Moonpig.com Vulnerability – Exposes customer data - <AUTHOR> http://www.ifc0nfig.com/moonpig-vulnerability/

<comment><USER2> I've seen dumber. In my second real job, I was a book editor, but I noticed our web master literally had a file called accounts.js which held a static array of usernames, passwords, and billing information for all of our customers. I told him this was terrible security, and he said, literally, "You'd have to view source to even know passwords.js exists, and our source is pretty hard to read. I'm not worried."

I took all the info to our CEO and got him demoted to server maintenance guy, on the spot, and I took over his job.

He later gloated that my store was much slower than his, since he downloaded our entire database as JS flat files and did absolutely everything client-side except payment processing and order fulfillment. I pointed out that my store didn't require 10 megabytes of download for the first page view, plus I had industry-standard security.

He was in even more trouble a couple of weeks after that, because some russian hackers pwned our server so bad that we had to drive to the colo and replace it with a new piece of hardware. I've got a dozen stories about this guy, he's a hoot.

Okay, last story, I promise; he's allergic to electronics power supplies, so he was the only employee who got to work from home (where he kept his CPU in a separate room from his keyboard and monitor).

<comment><USER3> "I took all the info to our CEO and got him demoted to server maintenance guy, on the spot, and I took over his job"

WOW. You are a terrible human being.

<comment><USER4> > WOW. You are a terrible human being.

Yes, heaven forbid someone qualified run their IT dept. What's he supposed to do? Sit around, idly hoping that someone else notices the incompetence?

I think OP made the right move. To me it sounds like the guy should have been fired rather than demoted.

<comment><USER3> really David ? Come on. How many times you made mistake ? Were you demoted and/or fired for mistake ? Now, let's not argue that you or all of us has not fucked up. In my 7 yrs. as engineer I have seen worse. However, that's not excuse to run to boss/CEO to demote someone and take over their job. Think about their family,kids before you do such act.

If you defend such behavior for taking over job/demotion I seriously think there lies greater problem in tech community.

Edit: HN is getting fucked up day by day. Any simple disagreement is greeted with downvotes. Carry on.

<comment><USER5> "you are a terrible human being" is not really a simple disagreement.

"That seems like a rude thing to do" would be.

What you said was a personal attack, and a quite rude one at that.

<comment><USER6> > What you said was a personal attack, and a quite rude one at that.

That's correct, and no doubt the reason for the downvotes.

<comment><USER7> The downvotes here have grown way out of control. Simple disagreement with the majority opinion results in massive downvoting.

I've even seen numerous posts that contain nothing but factual information that displeases the audience here be voted down into the gray. The post can be in the flattest, most neutral tone possible, and if it's not what people want to hear, down it goes.

It's discouraging, and it's to a point where I no longer feel a desire to participate in this community. Frankly, I'm finding a number of subreddits to be more inviting and more interesting these days.

I don't really see what can be done about it, if you even agree it's an issue, but I did want to make a point of letting you know about a problem I've seen grow worse over recent months.

<comment><USER8> Do you have links to examples?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I am a former customer of theirs (in the UK) and just contacted CS about this. I'm also looking into contacting the Information Commissioner's Office as this issue is still open and my personal information (and that of the people I send cards to) is still available to anyone who may want it.

I'm pretty sure them ignoring this for a year is illegal as it involves personal information which their privacy policy didn't authorise them to publish. However I'll leave it to the ICO to make that determination.

<comment><USER10> My guess is that the ICO wont fine them very much as it did not include full credit card numbers. However they might up it for failings in process, lots of remedial measures etc.

They might not even have PCI compliance issues alas.

The management will argue that they knew nothing, although that is becoming less of a defence now.

<comment><USER11> Doesn't matter, if they're a UK based company they fall under the EU GDPR and can receive a fine of 5% of their worldwide turnover for any loss of personal data, blanked out credit card numbers or not.

[http://en.wikipedia.org/wiki/General_Data_Protection_Regulat...](http://en.wikipedia.org/wiki/General_Data_Protection_Regulation#Summary)

<comment><USER12> There are more egregious examples of data protection violation here, and the fines look pretty small:

[https://ico.org.uk/action-weve-taken/enforcement/](https://ico.org.uk/action- weve-taken/enforcement/)

</comment></comment></comment></comment><comment><USER13> [http://www.conosco.com/case-studies/moonpig-outsourced- it/](http://www.conosco.com/case-studies/moonpig-outsourced-it/)

>Protection against cyber attacks

Wow...

<comment><USER14> They've already removed it...

<comment><USER15> Google cached version: [http://webcache.googleusercontent.com/search?q=cache:gkzZ7YK...](http://webcache.googleusercontent.com/search?q=cache:gkzZ7YKoCQYJ:www.conosco.com/case- studies/moonpig-outsourced-it/+&cd=1&hl=en&ct=clnk&gl=uk&client=safari)

</comment></comment></comment><comment><USER16> To anyone thinking of enumerating the customer IDs to play with this, be very careful as it's illegal in the USA. That is exactly what weev was arrested and convicted for.

<comment><USER17> > That is exactly what weev was arrested and convicted for.

Please don't spread this misinformation, the USA justice system doesn't work (... like that). Weev was arrested for having a (very, _very_ ) loud mouth and pissing off the wrong, powerful people/businesses/corporations.

If he'd have enumerated customer IDs for a smaller, lesser-known company such as Moonpig, reported it to the media like he did, without being all inflammatory and trollish[0] about it (or without having a history of allegedly doing such things in very different contexts), he'd have gotten a slap on the wrist, a fine, or something (if anything), but not been thrown into prison as he was.

Your post makes it seem like Weev was convicted "for" doing something that is illegal in the USA and that the justice system worked "exactly" how it is supposed to, equally as it would apply to anyone.

[0] stating this as a fact of how it happened, not judging him about this, at all

<comment><USER16> There is more context to his arrest but the actions and evidence supporting his conviction were as I described.

</comment></comment></comment><comment><USER18> Apparently they hired these guys to help with "protection against cyber attacks"

[http://www.conosco.com/case-studies/moonpig-outsourced- it/](http://www.conosco.com/case-studies/moonpig-outsourced-it/)

Awful...

<comment><USER19> It's worth pointing out that the case study is from 2007, there's a good chance that this company is no longer involved and likely wasn't involved in building the API for apps and the security on them.

<comment><USER20> In any case, once this is out, they will have to take the Moonpig case study from their site.

<comment><USER21> Yup that link is now 404

</comment></comment></comment></comment><comment><USER22> Surely this is bad enough to warrant criminal prosecution? Not sure if that's even possible in the UK but it ought to be...Shameful to have sat on that for over a year. Shameful.

<comment><USER23> If this were the USA it would certainly be bad enough to warrant prosecution of the researcher. I am not familiar with laws in the UK, however. Keep in mind the similarities between this research and weev's research.

This type of blatant insecurity definitely should be punished and I wish more policy makers both cared, and made the effort to understand the terminology behind phrases like "No authentication", "Plaintext", Etc.

<comment><USER24> First of all, the company could definitely be sued for negligence in the US. Not sure if they could in the UK.

Second, there are not that many similarities between this research and weev's research. In this case, the researcher created 2 accounts which he had control over, then read data from both of the accounts despite not authenticating to either of them. He did not access any other customer's information (or at least he's suggesting he didn't).

Weev on the other hand scraped private information for over 100,000 customers and shared it with friends and reporters.

Both technically violated the CFAA, but weev's offense is a much greater violation of customer privacy, while this researcher has not violated anyone's privacy.

I still don't think weev should have gotten any jail time, but you're making an unfair comparison.

<comment><USER25> Personally (and I know this is likely to be an unpopular sentiment on HN) I have very little sympathy for weev.

He knowingly and deliberately attack a weakness he had found to scrape data, knowing that the access was unauthorized. I disagree that the data was in the public domain (although the Third Circuit disagrees) - just because something is accessible to the public doesn't mean it's in the public domain.

Just because he wrote it up as a security researcher doesn't mean he should be immune for his actions - in fact in some ways it makes it worse because he did it knowing that he was unauthorized.

He exposed the vulnerability to the press (so he didn't act in good faith regarding the disclosue) and he did so potentially for monetary gain (he claimed to be a member of a hacker group called "the organization," making $10 million annually).

I think one part of improving cyber security is prosecuting people who deliberately and maliciously hack into other systems who do so for either monetary gain or fame. I think this is especially the case whereby they don't act in good faith (e.g. providing proper disclosure).

<comment><USER26> I agree, and feel that the EFF made quite the strategic error in supporting Auernheimer's appeal.

<comment><USER27> " _The trouble with fighting for human freedom is that one spends most of one's time defending scoundrels. For it is against scoundrels that oppressive laws are first aimed, and oppression must be stopped at the beginning if it is to be stopped at all._ "

— H. L. Mencken

<comment><USER28> _> "For it is against scoundrels that oppressive laws are first aimed..."_

[Citation Needed]

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Disgusting - this should be priority one for them to fix.

