Building sites with middleman - <AUTHOR> http://willschenk.com/building-sites-with-middleman/ <comment><USER2> Middleman is awesome and very proven in the field. There's a lot of cool sites out there made with it.

At Netlify ([https://www.netlify.com](https://www.netlify.com)) we're building a static hosting service with integrated build automation that's perfect for projects built with static site generators.

With the right tooling this approach to building websites can be so much more efficient than traditional dynamic sites, and it solves all the issues around security, performance and scaling costs that plagues WordPress and Drupal sites.

<comment><USER3> How is Netlify better than Github Pages?

<comment><USER2> Github pages can only run builds of plain jekyll sites with no plugins. Netlify will work for pretty much any static site generator (right now we support ruby, node and python).

You can also trigger new builds without pushing to Git (essential for pages like [https://www.staticgen.com](https://www.staticgen.com) that grabs data from somewhere else than the Github repo).

Apart from that there's hosting features like:

SSL for custom domains

Redirects

Rewrite rules

Fine grained header control

Lossless image compression

Automatically moves asset to content addressable URLs on a cookie-less domain with far-future expires headers

There's a few more things in the works as well.

<comment><USER3> Great! Exactly the information I was looking for :)

</comment></comment></comment></comment><comment><USER4> I second the thumbs-up to Middleman...to me, it hits the right sweet spot between hack-it-yourself-static-site and building out a Sinatra/Padrino/Rails, or even a WordPress site.

Having Sass and templating work right out of the box is, for many of my projects, just about all I need. Then I add a plugin to deploy to S3 and I'm good to go. But one of Middleman's best features is the ability to supply JSON (or YAML) files and automatically generate routes and pages from the data. I find it to be a nice way to prototype data-heavy sites that may end up requiring a full-blown Rails setup.

If all you're doing is blogging, then Jekyll might be all you need (especially since it, I think, had native Sass support in its latest version)...but for anything more complicated, or even simpler (i.e. a few static pages and not a blog), Middleman hits that niche very sweetly. I came across it when reading an article by a front-end shop about how they use it as a sort-of backend to their client-side-heavy apps...I haven't used it for that purpose yet, but, given how easy it is to setup the build process via Sprockets, I have no doubt it could serve as a decent static backbone for such an app.

Vox Media uses Middleman for most of their features: [http://product.voxmedia.com/2014/7/29/5863004/take-a-peek- at...](http://product.voxmedia.com/2014/7/29/5863004/take-a-peek-at-the-code- that-powered-the-verge-50)

</comment><comment><USER5>
        Many sites don't really require all that for them to run,
        and it's crazy to me that something as read heavy as a
        blog often can't perform well under load given that it's
        just serving up the same old stuff over and over again.
        You want to have some tooling to make it easier, but it
        doesn't need to be run time tooling.

Woah, that makes a tremendous amount of sense, I'm really surprised this kind of thing wasn't developed and caught on big earlier. No more worrying about security upgrades, no more worrying about overusing limited computing resources, no more worrying about giving things like Wordpress to people who don't understand the vast security implications, etc. etc.

<comment><USER6> I am curious about this seemingly common perception that Wordpress is an insecure product. Is Wordpress, when configured correctly, far less secure than other platforms? (My main thinking is that it is an obvious target due to its incredible marketshare)

A client I had was recently terrified of using Wordpress because an 'SEO expert' had filled her head with conjecture about the insecurity of Wordpress compared to Drupal, referring anecdotally to the White House website using Drupal as some sort of indicator that Drupal is infinitely more secure.

However, looking at CVE data, I don't find massive discrepancies, in fact Drupal had more listed vulnerabilities (almost double) than Wordpress in 2014. Compare the CVE statistics for Drupal [http://www.cvedetails.com/vendor/1367/Drupal.html](http://www.cvedetails.com/vendor/1367/Drupal.html) vs. Wordpress [http://www.cvedetails.com/vendor/2337/Wordpress.html](http://www.cvedetails.com/vendor/2337/Wordpress.html)

I'm just curious if you believe there are inherent risks in Wordpress, or if you meant specifically Wordpress in the wrong hands and with the wrong plugins/extensions etc.

<comment><USER5> > I'm just curious if you believe there are inherent risks in Wordpress, or if > you meant specifically Wordpress in the wrong hands and with the wrong > plugins/extensions etc.

Well, in the context of submission link -- serving straight up static HTML content, you have essentially zero risk of security vulnerabilities. I meant to contrast this in a general sense with Wordpress, so I moreso did mean to imply Wordpress is insecure for _both_ its inherent risks (fewer or greater than Drupal) and risks that come with plugins (which a significant amount of Wordpress users _do_ end up getting).

</comment></comment></comment><comment><USER7> I love middleman. I'm using it (via a modified version of Slate docs [1]) for all of our documentation at Catalyze [2].

1.) [https://github.com/tripit/slate](https://github.com/tripit/slate) 2.) [https://policy.catalyze.io/](https://policy.catalyze.io/)

</comment><comment><USER8> Sounds very good. But I would like more info on :

      > but I personally have had poor luck getting Grunt to work reliably in practice.

<comment><AUTHOR> Ruby is really good at writing DSLs, Javascript sucks at it.

I'll happily admin that this is user error, but I always have trouble editing Gruntfiles when I start to bring in other packages. Adding an additional task to a Gruntfile is way harder in than Rake, or make, or even Ant for that matter, mainly because you are dealing with hand editing a huge JSON blob.

Tweaking the file to add a different path in or whatever is fine, but there are many times where I wanted to to copy and paste something in to make it work, and I spent as much time fiddling with the format of the js file as I did solving my problem.

A lot of people love grunt, but I'm not one of them.

<comment><USER8> Thanks for your reply. I've been working with maven and make so far. I'm not used to do much stuff in Ruby, so that's why I don't consider Rake files for a big benefit of my working process.

Anyway I consider your points valid, although I also think you can remove a lot of the boilerplate ( Copy-Paste code ) by introducing some variables to your Grunt build.

I personally use Assemble [1] and I find it pretty decent for generating static content websites.

Good to know there's a good alternative in the ruby world.

1: [https://github.com/assemble/assemble](https://github.com/assemble/assemble)</comment></comment></comment>


60 people shot in Chicago over the weekend - <AUTHOR> https://nbcnews.to/2AMwFVm <comment><USER2> What is the main revenue source for these gangs? Just drugs?

Maybe we could just decriminalize a lot of the drug trade and starve the gangs of the money to fund these gang wars.

<comment><USER3> I think it's more that they've got a surplus of young men with no other options; historically, in any society where that occurs, you get violence sooner or later. Young men with nothing to do cause trouble, no matter where they are.

<comment><USER2> There are many factors, I was asking specifically about the funding.

<comment><USER3> My point (poorly articulated) was that, in an environment where the cost of labor is driven to zero, there doesn't necessarily need to be much revenue involved at all.

And of course Chicago is a major cartel nexus, so there's plenty of illicit money sloshing around.

<comment><USER2> Nexus of what kinds of cartels? I guess that's my question.

<comment><USER3> It's a major shipping/transportation hub, with a huge number of spanish- speaking people, so i think cartels have historically found it a useful place. [https://en.wikipedia.org/wiki/Sinaloa_Cartel#Operations](https://en.wikipedia.org/wiki/Sinaloa_Cartel#Operations)

<comment><USER4> You're not answering jeffdavis's question. The answer is "drug cartels", which is jeffdavis's point. They aren't just some generic cartels; they're specifically _drug_ cartels.

But you have a bit of a point, too. If you have tons of time and no money, there are a fair number of ways you can earn some money outside the law. Drugs are the most profitable currently, but if they were made legal, the action would probably move to other kinds of illegal activity.

<comment><USER3> I guess the way I see it, the drugs are incidental. Historically they haven't been, and for now the mix of drugs is changing - less weed, more opiates and meth - but I don't think just getting rid of the drug war would end gang life in Chicago.

Let me be clear that I think the drug war is a terrible idea for a million reasons and should be ended tomorrow, or like, yesterday. But I don't think its end would be the end of gangs in places like Chicago, where the supply of young men is abundant and has no other alternative. Gangs will just find some other criminal activity, as the cartels themselves have started to do.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> ABC is reporting 66 shot [0] and 12 fatalities.

[0] [http://abc7chicago.com/66-shot-12-fatally-in-chicago- weekend...](http://abc7chicago.com/66-shot-12-fatally-in-chicago-weekend- shootings/3892234/)

</comment><comment><USER6> A terrorist attack without terrorists. We're doing this to ourselves. I think it's time to make the gun illegals on the street on a massive scale.

<comment><USER2> What specific policy are you proposing?

<comment><USER6> I'm not proposing any policy. Just pointing to a state of the world that I think would cause less shooting.

<comment><USER7> Chicago _already_ has some of the strictest anti-gun policies in the US. [edit] They had, in effect and for decades, a ban on the sale of guns (requiring registration but then not actually allowing it). Some of the restrictions have been disallowed in recent years due to conflicting with the Constitution.

This may be why the level of violence in that particular town is of interest to many social and political commentators.

<comment><USER6> But are guns illegal, though?

From what I can gather [1], they're not. Some semi-automatic firearms, considered as assault weapons, are illegal in Chicago.

[1] [https://en.wikipedia.org/wiki/Gun_laws_in_Illinois](https://en.wikipedia.org/wiki/Gun_laws_in_Illinois)

<comment><USER8> So are you saying the Gangs will follow the laws?

<comment><USER3> The argument for gun control has never been that criminals will just obey the gun control laws.

The point is, and has always been, and will always be, to reduce the number of guns available. Fewer guns === fewer shootings. Axiomatic.

Of course, it's substantially easier said than done. But the mechanism by which gun control reduces gun crimes really doesn't require any criminal to spontaneously follow the law for some reason. It's a public-health measure, like vaccinating kids.

<comment><USER2> "Fewer guns === fewer shootings. Axiomatic."

That's not an axiom.

