but these are highly dubious due to the psychological aspect, and at the end of it you might have a correct value for max HR, only to realize that it is pretty useless for any prediction purpose.

Case in point, Chris Froome, winner of the Tour de France in 2015, has a max HR of around 170, yet he can sustain 450W for a hour. Meanwhile plenty of people with a max HR of 200 and beyond can't climb stairs without heavy breathing.</comment></comment></comment></comment>


First State set police on man who showed them how accounts could be ripped off - <AUTHOR> http://www.smh.com.au/it-pro/security-it/super-bad-first-state-set-police-on-man-who-showed-them-how--770000-accounts-could-be-ripped-off-20111018-1lvx1.html

<comment><USER2> Unfortunately this happens more than you might think and other Australian companies seem to have a similar approach to dealing with security findings. Many years ago I found a huge hole in a large company's Australian website that allowed me to download their entire database of customer records including addresses and plain text passwords, by a similar method of just changing url parameters. This was millions of consumer records from a -big- international brand.

Instead of warning the public, that their records may have been compromised, they focused on me. I was immediately slapped with legal threats via phone, email and mail. They took my original email apart, saying that by modifying the url and downloading the database I had illegally obtained this data, I could be prosecuted under xyz law etc... They ended it by saying that if I ever spoke about it publicly I would be taken to court.

Needless to say I attempted to take my issue directly to several Australian newspapers. I talked to a couple, but none wrote a story. I don't understand why - this was 7 years ago, perhaps they didn't understand the issue. I spoke to a lawyer who told me that there was nothing I could do. They'd given me a way out so I should just take it and try to forget what happened. In the end I convinced myself that perhaps I was in the wrong. No one would listen to me. At the time I was a lot younger and had less resources. I would of course not deal with it the same way now. However, I'm not interesting in digging up the past - the proof is long gone, but the lesson stays the same.

There should be a government body to whom security breaches like these can be reported. Companies can not be trusted to police themselves when it comes to private data.

<comment><USER3> At least this time around SMH have apparently understood the situation and called out First State Super.

Also; _NSW Police said it was not taking any further action on this matter. "There was no criminal offence committed and the company in question has been informed of the outcome. It was more a case of a civic-minded person reporting a potential security breach."_

I 100% agree that the government should handle these situations, unfortunately the closest thing we have is The Privacy Commission - which is completely toothless.

<comment><USER4> > I 100% agree that the government should handle these situations

Isn't that like asking the government to intervene when I notice that my next- door neighbor leaves his car unlocked with the keys in the ignition when he comes home from work?

<comment><USER5> Security of one's own property is a completely different matter than a bank's security of its holdings of other people's property.

<comment><USER4> What if the car belongs to the local bank manager who left his work laptop on the passenger seat?

<comment><USER5> If his work laptop contains customer-related information which endangers their accounts, that would definitely be a matter for the police.

</comment></comment></comment></comment></comment></comment><comment><USER6> A reasonably happy note of sanity is sounded at the end of the article:

'NSW Police said it was not taking any further action on this matter. "There was no criminal offence committed and the company in question has been informed of the outcome. It was more a case of a civic-minded person reporting a potential security breach."'

<comment><USER7> The comments from the First State officials seem fairly sane as well, but this is completely over the top:

 _"The next day Webster received a letter from First State's law firm, Minter Ellison, telling him his actions constituted a breach of the Crimes Act and Criminal Code Act...

...The firm said they may go after him for costs related to the matter."_

Hopefully someone reigns in these vicious lawyers before they screw over one of the good guys.

<comment><USER8> As to my very basic understanding of Aus law they can't, they would need to take him to court and prove he broke the law before they can presue costs, Which is very hard since the police have decided not to investigate the matter because they believe he didn't break the law.

</comment></comment></comment><comment><USER9> This is why I stand by anonymous public disclosure. Companies will not budget for security unless you make them.

<comment><USER6> It's true. About five years ago my bank upgraded their systems and, no kidding, set everyone's password to their login name as part of the transition. When I called them on it, they stonewalled me and repeatedly claimed that I was being unreasonable, and as far as I know never fixed it, and fearing something like the OP I never pushed it. (I closed my account and switched banks.)

Edit: My summary of that saga, posted at the time: <http://www.blahedo.org/blog/archives/000836.html>

<comment><USER10> "So, I sent a detailed email to the bank's address"

I've found that a one-line response (i.e. no explaining why, no technical details, no explanations of explanations) generally works a lot better:

"Wouldn't this mean that everybody now has easy to guess passwords?"

</comment></comment></comment><comment><USER11> I learned early on in my career not to mess around with account information, especially at a bank.

My first job out of university was in corporate IT for a big bank around the time that l0phtcrack came out. I used it to crack hundreds of user passwords, and then showed my boss the vulnerability.

He promptly told the director, the director sent out an email saying that people's NT passwords had been breached, and I got in a little bit of trouble for cracking people's passwords without authorization, even though people were using passwords like "password", "apple", etc.

