Superheroes don't work 90-hour weeks - <AUTHOR> http://www.bbc.co.uk/news/business-42705291 <comment><USER2> At a startup I worked at previously we introduced head-space and heads-down days.

Head space was an experiment where every fortnight, at Friday noon it was tools down and do what ever you want. You were encouraged to go away from the office. Ride your bike, have lunch with your wife/husband or family. What ever you thought was giving you head space.

Heads down days were every Tuesday and Thursday of every week. This meant, on those days no meetings. Work from where ever you want. Turn off Slack. Close your email client. The idea here is "planned" uninterrupted time so you get into the zone for a long stretch of time.

Edit: Oh. Forgot about this. The other Friday afternoon every fortnight we would do "refactor" afternoon. It's were the dev team would come together and refactor parts of the code base as a team. You would get to see parts of the code you'd normally never work on and some really great discussions came out of that.

<comment><USER3> We had a proposal for meeting free days but then a lot of people got nervous and it got reduced to a meeting free afternoon and then nothing. It seems a lot of people ca't live without meetings. For me it was perfect though.

<comment><USER4> Several positions involve interaction between people and organizations as their main responsibility, such as HR, sales, pure management, etc. What are they supposed to do on meeting free days?

<comment><USER5> Organize. Go through backlogs. Read reports. Learn what engineers are up to. Meditate. People whose jobs are the non-programmatic glue in a company and thrive on human interaction would benefit a lot from stepping out of their domain in any number of ways, or destressing, sorting through their mind, etc.

</comment></comment></comment></comment><comment><USER6> I keep getting the calendar used against me.

I'm super human by all honest measures, but management without fail starts giving me guff about going to the gym and having lunches away from my desk. I can venture into justifying that I don't use social or anything on the clock which creates clear head space, etc etc, but it'd fall on deaf ears... I'm old school like that.

But the calendar creates an attack surface. I don't want to work at such companies, it's not always been that way, but it's been consistent across shit rung startups.

Management wants me at my desk 12 hours a day and always on call, and makes "jokes" about anything that I mark as time I want away from my desk. Often 2 hours discussions start 15 minutes before I have an outside event noted.

I quit these jobs when the abuse threshold is crossed, but the departments are made up of mostly people on visas etc so they're not so lucky. It should never strike management as a surprise when I leave, but I get the impression they're used to dishing out abuse to "non-compliant" programmers. The bros thrive, the meek get beat down and go home to lonely apartments full of cats where they passionately code themselves to sleep with Netflix.

<comment><USER7> I quit when they expect me to stay beyond 5pm. It's software. It can wait more often than not.

<comment><USER8> I've found that a lot of problems solve themselves if you stay away long enough. I can't count the number of times that some urgent issue came in when I went on vacation and by the time I got back there were more emails saying that it wasn't needed after all, or "nevermind".

</comment></comment></comment><comment><USER9> There are not many people that actually work x hours even though they are at the office for x hours. So when they say they work 90, does that mean they actually is focused and doing actual work for 90?

<comment><USER10> I got down to 10 hours a week at one job. They never bothered to give me a pay rise, so I continued to do the same quantity of work, and tapered down my hours to compensate.

I never once heard them complain about my output.

<comment><USER11> That's my "secret" strategy too. I gradually lower hours I actually work and spend remaining times learning new things so I can get a better job. Never had complains too, so I see this as win-win situation -- employee get the work they pay me for done and I don't feel too bad about not being compensated enough. Funny thing though, every time I say I quit in such situation, I get a counter-offer of similar size or even bigger.

</comment></comment></comment><comment><USER12> For everyone interested there's an excellent book on running a bussines called Rework with exact same phrase "you're not a hero if you work long hours".

</comment><comment><USER13> If ya wanna see a hero go to the morgue.

<comment><USER14> Would you please stop posting unsubstantive comments to HN?</comment></comment>


Here is My Glimpse of the Future - <AUTHOR> http://www.softwarebyrob.com/2009/03/09/here-is-my-glimpse-of-the-future/ <comment><AUTHOR> While the message might be genuine and the site founder might have legitimate intentions to help other software developers succeed in business, the tone and style of the language reminds me too much of the language used in self-help seminars or pyramid schemes promising grand rewards if you simply follow the given advice.

It unintentionally and perhaps naively raises my suspicions and skepticism.

</comment><comment><USER2> I hate how the "message" isn't just on the site for us to see. If Rob isn't doing something underhanded, why insist on email?

There is a solution, though. If someone were to create a throwaway email account, say firstname.lastname@example.com_ and use a password we could all guess, like _spam88_ , and have <http://www.sixfiguresoftware.com/> send its "message" there, then people on HN could read it without trusting leaving their own email accounts vulnerable to marketing spam.

Bug-myinbox-not if you will.</comment>


We Have a Retirement Savings Problem. Politicians Can Help - <AUTHOR> http://www.nytimes.com/2016/11/12/your-money/retirement-savings-problem-politicians-can-help.html?em_pos=small&emc=edit_dk_20161111&nl=dealbook&nl_art=2&nlid=65508833&ref=headline&te=1p <comment><USER2> It's astonishing that the New York Times is still parroting this line.

If they cared about pension security they would advocate expansion of social security or defined benefit pensions.

Defined contribution pensions make Wall Street rich but they are a failed policy in terms of improving the security of ordinary folks. Quite possibly they've left a trail of destruction in the economy: twenty years ago a person might use their own money to start a business, but instead that money is locked up in a 401K and subsidizing huge businesses at the expense of Wall Street. Combine that with the inacessability of health insurance for the self employed and that's poison for competition and any kind of economic democracy.

Clinton can go and live on her millions, but I'm worried about losing my health insurance because of her big sense of entitlement.</comment>


The Resolver One (Python) Challenge - $25,000 - <AUTHOR> http://www.voidspace.org.uk/python/weblog/arch_d7_2008_12_13.shtml#e1042

<comment><USER2> This looks like something I could use on my OSX desktop but unfortunately this is a Windows-only product. Here are the full requirements:

      What are the system requirements for running Resolver One?

      ''Software'': Resolver One requires Windows XP or later, with .NET 2.0 installed.
      If you don't have .NET 2.0, you can download it from Microsoft (it's free).

      ''Hardware'': The minimum specification for running Resolver One is a Pentium 4 at 2GHz
      with 512Mb RAM. We recommend a Pentium 4 at 3GHz with 1Gb if you're running Windows XP or
      2Gb if you're running Windows Vista.

      Does Resolver One work under MacOS or Linux?

      Not right now, but it is something we're looking at. In particular, we have been able to get
      the Resolver One Web Server running on Linux using Mono internally; we will post instructions
      on how to do this soon.

<comment><USER3> You can run a windows instance on EC2 or similar for $.12 per hour, and connect to it with rdesktop. Personally, I find this better than trying to run things under Mono, etc: I can use resource-intensive applications from my laptop without roasting my thighs.

<comment><USER2> Sounds like an interesting option for developers who would like other people to try out non-trivial Windows applications like Resolver One in a safe way: put a trial version of your app on a public AMI for anyone to use.

</comment></comment></comment><comment><USER4> I wonder how effective a prize like this is for marketing? I've been considering doing a prize for <http://utilitymill.com>. I certainly couldn't do 25K, but maybe $500. Would that be enough to entice people? Think it would be worth it?

I don't see a lot of legal stuff for this resolver prize. Is that not really necessary?

</comment><comment><USER5> putting python code in spreadsheet files?

sounds like a security nightmare unless they sandbox with pypy.

</comment><comment><USER6> What's the commercial thinking behind the giveaway?

How do these guys make money?

<comment><USER3> a) Every new sale gets them $200, much more for the bells-and-whistles financial version. It won't take many sales to make back the prize money.

b) It's being used largely inside organizations, which need a push to share what they're doing with resolver. [I'm in this situation: I've done some cool things with resolver, but been asked not to talk about them. I may use the prospect of prize money to nudge my client into loosening up on the secrecy]

c) It's a very good piece of software. People trying out the app are likely to come away loving it.

d) Potential customers may be worried about buying something with a small user-base. A competition like this makes the number of existing users more visible, and maybe draws in new ones.</comment></comment>


Leo P. Kadanoff, Physicist of Phase Transitions, Dies at 78 - <AUTHOR> http://www.nytimes.com/2015/11/02/science/leo-p-kadanoff-physicist-of-phase-transitions-dies-at-78.html <comment><USER2> Kadanoff was a giant, one of the most influential physicists the general public doesn't know about. He was the first person to really understand what the renormalization procedure does. It had been previously regarded as a somewhat suspicious trick; Feynman famously called it a 'dippy process". After Kadanoff & Wilson's work, it was recognized as the central organizing principle of quantum field theory.</comment>


Nokia Thinks You've Just Been Beta Testing Smartphones - <AUTHOR> http://www.tomsguide.com/us/nokia-smartphone-beta-test-death-grip-fragile-lumia,news-14671.html

<comment><USER2> And Nokia smart phones don't pass the test.</comment>


A Centrist Blueprint for Immigration Reform - <AUTHOR> https://outlookzen.com/2019/03/20/a-centrist-blueprint-for-immigration-reform/ <comment><USER2>
      we should strive to emulate early 1900s immigration levels

That would mean a 65% _reduction_ from present levels.</comment>


The Wrong Patient (2002) - <AUTHOR> http://annals.org/aim/fullarticle/715318/wrong-patient <comment><USER2> It sounds like they weren't using the medical record number for convience-- what about simply adding a check digit or letter to names so that maybe people could be trained to say that if they insist on using names alone?

</comment><comment><USER3> This article is from 2002.

Health systems are complex and mistakes happen.

Its great that articles like this get published to ensure that we continue to learn from our mistakes and highlight the efforts we go to try to prevent them.

<comment><USER4> This patient survived. I worked in a hospital about 40 years ago. A young man came in with a laceration and required inpatient treatment. He was allergic to aspirin so the nurse gave him ASA (acetylsalicylic acid, AKA Aspirin.) He died. I wonder if that kind of thing still happens.

One effort to avoid this kind of problem is to use check lists. Book about that was published in 2009. (The Checklist Manifesto) [https://www.amazon.com/Checklist-Manifesto-How-Things- Right/...](https://www.amazon.com/Checklist-Manifesto-How-Things- Right/dp/0312430000)</comment></comment>


Three Things - <AUTHOR> http://blog.codinghorror.com/three-things/

<comment><USER3> This is shockingly bad advice.