Left as an exercise: find a subset of guns such that, if they were destroyed, is likely to increase the number of shootings.

<comment><USER3> Yes, I would argue it is in fact an axiom: a statement that is regarded as being established or self-evidently true.

Since basically all of the evidence we have available to us suggests that fewer guns lead to fewer shootings, and more guns lead to more shootings; since the only real objections to that logic are rather contrived "find the subset of guns such that removing them leads to more shootings" logical toys with little if any foundation in the real world; and since it's, I mean, just clearly correct - I'm curious why you think such a proposition is not obviously true.

Clearly there is a debate about the effectiveness of gun control in America, the one country on the planet that has yet to make up its mind about this. However, I would suggest that such a debate is not being carried out in good faith.

<comment><USER2> Calling something an axiom (when it's not) dismisses any nuance and leads to bad policies, even if it's "mostly true".

"More cars === more global warming" is mostly true, but might lead to really bad policies if taken too strictly. For instance, someone might make new cars illegal, which would prevent us from taking advantage of more efficient or more electric cars thta actually help the situation.

<comment><USER3> I grant you that oversimplification can be a problem.

However, I would argue that we're not particularly oversimplifying here. [https://www.hsph.harvard.edu/hicrc/firearms-research/guns- an...](https://www.hsph.harvard.edu/hicrc/firearms-research/guns-and-death/) sums up the overwhelming amount of literature demonstrating the obvious point I'm making quite nicely.

Social science is not the same thing as a pure mathematical theorem, so in that sense, an axiom in the social sciences is not as tidy as an axiom in a mathematical context.

Nevertheless, I think the weight of evidence makes pretty clear that more guns === more shootings. I'm willing to compromise and say that it is not technically an axiom, but instead a well-established fact, if that makes you feel any better.

But I think the far greater danger we face is people obfuscating simple truths because their political agendas require it. Rather than just letting "more guns === more shootings" slide, we're getting into an extended back and forth here, that kiiiinda obscures the fact that the overwhelming amount of evidence is on my side.

And the consequences of this, as opposed to your odd hypothetical where we take gun control TOO seriously in the US, are clear: more people will die. I'm sorry to be blunt, but, there you have it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER2> How big of an area is this happening in? Would police saturation of the area be practical and effective?

<comment><USER3> A) Big. The south side alone is ~60% of the city; the west side is much smaller, but the point is that by land area (not a great measure, admittedly), there's just a ton of space to patrol.

B) No. It's been tried, pretty consistently, with (at best) mixed results. Under Rahm, at one point (may still be true), CPD was paying boatloads of money in overtime to saturate violent neighborhoods.

C) That said, the book Ghettoside makes the really convincing argument that neighborhoods like the ones under discussion in Chicago simultaneously suffer from under- and over-policing. There's a massive police presence in much of the south side, kinda, and a lot of people get arrested for a lot of stuff. At the same time, the murder clearance rate (the number of murders "solved" by the police) was ~17% in 2017 ([https://chicago.suntimes.com/news/murder- clearance-rate-in-c...](https://chicago.suntimes.com/news/murder-clearance- rate-in-chicago-hit-new-low-in-2017/)) but over 60% in the (rather more violent) 1990s. So a lot of people have a lot of negative interactions with police, but the most serious crimes - murder especially - rarely get solved. Lots of people in the neighborhood know (or suspect) who did it, but that person never goes to jail (for that crime), resentments build up, it becomes harder for police to cultivate good sources/relationships, retaliations occur, etc etc you can imagine how things go.

D) There have been pretty successful interventions; CeaseFire comes to mind ([https://chicagodefender.com/2018/01/10/the-return-of- ceasefi...](https://chicagodefender.com/2018/01/10/the-return-of-ceasefire/)). But it's suffered from lack of money and infighting at the state level between Rs and Ds. The basic idea, though - intervene in violent situations with people who are from those neighborhoods and used to be in gangs - seems to work quite well. It just needs money.

E) Crime is still actually down when compared to the 70s/80s/90s. Not that that's much comfort to someone living in one of the affected neighborhoods. But the country as a whole has become both more peaceful and more media- saturated, so aberrations like this get much more attention and the problem seems worse than it is - though again, that doesn't mean much to someone who just had a loved one get shot.

</comment></comment><comment><USER9> Is there a riot going on in the city? TFA has literally no details except that the mayor has blamed the shootings on guns(?).

<comment><USER10> Click the 'Read More Here' link.

<comment><USER9> Wow that was kind of stupid of me to miss that.

<comment><USER10> Nah, it wasn't exactly the most user-friendly page.</comment></comment></comment></comment>


Growing number of airlines offer 'flights to nowhere' - <AUTHOR> https://www.washingtonpost.com/world/2020/09/17/growing-number-airlines-offer-flights-nowhere-international-travel-remains-stalled/ <comment><USER2> I read during lockdown season earlier this year that jets still had to fly, even if there were no passengers, because pilots have to maintain a certain number of air hours per year in order to keep their licenses.

Offering these one-way-return flights is a brilliant way to recoup some of the money this costs.

</comment><comment><AUTHOR> [https://archive.vn/YoHIY](https://archive.vn/YoHIY)</comment>


Sprint will offer the iPhone 5 with unlimited data - <AUTHOR> http://www.edibleapple.com/sprint-iphone-5-unlimited-data/

<comment><USER2> I am glad to finally see some competition with the mobile web costs. I have no idea how much it costs the companies for people to be on them, but it seemed like they looked at each other and said 'That company is getting away with charging per gigabyte and having no unlimited internet' and changed over to that. I hope that Sprint does this and the competition between companies drives down the price for these services, or at least brings back unlimited internet.</comment>


Show HN: React Cosmos 5 – A dev tool for building scalable, high-quality UIs - <AUTHOR> https://reactcosmos.org/ <comment><USER2> Looks awesome - any chance there is a way to use it in a codebase that doesn't use default exports? Perhaps adding shim files that import the component and re-export as default? (Would Cosmos have problems with the non-default- exporting TSX files?)

<comment><AUTHOR> I generally avoid defaults exports as well but didn't realize some codebases disable them completely. What do you mean by "non-default-exporting" TSX files, can you provide a link?

> Perhaps adding shim files that import the component and re-export as > default?

Definitely, you could add a transform to the Cosmos build pipeline that renames some named export to default. If you're willing to write the transform I'll gladly help you integrate it.

<comment><USER2> In general each export is named with what it is, so SearchWidget.tsx, which contains a search widget, would explicitly "export { SearchWidget }".

Both tslint and eslint support no-default-export rules, so its clearly at least a semi common approach.

I can't speak to why others use the pattern but I can say enabling no-default- export gets rid of the "do I import * as foo from, import foo from, or import { foo } from" conundrum and enables the linter or transpiler to detect when there is code that accidentally tries to import Football from "baseball" because import { Football } from "baseball" (when baseball.tsx doesn't export Football) generates a clearer and more targeted error message than some noise message about invalid props or wrong number of children under <Football> because it picked up some bogus default export from baseball.tsx. (Definitely not trying to start a language war here, engineering is always about trade offs, and different people and projects make them differently without invalidating each other's choices.)

I'm guessing there is a way to make a generic transformer but it's not a type of TypeScript language fu I've messed with.

<comment><AUTHOR> Totally agree, like I said I also avoid defaults exports (for the same reasons). But I'm fine with default exports in fixtures because you never import them by hand, they are picked up automatically by React Cosmos. And you can customize no-default-export rules to ignore fixture files.</comment></comment></comment></comment>


Why Are So Many Middle-Aged White Americans Dying? - <AUTHOR> http://www.theatlantic.com/health/archive/2016/01/middle-aged-white-americans-left-behind-and-dying-early/433863/?utm_source=SFFB&single_page=true <comment><USER2> drugs and suicide.</comment>


Stop playing startup and start building shit - <AUTHOR> https://www.linkedin.com/pulse/stop-playing-startup-start-building-kevin-marvinac?trk=hb_ntf_MEGAPHONE_ARTICLE_POST <comment><USER2> This is a solid article. I think the point about execution is spot-on.</comment>


Useful iPad Apps for Lawyers - <AUTHOR> http://hytechlawyer.com/?p=2538 <comment><USER2> Is Word, Excel and Outlook truly free? I thought you had to pay for a subscription.

Also, Pages is technically free (even though it costs 10 USD) because it comes for free with new iPads.

<comment><AUTHOR> A web search suggests that on iOS, the apps are free for viewing. On screens smaller than 12" (iPad Pro), you can edit docs after registering for a free Office365 account. For iPad Pro, a paid subscription is needed for editing. Market segmentation by screen size!

</comment></comment><comment><USER3> It's not an app, but I would add Casetext (YC) to the list of tools. It's free and is being improved rapidly to help more and more.</comment>


Equifax Is Said to Be Near $650M Settlement for Data Breach - <AUTHOR> https://www.nytimes.com/2019/07/19/business/equifax-data-breach-settlement.html <comment><USER2> I took Equifax to small claims. When that didn't pay up, I appealed and removed to higher courts. I continued doing this until it wasn't worth it for me. I think I cost Equifax a total of at least $20K USD. They had to keep flying lawyers back and forth from Atlanta to where I lived and put them in hotels.

I think I got them to spend more than I would have received in any settlement.

Fun note, my judge in small claims dismissed my case but said the following before dismissing it, "Mr. tuxxy, I would not trust Equifax with my dog's vaccination records. I'm absolutely appalled in the lack of protections Equifax provides for the personal data of Americans, however I'm afraid I don't see a case for negligence..."

She lectured Equifax's lawyers a bit on what a shitty offer credit monitoring was for the loss of my PII for a bit, then sent us out.

I trolled their legal team a bit near the end and tried to settle for $3.50 after mediation failed, but I wanted them to refer to the $3.50 as "tree- fiddy" in the settlement, but they refused. Oh well...

<comment><USER3> Sounds like your story would be a good article to read.

<comment><USER4> Yup. Would love to hear all the details.