I realize it's dumb to to blame me (or the guy in the original story), but I've come to learn that when you're dealing with big corporations like banks, they are eager to cover their own asses and to throw the blame wherever they can. So it's best to never mess with them.

The fact that the guy downloaded actually customer information is what opened him up to potential problems, that's the one step I probably would have avoided.

Of course, this ridiculous behavior by the banks will only make it more likely that any security breaches won't be reported, which means if you're a customer, you should change banks immediately to a bank that actually cares about the security of your information.

<comment><USER12> You're lucky you're not Randall Schwartz[1], who performed an unauthorised security audit on some intel boxes, and ended up being convicted and spent something like 10 years (and a hell of a lot of money) getting the ruling overturned.[2]

[1] [https://secure.wikimedia.org/wikipedia/en/wiki/Randal_L._Sch...](https://secure.wikimedia.org/wikipedia/en/wiki/Randal_L._Schwartz)

[2] <http://www.lightlink.com/spacenka/fors/>

</comment></comment><comment><USER13> The exact same thing (except in the USA) is happening to my friend: <https://freeweev.info>

He's looking at ten years in federal prison for what basically amounts to whistleblowing. They've charged him with identity theft and conspiracy to commit unauthorized access for scraping email addresses (and nothing else) that AT&T had published unauthenticated on the web.

The world is a crazy place, these days.

<comment><USER14> I'll preface this by saying that I like weev, and get a kick out of some of his antics, but...

He's a _really_ unsympathetic defendant. Put him in front of a jury and they'd likely convict him regardless of the evidence. If you're going to be engaging in activities of questionable legality, even if you think you're doing the right thing, it pays to at least put up a respectable front. Just about everything he engages in is something his attorney will have to account for in trial.

"Yes, he founded a grey-hat security firm named after an infamous image of a man exposing his digestive tract, but..."

"Yes, he claimed responsibility for illegally taking Amazon offline, but..."

"Yes, he exploited a vulnerability in AT&T's site to collect 100k+ user emails, but..."

"Yes, he is a member of the Gay Nigger Association of America, but..."

He's a defender's nightmare. If you're going to put yourself at odds with the law, at least give your attorney a fighting chance.

<comment><USER13> He says the whole thing will be worth it even if he just gets to play Gayniggers From Outer Space in federal court (to illustrate that he is not the leader of a hate group).

The man epitomizes "doin' it for the lulz". I agree 100% with all your points, but I personally feel that it's the unpopular or misunderstood speech that needs the most defending. What he does is not criminal, and should not land men in prison for a decade, trolling or no.

<http://en.wikipedia.org/wiki/First_they_came..>.

</comment></comment></comment><comment><USER15> From the article:

 _He said Webster's actions were more serious because he did not just access his own or a mate's account, but hundreds of other customer accounts, to prove the security flaw was real. "While we were appreciative of him showing us a weakness in our security systems the size of the downloads concerned us greatly and the fact that it was a major breach of the privacy provisions of our members," Dwyer said in a phone interview._

The guy didn't just find and report on a vulnerability. He also scraped a whole heap of private customer details ('to prove the problem was real'). If his intentions were pure, he shouldn't have downloaded & saved the private information of hundreds of customers. First State Super overreacted, but I can understand why they're nervous that he might keep the data.

<comment><USER16> Seriously? I'd say checking that the vulnerability works on "hundreds of customers" out of 770,000 is a reasonable thing to do to see if it's really there and to get a bit of proof. I could easily imagine quickly banging out some shell one-liner with seq+wget to see if it wasn't a fluke.

First State Super shouldn't have worried about this guy. If he were evil, he _wouldn't have told them_. If some problem later developed with those few hundred people, they'd know who to nab. This is just scapegoating, presumably driven by IT people trying to distract execs from their total incompetence.

</comment></comment><comment><USER17> A good deed never goes unpunished. I don't know if I would ever report a security problem like this for fear of needing to deal with this kind of head ache (at least with a non-Google-type company).

Anybody have any idea whether my feelings are being unduly influenced by familiarity with these kinds of stories? I doubt there is any real data to make a decision with, but I like to try to stay at least a little rational.

<comment><USER18> Not really strange. I generally don't report security vulnerabilities either when I find them. Sure, if it's a simple process to file an issue, or I know a knowledgeable person in charge of the system, I'll do it.

But otherwise I simply don't feel like explaining it. I don't feel I have the moral obligation to jump through hoops to get through all the customer bla-bla to someone who understands, and face legal issues, just because I bump on some 'bug'. Someone else will find it eventually. Choose your battles carefully and such...

</comment></comment><comment><USER19> > he may be liable for any costs in fixing the breach.

How is this even remotely logical? If someone walks by my house and yells "hey, your window is broken!" can I force them to pay to repair it?

</comment><comment> buff-a "I'm confident that when we meet and discuss the matter we can resolve it to our satisfaction that he is actually not holding those files any longer."

How the fuck are you going to do that, Mr CEO?

