The New York Times Is Now Available as a Tor Onion Service - <AUTHOR> https://open.nytimes.com/https-open-nytimes-com-the-new-york-times-as-a-tor-onion-service-e0d0b67b7482 <comment><USER2> And they're using an Extended Validation certificate from DigiCert for it

        CN = nytimes3xbfgragh.onion
        OU = Technology
        O = The New York Times Company
        Object Identifier (2 5 4 15) = Private Organization

along with some other addresses

        DNS Name: nytimes3xbfgragh.onion
        DNS Name: graylady3jvrrxbe.onion
        DNS Name: *.graylady3jvrrxbe.onion
        DNS Name: *.dev.graylady3jvrrxbe.onion
        DNS Name: *.stg.graylady3jvrrxbe.onion
        DNS Name: *.nytimes3xbfgragh.onion
        DNS Name: *.api.nytimes3xbfgragh.onion
        DNS Name: *.api.dev.nytimes3xbfgragh.onion
        DNS Name: *.api.stg.nytimes3xbfgragh.onion
        DNS Name: *.blogs.nytimes3xbfgragh.onion
        DNS Name: *.blogs.stg.nytimes3xbfgragh.onion
        DNS Name: *.blogs5.stg.nytimes3xbfgragh.onion
        DNS Name: *.dev.nytimes3xbfgragh.onion
        DNS Name: *.dev.blogs.nytimes3xbfgragh.onion
        DNS Name: *.newsdev.nytimes3xbfgragh.onion
        DNS Name: *.prd.nytimes3xbfgragh.onion
        DNS Name: *.sbx.nytimes3xbfgragh.onion
        DNS Name: *.stg.nytimes3xbfgragh.onion
        DNS Name: *.stg.blogs.nytimes3xbfgragh.onion
        DNS Name: *.stg.newsdev.nytimes3xbfgragh.onion
        DNS Name: www.bestsellers.nytimes3xbfgragh.onion
        DNS Name: www.homedelivery.nytimes3xbfgragh.onion

<comment><USER3> Sometimes I wonder if it's a good idea to brute-force these kinds of "vanity" onion prefixes. Take a look at the addresses used in [http://incoherency.co.uk/blog/stories/hidden-service- phishin...](http://incoherency.co.uk/blog/stories/hidden-service- phishing.html) ; they brute-forced the same prefix with a different suffix. Would anyone really notice?

<comment><USER4> If they didn't use vanity names, then people would only remember the first/last few random characters and the phishing scheme could very well still work, just it'd be less readable for visitors. I don't think we can assume that if all the characters were random they would remember them all better.

<comment><USER3> I don't think people would remember them _better_ if completely random. Rather, I think if they're completely random, people might correctly assume they can't, and remain appropriately skeptical; if they include a vanity prefix, people seem likely to remember the vanity prefix and somewhat less likely to pay attention to the rest.

</comment></comment></comment></comment><comment><USER5> This may not be the whole solution but it is a step in the right direction. Kudos to NYT for attention to this subset of readers.

<comment><USER6> It is. Overlay networks has a very expensive overhead, but it is one of the few ways that networks can be updated to modern views on security threats and privacy without getting ISP to change their hardware and software. I am in particular hopeful that we might see a future where tor will simply be a available tool in the general network stack, enabling private end-to-end without exist nodes.

<comment><USER7> > Overlay networks has a very expensive overhead

Single onion services are a thing now for quiet some time actually: [https://web.archive.org/web/20161219230314/https://blog.torp...](https://web.archive.org/web/20161219230314/https://blog.torproject.org/blog/whats- new-tor-0298) (had to use archive.org since images are broken on their blog currently)

</comment></comment></comment><comment><USER8> This is a great thing. Tor wants to encourage people to use tor as a normal browser so it's harder to track individuals using tor.

Handy graph for anyone curious about the benefits of Tor [0]

[0]: [https://www.eff.org/pages/tor-and-https](https://www.eff.org/pages/tor- and-https)

</comment><comment><USER9> Does the onion service still serve the same advertisements their website and mobile app do?

If so, they're leaving their users-who-want-to-stay-relatively-anonymous open to attack via the advertisement vector. Members of that group would be considered high-value targets simply due to their anonymity desires.

I can't see the number of daily users being large enough that they'd lose significant profit by closing that attack vector. Hell, if there was a way to pay NYT enough to disable ads on all their services, I'd do it.

<comment> system33- Tor Browser isolates cookies and other browser state into buckets based on URL bar domains.

<comment><USER7> ... i.e. first party isolation, one can read more about it on the Tor Browser design document: [https://www.torproject.org/projects/torbrowser/design/](https://www.torproject.org/projects/torbrowser/design/)

<comment><USER10> How can I get first party isolation in regular chrome or firefox? That is exactly what I've been imagining/wanting since Firefox announced their new container prototype.

<comment><USER7> Thankfully Mozilla works with the Tor Project so that Tor Browser patches to Firefox get uplifted to mainline Firefox, you can read more about those efforts here: [https://wiki.mozilla.org/Security/Tor_Uplift](https://wiki.mozilla.org/Security/Tor_Uplift) And the Tor Uplift tracker: [https://torpat.ch/uplift](https://torpat.ch/uplift)

In this case the relevant preference is privacy.firstparty.isolate = true. Another worth pointing out pref is privacy.resistFingerprinting = true.

<comment><USER10> Thank you. I am excited for all the ways this is going to break the web for me, but this is exactly what I wanted. Maybe someday this will be on by default for everyone. Can you imagine?

</comment></comment></comment></comment></comment></comment><comment><USER11> Mozilla is also currently matching all Tor donations: [https://donate.torproject.org/pdr](https://donate.torproject.org/pdr)

Consider donating!

</comment><comment><USER12> Will this help people in China at all? From an article I ready a while back it seemed like Tor has been defeated there. ([https://www.technologyreview.com/s/427413/how-china- blocks-t...](https://www.technologyreview.com/s/427413/how-china-blocks-the- tor-anonymity-network/))

<comment><USER10> That article is from 2012. It's a constant battle, which has changed a LOT in 5 years.

[https://blog.torproject.org/breaking-through-censorship- barr...](https://blog.torproject.org/breaking-through-censorship-barriers- even-when-tor-blocked)

[https://www.torproject.org/docs/pluggable- transports](https://www.torproject.org/docs/pluggable-transports)

</comment></comment><comment><USER13> What's the point of making it available in the Tor network if their onion site includes a script from www.googletagmanager.com (or an "iframe" if scripting is disabled) thus making it significantly less anonymous?

Onion websites should be isolated and should not initiate any connections to vanilla internet.

Edit: it also loads scripts from www.google.com, tags.bluekai.com, cdn.optimizely.com...

</comment><comment><USER14> Hmm don't you have to pay to access the full newspaper? How does that mix with Tor anonymity?

<comment><USER15> Haven't tested to see how they are doing, but that's kinda orthogonal to using tor. Standard cryptography like https uses is meant so any eavesdroppers don't know WHAT you are talking about. But they still know that Alice is talking with Bob. Onion routing, that tor uses, is meant to so eavesdroppers also don't know who is talking to whom. But that's on the eavesdroppers part. If Alice and Bob are talking completely privately, it's completely fine if they are exchanging all the information they want between themselves. The big idea is that attackers don't know what you are doing.

Tor can also hide where Bob's servers are, but not sure if the New York Times would need that bit.

<comment><USER14> Ah right - i was thinking of hiding from the US government, which can get the identity of subscribers directly from NYT.

I forgot there are other governments too... shame, I'm not even from the US.

</comment></comment></comment><comment><USER16> I don't see the point.

A hidden service is set for information can not be safely presented on the public Internet. Like what The Daily Stormer did.

If one just wanted to bypass blocking or hide himself from evil third parties, he could just use tor browser to open NYT's regular domain instead of the hidden service domain, no?

<comment><USER17> Onion services are faster on Tor, since you aren't limited by the bandwidth of the exit nodes.

There are also some security benefits, since connections to hidden services are automatically encrypted and authenticated, no HTTPS or trust in Certificate Authorities required (though HTTPS with EV certs can still be useful for identification purposes).

</comment></comment><comment><USER18> The url is a bit hard to remember. [https://www.nytimes3xbfgragh.onion/](https://www.nytimes3xbfgragh.onion/) Is there a directory of .onion sites? (with an easy .onion url)

<comment><USER19> There are no "easy" onion URLs. They are essentially random (hash of a key iirc). It's possible to generate random URLs until you get a prefix you like, but the time it takes increases exponentially with length of the desired prefix.

<comment><USER20> I wonder why namecoin addresses are not a part of the tor yet. Onion urls should be treated more like IPs.

<comment><USER7> It's in their works, see their proposal 279: [https://gitweb.torproject.org/torspec.git/tree/proposals/279...](https://gitweb.torproject.org/torspec.git/tree/proposals/279-naming- layer-api.txt)

As well as this blog post: [https://blog.torproject.org/cooking-onions-names- your-onions](https://blog.torproject.org/cooking-onions-names-your-onions)

See also this ticket for following the progress: [https://trac.torproject.org/projects/tor/ticket/10747](https://trac.torproject.org/projects/tor/ticket/10747)

</comment></comment></comment></comment><comment><USER21> Does anyone know why they posted this story through Medium?

<comment><USER22> TimesOpen is an engineer-driven blog. Its previous incarnation was self-hosted on a WordPress stack (separate from our main CMS), but for various reasons it was decided to re-platform.

There were many discussions before settling on Medium and alternatives were considered (such as dogfooding our own CMS). We have a lot of work in-flight to modernize and simplify our publishing stack, and the timing wasn't right to rely on internal tools to publish a new blog.

<comment><USER23> How widely is WordPress being used at NYT today? Seems like it was used a lot about five years ago but don't see it much anymore.

</comment></comment></comment><comment><USER17> Is there a search engine or other convenient discovery mechanism for Onion services?

I know DuckDuckGo has their own hidden service, but it seems that site only returns results from the regular internet, not from other hidden services.

<comment><USER24> > hidden services

I think you responded to your own question.