<comment><USER2> I can write about it on my personal website. Maybe I'll submit it here some time. I'm afraid it's not that interesting other than the emails of me trolling them.

I wish more people took them to court. It was not difficult to do and is quite an effective form of direct action because they have to spend quite a bit of money to fight it.

<comment><USER5> That can be a helpful part of the writeup. I'm sure it would motivate a bunch of us to actually do that.

<comment><USER6> I second this! I'm sure there's lots of people on HN who would find this really useful. There's so little corporate accountability that individual legal action might actually prove significant. And as far as applying economic pressure, a ton of small-claims cases could prove more costly than a single class-action suit (and hence provide more deterrence).

<comment><USER7> Thirded. It could really have an effect to write about it and give this more attention, with perhaps a call to action to do likewise (and why that might be good).

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I don't understand how Facebook got a $5B fine, yet Equifax gets a ~$650m fine. The data breached in the Equifax case seems to cause far more direct harm, and affected many more Americans. It feels like the 10x difference should go the other way.

Can someone more educated in how these fines work teach me about how these numbers are calculated?

<comment><USER9> > _The data breached in the Equifax case seems to cause far more direct harm_

Facebook breached a consent decree with the FTC [1]. Demonstrating harm was simple—they breached a settlement.

Equifax's harm is potentially great. But demonstrating damages is difficult.

TL; DR Facebook is a repeat offender.

[1] [https://www.ftc.gov/news-events/press- releases/2011/11/faceb...](https://www.ftc.gov/news-events/press- releases/2011/11/facebook-settles-ftc-charges-it-deceived-consumers-failing- keep)

<comment><USER10> > ...demonstrating damages is difficult.

I still don't see how less than $5 per person who's data was compromised constitutes a reasonable settlement.

<comment><USER11> Have you got better numbers?

<comment><USER10> Right here: [https://news.ycombinator.com/item?id=20484328](https://news.ycombinator.com/item?id=20484328)

</comment></comment></comment></comment></comment><comment><USER12> This is ridiculous. They just continue as if nothing happened. And who gets the money? What about the consumers who got affected? Where is the compensation for them?

<comment><USER4> The damage to each individual is incalculable. Their company should just be dissolved and split between everyone affected at this point. Giving them a fine even close to the amount of economic damage they did would already be the end of the company.

<comment><USER13> Splitting the company would just mean selling the data (the only valuable asset they have) to somebody else, whoever would pay the most.

<comment><USER14> Why? Breaches like Equifax happen when companies treat data, especially personal data, as an asset rather than a liability. Treat their database as the toxic asset that it is, and delete it as part of the bankruptcy.

<comment><USER15> Then what do you sell? You can't sell the company and distribute the money to the affected people if you make the company worthless first.

</comment></comment></comment></comment></comment><comment><USER16> When corporate fines are shown in headlines, I think they should be expressed as a % of market capitalization or cash on hand (the latter % obviously being much bigger). It helps the reader better understand what kind of action was taken. Fining McDonald's 10M and fining Mozilla 10M will have radically different effects.

<comment><USER17> Equifax is currently worth about 16.6B. This takes into account the fine, so without the fine they'd presumably be worth 17.25B or so. So this was a fine of 3-4% of their market cap. Total costs associated with the breach were probably moderately higher than that.

That being said, it's important to understand that in the US, penalties are assessed based on the seriousness of the infraction, not on the ability of the perpetrator to pay.

And while it might be the opinion of lots of HN commenters that the equifax breach caused "incalculable" harms, demonstrating this level of harm in court would be tremendously difficult.

<comment><USER10> > ...in the US, penalties are assessed based on the seriousness of the > infraction, not on the ability of the perpetrator to pay.

When the penalty is less than $5 per person affected, how am I expected to take that seriously? A penalty based on the actual seriousness of the infraction would put the company out of business, and that's what should have happened.

<comment><USER11> I agree but what's the actual seriousness of the infraction? Can the court calculate it? How?

<comment><USER4> Let's assume a piece of data is used to empty someone's bank accounts via social engineering. Now it's possible to calculate how much that'll cost the banks. Multiply that by the average worth of an Equifax "customer" and you'll arrive at a nice round number which should put them out of business.

<comment><USER17> There has been zero evidence that anyone's bank account was emptied due to the equifax breach.

</comment></comment></comment></comment></comment></comment><comment><USER18> My info is only worth $4.50?

<comment><USER19> What is the market value of your data on an open market? It might be less than $4.5

<comment><USER20> What was the level of detail exposed for the average person affected by the breach? Name, address, age etc?

That stuff has to be worth more than $4.5.

</comment></comment></comment><comment><USER21> I think they forgot at least three zeros in that number.

</comment><comment><USER22> So when will I be able to opt out of their tracking me?

<comment><USER23> That's the beauty of their business model — you can only opt out by opting out of most of banking altogether.

<comment><USER24> Opting out of US banking that is. This isn't a thing elsewhere.

</comment></comment></comment><comment><USER24> Why do we always fine companies and not the executives involved who made these decisions directly? Fining companies ensures the fines are mitigated and passed to the consumer ultimately, and rarely effect change, but even Zuckerberg would be stammering and sweating if he personally was issued a 5bn fine that he himself had to pay and couldn't have his company absorb.

</comment><comment><USER25> How does Facebook get billions and equifax gets millions?

Equifax goes out and gathers your personal finance data without even asking, they literally take it whether you want them to or not.

Facebook is data people choose to share freely.

This just seems like equifax should be settling with an extra zero on the end!

<comment><USER17> They do ask. It's one of the conditions in any loan you take out.

</comment></comment><comment><USER26> > Most of the roughly $650 million payment would go toward compensating > consumers for costs associated with the breach

4,48$ per person.

That ought to undo the damage of all your most personal information being public.

</comment><comment><USER27> What? $2/citizen? Somehow I thought I was worth more than that.

</comment><comment><USER28> That's like $3 dollars per affected adult!

</comment><comment><USER29> Yeah, it should be at least $100 billion.

The damages should completely wipe out all existing shareholders, and the company should be unable to continue as a going concern.

<comment><USER30> > The damages should completely wipe out all existing shareholders

Do you own any stock in a S&P 500 index fund, such as VFINX / VFIAX, SWPPX, FXAIX, PREIX, etc? Congratulations, you're a shareholder.

<comment><USER29> I'm well aware that the shareholders are very diverse and detached. All the more reason to impose a reasonable damages: $1000 per person. Let the market price that into companies that hold such vast amounts of sensitive data.</comment></comment></comment>


"What Did You Do?" - <AUTHOR> https://alexisohanian.com/home/2020/6/5/what-did-you-do <comment><USER2> Instead of everyone here nitpicking on how this action is too little, or not meaningful enough, or misguided, or whatever other criticism you can think of, just acknowledge that he is trying to do something. He is not seeking your approval or accolades. But actually doing _something_ is more than posting comments on HN, so there's that.

<comment><USER3> As I write this, there are 12 comments here, and every single one other than yours is disgusting. It seems Reddit isn't the only collection of self- centered people lacking empathy or any drive at all to understand the world around them.

<comment><USER4> It is irrational to compensate a negative event now incoherently with positive discrimination.

It's like saying: Germany started World War 2, now Germany must send soldiers to stop Syrian war to compensate its bad karma.

<comment><USER5> "Irrational" is becoming something of a synonym for "I don't agree". Also, that's an awfully dramatic analogy.

</comment></comment></comment></comment><comment><USER6> > I'm writing this as a father who needs to be able to answer his black > daughter when she asks: "What did you do?"

The rationalisation here is crazy. Dude with a black wife and a black daughter espouses some sort of moral requirement to quit his board role? There is no sense there. If there is a perspective here that makes sense; it needs elaboration.

It seems more likely he is dropping off the board for a different, unmentioned, reason.

<comment><USER7> Why does it seem more likely?

Part of the problem of systemic racism is lack of representation. If you aren't getting representation for your community then your issues are less likely to be addressed.

Why can't he feel a sense of moral obligation to have members of our community be represented in seats of power?

<comment><USER6> Traditionally when someone invokes their family while stepping down from a board it means there was either a major screw up, a sex scandal or a health crisis. It is normal not to get a straightforward reason for why someone resigns a powerful position.

> Why can't he feel a sense of moral obligation to have members of our > community be represented in seats of power?

His family is blacker than something like 80% of American families. He is "urging" a black replacement rather than identifying "this is the black candidate we have decided to replace me with". His daughter is going to be one of the American elite - this "able to answer" business is a transparent emotional play. She will crush everyone in this HN thread with the opportunities and material comforts that she will enjoy.

The blog post doesn't quite mesh. Balance of probabilities; there is more to this story that is not obvious. It isn't a basic moral decision.

</comment></comment></comment><comment><USER4> Wait, isn't exactly this discrimination? Selecting or not selecting someone based on his/her skin color?

</comment><comment><USER8> > "I have urged them to fill my seat with a black candidate"

Wait I'm really missing something about the "why?" here.

\- He didn't have an idea of how he could orient the organization he had built toward solving problems?

\- He didn't have any black leaders within the organization he could think of to elevate who would both have a more keen lived-experience sense of the nature of the problem _and_ know reddit culture enough to apply that understanding?

Maybe not and we don't have the full story here.

But systemic racism isn't some bad-apples good-apples issue any more than the 787-MAX was brought down by a pair of bad pilots. It is not really an issue of replacing people if they are under the same pressures. It's an issue of _systems_.

What systems does this refactor or dismantle?

</comment><comment><USER9> He is worth 10s (hundreds?) of millions of dollars. This costs him nothing. What he is suggesting reddit do is illegal.

<comment><USER10> > What he is suggesting reddit do is illegal.

Are board appointments considered hiring? Honest question. I have no idea how the law works here, but I just figured the shareholders could choose whoever they want.

</comment></comment><comment><USER11> Why is it just a black nothing as the picture?

