Did Donald Trump tweet classified military imagery? - <AUTHOR> https://www.bbc.co.uk/news/world-us-canada-49532408 <comment><USER3> This analysis suggests it was a particular spook satellite.

[https://github.com/cbassa/satellite_analysis/blob/master/nah...](https://github.com/cbassa/satellite_analysis/blob/master/nahid1_launch_failure_analysis.ipynb)

<comment><USER4> So absolutey, yes.

</comment></comment><comment><USER5> Why is this even a question? The president can decide what is classified and what is not, it may not be good policy or diplomacy, but that's the presidents prerogative.

</comment><comment><USER6> Is it me, or is there a refection of the photographer's head in the image - <USER2> looks like they snapped a glossy photograph from an iphone.

Is it Donald? If so it looks like he just whipped his iphone out during the debriefing and twittered the photo.

Perhaps it's just desert coloration from the blast

<comment><USER7> The original on Twitter [0] shows not only that head to the right side but also the torso of another person in the center. Doubt that's Trump's head though, the contour looks off.

[0] [https://pbs.twimg.com/media/EDPFB_XWkAY6QWB?format=jpg&name=...](https://pbs.twimg.com/media/EDPFB_XWkAY6QWB?format=jpg&name=large)

<comment><USER6> Not sure if that's a torso, or the hand holding the phone, the whiter 'oblong' being the bottom of the phone, with the flash at the top

<comment><USER7> Oh, right, I interpreted that white part as a collar but it might just be part of the phone or a sleeve.

</comment></comment></comment></comment><comment><USER6> How does the presidential twitter account work?

It seems like Donald just logs in on his laptop, or iphone, and posts what's on his mind.

Surely it should go through a bunch of advisors, and then a communications secretary makes the actual post?

That should be enforced protocol for Presidents, and CEO's, at least.

<comment><USER8> Donald Trump very likely controls his own Twitter account, personally, with very little input from staff before hitting submit.

This is contrary to other public figures, such as Barack Obama, who had communications staff manage his Twitter account.

Part of Donald Trump's "draw" if you will is that his messaging is nearly completely unfiltered, raw, and as close to his stream of thought as anyone has ever likely seen from a President in the modern era.

As for how dangerous that is, I'm sure people will be discussing that for years to come.

</comment></comment><comment><USER8> In his capacity as President of the United States, Donald Trump has the ultimate authority to declassify any executive branch material. So technically, he declassified the material the moment he sent the tweet, assuming the imagery was classified in the first place. I'm unsure if anyone has determined exactly how classified the material was: confidential, secret, top secret.

For anyone thinking that the President should have a process to declassify information like everyone else in the intelligence community: There likely is one, but the ultimate authority to enforce it is vested with the Office of the President and the President likely chose to disregard it by tweeting.</comment>


The top ten worst graphs - <AUTHOR> http://www.biostat.wisc.edu/~kbroman/topten_worstgraphs/

<comment><USER2> Would be nice to have an explanation what exactly went wrong -

I can see that graph 1 is needlessly "3D" which actually obscures the information, I can see that graphs 3 and 4 are just plain useless, and graphs 6 and 9 just hide the information by being 3D, but what's the problem with graph 5 (except that the caption is way too long, and maybe the blackish colouring hides the standard dev-bar)? I also can't see what's wrong with graph 10.

<comment><USER3> Uh, every single one has such an explanation. It's the "discussion" link beside each one.

<comment><USER2> Ha! Didn't see that one, thought it linked to the original paper, as well, thanks!

</comment></comment></comment><comment><USER4> Needed a graph.</comment>


The special effects for the computer display in "Escape From New York" - <AUTHOR> https://twitter.com/Foone/status/1066284025600339968 <comment><USER3> The effect was actually done using retroreflective tape; the building were indeed a physical model, with the edges covered in 3M Scotchlite tape. From first-hand experience (on other movies) the camera is placed behind a half- silvered mirror placed with a 45 degree tilt, with a projector underneath (in this case shining green light). The net result is the camera and projector are on the same optical axis, so no shadows are visible and because the tape (retro)reflects so strongly that's the only thing that shows up.

We used exactly the same technique on 'Superman', but projecting footage in sync with the camera and the most massive screen of Scotchlite behind the actors (it's must've been something like 200 feet wide and 50 high, so big we had to dig a curved trench several feet deep in the floor of Pinewood's A stage to fit it all in (my boss at the time won an Oscar for the flying FX).

<comment><USER4> Superman was the last movie my grandfather worked on before he retired. He was with British Lion so probably at Shepperton Studios/Sound City unit, not Pinewood. If you do read this, please send me an email, would be great to see if you ever crossed paths.

<comment><USER5> Note: The "email" field in your profile is private (for password reset and similar stuff). If you want to make it public you must copy it to the "about" field.

<comment><USER3> Thanks for thw tip!

</comment></comment></comment></comment><comment><USER6> On the other hand, I've just watched a behind the scenes video [1] about Mission Impossible: Fallout, and was absolutely shocked by how much of it was shot in real life.

Basically, most of it. When I saw the movie, I would've bet my left kidney that 90% of the effects were green screen, I definitely would never have guessed that the skydivig scene, helicopter chase, and the canyon fight are for real. I could barely believe such canyon existed! Absolutely stunning.

[1] [https://youtube.com/watch?v=lCv59-y123g&t=0s](https://youtube.com/watch?v=lCv59-y123g&t=0s)

<comment><USER7> Makes you wonder why they took the risks at all when special effects are so good that nobody needs to do such things anymore. Maybe they actually made a mistake by getting the scenes so perfect.

<comment><USER8> >...so good that nobody needs to do such things anymore.

There is a lot of CGI that just looks fake. I would even say most, at least to me. I go back to Star Wars (ep 4). The physical models still look good. The original Blade Runner still looks good. I've also noticed that CGI movies look okay in the theater, but once they hit the high compression formats like Blu- ray or streaming, the CGI really becomes noticeable. The practical stuff still looks good in these formats. Go back and watch Hunt For Red October, and know that during the submarine underwater scenes are just physical models in rooms of smoke to simulate underwater. I really notice when they do 100% CGI characters like Spiderman and Hulk.

<comment><USER9> I have two maybe contradictory things to say about this. On the one hand, thinking all cgi looks fake is confirmation bias. There is so much cgi you don't notice (cars for example, look incredibly real). But when you do, it's because it's bad.

On the other hand, I agree that 100% cgi characters look bad. I recently watched the latest Avengers and was amazed that with all the budget and years of experience they have, the Hulk looks terrible.

It's a useful tool, but when it becomes the only tool it gets old. There's a lot of charm to practical effects. Yeah I can tell that Yoda is just a puppet, but it works.

<comment><USER10> >On the one hand, thinking all cgi looks fake is confirmation bias. There is so much cgi you don't notice (cars for example, look incredibly real). But when you do, it's because it's bad.

Also known as the Toupée fallacy:

[https://rationalwiki.org/wiki/Toupee_fallacy](https://rationalwiki.org/wiki/Toupee_fallacy)

</comment></comment></comment></comment></comment><comment><USER11> Discussions of older effects work always make note of the high manual labor effort. But increasingly I'm not convinced that we really have things that much different in the CGI era. Certain things can be done in a commodity fashion(e.g. instancing thousands of AIs to make an army) but a good visual effect is designed and crafted, not manufactured. You don't get great animation just by scaling up the processing power.