</comment><comment><USER20> Looks related to this:

<http://risky.biz/fss_idiots>

<http://risky.biz/minter>

There's also a case where Police can arrest you and unarrest you at will (At Queensland at least). In the process, taking all your equipment (his iPad): [http://www.news.com.au/technology/facebook-story-arrest- disp...](http://www.news.com.au/technology/facebook-story-arrest-disputed-on- twitter/story-e6frfro0-1226057758607)

The young journalist decided to go quiet so as to not upset police(?): [http://www.reddit.com/r/australia/comments/hn74v/what_happen...](http://www.reddit.com/r/australia/comments/hn74v/what_happened_with_userbengrubbs_interaction_with/)

Even [NSW] politicians think accessing a private URL can be 'hacking': [http://www.smh.com.au/nsw/minister-a--monkey-could-have- hack...](http://www.smh.com.au/nsw/minister-a--monkey-could-have-hacked-- secret-transport-site-20100223-p085.html)

Quite frankly, I'm disappointed that companies in Australia can wave the police wand whenever there's an IT security issue. I want Aussie police to step up their game and charge the companies with making false police reports. Especially with demands to seize equipment of individuals as a form of extortion with malicious intent to silence them.

</comment><comment><USER21> I found this fascinating:

 _"But then three and a half weeks later the police just knocked on the door and said we're here to speak to you about downloading files about First State Super," said Webster, adding police discussed the matter with him and told him to stay away from First State's website."_

The implication there is that a website is property so strongly as to use the police to compel whether someone might choose to point their web browser at it.

<comment><USER22> That could be advise from the police. As in "We're looking into it, you say you are innocent, but if we find out you are hacking around that website again, then we might not be so sure"

</comment></comment><comment><USER10> So First State try and get revenge on and blame the poor guy who reports the problem. I can't understand how this is a cheaper or a better solution for them than fixing the hole. It would be interesting to know if there was a thought process behind this, because it reads like there wasn't.

<comment><USER23> There is still the very real chance this guy has all their member information.

In this situation, how can a company ensure he has deleted all of the data, without legal action?

<comment><USER24> How can a company ensure he has deleted all of the data _with_ legal action?

</comment></comment></comment><comment><USER23> "To demonstrate the flaw to First State's IT staff, he wrote a script that cycled through each ID number and pulled down the relevant report to his computer. He confirmed that the vulnerability affected the firm's full customer database."

Seriously? That sounds a little more than just "Checking the vulnerability exists", that sounds like exploiting it. Tweaking the url, is all he needed to do to workout that there was a problem... then he writes a script and downloads all the data?

I'm actually not that shocked by the reaction. Equivelant:

"I noticed your door was unlocked, so I stole all your stuff, and put it in that truck parked just there. Just thought you might like to know". <\--- Would you take legal action in that case?

<comment><USER25> Or: "it seemed like you left your private diary out, so I photocopied every page to make sure before telling you."

That said, I can see the temptation to want an answer to the question "did the _really_ leave every account open?"

<comment><USER26> more like

"I found your private diary in the hedge near your house, so I had a bit of a rummage around and also found your cheque book, credit card and driver's license. There's probably more stuff as well. Just thought I'd let you know before anyone else finds them"

<comment><USER27> Or, "I found that you, the bank, left all of your customers' money and social security cards and personal records (including mine) in an unlocked windowed room facing the street where anyone might walk by and steal all of it. You might want to lock it up." "Prove it." "Ok, I'll just show you how ridiculously easy it is to open this door . . ." "Thief!!"

</comment></comment></comment></comment><comment><USER27> Oh my gosh man. That's so bad. You simply replace the account ID parameter in the request URL? That's so bad. So so stupid on the bank's part. They should be showering this guy with gifts for pointing out such a stupid mistake to them and they should be going after whoever set up their system like that.

</comment><comment><USER28> Notwithstanding the right and wrong of this case, if Patrick Webster had done all his investigation anonymously, e.g. through Tor, and expressed his findings to First State Super in a way that does not imply that he actually downloaded anything, I wonder whether it would have put him in a better position.

Even without investigating anonymously, if he had just described the security vulnerability without saying what he actually did, would he be legally vulnerable?

I find it ironic that in helping this company with their IT vulnerability, he possibly took on himself a legal vulnerability.

</comment><comment><USER29> That was nice of him to do. And I doubt, after the reaction he got, that he'd do it again any time soon.

</comment><comment><USER30> After reporting how easily the Manhatten Project military safes could be opened, the higher ups sent round an urgent memo addressing the issue. It said "Don't leave Feynman alone in your offices".

:-/

</comment><comment><USER31> Unbelievable. Am not aware of US law, but I hope he can sue First State back for the mental harassment they caused him. This isn't plain ungratefulness - it is dangerous. It can dissuade well meaning, civic minded members of the public from helping an company, which by the way is great for the bad guys.

<comment><USER6> > _Am not aware of US law_

This is in New South Wales (Australia).

<comment><USER32> Interestingly, these horror stories are assumed to be from US by default.

</comment></comment></comment><comment><USER33> Whenever I see the phrase "First State", I think of Delaware, not Australia.

