One founder's nightmare - <AUTHOR> http://bsmcconnell.wordpress.com/2008/09/01/an-open-letter-to-paul-hammond-ceo-of-virtual-pbx-inc/ <comment><USER2> I am the author of the article. Unless you've been in a situation like this, it's best not to armchair quarterback. I expected a mixed reaction to this, and that's fine.

I had a choice. 1) do nothing, hope the harassment stopped spontaneously (the private eye I hired caught this manager trying to sabotage an unrelated deal nearly a year after I left, so what would you conclude?), 2) fight back on my own terms. The nature of bullies is that they continue bullying until someone stops them. I couldn't afford to sue, and didn't want to spend the next couple years dealing with them in court either.

I would have rather just moved on. I just wish this individual had been reasonable. There were dozens of ways to deal with the situation amicably, all of which would have resulted in us sticking around, and them making money from the products they acquired. None of us wanted this outcome.

Lesson learned besides avoiding earnouts, also investigate whether a company has experience with M&A or larger investments, and thoroughly check executive history to find prior deals (just being in the room when someone else was running a deal doesn't count). If they have not managed an acquisition before, there's a high risk that they'll screw it up. It's human nature that people don't want to admit their own mistakes, so if that happens, you'll become the scapegoat for it all.

For buyers, the lesson learned is that in a small acquisition, you're also acquiring living thinking human beings, not livestock. Hardball pennywise tactics might save you some money in the short term, but nearly always create resentment, early departures, etc, and degrade the value of what you bought in the first place.

Take all of this with a grain of salt though, as I am a disgruntled employee, etc.

<comment><USER3> I'm all for you standing up for yourself and we all appreciate your posting it here for us to learn from your mistake. At the end of the day, you may be ranting and venting a bit but there's also that spirit of, "Learn from my mistakes so that you don't have to." Thank you, Brian, and I'm sorry I heard to learn of you in this way. Best of luck to you.

Now go talk to your lawyer.

<comment><USER4> I'm disappointed at the number of "go to court" and "now go talk to your lawyer" responses here and in replies on the blog article.

Going to a lawyer is expensive. Going to court rarely helps your financial situation. You should do it only when all other avenues are exhausted. If publicizing this behaviour takes care of the problem (i.e., stops the harassment, allows the poster to continue on his new business ventures), then that is an amazingly cheap silver bullet solution, compared with the cost you incur when you cross that law office's threshold.

All the howling for legal revenge to set the world right re-enforces my worst impressions of Californians. Publicizing the details, which may cure the problem in the cheapest way possible, and then making money on something new, re-enforces my best Californian and Silicon Valley impressions.

<comment><USER2> Thank you for pointing this out. I just want to move on and focus on my new project, and not waste the next two years fighting in court over a botched acquisition.

A civil lawsuit is expensive. Expect to pay $200,000 or more, and to age about ten years and/or develop serious health problems from the process of dealing with people you'd prefer to throw under a bus.

The main reason I went public was so that other entrepreneurs won't make the same mistakes I did. It's no fun to admit that you got taken, but at least others can learn from it.

<comment><USER5> Given the evidence you have, you may be able to find a lawyer who will work pro bono. Given that they've done to you, the settlement might be never work again type money. At least spend some time checking into it.

By blogging you're opening yourself up to lawsuits. Now you'll be spending the same legal fees but with the good result being $0.

You're absolutely insane not to sue if half of what you say is true.

<comment><USER3> If you can't find pro bono, I think you'd definitely be able to find an attorney who would just work for 33% (or whatever) of the settlement. No cost up front.

</comment></comment></comment></comment></comment></comment><comment><USER6> Unlike most commenters, I would like to offer some words of support to Brian. Much like rape victims used to be judged on everything from their dress style to being out late after dark, you are being judged on everything from your writing style to your choice of deal structure. If the blame lies with the victim then surely nothing bad could happen to us, right?

All in all, I think you offered rather good reasons for structuring the deal that way even though _hindsight_ says otherwise. It's staggeringly naive to think that any amount of lawyering could "sort a deal out a 100%". People who make those sorts of comments have very limited business experiences and don't know the true meaning of the phrase "history is written by winners".

I wish you the best in whatever you choose to do next. I do hope you get a lawyer - even if you don't like to think of yourself as a litigious type, it will help you achieve some closure. Please keep us posted on your situation.

</comment><comment><USER7> Ouch.

I totally agree with "If you are an entrepreneur, _never_ agree to an earnout without substantial up front compensation, there are just too many ways you can get screwed, whether by chicanery or incompetence". I have a friend who did just that, and was also shafted in the process.

Never give your business away for free, and never count on any money after the initial sale.

It does sound to me like this guy needs to get himself a lawyer rather than post stuff on the web, assuming "Paul Hammond" is also US-based. My friend couldn't do that, as his "acquirer" was based in Poland, which made litigation difficult (lesson 2: don't sell to someone you can't sue).

<comment><USER8> ...and find out how much you can sue for. I happen to live in a country where you can't sue for punitive damages, so the worst case for the offender in a scenario like this is that they would have to eventually cough up the money they agreed to pay in the first place. In other words, for these people, breaking the contract is essentially a low-risk maneuver. Nasty.

</comment></comment><comment><USER9> Tip: the more personally you are involved in some dispute, the more careful you have to be to be crisp and understated when describing it. This would be much more convincing if it weren't so rambling. As it is, I read it and think "I don't know the rights and wrongs of this particular situation, but I could easily imagine that this guy would be a huge pain in the ass to deal with."

<comment><USER5> Clearly he's a bit of a donkey. He has multiple exits yet is still broke. He put himself in a situation where this could happen, which is ridiculous in and of itself. And rather than doing the proper thing (suing someone who seems to be clearly in the wrong and violating numerous laws) he's blogging about it and exposing himself to legal action.

To put it another way, there's no way I would hire this clown.

<comment><USER10> Well thats going on it a bit harsh, dont you think. First of all, we havent heard Virtual PBX's side of the story, so we can't really take sides, but if he's telling the truth it indeed has been horrible and he should indeed sue.

In fact, I really don't get why he's not suing, unless of course, he's lying.

</comment></comment></comment><comment><USER11> Seriously, stop writing. If you are aggrieved, take the guy to court. That is what the legal system is there for. Blogging will inevitably only prejudice a case. If the money does not matter to you, then at least do it to set precedent and discourage such behaviour.

I don't know if there is Legal Aid in the U.S. (like in the U.K.) but at least use the Small Claims Court system (<http://en.wikipedia.org/wiki/Small_claims_court>) or contact Judge Judy (or whoever is in vogue at the moment) to shame him more publically (as it seems like you are following a name-and-shame strategy).

<comment><USER12> _If you are aggrieved, take the guy to court._

If everything in the article is true, it sounds to me like a civil lawsuit is step 2. Step 1 would be reporting the computer intrusion to law enforcement authorities (hopefully there are good logs to document the fact that someone accessed his VPN) -- stealing someone's account credentials and logging in to remote systems without proper authorization isn't just a privacy violation, it's also a crime.

<comment><USER13> An employer has the right to check private email of an employee. It seems that the shafted guy is pissed off because he did not think that his employee status would give his opponent the right to snoop.

<comment><USER13> To answer most of the sibling comments:

"U.S. Court Affirms Employer's Right to Read Employees' Email" at [http://goliath.ecnext.com/coms2/gi_0199-14518/U-S-Court- Affi...](http://goliath.ecnext.com/coms2/gi_0199-14518/U-S-Court-Affirms- Employer.html) Keeping anything private on a corporate laptop or accessing private email through corporate network does not guarantee any privacy at all. There is a company right now arguing it has right to read Yahoo email of an employee. [http://www.informationweek.com/blog/main/archives/2008/06/co...](http://www.informationweek.com/blog/main/archives/2008/06/company_argues.html)

I take downmodding of my comment above as a sign of righteous indignation about US privacy laws.