So you still end up with labor effort, but proportionately more goes to the intellectual parts of modelling it on the computer, instead of hiring a crew to sweat over an array of painted glass, miniatures, and puppets. When CGI visuals got really popular for the first time in the 90's and 00's, they often suffered from the belief that the computer would make post-production so fast that the up-front design could be avoided in favor of a brute force "just redo it in post until it looks good" approach. And this is an appealing pitch on the surface, since it means more aspects of the work can stay undecided until the very end. Indecision is one of the things that drives a lot of software complexity.

But that kind of futurism isn't touted nearly as much as it used to be. It adds unnecessary risk for expensive mistakes, underwhelming visuals and awkward editing. Post work is still a huge part of doing blockbuster cinema, but it's been supplemented with extensive testing and a resurgent trend of in- camera effects. Meanwhile, the studios that provide CGI services are treated as commodity labor, just like yesteryear's model painters.

<comment><USER12> I'd say that a whole generation of effects people took the Star Wars prequels to heart as to how too much CGI sucks.

<comment><USER13> It was not too much CG, but rather the wrong approach to it. If you stick an actor into a green screen you need to do your damnest as a director to make clear to them what the invisible part of the setting is. As far as I know Lucas failed to handle that correctly.

Newer productions with actually capable directors got this right. There was a reason why Lord of the Rings employed previs animations before filming to figure out what the sequence will be. Weta Dgitial gave James Cameron a tracked virtual camera inside the motion capture rig with a real time preview of the Navi so that he could direct the camera while his actors where playing out the movie in a nonexistent jungle in a really drab gray studio with no props. There are tons of examples how the industry has learned to take CG as a tool and tame its abstract nature to make it useable.

</comment></comment></comment><comment><USER14> The discussion of the title effect for The Thing (painted glass, burning garbage bag, fishtank full of smoke) reminded me that the well-known Windows 10 default wallpaper[1] is, surprisingly, a practical effect. It's a pane of glass etched with the Windows logo suspended in front of a black background, with a bright light shining in from the side and a fog machine going.

[1] [https://cdn.arstechnica.net/wp- content/uploads/2015/08/windo...](https://cdn.arstechnica.net/wp- content/uploads/2015/08/windows-10-wallpaper-lights-640x347.png)

</comment><comment><USER15> The model shots as CGI reminds me of RoboCop's "thermal vision". Renting an actual heat sensing camera was too expensive, so they just filmed people in black spandex covered in fluorescent paints under a black light.

It's clever, but I don't think it really holds up: [https://youtu.be/Md14H_qD8iQ](https://youtu.be/Md14H_qD8iQ)

I always thought that shot looked weird, but I never questioned the wireframes in Escape From New York.

<comment><USER16> It's _so close_ to holding up though. If they had blurred it a smidge so you don't see the folds in the spandex it'd be perfectly fine. Thermal cameras aren't known for their high resolution anyway.

</comment></comment><comment><USER17> In the movie _2001_ , the computers feature flat screen displays because they were actually displaying rear projection film. This accidentally gave it a more futuristic look than later sci-fi's such as Alien and Blade Runner which featured bulbous CRT computer screens.

Also, like in OP's tweets, there were no actual computers involved in the production of _2001_. All of the displayed 3D wireframe models were films of physical wireframe models.

<comment><USER13> The effects in 2001 are breathtaking. Have you ever watched all the windows in the spaceships and stations? They aren't just white matte fakeouts, but actual filmsets with extras moving around overlaid with the model work. Building these sets, filming the inserts from the right angles and compositing that onto the final film in a purely optical process took an enormous amount of labor. I wonder why noone ever talks about that.

<comment><USER17> There's a scene in a cockpit that was filmed with rear-projected computer screens and black windshields. That film was stored and later re-exposed filming a miniature moon landscape filmed through the windshield of a miniature black cockpit viewing a miniature moon base with black windows. That film was stored again then re-exposed to film people walking around through the windows of a full-sized black moon base.

<comment><USER13> The worst part of it: this is chemical film. Copying degrades image quality. So you want to do every step on a the same strip of film. But make one single mistake and you'll have to redo everything from scratch. Digital compositing is a godsend compared to that process.

</comment></comment></comment></comment><comment><USER18> My favorite story of practical effects on a John Carpenter film is about the portal at the end of Prince of Darkness, where a character reaches through a mirror to hell. The effect was achieved using a large pool of mercury, which the crew had "liberated" from the hydraulic system of a rented piece of heavy machinery. They filmed for one night, got the shots they needed then replaced the mercury before anyone noticed.

This was a terrible idea for many, many reasons. But they got the film made.

<comment><USER19> I have no idea where you would get mercury from a hydraulic system on anything. This story kind of sounds like urban legend, or the crew had no idea what they were taking apart.

<comment><USER3> Having worked in SFX, I guess it was probably from a Chapman (a sort of crane balanced seesaw big enough to hang cameramen and cameras from) - at one time (presumably no longer) I believe they used a big reservoir of mercury to achieve fine balance, to the extent you could move swing them around manually.

Amusing side note: They had a locking lever when obviously had to be engaged when the cameraman wasn't on the end. If someone freed the lever with the crane out of balance, the results could be quite catastrophic (source: I could've been killed on one occasion).

Aha, and here's an article about them:-

[http://hollywoodjuicer.blogspot.com/2008/12/adventures-in- gr...](http://hollywoodjuicer.blogspot.com/2008/12/adventures-in-grip-land- cranes.html)

<comment><USER18> I heard the story second-hand on a podcast and obviously confused some of the details, but I think you are right about the piece of equipment they had access to.

</comment></comment></comment></comment><comment><USER20> If you find this kind of stuff interesting you may like this blog series on creative development for Moon (2009): [http://www.gavinrothery.com/they-never- went-to-the-moon](http://www.gavinrothery.com/they-never-went-to-the-moon)

Lots of interesting insight into production tricks used for a modern low- budget sci-fi film. Including graphic/motion design, sets and visual effects.

</comment><comment><USER21> Nice! This takes me back to my days as a kid when I would pour over issues of _Cinefex_ , which I'm very happy to see is still around.

If you enjoyed this, you'll probably also get a kick out of how they made the legendary HBO intro from 1983: [https://youtu.be/wqzihgR_- SI](https://youtu.be/wqzihgR_-SI)

<comment><USER3> Yes, I just looked it up too because I used to read it when I worked in the SFX business. Pretty sure there's an issue that covers Escape from New York, but couldn't find it in a quick search.

[http://www.cinefex.com/](http://www.cinefex.com/)

</comment></comment><comment><USER22> I'm a big fan of slit-scan:

[https://vimeo.com/71702374](https://vimeo.com/71702374)

As used in Doctor Who:

[https://www.youtube.com/watch?v=1fnzcAFy8d8](https://www.youtube.com/watch?v=1fnzcAFy8d8)

<comment><USER15> I love slit-scan effects, it's such a simple but powerful concept.

They're actually really easy to do now in post, After Effects has an effect called time displacement that allows you to displace time on a per pixel level. So to recreate a standard slit scan you'd just supply it with a gradient from black to white, but you can also create even more bizarre effects by mapping the pixels differently.

A few months ago I did all the effects for some music videos, and I created multiple effects based on slit-screen. Things like, having the video smoothly break apart into slices where the time moves at different speeds and then smoothly splice itself back together.

Another cool effect I figured out: using a blurred copy of the video as the time displacement mapping. This makes everything that's colored similarly move together in time, but out of sync with everything else.