<comment><USER12> From an Instagram thread where I asked my friend the same quesiton...

Me: "Hey there, you're latest post is all black. Is that a reference to the civil unrest & injustice in the USA at the moment? I'm a bit out of the loop being out of country."

My friend: "It is - in short, people are "muting" themselves on social media to stand in solidarity with our black peers and to amplify black voices right now"

</comment></comment><comment><USER13> Too little, too late. Reddit had a chance to ban T_D and other hateful subreddits many years ago and didn't.

<comment><USER9> So T_D quit reddit and went over to theDonald.win not because of reddit's censorship?

<comment><USER14> I'm not sure I follow. Could you rephrase?

I think you're trying to say: Reddit's partial censorship has been effective. For example, T_D is abandoned.

</comment></comment></comment><comment><USER15> "I have urged them to fill my seat with a black candidate"

Board positions are paid well, and racial discrimination in hiring is against the law. Ohanian should not be encouraging it.</comment>


Chrome 19: The Best Web browser just keeps getting better - <AUTHOR> http://www.zdnet.com/blog/networking/chrome-19-the-best-web-browser-just-keeps-getting-better/2391

<comment><USER2> The comments in that thread seem heavily biased on IE9/10. Usually it's the opposite.</comment>


How much time do you spend online? - <AUTHOR> http://9rules.com/web++/notes/6178/ <comment><USER2> Bad question. How much time do you _not_ spend on line?</comment>


Jobs was livid over native Facebook app for TouchPad, Zuckerberg cowered - <AUTHOR> http://appadvice.com/appnn/2011/10/why-facebook-almost-unfriended-apple-and-vice-versa

<comment><USER2> The original article is [http://mashable.com/2011/09/30/apple-facebook- hp/?utm_source...](http://mashable.com/2011/09/30/apple-facebook- hp/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Mashable+%28Mashable%29#21499Loading- Screen)</comment>


The State of Serverless - <AUTHOR> https://www.datadoghq.com/state-of-serverless/ <comment><USER2> > AWS Lambda has already been adopted by nearly half of companies with > infrastructure in AWS

How was this measured? I'm probably friends with wrong people but only a very small percentage of the AWS users I know do not use lambda.

</comment><comment><USER3> The title should be more something like "The State of AWS Lambda". The FaaS/Serverless ecosystem is larger than AWS Lambda.</comment>


Tell HN: Hacker News Profile Leak (Fixed) - <AUTHOR> Under certain error conditions, a bug in our API code briefly published 84 users' usernames, email addresses, password hashes, and 100 most recent votes. This information appeared at https://hacker-news.firebaseio.com/v0/updates. We notified affected users on Monday, November 10th via email and (for users without email addresses in their profile) on Tuesday the 11th via a message in the site header.
Affected profiles were leaked on one of 10/12, 10/20, or 11/02. In every case, the leaked data was overwritten 30 seconds later by the subsequent update batch. The leaked password hashes were salted bcrypt (FreeBSD's default libcrypt implementation). Though we think the risk is low we encouraged affected users to change their password on HN as well as on any other sites where they used the same password.
Many thanks to Ovidiu Toader for alerting us to the bug and for sending us examples that assisted us in tracking it down. While the bug was fixed on Sunday, November 9th within minutes of our becoming aware of it, Ovidiu originally reported the issue one week prior - we just didn't see it in a timely manner.
To help improve our future response times, we've created a dedicated reporting address, email@example.com that we'll publish on our contact form. We're also creating a "Wall of Fame" to properly thank and credit past and future vulnerability reporters. More details will follow.
Super sorry about this,
The Hacker News Team
(Edit)
A clarification, since some people seem to be misunderstanding: Only publicly available data is intentionally pushed to Firebase. That any part of a user's profile other than their username, account age, about text, and list of submitted items was published IS THE BUG, and is now fixed. <comment><USER2> _100 most recent votes_

This has me curious. Why 100? Why not 0 or all? 100 seems to indicate you're aggregating the 100 most recent votes for some specific purpose, and that the feature unintentionally leaked the data.

I wonder if mods have the ability to go to a page, type in a username, and see the 100 most recent things they've upvoted/downvoted? I guess as a way of looking for voting rings?

I often upvote comments I feel are unfairly downvoted, definitely not because I agree with the comment. Hopefully vote history isn't being used as a metric of character. Then again, maybe it's a useful filter. I've often wished Reddit would drag down comments from people who upvote angry bully-type comments from other people, so there might be all kinds of interesting ways "100 most recent votes" could be used.

<comment><USER3> I would bet on technical reasons. From what I've read HN uses some unusual caching and optimization strategies - part of how the Arc application was optimized after initial development. I have no idea if this is the case here but it seems plausible - there is (outdated) source available[0] so you may be able to take a look for yourself.

[0] Mirrored at [https://github.com/wting/hackernews](https://github.com/wting/hackernews)

<comment><USER2> There's nothing particularly unusual about what Arc does. This probably has a technical explanation, but the most logical deduction seems to be that when a mod visits your profile page, they can follow a link that will show them the 100 most recent items you've voted for.

Either that, or a program is aggregating the 100 most recent votes in order to be used in some filtering or weighting algorithm to change the ranking of comments. (People who upvote what YC alums/patio11/tptacek/etc upvote may be upvoting high-quality things, so make their votes count more. That sort of thing.)

I guess it might improve server performance if the server caches your 100 most recent upvotes for page generation purposes, since when it serves you a page, it has to know whether you've upvoted each comment or not. But it seems like a stretch to say it's only used for that purpose, because it still needs to know whether you've upvoted things from very old pages, yet the list stays at exactly 100 items. And they already hunt for and punish voting rings. I was just wondering the extent to which votes are scrutinized.

EDIT: The more I think about this, the dumber I sound. The dataset that was leaked was almost certainly used to generate pages and nothing more. It's the simplest explanation, for one. Manually looking doesn't scale. The program to look for voting rings is probably a completely different program. Etc.

<comment><USER3> As I said, I have no idea if this is what is happening, it would just fit in with the pattern of "weird" caching that I've heard HN uses - I mention Arc only because some of the caching is related to eliminating closures kept around for things like user sessions IIRC[0], though I assume any Lisp would lead to similar optimizations.

[0] It appears this is not the case with the vote caching from staff comments in this thread.

</comment></comment></comment></comment><comment><USER4> > The leaked password hashes were salted bcrypt (FreeBSD's default libcrypt > implementation).

As bad as data leaks are, it's at least nice to see one of these data leak stories where the passwords were actually stored correctly, instead of being MD5 / plaintext / base64.

<comment><USER5> Be nice to know the number of rounds used though - the default of 10 in most implementations is starting to become not enough.

Also bcrypt does not seem to be FreeBSD's default libcrypt implementation from the source code [1] - it appears to be DES (or SHA512 if DES isn't available). What makes HN think it's bcrypt? @kogir?

[1] [https://github.com/freebsd/freebsd/blob/master/lib/libcrypt/...](https://github.com/freebsd/freebsd/blob/master/lib/libcrypt/crypt.c)

<comment><AUTHOR> Thanks for pointing that out. You're correct (and I was wrong) - it's not the default, but we format our salts to request it.

The docs are here: [https://www.freebsd.org/cgi/man.cgi?query=crypt&apropos=0&se...](https://www.freebsd.org/cgi/man.cgi?query=crypt&apropos=0&sektion=3&manpath=FreeBSD+9.2-RELEASE+and+Ports&arch=default&format=html)

The code looks something like this:

        (withs (salt (+ "$2$10$" (rand-string 20))
                ux   (crypt pw salt))
          <stuff>)

"(rand-string 20)" provides 128 bits of randomness from /dev/urandom.

I'll up the number of rounds and upgrade them in place as users log in. Thanks!

<comment><USER6> I know it's compelling to answer users who ask for more transparency on security. But it's not the best thing to reveal implementation details after hashes were leaked.

<comment><USER7> That's not how bcrypt works. If you have the hash, you know the number of rounds.

Even if that weren't true --- and it very much is --- you'd still trivially be able to find that number given a single known password.

<comment><USER6> > you'd still trivially be able to find that number given a single known > password.

I understand that it's because the salt is entirely appended in clear to the hash. Isn't it better to have a second static salt implemented in the code, in case only the database would be compromised?

<comment><USER7> I think those schemes are pretty silly, but as long as you're using a well- tested implementation of a real KDF and not some goofy scheme you hacked up yourself so you could add the second secret nonce, I don't care.

<comment><USER6> Alright, it's true that it feels silly to add negligible protections when your security here is reduced to the KDF and its implementation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Shit happens, we're all human. All you can do is learn from it. Thanks for setting up that dedicated reporting address, and for being transparent about the incident.

</comment><comment><USER9> I was pretty amused to see the notification come across my email...I never get to part of the fun hacks, and also, I randomize my password to make it hard to log back in (without searching for the text file I've buried it in) when I've logged back out...so no big loss. I know the email asked us to not say anything about it until everyone was properly notified but I was pretty surprised no one blurted it out anyway, this being HN and the lively discussions we have about hack incidents.

</comment><comment><USER10> This is a perfect example of how security venerabilities should be disclosed.

• Quickly • Transparently • With a fix already in place

</comment><comment><USER11> I was one of the lucky users. I was on the road (coming back from a family funeral in rural Kansas) at the time the email was sent, so I was barely on my cell phone network enough to see the email, and wasn't near my desktop computer where I usually do all my password changes. But I only use my password for any given site on that site itself, and I have now reset my Hacker News password, so all's well that ends well. Thanks to the HN team for fixing the bug and for notifying the users affected by the bug.

</comment><comment><USER12> Just wanted to thank the HN team for a responsible disclosure.

It's never fun to be on the receiving end of these e-mails, but the HN leak e-mail was the most responsible data-leak notification I've received.

Thanks for being professional and responsible!

</comment><comment><USER13> So why was that data pushed "randomly" into the updates queue? Or put another way why was it random rather than happening all of the time?