Besides that there are lists of onion services. Apparently there are also search services like [https://ahmia.fi/](https://ahmia.fi/)

<comment><USER25> Although there's a risk to using onion directories, since you have to trust that the hash they give you for the New York Times for example, is actually the real hash. It's easier to spoof onion hashes than domain names since domain names are more well known. You'd hopefully catch that you're connecting to nytim3s.com, not so much nytimes3xbfgra3h.onion.

<comment><USER17> EV certs can help with this to some extent. For example, the New York Times is using an EV cert with the organization name "The New York Times Company" for their hidden service. So as long as you trust the CA system, you can be certain that you're talking to a server operated by _The_ New York Times, and not just a copycat.

<comment><USER25> Yes, but EV isn't that common on Tor. How would I distinguish Dread Pirate Roberts' Silk Road from FBI's Silk Road in a Tor online directory?

<comment><USER26> Well, obviously EV is less useful [0] for services where the host's anonymity is a key part of the reason the server is on Tor.

But for services on Tor that are fine with being identified but who wish there users to be opaque to third parties it seems to have some value.

[0] without a radically different CA infrastructure which has no chance of getting preloaded into browsers.

</comment></comment></comment></comment></comment></comment><comment><USER27> Tried to show my support by subscribing over Tor, unf:

        This action is not supported over Onion yet, sorry.

Which kind of makes sense, since you were probably about to ask my CC info, but still...

</comment><comment><USER28> Err... does the tor site still have the 10 views a month for free limit? Are tor users supposed to subscribe to NYT - that will surely blow through any privacy you hope to achieve.

<comment><USER29> See this subthread [https://news.ycombinator.com/item?id=15567778](https://news.ycombinator.com/item?id=15567778)

<comment><USER28> Thanks

</comment></comment></comment><comment><USER30> I'm seeing a different page at the Tor address than at the regular address. The layout is different:

[https://www.nytimes3xbfgragh.onion/](https://www.nytimes3xbfgragh.onion/)

[https://www.nytimes.com/](https://www.nytimes.com/)

</comment><comment><USER31> What would be the advantage here?

<comment><USER32> From the /r/tor thread System33 posted a comment[0] originally by Alec Muffet explaining why Facebook set up a TOR service, which may answer some of your questions:

Why would anyone run a legal onion service?

Thanks Alec Muffett (OP) for the following summary copied from this comment

Understandably folk tend to think "Anonymity!" when talking about Tor Onions, but in rolling out the Facebook onion we established several clear benefits:

1\. better and safer experience for people accessing over Tor: no interference by exit nodes, no bandwidth-contention for exit nodes, no use of exit nodes at all.

2\. "good neighbour" \- reciprocally, popular sites can unload themselves from eating up scarce exit-node bandwidth.

3\. "a peace offering" \- people (continue to) use Facebook over Tor; 3 years ago we saw 500,000/month, more recently ~1 million. Overwhelmingly we found (through measurement and assessment) that people using Facebook over Tor were ordinary folk wanting to do ordinary things. especially in times of political crisis. Providing a metaphorical "olive branch" showed that we value their use of the site.

4\. Discretion & Trust. Onion Sites are considered to be about "Anonymity", but really they offer two more features: Discretion (eg: your employer or ISP cannot see what you are browsing, not even what site) and trust (if you access facebookcorewwwi.onion you are definitely connected to Facebook, because of the nature of Onion addressing; no DNS or CA shenanigans are applicable.)

[0]: [https://www.reddit.com/r/TOR/comments/792mfr/the_new_york_ti...](https://www.reddit.com/r/TOR/comments/792mfr/the_new_york_times_is_now_available_as_a_tor/doymov3/)

<comment><USER33> Is this mainly intended for people from non-western countries who need a channel for free speech? Because apart from that I see no point in FB offering an onion service. If anonymity, discretion and trust are what I am looking for than surely FB itself is one of the least appropriate platforms for me.

</comment></comment></comment><comment><USER34> For a publication that openly supported the Iraq war and all the suffering that entailed for innocent civilians, its kinda funny that they're suddenly all concerned about people's rights.

</comment><comment><USER35> The NYT is so pro-establishment it is probably the last site on Earth that would have its domain taken away from them.

<comment><USER30> The Times has been blocked repeatedly, maybe even semi-permanently, in China. It gets blocked in other countries too, IIRC.

In the U.S., the Times published Chelsea Manning's leaked State Dept documents, it broke the story on Hilary Clinton's email sever, it reported the Wikileaks' DNC emails for months up to the US presidential election, and now it aggressively goes after Trump. While it's imperfect, I don't see which part of the establishment it so strongly supports.

<comment><USER36> _> While it's imperfect, I don't see which part of the establishment it so strongly supports._

The State Department. NYT is vital in fabricating the history of conflicts and internal problems that have ever affected the United States.

to name a few : Syria, Iraq, Afghanistan, the War on Drugs, the Indochina wars, Cuba, Mexico, outside-of-country extradition, continual abuse and outright breaking of UN laws and sanctions, etc.

That's not even mentioning their (the NYT) history of character assassination with regards to civil rights leaders, activists, authors, speakers, and alternative thinkers.

...OR you get the Chomsky treatment, and they pretend that you don't exist for a few decades.

I didn't bother with citations, there are plenty to read through with just a cursory search engine query, but since I already invoked the name of the beast, i'll let him tell you about NYT[0].

NYT's is systematically biased in who or what it chooses to illuminate for the public to digest. Don't be surprised when they do good by you -- it's all character building -- just like this news that they're embracing tor.

Boy, aren't they just keen!

[0]Noam Chomsky: The New York Times is pure propaganda: [https://www.salon.com/2015/05/25/noam_chomsky_the_new_york_t...](https://www.salon.com/2015/05/25/noam_chomsky_the_new_york_times_is_pure_proganda_partner/)

</comment></comment></comment><comment><USER37> Not a huge fan of the NYT but this is pretty cool!

<comment><USER25> Careful, you'll cut yourself on that edge!

</comment></comment><comment><USER38> Awesome!

</comment><comment><USER39> Can someone explain... why?

<comment><USER40> From the article:

> _" Some readers choose to use Tor to access our journalism because they're > technically blocked from accessing our website; or because they worry about > local network monitoring; or because they care about online privacy; or > simply because that is the method that they prefer."_

<comment><USER33> That's still a bit of a non answer. More to the point: Why does a mainstream news outlet care about this small group of people?

<comment><USER40> What's your working definition of "mainstream news outlet"? I can't think of a reasonable one that precludes them from broadening their reach. And given their size, they are more likely to have the resources to do so.

Also, there are large populations where network monitoring and/or content restrictions are part of everyday life. The New York Times experienced this directly with respect to their iOS app in China.

[https://www.nytimes.com/2017/01/04/business/media/new- york-t...](https://www.nytimes.com/2017/01/04/business/media/new-york-times- apps-apple-china.html)

Edit to add: To turn it around, why _shouldn 't_ the NYT do this? That isn't snark: I'm interested in hearing substantial reasons for the skepticism implicit in 'pbarnes_1 original question. Granted, I haven't read _all_ of the comments for this submission, I haven't seen any that convincingly argue this isn't a useful thing.

<comment><USER33> > What's your working definition of "mainstream news outlet"?

A news outlet with a "one size fits most" attitude. That is, they offer a product which caters to people who could be described as "average". Typically companies focus their energy only on (potential) customers, not those who aren't a good fit for the product in the first place. There probably are more profit-promising people out there for the NYT than those who are somewhat crypto-nerds. They don't like clicking ads, some may even feel uneasy using typical payment methods to buy a subscription.

> Also there are large populations where network monitoring and/or content > restrictions are part of everyday life.

yeah, that's reasonable.

</comment></comment></comment></comment></comment><comment><USER41> is it still paywalled on the onion service?

</comment><comment><USER42> Ah, so disagreement with an administration is what will make everyone eventually to TOR

Nothing to hide except when the wrong guy gets in power then you feel naked

<comment><USER43> Do you _really_ think the NYT does this out of some specific fear?

And if yes, does their adoption of https in 2014[0]\ then imply that they were equally suspicious of the previous administration?

[0]: [https://open.blogs.nytimes.com/2014/11/13/embracing- https/](https://open.blogs.nytimes.com/2014/11/13/embracing-https/)

<comment><USER42> Not the NYT itself, no

</comment></comment></comment><comment><USER44> Comical attempt to give Street cred to the NYT.

<comment><USER45> Comical how? Check out their tech blog[0]. I'd venture a guess that they are the most technically adventurous news site, if not one of the more open corporations around in regards to trying new technology and writing about the experience. A lot of what they have to say is pretty interesting.

[0] - [https://open.nytimes.com/](https://open.nytimes.com/)

<comment><USER46> I agree. NYTimes has led with technical prowess the past a few years.

</comment></comment></comment><comment><USER47> So is it now "guaranteed", that TOR is secure? And how many "guarantees" does one need in order to be "guaranteed" security whilst browsing?

[...]and they provide additional guarantees that readers are connected securely to our website.[...]

<comment><USER48> Its not secure. "Everyone" knows that. Everytime a drug market is taken down or a pedophile ring is busted, the investigators from FBI always claim it was some dubious mistake from the admin whic lead to it. But we all know they have discovered a vulnurability in the TOR protocol but won't disclose it.

Safe browsing guys

//edit: if you want extra security. Launch TOR from a remote desktop. And I am not talking about the ones you buy from known VPN providers like NordicVPN or amazon web services.

<comment><USER49> I guess I'm not everyone. I'd bet that the majority of the 'busts' are due to:

a) Infiltrating chats where people are more likely to share sensitive information / trust the people they're talking to

b) Poor configurations/ setups on either the client or server (client browser bundle has noscript, but it's not on the strictest settings, js is enabled iirc)

c) Exploitation of client or server due to out of date versions, things like that

Historically I think it's always fallen into one of these cases - and not just what the FBI etc say publicly but we've seen these exploits ITW. I wouldn't be surprised if the NSA and other agencies have the power to deanonymize TOR users but if it were trivial why is the majority of TOR traffic still going towards illegal content? Last I read (a paper a year ago) TOR is still primarily all about drugs, followed by child pornography (mostly drugs though iirc). If they can track all of these people by breaking TOR completely... why don't they?