I did that effect for a video that was just one long shot, and then I rotoscoped out the performers so they move in regular time and match the music: [https://youtu.be/-0zO7Fnqnvs](https://youtu.be/-0zO7Fnqnvs)

I really love old school effects work, they're a constant source of inspiration.

<comment><USER22> Very cool!

I did have a go at copying the Doctor Who tunnel effect:

[http://roy.red/slitscan-.html](http://roy.red/slitscan-.html)

<comment><USER15> Nice, your version of the time tunnel looks awesome!

</comment></comment></comment></comment><comment><USER23> his patreon: [https://www.patreon.com/foone](https://www.patreon.com/foone)

and why it's nto a blog post: [https://mobile.twitter.com/Foone/status/1066547670477488128](https://mobile.twitter.com/Foone/status/1066547670477488128)

</comment><comment><USER24> Both the title and the story of the title of "The Thing" are absolutely brilliant

<comment><USER25> I'm getting excited for my annual holiday viewing of "THE THING."

If you have an opportunity to see the special edition or some other copy with the documentary "Terror Takes Shape" about the background of the movie and special effects it is absolutely worth the hour.

Also if you are available June 25, 2022, there is a fan meetup at the location of the filming in Stewart, British Columbia.

[https://www.outpost31.com/2022](https://www.outpost31.com/2022)

</comment></comment><comment><USER26> It's the sheer ingenuity of effects like this that impress me to this day. You couldn't just come up with a concept and poot it out in CGI from the bureau render farm. It took a real understanding of the medium and the camera, and when manual animation was needed, a lot of blood and sweat.

</comment><comment><USER27> This guy @foone that did this tweet storm generally has an excellent Twitter account that everyone reading HN would love. He buys lots of old weird hardware and has interesting threads on them. He's well worth a follow.

</comment><comment><USER28> Imagine how much easier this great content would be to read as a blog post.

<comment><USER29> Feel free to write it as one!

But personally I can only do it this way, as I've got rather bad ADHD. So when I'm writing, it's a choice between "a rambly twitter thread" or "an unfinished never-posted blog post".

<comment><USER30> Are you converting "an unfinished never-posted blog post" into "a rambly twitter thread"?

</comment></comment></comment><comment><USER31> I often find Twitter to be an awful platform for viewing images and video because they make it so hard to zoom in or to save it.

</comment><comment><USER32> In a similar vein: all the graphics from the BBC TV version of Hitch Hiker's Guide to the Galaxy.

</comment><comment><USER33> How did this change into some awful Twitter thing?

I swear it was a solid blog post the first time I clicked on it - <USER2> readable, unlike this...

<comment><USER34> I first saw this story as [https://threader.app/thread/1066284025600339968](https://threader.app/thread/1066284025600339968) , which didn't work for some here: [https://news.ycombinator.com/item?id=18524844](https://news.ycombinator.com/item?id=18524844)

</comment></comment><comment><USER35> Twitter is a completely shit medium for in depth article like this.

<comment><USER10> Personally I much prefer Twitter threads like this to big, long, overly descriptive blog posts. The improvisational nature of the writing, plus the interleaved commentary from other interesting people, make it much more conversational and easy to digest.

</comment></comment><comment><USER36> The windows 10 background was also CGI free.

</comment><comment><USER37> A lot of people seem to love these twitter thread unroller sites, but it's not clear to me what problem they solve (on modern Twitter) and I almost always find the original Twitter thread to be more readable/flexible. For example, in this one, I found it a bit confusing whether a particular paragraph went with the clip above or below it. Anyway, to each their own! Original thread here… @Foone is _the best_ : [https://twitter.com/Foone/status/1066284025600339968](https://twitter.com/Foone/status/1066284025600339968)

<comment><USER38> On my machine, the linked 'threader' has every video as a busted icon, which defeats the entire topic. Twitter handles them correctly. Thank you.

One thing I found interesting that the author didn't seem to notice is that the text of the Star Wars opening crawl in the behind-the-scenes photo[1] is radically different from the version that saw release.

The crawl that we've all seen is only 4 sentences long: two in the first paragraph, then two 'paragraphs' of one multi-clause sentence each.

The crawl pictured in the tweet[1] is a much wordier mess, and may well be the original crawl Lucas showed to friends and executives before Brian de Palma edited the text down for him. It also features something similar to Dan Perri's semi-rejected logotype at the top (cut off unless you click in or view the image directly), the _angled_ 'Star Wars' block logo most prominently seen on the original posters[2] for the film.

[1]: [https://pbs.twimg.com/media/Dsw_RjNUcAAgCgE.jpg](https://pbs.twimg.com/media/Dsw_RjNUcAAgCgE.jpg)

[2]: [https://www.google.com/search?q=star+wars+77+poster&tbm=isch](https://www.google.com/search?q=star+wars+77+poster&tbm=isch)

<comment><USER39> I shudder to think how bad ANH would have been if Lucas had his way. We had a 1st taste in ROTJ and full-Lucas vision in the prequels.</comment></comment></comment>


Show HN: New free Git Mac client with full undo/redo - <AUTHOR> http://www.gitup.co/

<comment><USER2> GitUp is one of the best git apps I have interacted with. What I like about it the best is that is not just another client, but it offers a different, more efficient and intuitive approach to working with git-based repositories.</comment>


The 9X Email Problem - <AUTHOR> http://blog.hbs.edu/faculty/amcafee/index.php/faculty_amcafee_v3/the_9x_email_problem/

<comment><USER2> From the article: We mentally compare having the prospective item to giving up what we already have (our 'endowment'), but because we're loss averse giving up what we already have (our reference point) looms large.

Perhaps this reduces the risk of being tricked. However, when a genuine win- win situation is presented, it would be a significant source of transactional friction.

<comment><USER3> I think the problem is getting the user/consumer/customer to see the win-win. If you can present it successfully, you can make the sale. But the theory presented says it's a 9X problem to do so.

</comment></comment><comment><AUTHOR> "Gourville's research suggests that the average person will underweight the prospective benefits of a replacement technology for it [E-Mail] by about a factor of three, and overweight by the same factor everything they're being asked to give up by not using email. This is the 9X problem developers of new collaboration technologies will have to overcome."</comment>


Show HN: FAQ Off – Mitigate Mob Harassment on Social Media - <AUTHOR> https://github.com/soatok/faq-off <comment><AUTHOR> If you'd like to know what this is about AND see it in action in one fell swoop, boy do I have a link for you!

[https://faq.dhol.es/@Soatok/public-beta/what-is-faq- off](https://faq.dhol.es/@Soatok/public-beta/what-is-faq-off)</comment>


Mosquitoes engineered to pass down genes that would wipe out their species - <AUTHOR> http://www.nature.com/news/mosquitoes-engineered-to-pass-down-genes-that-would-wipe-out-their-species-1.18974?WT.mc_id=FBK_NatureNews <comment><USER2> _" Eliminating mosquitoes is more likely to alter ecosystems compared with approaches that equip the insects with malaria resistance, Esvelt says."_

Since we don't know what effects wiping out this entire species of mosquito might have on the other species further up the food chain whose lives may depend on it, couldn't taking this kind of drastic action be potentially disastrous?</comment>


Clutterme.com eBay auction ends below reserve price - <AUTHOR> http://cgi.ebay.ca/ws/eBayISAPI.dll?ViewItem&ssPageName=STRK:MESELX:IT&item=170280037599? <comment><USER2> Labors of love with unproven revenue rarely get valued by the market as high as founders think they should be valued.

a) They've been taking money for less than two full months, after a year of playing the things-on-Internet-should-be-free game.

b) They sold $4,000 worth of domain names at a cost of $2,000 for themselves in October.

c) They describe the business as being on a "growth curve", which is an interesting induction from one data point. I would be worried about whether you've shaken out all of the freebie customers who were dying for domains, causing the sales to crater the next month.

d) Cost to duplicate the site is not high. Barriers to entry in the market are zero. The site has no defensible competitive advantage, certainly not one which will survive the founders departing.

e) Whoever acquires it will need to find themselves a Rails specialist and they're not cheap at the moment.