<comment><USER12> _U.S. Court Affirms Employer's Right to Read Employees' Email_

Fraser v. Nationwide Mutual Insurance Company is entirely irrelevant here: That case dealt with whether a company has the right to access emails stored _on the company's server_. There's a question of privacy there, but not one of computer crime -- Nationwide Mutual Insurance Company did not access computer systems without the owner's permission. This is manifestly different from the situation as I read it to be here, where it was being alleged that the article's author's VPN was being accessed without his permission.

The Structured Settlements case is more relevant, but it fails on two counts: First, the legal theory being put forward by Structured Settlements involves them merely observing what Mr. Palma had done on one of their computers -- their claim is that they didn't access his Yahoo account, but merely saw him accessing his Yahoo account -- and second, the Structured Settlements case has yet to be tested in a courtroom.

Yes, the US has very weak _privacy_ laws, but that doesn't extend to its _computer crime_ laws -- and accessing a computer system without authorization is a computer crime, not just a privacy violation.

And of course, IANAL, the above is not legal advice, etc.

</comment></comment></comment></comment></comment><comment><USER14> It doesn't seem like a rant to me.

It would be good to hear the other side but given the fact that litigation is pending, comments aren't likely to come. If it's all true, then clearly Virtual PBX is a company to stay away from.

I appreciate the lessons McConnell provides here and wish him better luck next time.

</comment><comment><USER15> I dont blame the writer for blogging the incident . he has already said he has facts and witnesses and he would not risk telling a lie to the whole world .. sometimes you have to tell your own side of the story because even potential investors will wonder why youhave not made a statement to defend yourself. If nothing comes out of it readers can learn a thing or 2 from the story ...

</comment><comment><USER16> Here's one helpful tip that served me well: if you are not a good judge of people's character then don't try to judge their character. Instead, always judge their apparent motives.

This works well in business and politics.

How do you know you are a good judge? For example if you are a police investigator with 500 solved cases behind you, you are a good judge - you got experience. If you don't have similarly large experience you're likely not a good judge.

</comment><comment><USER17> There appears to be an update on this story - from the Venturebeat article [http://venturebeat.com/2008/09/01/when-selling-your- company-...](http://venturebeat.com/2008/09/01/when-selling-your-company- beware-of-earnouts-you-may-lose-your-shirt/)

The company says he used a personal email ID to conduct company work. All the email was on the company computer, and they looked at that account to get the business related stuff. Seems to me like this is a case of an ex employee that is pissed off and seeking personal revenge. Anything on that commputer belongs to the company. Cant comment on the contract stuff, but given the inflamitory way he talked about the email - who knows what the truth is about the contract. Sour grapes - I think his ranting is doing him more harm than good. who will want to do business with him now he shows how he deals with issues in public and not through reasonable normal business channels

</comment><comment><USER18> Found the official response from the company posted at O'Reilly

There are always two sides to a story. Looks like VirtualPBX offered to rescind the deal and are asking him to resolve the dispute through the dispute resolution procedures that are already outlined in the agreements he's signed

So why is this guy blogging about this - looks like its hurting him as much as anything else

This comes straight from the article ->>>>>"Virtual PBX is a small, privately held, non VC funded, 10-year old family enterprise that took a calculated business risk by acquiring the assets of Brian McConnell's business in an attempt to further the progress of its technology. Brian willingly signed a business agreement with Virtual PBX and subsequently entered into an employment contract with the company. Those facts are not in dispute.

Virtual PBX contends that Brian breached material terms of the agreement as well as the subsequent employment contract. We do not believe it appropriate to discuss the nature of the ongoing contract disagreement publicly, despite the fact that Brian has issued a stream of what we regard as misleading and even malicious statements in his blog about the relationship.

We do take exception that Brian has chosen to invoke the mantle of privacy as a means to avoid taking responsibility for his behavior. He chose to store large volumes of data on a company issued laptop, some of which was unrelated to company business. The laptop and the data stored on it were appropriately retained by the company upon his departure. The company's only interest in the data stored on the computer is that which relates to business issues. Brian's allegation the company committed cybercrime is malicious and unfounded. It is unfortunate Brian has chosen to pursue counter-productive rhetoric in lieu of reaching a mutually acceptable and business-like solution to this contract dispute."

Also says ---- They told me the company "has also requested that he resolve the dispute through the dispute resolution procedures that are already outlined in the agreements he's signed, and that Virtual PBX has even offered to rescind the deal with him and give him back everything he sold to the company including the IP."

</comment><comment><USER19> Earnouts seem to combine the worst properties of a purchase and an investment.

</comment><comment> daniel-cussen IANAL, but may I humbly suggest (from what little I know) that the poster take this down, seeing as the consensus here is that this post might hurt your case?

</comment><comment><USER20> This kind of post doesn't do him any favors. If its true (and that is up for debate) then it's still down to him not sorting the deal out 100% before he gave everything away. Business really can be a nasty place and he should really have had everything tight legally from the start of the deal.

</comment><comment><USER21> in part it seems like a "the-world-is-out-to-get-me" one-sided rant.. But there seems to be some good lessons to be learnt there, and it may very well be a reasonably accurate statement of events..

<comment><USER22> I think that the lesson here is that the world, in fact, _is_ out to get you. Act accordingly. Hopefully his hard lesson can keep others from going down similar paths.

<comment><USER8> Amen. I'm in a shockingly similar situation to the one the author describes, and I can agree, it's not fun. There are folks who really are out to get you, and will take advantage of any opening. Bottom line: find a lawyer you can trust, and rely on them heavily.

</comment></comment></comment><comment><USER23> This is a post I made which also goes into general some of the range of tactics used by rogue 'competitors'.

[http://thenextweb.org/2008/05/24/david-vs-goliath-the- underh...](http://thenextweb.org/2008/05/24/david-vs-goliath-the-underhand- tactics-of-competition/)

</comment><comment><USER24> Maybe the author should rewrite this so that the reader can get to something interesting in less than 15 minutes.</comment>


Facebook is harming our democracy - <AUTHOR> http://www.vox.com/new-money/2016/11/6/13509854/facebook-politics-news-bad <comment><USER2> 1) There's an irony that Vox of all companies is complaining that Facebook rewards click bait and punishes thoughtful pieces that require time to read and digest.

2) The article takes an interesting attempt at being even-handed: "it's not just right-wing Trump supporters who are being evil, but also left-wing Bernie supporters!"

3) The solution that Vox is suggesting is for Facebook to appoint a high council of editors who approve which stories are worthy of being allowed to be shared, and which are evil and duplicitous. For some reason I strongly suspect that the set of stories they want deemed good are those that align with Vox's editorial philosophy.

4) I'm curious how they would handle something like the Iraq war, where the two legitimate sides promoted by serious, responsible folks like Ezra Klein and the NYTimes were liberals who supported a humanitarian war and conservatives who supported a pre-emptive defensive war. How likely is it that the people who should have been banned from public Facebook discourse are those conspiracy nuts who thought the USA should stay out of Iraq?

<comment><USER3> > 1) There's an irony that Vox of all companies is complaining that Facebook > rewards click bait and punishes thoughtful pieces that require time to read > and digest.

Yeah I had the same reaction. It was also somewhat rich that they cited a BuzzFeed article as evidence people are gaming our predilections for clickbait. Though, now that I think about it since it is clickbait, BuzzFeed would certainly be an expert there. And in a way, Vox also takes advantage of it. Here's a short selection of my favorite "Vox [explains x] in [<=500 words]" pieces.