</comment><comment><USER34> The other lesson is that incompetence of this magnitude on one issue is always a symptom of incompetence generally.

I have seen this over and over again with multiple companies. It's not like everything else is first-rate and somehow just _one_ glaring thing slipped by them. That's what we'd like to believe.

Instead, there is a systemic problem with horrible decision-making that will infect every level of operations, until the organization finally collapses into a black hole of infinite stupidity.

Well, that may be a little extreme. Some of them putter along as White Dwarfs.</comment>


Angel investing and angel financing overview for entrepreneurs and startups - <AUTHOR> http://www.clickcapitalcorp.com/ <comment><USER2> I know craig. I can promise you that SEO is no something he is going for.

</comment><comment><USER3> The downside of using your title tag for SEO is that it makes a lousy headline on social news sites.

<comment><USER4> I'm interested in better SEO tagging; what would you suggest would make a better title in this instance?</comment></comment>


The success of Project Ara depends on Toshiba - <AUTHOR> http://www.araprototype.com/uncategorized/toshiba-modules-project-ara/

<comment><USER2> Specifications for the on-phone interconnect protocol, UniPro: [http://mipi.org/specifications/unipro- specifications](http://mipi.org/specifications/unipro-specifications)

Hopefully Project Ara can bring a PC-like open architecture to mobile devices, to unlock the combinatorial creativity of a multi-vendor interoperable ecosystem. This requires that the Google-controlled "Router" component will not exercise editorial policy or runtime tax on "Bridge" modules.

<comment><USER3> So now we'll have to put our trust in software and drivers? :)

PC is open indeed, but for the love of me I can't remember the last time I've actually upgraded a PC. I usually buy a upper mid-range to lower high end PC (currently running Core I7 5820K, 980) but i actually very rare upgrade them. The ones I buy last me for the 2-3 years of which ever games i play at the time, when i can no longer play them at the graphical level i deem acceptable i buy a new one.

And this is because the upgradeability of most PC's is sort of a myth, if you buy a hardware which is all of the same range when you'll have to upgrade a component the rest will become a bottle neck.

And i don't see this being any different, the added cost of the router and the entire protocol simply writes off the benefits considering that an upgrade will require you to upgrade at least 3 major parts.

On top of that you run the risk of the "router" most likely be turned incompatible within a few years simply because the standard will evolve to allow for additional bandwidth, different power requirements, an improved form factor etc.

Take a look at PCI express for example from version 1 to 4 there were huge changes in bandwidth and power supply, and while some hardware kept backwards compatibility it was in most cases severely hindered by the bandwidth limitations. Put in a modern PCIE 3/4 graphics card in a PCI 1 or even 2 slot and you'll see the difference high end cards lose upto 75% of their performance, some wont work at all due to the power supply differences.

Do you really think that for some reason that protocol would be exempt of that?

We already have a combined creativity of a multi-vendor environment, open your phone it has components from a 100 vendors. There are memory vendors, SOC vendors, sensor vendors, radio vendors, screen cameras etc. You can have an LG phone with a top of the line Sony camera, and NVIDIA SOC and a Samsung memory in it, do you really need to add a plastic square that says Dr Dre to it?

Not to mention that at least now you have the ability to debug issues with fair ease, if the PC over the past 40 years have not managed to tackle cross vendor compatibility even at a hardware level (just check the accepted hardware list for your mother board for example) not to mention on the software level what makes you so sure that this all of a sudden will?

I would rather much see an easy way to connect peripheral discrete devices to my phone with ease for the extremely rare occasion i would (and atm i can't think of one) need it than to have to select different hardware for my phone hoping it will all work together than having 6 different vendors to get support and claim warranty from while hoping that at least 2 or 3 of my lovely blocks will be compatible with the next years model.

<comment><USER4> I thought they were making an MDK to prevent the issues with drivers, do you know about that at all?

<comment><USER3> And how is that any different than the driver development kits, frameworks, hardware development kits and reference design guidelines we have today?

With all of those we still got issues, my 600$ creative sound card still doesn't work well with Windows 8, vendors still have to patch BIOS, firmware and micro-codes to sort out compatibility issues, and some hardware compatibility issues are not sorted at all.

No matter how well you plan things something will not work, today when a phone vendor designs a phone they can and do ensure that all of the hardware is compatible with each other and that the software works (some do it better than others). Do you really think that every single vendor will be able to test their plug with every other currently in existence?

And if they will can you even imagine the cost of such certification process? Motherboard vendors today barely test their boards with 1/3rd of the available memory modules, and on every motherboard manual you'll see warning of at least 5 that don't work at all.

All of them follow the exact standard set by JEDEC and still manage to mock it up. On the software level for each motherboard you can see 3-4 BIOS upgrades that patch in support for CPU's additional memory vendors, or increase system stability, this isn't something that i look forward to see on my phone.

The only reason why i still don't use an AIO PC is that i play games, and once Steam Boxes come down to reasonable price levels and not 600% branded PC markup I'll probably dump it for one.