And for that they wanted greater than $40,000.

<comment><USER3> I think anything over $40k is a great price for their product. The bubble is over, and a giant valuation for something that could easily be re-created in a few weeks just isn't going to happen right now.

</comment></comment><comment><USER4> not surprising based on what the thing looks like...if I were those guys I'd spend a few days to come out with an updated design at least for the front page...also I'd come up with a few designs myself that actually look good for the samples...the current designs in "Samples" look worse than what you can do with myspace

</comment><comment><USER5> That was dumb to do a reserve price... you should have just set the minimum bid at whatever your reserve was.

Relist it! :)

</comment><comment><USER6> Ryan Carson talked a lot about how selling in the open wasn't good for him with Dropsend ([http://www.thinkvitamin.com/features/webapps/sell-your- web-a...](http://www.thinkvitamin.com/features/webapps/sell-your-web-app- lessons-i-learned-from-selling-dropsend)).

I would think this applies to them too.

</comment><comment><USER7> And they also have a patent for sale! And all goes below the reserve price. As vaskel said, they surely need a new design. Especially the intro on the left of the homepage looks cluttered

<comment><USER5> Provisional patent, at least in software, is only worth it for telling investors "we have a provisional patent." If it's a lawyer written provisional patent it may be worth more if it can be refiled as a regular patent with minimum work, but anyone can have a provisional patent for $125.</comment></comment>


Ditch the GPS. It's ruining your brain - <AUTHOR> https://www.washingtonpost.com/opinions/ditch-the-gps-its-ruining-your-brain/2019/06/05/29a3170e-87af-11e9-98c1-e945ae5db8fb_story.html <comment><USER2> > "If we are paying attention to our environment, we are stimulating our > hippocampus, and a bigger hippocampus seems to be protective against > Alzheimer's disease," Bohbot told me in an email. "When we get lost, it > activates the hippocampus, it gets us completely out of the habit mode. > Getting lost is good!" Done safely, getting lost could be a good thing.

Is there a Betteridges headline law equivalent for Alzheimer's claims, something along the lines of if there's a claim of protection it's more likely than not to be spurious?

Bohbot's own research only hinted at some correlation between hippocampus gray matter volume and navigation strategy but put a reporter on the end of an email and the possibility that early stage dementia sufferers are unlikely to deploy cognition-dependent navigation strategies falls by the wayside.

Far better to take your GPS, completely avoid stressful and dangerous lost situations, and enjoy life.</comment>


Can Google get social networking right? - <AUTHOR> http://www.technologyreview.com/web/25970/

<comment><USER2> Google has the brains and infrastructure to build a great social networking tool. But in order for it to be useful to me everyone I know that currently uses Facebook would need to switch to to Google's new platform.

I just can't see that happening anytime soon unless Google can come up with a killer feature that Facebook can't easily replicate.

<comment><USER3> Well Fecebook got a lot of folks to switch from Myspace, right? I don't use either service so I don't know what Facebook offered that Myspace didn't but you are right that Google will have to offer something compelling. They can't just offer a "me too" clone of Facebook, and I don't think a cosmetically better UI will really be enough either.

Before the Buzz debacle I would have thought that Google might compete on the issue of privacy, at least as one differentiator. I think they've lost the high ground on that however, and it should be obvious to anyone who thinks about how Google makes money that they have a huge temptation to mine your social graph for information that will help them target advertising to you.

<comment><USER4> > Fecebook

Pun intended?

</comment></comment></comment><comment><USER5> Google failed at "Shopping", failed at "Video" (read youtube acquisition), failed at "Buzz", failed at "Wave" and I'm sure there are others that I'm leaving off. What google does is Ad's and search, that's their bread and butter.

It's very hard for big companies to venture off and do something out of their comfort zone. Facebook failed at "Marketplace". And you'd think that Facebook would be poised to take over that space, but still struggled.

Google is more poised to bite off of Linkedin's social graph, rather than Facebook's. IMO Though, with the right hire's Google can do it.

</comment><comment><USER6> probably not. They don't hire the kind of people who'd waste time on those SN websites, or do they?

<comment><USER7> A lot of them are on Buzz and the debate there is pretty cool (intelligent, balanced, active).

My concern is whether they have the right people to do "social networking" for the layman... i.e. the one who doesn't know VI keyboard shortcuts and just wants to upload a picture of their cat.</comment></comment>


Ask HN: How can we improve?  - <AUTHOR>

www.rileeq.net<p>Every feedback will be really appreciated.Thanks. <comment><USER2> It's in the FAQ, but you should probably delete this post and submit this as a link post with a small description in the comments as per guidelines. Thanks!

<comment><AUTHOR> Thanks but i read the FAQ and i could´nt find what is wrong with my post.could you provide any detail? Any feedback on our page?

<comment><USER2> Nothing's wrong with it, it's just recommended that you post it as a link rather than a text post with a link in it, as it will get more exposure on the front page and you will get more feedback.

[http://jacquesmattheij.com/The+Unofficial+HN+FAQ](http://jacquesmattheij.com/The+Unofficial+HN+FAQ):

If you are posting a 'rate my startup' post as a self post you are missing out on a lot of valuable feedback because likely your post will not make it to the homepage. I would suggest you post your site as a link and put your extra information about the project in the first comment.</comment></comment></comment>


Hosting Static Website on Google App Engine for $0 - <AUTHOR> https://aagat.com/blog/2017/09/13/static-website-on-google-app-engine/ <comment><USER2> If you want to host static sites at no cost on Google's global infrastructure, I suggest a look at "Firebase Hosting". It is a closer match for this need, works very well. It has some features that GAE doesn't, like the ability to auto-issue-and-provision an SSL cert for a custom domain. It has HTTP2 push.

[https://firebase.google.com/docs/hosting/](https://firebase.google.com/docs/hosting/)

Don't be distracted by the word Firebase - it is just a brand name in this context. You don't need to use the Firebase database, just because you use Firebase hosting.

<comment><AUTHOR> Neat. I wasn't aware firebase had independent hosting option.

It definitely looks easier to setup than GAE and I would've probably used it if I was aware. Thanks for pointing this out.</comment></comment>


Could Blockchain Be a Solution to the Issue of Misinformation Online? - <AUTHOR> https://open.nytimes.com/could-blockchain-be-a-solution-to-the-issue-of-misinformation-online-492ca63ae42 <comment><USER2> No</comment>


Why do we lock up so many people? - <AUTHOR> http://newyorker.com/arts/critics/atlarge/2012/01/30/120130crat_atlarge_gopnik

<comment><USER2> _"Prison rape is so endemic more than seventy thousand prisoners are raped each year that it is routinely held out as a threat, part of the punishment to be expected. The subject is standard fodder for comedy, and an uncoöperative suspect being threatened with rape in prison is now represented, every night on television, as an ordinary and rather lovable bit of policing. The normalization of prison rape like eighteenth-century japery about watching men struggle as they die on the gallows will surely strike our descendants as chillingly sadistic, incomprehensible on the part of people who thought themselves civilized."_

I found that quote to be particularly insightful.