<comment><USER50> ^ This.

Remember, Silk Road was finally found and taken down because Ross Ulbrich messed up his OpSec on a Stack Overflow question.

<comment><USER51> Thats really interesting, does anyone have a link to an explanation about this?

<comment><USER50> Wow. That was 4 years ago?

Here's a Reddit discussion: [https://www.reddit.com/r/webdev/comments/1nln17/the_stackove...](https://www.reddit.com/r/webdev/comments/1nln17/the_stackoverflow_question_that_busted_the_silk/)

Basically, he posted to stack Overflow using his own name and email address with code that was Silk Road was using. He quickly changed his username, but it was too late.</comment></comment></comment></comment></comment></comment>


Microsoft blatantly hung up on us - so this is how to crash IE8 - <AUTHOR> http://www.reddit.com/r/programming/comments/aqtvx/microsoft_blatantly_hung_up_on_us_so_this_is_how/ <comment><USER2> Is a chunk of HTML and javascript that crashes IE rare? Unless my memory is faulty, I feel like we've come across code that crashes various IE versions a dozen times in the last few years. Reporting these bugs to Microsoft is practically unimaginable to me -- I wouldn't know where to start.

<comment><USER3> Here's where you'd start: <http://connect.microsoft.com/>

</comment></comment><comment><USER4> In the past week, I removed the last active (and crashing) Windows OS from a production machine and installed Ubuntu. Our Windows development lives on in sandboxes. We're liking Ubuntu.

</comment><comment><USER5> I doubt that "Microsoft blatantly hung up" on them. MS have their issues, but rogue dickishness hasn't been one of them for a long time. (I mean among ordinary employees; their CEO is perhaps a different story.) They've turned into a large, professional, bland organization, which causes many problems, but not the type of thing the OP (whose shoulder appears to me to have a chip on it) is alleging.

I'm not saying this as any fan of MS. As far as I'm concerned, they've brought all their problems on themselves with egregious past behavior. (Reminds me of what Martin Amis said to Salman Rushdie after the fatwa: "It could have happened to a nicer guy.") But that doesn't change the fact that the anti-MS crowd behaves far more childishly than MS does.

</comment><comment><USER6> Looks like another Microsoft employee on Reddit is looking into this ... but I'll followup on this too.

<comment><USER7> I think the real problem in this instance isn't that IE crashes. We've all seen, used, and in most cases, written buggy code. Large systems are hard to get right, we all know that.

The problem is how hard it is to report such problems and get taken seriously. I, for one, have spent hours trying to tell someone that their code/system/service is severely broken, and yet repeatedly get ignored. I often don't know if this is because they already know, or whether they don't care. The problem is trying to report it, and getting ignored.

Here's a crazy idea. Have an on-line bug reporting service that includes a CAPTCHA, but the CAPTCHA requires that you write a small piece of code, or solve a problem, or something techie. Very, very few reports of problems will come in via such a portal, but at least you know they can be taken reasonably seriously.

<comment><USER8> The usual CAPTCHA is an id from a vendor support contract.

<comment><USER9> Which is of course a terrible idea when you're trying to report a problem that has or could have security relevance. I'm definitely not going to pay for support just so I can report security bugs to Microsoft.

</comment></comment></comment></comment><comment><USER10> ...because msie hasn't had enough bad press this week.

i would be laughing but half our install base is ie6 and i doubt that this weeks events will register with anyone in a position to change that :(

<comment><USER11> It would seem the next step up from all those upgrade IE6 banners is just to crash the entire browser. If enough sites did it then using IE6 would become untenable.

It seems a bit drastic to crash people's software intentionally but you could argue that you're doing them a favor.

</comment></comment><comment><USER12> It's probably more efficient to list out HTML fragments that _don't_ crash IE.

<comment><USER13> seems they've finally fixed the following bug (at least in my updated version of IE7):

      for(var p in document.write) document.write(p);

</comment></comment><comment><USER14> I tried it on IE 8 on Windows 7 . Didn't crash.

<comment><USER15> To his defence, he _did_ specify it was for XP only.</comment></comment>


Your Users Won't Read - <AUTHOR> http://www.w2lessons.com/2012/01/your-users-wont-read.html <comment><USER2> I've building my own site for the last 5 months now and I've been knee deep in usability like this. It always comes down to what is the easiest path you can possibly give to your users.

I'd do away with the whole extra click of making someone 'accept' or 'decline' the invite. Just have the two buttons in the dialog, on the first screen. Don't make me read, then click, then read again, then click. There is no logical reason for that extra step at all.

The button on the right should be the 'continue' or 'ok' button and the one on the left should be the 'cancel' button. Don't use text for 'cancel' or 'decline', just make them buttons. The buttons should be right aligned at the bottom of the text. This is how the user expects things to be based on UX experience of their operating system, don't confuse users by changing it up.

I just spent 5 minutes in Balsamiq mocking something up for you [1]. I'm not super happy with the decline button, I might play around with it in different areas (or ideally get rid of it all together). The point being that there is no need for the 'accept' step, since they aren't accepting anything, they are signing in or creating an account.

By the way, for my site, we got ride of the whole create an account process entirely. We just have sign in. User clicks sign in and they have the option of using their FB account (with the bare minimal permissions) or using a BrowserID account (which only requires an email and password).

Keep it as simple as possible.

[1] [https://img.skitch.com/20120130-dh9hf6mtt8wwemtgcjy7rq16t2.j...](https://img.skitch.com/20120130-dh9hf6mtt8wwemtgcjy7rq16t2.jpg)

Good luck.

</comment><comment><USER3> I work at a movie theater. We have four pairs of front doors, all of which open outwards. One pair has handles; these are the doors which should be used to enter the building. We sell tickets outside, and tear tickets at the door; if both these doors are open, people come in three or four at a time and we can't get to them and take their tickets. So, one of these two doors is always locked, and the entrance door which is not locked has a sign on it that says "Please use this door."

A nontrivial number of people will come up, read the sign, and promptly try to open the OTHER door, see that it's locked, and then walk away to try and find the "other door" - generally trying to push open the out doors. As it turns out, they all read the sign as saying "Please use other door".

(Occasionally they'll try to claim that the sign is wrong. There's a certain schadenfreude in the looks on their faces when I convince them to reread it more carefully.)

So, we removed the handle for the door that's always locked, and took down the "Please use this door" sign. Now people just walk along the out doors, pushing on them to try and find the one that'll open.

<comment><USER4> Putting a 'Please use this door' on a door that is open is redundant. That is why people 'believed' that the sign said 'Please use other door.'

If you were in front of the door that is open, why say 'Please use this door.' They will. You don't have to say so. People generally do not walk up to the door they do not tend to use. Hence why they assumed that the sign said 'Please use other door', since that is 1) what is most often on the doors and 2) it's illogical to have a confirmatory sign on the open door.

</comment></comment><comment><USER5> it's not so much that users won't read, it's that they read as little as they think they can get away with to make a decision. the best way to solve this problem is to take the decisions away from the user. instead of asking if they want to sign in, give them a username/password form. most of your users will probably be able to fill out the form. no decisions, no reading necessary, no problems.

the users that aren't able to fill out the form they will be unable to continue until they read. they will start looking for the "sign up" button. make it big and obvious for them. still, nobody has made any decisions. the user takes the only path available to them.

</comment><comment><USER6> experience in support:

'The software isn't performing the analysis'

"Okay, what does the dialogue box say"

'The data file is corrupted' (we have no such dialog box)

"Hrm, I haven't seen that box before, can you read it out word-for-word to me?"

'The. Data. File. Is. Corrupted'.

"Hrm, I've not heard that before, could you please spell out the words letter- by-letter so I can get it exactly right for the developers to look at?"

'Sure: Y-o-u-r s-e-t-t-i-n-g-s a-r-e n-o-t c-o-n-f...'

Even when specifically asked to read the message out word-for-word, endusers find a way to screw it up.

<comment><USER7> Send that to NotAlwaysRight, now.

</comment></comment><comment><USER8> 4 or 5 years ago I made a registration workflow for a event I was working with as part of a freelance gig. We had a giant bolded text link, something like 24 points, that said "Click Here to Register," right on the front page above the fold.

I got several emails from users who asked me "How do I register? I looked all over the front page and found nothing."

In hindsight, I wonder if maybe I needed to make it look like a button, or if these particular people were beyond saving and wouldn't have bothered to read the text on the button anyway.

<comment><USER9> The industry has trained people for a decade that primary calls to action look like buttons. People scan for this as a learned behavior, because scanning accomplishes their goals faster (true for most HNers), they don't enjoy reading, they can't read well, or they've learned by painful experience that words on a computer screen are likely scary gibberish like "screen resolution" and "defragment" and you should just click the blue thing in the bottom left corner followed by the blue E so you can get to your Googles.

<comment><USER10> On top of this, users have also been trained to ignore anything that looks like a banner or ad. Sometimes giant text just looks like something meant to be ignored.

<comment><USER7> You should see this website:

<http://airforcefcu.com/>

<comment><USER8> I didn't even need to expend any mental effort to ignore the large advertisement-shaped blocks there.

AdBlock Plus did it for me, and delivered me a blank page.

<comment><USER7> Apparently with no scripting, the middle of the page does not load.

</comment></comment></comment></comment></comment></comment><comment><USER11> This article comes to the wrong conclusion. Removing the dialog wasn't what stopped the confusion — changing the text on the buttons did.

Your users will read — but only enough to feel they have an understanding of a situation before they take action.

<comment><USER4> I believe that the key word here is _feel they understand_. That does not necessarily mean that they _actually_ understand.

</comment></comment><comment><USER12> Why is this a surprise. Reading is sequential. The primary way is which we consume information is not. Our eyes capture a bit of everything, left and right, up and down, then our brain gives it a meaning. Reading requires us to follow a specific path, and I am forced to believe it is harder on the brain.

</comment><comment><USER13> A related study into how long people spend reading words on a web page found that on average people only read 20-28% of the text. For 1000 words, the average visit duration was less than 70 seconds.