Jeff Atwood doesn't like TODO lists[1]. Jeff Atwood estimates that all projects will take 6 to 8 weeks[2]. Coincidence?

Be a pro. Learn the blocking and tackling of your craft. Read Getting Things Done[3].

Use a tool like Evernote for ubiquitous capture. Take notes at your stand-up meeting. Take notes at all meetings. Be the keener in the front row at conferences taking notes.

Put your TODOs in a tool like Things or OmniFocus.

Do a weekly review. Do a monthly review. Do a quarterly review. Do an annual review.

Set goals and KPIs for yourself every week, month, quarter, and year.

Get peers and mentors to give you continuous feedback. Ask them to rate you from 1 to 10 on different skill-sets and facets

Put everything time-based in your calendar. Going to the gym? Put that in the calendar. Going on a date? Put that in the calendar.

Get a paper file for stuff you can't digitize. Get a scanner. Scan stuff into Evernote or use your phone/tablet camera.

Use a pomodoro timer and count the number of sprints you can finish in a day. Use a tool like Harvest if you bill hourly. [4][5]

Trying to find a job? Trying to close consulting clients? Create a pipeline in Trello.

Use RescueTime and Timings.App to measure where your time goes. [6]

Be a pro. Don't listen to this shockingly bad advice.

      [1]: http://blog.codinghorror.com/todont/
      [2]: http://blog.codinghorror.com/on-our-project-were-always-90-done/
      [3]: http://en.wikipedia.org/wiki/Getting_Things_Done
      [4]: http://bookofhook.blogspot.ca/2013/03/smart-guy-productivity-pitfalls.html
      [5]: http://en.wikipedia.org/wiki/Pomodoro_Technique
      [6]: http://timingapp.com

<comment><USER4> Shockingly bad advice, eh?

[http://daslee.me/productivity-by-ron-conway](http://daslee.me/productivity- by-ron-conway)

"I finally settled on a system. I asked Ron [Conway] what he does. It's pretty simple. In the morning, he sets three things to do for the day. If he does all three, then it's a good day. If he doesn't, then it's a bad day."

<comment><USER5> Yes, shockingly bad. You seem to have missed a key part of that link - I'll put it here for you:

"Tactically, I take 3 things from my Asana and label them with "@TODAY." If I get them done, it's a good day. If not, then it's a bad day. Simple but not easy."

There may be 3 things to do that day, but it all initially comes off of the TODO list that you don't want to use for some reason.

</comment></comment></comment><comment><USER6> Good for him that he have only three things to worry about every day, but it's pretty silly to assume everybody else have that much free time, and only three things to worry about any given day...

I understand he means three main things by "Three Things" for the day, but why the earth would you want to memorize a shopping list or dozens of small things you need to do? I found that keeping small things OUT of my head actually helps me very much because, they aren't popping up throughout the day as I know they are safe and I just need to look them up and do them eventually. David Allen suggests this in his GTD book, [1] and it really free my mind from anxiety of forgettings, losing things! Great advice.

Also every issue tracker in the world is a huge TODO list, I'm sure he has a couple if TODOs in one of those. ;)

[1]: [http://en.wikipedia.org/wiki/Getting_Things_Done](http://en.wikipedia.org/wiki/Getting_Things_Done)

<comment><USER7> Agreed. GTD can be combined with this though (if you just ignore most of his post and focus on the "Three things of the day" point). ZTD calls these three things for MITs (Most Important Tasks) -- [http://zenhabits.net/ztd- habit-3-plan/](http://zenhabits.net/ztd-habit-3-plan/)

</comment></comment><comment><USER8> The problem is never dealing with the things you have to do today -- It's dealing with the things you don't. Whether it's things you need to do sometime in the future, or things that you may never need to do at all, or the things that you want to do.

For me, keeping track of the three things I'm doing today is far less of a problem than making the decision what those things are, and in being able to file things away so I can say to myself (and to others), "If it's important, I'll deal with it (and won't forget that it exists), but for now it's not my top priority".

<comment><USER4> Isn't that the whole point of this approach? The hard thing about hard things is deciding what they are.

<comment><USER8> The point I was trying to make is that, over the course of the day, things come up. Most of them I don't need to deal with now, I might need to deal with them in the future, but I don't want the cognitive load of worrying about remembering them while I'm trying to do other things. Hence, I write them down. Maybe "thing #1" of my three things some days is "figure out what the other two things for today" should be, but it's nice to have some sort of bucket to dump thoughts into for processing later. Call it a remembrall, or a todo list, but it's silly to pretend it doesn't exist.

</comment></comment></comment><comment><USER9> But, where do you put those three things? Do you just nebulously "say" them to yourself every morning? When? Should those three things not be concretely articulated? Should they not be staring you in the face throughout the day?

I think it's the "honoring the todo list"and "actually making the daily todo list" that's hard. How do you do that?

<comment><USER10> He's on his soap box, again. Apparently, he's an expert in absolutely everything under the sun. Therefore we must listen to him, err, or something like that.

Treat it like a plain blog. Take it with a grain of salt as it's just one way, one person's opinion. If you like it, great. If not, move along... Just because he's got good advice on certain topics, doesn't mean we should listen to him on everything else. Classic intelligentsia syndrome.

</comment></comment><comment><USER11> Hrm. Our entire lives are task lists of some sort.

\+ Your calendar with your list of meetings

\+ Your inbox with your list of unread emails

\+ Your snail mail

\+ Your personal needs (mow the lawn, paint the bedroom)

\+ Voicemails, text messages, facebook pings

\+ Your personal goals (learn to speak spanish)

Every single one of these things is a task. I can't imagine Jeff Atwood is saying that his day is:

1) Write a blog post

2) Do job

3) Do personal life

Does checking and responding emails not count? Does checking text messages from friends and family not count? Does making sure your bills are being paid not count? What about remembering to go to home depot to get drywall or getting your oil changed, or getting groceries or learning to make alfredo?

</comment><comment><USER12> This is actually the very reason behind a side project & successful Kickstarter I've been working on called Taco ([http://tacoapp.com](http://tacoapp.com)). Taco essentially aggregates all of my tasks across multiple task services (Asana, Basecamp, GitHub Issues, Trello, Starred GMail Emails, + ~40 others) and puts them on a single screen. This effectively allows me to prioritize across my entire life rather than within a single project. The added benefit is that it helps me stay focused throughout the day since I'm not switching between apps. At the end of each day, I just set aside the tasks I want to work on for the next day - <USER2> similar to what Jeff is suggesting here.

</comment><comment><USER13> Amen Jeff. I had a todo-list problem with digital tasks that I needed to do in the future. That led me to the startup that I'm running right now. [https://itunes.apple.com/us/app/later/id725222144?mt=8](https://itunes.apple.com/us/app/later/id725222144?mt=8)

</comment><comment><USER14> There's no reason to throw away crutches. Hell, I already implement his "three things" method. The only difference is afterwards I actually write down the three things so that I stay on target all day.

</comment><comment><USER15> What a pedantic article. The effectiveness of to do lists, or any other work management tool, is extremely sensitive to both the nature of the work and the nature of the person.

Some people can be effective thinking about 3 things all day? Great. I envy them. I'm not one of them. To do lists help me minimize the transition time after I finish something and quickly prioritize. But that's not everyone. I'm sure there are others best served by thinking about 3 things.

But to pretend that this method or any other is best for everyone is childish.

<comment><USER16> Also, when I imagined him slapping the thing onto pillows, I imagined that the screen cracked anyway. What a jerk. He should have asked me to imagine one of those stunt man long fall air bags. I also imagined that I used a nice tablet computer instead of an ordinary notepad, but that can't be helped. My imagination likes nice things.

For me, keeping even as few as 3 things in my head all day instead of writing them down is needlessly tying up 3 mental registers that could be used to speed up the thing I am doing right now.

</comment></comment><comment><USER17> I choose to interpret this in a way that isn't anti-planning, just anti- scheduling. Pmarca wrote up a similar anti-system a while ago, although it is more structured: [http://pmarchive.com/guide_to_personal_productivity.html](http://pmarchive.com/guide_to_personal_productivity.html)

</comment><comment><AUTHOR> This is how I do todo lists, using a zsh alias to create files in my desktop, which is generally otherwise empty

[https://github.com/bevacqua/dotfiles/blob/master/zsh/aliases...](https://github.com/bevacqua/dotfiles/blob/master/zsh/aliases#L5-L11)

<comment><USER18> This is not a bad idea actually. I'd be pissed if my desktop had icons on it and want to complete them quickly.

<comment><AUTHOR> That's how I feel too, which is why I find that command effective.</comment></comment></comment>


Open Source alternative to Evernote - <AUTHOR> https://github.com/Laverna/laverna <comment><USER2> I've been looking for something like this of late. I like Evernote, but I don't like keeping such a valuable treasure trove of notes on another server.

I looked at Laverna, also turtlr, and a few others.

Eventually I settled on Tiddlywiki - [http://tiddlywiki.com/](http://tiddlywiki.com/)

It's simple, runs well on a server, and is decent in a mobile web browser. What's missing is web clippings, which I love doing. For that I use 'scrapbook plus' in Firefox.

</comment><comment><USER3> > The application stores all your notes in your browser local storage spaces > such as indexedDB or localStorage, which is good for security reasons, > because only you have access to them.

Unfortunately the reason I use Evernote is to quickly document then later share idea docs with the other members of our team - Any chance of a future server-side storage?

</comment><comment><USER4> I'm not a big fan of Evernote, but seeing Evernote consists of a whole suite of various collaborative note taking/memory helper products (not just Evernote, but Skitch, Penultimate and others really provide added value), with native app clients on nearly all platforms, this is _not_ an alternative to Evernote. Evernote _can_ be used as a simple note taking utility, but it _is_ in fact much more than that.

This is not to say that this doesn't look a nice note taking app. It really does. I'm just pointing out that "being an alternative to Evernote" entails a lot more than being a nice-to-use web app. It's like claiming you have open source alternative to Photoshop - and after clicking the link you end up looking at GNU Paint instead of GIMP.

</comment><comment><USER5> You can take a look on Tagspaces - [http://tagspaces.org](http://tagspaces.org) which is also open source. It is not using a database and saves all the needed information directly on your file system. In my experiences this feature makes my notes extremely portable across my mobile, my laptop and my tablet...

</comment><comment><USER6> I like my notes to be synchronised and even though I connected it to dropbox, my phone and my computer didn't see eachother's notes.