Ron Paul thinks it would be a good idea to pardon all non-violent (violence includes theft) drug offenders.</comment>


America's Secret Innovation Weapon: Immigration  - <AUTHOR> http://gigaom.com/2009/07/04/americas-secret-innovation-weapon-immigration/

<comment><USER2> Ironically, the 'secret' is one that everyone but the American government and the majority of the American population are aware of.

A NY Times article [[http://bits.blogs.nytimes.com/2009/04/13/googles- immigration...](http://bits.blogs.nytimes.com/2009/04/13/googles-immigration- fixer/)] published not too long ago outlined how much Google was spending on H-1B visas and their demand for the cap to be raised. If you read the comments or the backlash which followed, it made you very aware how the American public is still convinced immigrants are 'stealing their jobs'.

<comment><USER3> To back your thing:

My current company was closing down. So I started looking for a new job, and I was really worried as an H-1B that I am, companies are really reluctant to hire in this environment, b/c of the huge amount of paper work, and cost required for them to eventually sponsor me.

Within two weeks I got 3 job offers, and getting one more next week (they are doing background checks), with a lot of money. I mean a lot more than I thought I could make. What it shows me, that there is a real demand for highly skilled engineers, even in a downturn, and a lot of "i am an American, I can't find a job lets send the h-1bs home", are probably voices from people that have no talent, or desire to work.

This is truly work Americans can't do, as I am not cheap at all, actually very expensive, money and paperwork wise.

The secret in the Silicon Valley is that 80% of the code is produced only by 20% of the engineers. If I have my own company, (or you had your own), I'd want to hire from that 20% pool, no matter what their race, ethnicity, or immigration status they are. Unfortunately, you have people on the 80% pool, that scream (or wishfully thinking) that if immigrants weren't here, there would be able to command higher salaries, and find job easily.

It is often much easier to blame others, instead of just looking in the mirror.

<comment><USER4> Good post. The other end of the spectrum: I used to write code for autonomous UAVs back home (commercial and military). After completing my second degree in the US, I made it through to 90% of the interviews and selection process at the top firms that play in such applied heuristics. At that point I didn't think I was wasting my time, given my background and experience.

In the end, I was apologized to almost everywhere as they couldn't offer me a position because of my immigration status and there were existing federal restrictions limiting their hiring of foreign workers. Nonetheless, almost all those companies still e-mail me today asking whether I would take a position at their operations in my home country because there just aren't that many _good_ people who do this kind of shit in the US.

Why, I ask? Later, I got multiple offers from companies back home who were willing to pay 5 times as much and were either in direct competition to the folks in the U.S. or were selling them patented technologies that cost billions in licenses every year.

<comment><USER5> I think the simple solution to the H1B program is to have companies biding on slots. When people see companies are willing to pay 10-20k+/year extra to higher the highest levels of talent few are going to complain.

Also, I once worked for a body shop which cared little for talent and just wanted people to fill the spots as cheaply as possible. And unlike at that paperwork this would stop them for using H1B's.

<comment><USER6> Bidding is often not a bad idea, as it does help to uncover the "true" value. But it's not the solution to the H1B program. That solution is simply to let any and every qualified person into the country -- indeed court their attention and residence. Anything else is selfish, chauvinist myopia.

</comment></comment></comment></comment></comment><comment><USER7> Immigration law actually deters innovation of the top immigrants. These students come to US to study at top universities, undergrad or grad and afterward they cannot legally start a business on their own. They have to wait to get a green card, which is years away. By then, as people become older, they lose some of the hunger.

The next best thing for them is to team up with Americans.

</comment><comment><USER8> Indeed. We've talked about this phenomenon before. Here's the link: <http://news.ycombinator.com/item?id=678144>

This was my remark on the matter:

 _As a foreigner in the US about to finish a MS degree in IT and travel back home, I find Friedman's words apropos. The limitation on H-1B visas does more harm than good. I've met many young, intelligent knowledge workers about to get their advanced degrees who, unfortunately, find themselves unable to stay in this country because of visa restrictions. Sending those brains back home is a mistake. A new approach is required if the US veritably wants to foster innovation and entrepreneurship._

It's good to see more and more people are joining us and voicing their opinions loudly. Evidently, the H-1B program needs some major tweaking. The more people know and understand the implications of what's at stake here, the better.

</comment><comment><USER9> > If we assume that talent is evenly distributed throughout the planet...

This is a terrible assumption. 71% of the planet's surface is practically devoid of talent.

<comment><USER10> Hey, dolphins are smart!!! ;-)

<comment><USER11> They're not distributed equally, either.

<comment><USER10> The point I was trying to make was not that they're equally distributed, but that the oceans are not devoid of "talent" ;-)

<comment><USER12> Yeah, I hate it when companies hire dolphin engineers instead of humans. Dolphin programmers will work for half of what a human one will -- often times being paid under-the-table in fish.

<comment><USER13> I've heard, though, that they have an uncanny habit of disappearing one day, just before disaster strikes, with nothing more than a "so long, and thanks for all the fish".

</comment></comment></comment></comment></comment></comment><comment><USER14> I wonder what will happen if people around the world can sell their citizenship.

Of course host governments have to do a background check etc and sign off on the bidders/buyers. Everybody wins, right? And I bet you can IPO 'eBay for citizenship' overnight.

<comment><USER15> Citizenship of a given country is a commodity in that piece is no differnt than any other piece, so it will be traded on an exchange and not in an auction house.

<comment><USER14> This is not much different from how Gmail invites were sold on eBay. While the invites themselves were no different from each other, auctioning helped the market find the 'fair' price.

Auction price will reflect the current supply and demand, affected by economic conditions and a million other factors. Remember that I proposing that people, not countries, sell their citizenship and move out to a country where they have bought new citizenships.

<comment><USER15> Good point. I suppose this will depend on the trade volume - no one will set up an exchange for the low-volume stuff so one arises on top of the nearest thing such as ebay. If volume is high and exchange must form tho.

Imagine the news roll: "Canadian citizenship was 5 points up today on soaring energy prices and the new healthcare proposal". Hilarious, but also kind of makes sense.

</comment></comment></comment></comment><comment><USER16> _one that targets the best and brightest around the globe and makes it easy for them to become permanent residents. We should be recruiting the world's best talent the same way top companies recruit the best talent._

No! Google ostensibly hires all of the "best talent" in the industry, yet what do you see of it?

If the government takes on some policy of allowing the world's "best and brightest" to immigrate, you're not necessarily getting the people who would have produced the most value. Instead you'll get people who have tons of qualifications and degrees.

Let's say France had this same immigration idea back in 1980. Would Bill Gates have been considered one of the brightest and greatest and allowed in? No. Would Larry Ellison? No. Would Steve Jobs? No. It's next to impossible to pick out the true people who provide value before the deed is done.

</comment><comment><USER17> I buy into the conclusion that immigration is good for the United States in general and particularly good as a source for innovation. Having lived overseas, in one of the countries that is a big source for immigrants to the United States (Taiwan), I have to respectfully disagree with the idea that what is going on here is mostly selection of people from very high-IQ echelons of source countries, and those people then doing things that lower-IQ people INHERENTLY can't do.