I just changed all my details to ones from a fake name/address generator, then emailed moonpig to close my account. I will lose about 80 pence, but nevermind.

I didn't see an option to get rid of my credit card details, so that may still be vulnerable, especially with the NameOnCard field in the api.

<comment><USER29> I know my mum has a Moonpig account so I'm pissed about this, but I don't recall if I have an account.

Recently, I have mostly been using CFHDocmail. It's 96p for a full colour A5 greeting card of your own design.

(It's also cheaper to use them to send letters than it is for me to buy a stamp. They also do postcards, going as low as 38p delivered. Lots of mailmerge and API stuff available too iirc, but I've never used any of it.)

Edit: They may use windowed envelopes for the cards, when I tested they didn't, but now I've been told they do. I've not sent one to myself since my original testing, and none of the recent recipients have said either way. I'll make a quick one and sent it to myself!

</comment></comment><comment><USER30> Wow. This is actually still wide open. This is really bad.

Fun fact - you don't even have to send the basic aut header - it'll respond just fine without it.

</comment><comment><USER31> I'm sure the (outsourced) dev team will have a bad day tomorrow. This is just unacceptable. According to the blog post he first made contact in 2013! Bugs happen, but this is just bad design.

</comment><comment><USER32> My comment from the other thread:

They also make it very difficult to delete your account. Rather than just have a link on the site, you have to contact customer services and they say they'll respond in 24-48 hours.

Not to mention the ways they try to hide you removing your card details. If you want to remove your card details, do the following:

 _The easiest way to do this would be to go to the My Account page then click on the 'Add Moonpig Prepay Credit' link, click on the Buy link and your saved card details will be shown onscreen. Click on the 'Remove Card' option._

</comment><comment><USER33> Looks like the API is no longer accessible from here. Seems like they have pulled it down.

<comment><USER34> In the circumstances that might be a generous explanation for their ID enumerable non rate limited API going down.

</comment></comment><comment><USER35> In the address example you can even emit the arguments and it just returns you a large list of addresses. Would expect this to be hitting the news here in the UK tomorrow!

Judging by their parent companies website they seem to be PCI certified ([http://careers.photobox.co.uk/security-officer- moonpig/](http://careers.photobox.co.uk/security-officer-moonpig/)) which is likely to be removed from them after this, also given the private information on show I would expect this breach of the data protection act to be meaning a large fine for them.

For anyone at risk from this you can't just cancel your account, but you can manually go through and delete quite a bit of data such as address books and they then disappear from the API calls.

<comment><USER36> Been a while since I read PCI DSS but if the PAN isn't there, does it specify you have to protect that information? Also, if they don't actually have the PAN touch their servers (like, using a BrainTree or Stripe-like solution), PCI compliance is quite minimal. Even PCI DSS 3.0 is trivial to deal with using Stripe (they just insert an iframe so the CC info goes directly to their site).

Of course, yeah, they don't deserve the benefit of the doubt here. Given such a terrible API they probably are a mess inside, too.

<comment><USER35> Reading that job spec I assumed they handle all the PCI side of things themselves, if using stripe etc I doubt you'd need such an involved role.

Given the mess it looks like on the front, I would bet PAN's are stored in clear text too!

</comment></comment></comment><comment><USER37> They have 3 other brands: [http://photobox.co.uk](http://photobox.co.uk) [http://uk.paper-shaker.com](http://uk.paper-shaker.com) [https://sticky9.com](https://sticky9.com)

Only the later seems to enforce SSL. I registered a dummy account on photobox, username/password/email, via their form which was not using ssl.

<comment><USER38> Photobox acquired Moonpig in 2011 [1]. In 2010, Photobox got called out for emailing passwords in plaintext[2], and were quick to take to twitter to say "It will never happen again."[3] At that point, it had only been happening for 4 years [4].

Coupled with the tone of the job advert already posted by others [5], it doesn't seem too hard to imagine a corporate culture where security is not a serious concern until things go wrong.

[1] [http://www.bbc.co.uk/news/business-14275632](http://www.bbc.co.uk/news/business-14275632)

[2] [http://www.pcpro.co.uk/news/security/360163/photobox- sorry-a...](http://www.pcpro.co.uk/news/security/360163/photobox-sorry-after- email-screw-up)

[3] [https://twitter.com/PhotoBox/status/20719242964](https://twitter.com/PhotoBox/status/20719242964)

[4] [http://blog.dave.org.uk/2006/06/more- password-s.html](http://blog.dave.org.uk/2006/06/more-password-s.html)

[5] [http://careers.photobox.co.uk/security-officer- moonpig/](http://careers.photobox.co.uk/security-officer-moonpig/)

[edited for clarity]

<comment><USER39> The number of companies that send (and possibly store) plain text passwords is scary. I keep reporting them to [http://plaintextoffenders.com/](http://plaintextoffenders.com/)

<comment><USER38> I was about to ask why anyone would bother sending plain text passwords and store them encrypted. I then remembered a high-school friend's first (and largely unsupervised) job where IIRC he devised a ridiculous password encryption (not hashing) scheme in PHP (on shared hosting).

Unrelated horror unfolded a couple of years later when for some peculiar reason he had to move the site to a godaddy VPS. An unencrypted customer database sitting at /db.sql, fully accessible to the world. Apache had been configured to show directory indexes and, to take the site offline, /index.php had been removed. I think at the time I even needed to explain the possible consequences. I just remember being told that the database was restoring and it wouldn't take too much longer!

I think any remaining part of me that implicitly trusted interesting websites with personal data died that day.

</comment></comment></comment></comment><comment><USER40> It's astonishing that somewhere out in the modern world there's an api that returns personally identifiable information without requiring any sort of authentication.

What I find absurd is that the company hasn't done anything about it. Even if they don't care/know about security they must at least care for bad PR...

But with all of that in mind, I don't know what's the best way to fight these clueless behemoths. You disclose and thousands or even millions of people will be compromised. You don't and those same people could be compromised but no one will know because the attacker(s) will just continue to siphon information quietly.

They should be waterboarded for making a responsible individual have to choose.

For the record, I approve of this disclosure. Better to know the evil than let it go on unnoticed.

<comment><USER17> > They should be waterboarded

Except, you know, for the part where that is an inhumane thing to do, even when done to people that are actually guilty of committing terrible crimes.

> It's astonishing that somewhere out in the modern world there's an api that > returns personally identifiable information without requiring any sort of > authentication.

Hello, have you met the 21st century? It's a freakshow and clusterfuck of planetary proportions. Although even accepting that fact, yes, I suppose that doesn't make it less astonishing. Spoiler alert: things will probably get even more astonishing before it gets less. Fasten your seatbelts, wear a hat, etc.

</comment></comment><comment><USER41> On top of this clusterfuck, I find it galling that I can't just close my account and have all my details removed. Oh, no you need to fill in a contact form.

</comment><comment><USER42> Lots of users on Twitter saying to delete your account, but is there any proof that this will exclude your account from the API?

<comment><USER43> It would probably be more effective to update your account with nonsense details.

</comment></comment><comment><USER44> This is irresponsible disclosure. You should have contacted the information commissioners office. They would have used legal powers to force Moonpig to rectify this. There are very steep penalties for not protecting customer data.

Now that you've publicly disclosed this, opportunists (people one level above script kiddies) will probably grab a data dump and compromise every customer.

Dealing with this via legal channels would have ensured a resolution whilst protecting customer data from any opportunistic bad actor.

Shame on you. I can't wait for myself and my wife to get doxxed now. Thanks.

Also, FYI; the whole card number isn't returned because they are probably tokenising the full card number with their payment gateway.... Or at least, I hope.

DOWNVOTING because you don't agree with me? How rude. I believe I'm a making a valid point, there are legal channels in place to help with this sort of thing.

EDIT. someone people think I do no hold moonpig responsible for this. I do! I am not blaming the security researcher. What I am saying is that some countries (like the one where moonpig is incorporated and operates) have agencies that deal with issues like these. Getting these agencies involved before public disclosure is a much nicer way to deal with these sorts of issues.

I'm aware that this exploit may already have been used but that doesn't mean that we should tell everyone about it until it is resolved. Getting the ICO involved may have resolved this issue a long time ago.

My disclosure - I have a friend that works at the ICO and she tells me that these issues usually take them (on average) 2 months to sort out. COmpanies get very anxious when the ICO contact them.

<comment><USER45> You're getting mad at the wrong person here, full stop. This is gross, inexcusable negligence and incompetence. I'm surprised this guy didn't wait more than a few months, given the severity of this problem.

> whilst protecting customer data from any opportunistic bad actor

Riiiight. Do you honestly think something this basic wouldn't be discovered by criminals soon, if not already?

<comment><USER44> > You're getting mad at the wrong person here, full stop.

No I'm not. I;m not angry. I realise this is the fault of Moonpig

>This is gross, inexcusable negligence and incompetence. I'm surprised this guy didn't wait more than a few months, given the severity of this problem.