</comment><comment><USER7> [https://gist.github.com](https://gist.github.com) works reasonably well for me

</comment><comment><USER8> Page contains chinese/strange unicode chars for me.

<comment><USER9> You have javascript disabled?

<comment><USER8> Nope, the thing seems to work.

<comment><USER8> I think it's because I have "Allow pages to choose their own fonts, instead of my selections above" Firefox feature disabled.</comment></comment></comment></comment>


Tracking leaks on NDA beta Xbox 360s by embedding serial number on-screen - <AUTHOR> https://twitter.com/cullend/status/1071884772064944128 <comment><USER2> Not as subtle, but Star Citizen's NDA test servers have hidden watermarks to track where screenshots come from. Someone pulled up the edges to show one here: [https://i.imgur.com/FXzwlYd.png](https://i.imgur.com/FXzwlYd.png)

You still get leaks because people take screenshots for their bug reports, upload them somewhere (even with an unlisted URL) for discussion on the bug reports forum, and then other users under the same NDA can download your screenshots and share them (rather than getting busted for leaking their own). So having a screenshot from a bug report leak isn't necessarily actionable for banning people.

But it's still useful to prevent, say, users under NDA streaming the super buggy builds on Twitch. Once they're relatively stable, CIG drops the NDA requirement, opens testing to a wider audience, then eventually push out to the main servers.

Doing this with a disguised UI component is a pretty cute implementation.

<comment><USER3> As an early backer of Star Citizen, I wish they focus more on making the game instead of chasing down leakers.

<comment><USER4> Because SC is not actually a game. It has evolved into a dream business. They are selling dreams. So secrecy is most important, else the glamour collapse. They lost me when they hired Gillian Anderson, but DRM ridiculousness is on the same level. Such things should not be the focus of a studio working to provide an actual game.

<comment><USER5> I have thought about this and realized I don't have the knowledge of how Gillian Anderson and the other big name actors have been compensated for their involvement to be critical. Maybe the actors receive the rights to their hirez digital scans, for example. Maybe the actors are getting a cut of the eventual 'box office take.'

<comment><USER2> The digital scans on their own probably aren't worth much, doing anything with them is a lot of modeling and shader work tied to the game engine. My bet's on good old fashioned money, possibly a cut of Squadron 42 sales, but probably not a cut of the giant pile of crowdfunding.

Mark Hamil and John Rhys-Davies might have been an easier sell, having been in Wing Commander. For the rest, maybe they were excited to work on something that hasn't been done before. The quality of the characters shown in the trailer is crazy.

<comment><USER4> Such actors do not work for cuts of crowd-funded games. They may get residuals or a share of sales, but they were paid cash for their time. You can hire C and D-list with promises of future pay, but A/B demand money.

<comment><USER2> I was thinking more "both" than "only potential future money if we ever finish it"

<comment><USER6> A cut of future money means no money. Anyone who is even a bit savvy and carries the kind of clout that comes with a big bank account doesn't need to work for empty promises. If they were promised both, it would be really surprising to me if the immediate money wasn't already enough to pay them for their time. Given that that is the case, "both" suddenly doesn't make sense anymore.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Always amused me: Sky used to use a pint glass on subscription sports package for pubs/bars. But some sneaky publicans were sticking pint glass stickers to the corner of their screens to fool inspectors... So now the glass has a different filling depending on the day.

<comment><USER8> The Spanish football league app turns on the microphone to listen if a game is playing and reports back to La liga with the exact location to find bars and restaurants with pirate broadcasts.

[https://techcrunch.com/2018/06/12/spanish-soccer-app- caught-...](https://techcrunch.com/2018/06/12/spanish-soccer-app-caught-using- microphone-and-gps-to-snoop/)

<comment><USER9> Wow, surprised this hasn't generated more coverage. They've turned a giant chunk of their userbase, likely completely unknown to a majority of users who understandably won't read the small print, into snitches/whistleblowers.

This presumably also inadvertently returns the home address of anyone opening the app while watching a game in their own living room? Not a huge stretch to move from pursuing public places without the correct licensing to pursuing individuals for pirate streams.

> "It also specifies that the feature is only deployed in its Android app."

Probably because this nonsense would cause a hellstorm in App Review on iOS.

<comment><USER10> > Probably because this nonsense would cause a hellstorm in App Review on iOS.

Or because it wouldn't be approved in the first place. Say what you want about walled gardens, but at least someone is policing the ecosystem.

<comment><USER11> I think that's what he meant by "App Review":

"App Review - We review all apps and app updates submitted to the App Store in an effort to determine whether they are reliable, perform as expected, and are free of offensive material."

[https://developer.apple.com/app- store/review/](https://developer.apple.com/app-store/review/)

</comment></comment></comment></comment></comment><comment><USER12> I met a dev who worked at Paypal that was pushing to steganographically add the IP address of the request client to the Paypal logo on every page load.

The reasoning being that you could then look at any phishing/scam site that included the logo and find the IP of the perpetrator (presuming a bunch of other things).

<comment><USER13> While this might catch some folks, many phishing/scam sites can route their requests through residential proxy networks. There are plenty of legitimate networks (e.g. ones that use free VPN offerings as a way to route traffic through your IP) with minimal KYC, and even more illegitimate ones based on botnets. This seems like a lot of engineering for a mitigation that's easily worked around.

</comment></comment><comment><USER14> Related: Anyone else noticed how Google Maps is now doing more subtle watermarking where they embed their logo into Street View images using machine learning, e.g. here: [https://imgur.com/a/0T8wP2u](https://imgur.com/a/0T8wP2u) URL: [https://email@example.com,4.8793692,3a,68y,194...](https://email@example.com,4.8793692,3a,68y,194.22h,83.04t/data=!3m6!1e1!3m4!1s4WICi0WcvZTyKwm8wM3brw!2e0!7i16384!8i8192)

Edit: Look a the yellow area above the door obscured by the Land Rover. They embedded their logo along the shape & size of an appropriately sized feature on the building, as opposed to somewhere randomly where it would be more visible as it crosses e.g. the boundary between a building and a tree.

When I first spotted this I thought Google's logo was actually on that building, but it disappears as you zoom in/out.

<comment><USER15> I can't figure out what I'm supposed to be looking for in that image.

<comment><USER16> I didn't noticed it in the imgur link, the image was probably compressed. You can see it in the google maps link.

<comment><USER15> Now that I know what to look for, I can see it in your imgur image, but I don't actually see it on the live Google Maps link.

I do se a small one overlapping the steering wheel on the car, which doesn't appear to be particularly smart placement.

<comment><USER17> yeah I only see watermarks if I'm zoomed in all the way and they are way smaller and more transparant than what was in the imgur image.

</comment></comment></comment></comment></comment><comment><USER18> I'm surprised that so many people are surprised that this was a thing. Ever since I learned that tracking information is present but hidden in an Eve Online alliance's forum[0] for tracking down leakers, I've assumed that anything serious inside or especially outside a video game would have the same resources allocated.

[0] [https://www.reddit.com/r/Eve/comments/1ftvub/pl_forum_waterm...](https://www.reddit.com/r/Eve/comments/1ftvub/pl_forum_watermarking_unmasked_and_explained/)

<comment><USER19> Former EVE player (Nulli Secunda) and long-time software engineer.

I saw this way back when and now assume any kind of NDA'd or questionable text has uniquely-identifiable unicode replacement character sequences and invisible watermarks. It's just too easy to do.

<comment><USER20> Old lexicons had misspelled words put in to catch the copycats. Since they don't have to prove who did the copying it's easy, they just have to prove that the copy is from them.

We do something similar to our stuff. No need to prove who did the copying as they publish the stuff on their app/homepage and have exactly the same spelling mistakes as our homepage displays to the ip-numbers we know they are using for harvesting. Document all and send to the lawyers.

</comment></comment></comment><comment><USER21> Related - printer dots: [https://en.wikipedia.org/wiki/Machine_Identification_Code](https://en.wikipedia.org/wiki/Machine_Identification_Code)

Great tool to crack down on any clandestine poster campaigns.

<comment><USER22> Possibly also helped to find NSA leaker Reality Winner, after the Intercept published good-quality scans of documents she'd printed at work: [https://en.wikipedia.org/wiki/Reality_Winner#Intelligence_re...](https://en.wikipedia.org/wiki/Reality_Winner#Intelligence_report_leak,_arrest_and_sentencing)

<comment><USER23> Conversely, wouldn't this make it incredibly easy to frame someone?

</comment></comment></comment><comment><USER24> they also used a 'zebra' skin on prototype Xbox One consoles to be able to find people who leaked images of the physical console: [https://www.thetechgame.com/News/sid=8160/photos-of-an- xbox-...](https://www.thetechgame.com/News/sid=8160/photos-of-an-xbox-one- zebra-prototype.html)

Xbox have a reputation for watermarking things to a large extent to deter leakers. The first ever footage of Halo 4 Multiplayer came courtesy of someone recording it from a terrible camera, played on a CRT television, from a VHS recording, while in a barn. I would link it but it also has obnoxiously loud music playing over the top of it but if you search 'halo 4 barn leak' you will be able to find it. Admittedly I'm sure whoever leaked that went a bit too far for comedic effect

<comment><USER25> Zebra skins are also used on prototype cars / unreleased cars - not for traceability, but to obscure their form - very similar to the technique used in WW2 battleships.

[https://en.m.wikipedia.org/wiki/Dazzle_camouflage](https://en.m.wikipedia.org/wiki/Dazzle_camouflage) [https://encrypted- tbn0.gstatic.com/images?q=tbn%3AANd9GcTv1x...](https://encrypted- tbn0.gstatic.com/images?q=tbn%3AANd9GcTv1xOaFzir591tHFQeq03b4W35rdvZaV8i0WuD8GOcE5PuA_eX)

<comment><USER26> Dazzle camo was more of a WW1 thing.

<comment><USER25> Thanks for the clarification. I noticed that the Swedish navy still seems to use it ?

[https://www-thelocal-se.cdn.ampproject.org/ii/w1000/s/www.th...](https://www- thelocal- se.cdn.ampproject.org/ii/w1000/s/www.thelocal.se/userdata/images/article/f135320fc79a7c11e4c2442cd0e02113639cbaf6322a4eb4bf143bdd85ca8449.jpg)

<comment><USER27> That's splinter camo. Camouflage is used in general to disrupt outlines, but dazzle camouflage specifically used black and white to accomplish that goal.