Most human beings don't come close to maximizing the realization of their potential. And many of the countries that are the biggest sources of immigrants to the United States have very much of a "growth mindset"

[http://www.stanfordalumni.org/news/magazine/2007/marapr/feat...](http://www.stanfordalumni.org/news/magazine/2007/marapr/features/dweck.html)

in general in their cultures, and particularly in the subcultures that supply most of the immigrants to the United States, such that those immigrants, whatever their IQ scores, do more to realize their potential than people with "fixed mindset." Indeed, there is a whole book on this subject, James R. Flynn's Asian Americans: Achievement Beyond IQ.

[http://www.amazon.com/Asian-Americans-Achievement-Beyond- Iq/...](http://www.amazon.com/Asian-Americans-Achievement-Beyond- Iq/dp/0805811109/)

The IQ threshold for eminent achievement and even "genius" (as carefully defined by psychologists) is not particularly high, but is only about 120 on a currently normed IQ test. That, by definition of IQ standard scoring, is less than two standard deviations above the population mean.

Follow-up comments to this by request.

</comment><comment><USER18> Most of the evil in this world comes from people believing in and fighting over imaginary borders.

<comment><USER19> In recent times it has been fashionable to talk of the levelling of nations, of the disappearance of different races in the melting-pot of contemporary civilization. I do not agree with this opinion, but its discussion remains another question. Here it is merely fitting to say that the disappearance of nations would have impoverished us no less than if all men had become alike, with one personality and one face. Nations are the wealth of mankind, its collective personalities; the very least of them wears its own special colours and bears within itself a special facet of divine intention.

\--alexander solzenitzen

<comment><USER18> I am not saying cultures should disappear. What I meant was national and other imaginary boundaries have engendered wars, genocides and other evils. Bringing boundaries down will not makes us clones in a 1984 like manner but may give rise to even more diversity due to the mixing. And these indigenous cultures are of no use when people are not free to roam the world!

<comment><USER19> War and genocide predate the nation state. It's perhaps as easy to argue that the nation state has been a force for restraint of violence and a bulwark against broader tyranny. Violence is worst in the modern world where nations are weakest and least independent. The endless wars in Europe only wound down when national boundaries were finally properly drawn along ethnic lines.

> more diversity due to the mixing

You are confusing diversity within a place with diversity between places. Whereas London was once an English city with a distinctive English character, it is now a "multi-cultural" stew that is much like any of five other large global multi-ethnic cities. The loss of an English London is a loss of diversity.

<comment><USER18> English London has been replaced by multi-cultural London. There is no net loss of diversity here. Old cultures die and new ones form (just like languages, species etc). There is nothing to cry over here. I am in favor of a global state which prevents broader evil and within this state there should be no borders. One nation state. People get scared by this notion believing it will lead to 1984 but that is only one of many possible outcomes. Are cultures and languages more important than the universal freedom to go anywhere in the world without fetters?

<comment><USER20> Why is being able to go wherever you desire so important to you? And how exactly do you plan to reconcile fundamentally different belief systems (such as, say, modern liberalism and fundamentalist Islam)? By imposing some global beauracratic tyranny, I presume?

<comment><USER18> People with fundamentally different belief systems are not hostile to each other. I have seen people with very radical beliefs who are very accepting of people with opposite views. Almost always it is the politicians and people in charge of nation-states who divide so that they can rule easily (us vs. them mentality). We can achieve harmony and unity through means other than tyranny (<http://en.wikipedia.org/wiki/Nonviolence>) .

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> FTA: So I would argue further that the "innovation probability" of a high I.Q. individual whose family has been in the U.S. for many generations is less than that of someone who's new to our nation and has a comparable intellect, but far more desire.

It sounds to me like the author stating an obvious, and often repeated, point. Perseverance/hard work is a much better predictor of success than raw intelligence. Immigrants, for a couple of generations at least, have the work ethic. Based on other posts to this discussion, this fizzles our by the fourth generation, so you're stuck on a tread mill of bringing in new hard workers to fuel the engine. Is that really the only way to handle this? It doesn't seem to address the root cause.

As far as the requirement to post a job to prove no American worker could fill the role, I think it's common knowledge that this aspect of the system is heavily (and easily) gamed.

The H1-B program does need to be reworked. It seems like the H1-B visa should provide more freedom to the individual to innovate--start their own company and not be so beholden to their sponsor. I am making an assumption that the hard working, hungry H1-B holder is more likely to start their own company. This is where innovation creation thrives and, therefore, where there is great potential value in H1-B visa reform.

</comment><comment><USER11> Unfortunately this strategy does not have the potency it once did. The two largest possible sources of talent for the US, India and China, have rapidly growing economies and plenty of opportunity. I don't know all that much about India but if you're smart and "hungry" in China there is a _ton_ of opportunity. Why on earth would you go to the US? Same, to a lesser degree perhaps, for Brazil et al.

I suppose the attractiveness of migration to the USA remains high in ex- communist states, the middle east, Africa, etc, so it's certainly possible they could make up the numbers, but the days of automatically assuming Chinese and Indians dream of building their companies in the USA are over, IMO.

<comment><USER17> _if you're smart and "hungry" in China there is a ton of opportunity. Why on earth would you go to the US?_

The freedom to criticize the government openly and vote in contested elections for the national leadership? That works for a lot of the Chinese immigrants I know in the United States. (Net immigration flows from China to the United States are still strongly positive in the direction of smart people leaving China and settling in the United States.) India actually presents the more interesting example, as people in India enjoy press freedom and free elections, but still find reason to move to the United States.

<comment><USER22> So people immigrate because they want to vote in US elections? What kind of change in American policy do they wish to effect? Wanting to vote seems like a very abstract motivation for making such an immense personal sacrifice. All of the Chinese immigrants I know moved for more obvious reasons (personal gain, marriage, etc.) And none of them seem particularly critical of the US government, or the Chinese government, for that matter. (But most of them work in academia, so take that with a grain of salt.)

<comment><USER23> People move to somewhere they will have a say in local government. Casting a vote now and then is a very small part of that participation. Or maybe they're interested in politics and are sick of not being able to have a real debate.

<comment><USER17> _maybe they're interested in politics and are sick of not being able to have a real debate._

This correctly characterizes many of the Chinese people I met in the United States in 1989 as part of the democracy movement at that time. Many of them were physical scientists or biological scientists or students about to enter those occupations when I met them, but they were deeply interested in politics and organized a "salon" with some very interesting discussions of politics, including guest speakers from newly post-communist Poland and public speeches by democracy movement activists who were able to escape from China after the post-Tian An Men Square Massacre crackdown.

</comment></comment></comment></comment></comment><comment><USER19> This narrative where the second generation immigrants ascend economically is not actually true. For certain ethnic groups it may have been true at one time, but the data actually show that Hispanics _descend_ economically after the first generation, for one example.

<comment><USER24> Which data? Back up your argument.

<comment><USER19> <http://www.amazon.com/review/R60O7705YNTL7>

"Throughout this book, our statistical models have shown that the low education levels of Mexican Americans have impeded most other types of assimilation, thus reinforcing a range of ethnic boundaries between them and white Americans."

As is well known, American-born Mexicans average more years of education than do their Mexican-born immigrant ancestors. Unfortunately, as Telles and Ortiz report, the third and fourth generations of Mexican Americans do not continue to close the gap relative to non-Hispanic whites:

"In education, which best determines life chances in the United States, assimilation is interrupted by the second generation and stagnates thereafter."