<http://www.useit.com/alertbox/percent-text-read.html>

I read quite a lot of text online, and I certainly have a different style of reading a web page versus reading a book. I'd be fascinated to know how efficient scanning is after years of practice online, in terms of information consumed that you're able to recall. 28% is surely too low for adequate comprehension, though.

</comment><comment><USER14> This is Apple's HIG stuff, from the 1990's.

</comment><comment><USER15> In my experience. It's Murphy's Law adapted to reading.

If you pour a lot of care and attention in to some copy or instructions. They won't even not read it, they will flagrantly disregard it.

If you fluff up some filler text to fit a space, they will go through it with a fine tooth comb and hold you to the fire over it.

In my experience, you can't win.

</comment><comment><USER16> If I ever get popup boxes on sites (or Windows), it becomes instinct for me to click the X or the button that says 'No', because its in the way of what I was doing and I don't care about whatever it has to say (if I wasn't expecting it).

</comment><comment><USER17> "Don't make me think" is a pretty good book on this topic.

</comment><comment><USER18> This is really good information. We did do some level of usability testing but we still rely on content for important messaging.</comment>


Falsehoods Programmers Believe About Hiring - <AUTHOR> https://shubhamjain.co/2018/06/07/falsehoods-programmers-believe-about-hiring/ <comment><USER2> Some of these are wrong. Number 2 is an example. A company with a req out specifying that it wants n years of Angular experience won't countenance you if you don't have n years of Angular experience. For unpopular tools (e.g., MUMPS, COBOL) they might be willing to onramp complete neophytes just to avoid paying the high prices the dwindling number of experts can command. But for in-demand languages and frameworks, the company can always hire, and will always prefer, someone who can "hit the ground running". If a company is flexible about experience, they will say so by not mentioning the exact tech stack used and/or by saying something like "Need 5+ years of object-oriented (C++, Java, C#, etc.) experiencr".

Number 3 is spot on. You can meet all the requirements, but if you don't have the "soft skills" and are not a cultural fit, you will NOT be hired. Introverts may as well find another line of work, especially since you will in most cases be working cheek-by-jowl with your co-workers at long noisy tables, individual desks having followed individual offices into the dustbin of office-layout history.

My parents are trying to get a dog. Back in the day they could go over to a friend's house and pick a puppy out of a crate for free. Today the easiest place to get a dog is at a rescue shelter -- and they charge high fees (still lower than breeders) and make you fill out long application forms. They can do this because they have way more prospective dog owners than they have dogs. The shelter is looking for an ideal "forever home" for each dog, and the list is long enough to where they probably donpt have to countenance anyone less than ideal. They also face stiff liability if they let a dog fall into substantially less than ideal hands.

It's the same with tech jobs, although if adopting a dog were really like getting a tech job, the dog shelter would give you a week to build a bespoke doghouse as part of the application process, evaluate it for safety and comfort, and still give the dog to someone else leaving you with no dog to put in the doghouse you built. But the principle is the same: companies are awash in candidates and can afford to be as picky as they need to be to put together their special-snowflake software teams.

<comment><USER3> > Some of these are wrong. Number 2 is an example. A company with a req out > specifying that it wants n years of Angular experience won't countenance you > if you don't have n years of Angular experience.

My experience, both hiring and being hired, is the opposite. I have found that lists of required technologies are actually mild suggestions. We're probably both right, which implies that we're moving in interestingly different bubbles.

> Introverts may as well find another line of work, especially since you will > in most cases be working cheek-by-jowl with your co-workers at long noisy > tables

Again, our experience is completely different. I have always had my own desk.

<comment><USER4> > My experience, both hiring and being hired, is the opposite.

Same.

> I have always had my own desk.

Outside of your headphones on at your desk, you still need to be more social during work hours than it used to be (30 years ago). Meetings are a thing, standups are a thing. Having your own desk doesn't preclude this. What he means by "introvert" is an important question.

<comment><USER5> Not ncessarily. There are companies with private offices like the old days, even if they're not the majority any more. There are companies where the atmosphere isn't meant to be all 'social' and sales people aren't sat in the same room as the programmers.

And there are tons of companies who don't have many meetings, standups, etc. Hell, there are tons who don't make their programmers go to any.

Just got to look around, maybe at smaller or less 'modern' companies if you want that sort of environment.

</comment></comment></comment></comment><comment><USER6> From my experience, 11 is not a myth. I'm trying to change industry and so I have no previous relevant experience. So the only times when I've actually got interviews was because I sent out ~100 CVs. Understanding the company has never got me an interview.

</comment><comment><USER7> _> > 3\. Technical skills matter above everything. -- More than programming proficiency, what is valued more is the ability to communicate clearly, to work well with the team, and to understand the business goals._

For sure! But before we go any further, please implement binary heap and longest common subsequence in C++ on the whiteboard.

<comment><USER8> I haven't had the 'pleasure' of that kind of technical interview, so I can't speak to that.

To the point of #3 I'm believing it more and more. I'm writing less code as I go on, but spending more time talking to people trying to tease out why people want things the way they say they want them.

</comment></comment><comment><USER5> Nice list. I especially agree with this point:

> 1\. Contribution to open-source/having Github projects is an indispensable > requirement.

Not everyone is a hobbyist who treats programming like the centre of their whole life, and many great programmers see it as a job like anything else.

And would like to add a related falsehood: not every programmer has a portfolio/lengthy list of work examples to show off.

Many do, but keep in mind that some jobs are under NDA, some jobs involve internal systems and some jobs simply involve the sites/programs worked on never going live.

In these cases, someone could work for years and have little to show for it.

</comment><comment><USER9> Number 4 is ambiguous - assuming you're competent nepotism gets you way closer to getting a job than almost anything else. Basically nepotism is a very effective shortcut to an interview for a position, alongside an initial bias in your favor (people trust their competent coworkers), and for large high profile companies your biggest problem is likely to be getting through the initial resume filtering.

Obviously this only gets you so far - I don't want to say that 4 is /wrong/ as generally for large companies you can't just get your friend (for instance) a job, but you do get a huge leg up on any potential competition.</comment>


Updates to Cloud Speech-to-Text and general availability of Cloud Text-to-Speech - <AUTHOR> https://cloud.google.com/blog/products/ai-machine-learning/announcing-updates-to-cloud-speech-to-text-and-general-availability-of-cloud-text-to-speech <comment><USER2> Google's speech-to-text is powerful, but I'd be pretty skeptical about tying a project to it given how services like Maps have been handled recently. There are companies like Mozilla trying to build more open solutions, but to the best of my knowledge (please correct me if I'm wrong) any pre-trained services Mozilla offers will also still involve you connecting to their servers.

Maybe I'm just paranoid, but I just can't imagine using a speech-to-text system for anything serious that I can't self-host. It feels like we've just seen example and example over and over again why this is a bad idea -- to the point that when I hear a company like Google talk about a locked-down cloud platform as "making AI accessible to everyone" it feels almost dishonest.

Especially once we start talking about text-to-speech. We can already do a lot of that locally - we should be pretty hesitant about coupling new text-to- speech techniques to strategies that require us to move logic away from local devices onto the cloud.

<comment><USER3> Mozilla's DeepSpeech is available as an offline pre-trained system for English.

The quality is far below Google's speech API as the model is somewhat out of date and more importantly the training data set is much smaller and less general.

The best pretrained speech to text model I've seen is from Baidu's DeepSpeech 2 repository. They provide pretrained models for English and Chinese based on their internal data. The quality is astonishingly good!

Edit: both of these models can be comfortably run in real-time on a desktop. At Arm I recently worked on a project to run <5% word error rate models in real-time on a mobile phone.

<comment> dan0- Any links to Baidu's DeepSpeech 2 pretrained model? I'm likely looking right past it, spent the past few days playing around with Mozilla DeepSpeech and their pretrained model, building a simple little API and webpags to feed it files: [https://github.com/AccelerateNetworks/DeepSpeech_Frontend](https://github.com/AccelerateNetworks/DeepSpeech_Frontend)

I really want to put DeepSpeech 2 with Baidu's model up against Mozilla's model and see which is better, seems like it could be quite interesting!

<comment><USER4> [https://github.com/PaddlePaddle/DeepSpeech#released- models](https://github.com/PaddlePaddle/DeepSpeech#released-models)

<comment> dan0- Any chance there is a mirror of the BaiduEN8k Model that isn't in China? I'm getting about 20KB/s when trying to download it, and using a DNS override to 184.108.40.206 for cloud.dlnel.org gets me what looks to be a partial file at slightly less than 200MB in size.

</comment></comment></comment></comment></comment><comment><USER5> If you want to build open-source, 100% on-device and private-by-design Voice assistants which can run on a Raspberry Pi, you can take a look at what we are building at [https://snips.ai](https://snips.ai) (disclaimer: I'm a co- founder)

We want to make it possible to have embedded assistants in all your objects which preserve people privacy, and do this with open-source: [https://medium.com/snips-ai/an-introduction-to-snips-nlu- the...](https://medium.com/snips-ai/an-introduction-to-snips-nlu-the-open- source-library-behind-snips-embedded-voice-platform-b12b1a60a41a)

Take a look at our blog to get started in 1h: [https://medium.com/snips- ai/voice-controlled-lights-with-a-r...](https://medium.com/snips-ai/voice- controlled-lights-with-a-raspberry-pi-and-snips-822e53d7ede6)

It also binds in popular Home automation platforms like Home Assistant and the Jeedom platform

<comment><USER6> Hey I've been working on a chatbot project lately and I came across semantic parsing ([http://nbviewer.jupyter.org/github/wcmac/sippycup/blob/maste...](http://nbviewer.jupyter.org/github/wcmac/sippycup/blob/master/sippycup- unit-0.ipynb)) . Even Though we didn't use it , I found it to be more robust and capable to handle very complicated utterances. The main disadvantage of using a grammar based approach is that it's hard to extend the grammar to incorporate new intents and also creating a grammar is time consuming .