[http://www.vox.com/2016/8/29/12692546/obamacare-whats- wrong](http://www.vox.com/2016/8/29/12692546/obamacare-whats-wrong)

[http://www.vox.com/2016/7/15/12204172/turkey-coup-erdogan- mi...](http://www.vox.com/2016/7/15/12204172/turkey-coup-erdogan-military)

[http://www.vox.com/science-and- health/2016/10/4/13155916/201...](http://www.vox.com/science-and- health/2016/10/4/13155916/2016-nobel-prize-physics)

[http://www.vox.com/2016/9/7/12817566/donald-trump- immigratio...](http://www.vox.com/2016/9/7/12817566/donald-trump-immigration- position)

Last one for kicks. To be fair to Vox, they _do_ produce some long-form stuff and often link it at the bottom of these shorter pieces, but these explainers are not helpful and, I think, produce a rather shallow understanding of extremely complex issues.

<comment><USER2> The ideal article for Vox to write on these lines would actually be something like "don't expect to get any meaningful understanding of issues from articles that go viral through Facebook or other social media, and wait at least a couple months or years until a current event has played out so you have enough context and expert analysis on it to come to an informed opinion."

Unfortunately, that'd sort of undermine their entire business model.

<comment><USER4> You don't have to wait months or years. I've moved most of my media consumption from daily news broadcasts to a single weekly newspaper, which to me provides the most adequate balance between currentness and classification/interpretation.

<comment><USER5> I do similar via The Economist, may I ask what source you have found that you feel serves you on a weekly basis?

<comment><USER4> I'm subscribed to "der Freitag", a German weekly leaning on the left side, but with a healthy amount of internal debate. [http://www.freitag.de](http://www.freitag.de)

</comment></comment></comment></comment></comment></comment><comment><USER6> The "gate-keeper" media gave us the Iraq war. Anyone who was skeptical at the time was dismissed as a loon or worse, censored via refusing to cover X's viewpoint. Vox's argument boils down to: FB regressed in area Y, therefore it's worse than the system that came before it. This is incredibly short- sighted thinking, to the point where it comes across as being deliberately so.

I'm not a fan of click-baity articles, but the chance for all voices to at least be heard trumps (no pun intended) relying on what we may dub the "media elite" for our news. Time and time again they've shown they aren't the objective neutral actors in ALL cases they claim to be. Of course the WSJ or NYT will have a better overall track record than say buzzfeed, but that doesn't mean there won't be cases in which the the aforementioned elite media organizations don't try to skew the conversation.

A good example of this is the ND pipeline. None of the established players are giving it the coverage it would seemingly deserve, without YouTube, and smaller outlets the majority of the country wouldn't know anything is happening.

</comment><comment><USER7> Facebook isn't the problem. Advertising is. Vox can't tell you this without hurting themselves.

We fund content distribution (Facebook) and content creation (actual articles) based on how many people are looking at them, so journalists produce clickbait and Facebook gets you addicted to it. We can call it "maximizing daily active users" instead of addiction if you like, but it all sounds the same to me. If you're asking Facebook or journalists to make less money to create a better world, don't be surprised when they say no.

Instead, individuals must take on the responsibility to fund the production and distribution of content they find valuable. That won't eliminate bias, but it'll eliminate the very strong financial incentive embedded in capitalism to create a compelling alternate reality for each individual on the planet. It is tearing us apart. Start a recurring donation to a nonprofit news organization today, then turn on your ad blockers. Not just for intrusive ads. For everything.

<comment><USER8> No, Facebook absolutely is the problem. See: modifying users' feeds to conduct a random, secret, psychological experiment on unwilling humans.

[http://www.theatlantic.com/technology/archive/2014/09/facebo...](http://www.theatlantic.com/technology/archive/2014/09/facebooks- mood-manipulation-experiment-might-be-illegal/380717/)

<comment><USER9> What's wrong with this? Would it also be wrong if Facebook changed their algorithm but deployed the update to 100℅ of users?

If not, why is 50℅ somehow bad while 100℅ is ok?

<comment><USER8> Facebook modified certain users' feeds to only show "sad" or "negative" posts and effectively hide "happy" or "positive" posts, while simultaneously doing the opposite to others' feeds. Grade A+ psychologically manipulative experiment. This is why I don't engage in the Facebook nonsense anymore.

</comment></comment></comment></comment><comment><USER10> Its immoral for either facebook or twitter to take sides - and the idea of letting them edit the news is horrifying. Facebook and twitter each are monopolies, unlike the diverse traditional press. I find it for example unacceptable that facebook's CEO has endorsed a candidate. Social media should be held accountable to act as social lubricant and nothing more in well functioning democracies.

<comment><USER11> they're private companies that can do what they want on their platforms, but if fb actively censored my posts i and many ppl i know would immediately stop using it

<comment><USER10> > they're private companies that can do what they want on their platforms

Newspapers are private companies too.

</comment></comment></comment><comment><USER12> Facebook and companies like it will in the long run harm more than just democracy. See [https://www.theguardian.com/technology/2014/jun/30/facebook-...](https://www.theguardian.com/technology/2014/jun/30/facebook- emotion-study-breached-ethical-guidelines-researchers-say).

</comment><comment><USER13> >Most people today don't get their news ... They open a social media app

I'm not sure that's true. In a 2016 article Pew Research has TV as easily the number one source. [http://www.journalism.org/2016/07/07/pathways-to- news/](http://www.journalism.org/2016/07/07/pathways-to-news/)

I'd be more worried by Fox News than Facebook. Also Breitbart and the Daily Stormer can be scary experiences.

</comment><comment><USER14> That time when Vox blamed Facebook for the US being inundated with credulous idiots. Here's a counter-proposal, instead of whinging about Social Media why don't we make Manufacturing Consent required reading?

Edit: oooh hit a nerve there.

</comment><comment><USER15> I agree with Vox but they are being too narrow by just asking Facebook's founder to fix it. I would say that Social Media is a threat to Democratic system as we know it. It's about to be tested like no time before. With the ability for everyone to have a voice via social media single minded groups are easier than ever to create. As we have seen many of these groups are unwilling to compromise their ideas which makes it likely for chaos to erupt over any hot issues. We saw an example with the Arab spring and Occupy Wall Street. They erupted but yet have had no real results. Primarily because there was no real leadership behind it to move it forward. In many ways you can say that the revolution made matters worse.

When everyone is upset and there are many points of view there is no common way to move forward but there are many hot heads that are willing to shoot first and ask questions later. Imagine a million hot heads without a common goal but the willingness to fight and we can see chaos without results.

People get upset at the "do nothing congress" because they can't get X done but people aren't willing to admit that the reason is that voters have sent individuals with very diverse ideas to try to get things done. Voters are the ones that are pushing them to not compromise any idea or be punished by being voted out. I can see a future where one person that can use social media very well can push people to vote in ways that we consider distasteful now. What will happen then? Groups will erupt with opposing view and many will be ready to fight.

We've heard allegations that the voting system is rigged but that's very unlikely. We have laws and watch dogs that prevent that in any significant way. We don't have the same for social media but we know that it's possible to manipulate it, even by foreign powers, and that's not illegal worse yet it's hard to impossible to prevent. Yet, any thing published whether true or not becomes true by effect if enough people repeat it. It's hard to even contemplate how that effects a democratic system.

The founding father created a representative government because they knew that rule by majority can be as distasteful as government by a monarchy or emperor- ship. They thought a functioning government needs representatives that can sort out what's needed for a better nation. With everyone having a voice that's going to get extremely difficult. Social media is about to let the US test out its governmental system, lets hope it can pass the trouble ahead. Can the US stay together as a nation when there is no common ground among the citizenship?

<comment><USER11> what country are you from?

<comment><USER15> US

</comment></comment></comment><comment><USER16> FB already has too much power and its moderators affects 'politically undesirable' content too much. And they want them to employ human editors to evaluate stories in addition to that?

One week ago, FB blocked an event page of Independence March, which traditionally takes place on November 11th (Polish Independence Day) in Warsaw. This is the biggest mass event of Independence Day, having more than 100k participants each year.