The fourth generation (whose grandparents were born in America) was particularly unaccomplished:

"Sadly and directly in contradistinction to assimilation theory, the fourth generation differs the most from whites, with a college completion rate of only 6 percent [compared to 35 percent for whites of that era]."

The fourth generation Baby Boomers averaged 0.7 years less schooling than the second and third generation Mexican Americans born in the same era.

Telles and Ortiz found:

"...the educational progress of Mexican Americans does not improve over the generations. At best, given the statistical margin of error, our data show no improvement in education over the generations-since-immigration and in some cases even suggest a decline."

<comment><USER24> This hardly seems to justify your sweeping assertions above, and the review (by Steve Sailer, who I'm afraid I do not consider an objective commentator) seems to suggest that the fault lies entirely with the population in question, ignoring the book authors' own conclusion that institutional discrimination is a major limiting factor in Mexican-American economic development.

Sailer writes: _Their book is a monument to disinterested, objective social science._ but seems uninterested in reporting the context in which these trends take place, preferring an interpretation of racial degeneracy.

The publisher's description and one other review present a considerably more nuanced picture than the one you chose to quote ([http://www.amazon.com/gp/product/0871548488/ref=cm_rdp_produ...](http://www.amazon.com/gp/product/0871548488/ref=cm_rdp_product)) I do not think a selective book review from a tinfoil-hat-wearing race baiter makes the cut.

<comment><USER19> The reviewer is irrelevant. I posted quotations from the book.

<comment><USER24> You quoted and linked to the review rather than original source material, and as such you own the selectivity and bias too. The quoted sections do not, in any case, validate your original argument, but only offer partial support for one of your assertions.

</comment></comment></comment></comment></comment></comment><comment><USER25> I already gave my points about immigration in some earlier posts, but my opinion is: Immigration is irrelevant to prosperity of country. Several reasons for that: 1\. The countries many immigrants are from, you know they have very affordable medicine and education (former Soviet Union, for example), so in fact any modern American big software company parasite on this cheap facilities, without any interest in developing similar things domestically. 2\. There plenty of examples of countries with high rates of innovation, but with low immigration rates: Sweden (ericsson), Finland (Nokia), Japan. 3\. I dare to claim, that immigration erodes values of American society.Imagine a person from China or India (the country where 60 million people literraly live in poop, they are born in cast of poop-cleaners- by-bare-hands), the person comes to USA and imeddiately becomes middle class (upper sometimes). Well, this new middle class built from immigrants from ugly places, thet have a lot higher tolerance for injustice and corruption.

<comment><USER26> Systems are more powerful than the people caught up in them. The person who is escaping the "cast of poop-cleaners-by-bare-hands" is trying to escape the system that casts him thus. If you (America) ensure that only the best and the brightest are granted entry, then you get to both

a) preserve your system, without dilution of it's core principles

b) allow new entrants into the system who are hungry and desperate to succeed and start a new life

What the article correctly identifies is that someone who is desperate to succeed will go much further than others. This kind of inner motivation is extremely valuable and is what fuels the engine of America's growth.

</comment></comment><comment><USER27> Disproof:

[http://www.nationmaster.com/graph/peo_nob_pri_lau_percap- nob...](http://www.nationmaster.com/graph/peo_nob_pri_lau_percap-nobel-prize- laureates-per-capita)

So, so tired of the BS. The reason you think immigration is so wonderful is because you have been brainwashed since childhood. Period.

But really, look at this:

 _Smart immigration policies will do more for American innovation and productivity than better math and science education, more spending on basic research and additional venture capital combined._

Boil this off...what is he saying:

"You should not improve the people...you should _replace_ the people."

<comment><USER3> Disproof to your above claim:

The US soccer team is mostly out of first-gen recent immigrants, or people that were given a passport just to play here. I think a fair-er comparison is of Noble prize laureates by ethnicity or country where they were born. You probably will see a lot more even distribution. Americans are not any smarter then, lets say Europeans. It is just they have more means.

You will probably see a great correlation to economic output and noble price laureates because:

1\. Richer countries attract smart people. You are smart, you probably are smart enough to be given great jobs/research positions and the best places to live in this earth, which happen countries that are rich already.

2\. To do nobel price research, you probably need a lot of financial/instutinational backing, which you are most likely to find in rich countries..

<comment><USER28> "I think a fair-er comparison is of Noble prize laureates by ethnicity or country where they were born. You probably will see a lot more even distribution."

Ha. You seriously believe that, don't you? I'm impressed almost. In the U.S., 13% of the population is black. 2% is Jewish. Guess who get Nobel prizes and who don't.

Evolution is a nasty, nasty theory that happens to be true. The magical equality fairy theory is beautiful, full of peace and love, and is wrong and stupid.</comment></comment></comment>


Rapidly Prototyping Rockets - <AUTHOR> http://media.armadilloaerospace.com/misc/sas07_high.mpg

<comment><USER2> That's pretty awesome.

I guess this is what John Carmack is doing with his fortune from Doom and Quake.</comment>


Linux ransomware in the wild - <AUTHOR> https://forums.gentoo.org/viewtopic-t-1060828.html <comment><USER2> It doesn't seem to have been mentioned on the forums, which is alarming, but the correct response to finding out your machine has been owned is to _shut it the fuck down_. Right away. Then boot up a rescue CD, which will have a known working system (read: not compromised), from which you can do some forensic work to find out how you were owned and what data is recoverable.

Take the data you can recover offline and then reinstall from scratch. Don't try to fix it, just recover what you can and throw the rest away.

<comment><USER3> > from which you can do some forensic work to find out how you were owned

It's worth noting that if you are really serious about doing forensics and investigating the attack, then shutting down can be pretty destructive.

> what data is recoverable.

Another point I'd make is that try to recover as little as possible from the infected system and prefer using clean backups instead.

I agree on the overall sentiment though, attempting to recover a infected system is unnecessarily risky. Nuke it from the orbit, it is the only way to be sure.

<comment><USER4> I may be wrong, but these days doesn't malware have a loader (which has a hook in the boot cycle at some point) and a payload (which usually poses as an innocent file tucked away on your system somewhere). Even if you wholesale recover your data and include the payload, there is no loader hooked into your newly-installed system, rendering the payload a digital bullet without a corresponding gun. As far as I'm aware, infecting your MP3s or JPEGs was more something ye olde worms did, no?

<comment><USER5> The loader hook could well be in your .profile. Or the infection vector could be a naughty PDF just waiting to be thumbnailed again after a reinstall.

<comment><USER6> Could you elaborate are you referring to a specific PDF vulnerability? Could you share a link to it? Thanks.

<comment><USER7> This should do:

> In the first demo, I just select the PDF document with one click. This is > enough to exploit the vulnerability, because the PDF document is implicitly > read to gather extra information.

> In the second demo, I change the view to Thumbnails view. In a thumbnail > view, the first page of a PDF document is rendered to be displayed in a > thumbnail. Rendering the first page implies reading the PDF document, and > hence triggering the vulnerability.

> In the third demo, I use my special PDF document with the malformed stream > object in the metadata. When I hover with the mouse cursor over the document > (I don't click), a tooltip will appear with the file properties and > metadata. But with my specially crafted PDF document, the vulnerability is > triggered because the metadata is read to display the tooltip…

[https://blog.didierstevens.com/2009/03/04/quickpost- jbig2dec...](https://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode- trigger-trio/)

</comment></comment></comment></comment></comment></comment><comment><USER8> Nice read but nothing particularly special here and it happened months ago. The title is alarmist.