[http://camopedia.org/index.php?title=Splinter](http://camopedia.org/index.php?title=Splinter)

</comment></comment></comment></comment></comment><comment><USER28> I suppose this is a perfectly cromulent use of "security through obscurity", and an excellent example of steganography.

I wonder if anyone thought about those rings or ever noticed they were different machine to machine.

<comment><USER29> On a related topic, it would be fun to embed the EURion constellation[0] into random things just so it results in difficult to trace side-effects. For example wear a t-shirt with it printed on, if someone tried to edit CCTV footage or a photo of you, it might error out.

[0] [https://en.wikipedia.org/wiki/EURion_constellation](https://en.wikipedia.org/wiki/EURion_constellation)

<comment><USER10> EURion only works on flat services (photocopiers and scanners). Photoshop detects currency based on a Digimarc watermark, which you can't generate without paying a licensing fee.

<comment><USER30> > Photoshop detects currency based on a Digimarc watermark, which you can't > generate without paying a licensing fee.

You can't generate _your own_ without paying a licensing fee. Nothing[§] prevents you from extracting existing watermarks and applying them to other things. This is called a _copy attack_. There are mitigations[1] but I believe they are not practical for banknotes. I've been told by a Digimarc representative in private conversation about the mentioned paper, that _" The Digimarc for Images solution does not utilize the exact functionality described in the paper [..]"_. This was in 2011, I don't know if things have changed.

[§] Ok, nothing technical at least; legally it's a different matter...

[1] [https://www.digimarc.com/docs/default-source/technology- reso...](https://www.digimarc.com/docs/default-source/technology- resources/published-technical-papers/commercial- applications/dmrc_image_signatures.pdf)

<comment><USER10> The current research in to the Digimarc currency watermark has determined an absolute minimal test case [1], however no one has discovered the exact watermarking mechanism. I was speaking in absolutes because we can't do a copy attack without knowing what features to extract.

Someone has enumerated all the detected regions on the 20 pound note [2] if you'd like to take a stab at it!

1\. [https://murdoch.is/projects/currency/cropped.png](https://murdoch.is/projects/currency/cropped.png)

2\. [https://murdoch.is/projects/currency/small_crops.png](https://murdoch.is/projects/currency/small_crops.png)

<comment><USER31> I don't know anything about Digimarc, but it looks like this tool may allow you to create watermarks as other people using the official digimarc software [https://github.com/flarn2006/DigimarcPIN/](https://github.com/flarn2006/DigimarcPIN/)

</comment></comment></comment></comment></comment></comment><comment><USER32> As someone who's been on a few NDA'd betas before... I just don't understand why people leak. Is it the feeling they can break the rules without likely facing truly serious repercussions? (Has anyone ever gone to jail or even been seriously fined for violating a video game NDA?) Is it the notoriety of it?

I mean, I won't deny there was a fun factor to having a New York Times reporter beg me to violate a Google NDA once. But even then, I had more fun knowing something the New York Times didn't than breaking my agreement, ruining my personal reputation/credibility as a trustworthy individual, etc.

And generally if I have access to these sorts of things, I'm enthusiastic about what the company is doing, and the last thing I'd want to do is sabotage them.

<comment><USER33> NDAs generally fall under civil law, and, with few exceptions (e.g. contempt of court), you can't be incarcerated for civil (rather than criminal) infractions.

You can still be fined to high heaven, though, and subject to forfeiture if you can't pay...

<comment><USER32> Have you ever actually heard of someone being fined over a video game NDA though? Players being banned for violating NDAs in closed testing isn't super uncommon, but I've never seen someone actually taken to court over it.

<comment><USER33> It would be up to the plaintiff (e.g. video game company) to claim monetary damages occurred, and to what extent. I haven't heard of it, but that doesn't mean it hasn't happened... the outcomes of many NDA cases are themselves not disclosed.

</comment></comment></comment></comment><comment><USER34> This reminds me of [https://www.ghacks.net/2012/09/12/blizzard-watermarking- wow-...](https://www.ghacks.net/2012/09/12/blizzard-watermarking-wow- screenshots/)

</comment><comment><USER35> Just as a thought experiment - what if they actually never implemented this. But now through this announcement, everyone will think twice before leaking BETA etc. program screenshots and second guess which UI elements might be the ones that are used to identify them. ;-)

That said, excellent example of steganography as pointed out by others too! Thumbs up!

<comment><USER36> Actually that was a trick they used in Windows 8 betas. They put a weird puzzle watfermark on it, except they were all exactly the same!

However I guarantee this was real, but hasn't been a part of the Xbox experience for yearrrs

<comment><USER37> How do you guarantee this, Cullen?

<comment><USER36> Because Steven has literally talked about this on Twitter.

<comment><USER37> You guaranteed the Xbox tracking, so I was referring to that. Not the puzzle.

<comment><USER38> Isn't his guarantee based on the fact that he was the one who did it?

</comment></comment></comment></comment></comment></comment><comment><USER39> Your (legally purchased/streamed) music is most likely also fingerprinted in a way degrading its fidelity [https://en.wikipedia.org/wiki/Master_Quality_Authenticated](https://en.wikipedia.org/wiki/Master_Quality_Authenticated)

</comment><comment><USER40> That's neat.

Lots of broadcasters do something similar (display a number on the screen) when they are broadcasting sports events etc to detect streaming. I'd love to know how that works. Presumably they broadcast the same thing to everybody, so is it actually the box/receiver which adds the number to the screen? Does everybody get a unique number, or do groups of people get the same one?

<comment><USER41> Apparently state level actors can defeat the watermarking...

> "There's nothing else like it in the world," Esteban Israel, beIN's > executive director of technology, said of beoutQ's level of sophistication. > "We work with all the top technology vendors, technology developers. We have > our experts, we deploy state of the art technologies and we have not seen > this anywhere else."

[https://www.nytimes.com/2018/05/09/sports/bein-sports- qatar-...](https://www.nytimes.com/2018/05/09/sports/bein-sports-qatar- beoutq.html?smid=matthewkeyslive)

<comment><USER42> The image of some crack antipiracy team hanging out in a war room is just so ridiculous to me. They say it's an individual subscriber's stream being rebroadcast, who has somehow managed to remove the watermark? Alright, just blank the stream for a few frames for half of your customers while watching the illicit stream. Binary search until you find the culprit subscriber. Even if you had 100 million subscribers it would only take 27 iterations to find. No one is going to mind or probably even notice that their screen flickers a few times.

Instead they've put together a team of highly-paid professionals bumbling about that they can't possibly figure out who is behind all this.

While it may be slightly more complicated in the real world, I suspect it's simply a case of justifying their own overpaid positions.

</comment></comment></comment><comment><USER43> "You're giving away all our best tricks" \- Wargames.

It's true. And boy did it surprise those leakers who wanted to show off the fancy new UI and the new avatars.

<comment><USER36> Hell it surprised half the people internally that got fired using this

<comment><USER43> Well probably all of them - otherwise they would have done it differently! :)

</comment></comment></comment><comment><USER44> I've worked on AAA games that have had similar watermarks to catch leak sources.

</comment><comment><USER45> OK, that's actually pretty cool.

</comment><comment><USER46> Movie companies have done this for a long time. I was friends with a movie critic back in VHS days, and the films sent to him to review before their release had a warning and an ID number that popped up every five minutes or so.

Strangely, not every film company did it. And it wasn't limited to just the big movie companies. It seemed pretty random. Maybe because a shotgun approach was cheaper.

<comment><USER47> There's also a forensic watermarking technique used that is invisible to the viewer. It is supposed to survive any kind of transcoding and scaling that might occur. I can't remember the name of it, but we would use it to encode videotape masters as well as for DVD/Blu-ray encodes. Very popular for use in Academy screeners.

<comment><USER48> Every new watermarking technique they come up with is discovered and obscured within days each year by the screener leak community. I think it's kind of a sport for them at this point.

<comment><USER49> If you have 2 leakers they can just run a tool to compare the difference between the file and spot any watermarks. Of course the next level is making the watermark so there is a bit that is unique to 2 users only so you will then know the exact 2 who leaked it.

<comment><USER50> Pretty sure they'll just start bisecting the screener population down.

</comment></comment></comment></comment></comment><comment><USER51> I might be too dumb to use twitter but where does he actually explain what he did? I only see a screenshot and reaction gifs

<comment><USER51> Turns out, yes, I'm dumb.

</comment></comment><comment><USER37> [Edit: Removed all commentary. I'm getting penalized for discourse around an unvalidated claim. I don't want to further affect my standing in the Hacker News community.]

<comment><USER36> Hello Raf. Someone in the comments below confirmed it, as well as on twitter :-)

As a side note, I don't see why after not having any substantial interaction in nearly a decade you continue to see the need to follow me around and harass me.</comment></comment>


Ask HN: Can we use AI to contain AI? - <AUTHOR> Dumb question from someone who doesn't know what they are talking about: From my understanding there is the problem of if AI gets so intelligent we won't be able to contain it. So prior to that event could we use the predictive capacities of the AI to help generate different scenarios/ways in which it would be able to over take us and then find solutions? Obviously we wouldn't want this to be our only approach. Thoughts? <comment><USER2> And then we will need AI to manage the AI that is used to contain the AI.</comment>


32 and 46-inch Android Coffee Tables to hit the market soon - <AUTHOR> http://hacksandstuff.com/news/multitouch-android-coffee-tables_1234126.html

<comment><USER2> So, what's the difference between this and [http://en.wikipedia.org/wiki/Microsoft_PixelSense](http://en.wikipedia.org/wiki/Microsoft_PixelSense) \- the OS? What other appeal does this bring?</comment>


Ask HN: What's the simplest tech to learn fully? - <AUTHOR> <comment><USER2> I think the best answer is "the one you're interested in" or maybe if you have a goal then use that?

Learning something completely is never simple, everything leads to the same thing.

<comment><USER3> > I think the best answer is "the one you're interested in" or maybe if you > have a goal then use that?

Ding ding ding, this is the correct answer. Something you have a vested interest in will always be infinitely easier to learn than some random thing someone else (who likely _is_ interested in it) suggests because they said it was easy.