But the approach used in various NLU services such as Snips and RASA is much more simpler. This can work fine for easy queries but once we start asking complicated questions using conjunctions and disjunctions these systems start becoming brittle. If they try to capture all the possible logical forms through intents they'll need an exponential number of intents and also a huge dataset to capture all the intents.

I would like to know your take on using a grammar based semantic parsing.

</comment></comment><comment><USER7> Anyone know how this relates to the Web Speech API[1]?

Will they ship it with chrome to replace the existing speech synthesis api? (I believe right now it just uses whatever voices are available to the device or OS but chrome can fallback to a serverside voice)

[1] [https://developer.mozilla.org/en- US/docs/Web/API/Web_Speech_...](https://developer.mozilla.org/en- US/docs/Web/API/Web_Speech_API)

[2] [https://developer.mozilla.org/en- US/docs/Web/API/SpeechSynth...](https://developer.mozilla.org/en- US/docs/Web/API/SpeechSynthesis)

<comment><USER8> pure guess: Mozilla will use their DeepSpeech model for that soon

</comment></comment><comment><USER9> On my machine the demo page doesn't work at [https://cloud.google.com/text-to- speech/](https://cloud.google.com/text-to-speech/)

I tried to get Google to fix this a long time ago and it seemed to work for a while after being offline for weeks.

<comment><USER10> Works for me. Whats your machine like?

<comment><USER9> Sadly it is like this:

OSX 10.13

Model Name: Mac mini Model Identifier: Macmini7,1 Processor Name: Intel Core i5 Processor Speed: 2.6 GHz Number of Processors: 1 Total Number of Cores: 2 L2 Cache (per Core): 256 KB L3 Cache: 3 MB Memory: 16 GB

</comment></comment></comment><comment><USER11> Anyone knows how this compare to Dragon NaturallySpeaking?

<comment><USER8> Google is orders of magnitudes better on trendy words and phrases etc. Just try Siri vs Google.

<comment><USER12> Is Siri done by nuance?

<comment><USER8> Yes, much to the pain of Apple

<comment><USER12> You have any links to where that has caused issues? I've heard more people personally like Siri than Google Assistant. Of course, I have my own love/hate with Alexa. Haven't used the others.

</comment></comment></comment></comment></comment><comment><USER13> A friend is working for a newspaper. He records interviews.

We tried all the software we could find to turn the recording (Dutch) into text but there is nothing that gives a helpful result.

I know that a recording-to-text is different than speech-to-text but even when I use OK Google most of the time the results are horrible.

So after all those years I am still a little skeptical.

<comment><USER14> That's why all the hype about DL is so irritating. Yes, it allowed us to make enormous progress in certain fields. No, it's nowhere near usable in others. So why pretend it is?

Just one example from the preface to Chollet's "Deep Learning with Python":

> If you've picked up this book, you're probably aware of the extraordinary > progress that deep learning has represented for the field of artificial > intelligence in the recent past. In a mere five years, we've gone from near- > unusable image recognition and speech transcription, to superhuman > performance on these tasks.

Come on, speech to text is still far from usable unless in a very limited scenarios. Why pretend it's different?

<comment><USER8> in most languages google ASR works shockingly well.

</comment></comment></comment><comment><USER15> I really want a free software implementation of Text-To-Speech and Speech-To- Text that runs on local computer without network.

I don't trust those cloud-based solutions.

</comment><comment><USER16> Speech-to-text is great. I'm using it to transcribe voicemails in a product I'm building.

</comment><comment><USER17> I'd love to read what this page has to say, but somehow it managed to load with some click-grabbing Gawker-type theme? Half expecting a "100 Surprising Cloud Facts, And Number 12 Will Shock You" link to appear in that inexcusable waste of space along the bottom. [https://i.imgur.com/Uk1udNo.jpg](https://i.imgur.com/Uk1udNo.jpg)</comment>


Tails 2.0 is out - <AUTHOR> https://tails.boum.org/news/version_2.0/index.en.html <comment><USER2> _Tor Browser 5.5 introduces protection against fingerprinting but due to an oversight it is not enabled in Tails 2.0. However, this is not so bad for Tails users since each Tails system has the same fonts installed, and hence will look identical, so this only means that it 's easy to distinguish whether a user of Tor Browser 5.5 uses Tails or not. That is already easy given that Tails has the AdBlock Plus extension enabled, unlike the normal Tor Browser._

I wonder why they opted to preload it with AdBlock Plus instead of uBlock Origin. I'm sure gorhill would certainly give his blessing, and by all measurements it is just as effective with way less overhead.

Heck, they could go one step further and preload it with a uBlock Origin profile on a paranoid mode that proactively disables all JavaScript (last I remember using Tor I had to manually disable Javascript in the Firefox config).

<comment><USER3> I use AdBlock Plus because of the Element Hiding Helper addon, which lets me easily and perpetually hide whatever DOM element I decide is annoying me or taking up unnecessary space. To my knowledge there is no similar addon for uBlock Origin.

<comment><USER4> That is built in uBlock Origin.

Click the eyedropper tool "enter element picker mode" [https://www.dropbox.com/s/niy881lyaca4zmx/Screenshot%202016-...](https://www.dropbox.com/s/niy881lyaca4zmx/Screenshot%202016-01-28%2018.14.09.PNG?dl=0)

<comment><USER3> Hey, thanks!

</comment></comment></comment></comment><comment><USER5> I appreciate a lot of the work that the Tails guys do - but for a privacy and security focused distribution there are far too many included apps for my liking[1], which increases the attack surface. LibreOffice, Gimp and Audacity are just some of the apps - and many have a horrible history of vulnerabilities[2].

When Tails has had vulnerabilities it is often with one of these included apps[6].

The browser isn't sanboxed (it's in progress[3]), and the machine is still directly connected to the internet, so you're a single Firefox vulnerability and a drive-by download away from being deanonymized.

It is also a shame that both OS X and Windows make it difficult to write an OS to an USB stick and boot from it - the install requires an intermediary Linux OS either on DVD or USB, which a lot of users won't get by.

For a different approach, see Whonix[4] - a virtual machine based approach with an isolating proxy (very popular setup amongst black hats) and Qubes OS[4] which is built on Xen and runs processes in separate VM's

[1] [https://tails.boum.org/doc/about/features/index.en.html](https://tails.boum.org/doc/about/features/index.en.html)

[2] [https://www.cvedetails.com/vulnerability- list/vendor_id-1143...](https://www.cvedetails.com/vulnerability- list/vendor_id-11439/product_id-21008/Libreoffice-Libreoffice.html)

[3] [https://wiki.mozilla.org/Security/Sandbox](https://wiki.mozilla.org/Security/Sandbox)

[4] [https://www.whonix.org/](https://www.whonix.org/)

[5] [https://www.qubes-os.org/](https://www.qubes-os.org/)

[6] [https://blog.exodusintel.com/2014/07/23/silverbullets_and_fa...](https://blog.exodusintel.com/2014/07/23/silverbullets_and_fairytails/)

<comment><USER6> The Whonix approach is very reasonable. Tails must be considered inadequate when used as a complete solution as long as the browser isn't fully isolated from the Tor underlay.

<comment><USER7> >Tails must be considered inadequate

Tails is significantly more secure than the common practice of running the Tor Browser Bundle on a Windows OS.

<comment><USER5> I built a custom VMWare install of Windows Embedded (well, they're all custom) running just Chromium. I think it's pretty secure - the footprint is tiny, I was actually more concerned about switching off some of the fancier features of Chromium (such as Canvas and WebGL).

In theory it would make an excellent thin client to use with an OpenBSD isolating proxy - i'm actually curious to hear what others would think about using embedded Windows (XP or 8 or 10) in this way.

<comment><USER8> A proxy cannot anonymize encrypted traffic.

<comment><USER5> Isolating proxy:

[https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWT...](https://trac.torproject.org/projects/tor/wiki/doc/TorifyHOWTO/IsolatingProxy)

meaning the only way to route out is to proxy via Tor. IMO it's the only safe way to run Tor and remain anonymous.

<comment><USER8> That only tunnels traffic through Tor, right?

If the browser leaks identifying client information through HTTPS or other encrypted protocols, the proxy (torify) will not be able to help. That is why Tor Browser is important.

<comment><USER5> yep, the way it is setup is you create a private network in VMWare, the proxy/router box has a live IP address on one end and is running a DHCP server on the private network. The client VM's connect to the Tor daemon on the proxy/router using SOCKS or HTTP

I don't use torify or anything else - if the app doesn't support SOCKS or HTTP then I don't use it. Any browser leaks will just hit a wall against the router VM.

It's the whonix architecture - except I use my own router (wasn't comfortable with whonix's 1.6GB+ router) and client.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Always been puzzled as to why the ISO release is provided by HTTP and not HTTPS; possible it doesn't make a difference, but if so, it's not clear why.

<comment><USER10> You can also DL the ISO via bittorrent, which has some additional consistency checks.

[https://tails.boum.org/torrents/files/tails-i386-2.0.torrent](https://tails.boum.org/torrents/files/tails-i386-2.0.torrent)

<comment><USER9> Right, though my understanding is Tails' and TOR's position are not to torrent using either system: [https://labs.riseup.net/code/issues/5991](https://labs.riseup.net/code/issues/5991)

^^ given that, it is to me just as puzzling that they provide a torrent as it is for failing to use HTTPS by default for file transfers.

</comment></comment></comment><comment><USER11> I'm sure I'm not first to question this, but if you download Tails or Tor browser or whatever, wouldn't that be sort of obvious? I mean it leaves traces. Then if you only use it to do something specific be it chat with friends, browse for porn, take part is activism or to buy illegal products for example wouldn't it be easy to see that: your computer went offline, then something new (Tails) went up, took anonymous connection to somewhere and then X happened, then Tails went away and your main OS/machine went back up.

My main "inspiration" here is the fake bomb threat by the college kid to get out of mid terms, just before the email about the bomb was sent his IP downloaded Tor bundle. The service he was using also had the schools IP or something so administration could see it was sent from inside the school, but I think that is still valid concern. This kind of meta data about your actions can leak just as much information as actually seeing what you are doing.