FB also blocked or removed pages of NGOs and political parties, which are organizing or support the march (some of them had 80k or 170k followers) and personal accounts of people involved in these organizations.

Then FB went full rage and started to block personal accounts of everyone who invited or even positively mentioned the Independence March, including for example the personal account of editor-in-chief of the second largest daily newspaper in Poland ([https://twitter.com/sjastrzebowski/status/793001362070052864](https://twitter.com/sjastrzebowski/status/793001362070052864)).

The most extreme case was the personal account of a MP, who wrote on his timeline: "I will be [on the Independence March] along with my family, whether FB likes that or not." ([https://twitter.com/jakubiak_marek/status/793497135954202625...](https://twitter.com/jakubiak_marek/status/793497135954202625/photo/1)) His profile was blocked for 24 hours after that.

Another case was a personal profile of a retired Intelligence Agency officer, who revealed in a FB post, that a local coordinator of an anti-government liberal-left protest movement during the communist period was a colonel of Soviet-dependent military intelligence agency.

All of this happened just within the last month. FB actions generated a huge pushback and hit the headlines. Deputy Minister of Justice qualified FB actions as "censorship". Minister of Digitization tweeted that she "asked FB management for a talk". Many people started deleting their FB accounts in protest.

FB got frightened and reactivated the event page of Independence March, but many nationalist/conservative organizations profiles still remain blocked.

</comment><comment><USER17> When newspapers and television news held influence, most countries had media ownership laws.

Humans and algorithms will have bias, but a diversity of bias is good.

If industry cannot implement some self regulation, it risks finding itself with external policy and regulatory controls.

</comment><comment><USER18> Churchill said, "Democracy is the worst form of government, except for all the others". A similar concept would apply to the press and the dissemination of reported events.

News networks were much worse, they could arbitrarily censor anything that did not result in a higher TV rating, more advertising revenue, or that didn't represent the interests of the investors/donors/advertisers... oh, wait. Same on Facebook to some extent :-)

That's why it's important to decentralize the Internet.

</comment><comment><USER19> Censors opinions I don't like - Private company can do whatever it wants

Doesn't censor opinion I don't like - Harming our democracy.

Eg:

Trump is harming our democracy .

Wikileaks is harming our democracy.

FBI is harming our democracy.

Pepe the frog is harming our democracy.

Russia is harming our democracy.

<comment><USER20> And we're all too stupid to make up our own minds about what/who to believe. Thankfully, we have Vox to Voxplain it all for us ignorant masses.

</comment></comment><comment><USER21> I'm sure Vox would like if Facebook were obligated to promote approved opinions, but I'm not comfortable with _any_ given group of people doing such sort of approval, so right now I consider an algorithmic approach natively superior.

<comment><USER22> > I'm not comfortable with any given group of people doing such sort of > approval, so right now I consider an algorithmic approach natively superior.

That is a point the article makes, though. The algorithmic approach is effectively equivalent to particular group of people doing the approval (or rejection). What group that is manifests itself via the way the algorithms are coded and the data that are fed into it.

 _Edit:_ This is similar to the conclusion people are coming to regarding algorithms for court sentencing[0] and other areas where algorithms are becoming increasingly used. It's dangerous to conclude that an algorithm is better just by virtue of it being code. That code (and/or its training data) may be reinforcing existing stereotypes and biases.

[0] [https://www.engadget.com/2016/06/26/wisconsin-sentencing- alg...](https://www.engadget.com/2016/06/26/wisconsin-sentencing-algorithm- faces-court-battle/)

<comment><USER9> The conclusion that _numerate_ people are coming to regarding algorithms for court sentencing is quite different from what you describe.

The conclusion there is simply a theorem: it's mathematically impossible to be both well calibrated (a black and white person receiving the same risk score have the same probability of committing crime) and also racially balanced (similar levels of false positives), except in trivial and unrealistic cases.

[https://arxiv.org/pdf/1609.05807v1.pdf](https://arxiv.org/pdf/1609.05807v1.pdf)

See also this WaPo article explaining in simpler terms: [https://www.washingtonpost.com/news/monkey- cage/wp/2016/10/1...](https://www.washingtonpost.com/news/monkey- cage/wp/2016/10/17/can-an-algorithm-be-racist-our-analysis-is-more-cautious- than-propublicas/)

But the thing is, this theorem applies to _any_ decision process - human or algorithm. You can't escape mathematical impossibility results just by using humans (e.g. NP Complete problems are still hard even if done by humans).

Human processes just add additional bias, e.g. the editorial slant that Vox wants Facebook to add, or the (alleged) bias that Facebook's human editors added before Facebook went all algorithmic.

<comment><USER23> My only disagreement is with: >Human processes just _add_ additional bias

Bias with respect to what? As you say, there is already bias baked into the data collection and the algorithmic choices.

The bias that human editors introduce is different, but not necessarily larger, however you even measure it. There are also myriad human choices behind the choice and deployment details of the algorithm.

An important plus for human editors is greater interpretability and greater transparency regarding the biases the system ends up showing.

<comment><USER9> It's been reproduced across many experiments that humans will add bias that harms accuracy when making decisions. I.e., if x[6] represents race, humans will systematically wrongly weight x[6].

Machines simply don't do this.

 _As you say, there is already bias baked into the data collection and the algorithmic choices._

That's not what I said.

What I said is that you can't have collective equality (e.g. same rate of false positives, lack of disparate impact) and also accuracy (getting the right answer) except in trivial/unrealistic cases.

Human editors are fundamentally less interpretable and transparent than machines. You can easily interrogate machines and test for bias; how do you do that to humans?

Or, to take a historical example, why did colleges switch from algorithms to humans when the supreme court said that transparent racial bias is forbidden?</comment></comment></comment></comment></comment>


Apple TV 2.0 coming in 2014 - <AUTHOR> http://thefrustum.com/blog/2014/2/12/apple-tv-20-coming-in-2014

<comment><USER2> I've been holding out on buying a TV (not just a set-top box) until Apple decides to make one. I don't like the way cheap way most TVs look nowadays. I don't think I'm the only one that's waiting.

Then again, I've been waiting for years. I've come to realize that if Apple never makes a TV, then so be it - I'll just never get a TV. But the one thing I won't do is put ugly stuff in my home.

</comment><comment><USER3> Apple TV is already on gen 3. Perhaps you mean the next generation.</comment>


More Than Half of Coffee Species Are in Danger of Extinction - <AUTHOR> https://www.popularmechanics.com/science/environment/a25917401/wild-coffee-extinction/ <comment><USER2> I just had a chat some days ago to an Ethiopian import-export manager.

He said:

"our core business is importing building materials (this is how we make money) but to be allowed to do so our national bank makes us exports goods so to be able to have USD to be used to import: I mean, if we want to import 500K USD of building material, first we need to sell Ethiopian goods abroad for 500K USD: how do we do it? by selling coffee!"

coffee? yes!

"The weird outcome of this is that we end up selling ethiopian coffee abroad without making any profit, so to be sure to sell it, and so to be sure to have the USD necessary to buy building materials, which is where we make money"

So, Ethiopian coffee can be purchased abroad with a price that is about its cost!

This is very bad since, as a minimum:

1\. No proper coffee exporters can survive, due to very low margin

2\. Ethipia ends up selling its coffee without making any money

can Coffee producers survive?</comment>


Why all placeholders' text are John Doe? - <AUTHOR> http://en.wikipedia.org/wiki/John_Doe

<comment><USER2> Why is this just a link to a Wikipedia article? I don't see the reference to the titular question.</comment>


Early 80386 CPUs and their errata - <AUTHOR> http://www.pcjs.org/blog/2015/02/23/ <comment><USER2> I found one of these when I was Autodesk back in the early 90s.

It's been awhile, so I'm undoubtedly remembering something incorrectly.

This was in the early days of protected mode DOS software. Some customers were reporting an lockup issue with AutoCAD in rare instances when a particular command was used.