For the rest of my uses, a laptop, tablet, or some other AIO device will work just fine, and judging by where the market is headed I'm probably not alone in this view.

</comment></comment></comment></comment><comment><USER5> I am looking forward to Project Ara. Assuming my Moto X holds on long enough, an Ara type phone will be my next phone. I do not care if the Ara doubles the thickness of my Moto.

That said, I am approaching it the same way I do Lego Mindstorms, Raspberry Pi, and Arduino. However, I do not think Ara will have the education angle those do to reach volume.

I am not sure I see the real value outside of tinkerers. I plan to buy one but I do not expect to actually save money, electronics waste, or have better performance for the dollar.

</comment><comment><USER3> Seems to be yet another HN assisted DDoS attack since the site is being going up and down like crazy.

On that note, I'm honestly not looking forward for project Ara at all. Seems to be quite a finicky concept and while i "loath" apple i do think that a purposely built device is much better over Lego type hardware. I don't mind some upgrade-ability but this to me seems like it will come at a much higher cost, bot in terms of overall cost and TCO having even more points of failure in a given device which will make it even less reliable and to have an overall shorter lifetime and for what exactly?

I really don't see a single feature that i would want to upgrade on a phone in the 12-18 months I'll use it, and when i will want to upgrade one it will most likely mean i will want to upgrade them all. If i wan't a better screen at that point I'll want a better SOC to drive it, more memory to store higher resolution content on it etc.

The only thing i see coming out of this is another "Beats" type scam with some silly audio parts and instragram branded cameras that will be sold for a huge markup. The only "benefit" we might get is that every "Ara" device will finally have a user serviceable battery, but considering that no matter how good their interconnect is the standard and protocol constraints will make it impossible to optimize every component like you could with a purposely designed device it's not much of a trade off either (especially considering that if you need replaceable batteries, many phones still come with them including the flagship phones from Samsung).

/illpass.

<comment><USER6> For many people mobile phones are the dominant computer in their lives. I for one welcome any attempts to make them less monolithic. In an ideal world I would be able to freely mix and match the hardware, the OS, the application framework and the language for my mobile device.

I admit the modular solutions might physically be clunkier and offer worse battery life. I am willing to live with some compromises on those if it means that I have more control over the device.

<comment><USER3> Well the current trends in personal computing is actually towards monolithic all in one devices, whether if it's the rise of the MAC's or the continuing trend in the PC world to put everything unto the mainboard or the CPU.

25-15 years ago your PC would've had 3-4 different extension cards, today unless you're a gamer or otherwise in need of a discrete graphics card you have none since they've migrated unto the CPU. And modern CPU's can run many games today even AAA title on quite acceptable settings for most casual Gamers, and that trend will only accelerate as they improve.

With AMD built in "APU" being based on the same architecture as their discrete cards, Intel's IRIS being able to drive more and more games, and NVIDIA getting more experience in integrating their own discrete graphic cores with CPU's in their SOC i doubt we'll see discrete graphic cards for much longer, beyond that the only thing that you'll have on your board is your memory and that too with stacked and 3D dies will be integrated soon enough. You already have desktops the with a 10cm^2 footprint that have the same CPU and memory that you put in your tower, within a couple of years there won't be a single discrete component on that board at all.

I for one don't see how being able to customize hardware translates to having any more control over the device i own than being able to select a device with the hardware i want. Infact the compromises forced by such architecture in my eyes result in less control as they force me to compromise on hardware to begin with. Today i can select a phone which has the screen i want, the battery i want, the camera i want and the SOC i want, yes i might be limited to certain vendors but i don't see this change if my phone comes as a single magical block without as much as a sim card slit or as a complete Lego set.

<comment><USER6> I admit that you are completely correct about the trend towards increasing integration. Its possible that as someone who grew up in the PC era I struggle to embrace the concept of a computing device with few degrees of freedom.

<comment><USER3> I got that too, i think that's where more of my resentment to Apple devices comes from (Why pay twice the prices for inferior hardware).

But considering the current trend and the fact that your data and software becoming more and more detached from the device you use you get a different kind of freedom.

Considering that for virtually every discrete software today there is a cloud service, and eventually even streaming games trough the cloud (or your local network) will become technically viable why should you care whats inside your device? The only thing it will do is some basic processing and input/output it will become nothing more than a terminal.

And where the majority of the computation will be at your house or in the "cloud" it doesn't matter.

Heck I'm pretty sure that NVIDIA for example is already preparing for the future in which it can't sell graphic cards, at best it will be able to license it's technology.

That's why in my opinion they are working on their streaming technology so badly, I mean today there is absolutely no freaking reason to stream Call of Duty onto a tablet but in 2-3 years? That will probably be the default setting whether they sell you some game streaming box which you can buy that can run 3-4 games at the time onto multiple devices or sell their hardware in bulk it to who ever decides to revive OnLine or take on Playcast.