My question therefor would be: should more people use Tails as their "daily driver"? Would that make it more anonymous/private for the people like whistle blowers? My only idea at the moment would be to pay for two separate trusted VPN provider (don't know how you would vet that trustworthiness) with bitcoin, to keep your anonymity/privacy with them as well. Then pipe all your traffic through one of the VPNs all the time. Then when you need to use Tor, you would simply pipe it through that same VPN when you would emerge with rest of the clients from same point and then pipe your Tor traffic through the secondary VPN. This way you would still get the benefits of encrypted tunnels all the way through with benefit of Tors anonymizing and it might not be so obvious you are browsing Tor to your ISP or whatever.

Maybe I'm thinking this is harder than it actually is

<comment><USER5> First, Harvard bomb kid was caught because of some decent sysadmins ran good network analysis and after receiving a bomb threat that was received from Tor saw that there was only a single student on the entire network that was running Tor.

ISP's or network providers know if you're running Tor, when you're online and when you're active (it has been used in criminal cases to link real people to online aliases)

Someone else in this thread pointed out that the download points for Tails are all HTTP - so you can't find it and download it anonymously.

The way to do it would be to find an HTTPS mirror (avoiding search engines) or a public terminal.

IMO you shouldn't use Tails as your personal machine. This isn't a technical decision more a question of OPSEC policy. The key to anonymity is compartmentalization - the concept of creating, maintaining and then isolating your different identities.

Your real identity will continue to use your computer, your phone number, your internet connection, etc. It might tighten up some privacy leaks. Your anonymous identity (which may have a name) will use Tor in a virtual machine as a gateway and Linux in another virtual machine as a client, or it will boot into Tails. The anonymous identity using Tor has nothing in common with the real identity that can be linked together by a passive or active attacker.

For ex. your anon identity is doing anonymous stuff on anonymous online markets, but then you use the same Tails session to login to your personal Gmail. You've just been de-anonymized. Don't share anything between the two identities (having the same interests, typing style, etc. to name a few) as that would tie an anonymous identity to a real one.

With this in mind, Tails is perfect for the use case of 'I need to do some anonymous stuff with my anonymous identity and then get back' which is exactly how a lot of journalists, black hats, etc. use it. The more 'comfortable' Tails is with features and programs the more likely you are to hang around and do something that will de-anonymize you :)

<comment><USER12> Seems you can download via bittorrent as well? [1]

BTW, if you download a file of 1.1 GB from boum.org then the size of the download already pretty much gives away that you are downloading tails.. So https does not give you anonymous downloads, it gives you an increased certainty of origin. But as you should verify the signature instead (which is served over https)[2] I think it is fine to download via http.

[1] [https://tails.boum.org/install/mac/dvd/index.en.html?overrid...](https://tails.boum.org/install/mac/dvd/index.en.html?override=firefox)

[2] [https://tails.boum.org/download/index.en.html#index2h1](https://tails.boum.org/download/index.en.html#index2h1)

</comment></comment></comment><comment><USER13> Hmm inclusion/switch to systemd on something that purports to be a 'secure' OS for private browsing seems counter-intuitive.

<comment><USER14> \- the tails project lacks the manpower take a different path than its debian mothership

\- the devs don't seem to be bothered by increasing their attack surface with systemd

\- systemd makes life easier when building a distribution, so the tails-devs like it (not only because they are lacking manpower)

\- sure you got to be a bit paranoid when working on this kind of project, but tails doesn't seem to be a very welcoming environment for contributors

follow tails irc / the mailinglist for a while to get your own picture and have a look at Whonix/Qubes for more security focused alternatives

<comment><USER15> >systemd makes life easier when building a distribution

Can you elaborate on this? I found that it mattered more what live-cd system an upstream distro used (e.g. dracut vs Debian's older tools)

<comment><USER16> It think its about how much systemd comes with.

Init, session tracking, DNS client, DHCP client, etc etc etc.

</comment></comment></comment></comment><comment><USER17> Firefox refuses to let me look at this page because of a certificate problem.

Not to go off on a rant, but this is what the "everyone must use https because we said so" edict is going to cause - it's not enough you use https, it has to be the right kind of https that involves a third party issuer of certs.

Can anyone fix that issue or link to a different page please?

<comment><USER18> > Firefox refuses to let me look at this page because of a certificate > problem.

Me too, but I know why: my employer's proxy MITMs any SSL connections whose certificate authority it does not recognize as bona fide. Quite aggravating - but a very nice tool to explain SSL MITM to users... There's always a silver lining !

<comment><USER19> > whose certificate authority it does not recognize as bona fide

That's a very strange criteria; do you mean that anything that _would_ have been a certificate error gets MITMed instead, rather than rejected? Very strange.

<comment><USER18> Not just the self-signed ones - also some others... I wonder what the whitelist is. The proxy is the infamous McAfee Web Gateway - I don't know if the list is user-maintained or supplied by the vendor.

</comment></comment></comment></comment><comment><USER20> How secure is this os?

</comment><comment> awinter-py Think twice before clicking this link. A bunch of non-crazy newspapers have reported that merely reading about privacy tools (tails & tor) will make you a link in the NSA surveillance graph.

<comment><USER21> Which is why you should be using Tor to read it. You shouldn't accept someone's attempt to subvert your right to the freedom to read. Fear tactics like that shouldn't be accepted. Besides, everyone is already in NSA's database. Looking up Tor just adds more data that can be correlated with you later. On the plus side, if you then go on to use Tor, that's the last piece of data that can be correlated with you (assuming good enough opsec).

EDIT: As I send this, the app I'm using (Materialistic) isn't able to access the HN API when I'm using Orbot with transparent proxying. That's really annoying.

<comment> awinter-py I'm not sure tracking privacy-seekers is a fear tactic. It may have more to do with consolidating bureaucratic power -- the more an agency can collect, the more convincing it can be when it asks congress for money.

TAILS solves the problem of your individual privacy, but if you care about privacy in general you need to engage politically. Increasing TAILS use without increasing letters to congress increases the odds of anti-privacy legislation.</comment></comment></comment>


The case against checked exceptions - <AUTHOR> http://stackoverflow.com/questions/613954/the-case-against-checked-exceptions <comment><USER2> The arguments here seem to be around whether APIs need to declare the exceptions they throw or not.

However it seems pretty easy to infer what exceptions can be thrown in a static language, so why not let this be handled by tooling such as an IDE that can simply tell you what exceptions are thrown by a given call without requiring all the code in the call chain to care.

Or why not let people opt-in to checked exceptions at functions where they would actually want to do something like present a user with a message?</comment>


What a lot of people get wrong about the 1994 McDonald's hot coffee lawsuit - <AUTHOR> http://www.cnbc.com/2016/12/17/what-a-lot-of-people-get-wrong-about-the-infamous-1994-mcdonalds-hot-coffee-lawsuit.html <comment><USER2> This is a very light treatment of an important case. It didn't go into the extensive surgery she had, and that her case wasn't for $20K, it was just to pay for her medical expenses.

Also, though maybe not important in this article, was the logic behind the jury's award. They placed the award at 2 days worth of McD's nationwide coffee sales.

But I am glad that they did mention the other 700+ suits filed against McDs, but they should have gone into a little more depth about how McDs used its extensive legal department to squash those complaints. A practice that still continues today.

Edit: And for more interesting reads, check out the Stella Awards site. Now defunct, it was devoted to finding _really_ stupid law suits, and debunking urban legend law suits. The quoted aim was to show that there is a real issue with US law suits, that doesn't need fake "I microwaved my poodle because the instructions didn't let me know that was bad" to let people know there is an issue.

I teach lawyers English, and one of my more fun classes is mixing up a bunch of true and fake lawsuits and watching them try to figure out which is which.

Pro-Tip: The more ridiculous sounding ones are actually real.

Case in point - a couple who lost their 2 year old in a lawnmower accident at day care found out that the day care only had a $100K insurance policy. So they dropped the case against the day care center and sued the manufacturer of the lawn mower.

There was a safety feature that was invented 16 years after the mower was built that the mower didn't have. No recall statement or after action was specified by authorities. The jury awarded the couple a $2M award.

<comment><USER3> For me the question isn't about McDonald's being rigid and stubborn and refusing to pay medical bills for one of their customers. It's "the right thing to do".

On the other hand, coffee is hot. Coffee aficionados might quibble on the proper temperature for coffee --but the temp McDonald's served the coffee was not "wrong".

So, I could see them found guilty of providing an inadequate vessel for the coffee .. but she burnt herself trying to open the cup and adding sweetener, or something to that effect. How is that the company's fault?

Granted, if you see one of your customers accidentally hurt themselves, the humane thing is to help them --but how was McD guilty of contributing to her injury when we all recognize coffee is a hot substance. When you make it at home you know you are not to allow it to spill over yourself. I mean, I get that McD was callous in not wanting to pay her bill. I agree they were callous but how were they at fault for her injury?

There are many things which are intrinsically unsafe but we mostly operate safely around such things: gasoline, razor blades, knives, medicines, etc.

Is it believed servers should allow coffee to cool down to a safe temperature before tendering the drink?

<comment><USER4> > when we all recognize coffee is a hot substance.

190 degrees is not at all drinkable (though perfect for out of the brewer) and McDonalds had already received complaints about it being too hot.

<comment><USER3> So are they supposed to have a "cooling process" to bring the temp down to a standard temp? If there is no such standards, it kind of leaves things undefined and perhaps we should have one, although I imagine a few coffee bars flouting the standard.

The complaints may or may not be relevant, I think because you will have people complain it's not hot enough, or too hot, etc. and in terms of proportion to servings served it was a miniscule percentage. Never the less we all know from experience when we brew at home that coffee is hot. We know to be careful around the stove or range.

<comment><USER5> They didn't need a cooling process. The coffee was brewed and left in a pot on a warmer. They just needed to turn down the temperature on the warmer. They were literally selling a drink that was hot enough to burn/melt flesh. They were told this practice was dangerous several times and multiple people were injured, yet McDonald's still refused to decrease the temperature. Sometimes a lawsuit is the only way to get a business to stop dangerous behavior.