I agree

>Riiiight. Do you honestly think something this basic wouldn't be discovered by criminals soon, if not already?

We don't know if anyone has already used this. We don't know if anyone ever knew about his. But now we know everyone knows about it. To be honest, I would not be surprised if someone may have already used this for nefarious purposes but at this point in time there doesn't seem to be a public dump of data for low skilled hackers to continue using for years to come.

I still think this should not have been publicly disclosed in this manner. He did not contact the ICO and he left this exploit open for a year because he didn't know the mature way to handle this.

<comment><USER46> You do know that this is the first time a lot of people that do not live in the UK are hearing of the ICO</comment></comment></comment></comment>


Ask HN: How to start coding my product? - <AUTHOR> I'm currently employed and working as a Ruby on Rails programmer for 3 years now, and I have decided that I want to start coding my product that I have been planning ever since I got interested with web applications, but when it comes to making it happen, I just can't do anything, I can't start working on it, I can't begin coding... I just lost enthusiasm on my own thing. But when my employers ask me to create a web app (website, ecommerce, internal apps, consulting apps), I responded enthusiastically and delivered it right on time (and beyond their expectations).
What's wrong with me?, I have everything already set, I bought my domain, I bought a VPS, S3, and has the technical skills to make it happen, but and I just can't find any interest on doing things for my own's sake, it's easier for me when my boss says "hey do this", but when I comes to myself to do something for myself I failed miserably. The last time I visit my VPS is back on September 2010, and I haven't touched it eversince...
Can someone give me an advice? <comment><USER2> Here's my take from having gone through a similar problem, it may or may not be relevant to you.

A few years ago I had a great idea for a product and would pitch it to whoever would listen. I had the domain, had a plan, just had to execute. I'd barely gotten started when I ran into a wall, instead of working I would just stare blankly at my computer. I had zero motivation to do any actual work.

And yet, I was still passionate and believed in the idea, which led me to a similar place as you where I'm wondering "what gives?"

This situation showed me that I had an internal problem, that while I could function in environments with external motivational factors, if I removed them, I had nothing. Something inside was holding me back.

It was only through a combination of months of therapy and soul searching that I was able to find the source of my motivational short-circuit, I had given up on the first thing I ever truly wanted without even trying to achieve it. After that epiphany, motivation has been the least of my concerns. Heck, I'm working on my plans for world domination at this very moment.

So here's my advice, take the time to debug your brain, it won't be easy, but it beats having that error message pop up for the rest of your life.

<comment><USER3> This.

Fear is a multi-faceted and very powerful, yet often times extremely irrational, emotion that can destroy you even before you get started. A few people here have brought up Seth Godin's Lizard Brain concept, but what's missing from it is a deeper dive into fear being a huge blocker to accomplishing something. "Just ship it", or "ship early and ship often" are techniques that are of great help but they're farther down the pipeline than getting started.

Of immediate and initial importance is needing to understand why you are getting in your own way - what is the cause of the fear that is preventing you from executing your idea? Is it a fear of failure, of success, of being judged once you finish, of making mistakes, of having too much responsibility, of making the wrong decision along the way? It's not a question that you can answer immediately, and unwrapping fear can sometimes lead you down a path where the only thing you have feared is more fear (sounds like a very familiar quote, eh?).

When it's someone elses idea that you're working on and you're not the one in charge it's much easier to meet and often exceed expectations b/c many of those fears aren't possible outcomes (to the trully paranoid mind they might be, but since you can accomplish tasks at work you don't fit the bill for this).

It's not easy to understand the 'why' of our psychopathologies. Everybody has their own that they struggle with. Some people create coping mechanisms and live within the pathologies, and some people overcome their pathologies through a combination of technique / drugs.

Two books that I found of personal help on first helping me understand the 'why' of my personal struggles and then provided helpful techniques to break through them are:

"Do It!" by Peter McWilliams <http://www.amazon.com/Lets-Get-Off-Our- Buts/dp/093158079X> (there's a free version @ mcwilliams.com but the website seems to be down)

"The Procrastinator's Handbook" by Rita Emmett [http://www.amazon.com/Procrastinators-Handbook-Mastering- Art...](http://www.amazon.com/Procrastinators-Handbook-Mastering-Art- Doing/dp/0802775985)

</comment></comment><comment><USER4> _> I have everything already set, I bought my domain, I bought a VPS, S3_

This is your problem. By taking these preliminary, preparatory steps, you are satiating your brain's motivational desire for action without taking any actual constructive steps. Thus you do not have the will or urge left to write the code.

Stuff like buying a VPS or setting up S3 is easy and quick, therefore your reptile brain makes it easy for you to do such things first, as it prefers instant gratification. This unfortunately depletes the motivational neurotransmitters that signal you to take action, because as far as your brain is concerned, action has been taken.

The answer is to do that stuff _last._ Or, in a business setting, get someone else to be responsible for it.

This is an extension of some ideas from the great Derek Silvers, which he relates in this TED talk, which you should definitely watch: [http://www.ted.com/talks/derek_sivers_keep_your_goals_to_you...](http://www.ted.com/talks/derek_sivers_keep_your_goals_to_yourself.html)

<comment><USER3> Ian Ayre (and others) have challenged the study that Derek Sivers based his 'keep your goals to yourself' talk on - [http://freakonomics.blogs.nytimes.com/2010/10/28/are- public-...](http://freakonomics.blogs.nytimes.com/2010/10/28/are-public- commitments-counterproductive/)

I think the OPs problem is primarily about fear [<http://news.ycombinator.com/item?id=2185833>], not instant gratification. It's necessary when building a website to get a VPS and S3 account (or equivalent) to host the site/files on. I completely understand what you're getting at by suggesting that putting easy things ahead of hard things gives a false sense of accomplishment, and I tend to agree. I just think there's something different at play here for the OP to focus on.

On a related note, I know that Derek frequents this board often and I've had the pleasure of learning from some of his insights along the way. I'd love to hear his reaction to the above article or a link to such a post from the HN crowd.

<comment><USER4> Very true.

An important idea, not often acknowledged, is the _fear of success_ rather than the fear of failure. "Oh God, how long before they figure out I'm faking it?"

See the following article: [http://thelastpsychiatrist.com/2010/08/the_worst_thing_that_...](http://thelastpsychiatrist.com/2010/08/the_worst_thing_that_can_happe.html)

 _Note: while I am linking this article for its ideas, this is IN NO WAY an endorsement of the author's somewhat antagonistic and disjointed writing style. Please persevere with it._

</comment></comment></comment><comment><USER5> Cut back scope, pick something you can deliver in your typical attention span, then _sit down and do it_. If you have one little feature that makes lives better enough to pay, then just a wee bit more work adds the ability to charge for it. Just a wee bit more work gets you the first cut of a marketing site. ... _repeats ad nauseum_

<comment><USER6> What helps me with this approach is to pick a small module, and then start writing a README for it as if the module already existed.

By pretending that the module is already done you get to use it before it exists (which is a lot of fun :). In the README, write your instructions in such a way that they are testable (python doctests make this easy, I assume you can do something similar with ruby).

When you're done, it is much easier to start on the actual module itself because you've already figured out how that module interacts with the rest of the system, and you have a set of tests to verify it.

</comment></comment><comment><USER7> I suspect the stakes are too high for you with this personal project. You've been planning it for so long, you imagine it will revolutionize the industry and make you a billionaire. And sitting down to start coding makes it feel like, well, just another web app. So any small steps toward your goal feel, paradoxically, as though they're destroying that goal.

All you can do in that situation is step back and remind yourself that this project probably won't change the world but might be fun to make. Consciously work on replacing the grandiose fantasy with a more realistic one: Imagine yourself ... coding a neat little Rails app in your free time! Staying up late to fix an annoying bug, and then feeling satisfied when you've fixed it! Not being a billionaire but being a guy who made a cool little web app!

And then sit down and start coding, even if you're not really in the mood.

</comment><comment><USER8> You're letting the lack of requirements blind you. Depending on who you are, there's 2 ways to fix it:

1) Write some requirements! Clarify in your mind where the project is heading both in the short-term and the long-term. Agile-style user stories is one way to do both of those.

2) Start with the basics. Get the Rails framework set up. Get the DB set up. Start writing the schema. Etc. Once you've got the basics of every app (mvc, authentication, ACL, etc) then move on to what makes your app unique. Start with things that will provide benefit for you or your customers.

</comment><comment><USER9> Hire me as your boss. We write a contract. The contract stipulates that you have complete ownership of the idea, I get profit sharing for payment, but if you don't execute at a reasonable time pre-negotiated then I can throw the idea out there to have someone else get this project coded--with you still retaining complete intellectual ownership of the idea but they are added to the profit sharing pie.

=)

Logically your reaction will be heck no because you can do it yourself and keep all the money to yourself, but you have just then created a paradox because this is exactly what makes you execute and seems to be what is preventing you.