It took awhile, but I finally narrowed it down to running the "3-point arc" command on a system with a math co-processor and low memory (so it's paging) on certain 386-20 chips.

I don't recall the exact fix, but we did put some Intel-recommended code in the app to workaround the lockup. The 386 was quickly superseded by the 486 (which had its math co-processor built in which was huge for AutoCAD users back then) so this entire issue quickly disappeared.

Fun times.

<comment><USER3> The 486sx, at least at the start, did not have a coprocessor at all.

<comment><USER4> The 486DX was the original 486 and it definitely did include an FPU. The FPU- free 486SX came along a couple of years later. My recollection is that the SX was originally a way to make use of 486DX chips that failed manufacturing tests on the FPU; they'd disconnect the FPU portion of the die and sell the busted chips as "486SX". Same trick AMD pulled with the 3-core Phenom.

<comment><USER3> The 486dx did, which is why I specified 486sx.

<comment><USER4> My apologies; I thought you were making a comment which was intended to be relevant to the one you were replying to, which concerned the change from the 386 to 486DX. I am not sure what relevance the configuration of the later 486SX would have to the situation msisk6 described.

</comment></comment></comment></comment></comment><comment><USER5> Related story about Windows 95 on the B1 stepping:

[http://blogs.msdn.com/b/oldnewthing/archive/2011/01/12/10114...](http://blogs.msdn.com/b/oldnewthing/archive/2011/01/12/10114521.aspx)

<comment><USER6> I particularly liked the part where they had to use a 32-bit NOP because doing NOP on 16-bit data at that spot would've triggered the errata.

</comment></comment><comment><USER7> _Assembling a detailed and accurate history of the 80386, including a complete listing of all the "steppings" (revisions), when they were released, what "errata" (problems) each stepping suffered from, and which of those problems were fixed by a later stepping, seems virtually impossible at this late date._

I'd guess that part of this could be because a lot of interesting info used to be on various small now-defunct or deindexed sites. Even if it's largely historical information, it doesn't feel right to just let it disappear, as sometimes it can be used to solve some mysteries. It's too bad the Internet Archive doesn't have a Google-like search function.

However, as long as this list is, it seems to be missing the somewhat more famous POPA(D) bug:

[http://computer-programming- forum.com/46-asm/c4c6d6725060904...](http://computer-programming- forum.com/46-asm/c4c6d67250609049.htm)

<comment><USER8> Isn't this one listed in 86LIST04.LST?

That list is still easy to find via Google? I believe it is bundled with the Ralph Brown interrupt list.

What "doesn't feel right to me" is Google's treatment of Usenet archives.

It should still be possible to download these messages in their original plain text format, in bulk using only the internet... i.e., without using the www and all the cruft that comes with it.

</comment></comment><comment><USER9> It might look scary if you never worked with Microchip microcontroller :)

<comment><USER10> Hah, this resonates with me. I was so excited about the PIC32MZ family (MIPS M4K with a decent amount of RAM and some peripherals, cool!) but the errata is just _staggering_. These chips are "in production" but the errata is long, and it's not just bugs and functions that fail to meet datasheet specs (which is pretty bad by itself)... a lot of functionality is simply listed as "does not function" or "not operational."

<comment><USER6> Yeah, this tends to happen a lot on modern microcontrollers with lots of complicated peripherals from what I've seen, especially in pre-production steppings of the chip

</comment></comment></comment><comment><USER11> Some things seem downright scary in the first erratas

> Misaligned Selectors: If a 16-bit memory operand is loaded into a segment > register, the 80386 hangs if the selector is not word-aligned

> Incorrect Interrupt Vector: If a maskable interrupt occurs immediately after > the 80386 has executed an instruction with an 8-bit operand, the interrupt > is always assigned a vector number of 0.

I can understand, since they probably did a lot of it by hand. It was also more advanced than the 80286 being 32-bit, memory protection (though I think some of it was on the 80286), etc

<comment><USER9> Actually 386 was almost 100% autogenerated. Only bits done by hand was a glue logic between code generated blocks.

Intel embedded its engineers at Berkeley (afaik) for a full year to work with students on the brand new VLSI software that made 386 possible.

Intel started doing formal proofing of its logic blocks after Pentium FPU fiasco.

<comment><USER12> I'm not entirely sure if it was quite so heavily software synthesized at that point. I think a lot of the logic and datapath was still done by hand.

The grad student I think you're talking about is (now) Dr. Carl Sechen who developed an Auto Place and Route tool he named Timberwolf. Those tools don't synthesize logic so much as they choose optimal locations and orientations for the standard cells on the wafer and then attempt to route the metal interconnects (all with respect to timing). I think it wound up being rather buggy (to the point they had to keep calling him back from school work to patch some things up) and a fair number of things had to be corrected by hand.

I did hear that some of the units on the 386 were written in some Stanford devised programming language from the pre Verilog/VHDL toolstack days and that a few engineers in design automate hacked up a tool flow to turn that programming language into something synthesizable.

That said I wasn't there and so I can't claim to know for sure. I would wager there are some good interviews and documents either with the Intel Museum folks or the Computer History Museum in Mountain View (which seems to always have both contacts from the day and documents for all the old fun computing hardware).

<comment><USER9> I read it here [http://webee.technion.ac.il/people/kolodny/ftp/IntelCADPaper...](http://webee.technion.ac.il/people/kolodny/ftp/IntelCADPaperFinal2.pdf) plus some stuff written by Randal Bryant (of mossim/cosmos fame)

<comment><USER11> That's a great article!</comment></comment></comment></comment></comment>


A theory of the learnable - <AUTHOR> https://blog.acolyer.org/2018/01/31/a-theory-of-the-learnable/ <comment><USER2> Very interesting topic indeed !

Me and two other researchers have published a paper[1] using Valiant's Probably Approximately Correct learning to learn regulatory Gene networks, which can be interesting if you want to dig deeper !

If anyone has questions on the topic, feel free to ask, I'll keep an eye on the thread.

[1]A. Carcano, F. Fages, and S. Soliman, "Probably Approximately Correct Learning of Regulatory Networks from Time-Series Data," presented at the CMSB'17 - 15th International Conference on Computational Methods for Systems Biology, 2017, vol. Lecture Notes in Computer Science, pp. 74–90. [https://hal.archives-ouvertes.fr/hal-01519826v2](https://hal.archives- ouvertes.fr/hal-01519826v2)

<comment><USER3> Thanks for the paper link! I've been digging into PAC learning so I'm taking anything I can get.

On the paper, I was hoping you could help me understand a few things: \- It seems that the main finding is that any k-CNF form, like Thomas' Boolean Regulatory Network, can be expressed by PAC learning bounds. In section 4 of the abstract [1], you mentioned that "when the dimension increases... the PAC learning algorithm can leverage available prior knowledge...". Are you referring to the time dimension adding more clauses to the k-CNF? \- I'm having trouble reconciling the PAC term "h" with "model confidence" in section 5.2. Is this allowed because the PAC learning "delta" (probability) [2] parameter is dropped for the k-CNF adaptation? \- In this concrete case, is the learning portion just the mapping the stochastic traces to outputs (i.e. lookups)? I'm missing some understanding on how such a mapping handles stochasticity.

You'll have to forgive me, as I'm still trying to understand the paper. It's incredibly interesting to me, so thanks for writing it!

[1] Abstract - [http://mlsb.cc/2017/abstracts/MLSB_2017_paper_11.pdf](http://mlsb.cc/2017/abstracts/MLSB_2017_paper_11.pdf)

[2] PAC Learning - [https://en.wikipedia.org/wiki/Probably_approximately_correct...](https://en.wikipedia.org/wiki/Probably_approximately_correct_learning)

<comment><USER2> Hi ! I'll try to answer your questions as I can :

Unfortunately the final version of the paper is not the one that is on hal -- which is an older one, and I must concede that being new to this whole publishing world, I don't know exactly how you can have access to it. I'll try to sort it out and get back to you. In the mean time, you can refer to the hal version.