<comment><USER6> There's so much disinformation on this case. For instance, I was once told that the McDonald's franchisee was violating even McDonalds policy by keeping his coffee "even hotter"—because he liked it that way. And that one of the outcomes of the case was McDonalds removing the temperature control from their coffee machines to ensure consistency.

I have no idea if that's true, but I suspect not.

</comment></comment></comment></comment></comment></comment><comment><USER7> Adam Ruins Everything - The Truth About the McDonald's Coffee Lawsuit [https://www.youtube.com/watch?v=KNWh6Kw3ejQ](https://www.youtube.com/watch?v=KNWh6Kw3ejQ)

<comment><USER8> The other side's point of view: [http://www.hotcoffeetruth.com/](http://www.hotcoffeetruth.com/)

<comment><USER9> This is connected to the "U.S. Institute for Legal Reform" which in turn is connected to "U.S. Chamber of Commerce" who are not good people.

<comment><USER10> The WHOIS for the domain proves him right:

[https://whoislookup.ninja/whois/hotcoffeetruth.com](https://whoislookup.ninja/whois/hotcoffeetruth.com)

      Registry Registrant ID:
      Registrant Name: Domain Administrator
      Registrant Organization: Chamber of Commerce of the United States of America
      Registrant Street: 1615 H Street NW,
      Registrant City: Washington
      Registrant State/Province: DC
      Registrant Postal Code: 20062
      Registrant Country: US
      Registrant Phone: +1.2026596000
      Registrant Phone Ext:
      Registrant Fax:
      Registrant Fax Ext:
      Registrant Email: @uschamber.com

Edited to add: The piece makes the point that the film "Hot Coffee" is propaganda. I believe that gives me leeway to do the same here.

<comment><USER11> True or not, it's still Ad Hominem. Address the argument, not the organization making it.

<comment><USER12> Yes and no, it's important to know the motivation behind the messages people are saying.

</comment></comment></comment></comment></comment></comment><comment><USER13> See also: the 2011 documentary film "Hot Coffee" about the case and so called tort reform in the US legal system. [http://www.hotcoffeethemovie.com/](http://www.hotcoffeethemovie.com/)

<comment><USER8> Also be sure to explore "the other side" after watching that movie: [http://www.hotcoffeetruth.com/](http://www.hotcoffeetruth.com/)

I agree there was a lot of bad reporting on this case, and there are a lot of misconceptions about the case, but I attribute it to bad media than anything else.

<comment><USER13> So these videos are hosted on Youtube by the U.S. Chamber Institute For Legal Reform, which describes itself as "a national campaign, representing the nation's business community, with the critical mission of making America's legal system simpler, fairer and faster for everyone." The website says "The views expressed in this (these) videos are solely those of the panelists, and do not necessarily reflect the positions of the U.S. Chamber Institute for Legal Reform." Yea, but who setup this slick panel and presumably paid these lawyers, moderator and editors?

Edit: Looking at their _arguments_ in each episode: 1\. Intros and general reactions and opinions. No direct argument here.

2\. Definition of _tort_ in the film was incorrect, missing the phrase _civil harm_. This is myopic as the film does go on to explain plenty of complexities around tort law: negligence, strict liability, punitive damages, etc.

3\. The 700 complaints vs. billions of cups of coffee sold.

4\. Damage caps: the film portrays damages caps as common when they are rare.

5\. Judicial Elections: a) money doesn't only flow from corporations, b) most judges will be fair regardless of how they were elected, only a few 'bad apples'

6\. Mandatory arbitration, Franken Amendment: a) amendment didn't change Jones case b) most arbitration is not around tort claims.

Overall I think it's _surprising_ that all panelists are in agreement on each issue. :-)

<comment><USER8> ad hominem. Attack the arguments presented in the video, not the arguers.

edit: the message that I replied too got heavily edited after the fact.

<comment><USER13> It's not ad hominem to point out that these videos are being produced by an organization that has historically taken one side on the issue of tort reform.

I edited my comment to include the episodes arguments. I'll post my thoughts here:

3\. The documentary _does cover_ McDonalds scale and the fact that they received the same complaint at various levels within the corporate offices (not just franchises) but did nothing. Even a single instance has grounds for a tort case if McDonalds knew about the problem but did nothing.

4\. This dances around the issue. Nebraska _does have damage caps_ and those caps are on real damages. The panelists even say that this case is "tragic". Not sure what more to say...

5\. This is simply Citizen's United vs. FEC a few years earlier. We probably disagree on this decision. :-) But the film does bring up cases where there is an _appearance of influence_ thanks to donations.

6\. Again dances around the issue. Regardless of whether the Franken amendment covers the Jones case, they fail to discuss the problems with _mandatory arbitration_ which is what the documentary finds to be the most troubling aspect of these agreements.

None of these 'arguments' really address the concerns that the film raises. The panel nitpicks on definitions, complains that the film 'missies the point' because these are rare cases [citation needed], etc.

And again, everyone is in agreement on the panel, which _usually indicates that the panel was poorly chosen_ , at least if you want an good presentation of different viewpoints.

</comment></comment></comment></comment></comment><comment><USER14> NY Times also had a retro report on this case: [https://www.nytimes.com/video/us/100000002507537/scalded- by-...](https://www.nytimes.com/video/us/100000002507537/scalded-by-coffee- then-news-media.html)

</comment><comment><USER15> Read the awesome Too Much Coffee Man version please: [http://www.tmcm.com/tmcm/mcdonalds-coffee- lawsuit/](http://www.tmcm.com/tmcm/mcdonalds-coffee-lawsuit/)

<comment><USER16> The epilogue and the last two frames are excellent.

</comment></comment><comment><USER17> this article seems to only describe what you can see in the video (already linked in other comments) and does not add any value, apart from advertisement, but that value doesn't go to the reader.

<comment><USER18> I can't view the video here, so reading the article was valuable to me.

<comment><USER17> sure that happens to me sometimes. but there is always: [https://lmgtfy.com/?q=youtube+proxy](https://lmgtfy.com/?q=youtube+proxy)

</comment></comment></comment><comment><USER8> Actually, the vast majority of cases where people sued over hot coffee that was as hot or even hotter than the liebeck case are dismissed as "frivolous". The liebeck verdict was more of the exception, rather than the rule.

Source (wikipedia): [https://en.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restau...](https://en.wikipedia.org/wiki/Liebeck_v._McDonald%27s_Restaurants) (in "aftermath" section)

</comment><comment><USER19> Adam Ruins Everything did a video debunking many of the myths about the case.

[https://youtu.be/KNWh6Kw3ejQ](https://youtu.be/KNWh6Kw3ejQ)

</comment><comment><USER20> Wasn't that case then used to justify laws making "frivolous" lawsuits harder?

</comment><comment><USER21> Warning, video / audio starts as soon as the page loads.

</comment><comment><USER22> I have read about this before and I'd agree that McDonald's were just dicks. It's sad that this story went through the press and nobody ever bothered looking a little closer.

</comment><comment><USER23> I read the article, but can't watch the video right now, so perhaps this is adressed there, but what I don't understand is why selling coffee at 190 degrees should make you liable for people's handling of a known hot product. Heck, if I sell you 212 degree water and it is no secret that it is super hot, what did I do wrong?

Or what about if I sell you coffee at the lower temperatures McDonald's now sells coffee at, and you spill it over a newborn's delicate skin causing severe damage.

Please help me understand the other side of the story.

<comment><USER24> No. This story has been circulating for 22 years now, there is more than enough information for you to find it on your own. I've literally spent two decades explaining it to people and at this point 'please explain it to me' requests come off as being asked in bad faith.

<comment><USER25> "please explain it to me" is almost rhetorical - what is there to explain? Was it molten salt, or some other substance besides water? Was it really plain honest H2O just below the natural boiling point at that altitude? How could there possibly be anything to explain? Thus the virality of this story - simple and understandable by anybody.

Your explanation is "the injuries were _so bad_ and McDonald's was _so mean_ " but that should not be a legal justification.

Oh, so the woman was being reasonable, just wanted McDonald's to pay her medical bills - no, that's not reasonable either. I can't buy $1 bag of candy and then get my dentistry bills paid by the manufacturer, even if it was "closer to 100% sugar than is reasonable". Yeah, no metaphor will be exactly the same, but the situation is clear. Here's another one: someone buys a kitchen knife, and then cuts off their finger. Manufacturer has to pay? I'm sure some people in this vast country have said "man these knives are way too sharp" while the manufacturer says "our customers want the knives to be sharp".

McDonald's sold coffee near the boiling point. It was not defective or misleading. Something very unfortunate happened. And here in America _someone_ has to pay for it! But that's not actually fair. If you really want this unfortunate woman to have her medical expenses paid for, have your government give her the money, sharing in the expense via your taxes.

<comment><USER24> _Your explanation is "the injuries were so bad and McDonald's was so mean" but that should not be a legal justification._

I've declined to explain it. Do not project your straw man arguments onto me.</comment></comment></comment></comment>


T-Mobile CEO Apologizes for "Offending" EFF and Its Supporters - <AUTHOR> http://techcrunch.com/2016/01/11/t-mobile-ceo-apologizes-for-offending-eff-and-its-supporters/ <comment><USER2> As an EFF supporter and conflicted T-mobile customer I'm glad he issued this apology. No, it doesn't mean that he and the EFF are on the same page, but at least he is acknowledging that they are an organization to work with rather than dismiss outright.

I'm going to attempt to give him the benefit of the doubt and allow that he may have been unfamiliar with the EFF and had suspected that they represented primarily the interests of T-Mobile's competitors rather than individuals.

Also, I think that while Binge On was announced and promoted in a dishonest way, there is room for people who agree on the importance of net neutrality to disagree on whether such a program has a place on a neutral internet.

<comment><USER3> I like him actually - his initial response paired with this strikes me as authentic, that he really did think they were some interest group funded by Verizon or something.

Unfortunate it was the EFF he thought this of, but his defense of binge on seems well reasoned and isn't surrounded in the normal corporate speak that usually comes from the CEO of a big company.