TL;DR: The user ran firefox as root and the attack happened through adobe- flash. Hardly a sophisticated attack.

<comment><USER9> Why does it matter if Firefox ran as root or not? I agree it's terrible practice in principle. But most people will run Firefox as their ordinary user, which normally has full access to the files in their home directory.

If someone gets arbitrary code execution under your user, they can erase/encrypt your files. Who cares if the OS files are safe. All the data you really care about will be gone.

<comment><USER10> agree. ordinary user is absolutely sufficient. I'll now present a sophisticated privilege escalation method that most of us won't notice (me included, sarcasm off):

      alias sudo='/usr/bin/sudo echo something evil && /usr/bin/sudo'

I don't think it matters that he used his root account.

Edit: Maybe I'm wrong with my opinion, you can disable ASLR using your root rights... [https://askubuntu.com/a/318476](https://askubuntu.com/a/318476)

Edit: Last exploit for Linux remote exploitation with Flash is from 2015 [https://www.rapid7.com/db/modules/exploit/multi/browser/adob...](https://www.rapid7.com/db/modules/exploit/multi/browser/adobe_flash_hacking_team_uaf) or did I miss something here?

<comment><USER11> I'm going to make a separate account just to run the web browser, xhost +localhost && su -c web-browser unprivileged-user

<comment><USER12> If you're using xwindows they can just install a keylogger

</comment></comment></comment></comment></comment><comment><USER13> Not trying to blame the user, just trying to understand: why would someone ever run a web browser as root? A text editor to edit system files, ok, but a browser?

<comment><USER14> Seeing as the user's main problem is their home directory was encrypted, the root doesn't seem like it would make any difference...

Better would be easier ways to run browsers (and all applications) inside protected systems of some kind, so even if they are hacked they can't touch anything outside their own cache directory, and creating downloaded files.

<comment><USER15> You're describing a sandbox. You run the security-vulnerable routine inside a separate process and give this process the most minimal read/write-permissions that the routine can still work with.

Flash itself has been sandboxed inside Firefox's Plugin Container since forever and Firefox is getting a sandbox around tabs as we speak.

But you can break out of sandboxes. By either exploiting a bug in the OS that bypasses process permissions or by finding a hole in the sandbox that allows you to do things.

I imagine, for example, if you want to upload a file, then the tab-process has to talk to the less restricted main-Firefox-process, which has to then open up a file-chooser dialog and give control to the user.

But it could for example be possible to somehow malform this request to the main-Firefox-process, so that the file-chooser crashes and just hands over a random file, before the user has even seen the dialog. (Obviously, I'm not going to come up with an actual security vulnerability on the spot here.)

This kind of vulnerability can't be fixed with a sandbox. You need some way to upload files, for which you'll need filesystem access in some way and to pretty much the entire Home-directory.

Theoretically, you could require the user to copy the file into a separate "Upload"-directory and then only have read-permissions to that directory, but that's hardly user-friendly and would probably end up with some users keeping their entire Home-directory underneath that Upload-directory.

</comment></comment></comment><comment><USER16> It seems like some variant of the Linux.Encoder.1 (2015):

[http://www.zdnet.com/article/crypto-ransomware-strikes- linux...](http://www.zdnet.com/article/crypto-ransomware-strikes-linux-but- attackers-botch-private-key/)

[https://labs.bitdefender.com/2015/11/linux-ransomware- debut-...](https://labs.bitdefender.com/2015/11/linux-ransomware-debut-fails- on-predictable-encryption-key/)

probably "python based" and, as mentioned on the gentoo forums, the ransomware mesage is very similar to the one in: [https://github.com/jdsecurity/CryptoTrooper](https://github.com/jdsecurity/CryptoTrooper)

</comment><comment><USER17> Hmm... I half expected this to be a joke and the post about how they had to compile it themselves and were trying to get the dependencies squared away.

Friends don't let friends run Flash. Does Gentoo have Firejail readily available? That would have prevented this, I'm pretty sure.

</comment><comment><USER18> This is 7 months old. From March. Title makes it sound like breaking news.

</comment><comment><USER19> Hadn't thought of it before but it might be an idea to run my browser (Firefox, Kubuntu 17.04) under a separate user that doesn't have access to my main user files.

Might be simplest to just create a user through the DE, then "su -c" from my main user to run the browser?

<comment> unkown-unknowns Out of the box it'll probably tell you "Client is not authorized to connect to server" if you try to run anything X11 as another user.

However it should be possible to configure your system such that it doesn't like such: [https://wiki.archlinux.org/index.php/xorg#X_clients_started_...](https://wiki.archlinux.org/index.php/xorg#X_clients_started_with_.22su.22_fail)

<comment><USER19> I currently run my kids browsers under my user by doing "xhost +local:; su -l -c /usr/bin/firefox $USERNAME" where USERNAME is the kids login. I may have made changes to enable that, don't recall sorry.

<comment><USER20> An extra layer of protection may be offered by using the likes of xpra.

[https://xpra.org/](https://xpra.org/)

</comment></comment></comment></comment><comment><USER21> There is trend of insecurity/vulnerabilities that seems to gain in speed in recent months. Not trying to sound ominous and nothing to really point finger to but it seems like a thing.

Since few months ago I do almost all browsing in carefully set w3m. No javascript at all of course and certainly no flash. I am typing this in vim which is set as default form editor in w3m for me.

Edit: if you are wondering if w3m can work well try looking at HN using w3m, its a real beauty.

</comment><comment><USER22> That is one of the reasons I am thinking about having /home on NILFS2 ([1] a log-structured file system) in my dabbing with my own Linux distribution. When you have constant snapshots then ransomware can't do much, can it?

[1] [https://en.wikipedia.org/wiki/NILFS](https://en.wikipedia.org/wiki/NILFS)

<comment><USER23> Depends on what permissions it has. If it runs as root, it probably could delete/mess up snapshots. If it's going to do so, especially for non- mainstream filesystems, is another question.

<comment><USER22> If it runs as root you have much more to worry about, but that's of course one of the problems.

</comment></comment></comment><comment><USER24> Yes, I got hit by this on two separate machines in June or so, they'll break into one, steal all the SSH keys and look through your history looking for more machines to break into. It sucks ass. I suspect that my breakin was because of an outdated Wordpress installation I kept around.

This malware is super thorough and super obnoxious. Keep your machines up-to- date.

</comment><comment><USER25> > "Yeah, I'm guilty of running FireFox as root."

Noooooooooooooo!

</comment><comment><USER26> I don't understand from this post why run Firefox as root and why have in addition flash enabled on Linux.

But it's still interest that they bother with making ransomware the first place for Linux.

<comment><USER27> Lots of servers run Linux. Lots of data to hold ransom on lots of servers running Linux.

<comment><USER26> But who runs flash on server as root?! If this was the source..

<comment> yjftsjthsd-h It's a multi-stage thing, first stage gets into a system by browser exploit, then it uses SSH keys to get everywhere else

</comment></comment></comment></comment><comment><USER28> Linux ransomware has been around since the fall of 2015. Nothing special, mate.

<comment><USER28> Wow...voted down for speaking the truth and bringing some actual knowledge to this fear-mongering thread. HN is turning into Slashdot, I see.</comment></comment>