That was all in hypothetical fun of course but I think would work in practice. Sometimes people don't need to find or "hire" co-founders, rather a "boss". But to overcome your biggest challenge, which is yourself, @JonnieCache and others here definitely know what they are talking about.

</comment><comment><USER10> I think all entrepreneurs and engineers go through this kind of phase at some point in their life.

The best solution I've found is get yourself a partner, someone that can keep you accountable and motivated.

Remember not to take your code too personally, most of it will inevitably need to be rewritten again anyways - it does not have to be perfect in the beginning.

If there are certain aspects of the project that are frightening to you and stopping you from starting (UI, DB design etc), then bite the bullet and outsource those parts... makes things much easier.

If you have the funds available, consider outsourcing the entire project - this will leave you with time to get the business end sorted.

Best of luck!

Sean

</comment><comment><USER11> Your subconscious is telling you that it thinks there is a problem and you shouldn't spend time working on a project that it feels is going to fail if you continue down your current path. Spend a few days listening to what your subconscious is trying to tell you, and refute in writing all the negative things it's telling you. If you can refute everything convincingly, then your mental motivational block will resolve itself. Don't be afraid to free- associate until you get to the root of the problem. Don't worry about spending too much time overcoming this roadblock, because 1) your subconscious is telling you there is a real problem, and 2) many times it's right. Brainstorm solutions until you get your solution. I've sometimes spent many days mulling over problems until I come up with a solution, but once I do my motivation comes right back and I can't wait to get back to the project. Everybody occasionally runs into these mental blocks; it's nothing to be concerned with if you decide to systemically attack it by letting your subconscious feed you solutions until you find one that works. Just don't write it off to "lack of motivation"; there's something your subconscious is trying to tell you. Address it and your motivation will come back.

</comment><comment><USER12> Fear of failure? If you never finish the project, you can always think / say what it could be. If you actually make it, then you have a chance to fail.

I'd say write 1 of the many features your trying to work on. It could be because you're overwhelmed with the whole project.

Also, it seems like you have a "sheep" mentality rather than a "wolf" mentality (when your employers asked you to make an app but wont make one for yourself). If you can recognize it, you can most likely change it.

</comment><comment><USER13> Accountability - find a buddy (or anybody) that is remotely interested in what you are doing. Your boss (and even other people you interact with) probably asked you when it's going to be done and you are eager to "please". You may be one of those people that feel that if nobody else cares about your project, why should you. So find a person to work with on this project ... maybe a future client or user with the problem you are trying to solve.

</comment><comment><USER14> I have been in a similar position as, like you, I find it easier to do stuff when someone else is expecting me to do it. In the absence of a co-founder, one of my strategies has been to create that sense of expectation by outsourcing parts of the work which then requires work from me to provide the outsourced person with what they need to do their bit.

On one recent project, I got going by knocking out a rough plan in Pivotal Tracker and then doing some pair programming on some portions of the code with someone I hired on oDesk. Having booked someone for a couple of hours a day for a week or two meant that I got started, and by using them only for small portions of the functionality meant that it didn't cost too much and I was motivated to get the other bits done myself that were dependencies for the next bit of functionality I was going to be working on with my pair programmer.

</comment><comment><USER15> Just revise your thoughts. You're not doing it 'for yourself' but you're doing it for a future audience, for future customers. The reason why you work so well for your boss is probably because you like to impress him. But it's difficult to impress yourself. When you think about your product, think about what positive reaction you'll get from your future customers.

Also, this mode of seeing things will help you to deliver a better software experience to your end-users as you will always remind yourself that going for quick and dirty solutions (during development) might work if you use it, but not if others use it.

Also, in order to gain additional enthusiasm, you should find a good friend with whom you can talk about your project, and brag from time to time. Then you feel obliged to continue working on it because you don't want him to believe that you've failed on it.

</comment><comment><USER16> I've found that this sometimes happens because I have serious second thoughts about some aspect of the project (maybe I don't know how it could ever make money, or it seems like it would be difficult to acquire users).

The most effective thing seems to be getting someone else involved. That way, you are committing not to yourself, but to another person as well. If that person is a coder, then you don't have to do all the programming work yourself. If not, maybe they can help you to get around some of the shortcomings in your own skillset.

Some people just don't work well alone (I'm one of them). It's not that I can't do all of the work myself (I can), but just that I don't enjoy it. I've learned to accept that, and then to get around it by bringing others into my projects at an early phase.

</comment><comment><USER17> Is the lizzard brain that is fighting back, is trying to protect you from failure see this <http://vimeo.com/5895898>

</comment><comment><USER18> hmm, is the app you are planning something that will solve some of your own problems? Or is it something that your boss's client would appreciate. I am guessing that it might be the latter in your case and that's why you have trouble motivating yourself, because your boss isn't there. If you would find something that solves one of your own problems and made your own life a lot easier, then finding the motivation to do it is far easier!

</comment><comment><USER19> "What's wrong with me?..."

How to beat procrastination: <http://news.ycombinator.com/item?id=2185174>

Perhaps you feel that your idea doesn't help someone else, even if it is interesting to yourself (hence it's easy to do work for others). Convince yourself either the idea/product would help people (ask if people are interested?) or do it for fun/hell of it. Otherwise, cut your losses.

</comment><comment><USER20> You may just be a creative who may lack the skills which are needed in combination to get you moving forward such as "Leadership" & "Organization". Thus looking into partners or mentors who have those two will only help you along.

I have found this video helpful as it explains further: The project plateau <http://vimeo.com/13399691>

hope this helps.

</comment><comment><USER21> I know that situation well. I figured out it's because I strongly prefer working in a team. Solo-founder is never going to work 100% for me. I do work individually great, but if there isn't at least one smart person to bounce ideas off, and who reflect back some real enthusiasm, I'm burned out after a few days.

If anyone figures out how to trick yourself then I'm all ears!

</comment><comment><USER22> Sketch out the app. Do a SDUF (small design up front).

What do you need to do, and in what order?

What is the minimum viable product? What does that need to do, and in what order?

Now, what's the first thing that needs to happen for the MVP, and what is the smallest piece in it that can be done in an afternoon of coding and uploading to your VPS?

0: Do it.

1: Now, what's the next task in the chain towards MVP?

2: Do it. If the MVP isn't done, GOTO 1.

</comment><comment><USER23> Ask yourself, if 3 years and I haven't made my app will I be disappointed? If yes, then set 30 mins a night to work on your singular project. Write a general plan of attack, then flesh out the 1st 20 objectives. If it helps, pretend your boss asked you to complete this project. good luck!

</comment><comment><USER24> Try cutting scope until you get down to a thing you feel like you can do right then. This might be more like "gutting scope".

You'll end up with a tiny unusable thing, but it's something you can add to. Some people have an easier time "improving" than "starting".

</comment><comment><USER25> Have you looked for a co-founder ? Having someone else to work with or rely on is a great source of motivation...

</comment><comment><USER26> Sit down, roll up your sleeves and get to it. 2500 commits later and you may get somewhere with this...

</comment><comment><USER27> You bought this you got that you have the technical skills.. but do you have a plan? do you have a design on paper or whiteboard which you can implement?

Here's something I did to get past my own wall two months ago. I told myself to shut up, set aside some time each day (after I started working it was a lot easier. The only time I had was after work hours till 10 30 in the night) and then follow these steps.

1) make sure you are fresh, preferably having had shower 2) phones, distractable media all shut off and put away. block everything except your resources on the net if you have to 3) put down what you are going to do either on a small A4 size like whiteboard, or an A4 drawing paper (blank white is best to focus) When putting down the stuff do it this way a) write down the features you want to implement in your current development cycle b) draw up the screen designs if you need to c) think through the logic and put down what's needed.

Get to Work!

Methodologies are there for a reason. They do actually work. Btw, before starting. Make sure you have a clean overall view of the project as well. Not just the 'pitch'. Put down your main use cases and the features for each use case there (two levels max you can elaborate during the main cycles).

What's wrong with you is not lack of motivation. It's a lack of focus. I've dealt with it when learning languages too. I'd spend hours reading the material and come away with nothing. You need to know what you will achieve and that within a practical time frame. If you are having a really bad case of not being able to focus, I suggest a maximum time frame of two days. I currently work on a functionality a week/fortnight basis.

Good luck :)

<comment><USER28> Good grief, did you just advise someone you've never met to take a shower?</comment></comment>


Hurl is back: http://hurl.it/ - <AUTHOR> https://twitter.com/#!/defunkt/status/1569030636838912 <comment><AUTHOR> <http://hurl.it/>

</comment><comment><USER2> nice service. You should add some formatting for JSON like the JSONView extension does, and the ability to view the response content only

Also, short URLs FTW. eg:

hurl.it/s5gJ#h5 would link to a particular request and highlight the fifth header line.

hurl.it/s5gJ#c12 would highlight the 12th line in the content.</comment>


Malaysian Official Says Missing Plane Hijacked - <AUTHOR> http://hosted.ap.org/dynamic/stories/A/AS_MALAYSIA_PLANE?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2014-03-15-00-22-45 <comment><USER2> First, I can't imagine the US doesn't know the location of this airplane or exactly what happened during deviation from its original flight path. Understandably, they cannot reveal the full breadth of their reconnaissance capabilities to "enemies" and the general public.