For example, while not exactly a "super simple" topic, at work part of my responsibilities include maintaining/developing ETL jobs for copying data from a few data warehouses to local app dbs. I absolutely dread anytime I have to spend any amount of time working on these, I find it boring, the software terrible, the problems tedious. And, I'm certain if I spent a fair amount of time really learning the technologies/patterns/etc, it wouldn't be nearly as much of a chore. And, given I'm not working with google level terabytes of data, only a few 100 or so gigs, the scope of what I'd have to learn likely isn't terribly difficult. The problem is though, I have absolutely no interest in doing so, I only work on them because I inherited them, and if I were to need to do the same thing from scratch, I'd likely try something other than "enterprise" ETL frameworks, or more realistically try my damndest to find someone that actually likes doing this kind of thing so then I don't have to worry about it.

Contrasted to about a little over a year ago, I got super interested in CI/CD and containerization technologies. I started having no experience with CI, Docker, and really only having deployed things to heroku. However, I was fairly quickly able to get up to speed with the basics of the technologies, and then a short time after that I became the "Docker & CI" guy at work, I found that I was able to quickly and (hopefully) competently answer almost any question/issue coworkers were encountering. I now spend a fair amount of time configuring CI and containerizing older apps in our portfolio just because I thought it was fun/interesting to do, which provided me with even more opportunities to learn and find gaps in my knowledge. But, to some others, spending any amount of time configuring CI, fighting with a legacy codebase to get it's test suite to run in a containerized/CI environment , and building security scanning practices likely sounds absolutely dreadful, tedious, or a waste of time.

So, whatever you have an actual interest in learning completely will be the easiest, whether that be Machine Learning, full blown functional programming in Haskell, enterprise Java OOP, application architecture, compiler/language development, or even something as deceptively "simple" as building CLI tooling. Anything someone advertises to you as "easiest to learn" is something that person themselves are interested in, which is why to them it was easy, but if you don't give a shit about it, it likely will be a chore and far from the "easiest".

</comment></comment><comment><USER4> Boolean logic. It's applicable to every day programming and foundational to software in general.

</comment><comment><USER5> HTML</comment>


Remote teaching using Wacom tablet and Inkscape - <AUTHOR> Because of the virus, I wanted to share my solution for remote collaboration and teaching: https://github.com/amkhlv/mathpump3
Professor uses Wacom and Inkscape to draw a picture, which is incrementally transmitted to students' computers. Students, those who have Wacom, may interact. Or just watch. Transmission happens every time the svg file is saved. Transmission requires a RabbitMQ server, which can be easily set up. Basically, a class needs one person who knows Linux, to set up the server.
It is intended for scientific collaboration or teaching in small groups of people. I am now using it for teaching my QFT class, although it only has 5 students. In principle, it should scale, but I have not tried it for large groups... <comment><AUTHOR> Drawing with Wacom in Inkscape is a pleasure, once you get used to it. In some sense, it is more convenient than using a physical blackboard. Although, some training is needed...</comment>


Doctors Warn Sitting Disease Could Become the New Smoking - <AUTHOR> http://sacramento.cbslocal.com/2014/11/03/doctors-warn-sitting-disease-could-become-the-new-smoking/

<comment><USER2> This article desperately needs to pull some numbers out of proper studies instead of asking a doctor whether or not it's good to stay seated.

Because it's not. We know that, we want to know how bad.</comment>


China's secret goal is to crush Silicon Valley - <AUTHOR> https://www.cnbc.com/2018/05/22/chinas-secret-goal-is-to-crush-silicon-valley.html <comment><USER2> And Silicon Valley is preparing the golden platter by turning the internet into a series of big proprietary silos where might makes right.

</comment><comment><USER3> Don't think a place that has a blocked internet can ever achieve that. Silicon Valley is built by liberals.

<comment><USER4> China also "blocks" people. Silicon Valley recruits the best from all over the world. China's gov't is not ready for that many "foreigners" tromping around; it goes against their controlling senses.

Openness of info and people is a key to SV, and one of the reasons SV fears Trump's curbs on imported experts. (The H-1B system is abused for rank-and- file workers, though. I agree with T on that one.)

<comment><USER5> The number of people I know who had to go to China because their business is manufacturing is astounding. None seem to have much trouble getting over there. There are "special economic zones" setup specifically to keep the mixing contained. Shenzhen is the most famous.

<comment><USER4> Re: "Keep the mixing contained": Are they required to stay within a certain boundary, or at least "register" if they leave the boundary?

<comment><USER5> You can't setup your company outside the boundary and access to services is limited to that location. So while my understanding is you can drive where you want - your ability to stay there for long periods of time is limited. In addition you are required to register with the local police wherever you stay (hotels do this for you).

<comment><USER4> Interesting.

But whenever the gov't of a country has said, "We'll be the next X powerhouse!" and dumps money into it, it usually fails. The market tends to be a step or two ahead of gov't. In the late 80's Japan's gov't set out to make the country the king of high-def TV. When they finally had market-ready products, the world had moved on from analog to digital, making most of their R&D & patents obsolete. I suspect there will be (another) AI slump, and S.Valley will quickly move onto to something else. China will be left holding a bag nobody wants. The churn & burn of "cowboy capitalism" is bit too jumpy for their tastes.

<comment><USER5> The China model is actually pretty similar to the VC model, except with the government as the venture capitalist. I don't know whether it will work out for them or not, but one thing China has going for it is a higher level of pragmatism than most countries and the political power to make things happen.</comment></comment></comment></comment></comment></comment></comment>


Magic Leap has apparently raised another $350M - <AUTHOR> https://techcrunch.com/2020/05/21/magic-leap-has-apparently-raised-another-350-million-in-spite-of-itself/ <comment><USER2> > Magic Leap has reportedly received a $350 million lifeline, a month after > slashing 1,000 jobs and dropping its consumer business.

What the heck do a thousand people do at Magic Leap? That's an insane headcount for a company without a sales or consumer support team. And that's just the jobs they cut!

<comment><USER3> To be fair, none of these things are trivial: \- Creating an AR operating system \- Developing and manufacturing AR hardware \- Creating an SDK and a developer ecosystem for the hardware and software \- Creating a platform for selling AR apps, and selling B2B \- Doing R&D and filing patents for new AR tech

I don't think they are one of those companies where I wonder why they need people. They are doing something really hard. Maybe too hard.

<comment><USER4> prolly don't need an os. or a platform.

<comment><USER5> I'd imagine it's some kind of RTOS to handle the time sensitive parts of the graphics / AR stuff. Probably not custom kernel but they'd have to develop a lot of stuff around it.

As for the sales platform, why wouldn't they develop it? To attract developers they need to make it easy for users to buy the products those developers would be create. It's not like the early 2000's where you could launch a console without an online store, it's pretty much mandatory these days because both developers/publishers and consumers expect it to be there.

</comment></comment></comment></comment><comment><USER6> This is the startup equivalent of "too big to fail."

They have capitalized so much that they need to capitalize even more to make their previous capitalization make sense.

<comment><USER7> I doubt if we investors who funded earlier wil want to continue doing that. At some point they have to decide to cut their losses. Like wework

<comment><USER8> Only if the product begins to feel infeasible. But as computing hardware continues to shrink and ML improves their processes, I'm willing to bet a lot of investors see success as an eventuality.

</comment></comment></comment><comment><USER9> They must have something very valuable in the defense space.

<comment><USER10> Pretty much this. There's something else at play here given they haven't been left to crash and burn, and patents either resold or licensing deals inked. There's likely something actively being used or funded that can't be left to fall over as part of a wider scope of work or project. Given it's JPMC, only the board will "officially" be privy to it.

Nobody throws money into the fire unless they're trying to keep something warm.

Once that project ceases, those employees will be cut and the resulting tech or teams will be acqui-hired by an R&D arm or contractor who'll continue to pick at the bones of it.

JPMC is in the money business. Not tech. They're riding this beater until it finally conks out.

If you work for MagicLeap, get your CV out there.

</comment></comment><comment><USER11> Magic Leap has already signed over its patents to JP Morgan back in Nov 2019. Are those still acquirable assets in the event of an acquisition?

<comment><USER12> I read about this previously.

"Signed over" is too strong, it's more like their loan covenants mention the patents, but if you pay the loan, it doesn't matter.

</comment></comment><comment><USER13> > Whatever the case, the company is withdrawing the WARN notice (a 60-day > notification for large-scale layoffs) sent to staff in late April. The move > represents an apparent reversal of the massive layoff round it previously > announced.

What does that mean exactly? Were the people laid off given their jobs back? What does "withdrawing" a WARN notice even mean?

<comment><USER14> Is most cases, large companies need to give a 60 day notification if they plan a sizable layoff. So perhaps they were just given the notification but not laid off yet. But many employers will "pay in lieu of notice" and lay them off immediately with the 60 days of pay.

[https://en.wikipedia.org/wiki/Worker_Adjustment_and_Retraini...](https://en.wikipedia.org/wiki/Worker_Adjustment_and_Retraining_Notification_Act_of_1988)

</comment></comment><comment><USER15> I have got to see this demo

</comment><comment><USER16> Yay- hopefully the landlords can get paid now - [https://www.geekwire.com/2020/heavily-funded-magic-leap- sued...](https://www.geekwire.com/2020/heavily-funded-magic-leap-sued-seattle- landlord-52k-unpaid-rent/)

</comment><comment><USER17> >"We are making very good progress in our healthcare, enterprise, and defense deals," Abovitz writes. "As these deals close, we will be able to announce them."

Wouldn't surprise me if they sold lemons at such absurd contract prices that it made their investors giggle.

<comment><USER18> They've also made "very good progress" in AR for the past 5 years. I hope the deals won't turn out like this:

[https://www.youtube.com/watch?v=UZ7-F_vWUVE](https://www.youtube.com/watch?v=UZ7-F_vWUVE)

<comment><USER19> As funny as that is, this was recommended to me next:

[https://m.youtube.com/watch?v=n0uhkLa5lBg](https://m.youtube.com/watch?v=n0uhkLa5lBg)

Id buy that.

</comment></comment></comment><comment><USER20> > Magic Leap cited COVID-19 as a key reason for April's news.

Riiiigghhhht.

</comment><comment><USER21> A signal we'll be seeing something in this space from Apple soon...

</comment><comment><USER22> $3 billion total...

That's enough money to give $100,000 to 30,000 startups.

<comment><USER23> I mean that's simple math. But $100K won't pay the fully allocated cost of one senior developer for a year in a medium COL area.

<comment><USER22> what exactly is a startup to you?

(Assure you a $100k to a startup is not the same as $100k to Google.)