      In section 4 of the abstract [1], you mentioned that "when the dimension increases... the PAC learning algorithm can leverage available prior knowledge...". Are you referring to the time dimension adding more clauses to the k-CNF?

I think this sentence is actually referring to what is presented in section 5.3 of the final (and hal version) paper.

      I'm having trouble reconciling the PAC term "h" with "model confidence" in section 5.2. Is this allowed because the PAC learning "delta" (probability) [2] parameter is dropped for the k-CNF adaptation?

I think there are two things here.

First the "delta" you are referring to is indeed taken to be equal to the "epsilon" and both are what we call "h" in section 2.1.

Second, the idea of the discussion in section 5.2 is the following: let's say you fix a number A of initial states and simulate B steps of for each of these states. You will have a given number of (de)activation samples for each (de)activation function. Then, accross all 2n (de)activation functions, take the minimum number of samples you got, and call it Lmin. Then using results from section 2.2, with S=(2n)^(k+1), you can find h so that Lmin=2h(S+log(h)). This h will be your "model confidence".

However, if we didn't have one "h" but one "delta" and one "epsilon" (wikipedia notations), I guess we would not have a given value but only a relation between the two (i.e. defining one would define the other).

I'm afraid I don't get your last point.

I'm new to HN so I hope this answer will be somewhat correctly formatted.

<comment><USER3> Thanks, these are great responses! Also, I apologize for not fixing my own formatting sooner, which makes the questions almost impossible to read. You answered my last question about stochastic traces by explaining the de/activation function relationships with Lmin.

Thanks again!

</comment></comment></comment></comment><comment><USER4> Interesting blog entry but I was a bit disappointed not to hear about Solomonoff induction, as it is often taken to determine quite rigidly what is in principle learnable by induction. What's the connection of the approach mentioned in the blog post to Solomonoff induction?

<comment><USER5> Isn't Solomonoff induction optimal if the target is learnable?

The connection to Kolmogorov complexity is interesting. It implies a perfect learner must have infinite KC or increase KC, neither of which an algorithm can do.</comment></comment>


Ask HN: What are the best resources for learning security and pen testing? - <AUTHOR> <comment><USER2> I create highly technical videos about various topics of IT security. Many of my videos are walk-throughs of CTF challenges explaining my thought process. I think this playlist could be interesting: [https://www.youtube.com/playlist?list=PLhixgUqwRTjywPzsTYz28...](https://www.youtube.com/playlist?list=PLhixgUqwRTjywPzsTYz28I-qezFOSaUYz)

I have also recently started a series on Pwn Adventure 3, where we are hacking a game and I explain my process: [https://www.youtube.com/playlist?list=PLhixgUqwRTjzzBeFSHXrw...](https://www.youtube.com/playlist?list=PLhixgUqwRTjzzBeFSHXrw9DnQtssdAwgG)

Besides that, I can also really recommend livestreams/screenshares from the following creators. To me, seeing how somebody really does it and where they struggle, really really helped me break through a wall I was hitting:

\+ ippsec: [https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA](https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA)

\+ John Hammond: [https://www.youtube.com/user/RootOfTheNull](https://www.youtube.com/user/RootOfTheNull)

\+ Gynvael EN: [https://www.youtube.com/user/GynvaelEN](https://www.youtube.com/user/GynvaelEN)

\+ Derek Rook: [https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA](https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA)

\+ ...

<comment><USER3> I really appreciate your videos.. I'm an early early beginner, regardless though the videos and how you construct them is really entertaining and informative. Keep it up. <3

</comment></comment><comment><USER4> If you like watching videos and following along:

Free: [https://www.cybrary.it/](https://www.cybrary.it/)

Cheap: [https://www.pluralsight.com/](https://www.pluralsight.com/)

The entry level cert in this area is the CEH. It's kind of looked down upon, like a lot of entry level certs are, but studying/working towards that isn't a bad thing.

Books:

\- Practical:

The Web Application Hacker's Handbook 2nd Edition - Gives a very good overview and is a good place to start.

The Hacker Playbook 3: Practical Guide To Penetration Testing - #3 just came out. Haven't gone through my copy yet, but I've heard good things.

RTFM - Red Team Field Manual - Nice to have, quick reference guide

BTFM - Blue Team Field Manual - Like the above, but for the good guys ;)

\- Covering the bigger picture, if you're curious (geopolitical):

The Hacked World Order: How Nations Fight, Trade, Maneuver, and Manipulate in the Digital Age

The Red Web: The Struggle Between Russia's Digital Dictators and the New Online Revolutionaries

Dark Territory: The Secret History of Cyber War

Cyberspies: The Secret History of Surveillance, Hacking, and Digital Espionage

<comment><USER5> > It's kind of looked down upon, like a lot of entry level certs are

Well, it's an entry level cert, as you say. Passing CEH doesn't mean someone knows what they're doing.

Is there an alternative entry-level qualification that evokes fewer frowns?

<comment><USER6> CISSP is a bit harder but still entry level and has more credibility

<comment><USER7> But still gets looked down on. It's a running joke in pretty much everywhere I've worked that if you see someone with CEH and/or CISSP in their email signature - like a badge of honour - that you know you're going to be in for a real tough time.

<comment><USER5> Well sure. That's like the old joke from Red Dwarf: _Arnold J Rimmer, BSC_. The BSC stood for Bronze Swimming Certificate.

That's not a problem with the certificate, it's a problem with people confusing it for an advanced qualification.

</comment></comment></comment></comment></comment><comment><USER8> There's no standard path in information security, most schools don't offer information security degrees and many extremely successful people in security didn't come from a CS background at all.

Some general recommendations:

\- follow smart security people on Twitter, which is the defacto medium for information security discussion

\- read publicly disclosed bug bounty reports on Hackerone and Bugcrowd

\- read The Tangled Web by Michal Zalewski

\- learn to use Burp Suite

<comment><USER4> > \- learn to use Burp Suite

Burp Suite is an awesome tool for devs as well. The Repeater tool is better for messing with API calls than any of the browser dev tools, imo.

For people finding the proxy setup stuff annoying: install Foxyproxy in Firefox and it makes your life really simple.

<comment><USER9> How about for proxy servers in headless browsers; what do you recommend? Any experience with how public and premium proxies vis-a-vis uptime and reliability compare?

<comment><USER4> Sorry, no experience with that.

</comment></comment></comment></comment><comment><USER10> I highly recommend pentesterlab.com. The Web for Pentester course is a great intro for first timers if you read the PDF and play with the VM

When training newbies I will start with this and get them to play around with google-gruyere.appspot.com.

These are only relevant for web app testing, I haven't been able to find a suitable free resource for network testing but for paid resources OSCP is a great practice course if not pretty challenging for first timers

</comment><comment><USER11> Plenty of good suggestions here already. Some I've not seen mentioned yet:

Books:

Hacking, 2nd edition (some specifics are out of date, but it teaches hacking by teaching how the relevant pieces of a computer work which is still valuable)

Anything else from [https://nostarch.com/catalog/security](https://nostarch.com/catalog/security) that looks relevant to your specific interests

Hands-on practice:

OverTheWire: [http://overthewire.org/wargames/](http://overthewire.org/wargames/) (wargames to ease you into things)

WeChall: [https://www.wechall.net/](https://www.wechall.net/) (challenge site directory that'll help you pick challenge sites based on your topic of interest)

+Ma's Reversing: [http://3564020356.org/](http://3564020356.org/) (old reverse engineering site/community - mostly dead as far as I know but the puzzles will still challenge you and the old articles you can unlock make it a bit of a hacking museum)

CTF Time: [https://ctftime.org/](https://ctftime.org/) (A directory/calendar of tons of CTFs you can play in)

Pwn Adventure: [http://www.pwnadventure.com/](http://www.pwnadventure.com/) (A vulnerable MMO server/client designed to demonstrate common game vulnerabilities)

VulnHub: [https://www.vulnhub.com/](https://www.vulnhub.com/) (A repository of deliberately vulnerable VMs you can host and attack in your security lab)

</comment><comment><USER12> I find that talking to folks in the trenches is incredibly useful. If you're already at a company that has a security team, or even a small company that has folks that deal with infra/app security and/or incidents, you can learn a boatload directly the practitioners on the line. Even better if there's a chat room that you can be a fly on the wall in.