If you don't know, there is a highly sophisticated US naval air facility on the island of Diego Garcia. The Navy does deep space reconnaissance over there! among other things...

And they didn't detect a massive 777 flying north/south in and around the Indian Ocean?

That area is saturated in complex radar. Diego Garcia houses complex radar and satellite communications systems and who knows what else that is still classified.

Additionally, there are over 1,000 operational satellites in orbit!

IMO, this was a carefully and planned mission.

For all we know (tin-foil hat time) there could be behind the curtain negotiations with hijackers and/or missions being planned to recover the aircraft in case of wild extremists theories flying around on the Internet (0.1% on this) And as we all know today, nothing is that extreme anymore in the world we live in.

Disabling transponders takes three clicks of a wheel and it was most definitely done intentionally, the sharp, almost hairpin turn, this jet made and then strategically avoided radar are all signs of a sophisticated operation here. The WSJ reports that circuit breakers were accessed in order to shut down transponders, clearly requiring a high level of skill for aircraft maintenance opps. Sure, pilot can break a circuit but they will spend 20 minutes reading the flight maintenance manual AND contact ground before doing anything like this.

Finally - there were a few important people on board, including quite a few high-tech people involved with government contractions.

Whatever is happening, it might never make complete sense - or at least the general public might be out the loop and get whatever information THEY want us to hear. I don't know who THEY are but this whole situation is very strange and gets crazier by the day.

Edit: this bird was hacked

<comment><USER3> * puts tinfoil hat on *

In two months there are EU elections. Plus the hijacking in switzerland shortly before this... Sound convinient.

<comment><USER4> You'd need something stronger than a tinfoil hat to think that EU elections are important.

</comment></comment></comment><comment><USER5> AP is already walking back the headline, now reads "Malaysian official says missing plane hijacked"

 _" It is not conclusive. I'm heading the investigation and nobody is saying that. It's not true. We are looking at the possibility, we're looking at all possibilities. We're doing every profile of the passengers and crew but there is no firm evidence or leads so far," he told the Telegraph. _

<comment><USER6> At this point the only safe headline to run is "Malaysian officials currently saying something they're going to deny saying a few hours from now".

<comment><USER7> Or perhaps _" Passenger Jet Missing"_. That seems to be the only confirmed information.

</comment></comment></comment><comment><USER8> At this point I'm guessing it was hijacked or otherwise a victim of foul play, and then the perpetrators screwed up somehow which is why no one now wants to take credit for the affair. I bet we're going to hear conspiracy theories for years.

<comment><USER9> >then the perpetrators screwed up somehow which is why no one now wants to take credit for the affair

There is no hard evidence for it, but a suicidal pilot who wanted to make sure his insurance paid out would also explain this. Suicidal _and_ psychopathic.

It's horrific, but it has happened twice before.

<comment><USER10> Except psychopaths and suicides are on opposite sides of the spectrum. You do have edge cases where psychopaths choose suicide over being caught, ie Hitler. But to commit just suicide there literally thousands of easier ways to do it. You don't even have to leave home to do it.

<comment><USER11> Got it, so because committing suicide is easier to do at home, you must be silly to do it in this matter. Crazy, even.

</comment></comment></comment></comment><comment><USER9> It has to be asked, why did it take so long to get the additional data about the flight path?

That data includes engine to satellite handshake, and military radar.

A lot of effort and time was wasted searching in the wrong place, even though the lack of wreckage beneath the last transponder location was an immediate sign that something might be unusual about this case. Meanwhile, possible evidence, such as floating wreckage in the Indian Ocean, was being lost.

<comment><USER12> It's fascinating that you can find your iPhone using a Web site, but we're having such a hard time finding a plane (with lots of people with smartphones in their pockets turned off, or not).

EDIT: just to clarify -- I'm thinking of how tracking the precise location of a plane at all times is a problem that it seems like we should have a handle on by now, although not necessarily using cell phone technology. (I wasn't thinking clearly about the cell phone signals in this context, though, as people have been correct to point out.)

<comment><USER9> It's fascinating, but it leads one toward the unpleasant conclusion that the passengers could have already have been dead or unconscious before the plane flew back across Malaysia.

Cellphone tower records should provide more evidence, because there are sure to be some phones that were not in airplane mode.

Cellphones won't have enough power to connect more than about 50 km from the coast.

<comment><USER13> Do you still get cell signal seven miles up? I remember one time accidentally leaving my phone not in airplane mode and I had no signal. YMMV.

<comment><USER9> The quality of service may not be good, but text messaging will work, at least.

</comment></comment></comment></comment></comment><comment><USER14> I'm convinced this is one of three things after watching this for 7 days:

1\. Hijacking gone wrong and the plane is in the ocean.

2\. Pilot suicide and the plane is in the ocean.

3\. Hijacking gone right and the plane is parked somewhere and all the passengers are dead and/or being held captive (least likely option).

That's it. Nothing else could have happened.

<comment><USER15> What about a portal to another dimension?

<comment><USER16> That's what I'm talking about! [http://www.imdb.com/title/tt0112040/](http://www.imdb.com/title/tt0112040/) good theory.

<comment><USER17> man I loved this when it came on TV for the first time. gotta watch it again someday

</comment></comment></comment></comment><comment><USER18> A modern day Earhart. I wonder if this incident will be the result of unintended blowback from making the cockpit too secure. Can we trust pilots? Should we be able to over-ride the controls of a plane mid-flight? EgyptAir Flight 990? All 9/11 flights? Ethiopian Airlines flight ET-702?

<comment><USER19> "making the cockpit too secure"

How so? If you don't trust the pilots to the point where you want, who, the FAs? taking over the plane, you've got far bigger issues. An override system should be a remote-control thing requiring keys from multiple people.

</comment></comment><comment><USER20> I think hijacked is a high possibility, though the only question remains is why hasn't anyone actually claim the responsibility? This is so unlike terrorist group out there.

From what I understand, no terrorist group has claimed responsibility for the recent Kuming massacre in China the week before the missing plane.

Uighurs separatists/terrorists are not that shy; they did claim responsbility are few times. ([http://en.wikipedia.org/wiki/Terrorism_in_China](http://en.wikipedia.org/wiki/Terrorism_in_China))

If this were a hijack, it's either targeting at the Chinese (most likely Uighurs separatists) or an upgraded terrorist attack. Maybe I've watched too much _24_ and Sherlock Holmes.

</comment><comment><USER21> Hmm. I wonder what the motivation is. I don't think it's terrorism or ransom, since nobody's claimed responsibility yet.

Maybe it was a hijacking gone wrong, and the plane went down?

Then again, the time gap between the disabling of systems suggests the hijackers ended up with enough control of the aircraft to send someone to see to it (presumably if they were engaged in a desperate battle with the crew and passengers, or if they lost control of the aircraft and the plane was going down, all of the hijackers would be busy dealing with the crisis).

The fact of "significant flying experience" and the disabling of the transponder suggests a professional operation -- maybe some country's intelligence agency wants one of the passengers badly enough they're willing to interfere with a couple hundred other innocent passengers? The outcome doesn't bode well for the missing, since they are now Witness Who Have Seen Too Much.

Or maybe the hijackers _want_ all the passengers because they have a use for a couple hundred humans. Slave trading? Weapons testing? Wouldn't it be simpler (and bring a less thorough investigation) to just kidnap people off the street in some country with poor law enforcement?

The more I think about this, the less sense it makes.

<comment><USER22> There can't be _that_ many places within reach of that plane where such a plane can land, right? The time window and range are both known, so can't all those places be checked somehow?

<comment><USER23> More importantly, there aren't that many places a 777 can land _without being picked up by a radar_. Probably zero places.

<comment><USER24> I'd imagine that most airports that could handle a 777 would be suspicious if it wasn't a scheduled flight, wasn't an emergency _per se_ , and later learned that an aircraft of that type went missing.

And if it was still the case up to the point of disappearance, its latest livery was a bit... flamboyant [1]. Not exactly the sort of thing I'd want to try hiding.

[1] [http://flightaware.com/photos/view/1342999-1276f63c75e647f6d...](http://flightaware.com/photos/view/1342999-1276f63c75e647f6d73bb3dc004b0dfad70ae7ea/aircrafttype/B772)

</comment></comment></comment></comment><comment><USER25> Officials now believe most likely location for MH370 is on land near Chinese/Kyrgyz border.[1]

If this holds true, then the most likely perpetrators are Uyghur separatists. But this begs the question, how did they manage to evade being detected by the numerous radars?

[1] [https://twitter.com/JonahFisher/status/444754310677553153](https://twitter.com/JonahFisher/status/444754310677553153)

<comment><USER26> They probably were detected by radar, but geopolitics means few countries will admit they were able to detect it to avoid revealing military capabilities.