<comment><USER23> Whatever $100K is to someone, I know that what I said about salary is true. I've worked for small VC back companies with less than $10 million in revenue. $100K wouldn't have made a difference either way.

<comment><USER22> Here's small scale examples of $100k making a massive difference:

[https://www.businessinsider.com/where-are-they-now-peter- thi...](https://www.businessinsider.com/where-are-they-now-peter-thiel- fellowship-2017-3)

That said, $100k is not a salary and if someone needs $100k+ salary to do a startup for a year, startups are the wrong choice.

<comment><USER23> Yes. That's fine if you're not adulting - with kids, bills, the need to pay health insurance etc.

If I were under 26, no responsibilities and could get on my parents insurance sure.

<comment><USER22> This has nothing to do with age, being an adult, being in US, etc.; sure, you have a set of assumptions, but they apply at best to you, not the world.

<comment><USER24> "Peter Thiel launched a program that awards $100,000 to promising young entrepreneurs who are willing to drop out of college"

Your example explicitly mentions age as one of the requirements.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> This might sound a bit cynical, but companies like Magic Leap (and WeWork, for that matter) is why I find myself so fatigued with my "startup dreams" \-- it's clear that VCs are an echo chamber and that getting in those circles is much more important than ideas, execution, or even profitability. During my brief stint into hardware startups[1], I could barely find people to answer my emails.

Magic Leap is literally garbage (it's downright embarassing when compared to Oculus or HoloLens), and yet they just raised another $350M. It simply boggles the mind.

[1] [https://www.pcgamer.com/introducing-gameref-the-anti- cheat-h...](https://www.pcgamer.com/introducing-gameref-the-anti-cheat- hardware/)

<comment><USER26> Products never matter. It's all about execution and convincing others to buy into your execution plan

<comment><USER27> that doesn't seem to describe ML either

</comment></comment></comment><comment><USER28> beyond parody.

</comment><comment><USER29> I can't believe seemingly smart people still think consumers want vr

<comment><USER30> I've been skeptical of VR myself, but Oculus Quest feels like it is going to be a hit.

I don't have data but the pulse I'm reading is a very high consumer satisfaction and it continues to sell out.

<comment><USER31> To be fair though, they have a lot of cash for PR to manage people's perception of 'pulse'. That is PR job after all.

</comment></comment></comment><comment><USER32> the technology is really wonderful and given this current crisis, things which digitizes us becomes even more important. we should try and go for mind uploading soon.</comment>


Taste for the Web - <AUTHOR> http://www.xach.com/lisp/taste-for-the-web.html <comment><USER2> I wanted to laugh. But I couldn't.</comment>


Quadrooter: New Vulnerabilities Affecting Over 900M Android Devices [pdf] - <AUTHOR> https://www.checkpoint.com/downloads/resources/quadRooter-vulnerability-research-report.pdf <comment><USER2> The FCC absolutely must clamp down on EOL policies and security updates for phones. It's a telecom infrastructure issue. Sure it places a burden on companies like Google and Verizon, but they're the ones who deserve to carry that burden -- not consumers. The secure lifetime of a device that is hundreds of dollars should not be only 2-3 years. That leaves a dramatic number of consumers fully exposed and eliminates the secondary market for used technology.

Edit: Furthermore, if the companies are going to lock down devices and driver blobs so nobody else can fix them, all the more reason that the security of the device is their absolute responsibility.

<comment><USER3> Be careful what you wish for, this type of legislation may unintentionally prevent consumer level device modifications like rooting and custom roms which allow security researchers the ability to find these issues and basically restrict this to an NSA level of funding. If I were qualcomm that'd be my first response in order to minimize effort on my part.

Ideally Google would just produce a version that was more directly update- able.

<comment><USER2> First, a nitpick that the FCC makes regulation not legislation, and it could do this under existing authority. Second, I think a fine solution would be to force open the buildable source including all drivers and firmwares upon EOL. If top-down security updates will stop, then all components must be open source at that point.

<comment><USER4> All information required to build, package, and install; as well as a license for anyone using or working on affected hardware to the copyright and patents involved for use with affected devices.

</comment></comment></comment></comment><comment><USER5> > The vulnerabilities are found in Qualcomm's software drivers that come with > its chipsets. Pre-installed on devices at the point of manufacturing, these > vulnerable drivers can only be fixed by installing a patch from the > distributor or carrier. Distributors and carriers can only issue patches > after receiving fixed driver packs from Qualcomm.

> The research team provided Qualcomm with information about the > vulnerabilities in April 2016. The team then followed the industry-standard > disclosure policy (CERT/CC policy) of allowing 90 days for patches to be > produced before disclosing these vulnerabilities to the public.

> Qualcomm reviewed these vulnerabilities, classified each as high risk, and > confirmed that it released patches to original equipment manufacturers > (OEMs).

The complexity of this is really a problem for security updates.

It's bad enough for Android updates: the OEM packages it and adds their stuff, then the carrier packages it and adds their stuff. A firmware update like this is yet another layer..

While Checkpoint did the right disclosure thing here, I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today.

<comment><USER6> >I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today.

There were a handful of "Critical" Qualcomm specific bugs fixed in the July [0] and August [1] Android security updates.

I can tell you that my Nexus 5X, which is on the July patch level, is still vulnerable to 2 of the bugs according the checkpoint security scanner. One is listed as being fixed in the August update, the other isn't.

[0] [https://source.android.com/security/bulletin/2016-07-01.html](https://source.android.com/security/bulletin/2016-07-01.html)

[1] [https://source.android.com/security/bulletin/2016-08-01.html](https://source.android.com/security/bulletin/2016-08-01.html)

<comment><USER7> I'm on a Nexus 5, can I take it there's basically nothing we can do until Google push out patches.

<comment><USER8> Correct, because you don't even have the required data to fix the device, and instead are fully dependent on someone else.

A someone which has been proved to be unreliable again and again.

<comment><USER9> Better 'a someone' on the Nexus 5 than 'a series of someones' (e.g. Qualcomm, Google, HTC, and Verizon) on any non-Nexus phone, only some of which have any vested interest in getting you those updates.

<comment><USER8> Best to be the owner on your own device.

There's a reason we modularized drivers on other systems, which allows people to customize the OS however they want it, because the firmware, drivers, main OS, UI layer of OS, and applications are all properly seperated.

</comment></comment></comment></comment></comment></comment><comment><USER10> This is in a certain sense a typical checkpoint finding. It's probably a good finding and it's good that they point out the problematic andorid ecosystem. But their announcement is then filled with some nonsense and marketing bullshit that's more likely to confuse users than help.

In their blog post they say [1]:

* "Use known, trusted Wi-Fi networks or while traveling use only those that you can verify are provided by a trustworthy source." What's that supposed to mean? Is a Wifi trustworthy if it's named Starbucks, because I just bought a coffee there?

* "End users and enterprises should consider using mobile security solutions designed to detect suspicious behavior on a device, including malware that could be obfuscated within installed apps." I call bullshit.

* And then further on [2]: "ZoneAlarm® Mobile Security for Android™ keeps your mobile devices fully protected from malicious apps and Wi-Fi attacks." Oh really? Can they explain how they overcame the theoretical limits (halting problem) that prevent something like this from being possible?

A lot of it reminds me to the Misfortune Cookie vuln a while ago. Also a good find from Check Point in DSL routers, yet they claimed Zone Alarm can protect you, which was outright nonsense.

[1] [http://blog.checkpoint.com/2016/08/07/quadrooter/](http://blog.checkpoint.com/2016/08/07/quadrooter/)

[2] [https://www.checkpoint.com/resources/quadrooter- vulnerabilit...](https://www.checkpoint.com/resources/quadrooter- vulnerability-consumer/)

</comment><comment><USER11> > BlackBerry Priv

YES!

i bought this phone only to "vote with my wallet" that more companies should make android phones with keyboards. It is pure garbage in any other aspect. It is the lame phablet size. The keyboard doesn't even have a DOT or COMMA key, let alone numbers, tab, etc.

The only redeeming features is the OLED screen and keyboard. But then they made the software for the keyboard pure garbage, and filled the OS with bloatware.

I've been waiting for root on this phone so i can start to hack away for months. But blackberry with its cave man corporate mentality, thinks that giving out root will scare the 5 old men still buying their products. I can't even buy a developer version like motorola (which have the same mentality) allowed before.

So, thank you for the sloppy coding, Qualcomm! Thank you for not doing your homework, Blackberry! and thank you AT&T for holding OS updates until you can bother to patch your bloatware!

<comment><USER12> I have one of these phones, and this was my first thought too. "Woohoo! Root vulnerability! Now I can run what I want on my own device!"

:(

<comment><USER13> As a former Samsung owner, that's actually the same feeling I get every time I heard of an Android vuln but definitely without the frowny face. I only get frowny face when the exploits don't work on my specific device. Or, rather, used to then I noped right out of that situation and got a Nexus device.

In the same way I never intend to get "free phone with contract" ever again, I hope to never again buy a device that is subject to vendor "enhancements."

</comment></comment></comment><comment><USER14> Some enterprising lawyer could look for people whose phones or accounts get hacked as a direct result of manufacturer-provided security patches not integrated in time by Android core, the device maker, or the carrier.

Then start a class-action lawsuit, with the stated outcome of forcing carriers to allow, at no cost to all users of no-longer-security-patched phones still being paid off on their plan, a switch to newer phone that are still being patched.

While it'd likely result in a settlement, this may be a way to get the ball rolling, and turning our multi-year outrage into actual (if underwhelming) results.

</comment><comment><USER15> "An attacker can exploit these vulnerabilities using a malicious app. These apps require no special permissions to take advantage of these vulnerabilities, alleviating any suspicion users may have when installing."

So If I understand correctly, it does require you to side-load an app. Can I assume Google Play apps are "safe", at least from this type of vulnerabilities?

<comment><USER16> > Can I assume Google Play apps are "safe", at least from this type of > vulnerabilities?

Looking at the crap that is on the play store, I wouldn't count on it.

<comment><USER17> "crap" aside, users of the Play store (as well as Apple's App Store) are overwhelmingly safe.

Google now has Android Security Annual reports [0]. From that you can see that if you only use the Play Store (no sideloading), only 0.15% of devices got a potentially harmful app.

On top of Play Store's security features, if there were a malicious app that began causing trouble, Google has other mechanisms to shut down PHAs. As this vulnerability shows there are issues that are outside AOSP, Android has been shoring up more defenses in depth.