When I worked at Mashery (a SaaS API management company) we were the front end for the APIs of hundreds of companies around the world, handling billions of API calls for the likes of Comcast, Best Buy, Starbucks, Macy's, etc. During my time there, I learned a god awful amount about ops, scaling, amd security, simply by sticking my head in whenever I detected chaos going down.

Some comments mentioned tools like Metasploit, or reading up on the OWASP 10. Yup and yup. Plus, there are other tools to add to your belt that I find indispensable: Charles Proxy (install a MITM to watch web traffic), nmap (discover all the services running on a network)

</comment><comment><USER13> As mentionned several times already, OWASP has very interesting stuff, it's more web application oriented though. ([https://www.owasp.org](https://www.owasp.org))

WebGoat is a good way to put things in practice locally. ([https://github.com/WebGoat/WebGoat](https://github.com/WebGoat/WebGoat))

The project ZAP is a really great tool to help you in the process. ([https://www.zaproxy.org](https://www.zaproxy.org))

Outside the web sphere, exploit database is a great site with a bunch of exploit code, explanation and papers. ([https://www.exploit- db.com](https://www.exploit-db.com))

The tool suite in Kali Linux is also very good if you don't mind read the documentation and try understanding the goal of the tools. ([https://www.kali.org](https://www.kali.org))

Kali NetHunter lets you practice from Android. ([https://github.com/offensive- security/kali-nethunter](https://github.com/offensive-security/kali- nethunter))

Security is such a wide domain that you can quickly get flood. I don't think the ultimate step-by-step learning guide exists.

Once you've learned and practiced a bit, if you don't give up too soon, you will get the point and understand how deep you need to go into a protocol or a system to actually do something yourself (then this not about security documentation anymore, but about understanding how the target works, and how you can make it work the way you want).

I would say that you need to focus on some targets first, and expand the scope over time depending on your needs/interests.

</comment><comment><USER14> CTFs: [https://github.com/apsdehal/awesome- ctf](https://github.com/apsdehal/awesome-ctf) especially [https://www.hackthebox.eu/](https://www.hackthebox.eu/)

In case you want cert: skip CEH, get some basic knowledge and go OSCP

Daily resources:

* [https://www.reddit.com/r/netsec/](https://www.reddit.com/r/netsec/)

* [https://www.hackerone.com/zerodaily](https://www.hackerone.com/zerodaily)

* [https://hackerone.com/hacktivity](https://hackerone.com/hacktivity)

For lightweight learning by watching after work, check out LiveOverflow: [https://www.youtube.com/channel/UClcE- kVhqyiHCcjYwcpfj9w](https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w)

<comment><USER2> thank you for sharing my channel <3

I would also like to highlight the following other creators. For me seeing the process of others has been a lot more fruitful then just following text tutorials:

\+ ippsec: [https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA](https://www.youtube.com/channel/UCa6eh7gCkpPo5XXUDfygQQA)

\+ John Hammond: [https://www.youtube.com/user/RootOfTheNull](https://www.youtube.com/user/RootOfTheNull)

\+ Gynvael EN: [https://www.youtube.com/user/GynvaelEN](https://www.youtube.com/user/GynvaelEN)

\+ Derek Rook: [https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA](https://www.youtube.com/channel/UCMACXuWd2w6_IEGog744UaA)

\+ ...

<comment><USER14> Wow, thanks for sharing and for your hard work on your channel!

I recommend it to everyone who is even remotely interested in security as your videos provide really valuable knowledge which is very easy to digest in the same time.

Thank you and keep it up please!:)

</comment></comment></comment><comment><USER15> If your goal is to land a job with the skills you acquire, you'll need more than just solid basic skills. It would be helpful to keep abreast of new developments, where there might not necessarily be a lot of training material yet.

One way to keep up on what's new, is to watch the talks posted by security conferences. Speakers generally submit their freshest work, and are often playing their own game of resume-enhancement by getting their name associated with hot topics. So pay attention to not just the topics, but also the vocabulary around them...

A lot of the newest-fanciest research won't necessarily be within your grasp as a neophyte, but some of it will, and some of it will inform your direction and focus as you work your way up.

And some of it will suggest entirely new avenues, disciplines, and modes of thinking.

</comment><comment><USER16> This should help - [https://www.zaproxy.org/](https://www.zaproxy.org/)

</comment><comment><USER17> [https://www.pearson.com/us/higher-education/program/Dowd- Art...](https://www.pearson.com/us/higher-education/program/Dowd-Art-of- Software-Security-Assessment-The-Identifying-and-Preventing-Software- Vulnerabilities/PGM306255.html)

</comment><comment><USER18> OffSec's course is both very well-respected and very in-depth.

[https://www.offensive-security.com/information-security- trai...](https://www.offensive-security.com/information-security- training/penetration-testing-training-kali-linux/)

The price isn't bad, either.

</comment><comment><USER19> Resources I like:

DDoS BootCamp: [https://www.ddosbootcamp.com/](https://www.ddosbootcamp.com/)

InfoSec Industry: [https://www.infosecinstitute.com/topics/information- security...](https://www.infosecinstitute.com/topics/information-security- training/)

Learning Tree (might have free access through your local library): [https://www.learningtree.com/training-directory/cyber- securi...](https://www.learningtree.com/training-directory/cyber-security- training/)

and several courses available on Coursera: [https://www.coursera.org/learn/it- security](https://www.coursera.org/learn/it-security)

</comment><comment><USER20> This is a good intro to pen testing: [https://www.sgsgroup.com.hk/en/news/2014/02/general- requirem...](https://www.sgsgroup.com.hk/en/news/2014/02/general-requirements- and-test-methods-for-pen)

</comment><comment><USER21> This often goes overlooked on a forum full of coders, but not everyone who reads HN or wants into infosec is proficient with a major scripting language.

I'd bet being solid in python/bash/powershell would come in handy, and that having no skills in any of them may be a dealbreaker.

<comment><USER22> Highly recommend python or perl myself - and obviously know how to use bash as well.

One related suggestion: _Do not_ become reliant on third party modules/add-ins (other than the standard library stuff) - at least when learning. Really learn how it works.

</comment></comment><comment><USER23> [http://www.securitytube.net/](http://www.securitytube.net/) [https://www.pentesteracademy.com/](https://www.pentesteracademy.com/) ... both run by same company

</comment><comment><USER24> Resources I like that haven't been mentioned yet:

Offensive Computer Security (used to be a class at FSU): [http://hackallthethings.com/ocs.php](http://hackallthethings.com/ocs.php)

[https://www.cs.fsu.edu/~redwood/OffensiveComputerSecurity/le...](https://www.cs.fsu.edu/~redwood/OffensiveComputerSecurity/lectures.html) (2014 version)

Opensecuritytraining (various stuff on different topics): [http://opensecuritytraining.info/Welcome.html](http://opensecuritytraining.info/Welcome.html)

</comment><comment><USER25> No-bullshit, basics of hacking guide often referenced as preparation material for the OSCP exam.