<comment><AUTHOR> Had it happened in all cases, I'd have noticed it (I hope!) before pushing it to the live site.

This was a case of rare error handling having unintended side effects. The profiles were only published in one very unlikely case.

<comment><USER14> Why are password hashes available via public API at all? Email addresses too?

<comment><AUTHOR> Because we made a mistake that is now fixed? It was definitely not intentional.

<comment><USER14> ok. the way you worded it, it sounded like the mistake was the publishing of the info, not that certain info was made available via the api. i was questioning why certain data would be available via the api, but it appears it was only available during error.

<comment><USER15> > it appears it was only available during error

Yes, for two different meanings of "error". I wonder if this ambiguity is part of what was confusing, so let me disambiguate.

 _There was a programming error in some error-handling code._ If that makes sense, you can skip the following.

The first kind of error was a bug in our code. The API code is _never_ supposed to send info to Firebase that you couldn't get by scraping the public website. Unfortunately, we wrote a line of code that (in a totally non-obvious way, which is why it got past both testing and code review) broke this rule.

The buggy line of code happened to live inside an exception handler. That is, it was only ever executed when a runtime error occurred. That's the second type of error we're talking about. An example might be a network timeout. These are infrequent, so the buggy code only ran infrequently.

Had the bug been in the happy path, testing would have caught it right away. In this case, though, even testing the error path didn't catch it, because certain other (basically random) conditions had to happen in order for the buggy code to leak the data. That's why we didn't know about it until Ovidiu told us.

</comment></comment></comment></comment></comment></comment><comment> undrcvr-lagggal Wow if _HN_ can't even get this right, it's no wonder so many fortune 1000 and fortune 100 companies are compromised so often. Information wants to be free. Secure programming requires thorough discipline.

</comment><comment><USER16> From the data leaked it sounds like HN is exporting a lot more than it should.

<comment><AUTHOR> Well, yes. That was the bug that was fixed.

<comment><USER16> Ah I see. Ouch. Well, I'm sure you'll be a lot more careful in the future ;) Thanks for the transparency, it's much appreciated (and in general short supply elsewhere).

</comment></comment></comment><comment><USER17> Is there a prize for the 84 users? even symbolic...

<comment><USER18> As one of the 'winners' I'm just happy that everything was hashed and salted correctly.

</comment></comment><comment><USER19> Hey, how come this is not yet on the homepage? my last post is weirdly stuck in newest as well... Any pb with the posts are picked up for homepage?

<comment><USER15> You can't derive the front page or an individual story's rank from the displayed score and timestamp alone. That's on purpose, as an anti-gaming measure.

I'm going to mark this subthread off-topic now. If you have questions like this, please don't post them here, but rather email email@example.com, as the guidelines ask.

<comment><USER19> sure no problem

</comment></comment></comment><comment><USER20> "Please put a valid address in the email field, or we won't be able to send you a new password if you forget yours. Your address is only visible to you and us. Crawlers and other users can't see it."

Welp, I'm taking my email out.

<comment><AUTHOR> Make sure never to commit to a public git repo either.

(Edit)

In all seriousness though, we're really bummed this happened and wish it hadn't. We do code reviews and try our best to prevent this kind of thing from happening. That said, if you truly want your account here to be anonymous, you're right to remove all personally identifiable information. I'd also recommend using tor (and using it correctly).

<comment><USER20> I've made statements on HN I'd prefer are anonymous to the general public?

Also, there was no mention they were handing the info over to a 3rd party. If you explicitly state something like that, you should follow it and/or change it when the situation changes.

I don't have that issue with git repos.

I'm kinda amused a yc employee went through the effort of downvoting it after pointing out this situation is caused by y'all not following what you actually have in your notices for things.

<comment><USER21> >I'm kinda amused a yc employee went through the effort of downvoting it after pointing out this situation is caused by y'all not following what you actually have in your notices for things.

Seriously what is it with HN/Reddit where everyone assumes that any downvotes are from people with an agenda?

<comment><USER22> Because I know I'm right and all rational people agree with me. Anyone who disagrees is a bad person.</comment></comment></comment></comment></comment>


Where is Premium Email? - <AUTHOR> http://drewb.org/post/18503305667/where-is-premium-email

<comment><USER2> Well I was going to respond to this, but I can't because I don't have tumblr account and I don't want one. So...premium aside, where is your e-mail?</comment>


Map.merge() – One method to rule them all - <AUTHOR> https://www.nurkiewicz.com/2019/03/mapmerge-one-method-to-rule-them-all.html <comment><USER2> Yes, the final example code reads reasonably nicely, but alas -- unless ConcurrentHashMap.merge() has been rewritten since Java 8 time -- it is definitely not as performant as the author appears to think it is since the actions will be contained in a fairly long synchronized block. This is not to say the code is bad, but you can't get around that.

Somewhat surprisingly, the code the author pooh-poohs is actually more performant (although it's better if the test is for the presence of the key rather than the "putIfPresent/computeIfAbsent combination) because the JVM will properly optimize a membership test (in keyset) and the use of a ternary expression makes the action clear.

</comment><comment><USER3> yes, Java 8 adds a bunch of methods to ArrayList and HashMap that makes the code a little more high level.

There is also another variation, using map.getOrDefault()

      words.forEach(word -> {
          map.put(word, map.getOrDefault(word, 0) + 1);
      });

and then at some points you discover the Stream API

      var map = words.stream().collect(Collectors.groupingBy(w -> w, Collectors.counting()));

<comment><USER4> in python:

        >>> from collections import defaultdict
        >>> map = defaultdict(int)
        >>> for word in ['hi', 'there', 'hi']:
        ...   map[word] += 1

I am glad Java has this stuff now, but it's a little surprising that its tools are still so obtuse relative to competitors.

edit: I should have foreseen the derailment caused by and nitpicking to follow a comment like this. Sorry folks!

<comment><USER5> Yes... now turn that map into a lock free thread-safe dict in Python and show us the same code. I get that for free in Java via ConcurrentHashMap.

<comment> ben-schaaf If you mean lock-free as in no GIL, you obviously can't. But otherwise all python code is inherently thread safe.

<comment><USER5> Yea I meant lock free and ready for multi-threaded use without a GIL. I didn't mean to dump on Python either, I write a lot of Python and Java but comparisons like yours aren't really fair because the JVM is just considerably more powerful than Python's runtime. I could take a huge list of words, hand subsets to threads and let them all update the same map using the same API and without needing a lock.

</comment></comment></comment></comment></comment><comment><USER6> This is a poor semantics. The function should always be called. In the non- existent-key case, it should be invoked on the default value that is supplied. Thus the example of the histogram tabulation would use 0 as the initial value.

The name is ill-chosen; this mutator doesn't "merge" at all; it "updates" the map entry through a function, with a default value.

"merge" might be a somewhat good name for an operation that combines two maps, with a function that resolves key clashes; though since that is a kind of set union, that provides better terminology.

</comment><comment><USER7> I like how the more mathematical concepts get their way to the mainstream languages. It's making concepts such as monoids and semigroups more accessible to general public.

</comment><comment><USER8> The one thing that frustrates me about merge is that it returns the value inserted, rather than the value being replaced (as Map::put does).

There are good uses cases for what it does - but there are also good use cases for returning the previous value, and when i have one of those, i can't use merge, and have to fall back to a get followed by a put.

Perhaps what i would really like is a Rust-style entry API, where i could use a key to obtain a Map.Entry, which i could then inspect and mutate how i liked. It might look like:

      Entry<K, V> getOrCreateEntry(K key, Function<? super K,  ? extends V> mappingFunction)

And then i could write:

      void sell(Potato) throws FarmException { ...}

      Map<Field, Potato> potatoesByField = new HashMap<>();
      for (var potato: getAllPotatoes()) {
        var fieldAndPotato = potatoesByField.getOrCreateEntry(potato.getField(), f -> potato);
        var oldPotato = fieldAndPotato.getValue();
        if (potato.getWeight() > oldPotato.getWeight()) {
          potatoAndField.setValue(potato);
          sell(oldPotato);
        } else {
          sell(potato);
        }
      }

To collect my prize potatoes into a map, and sell the rest. Still ugly, but hey, at least it's not Go.

<comment><USER9> Your API works less well in concurrent map scenarios, though.

</comment></comment><comment><USER10> Nice, so basically it's `INSERT ... ON DUPLICATE KEY UPDATE` ?

<comment><USER11> It's also MERGE in the SQL standard: [https://en.m.wikipedia.org/wiki/Merge_(SQL)](https://en.m.wikipedia.org/wiki/Merge_\(SQL\))

</comment></comment><comment><USER12> Monads do exist in the programming for a reason.</comment>


Ask HN: Video as a background? Are you mad - <AUTHOR>

http://www.whitelies.com/
Im not one for flash nor do I like sound playing in the background when you load a website.
There is something quite captivating about the use of video as a background to this bands website.
Am I having a lapse of judgement or do others who usually frown upon this find themselves strangely drawn to it?
Where else could it work?
Example: What if it were lots of smaller screens running the top TED shows, like what they do but more video than static. <comment><USER2> Being "drawn" to something is not the same as finding it useful or helpful. Certainly having the video as background is "captivating", but that means the foreground is basically useless: it's difficult to see, difficult to pay attention to, and difficult to use. The background gives you an idea of what the band is all about, and let's you watch them. But if that's the point, why have the foreground at all? Just show a video.

> Example: What if it were lots of smaller screens running the top TED shows, > like what they do but more video than static.

Sure, if the point of the TED site was to make people feel vaguely happy about TED. But when I go to the TED site, it's to watch a video so that I can understand the ideas the speaker is presenting, not to get my senses filled with some kind of aesthetic vibe of TED-ness. For me, at least, your suggestion would be highly counterproductive.

<comment><AUTHOR> Im going to pull you up on semantics here im afraid. I specifically used the word "captivate". If I wanted to question its usefulness or helpfulness I would have maybe used one of those words.