[0] [https://security.googleblog.com/2016/04/android- security-201...](https://security.googleblog.com/2016/04/android- security-2015-annual-report.html)

<comment><USER18> Overwhelmingly safe in the sense that tons of popular apps impede and undermine your security and privacy, especially easily if you're never getting updated to Marshmallow.

[https://www.engadget.com/2016/03/19/ftc-issues-warning-to- ap...](https://www.engadget.com/2016/03/19/ftc-issues-warning-to-apps- covertly-monitoring-tv-broadcasts/)

</comment></comment></comment></comment><comment><USER19> interesting that they highlighted how ecosystem fragmentation makes patching more difficult; they didn't highlight how fragmentation makes exploitation of their headline-grabbing "900m devices" also very tricky.

This is one of the key reasons the world didn't end when the stagefright series of bugs was released.

Cool bugs nonetheless..

<comment><USER20> As a layperson, I read the report that the exploit could apply broadly (since it's the baseband), but the patches were potentially difficult to roll out because of the layers of fragmentation in approving and pushing out the patches to the baseband firmware and the various mechanisms which might or might not be in pace to do so.

<comment><USER19> They all look like kernel code/driver bugs to me, meaning there will likely be memory layout and config variations much more significant that you'd see in baseband code which might be a lot more duplicated across devices.

<comment><USER20> I think I get it more based on your explanation. Essentially, because the potential exploits rely on a larger variety of configurations, it's unlikely that any widespread exploits would take place; the work just wouldn't be worth it.

More likely that they would focus on the largest subset, hence leading to security through variety.

</comment></comment></comment></comment><comment><USER21> I'm curious as to whether this affects the Jolla as well, as it uses Qualcomm's chipset and kernel drivers (but not Android)

</comment><comment><USER22> SELinux enabled devices also affected by this?

<comment><USER23> In N and in some later versions of M SE Linux will stop this.

They are exploiting a series of gpu bugs, and a IPC driver:

[https://android.googlesource.com/kernel/msm.git/+/e8408e6dca...](https://android.googlesource.com/kernel/msm.git/+/e8408e6dca1067f8759a5baeadbc454a8a2293bc)

[https://www.codeaurora.org/invalid-path-check-ashmem- memory-...](https://www.codeaurora.org/invalid-path-check-ashmem-memory-file- cve-2016-5340)

[https://www.codeaurora.org/use-after-free-due-race- condition...](https://www.codeaurora.org/use-after-free-due-race-conditions- kgsl-module-cve-2016-2504-cve-2016-2503)

[https://www.codeaurora.org/projects/security- advisories/linu...](https://www.codeaurora.org/projects/security- advisories/linux-ipc-router-binding-any-port-control-port-cve-2016-2059)

Which is now blocked by SELinux. The android security team has started killing off IOCTL calls which aren't necessary for normal apps. They are also nuking access to weird socket types. Including some Wifi related socket closures, which nukes a huge attack surface on the wlan side of things:

[http://kernsec.org/files/lss2015/vanderstoep.pdf](http://kernsec.org/files/lss2015/vanderstoep.pdf)

[https://security.googleblog.com/2016/07/protecting- android-w...](https://security.googleblog.com/2016/07/protecting-android-with- more-linux.html)

<comment><USER22> thanks for the details & links. Good to know some version of SELinux prevents this.

</comment></comment></comment><comment><USER24> All I ever wanted was pure linux on a phone, so I could do what I wanted to with it, including securing it. Instead what we got was a half open half proprietary peice of crap that even google bent over backwards to let the carriers fuck up with their custom ROMs on top of stock droid.

What we need is an open source phone, metal to screen, so to speak. Oh wait, the cell radio firmwares are all proprietary too?

I blame carriers and their bullshit first, google for not allowing more granular ACL's natively, and consumers for accepting android because they were so ready for anything different.

<comment><USER25> > and consumers for accepting android because they were so ready for anything > different.

What would be the alternative for those who can't afford premium phones?

<comment><USER26> For a while it was Symbian, Maemo and WP but thanks to how Nokia and Microsoft managed it , those options are now gone.

</comment></comment></comment><comment><USER27> So I can now finally root my unlockable device ? Cool !

</comment><comment><USER28> I wonder if most apps have a reason to use the ioctl syscall normally. I think termios uses ioctl(), but what else? Do apps even need terminal control? Seems like ioctl() could be blacklisted with seccomp. Or maybe whitelist the permitted nodes with seccomp.

</comment><comment><USER29> Would rooting your phone, and then using an app like SuperSU protect you from this? When a malicious app attempted to get root, would it be able to bypass SuperSU or would the user have to give it permission though SuperSU?

<comment><USER3> SuperSU is simply a tool which allows apps to gain root access with user permission via an API.

Apps that use exploits like this can still gain root with no need for user permission. However, exploits like this can also be used for users to root their phone and install SuperSU or similar, allowing them to take advantage of the root-only apps on phones with locked down bootloaders and similar issues. This may also allow patching of devices which don't get official updates in similar fashion to "fixer" worms.

</comment></comment><comment><USER30> Can you root your phone using the exoloit yet?

It's only a matter of time.

</comment><comment><USER31> This is just getting worse and worse. I'm not going to bash Android specifically, because iOS does get some exploits, but seriously we need to have a more locked down system that allows the user to only install the apps that are downloaded from a app store, that runs the apps in a container and doesn't allow special access to forbidden parts of the system. Of course if the user doesn't like it and wants freedom to use any apps, as well to be open to security risks that come with it, they MUST be allowed to do that, but don't make that the default option on billions of devices...

<comment><USER32> > only install the apps that are donwloaded from a app store

That's how it is by default. You have to enable the ability to install third- party applications

<comment><USER31> Yet Google's track record of spam and malware in the Play store is horrific. They obviously care more about quantity of apps rather than quality, and therefor don't do something like Apple with a manual review process.

Though apps should still be run in a sandbox...

<comment><USER33> Google's automatic scanning is actually quite good. Most malware comes from random apk downloads and third-party app stores (often piracy-related). This has been pointed out many times throughout this thread (with links to back it up).

</comment></comment></comment></comment><comment><USER34> If a device has Marshmallow it can't write the system partition, isn't?

It can't be rooted because it will be detected at boot

<comment><USER35> You mean it can't have a persistent rootkit installed. That is not the same thing.

</comment></comment><comment><USER36> From the PDF it seems that this only applies to kernels that have a few Qualcomm patches applied.

<comment><USER37> So only 65% of Android phones (100% on Verizon/Sprint?).

<comment><USER36> No idea about the exact percentages, but no doubt it's a large fraction of phones. I'm not debating it's insignificant or something - sure, it's giant.

Just thought that pointing out it's Qualcomm-specific issue should make other chipset phone users feel somewhat at ease. (I have an Intel SoC-based one and got nervous upon seeing the title.)

</comment></comment></comment><comment><USER7> Seems like a pretty good reason to switch to a nightly cyanogenmod build

<comment><USER13> Perhaps I'm not following your intention, but for those with bootloader-locked devices, if we could have gotten enough control over our devices then we would have already jumped off of the antiquated builds. So it's a terrible catch-22: those with super old bootloader-locked devices are actually the _most_ vulnerable to a whole host of these style attacks, but are the _least_ able to do anything to the hardware that we paid good money to buy.

Also, while this may just be my experience with cyanogenmod and the devices that I _have_ managed to root, one can often end up not having access to the necessary blobs to make the phone run as well as it did under the bloated rom. That actually is very similar to Linux and the Win-modems and a ton of Win- printers that followed: sure, you can run a FLOSS setup, you'll just need to be very, very choosy about the hardware that goes into it.</comment></comment>


Getting started with mini.css's templates - <AUTHOR> http://minicss.org/templates.html <comment><AUTHOR> Apart from pens, the author has created a sample Codepen project[0] for getting started. I recommend checking it out, as it's very helpful indeed.

[0]: [https://codepen.io/chalarangelo/project/editor/DzvxKa/](https://codepen.io/chalarangelo/project/editor/DzvxKa/)

<comment><USER2> recent discussion of minicss might be of interest, [https://news.ycombinator.com/item?id=14264494](https://news.ycombinator.com/item?id=14264494)</comment></comment>


Notepad.cc - a piece of paper in the cloud - <AUTHOR> http://notepad.cc/

<comment><USER2> While I have seen this done several times before, this is the first time it has been done with a clean interface and limited options... making this the clear winner already.

As a developer though I prefer <http://gist.github.com>

<comment><AUTHOR> Thanks. Gist is really awesome for some things, but it definitely servers a certain form of "composing and storing text online."

<comment><USER3> Jacob are you planning to add some formatting options?

What you consider to be the main use cases for notepad.cc?

<comment><AUTHOR> Writing stuff down.

</comment></comment></comment></comment><comment><USER4> Jakob, you did a great job. A couple of suggestions.

1\. Make it visible when the text cannot be saved. Nobody wants to lose his work because of Wi-Fi glitch. In my version of notepad I implemented this with a light yellow frame around the textarea. I'm sure there's a better way to do it.

2\. Imagine you could type a note into an address bar, hit Enter and have it added to your notepad. It's easy to implement, and it works really great for saving page URLs. Here's how I did it with a similar service of mine. Define a keyword search (e.g. "g hello world" - Google Search, "s hello world" - add a note), in Opera it's trivial - right-click the text area, select Create Search, and pick a keyword, I guess in other browsers it's doable too. The POST request carries the name of the page and a note to be added. It might sound simple, obvious, useless, but try it and there's a chance you'll love it.

3\. List of my pages in the sidebar. Like, when I prefix my pages with "alisey." they go to the sidebar. E.g alisey.links, alisey.snippets.

<comment><USER5> Note through URL idea is superb. Clearly you've lures me over to your service, so what's the URL?

<comment><USER4> Well, it's a quick hack for private use, please be gentle. <http://pisets.org.ua/hn>

</comment></comment></comment><comment><USER6> Well I can see myself paying for such a tool.. as in my-username.notepad.cc, all files saved under a master password.

Is it possible to get the files sync to dropbox? may be through dropbox api?

<comment><AUTHOR> Paying for your own namespace...now _that's_ an idea!

<comment><USER6> I am sorry, was that sarcastic?

<comment><AUTHOR> Nope. It's a great idea :)

<comment><USER6> Oh, my bad. :)

</comment></comment></comment></comment></comment><comment><USER7> This is great. Simple, well designed, and just enough features. I especially enjoy the vanity url and password protection. Good work!