</comment></comment><comment><USER27> _" Radar signals recorded by the Malaysian military appear to show the airliner climbing to 45,000 feet (about 13,700 meters), higher than a Boeing 777's approved limit, soon after it disappeared from civilian radar, and making a sharp turn to the west. The radar track then shows the plane descending unevenly to an altitude of 23,000 feet (7,000 meters), below normal cruising levels, before rising again"_

Sounds to me like a possible fight/commotion in the cockpit was the cause of the plane to fly in such a weird pattern.

Potential Scenario:

\- Fight in cockpit results in the plane flying unexpectedly high ( _" above approved limit"_)

\- Hijackers obtain control, turn off transponder and turn to their target location

\- Unexperienced pilot (possibly learned how to only fly smaller planes) makes an _" unevenly"_ descent to lower altitudes as he knows the plane is above its approved limit

\- Rise again could be a second fight in the cockpit? Not sure on how to explain this one.

The rising and falling in altitudes makes me suspect this wasn't pilot suicide.

<comment><USER28> Why would a plane ascend because of a struggle in the cockpit? You don't just climb 15000 ft at that altitude because someone fell over the controls. Someone had control at that point. Had there been a struggle, a descent would be the most likely outcome. All the explanations I've heard so far contains way too many assumptions. Ockham's razor.

Here's another scenario: hypoxia. Makes you retarded and euphoric. Like being drunk but with less disassociation. Suddently, it's a great idea to climb! Oh wait, nope. Better descend. Are we on course? Better turn.

Hypoxia and/or stress. Look at AF447. All pilots know what a stall is. But when you're flying at night in bad weather with S:t Elmo's fire all around you and the airspeed indicator stops working and you believe you need to climb, you might react without thinking. Oh, we're losing altitude? Better pull up!

</comment></comment><comment><USER29> Malaysian PM just concluded a Press Conference.

[http://www.youtube.com/watch?v=uwRUf4NlwDc](http://www.youtube.com/watch?v=uwRUf4NlwDc)

He himself confirmed that satellite data (alledgedly cross-checked with US and other countries) shows the plane was still up in the air until at least 8:30AM Malaysian Time (~4-5 hours after the disappearance iirc).

Search and Rescue operations in the South China Sea (east of Malaysia) have been cancelled - the search now focuses west of Malaysia.

I quote (emphasis mine) : "the last satellite communication occurred in one of two possible corridors, a northern corridor, stretching _approximately_ from the border of Kazakshtan and Turkemistan to northern Thailand, and a southern corridor, stretching _approximately_ from Indonesia to southern Indian Ocean."

PM exited the press conference right after ending his speech, not answering questions.

</comment><comment><USER30> This story gets more interesting and interesting with every day. I really hope it was hijacked and landed safely somewhere.

<comment><USER31> If true, it means 230 peoples lives are in the fate of a group crazy enough and smart enough to hijack a plane undetected. I don't even want to think about that too much. The situation they are in must be hell.

<comment><USER32> > The situation they are in must be hell.

Better than being dead.

<comment><USER33> Are you sure?

<comment><USER32> Yes. Being alive is better than being dead. I will stand by that statement no matter the circumstances.

</comment></comment></comment></comment></comment><comment><USER34> One plausible scenario is that the plane was hijacked by terrorists so that it could later be used to deliver a payload (or be the payload itself a la 9-11). Since the plane has such a huge range, it could be used in an attack on American soil. This could also explain flying at a high altitude as a way to kill the passengers.

<comment><USER35> You can't just fly an unidentified plane into American airspace without getting shot down... I think

</comment></comment><comment><USER36> Motorola/Freescale is apparently a dangerous place to work: [http://en.wikipedia.org/wiki/Singapore_Airlines_Flight_006](http://en.wikipedia.org/wiki/Singapore_Airlines_Flight_006)

<comment><USER37> It happens a lot more than people think.

If your company has 20,000 employees and it's routine for many of them to fly, then the odds are that something bad will happen eventually.

[http://www.wired.com/autopia/2010/02/tesla-employees- identif...](http://www.wired.com/autopia/2010/02/tesla-employees-identified/)

[http://www.theguardian.com/world/2013/aug/10/connecticut- pla...](http://www.theguardian.com/world/2013/aug/10/connecticut-plane-crash- six-feared-dead)

Below are some unusual airplane incidents, I'm sure there are many more than are on this list. The point is that everyone would say the below things would NEVER happen on an airplane, yet, they happened.

[http://www.planecrashinfo.com/unusual.htm](http://www.planecrashinfo.com/unusual.htm)

Some highlights:

"A passenger brought aboard a crocodile hidden in a sports bag. The crocodile escaped, causing a panic among passengers who all rushed to one end of the plane. This caused an imbalance in the aircraft which led to loss of control and a crash."

"A stray bullet from training soldiers struck the landing plane, hitting an oxygen cylinder. A fire broke out and control of the plane was lost and it crashed."

"The aircraft was hijacked shortly after taking off from Ethiopia by three drunken escaped prisoners. They demanded to be flown to Australia, but wouldn't let the pilot stop to refuel. The plane eventually ran out of fuel and ditched 500 feet offshore killing 127 of 157 aboard."

"A passenger's cigarette caused a fire in the cabin which led to an oxygen tank exploding. The plane crashed killing 25 of 69 aboard."

"Two passengers were sucked out of the plane after a tire exploded in the wheel well causing damage to the fuselage."

"Out of boredom, the captain and flight engineer decided to experiment and see what would happen to the autothrottle system if the circuit breakers which supplied power to the instruments which measured the rotational speed of each engine's low pressure compressor were tripped. This led to engine overspeeding and destruction of the engine. Pieces struck the fuselage, breaking a window, causing rapid explosive decompression and a passenger was sucked out of the plane. The plane landed safely."

"An unrestrained German Shepard interfered with flight controls and caused the plane to crash."

"Without authorization, the pilot taxied half-way down the runway to try and clear fog. Braking done during the fog clearing overheated the brakes. Soon after takeoff, the overheated brakes caused a tire to burst which damaged a fuel line and started a fire. The plane crashed shortly after killing all 80 people aboard."

These below happened like 50+ years ago.

"A U.S. Army Air Force B-25 crashed into the 79th floor of the Empire State Building in fog, killing 3 aboard and 11 on the ground."

"Carbon dioxide extinguishers were discharged in response to a fire warning in the cargo hold. The plane's nose was lowered for an emergency descent and due to a design flaw, carbon dioxide entered the cockpit and rendered the crew unconscious after which the plane crashed killing all 43 aboard. "

"The DC-3 disintegrated in flight outside of Quebec killing all 23 aboard.. A dynamite bomb was planted in the forward baggage compartment by Albert Guay, a jeweler, in a plot to kill his wife who was a passenger on the plane. Guay, who assembled the bomb, had his accomplice, Marguerite Pitre air expressed the bomb on the aircraft. Ms. Pitre's brother, a clockmaker, helped make the timing mechanism. The insurance policy was for 10,000 dollars. All three were hanged for their crimes. "

"The plane landed in Pacific Ocean, 2.5 mile short of the runway in the shallow waters of San Francisco Bay. All 107 people aboard were safely evacuated off the plane. The aircraft was recovered from the San Francisco Bay 55 hours after the accident, repaired and eventually flew back home to Japan and was in service for many decades."

"The aircraft crashed killing 61 of 82 aboard after colliding with a balloon."

<comment><USER38> > "Out of boredom, the captain and flight engineer decided to experiment..."

Wow, that starts out like something out of The Onion: [http://www.theonion.com/articles/pilot-tells-passengers- hes-...](http://www.theonion.com/articles/pilot-tells-passengers-hes-about-to- try-something,34934/)

<comment><USER39> A similar story is how Chernobyl happened.

</comment></comment></comment></comment><comment><USER40> Like every other piece of information that's denied in the daily press conference...

> the official, who spoke on condition of anonymity because he was not > authorized to brief the media.

</comment><comment><USER41> didn't google news have a hosted page for AP stories that was formatted a bit better for reading? I can't seem to find it anymore...

</comment><comment><USER42> [http://www.telegraph.co.uk/news/worldnews/asia/malaysia/1069...](http://www.telegraph.co.uk/news/worldnews/asia/malaysia/10699933/Missing- Malaysia-Airlines-flight-MH370-investigator-denies-claim-plane-was- hijacked.html)

I don't know who to believe.

<comment><USER43> They've been publicizing information and shortly denying them afterwards themselves this entire week, it almost seems like there is a faction within the government that has conflicting motives with the rest.

Next they are gonna deny that MH370 existed at all.