They have a foreground so you can click links, current web browsers do not fully support links in videos.

As for the TED site, I really like how they size up and down the image, yet I find the use of the static image a waste of time. Usually that image doesn't add to who or what is being spoken about. Hence I still feel the video could work there.

I understand why you would feel its a little over the top. But I remember the first time I saw the page, I thought that was over the top.

Yet now im used to it.

</comment></comment><comment><USER3> I quite like it - my iPhone really hates it though.</comment>


Mt. Gox trades rolled back, thief only got away with $1K in BTC - <AUTHOR> https://support.mtgox.com/entries/20208066-huge-bitcoin-sell-off-due-to-a-compromised-account-rollback

<comment><USER2> The hacker wasn't trying to get money. He was trying to undermine the system. And it's working.

The $1000 was a bonus on top of all the doubt he has now instilled in anyone who has bitcoins.

<comment><USER3> _The hacker wasn't trying to get money. He was trying to undermine the system._

What makes you think that?

Heck, I've been undermining bitcoin for weeks just for fun, but I'd much rather have a thousand dollars.

<comment><USER4> Not to sound paranoid, but if the hacker had a vested interest in bitcoin being undermined (government agent?) then money wouldn't be his main motive.

<comment><USER3> _Not to sound paranoid... (government agent?)_

Uh, sorry, that's pretty much textbook paranoia.

<comment><AUTHOR> It's a possibility. States do work to undermine things that threaten them. The Liberty Dollar project, for example, was recently shut down by the US government: <http://en.wikipedia.org/wiki/Liberty_Dollar> . Bitcoin is a potential threat to the state because it provides an ideal instrument for tax avoidance and competition in the drug/force trade.

<comment><USER3> _It's a possibility. States do work to undermine things that threaten them. The Liberty Dollar project, for example, was recently shut down by the US government:<http://en.wikipedia.org/wiki/Liberty_Dollar> _

Sure, and they shut it down openly using the hammer and anvil of the FBI and the judicial system. If and when the US Government decides to act against bitcoin, they'll do it loudly and openly... not by some complicated, difficult and illegal scheme that doesn't really achieve anything.

Currency issues fall into the jurisdiction of the US Secret Service, an agency not known for subtlety.

<comment><AUTHOR> Yeah, if legal and open is more cost effective, they'll likely go that route. Otherwise, they may revert to skullduggery (as they have in the past: <http://en.wikipedia.org/wiki/COINTELPRO>).

<comment><USER5> I think it's a big leap to go from illegal wiretaps to hacking and stealing.

<comment><AUTHOR> COINTELPRO included "extralegal violence and assassination" according to Wikipedia. So it's weird to think that the authorities would rule out a bit of hacking to protect their interests.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Homework assignment: what's $1k in BTC at $0.01/BTC?

<comment><USER7> That $1K stolen represents the first trades at the starting price of the crash, i.e. 50 or so Bitcoins.

Given the profits MtGox is making, it wouldn't surprise me the exchange buys $1K in Bitcoins for the account holder so he has his 500K coins again.

<comment><AUTHOR> Hopefully they'll hire some security consultants as well.

<comment><USER3> For a currency invented by a bunch of cryptography geeks, it's astonishingly insecure.

<comment><AUTHOR> Mt. Gox is an exchange, not the currency. The currency is secure. This is analogous to a bank getting robbed.

<comment><USER8> That's right, and let's be clear here: Mt. Gox has been kind of a mess from the beginning. They've never appeared to have a clue about security, and performance has been a complete and utter mess for quite a while now. To give you some idea, the trade that blew through the entire buy-side took over 30 minutes to execute, and the exchange essentially slowed to a standstill during that time. I realize that there are a lot of orders on any exchange at any moment, but 30 minutes of downtime in response to a single order? Come on...that's not even to mention the complete lack of sanity checks or catastrophe reporting that you'd expect in any system like this that touches people's money - it should _not_ have required people directly tracking down the site owner to get a human looking at this stuff!

That type of thing is maybe acceptable from a lean startup that's learning as it goes, but when you're transacting over a million dollars in trades per day, there's an expectation that you'll figure out what you need to do to get things running smoothly.

This might not be totally fair, but when I saw the .php extension on all the trade API URLs and noticed that there was a dynamically generated price chart on the front page (apparently not cached, based on how long it took to load) I was immediately suspicious of the competence of the Mt. Gox devs to handle the scale of what they'd created (or rather, AFAIK, the scale of the system that they purchased from the original creator)...I'm not really that surprised that security was completely botched, this has seemed like a very amateur operation from the beginning.

</comment></comment></comment></comment></comment></comment><comment><USER9> Does the $1000/day limit apply to withdrawing to the Bitcoin network in addition to the bank options? If not the thief could have just send the 500K BTC to one of his Bitcoin addresses, and laundered the money and traded if for real currency at his leisure. Mt Gox can only roll back trades within their system, not transactions involving the Bitcoin network once they're in the block chain.

<comment><USER7> Good point, it would make much more sense to just run away with the Bitcoins rather than dumping them.

<comment><USER9> Looks like he might have done just that: [http://blockexplorer.com/tx/84f96975ea88d317676771a482c71f39...](http://blockexplorer.com/tx/84f96975ea88d317676771a482c71f39ff53beda790c89c07ae82e427b4d090f)

Impossible to know without confirmation from MtGox though.

</comment></comment></comment><comment><USER10> Mt. Gox are now accepting claims to recover accounts.</comment>


Female Anti-Rape Condom - <AUTHOR> http://www.nydailynews.com/news/world/2010/06/20/2010-06-20_new_female_condom_with_teethlike_hooks_debuts_at_world_cup.html <comment><USER2> I can't see this taking off. But rape in South Africa is very, very bad. It goes hand in hand with AIDS. Anything that would help is worth it.

Many of the people that are infected by AIDS go to their witch doctors to seek a cure. There is a legend, started by the witch doctors, that if you have sex with a virgin, you will be cured. These virgins usually aren't willing, and so are raped. And then the original AIDS infected man is still infected, so figures that the victim mustn't have been a virgin and looks for someone younger. And so the vicious cycle of rape and AIDS continues.

Hopefully these things help some girls. Although instead of catching AIDS, they might just get killed by the rapist instead. It is a horrible, violent world in South Africa (and sadly - one of the most beautiful countries in the world, too).

BTW - My wife is South African and got out almost 15 years ago. She still has extended family there.

</comment><comment><USER3> The version in _Snow Crash_ was better: it delivered a injection of total anesthesia, allowing safe escape for the victim and apprehension of the offender.

This risks getting the victim killed. It also may find its largest audience not among women freely choosing it for self-defense, but traditional fathers in some cultures forcing it on their daughters -- the same men who sometimes 'honor kill' their daughters or nieces who've had premarital sex, whether that sex was consensual or rape.

<comment><USER4> Everything in _Snow Crash_ was better. :)

</comment></comment><comment><USER5> Arming women and teaching them to forcefully defend themselves significantly reduces the incidence of rape.

      Women are often advised to use non-aggressive
      strategies against sexual assault[3]. Research
      suggests that this is a poor advice.According to one
      study, women who used non-forceful verbal
      strategies, e.g, crying or pleading with the assailant
      were raped about 96% of the time[4].

      Forceful verbal resistance, including loud screaming
      was more effective than non-forceful verbal
      resistance. These strategies were associated with
      completion of rape from 44%-50% of the time[5].

      Running works even better than verbal resistance.
      Researches indicate that only 15% of women who
      attempted to flee were raped[6].

      Forceful physical resistance is an extremely
      successful strategy. The completed rape dropped to
      14% when the rapist's attempt was met with violent
      physical force. Striking was more successful than
      pushing or wrestling. Physical resistance also
      appeared to be more effective when assault occured
      outdoor[5].

      Women who used knives or guns in self-defence
      were raped less than 1% of the time. Defensive use
      of edged or projectile weapons reduced the rate of
      injury to statistical insignificance[7].

<http://medind.nic.in/jal/t07/i4/jalt07i4p99.pdf> *

Whether this particular strategy will be effective or not, I don't know. But I can easily imagine the class of rapists who give up when the woman merely yells at them might decide they really don't want to deal with _this_.

Naively, if I wanted to reduce the incidence of rape, I'd make switchblades standard issue for young girls and tell them to seriously attempt to do maximum damage when threatened.

Though it might work differently in South Africa.

*I had read this before, but had to google for the paper. It looks good to me, but I cannot vouch for its reliability.

<comment><USER6> Armed self-defense is a great idea for grown women. I'm not sure about little girls.

<comment><USER5> Children can be taught to handle weapons. In Somalia, boys as young as 9 serve in militias and handle automatic rifles. That's abusive and wrong of course, but they're evidently responsible enough with them to be useful to somebody. And in Switzerland, children routinely take part in shooting competitions at 13.

And of course, kids handle kitchen knives and pocket knives from a very young age. It depends on the household, but six or eight isn't unusual; it can be as young as three in some cultures.

Even in this culture, early elementary school kids are taught serious things like when to dial 911 and when not to. Learning when to use a weapon isn't that much harder.

If rape is a serious problem, arm the dang girls. Or at a minimum teach them to fight and run.

[http://www.stephenhalbrook.com/article- knabbenschiessen/pic1...](http://www.stephenhalbrook.com/article- knabbenschiessen/pic1.jpg)

<comment><USER6> There's a difference between teaching someone to handle a knife or shoot a rifle accurately and teaching someone to kill.

Women and girls are not, by nature, killers. It's not politically correct to say that but it's true.

<comment><USER7> All humans are killers by nature. And at that age girls are taller and stronger than the boys are.

<comment><USER8> The research I've read disagrees with your statement: [http://www.amazon.com/Killing-Psychological-Cost-Learning- So...](http://www.amazon.com/Killing-Psychological-Cost-Learning- Society/dp/0316330116)

</comment></comment></comment></comment></comment></comment><comment><USER9> this looks to me like one of those security things that can only work because it isn't used widely. Won't a carrot defeat this? If adoption becomes widespread, the trick will be known and therefore useless.