I for one can't wait for the time in which i will be completely free to choose which ever device i want because for all intents and purposes they'll do exactly the same thing and that is connect me to my data and applications. I'm sick of benchmarks, reviews, and constant upgrades, sick of throwing money down the toilet just to have a better screen or a faster CPU.

<comment><USER6> In my opinion the software story and the data access story could be a lot better in the new integrated world.

1\. Monoculture of a single language per platform needs to go away. Its wasteful in terms of programmer productivity.

2\. The data layer needs to be disjointed from the applications completely. Access to this data needs to be available on a system wide basis.

3\. Power users frequently want to access their data programmatically. More attention needs to be paid to these use cases.

4\. The bottom level cross application data layer needs to be based on some open standard allowing people to trivially get data in / out of the ecosystem via some scripts / programs / tools.

5\. Applications need to be extensible by the end user.

</comment></comment></comment></comment></comment></comment><comment><USER7> I remember when Ara was first announced that it was in a special Google program where it basically has to have results in a year or they shut it down. I'd love to know how it's tracking in that and if it looks like it will live on or be put on hold. I'm pretty sure it's coming up on a year old very soon.

IMHO I think it's neat technology but I would not personally want all the trade-offs of more bulk and weight just to have the ability to swap out parts.

<comment><USER2> _> I'd love to know how it's tracking in that and if it looks like it will live on or be put on hold. _

Project Ara received an extension:

 _" A notable exception to the rule is Google's Project Ara, the modular Android smartphone with interchangeable components, which was granted an extension on its two-year deadline because it's promising enough that they're actually testing it in Puerto Rico."_

[http://www.businessinsider.com/google-atap-killed-project- to...](http://www.businessinsider.com/google-atap-killed-project-to-improve- mobile-battery-life-2015-3)

</comment></comment><comment><USER8>
      Currently computers are not modular and people that keep  saying that they are actually tech enthusiasts that are willing to open up a pc and play with the innards.

       A modular phone and ability to hot swap parts is something completely different than what we have in pc currently. I hope it catches on and is adopted into other devices as well.

       IE taking out the gpu and processor from my phone and attaching it to my TV or tablet for gaming. Or the ability to upgrade the entertainment console in my car by just replacing a part.</comment>


Eric S. Raymond is creating the computer code that makes your digital world work - <AUTHOR> https://www.patreon.com/esr?ty=h

<comment><USER2> the internet runs on fetchmail?</comment>


Why "The trouble with nonprofits" involves incentives - <AUTHOR> http://blog.seliger.com/2008/01/23/foundations-and-the-future

<comment><AUTHOR> Note that this responds to the HN piece that's here: <http://www.aaronsw.com/weblog/measurenonprofit> (see the discussion here: <http://news.ycombinator.com/item?id=809952> ).</comment>


Yahoo Japan Selects Google for Search Queries, Advertising - <AUTHOR> http://technologizer.com/2010/07/27/yahoo-japan-now-with-google-search/

<comment><USER2> _I have to say I'm shocked by this news, especially considering that Bing will be behind Yahoo's primary search engine here in the states and in Europe._

Bing seems to lack mobile search. While there search page is optimized for mobile, they don't seem to rank mobile differently. That alone could be a deal killer for the Japanese market.

</comment><comment><USER3> Yahoo Japan is very much a separate entity from Yahoo.com.

For instance, they're still operating geocities.jp, whereas the .com (and all the others) has closed, and in general they seem to be able to make a go of things where the .com version falters.

</comment><comment><USER4> Will there be any kind of anti-trust oversight on this deal? Does anyone know what the deal is with government competition regulation in Japan?

</comment><comment><USER5> Sounds like a good test of a plan b.

Also there's some bullcrap at the end. Most of the time in yahoo history the "heart" of it was done by a 3rd party company,e.g. google. Which became a company we know only after yahoo used them as their search engine long ago</comment>


Ask YC: What music do you listen to when hacking? - <AUTHOR> What music, if any, do you listen to when hacking? Do you find it helps you concentrate or is it just a distraction? <comment><USER2> The Feel Good Initiative <http://thefeelgood.com/>

Found it here on YC, actually.

<comment><USER3> The Feel Good is the bomb! ;)

</comment></comment><comment><USER4> Sometimes, music with lyrics in the language I'm learning. I don't understand most of it, but my ear gets better at picking out words, and properly- conjugated phrases start to sound natural to me, even if I don't know what they mean yet.

But that's only when I feel I need to be pulled along. Once I get into flow, I don't see or hear anything except what I'm doing. My music will end and I won't notice until 2 hours later when I come up for air.

In "Peopleware", DeMarco and Lister are even more explicit: if programmers need to put on headphones to drown out ambient noise, they're using up the very creativity they're being paid so much for.

<comment><USER5> _"Sometimes, music with lyrics in the language I'm learning"_

I assume you don't mean programming language? If that's what you did mean, where can I get music with lyrics in Python, Lisp, etc?