</comment><comment><USER8> Very nice. I love how many projects you churn out, Jacob. And how good they look. It's inspiring. And humbling.

<comment><AUTHOR> Hey, thanks!

</comment></comment><comment><USER9> Neat. I tried viewing a note in IE7 and it didn't display right. <http://i.imgur.com/pKdJG.png>

</comment><comment><USER10> It looks neat, and is the sort of thing I both wish I'd thought of first, and wish had the source available so I could run it (for myself) on my own server. This would be a lot better than my current solution for saving scraps of code, notes, or other digital ephemera, but most of that I can't put on someone else's storage.

Time for me to get coding, then, I suppose? :)

<comment><USER11> <http://code.google.com/p/etherpad/>

<comment><USER10> I'd thought about etherpad, but it seemed too busy to switch from my current Editpad setup. The UI on notepad.cc is fantastic, and it's a great idea, so I'm thinking about whether this itch should be scratched a second (third, fourth, infinite?) time where I code it and the release the source, since that's a "feature" I'd like to see.

</comment></comment></comment><comment><USER12> I really like how you can add a password in a non-intrusive way. I mean, it doesn't force you to use it but when you need it, it's really easy to add one :)

And by the way, when I want to save things for myself, I hacked a little snippet:

my-ip/whatever-category-1/category-2/whatever i wanna save -> And it saves it. I can then access it on my-ip : )

</comment><comment><USER13> While I don't personally have a reason to use this, I'm sure a lot of people will find it quite useful.

One suggestion though, the user should be able to select their own URL if possible, and if they want to. I know it'll pose some security risks, but having a totally ridiculous address is going to make your notepad less than memorable.

<comment><AUTHOR> There is a link to change the URL below the notepad. It validates and confirms that the name isn't taken and then renames your notepad and redirects you.

Alternately, you can just visit any URL you want and (as long as it's available) start using it.

<comment><USER13> I think that means you win, then.

Great job!

</comment></comment></comment><comment><USER14> Great job jacob. It's very clean and straight-forward. I like how it instantly creates a shareable url. I've been working on a similar (though not exact) concept on the side for a few months now. Demo: <http://bulletxt.com/demo>

</comment><comment><USER15> I did a similar project a few months ago: <http://zonewriter.com/>

If you hover to the right of the text box, a sidebar with basic formatting options appear.

</comment><comment><USER16> So, I tell here what I am looking for: maybe someone will find it interesting and want to implement that.

I have android phone and few linux desktop. I want to be able to record notes (simple unformatted text is good) and maybe even voice recording on my phone and have them appear via widget on my desktop transparently.

There are webapp that kind of let you do something at least remotely similar (oi notes, astrid, springpad, evernote) but none of them offer a good set of API that would allow me to have a transparent client.

<comment><USER17> Simplenote, <http://simple-note.appspot.com> might be what you're looking for. It has a pretty good API and a nice web interface.

I really like the iPhone app but I don't think it has any other native apps.

</comment></comment><comment><USER18> Stupid question... but if I put something personal in there... what's to stop you from reading it? I mean... you could steal my million dollar startup idea. Or is that the plan?

<comment><USER19> the "add password" feature?

<comment><USER20> Doesn't mean the data's encrypted on the server-side though. The person running this could probably access anything written here pretty easily. That's a trade-off you make with almost any cloud service though.

If you have a super-secret million-dollar startup idea or something really personal that you don't ever want anyone reading, you probably shouldn't be putting it _anywhere_ on the internet.

<comment><AUTHOR> Eh. Do you email ideas? Someone could read those, too.

<comment><USER21> Actually as all email traffic is sent in clear text (unless encrypted using PGP or a program of the sort) - these can be read by any node between your SMTP server and the recipient's POP server not just the end points.

<comment><USER22> The site definitely needs HTTPS.

<comment><USER23> I agree. While someone on the server might be able to read it, there's no need for everyone with a sniffer to be able to.

Regardless, I like this.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Great idea. Is there a write up on this? A blog entry at least?

Some sort of 'about' so users can find out who wrote it, and what (if any) T&Cs and privacy there are, is probably in order, at least to keep the lawyers at bay.

Out of interest, where is the data stored? Cloud?

</comment><comment><USER25> Nice project. Reminds me a little of <http://htlm.org>

But what I really wanted to say: there's a link to <http://www.tumblr.com/?notepad> that's kind of dead (?)

<comment><USER26> <http://notepad.tumblr.com>

<comment><USER25> thank you

</comment></comment></comment><comment><USER27> I can definitely see myself using this in the future. It has a very similar feel to dropbox in that it "just works". If you need some support developing an iPhone/iPod/iPad app for it, which I think would be a great idea, I would be happy to lend a hand.

</comment><comment><USER28> just came across this as it was being used for the froyo port to cdma hero by xda folks, and think it's awesome. something cool to do might be to make it like tomboy notes where you can link between notes, though this probably defeats the purpose.

and as an aside, would make for a great faceplate page, or at least humorous. or be able to add some code to the <head> and let it redirect to an OpenID Oauth so that the addy could be used as an openID. might need to specify admin versus guest on that (like a drop.io type setup). speaking of, is this searchable by search engines (or hidden like a drop.io)?

</comment><comment><USER29> Awesome... but what is the difference between the URI of the page (notepad.cc/test) and the "share this" link URI (notepad.cc/share/ASDF123)? Why aren't they the same? Different security? Different expiration lengths?

<comment><AUTHOR> The share URLs are read-only.

<comment><USER29> That's a great idea, but not very obvious.

</comment></comment></comment><comment><USER30> pretty simple, i like simple user interfaces. one thing that kind of sux is that you have to manually erase everything in the canvas if you want to start a new document. would be nice to add something to the effect of "start new txt". noticed that with a new tab, it seems to save the session data.

need to fix the multi-document feature. otherwise i like it, "share" rather than save. abstraction of the storage layer is great, i don't even want to know where it's stored, just give me access.

<comment><AUTHOR> The idea was sot of just that you go back to notepad.cc (the index) to get a new auto-generated URL, and then you have two that you can edit. "Start a new doc" is just notepad.cc, or creating one in on the fly by just going to the URL you want.

In that regard, your browser offers multi-document support (via tabs or bookmarks, or delicious, whatever you use to remember the URLs).

<comment><USER14> You could still make a notepad.cc/new link and call it "Start new doc." The /new page just does the same thing as main index page (i.e. creates a new page and forwards to a new url).

</comment></comment></comment><comment><USER31> Cool. I has to type something and reload to see if it saved automatically. I like that it does, I just didn't trust it.

Some basic formatting support would be awesome too.

<comment><AUTHOR> Currently, if you add a + to the end of any URL it will switch to a monospace font.

I like that its impossibly simple, but I've thought about adding some more filters like that.

I might also just add support for cmd-b and cmd-i to make the font italic, but right now it's actually just a styled textarea. If only -webkit-user-modify was already supported outside Webkit :(

</comment></comment><comment><USER32> That's pretty cool.

I went and immediately tried it on my iPad. Unfortunately, the links don't show up when I pull up the page there. (The text does autosave though.)

<comment><AUTHOR> Yeah, definitely want to make the mobile version a ton better. In the very least I wanted to make it actually _work_ first.

</comment></comment><comment><USER33> So, pastebin.ca reborn?

<comment><USER34> Sort of like <http://txtb.in/> as well

</comment></comment><comment><USER35> Any plans of open sourcing this? What other features have you planned for it? Versioning? Like gist.github.com?

</comment><comment><USER36> check google notebook. like their more powerful notebook for the web

</comment><comment><USER37> Cool.

How long does it retain the note once you close it?

<comment><AUTHOR> Indefinitely. I might eventually go through and remove notepads that haven't been touched in months and only contain a few characters.

<comment><USER38> Why introduce an arbitrary limitation that does no good and save you nothing?

<http://www.w3.org/Provider/Style/URI>

</comment></comment></comment><comment><USER39> Looks great, hoping to see source released sometime :)

</comment><comment><USER40> This is great. I love the simplicity.

</comment><comment><USER41> does it work for mobile devices such as nonsmartphones?

(written frm samsng impct)

<comment><USER42> Not from my iPhone...

</comment></comment><comment><USER43> Takes forever to save.</comment>


What's the dark side of Silicon Valley? - <AUTHOR> https://www.quora.com/Silicon-Valley/Whats-the-dark-side-of-Silicon-Valley?snids=3290933243

<comment><USER2> I am yet again reminded that I made the right decision to not go there.

I really think the Valley is coasting on its 90s mythos of being a hotbed of genuine creativity, real opportunity, and interesting cutting-edge culture. Today it sounds like an overcrowded, overbought, overpriced workaholic golden handcuff treadmill. The radical futurist "burning man" culture seems almost gone, having been priced out or workaholiced out-- no time to do interesting "maker" things or create culture when you're doing 80 hour work weeks. I know a few people who live there and they say the same.

A few replies mentioned Modafinil/Armodafinil and Adderall. I have nothing against nootropic stacking, but feeling like you _have_ to take something just to keep up with the baseline is a sign of a deeply dysfunctional workaholic culture.

Many other large overhyped cities are not much better. If I wanted a mega-city I'd pick New York-- expensive as fsck but tons of culture and a deep, diverse economy. Also genuinely not needing a car cuts into the cost somewhat.

A lot of the downsides mentioned apply to startup culture no matter where you are. Fake mentors, incubator gators, networkaholics, and sanctimonious self- righteous sociopaths are major potholes on the entrepreneureal highway.

Where to go to do genuinely innovative work or really bootstrap a labor of love?

The former, I'd say hard to say. Maybe academia if you can handle a vow of poverty, or maybe an established company with a lot of R&D going on.

The latter? I'd look at smaller tech centers like Austin or Boulder, less overbought cities like Seattle, Chicago, and Toronto, or towns and smallish cities with a tech, R&D, geek, or major university presence or just a nice quality of life.

Some examples of the latter include Bloomington (IN), Lansing (MI), Ann Arbor (MI), Asheville (NC), Oak Ridge (TN), Orlando (FL), Roswell (NM), Santa Fe (NM), Huntsville (AL), etc. Note that a lot of these are in the South or the Midwest, not the trendiest of places.

Then there are total contrarian choices: Detroit (cheap real estate, interesting maker subculture) or bumblefuck nowhere.</comment>