<comment><USER4> I'm now imagining a future breed of sophisticated would-be rapists: men who bring roofies with them on a date AND a carrot. Just in case.

<comment><USER10> Didn't know there was slang for that, had to look it up:

<http://en.wikipedia.org/wiki/Date_rape_drug>

"flunitrazepam, also known as Rohypnol or "roofies""

</comment></comment></comment><comment><USER11> Does anyone but me care that you have to get penetrated before the damn thing works?

Gah. Ass-backwards. Even if the condom is effective, technically and in all other ways, you still get raped.

<comment><USER7> You still get raped, but only for a moment, instead of potentially for hours.

<comment><USER10> The psychological trauma will probably still be the same regardless of the actual time.

</comment></comment></comment><comment><USER12> I've been occasionally hearing about the invention (but never use) of this for a while now.

 _"It not only presents the victim with a false sense of security, but psychological trauma," said Victoria Kajja, from the Centers for Disease Control and Prevention in Uganda._

 _But Ehlers said that she had taken the proper research and development steps before launching the product._

 _"I consulted engineers, gynecologists and psychologists to help in the design and make sure it was safe," she said._

Well, yeah, but that's not what that particular criticism was about.

 _Ehlers also pointed out how women take extreme measures such as placing razor blades in their nether regions to prevent rape in South Africa._

...that's pretty bad. I wonder if it actually helps any?

<comment><USER13> In the AIDS capital of the world, using razor blades and causing someone to bleed all over your genitals seems like the exact opposite of what you'd want to do.

<comment><USER14> Could this device also cause bleeding? Or has it been shown to not do so?

Sounds like a valid question the woman using this should no. I could increase the likelihood of infection

</comment></comment></comment><comment><USER15> Earlier and more scary take on the same idea by Swedes - <http://www.femdefence.info/index2.html>

<comment><USER16> That's a statement. Not a product.

</comment></comment><comment><USER17> _Rape-axe is inserted like a tampon and when embedded to a man the device can only be removed by a doctor._

I don't buy this at all. Doctor's aren't going to have some super secret method of Rape-axe removal, they're just going to cut the device off carefully.

<comment><USER18> Cut the end off of it, slit it lengthwise, then pull it off in the same direction as the hooks.

And I have a feeling they are significantly exaggerating the pain level. I wonder if they tested it on an actual person.

</comment></comment><comment><USER19> Vagina dentata, <http://en.wikipedia.org/wiki/Vagina_dentata>, a la Teeth, <http://www.imdb.com/title/tt0780622/>. Enjoy :)

<comment><USER20> Snow Crash, anybody? :)

<http://en.wikipedia.org/wiki/Snow_Crash#Dentata>

</comment></comment><comment><USER21> A woman could hack a vuvuzela instead or blow one (the horn).

</comment><comment><USER22> penis mutilation isnt really the sort of 'hacking' i come to this site to read about

</comment><comment><USER23> From the looks of it, this will shred the inserted penis and likely cause bleeding directly into the body of the victim. As traumatic as rape is, this seems like guaranteed infection, whereas not wearing the device should give the victim at least a few seconds to _attempt_ to fend off the attacker.

<comment><USER7> I don't think you've thought this through very well.

<comment><USER23> I guess so. I must be missing how this thing works.</comment></comment></comment>


Ask HN: What can be done to circumvent the central server? - <AUTHOR> The internet was supposed to be decentralized. But these days this is just not the case anymore.
I just came out of a [very popular video chat software] meeting that started out in [decentralized video software]. [very popular video chat software] offered a superior video quality which I attribute to the possibility to organize datastreams centrally and distribute data from a high bandwidth central instance.
I realize that this is a very general question, but is there anything that can be done about this? <comment><USER2> The Internet is a network of networks. Among those networks there isn't any central network. That is what "decentralized" is supposed to mean. And while some networks are more prominent then the others the Internet _is_ decentralized.

Services that work atop the Internet are what they choose to be. For one centralized services are easier to code and easier to monetize, so not very surprisingly more people choose to build centralized services.</comment>


Ask HN:Review my first App "DAWG" and sign up for beta. - <AUTHOR>

Hi All , It's my first attempt on my own. I left job in last quarter to follow my heart. I slogged hard, kept myself motivated and developed a very simple social reader for android phones and tablets.
1. It aggregates your Facebook, Twitter accounts at one place but keeps feeds from each networks separated. (Unlike existing products in market) 2. Well supported for android tablets. 3. Less number of clicks and uses gestures for quick glance. 3. Seamlessly updates with real time notifications. 4. Allows you to update with your location as well as post photos.
I am launching it early and want to learn more from you people prior to launch in android market. I need your feedback to improve the product and serve better.
You can signup for beta and view screen shots of application at http://zubhalabs.com/ <comment><USER2> I love the fact unlike other social application you are not mixing all it one , it aggregates but still you can enjoy functionality of each one differently in one app. I want hear from someone who tried it on tablet. Because android tablet is new and emerging platform.

<comment><AUTHOR> Thanks, yes Dawg aggregates but does not mix all feeds from different social networks in one. You can slide and view each network seperately. No clicks :).

</comment></comment><comment><AUTHOR> Please click here <http://www.zubhalabs.com> to get beta

<comment><AUTHOR> You can download apk file directly now from <http://cl.ly/42To>

</comment></comment><comment><USER3> Seems interesting, really hot area.

<comment><AUTHOR> Yes, companies like TweetDeck, HootSuite are leading segment but still I feel,there is a space . Any thoughts on it ?</comment></comment>


Accidentally pay an 80BTC transaction fee? Please contact us for a refund - <AUTHOR> https://blog.btc.com/accidentally-pay-an-80btc-transaction-fee-please-contact-us-for-a-refund-b9f8bb4ff65a <comment><USER2> Related true story: I wrote a free e-book about Bitcoin[1], and Bitcoin dev lead Gavin Andresen wanted to send a donation as thanks. He apparently meant to send $10, but sent 10 BTC by accident. (worth $3,000 at the time, now worth $25,000)

He emailed me and my co author asking (very politely!) for us to send it back, which we did (minus some amount to make it come out to the intended donation).

You can see the transactions here: [https://blockchain.info/address/19QsxWwNyeQ9NceaXZFXkHSHbdKC...](https://blockchain.info/address/19QsxWwNyeQ9NceaXZFXkHSHbdKCibjYKR)

(And verify that address matches up with the donation address on the site).

[1] [http://understandingbitcoin.us](http://understandingbitcoin.us)

<comment><USER3> There was a recent thread in r/Bitcoin about someone missing a 200k deposit on Coinbase. With the quote "say what you will about the banks, at least you can get on the phone with them." These super anti banking activists want banks when shit really hits the fan, surprise surprise.

BTC will never be a currency for anything legal. Anyone telling you otherwise is pumping so they can eventually dump. Regulations, inflation, etc these are all features, , not bugs. None of the Bitcoin true believers want to spend theirs which is exactly the problem with deflation.

Maybe it can be a store of value. Maybe. It's primarily a Ponzi scheme and a way to buy drugs.

<comment><USER4> > BTC will never be a currency for anything legal

It is actually already quite common for many legal internet-based services.

<comment><USER5> Such as, for instance, pornography.

Privacy issues aside, many people don't trust porn sites. Bitcoin enables them to pay with absolutely zero chance of them being stuck with a recurring subscription.

</comment></comment></comment></comment><comment><USER6> _the correct fee should have been approximately 2BTC._

At current rates isn't that a $5,000ish transaction fee?

Have I misunderstood something? That seems like a crazy amount, especially given the hype surrounding Bitcoin.

<comment><USER7> I am with you on this one. BTC is supposed to solve the problems current systems have, the key ones being; high tx fees and slow tx.

<comment><USER8> It was never intended to solve that. As described by the bitcoin paper, it solves the problem of decentralized cryptocurrency which is minting and preventing double-spending without a central authority.

<comment><USER9> But 'not having a central authority' is only valuable if the alternative solves the problems that having a central authority causes. The main problems I have heard articulated about a central authority is that they have high costs, are slow, and can block transactions or withold funds with no recourse. Bitcoin doesn't solve the first two issues; does it really solve the third, either? Maybe, but there are also a host of NEW issues that it brings up, too.

<comment><USER10> On the contrary, centrally authorized systems can be extremely fast and cheap. Postgres outperforms any blockchain. The issues are about authority and power, and also the barriers to innovation and access which that power imposes.

Payment channels can solve scaling issues in blockchains just like various settlement layers solve the slowness of bank transfers. Some people don't want such a solution, but it's still a solution.

Development doesn't happen the way we want. Some people want cryptocurrencies to stop existing, which seems unlikely. Bitcoin's development is really thorny because of diverse interests and general incentivized hostility; that's just reality.

Maybe a faster blockchain will gradually take Bitcoin's market share. Maybe Bitcoin will remain quite valuable. If you know a certain answer to this, there are large profit opportunities!

</comment></comment></comment></comment></comment><comment><USER11> This happens when someone manually crafts a transaction.

In Bitcoin, if you have an input of 100 BTC and make a transaction with a single output of 20 BTC, the remaining 80 BTC are kept by the miner. There's no wallet software that would let you do this.

It's like paying a $20 check with a $100 bill and saying "keep the change."

<comment><USER12> More like paying a $20 bill with a $100 note and _not_ saying " _don 't_ keep the change"!

</comment></comment><comment><USER13> No explanation? How is it even possible for something like this to happen?

<comment><USER14> Like a check, you can write whatever value you want in the "Amount" box.

<comment><USER15> Most wallets estimate fees based on transaction size, so this did require a particular wallet or using an "advanced setting"

<comment><USER16> Or a bug. In any case, since this post is from the recipient of the fee, they probably have no way of knowing how it happened. At least, not until and unless the person who paid it comes forward.