<comment><USER42> It almost seems like they are trying to avoid looking bad in front of the world. It's really hard to believe that a large flying object like that is undetectable or the idea that it's sitting on an island with trees covering it.</comment></comment></comment>


Creating order from chaos in a startup - <AUTHOR> http://joel.is/post/3678211291/creating-order-from-chaos-in-a-startup <comment><USER2> Great post joel. I particularly agree with your "lizard brain" description. It is something I try to get rid of more and more. On the other hand it also acts as a sceptical element within my thinking, which I perceive to have some value too. Also I really like your description of Chaos and Order. To me it feels as if we can have order one day and with just one piece of feedback or one additional piece of knowledge - BAM - Chaos rules again. But that's not bad, is it? It helps to never settle. Something I believe you are after too.</comment>


The Sloan Digital Sky Survey - <AUTHOR> http://alliance.nautil.us/feature/278/taking-to-the-stars <comment><USER2> For anyone interested in astronomy who would like to try their hand at some small projects using real data, the SDSS website has some guides to help you through a few projects here:

[http://skyserver.sdss.org/dr14/en/proj/projhome.aspx](http://skyserver.sdss.org/dr14/en/proj/projhome.aspx)

Some of the advanced projects are to make an HR diagram, classify stellar spectra, and calculate the redshift of quasars. Of course, all the data is public so the guides are just a start --- you can keep going in any interesting direction. It doesn't take long to get to the point where you're doing real research.

It's pretty cool that thanks to this project anyone with an Internet connection can reproduce fundamental astronomical results for themselves.

</comment><comment><USER3> Even for a simple amateur astrophotographer [1] the SDSS data is invaluable. It powers most of the target selection, and provides accurate coordinates for most astronomical objects. Combined with Plate Solving, it makes my life much easier [2]. Take for example a well known tool "Sequence Generator Pro", I only have to type in a name and I can start imaging [3]. I can't thank the people enough who worked on this. I'm soon upgrading the telescope with a set of Sloan photometric filters (used in the survey) [4], and particularly interested in expanding my images with Near Infrared data. Which can also give very pretty pictures [5]

[1]: my 2017 images [https://www.flickr.com/photos/joelkuiper/38496747325/](https://www.flickr.com/photos/joelkuiper/38496747325/)

[2]: [http://cosmo.nyu.edu/hogg/research/2006/09/28/astrometry_goo...](http://cosmo.nyu.edu/hogg/research/2006/09/28/astrometry_google.pdf)

[3]: [https://www.flickr.com/photos/joelkuiper/24582661547](https://www.flickr.com/photos/joelkuiper/24582661547)

[4]: [http://astrodon.com/store/p12/Astrodon_Photometrics_Sloan_Fi...](http://astrodon.com/store/p12/Astrodon_Photometrics_Sloan_Filters.html)

[5] [http://trappedphotons.com/files/tmp/Making%20Pretty%20Pictur...](http://trappedphotons.com/files/tmp/Making%20Pretty%20Pictures%20from%20Scientific%20Data.pdf)

<comment><USER4> The second link is fascinating. I've never come across this algorithm. What a clever solution!

I'm a bit unclear on how the "quads" are chosen (ie. which 4 stars are grouped together). I assume your image and the sky-survey database you're comparing to are at a completely different detail-level. Choosing every combination of 4 stars seems not practical. If you just choose groups of 4 that are next to each other then you may find the database has dozens of stars in between your quad's stars (b/c it's at a higher detail level)

The slides acknowledge this by saying " Finally, there is the additional problem of distractor & dropout stars", but I don't see their solution :)

Maybe this is a clue "Cycle through all possible valid* quads (brightest first) and compute their corresponding codes" but there are no details.

</comment></comment><comment><USER5> Nearly 10 years ago (wow, time flies), as a weedy undergraduate, I was fortunate enough to do a research project [1] under one of the scientists [2] who worked on this survey. It was pretty cool to just be able to submit arbitrary SQL queries and get nice CSV files back.

With my imperfect knowledge of astrophysics and hacked-up scripts, it was pretty intimidating to stand up and present my "interesting-but-will-probably- need-more-detailed-research" to a bunch of people with literally decades of experience in the field and have them take me seriously and ask questions.

I do other things now, but it's a pleasant surprise from the past to see this on here :)

[1] [https://mandarg.com/vsrp-talk.pdf](https://mandarg.com/vsrp-talk.pdf)

[2] [http://www.ncra.tifr.res.in/~yogesh/](http://www.ncra.tifr.res.in/~yogesh/)

</comment><comment><USER6> I worked with probably a dozen or so scientists and engineers who were building the SDSS telescope and the associated data analysis infrastructure (full disclosure: my role was very nearly entirely nothing compared to everyone else).

It's really a technological marvel, and some truly brilliant engineers and scientists were working on it. I'm intensely gratified that the survey has been such a smashing success; they all deserved it.

The part I was always most impressed with was they way they took the spectra. As mentioned in the article, the survey was twofold: the image survey over the vast swaths of the sky and somewhere around 2,000,000 spectra taken of distant objects.

Every single one of those spectra was taken by use of a fiber optic cable at the focus point of the telescope. They would take a metal plate, drill holes in it where the objects would appear, and plug the holes by hand with the cables: [http://blog.sdss.org/wp- content/uploads/2014/05/twitter5.jpg](http://blog.sdss.org/wp- content/uploads/2014/05/twitter5.jpg)

2 million times!

<comment><USER2> I was pretty lucky to be in a department that was one of the SDSS members. The metal plates they had were only used a few times since each one was unique to the field it was designed for. After they were done with them they sold them to some of us grad students for $20 (the price they would have gotten as scrap). When I move into a house I'm going to mount mine on a wall so I have a little piece if scientific history to look at. :)

One thing to add, too, is that the plates are pretty big! Each one is about three feet across and maybe 1/8 inch thick!

</comment></comment><comment><USER7> On the radio astronomy side. The Jansky VLA survey has only just begun data collection ;)

[https://science.nrao.edu/science/surveys/vlass](https://science.nrao.edu/science/surveys/vlass)

[https://sciencesprings.wordpress.com/2017/12/28/from-nrao- th...](https://sciencesprings.wordpress.com/2017/12/28/from-nrao-the-very- large-array-sky-survey-vlass-this-is-huge-with-many-great-videos-at-the-end/)

</comment><comment><USER8> The most recently run catalog of the sdss has some very interesting coding techniques associated with it:

[https://youtu.be/uecdcADM3hY?list=PLP8iPy9hna6QpP6vqZs408etJ...](https://youtu.be/uecdcADM3hY?list=PLP8iPy9hna6QpP6vqZs408etJVECPKIev&t=1718)</comment>


What if you could only move your eyeballs? - <AUTHOR> http://www.esquire.com/features/unspeakable-odyssey-motionless-boy-1008?src=rss <comment><USER2> Eh, Stephen Hawking seems to be doing OK.

</comment><comment><USER3> just ask the really fat guy down the aisle</comment>


Why round to even integers? – Mathematica Stack Exchange - <AUTHOR> http://mathematica.stackexchange.com/questions/2116/why-round-to-even-integers <comment><USER2> I don't remember Mathematica was ever like this, although I didn't use Round[] much either. It does what I would expect it to do today:

[http://reference.wolfram.com/language/ref/Round.html](http://reference.wolfram.com/language/ref/Round.html)

        Round[x]
        gives the integer closest to x.

<comment><USER3> that documentation is insufficient to describe what integer 1.5 rounds to. There are two equidistant integers. So what do you expect in this case and what does it do, and how could you expect it to do one or the other in this case based on that documentation?

from examples further down: Round[{0.5, 1.5, 2.5, 3.5, 4.5}] yields 0, 2, 2, 4, 4

<comment><USER2> Except in floating point arithmetic there aren't two equidistant integers.

What I expect is, Mathematica doesn't make promises about stuff that can be affected by an infinitesimal change, with a floating point input. I don't think you can talk about "numbers of the form x.5" precisely with floating point. Mathematica typically behaves differently with inputs 1/2 and 0.5, so I'm not sure what's going here. I guess Round[] works slightly differently, maybe tries to fractionalize the input first.

I checked, and that promise is still there actually, under Details section.

<comment><USER4> > Except in floating point arithmetic there aren't two equidistant integers.

Yes there are. 1 and 2 are equidistant from 1.5.

> I don't think you can talk about "numbers of the form x.5" precisely with > floating point.

Yes you can.

<comment><USER2> If only IEEE-754 math worked as infinite-precision math. You should first learn some basics about floating point numbers before attempting to make such strong assertions to correct people with such a bossy attitude (you're 100% wrong BTW).

Here's a quick exercise for you:

#include <stdio.h>

int main() { float x = 123456789.5; printf("%f\n", x); return 0; }

prints 123456792.000000

And the distance between two nearest floats grow larger as you go away from 0. So the nearest existing integers aren't 123456790 or 123456788 either.

<comment><USER4> Meanwhile, 2 - 1.5 == 1.5 - 1, and in half the integer range, the .5's can be represented exactly.

<comment><USER2> I think I've wasted enough time with your ignorant ramblings.

Yeah, yeah, go and live with your delusions happily ever, "pal". Shoo.