<comment><USER6> [http://www.songworm.com/lyrics/songworm- parody/EternalFlame....](http://www.songworm.com/lyrics/songworm- parody/EternalFlame.html)

</comment></comment></comment><comment><USER7> Trance! [http://s-torm.com/forum/dload.php?action=category&cat_id...](http://s-torm.com/forum/dload.php?action=category&cat_id=15)

<comment><USER8> Digitally Imported radio (di.fm) is a great trance channel. I used to subscribe for $5/month to get their higher quality feed, which was worth it when I had good headphones. I spent a lot of hours in the library coding and doing math listening to di.fm. They have other great channels like "chillout" and "house" which are also good for coding. Chillout is, well, chiller and good for relaxed coding sessions and house is a bit more funky and less "poo tsh poo tsh poo tsh poo tsh" like trance can get (and can get annoying).

ASOT++ btw. I listen to it every week. You can d/l it on most torrent sites, which isn't even as illegal as d/ling other music. Its like taping the radio and giving it to your friend. And this radio doesn't have commercials. Plus trance style music lives on a different plane of business than the rest of the industry they way I see it - which is a whole different tangent I'll not go down.

<comment><USER9> di.fm used to be good; then they grew bigger and started charging (about the same time their music selection quality started to decline).

These days I'll listen to MrsFudge Streaming Radio, which has the best music voting system I've seen: <http://gurba.sytes.net>

Alternately, there's Proton radio: <http://www.protonradio.com/>

</comment></comment></comment><comment><USER10> Dup. See <http://news.ycombinator.com/item?id=61831> and <http://news.ycombinator.com/item?id=99936>

<comment><USER11> It's a dup, but I think lots of people don't mind that. I for one don't mind seeing this pop up every few weeks if people suggest new songs.

Toward that end, here is some music I haven't seen mentioned here before. List of Demands, and Black Stacy, both by Saul Williams (see also <http://niggytardust.com/>, which many here may have heard of). He's on tour right now, if any want to see him live.

<http://youtube.com/watch?v=l1llNYAlYrc>

[http://youtube.com/watch?v=kRsgavuG4sg&feature=related](http://youtube.com/watch?v=kRsgavuG4sg&feature=related)

</comment></comment><comment><USER12> Brian Eno - Music For Airports

</comment><comment><USER13> Maybe someone should create a Hacker News (or hacking music) group on last.fm?

My hacking music preferences:

<http://www.last.fm/user/zenlinux/>

</comment><comment><USER14> Boards of Canada, Thievery Corporation, Morcheeba, Zero 7, Massive Attack, Daft Punk, Kid 606, Royksopp

zenlinux's idea of a last.fm group for this is an excellent idea.

</comment><comment><USER15> This question seems to come up once a week. People never get tired of answering it.

<comment><USER16> If we don't keep our supply of hacking music fresh then we could all die... I mean, stop hacking as well.

</comment></comment><comment><USER17> I tend to listen to something from the death metal genre <http://www.newmetalarmy.com/band/unleashed>

or maybe in the thrash genre

<http://www.newmetalarmy.com/band/evile>

</comment><comment><USER18> Space rock (God is an Astronaut) <http://www.last.fm/music/God+Is+an+Astronaut>

and another in the same sort of genre 'Gold Four' <http://www.last.fm/music/Au4>

<comment><USER19> They're on a US tour at the moment. Playing in Boston at the Mid-east on the 19th of March. Great band, a friend in Dublin claims they're the loudest band he's heard in ages.

</comment></comment><comment><USER20> I think this has been discussed a couple of times here:

<http://news.ycombinator.com/item?id=61831>

<http://news.ycombinator.com/item?id=99936>

<comment><USER21> As new users sign up to HN, and older submissions drop down the list, it's the sort of question which is apt to come up a couple of times.

<comment><USER22> Yes, and it's the kind of thing searching was invented for. But for some reason HN refuses to provide a way to search posts and comments (no, having to go to Google and search news.ycombinator.com is not decent search. Google doesn't take into consideration how long ago a post was, how many comments it had and how many votes it received, all information I think is useful for determining relevance of the results).

<comment><USER23> <http://www.searchyc.com>

</comment></comment></comment></comment><comment><USER24> Philip Glass is my favorite to listen to while coding. It's prefect for both background music while focusing on a difficult problem and for putting into the foreground when you just need to take a second away from the problem.

</comment><comment><USER25> All kinds, the only time I avoid music and keep silence is when I have to do reading/writing stuff. Probably the same reason I find reading and writing to be more of a chore and coding/designing more enjoyable.

<comment><USER26> Go for instrumental music, it doesn't activate the part of your verbal part of your brain. Essentially to hear singing (or talking) your brain mimics it, however when you're trying to read/write you've got two processes and only one processor to put it through. You can struggle through, but not nearly as well as running them solo.

Also, just go onto TPB or usenet and download some Beethoven or Wagner. It's 100% legal, no copyrights exist on them and even if they did they're so old it'd be void anyway. Even the BBC offered them up for free at some point, they were surprisingly good quality too.

I learnt this a long time ago when I was working doing reviews. When you spend 10 hours writing reviews, you need something to listen to or you're going to start shooting kids and spearing dogs for making the slightest noise.