</comment></comment></comment></comment><comment><USER17> There is a way to mostly prevent these errors BTW: Change the transaction format so that the sum of input values must equal the sum of output values (edit: including a special fee output which should only be ~8 bytes); this would prevent money from being "lost" as fees. If someone is planning to change the transaction format anyway (ahem) maybe they could also add this safety feature.

<comment><USER18> That would eliminate fees entirely as well, unless you're proposing an additional "fee" output. That would take additional space, which means it won't flow as space is at a premium. I don't know of any wallet software that would let someone do this, so this must have been a manually-created transaction.

<comment><USER17> If only there was some way to increase the space available for transactions!

But your overall point is well taken: Bitcoin is sociopathic software where "sorry for your loss" is considered a feature, not a bug. Nonstandard hand- rolled transaction? Fuck you, you deserve to get robbed.

<comment><USER18> > If only there was some way to increase the space available for transactions!

Hehe.

> But your overall point is well taken: Bitcoin is sociopathic software where > "sorry for your loss" is considered a feature, not a bug. Nonstandard hand- > rolled transaction? Fuck you, you deserve to get robbed.

Well except, in this case, the miner is offering to give the fee back. In general, you're right though. :)

</comment></comment></comment></comment><comment><USER19> Is it possible that this is a scheme designed to draw a specific miner out of his/her anonymity?

<comment><USER14> The bitcoin ledger is public, so the miner fee information for this transaction should be verifiable in private before the spender decides to deanonymize themselves.

</comment></comment><comment><USER20> What's a likely solution here? I'm perplexed on how they can do anything to help this transaction fee, without just giving money away.

Thoughts?

<comment><USER21> They are giving the money away. Roughly $195,000 USD.

<comment><USER22> Is that really worth the good PR for them? It seems almost ridiculous if it was not BTC.com's mistake to begin with.

</comment></comment></comment><comment><USER23> The correct fee should have been 2BTC?

<comment><USER24> I think it's supposed to be approx 10-20 satoshis at the moment.

<comment><USER15> Actually, they're based on tx size. Fees are estimates as satoshis/byte. 10-20 satoshis is incredibly cheap

<comment><USER24> Ah right. Thanks for jogging my memory; been a while since I last researched this for an online debate about bitcoin ^_^

Looks like the top of the txn queue is 330 satoshis per byte, so for an average size txn of 226 bytes, you're paying 75k satoshis, or about 2 bucks! (according to bitcoinfees.21.co)

</comment></comment></comment></comment><comment><USER25> ITT it is revealed I know literally nothing of how BTC operates. What is the best way to remove my ignorance?

<comment><USER26> The best? Write your own blockchain; speaking from experience.

The easiest? Read [https://en.bitcoin.it/wiki/](https://en.bitcoin.it/wiki/).

</comment></comment><comment><USER7> If only there was a technology that can provide low fees and fast tx. *sarcasm

</comment><comment><USER4> How can they help exactly? Who gets these fees?

<comment><USER14> BTC.com got the fee, because they mined the block.</comment></comment>


BNF graphs for Lisp, Java, SQL, and other languages - <AUTHOR> http://cui.unige.ch/db-research/Enseignement/analyseinfo/BNFweb.html Browse and explore some of your favourite programming languages syntactic rules. See relations between the rules, understand them using both BNF (Backus-Naur Form notation) and syntactic diagrams. <comment><USER2> The one for "LISP" is an idealized Lisp that's just a step above the pure, untyped lambda calculus. See Gregory Chaitin's Algorithmic Information Theory for a slightly more detailed implementation of an ancient but pure Lisp.</comment>


Moodstream - streaming images and sounds to boost creativity - <AUTHOR> http://moodstream.gettyimages.com/ <comment><USER2> I use delicious to do something like this, tagging good stuff with "wonder". I often check it out when working out on the treadmill in the morning:

<http://delicious.com/nielsen/wonder>

</comment><comment><USER3> I love the idea, but I'd prefer to be able to use my own images and music. I suppose the hard part is the categorization of the content, but perhaps that could be crowdsourced.

</comment><comment><USER4> Really impressive, love the concept but unsure if that would actually boost my productivity.</comment>


Transforming our Futures – Energy storage - <AUTHOR> https://www.youtube.com/playlist?list=PLg7f-TkW11iXxtb146enrWRdNcfi1pprU <comment><AUTHOR> The Royal Society has a series of talks about Energy and the Grid several weeks ago.

I'm subscribed to the YouTube channel, it seems they published this quietly.

I'll have to comb through their back catalogue of conferences to see what else I've missed.</comment>


Show HN: Every haiku that happened on Reddit comments since December 2005 - <AUTHOR> http://haiku.somebullshit.net <comment><USER2> This might be my favourite "silly nerdy bollocks"-type HN post that I've ever seen, what a great idea.</comment>


How to Measure CO2 with a Low-Cost Sensor and a Raspberry Pi - <AUTHOR> https://joshefin.xyz/measure-co2-with-senseair-s8-raspberry-pi-java/ <comment><USER2> You are not going to get an accurate CO2 sensor for $27. You're being misled into buying cheap Chinese crap.

An accurate CO2 sensor is much more expensive. I would not trust the readings of the sensor in this blog. It's going to be off by over 100ppm, especially if there's a lack of good airflow.

[https://www.atlas-scientific.com/product_pages/probes/ezo- co...](https://www.atlas-scientific.com/product_pages/probes/ezo-co2.html)

<comment><AUTHOR> Senseair is a Swedish company and definitely not "cheap Chinese crap". Do you know about any research that confirms your statements about the accuracy?

I believe that some of the more expensive sensors are more accurate, but this cheap one may be a good enough solution in some cases (e.g. indoor air monitoring for DIY projects).

<comment><USER2> The research has been done by the weed growing community. I don't know any professional growers using sensors outside of the American Scientific as the cheap ones are inaccurate and failure prone.</comment></comment></comment>


The most important lesson that the success of JavaScript has taught us - <AUTHOR> https://dev.to/remojansen/the-most-important-lesson-that-the-success-of-javascript-has-taught-us-4ike <comment><USER2> JavaScript is successful for several reasons:

* It compiles on the fly (and extremely quickly at that)

* It runs almost everywhere and JavaScript interpreters (plural) are on almost every modern computer

* It is multi-paradigm. This means the language can be structured in a OOP way somewhat like a Java program, or (thank god) you can avoid all of that nonsense.

* The language is extremely forgiving, which makes it extremely sloppy but very cozy for amateur programmers

* The most important part (and least understood) is that it features concepts that make programming fun: functions as first-class citizens and native lexical scope (without some conventional bullshit like a lambda expression)</comment>


Ask HN: Best way to display MP4 video on LCD without laptop? - <AUTHOR>

Looking for the best solution to present a video in MP4 format on an LCD TV without a computer or access to the internet. Was originally considering a Roku XDS with a USB drive, but it appears to require internet connectivity even if you aren't using internet content. Looking for something super small and portable, as it will become part of a trade show package. <comment><USER2> There are cheap media players that you can use to plug in a flash drive. Here are some examples from DealExtreme, but I'm sure you can find similar stuff on eBay or even maybe Amazon. Some will even play HD over HDMI, they say.

[http://www.dealextreme.com/p/umini-1080p-media-player- with-s...](http://www.dealextreme.com/p/umini-1080p-media-player-with-sd-usb- host-hdmi-av-coaxial-spdif-41222) [http://www.dealextreme.com/p/mini-rm-rmvb- mpeg4-media-player...](http://www.dealextreme.com/p/mini-rm-rmvb-mpeg4-media- player-with-sd-mms-usb-host-ypbpr-36226)

</comment><comment><USER3> Popcorn Hour A210 (or C200 if you don't mind it being a bit bigger). Plays virtually everything, has USB input, you can stick a hard drive (SSD or SATA) in it, works over the network with just about anything. [http://www.popcornhour.com/onlinestore/index.php?pluginoptio...](http://www.popcornhour.com/onlinestore/index.php?pluginoption=catalog&mainItemId=20)

</comment><comment><USER4> [http://www.amazon.co.uk/Apple-Digital-AV-Adapter- connector/d...](http://www.amazon.co.uk/Apple-Digital-AV-Adapter- connector/dp/B004QK5N5W/) iOS device required.

Superuser?</comment>


Ask Dustin Curtis (UX Designer) anything about your web site - <AUTHOR> http://officehours.tv/senseis/dustin-curtis

<comment><USER2> I love this concept. Smart guys offering up advice to fledgling companies and entrepreneurs looking to do something great. $10 for 10 minutes is a steal for such an opportunity, especially because you could prepare a few questions well in advance.

</comment><comment><USER3> What does he charge to just shut up already?

<comment><USER4> While I think the tone of your comment is unnecessary and nonconstructive, I do think it's a curious choice.

Co-founder of Foursquare.

Co-founder of Grooveshark.

Co-founder of Reddit.

And a semi-famous UX person.

I mean, I could understand if he were the lead designer on a successful startup, been a major influencer to the industry or founded something amazing as a designer.

<comment><USER5> > Co-founder of Reddit.

Wait, what?

<comment><USER6> That's a list of all the people who are on officehours.tv (<http://officehours.tv/faqs>), not Dustin's CV.

</comment></comment></comment></comment><comment><USER7> What an awesome idea and opportunity. I just set my calendar reminders to come back and bid. I need some DCurtis UI time!

</comment><comment><USER8> While I really like the idea, I have a hard time supporting something that Dustin Curtis has a hand in, in any capacity. He's a bit smug/arrogant for my taste.

</comment><comment><USER7> Does anyone know who is behind this?

<comment><USER9> From the FAQ:

Who's behind OfficeHours.TV and how did you get the Senseis?

There is currently only one founder for OfficeHours.TV, Jared Tame. Most of the Senseis have agreed to host office hours after Jared wrote a book called Startups Open Sourced and interviewed many of them. You can watch an interview about the book with Jared on The Startup Foundry

<comment><USER7> Thanks.</comment></comment></comment>