<comment><USER4> There has always been a risk with being "authentic" although some people can pull it off. One of the things I've noticed about people fairly far up in large organizations is that they have filled their brain with all the various aspects of running that organization and have very little space for things they don't normally interact with. I can completely believe he didn't even know what EFF was beyond "something in the computer space" because it was probably irrelevant information until the twitter bomb.

</comment></comment></comment><comment><USER5> >no one at T-Mobile filters me either (no, they don't even try).

They may not filter you, but I'm sure they pressured you to make this apology.

<comment><USER6> He does not like to be filtered, but he's OK filtering content...

</comment></comment><comment><USER7> tl;dr - Sorry, not sorry.

Strangely, even a HUGE supporter of net neutrality, this doesn't bother me very much. Maybe it's because to me, Netflix is SO big, that this looks very similar to a peering agreement.

T-Mobile is just peering with netflix, and because of their agreement, will route data between their networks for free.

Although that is probably the sheep's clothing that the destruction of the open web will come dressed in.

<comment><USER8> It's not about peering.

In return for zero rating the video data for the video providers in the BingeOn program, they agree to serve video with a fixed highest bitrate, which saves on tower spectrum (which is far more important than whatever bandwidth consumption T-Mobile is experiencing at its peering points).

This makes sense. If you're a consumer who doesn't care about the bitrate being limited (assuming the highest bitrate is based on mobile device screen resolution), its not a problem. You get decent video quality on your device, T-Mobile doesn't have to work as hard at network management. If you want to opt out for whatever reason, there is a toggle switch to do so.

Its a clever solution to limited last-mile mobile connectivity.

<comment><USER9> Why do you keep providing in-accurate descriptions of Binge On and deliberately exclude the throttling that is central to both the current debate and T-mobile's claims of "UP TO 3X MORE VIDEO from your data plan"?

[https://www.eff.org/deeplinks/2016/01/eff-confirms-t- mobiles...](https://www.eff.org/deeplinks/2016/01/eff-confirms-t-mobiles- bingeon-optimization-just-throttling-applies)

The opted-in throttling is especially dangerous for innovation on the internet because in one swoop it increases the difficulty of starting any service that depends on displaying high definition video on mobile. Not all high definition video is entertainment, so T-mobile has no way of knowing if 'incredibly high resolution rates that are barely detectable by the human eye' are needed or not.

> Its a clever solution to limited last-mile mobile connectivity.

No, it's a slipshod and disingenuous solution to the limited last-mile mobile connectivity that violates Net Neutrality in two different ways: Zero Rating and content specific Throttling.

The value of Net Neutrality is open for debate, but T-Mobile is now flat out lying about their support of it:

> T-Mobile is a company that absolutely supports Net Neutrality and we believe > in an open and free Internet.

[https://newsroom.t-mobile.com/issues-insights-blog/open- lett...](https://newsroom.t-mobile.com/issues-insights-blog/open-letter-to- consumers-about-binge-on.htm)

If T-mobile wanted to solve this problem while respecting Net Neutrality, they could have worked with content networks and other carriers to develop an open standard for marking video stream network data as amendable to throttling.

<comment><USER10> That was pretty looney right up to the last bit. That there, is a great idea.

Whatabouts a flag to indicate that throttling will gracefully degrade? QoS tool's best friend?

</comment></comment></comment></comment><comment><USER10> I called tmobile, told them to turn binge-on off, that net neutrality is super important for small business to be competitive, and that I was offended by what their CEO said about the EFF. I also mentioned that they are normally really good at listening to feedback...

Thanks, t-mo. I will continue to give you money instead of at&t.

</comment><comment><USER11> That's the right thing to do (to apologize, not to defend Net Neutrality violation of course). Let him go back to making fun of "the dumb and the dumber", instead of attacking EFF ;)

</comment><comment><USER12> The comments in this thread evidence what a great ploy this was.

First, Outrageous CEO generates a mild uproar, irritating nerds, and generating press. Irritated nerds tweet about T-Mobile, causing it to trend. Bonus: everyone is branded for several minutes by the big pink T in the background of the video.

Second, he issues the apology. TechCrunch article. Twitter. More press for T-Mobile and Binge On. Everyone opines on the matter as if any part of it is meaningful.

Next, he'll meet with the EFF and make a pledge to support them. More chatter, more branding, and now some goodwill to boot.

Net result: Everyone is talking about T-Mobile instead of their competitors.

</comment><comment><USER13> I wonder if he made a video apology and released it on Twitter for all his followers to watch.

<comment><USER14> He did link the letter:

[https://twitter.com/JohnLegere/status/686669027679141889](https://twitter.com/JohnLegere/status/686669027679141889)

</comment></comment><comment><USER15> This issue aside, it's always okay to scrutinize the intentions and funding sources of organizations. The EFF once tried to work with big tobacco.

</comment><comment> a-b He admitted "I am a vocal, animated and sometimes foul mouthed CEO" so how can we trust his words about support and shared goals? He can proof something by making significant donation say 1MM to EFF [https://www.eff.org/about/contact](https://www.eff.org/about/contact)

<comment><USER16> Thats an insane requirement.

<comment><USER17> You were very insensitive to a-b. You can prove you're sorry by donating say 1 000 000 USD to me.

<comment> a-b if I would be a face on national telecom operator and you non-profit organisation representing interests of significant part of my userbase I would consider this.

<comment><USER16> Well it's a good thing you aren't. Thats a bad idea.</comment></comment></comment></comment></comment>


Show HN: Follow my journey to $50k in revenue - <AUTHOR> https://www.elyfornoville.com <comment><AUTHOR> Inspired by Jon Yonfook's idea and my own experiences, I've put together a personal website that allows me to be more motivated on my projects. This is my online journey in bootstrapping a business and monetizing it. My goal is to launch various projects that solve personal problems and generate $50,000 revenue.

You can subscribe below and receive regular emails with updates on my journey, how I failed and succeeded and what tools I used.

<comment><USER2> FYI: Can't access the website. I'm getting "ERR_CONNECTION_RESET"

<comment><AUTHOR> That's strange. It's working on my side.

<comment><USER2> I was able to get it to work from a LTE connection, but it's being blocked from my organization's network. Not sure why, but I found it was blacklisted by McAfee: [https://sitecheck.sucuri.net/results/www.elyfornoville.com](https://sitecheck.sucuri.net/results/www.elyfornoville.com) May not be a huge problem for your traffic, but I would check it out!

<comment><AUTHOR> No blacklist here: [https://mxtoolbox.com/domain/www.elyfornoville.com/](https://mxtoolbox.com/domain/www.elyfornoville.com/)</comment></comment></comment></comment></comment>


Porn for Girls by Girls - <AUTHOR> http://www.pornforgirlsbygirls.com/

<comment><USER2> 18 upvotes already huh.

From now on, every one of my submission titles will contain the word 'Porn' regardless of content.

</comment><comment><USER3> Bah. chaos, you usually has some good submits. This one is way off mark. Funny yes. Insight into the hacking, business, or social trends, no. I fail to see the relation to hacker news. :(

<comment><AUTHOR> sorry everyone - i just thought it was somewhat related to "how to market to women/females"... (I can't reference the YC thread since there's no search)

yeah lately my posting streak has been sucking hard - maybe it's because I've been working more

</comment></comment><comment><USER4> Ahem, we are engaging in serious Internet business on this website and it is necessary that we eat, breathe and sleep Michael Arrington's table scraps 24/7. We must remain steeped in the echo chamber at all times. Thank you for understanding.

<comment><USER5> All the objectors are completely missing the point that's being _brilliantly illustrated_ by this tongue-in-cheek site:

MAKE SOMETHING PEOPLE WANT.

There are huge untapped markets because most web 2.0 sites are very, very niche, with a huge percentage overlap covering the same small Lispy HHGTTG crowd. Games mostly market to the same "kill some pixels" demographic, whether with guns or swords.

If you want to talk _"serious"_ business, you're generally talking appealing to a wide spectrum of people with diverse interests. So you have to look at the commonality of what people want -- access to information (Google), social connection (MySpace, Facebook, WoW). (WoW's actual gameplay is niche, but there just happens to be a large supply of 11-year-olds who want to kill monsters.) This hardly exhausts the possibilities!

Mate, Spawn, Die: Pick any two.

</comment></comment><comment><USER6> This is a low.

<comment><USER7> Stories like this make me want a Bury button.

<comment><USER8> You mean "downvote," right?

</comment></comment></comment><comment><USER9> Let's stay on topic here and keep this kind of thing on reddit.

</comment><comment><USER10> Funny, but not entrepreneur-related.

Also, no it doesn't.

</comment><comment><USER11> This appears to be a real advertisement for that book halfway down the page.

Also, there are a bunch of parody sites at the bottom, like Crackbook.

</comment><comment><USER12> yc.news.jump(shark);

<comment><USER13> (jump 'yc-news 'shark)</comment></comment>


Raising Bill Gates (a.k.a. Trey) - <AUTHOR> http://money.cnn.com/2009/04/15/technology/gates_secrets.fortune/index.htm?postversion=2009041604

<comment><AUTHOR> "Perhaps there's a lesson in this for the parents of other curious children who, from the start, require the freedom to meet life on their own terms: It is that there is no statute of limitations on the dreams you have for your children. And there is no way to predict how much delight you might feel when those dreams are realized in a far different way than you could have imagined."</comment>


Fastest-growing Airbnb market at risk as lodging-scarce Japan cracks down - <AUTHOR> http://www.japantimes.co.jp/news/2016/02/19/business/fastest-growing-airbnb-market-risk-lodging-scarce-japan-cracks/#.VsdlAbQrKt9 <comment><USER2> I'm surprised to see Japan as their fastest growing market. I was very disappointed with the selection available when I was looking to rent an apartment last year. While they probably don't have enough accommodation for the Olympics, I will say that I generally find very cheap accommodation available in Japan, as opposed to many other countries.</comment>


Tardigrades can live 30 years in a freezer&survive in space, and now we know why - <AUTHOR> http://www.theverge.com/2016/9/20/12990274/tardigrade-extreme-water-bears-genome-sequence <comment><USER2> [https://www.nature.com/articles/ncomms12808](https://www.nature.com/articles/ncomms12808)

(This paper/article are from 2016, btw.)</comment>