<comment><USER27> What also works is recorded rain sounds, and James Horner (A Beautiful Mind soundtrack). Loud enough to drown out the talking, but doesn't interfere with the thought process.

<comment><USER26> I heard whale song, and ocean sounds now thinking of it, is supposedly good, however I've never bothered to try it. I'll have to find somewhere to get it that doesn't charge $20, it'd be cheaper to go to the ocean myself.

</comment></comment></comment></comment><comment><USER28> Progressive trance streamed from ETN.FM.

<comment><USER16> Yeah, progressive trance, dnb, and hard house (I think it's called).

</comment></comment><comment><USER29> I listen to a lot of Pandora... but recently, I realized that iTunes has radio stations built in. A really good trance station is Electronic -> ABF Underground.

</comment><comment><USER30> Devo, Gary Numan, Captain Beefheart and His Magic Band, Janis Joplin, Led Zeppelin, Rolling Stones, Muddy Waters, Derrick May, Juan Atkins, Drexciya, Dan Curtin.

</comment><comment><USER31> It varies, though it tends to be noisy repetitive semi-drone electronic-ish stuff.

Lately I'm liking Holy Fuck.

(Though I dug up some Hawkwind, too, for some odd reason.)

</comment><comment><USER32> I prefer to Enjoy the Silence.

<http://www.youtube.com/watch?v=Hd7y6A-5uTY>

</comment><comment><USER33> Wow, we all have pretty similar tastes. I always listen to something that has a steady beat and fight for my attention, so anything too lyric heavy is out the window.

Proton: www.protonradio.com Frisky: <http://www.cbs.nu/home/> CBS: www.cbs.nu/home/ Radiomagnetic: www.radiomagnetic.com

</comment><comment><USER34> Mostly instrumental music, primarily some type of jazz or classical.

If I am in a noisy working environment, then I keep the music going pretty much constantly, to block out extraneous noise. In general, the more quiet and peaceful my environment is, the less music I listen to while working.

</comment><comment><USER35> Bands: Infected Mushroom, Shpongle, Sigur Ros

iTunes Radio: Electronic->AH.FM, Ambient->Drone Zone on SomaFM

</comment><comment><USER36> NIN - a downward spiral. Daft Punk - Alive. Timbaland. Kraftwerk, Chemical Brothers, Radiohead.

</comment><comment><USER37> Gothic radio on the net. R1Live, darkwave or www.gothicradio.tv.

All that screaming behaves almost like white noise for me :-P

I once downloaded a recording of heavy rain from a nature site. I found that sound very very conducive to coding :)

</comment><comment><USER38> Mostly dubstep recently, since you can just sink into it and get into a nice groove: <http://dubstep.fm>

IDM or drum n bass for occasions where hardcore coding is needed.

</comment><comment><USER39> bassdrive.com, itunes -> radio -> electronic -> bassdrive ...

</comment><comment><USER40> Pandora's (<http://www.pandora.com>) is pretty cool to run in the background. I've discovered lots of new music through the site..

</comment><comment><USER21> When I was still working in an office, I found listening to film scores, in particular, very helpful in shutting out the noise of the office.

<comment><USER41> I'll second that. My suggestions are: American Beauty, Atonement, Braveheart, Gladiator, Lord of the Rings I II III, Meet Joe Black, Requiem for a Dream, The Last Samurai, and There Will Be Blood.

<comment><USER21> The soundtracks to Batman Begins and the Battlestar Galactica mini-series are not dissimilar to that for There Will Be Blood (which I've just been to see).

</comment></comment></comment><comment><USER42> For this last project a lot of what I listened to was the Battlestar Galactica soundtrack by Bear McCreary.

</comment><comment><USER43> Mozart and Bach! Agreed w/ one of the other entries. "Accept no substitutes for true greatness."

</comment><comment><USER44> This is definitely a page I'm going to have to come back to. One look through is not enough.

</comment><comment><USER19> Groove Salad at SomaFm: <http://somafm.com/>

</comment><comment><USER45> I beatbox.

</comment><comment><USER46> Music when coding is a MUST! Preferably a band you love/like.

</comment><comment><USER47> Lately: Moby, Kenna, Cee-lo, goodie mob, david bowie, prodigy

</comment><comment><USER48> techno/trance. ETN.fm / DI.fm type stuff in iTunes Radio

</comment><comment><USER49> J.S. Bach. Accept no substitutes for true greatness.

</comment><comment><USER50> Lately I'm listening: Read My Mind - The Killers

</comment><comment><USER51> Mostly hip-hop, especially freestyles.

</comment><comment><USER52> pandora FTW!

stations i created "rabbit in the moon" "hacker radio" "garbage" "fluke"

any other cool strings to create stations off of?

</comment><comment><USER53> They Might Be Giants

</comment><comment><USER54> Paul van Dyk

</comment><comment><USER55> daft punk

</comment><comment><USER56> enya

</comment><comment><USER57> psytrance or any kind of hypnotic techno music when programming</comment>