<comment><USER4> Guess what pal, even IEEE defines the round to even mode for results exactly between two integers (when they're the nearest representable values).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I'm surprised none of the answers seem to emphasize IEEE 754, which recommends ties-to-even rounding as the default (but allows ties-away-from-zero, which is what's more familiar to me and probably the person who asked the question in the first place).</comment>


Release Doves - <AUTHOR> https://en.wikipedia.org/wiki/Release_dove <comment><AUTHOR> I just found out about this, and was astonished at he irony of the act of releasing these doves which are specially bred in captivity all their lives. Most of these doves die on getting released.

<comment><USER2> I agree, Doves & Pigeons are social birds and depend on many urban things. Like, they build their nests only on hard surfaces (sheds etc.). On top of that, they usually have more predators in the wild than in urban areas.</comment></comment>


Recent News Powered by "News Graph" Platform - <AUTHOR> http://myfrancisco.com/

<comment><AUTHOR> I will write details of the graph, possibly open-source it, at the meantime I want some feedback on the implementation of myfrancisco.com</comment>


How tall can a tree grow? - <AUTHOR> https://youtu.be/vvtPJKWUb2g <comment><USER2> I'd really recommend watching TED-Ed videos in short breaks, etc. They are short, very well put together and quite informative.</comment>


Show HN: Search a database of 5000 keyboard shortcuts by description or keys - <AUTHOR> https://keycombiner.com/collecting/collections/public/ <comment><AUTHOR> Hey HN! My side-project KeyCombiner just got a major new feature addition:

Search functionality over its complete database of keyboard shortcuts. You can search (without login) by description, Win/Linux bindings, MacOS bindings, or a combination of these.

I can think of a couple of scenarios where this could be useful:

1\. To see if there is a consensus for a particular operation, e.g., search for "Step out" and see that IDEs use F6 (Eclipse), F8 (Jetbrains), and F10(VSCode) for this. This could be helpful when thinking about key bindings for your application. 2\. If you want to, as a user, assign your own key bindings and like to maximize compatibility in many different applications. Search if, eg ctrl+shift+a is already reserved for other things by the apps you use. 3\. Last but not least, the main idea of KeyCombiner is to create your own shortcut collections and then learn and practice them, create cheat sheets, share with others, etc. The shortcut search helps to find combinations to put into your own collections. If you are logged in, the search results that are already in your collections will be marked. (I wish Spotify could do this with songs any my playlists!)

Largely thanks to the DataTables open source project, you can do many things with the result table in regards to filtering, row grouping, showing/hiding columns, and so on.

While the feature is not overly exciting from a technical standpoint, I like to think that it is interesting and useful because I haven't seen anything similar. I would love to hear what you think can be done with it.</comment>


Why Our Kind Can't Cooperate - <AUTHOR> http://lesswrong.com/lw/3h/why_our_kind_cant_cooperate

<comment><USER2> > But it is nowhere written in either probability theory or decision theory > that a rationalist should not care. I've looked over those equations and, > really, it's not in there.

You know, in all my childhood of reading Asimov I never believed I'd live to see this written in earnest (or close enough).

</comment><comment><USER3> The entire essay fails at some basic level for me.

Background Situation: you maintain a heavy internet presence in which you write lots of articles on various "issues" and have attracted a sizable community of hangers-on who like to argue about the issues. The "issues" you write about are things you believe in strongly.

Puzzling Development: you have a fundraiser for the "issues" you care about and are disappointed in the outcome (more on this later, see (!)). You get some amount of donations but the most-visible response is a lot of arguing and discussion, which you (correctly) conclude is counterproductive to the fundraising process.

Possible Conclusion One: there's a sizable community of people who like discussing and arguing about these issues, the same way there's a sizable community of people who enjoy discussing lost, or star trek, or whatnot. The underlying issue isn't that important to them (no more so than lost or trek is important to losties or trekkies), but they sure do enjoy the arguing and discussion.

Possible Conclusion Two: there's a sizable community of people who deeply care about the "issues" at hand, as evidenced by the argumentation and discussion they exhibit. Sadly, the fondness for argumentation leads to counterproductive behavior when (eg) we try to raise funds, b/c the argumentation is public (producing negative feedback loops) but the donations are not public.

"Possible Conclusion One" seems the most warranted; there clearly are people who love arguing and discussion the issues but there's also clearly far fewer of them who care enough to donate (or otherwise do more than post comments on teh blog).

"Possible Conclusion Two" is more flattering to the writer but requires more assumptions about the community of readers and requires drawing more inferences from observed behavior than "Possible Conclusion One".

(!) Note that the reason the author feels disappointed is b/c the author looks @ the amount of donations vis-a-vis the amount of passionate argument the fundraiser provoked and is disappointed (that so much of the passion went into arguing instead of donations). This is tantamount to assuming "Possible Conclusion Two", as it is assuming you can correctly infer actual interest in (doing something about) the "issues" just from apparent passion to argue and discuss ideas pertinent to the "issues".

If you started from the assumption you had attracted a bunch of people who like arguing and for whom your "issues" are a kind of catnip -- the way losties and trekkies find lost and trek to be their catnip -- you might still be disappointed but for a different reason; you'd be disappointed with your ability to get your readers to make the leap from enjoying your work as "entertainment" to caring about the issues it raised, instead of assuming you'd already done that and then bemoaning their seeming inability to act productively wrt those "issues".

<comment><USER4> While I think you're basically correct in the context of a fundraiser (Occam's Razor suggest the more likely explanation is that most people don't donate to most causes and you weren't special enough to get around that), I still think Eliezer has a point in general.

I've observed this in online debating in general as well, to put it in a larger context. If I write something even modestly controversial, and get five replies, I guarantee each of those five replies will be nothing but sheer negativity and disagreement. _Agreement_ is indicated by... simply ignoring the agreeable point. It produces a harshly confrontational environment. I have no idea how to address that, though; we eschew people simply posting "I agree!" for a reason, after all. "Voting up" isn't supposed to mean "I agree" either, though we all know that it sort of does in practice no matter how much we may protest to the contrary (or even sometimes stretch ourselves and upvote a good argument for something we disagree with; I've done it, but I'll be honest, it's an exception, not a rule).

Note that this message is not an exception, except perhaps inasmuch as I "throw you a bone" in the first paragraph. I don't know what to do about it, but I'd be interested in ideas.

<comment><USER3> To step over the essay and get to your larger point, I think there's a conceptual error in assuming agreement and disagreement are sufficiently symmetric that it'd be reasonable to expect there to be a "solution" to the "problem" you're pointing out.

I think the actual situation is that "agreement" as such _is_ communicated by actions (either cooperation or mimicry) and "disagreement" as such _is_ communicated by talking (eg: 'u r rong and eevil' responses).

When you look at successful ad-hoc or loosely organized groups the common theme is outlets for mimicry or cooperation; eg:

\- 'birthers' don't post "i'm so ghey for your evidence and theories" love- notes to each other on the movement leaders' blogs; they indicate "agreement" by taking the message to new venues (cooperation), starting up (or taking over) local 'patriot' organizations (cooperation + mimicry), starting new blogs advancing the cause (mimicry) and trade strategies / information with each other (cooperation)

\- 'raelians' are actually a fairly ad-hoc and decentralized cult as cults go; there's lots of outlets for missionary work (mimicry + cooperation), 'spiritual practice' (mimicry + cooperation), and so on

If the "host" doesn't have outlets for cooperation + mimicry that are both (a) visible to the host and (b) beneficial to the host then whatever agreement it generates will either be invisible or not beneficial or both; in the same way, if you convince people with your controversial blog post the "agreement" you'll see will come in the form of people linking to you (at its most visible) as 'great post by jerf' and more often it's just some invisible-to- you uptick in what % of people have similar takes on the issue you discussed.

This makes a fundraiser for an institute to promote "rationalism" essentially a multiply-pathological case study with predictably poor results.

EDIT: forgot one thing.

"Communication" is a broad thing (most human action is communicative at some level or other). Different message types are best transmitted using different communications types, and I think this is probably unavoidable / not teachable.

When you frame it as: "I communicate messages of type A on medium B and only get back responses of type C, but wish I also got messages of type D" it's a little limiting; the fact of the matter is that perhaps messages of type D are going out in other media, they're just not reaching your attention.

I'm pessimistic in general as to how malleable the message-type and media-type pairing can be; my suspicion is that if you care about getting messages of type D you should first figure out how those messages are communicated -- eg medium E -- and then find a way to work with that constraint in mind.

This probably means that the current internet communications media are:

\- productivity enhancers for existing high-passion groups

\- allowing new, low-intensity, low-passion groups to get made that otherwise wouldn't happen (cf: shirky's notion of the coasean floor)

\- ...not really going to enable the latter to graduate to the former on its own</comment></comment></comment>


How to Be Big Time Silicon Valley Tech Guy - <AUTHOR> http://thecooperreview.com/how-to-be-big-time-silicon-valley-tech-guy/ <comment><USER2> This is funny but is it what we want on HN?</comment>