[https://nostarch.com/pentesting](https://nostarch.com/pentesting)

/r/netsec

netsecfocus.com - chat community, super active

</comment><comment><USER26> This Medium article provides a comprehensive overview [https://hackernoon.com/how-to-become-a- hacker-e0530a355cad](https://hackernoon.com/how-to-become-a- hacker-e0530a355cad)

Books

<comment><USER26> Author maintains a GoodReads page [https://www.goodreads.com/user/show/57131835-andrew- douma](https://www.goodreads.com/user/show/57131835-andrew-douma)

</comment></comment><comment><USER27> How about these courses: [https://www.edx.org/micromasters/ritx- cybersecurity](https://www.edx.org/micromasters/ritx-cybersecurity) it's free if you don't want the certificate and Johnathan S Weissman is an amusing and informative geek.

I've only done the foundation so far, but as a long time developer I've already learnt a few things

</comment><comment><USER28> AskNetsec on reddit.

OWASP find your local chapter and go to meetings.

YouTube, and pentesterlab (even the free ones are better than most (even all) other paid resources).

</comment><comment><USER29> Learn the OWASP top 10

Use vulnerable VM's and practice like Metasploitable and [https://github.com/SecGen/SecGen](https://github.com/SecGen/SecGen)

Get the OSCP

I also highly recommend being good at some programming. This is for source code review and quick scripts/exploit development.

<comment><USER4> > Get the OSCP

I mean, sure, yeah, that's great, but that's not an easy task.

</comment></comment><comment><USER30> The university of NSW (respected Australian uni) is putting up a bunch of materials from their Masters in Cyber Security. It's going up slower than expected but the lecturer is engaging and the first subject to roll out covers a lot of good philosophy of security type subjects.

Find it at sec.edu.au/moocs

</comment><comment><USER31> This 'awesome list' is a great list of curated security resources. [https://github.com/sbilly/awesome- security/blob/master/READM...](https://github.com/sbilly/awesome- security/blob/master/README.md)

</comment><comment><USER32> For getting started in web security, the Hacker101 series by HackerOne is a great — and free — place to start. And I believe they are currently adding new content every month.

[https://www.hacker101.com/](https://www.hacker101.com/)

</comment><comment><USER33> recommended way, 1\. learn operating system internals, start using Linux 2\. learn computer networking. TCP/IP, OSI layer and network protocols like TCP, UDP, HTTP 3\. learn about software programs and Web application architecture 4\. start following up security related resource like books, videos, courses (OSCP is great).

\- Pick one programming language along the way and try scripting programs while learning. \- you need not master every topic but knowledge of how and why everything works the way it works increases you expertise as security practitioner \- since there are many public bug bounty programs these days, legally testing out stuffs to hone your knowledge has never been easy. plus you get paid.

</comment><comment><USER34> [http://security-and-privacy-reference- architecture.readthedo...](http://security-and-privacy-reference- architecture.readthedocs.io/en/latest/) with Only open resources

</comment><comment><USER35> I'm going through HackTheBox to prepare for taking the OSCP course. [https://www.hackthebox.eu/](https://www.hackthebox.eu/)

</comment><comment><USER36> Surprised I didn't see the Matasano security challenges mentioned yet:

[https://cryptopals.com/](https://cryptopals.com/)

</comment><comment><USER37> for learning security I'd start with this book:

Security Engineering — The Book [https://www.cl.cam.ac.uk/~rja14/book.html](https://www.cl.cam.ac.uk/~rja14/book.html)

</comment><comment><USER38> Follow anyone from SpecterOps and the content they put out.

</comment><comment><USER39> r/netsec</comment>


Compensate for Google Maps inaccuracy - <AUTHOR> https://coderwall.com/p/18e3ug

<comment><USER2> This inaccuracy may not arise from what you think. Each map has a "datum", a coordinate correction that obeys one or another convention. Examples include NAD83, NAD27, GRS80 and WGS84. Which of these corrections are applied may change the location of sites on the resulting map when it's compared to satellite-derived positions. And a GPS receiver must be told which datum to use.

<http://en.wikipedia.org/wiki/North_American_Datum>

<http://geography.about.com/od/geographyintern/a/datums.htm>

A quote from the second link: "Today, there are hundreds of different datums in use; but, they are all either horizontal or vertical in their orientation. The horizontal datum is the one that is used in measuring a specific position on the earth's surface in coordinate systems such as latitude and longitude. Because of the different local datums (i.e. those having different reference points) the same position can have many different geographic coordinates so it is important to know which datum the reference is in."

So it may not be as simple as saying "Google maps inaccuracy", even though that's the outcome.

> That is when I realized satellite maps is fine, but road map is off by some > distance.

This sounds as though the satellite map used one datum and the road map another. This is fairly common in locales other than the continental U.S. and Europe.

I just performed a comparison for a freeway intersection in Hangzhou:

[https://maps.google.com/maps?q=hangzhou&hl=en&ll=30....](https://maps.google.com/maps?q=hangzhou&hl=en&ll=30.334602,120.140111&spn=0.012594,0.019226&sll=47.272986,-120.882277&sspn=5.069316,9.84375&hnear=Hangzhou,+Zhejiang,+China&t=h&z=16)

... and came up with an approximate error of 521 meters between the satellite and road maps. This is a rather extreme case, but it could easily be explained by the use of one datum for the satellite map and another for the road map. Here's a reference about this:

Source: <http://en.wikipedia.org/wiki/North_American_Datum>

Quote: "A point having a given latitude and longitude in NAD27 may be displaced on the order of _many tens of meters_ from another point having the identical latitude and longitude in NAD83, so it is important to specify the datum along with the coordinates."</comment>


Streaming encryption protocol based on libsodium's box primitive - c-rack https://github.com/dominictarr/pull-box-stream <comment><AUTHOR> The protocol uses symmetric crypto primitive from Sodium, leaves key distribution - arguably the most difficult part - beyond the scope.

I'm not a cryptographer, but I do know, that cryptographic protocols are damn hard and their design should be left to professionals.

<comment><USER2> regards to professional cryptographers, here are two quotes:

First, from Matthew Green:

> A while ago on Twitter somebody asked why I spend so much time criticizing > things that are old and broken, rather than making things new and shiny. > When I finished sputtering, I realized that the answer is simple: I'm lazy.

(from this blogpost: [http://blog.cryptographyengineering.com/2012/12/the- anatomy-...](http://blog.cryptographyengineering.com/2012/12/the-anatomy-of- bad-idea.html) )

and the second from Diffie & Helman's classic paper, _New Directions in Cryptography_

> The last characteristic which we note in the history of cryptography is the > division between amateur and professional cryptographers. Skill in > production cryptanalysis has always been heavily on the side of the > professionals, but innovation, particularly in the design of new types of > cryptographic systems, has come primarily from the amateurs.

(from: [http://www.cs.jhu.edu/~rubin/courses/sp03/papers/diffie.hell...](http://www.cs.jhu.edu/~rubin/courses/sp03/papers/diffie.hellman.pdf))

(note that "cryptanalysis" means _breaking cryptographic systems_)

</comment></comment><comment><USER2> Hi I am the author of this protocol (but I did not post it to hacker news)

To clarify: this is not a substitute for TLS, DTLS, Curvecp, or Noise-Pipes -- because there is no key agreement handshake.

You could use this _with_ a suitable handshake protocol to encrypt the rest of the session, or you could encrypt a file.

Do not use this protocol on it's own to encrypt a tcp connection. I have updated the protocols documentation to make this more clear.

</comment><comment><USER3> This is a bit weird. Why not use an AEAD construction? Libsodium provides ChaCha20Poly1305, conform to RFC 7539.

The code is also confusing. "box" is actually the "secretbox_easy" operation, but rewritten using "secretbox". Which intentionally doesn't exist in libsodium.js because it only makes sense in C code.

<comment><USER2> Hi I am the author of this protocol (though I do not know who posted it to hacker news)

You ask a good question, but I would much rather discuss it on github, since then that discussion will be tied to the project not a hacker news thread.

[https://github.com/dominictarr/pull-box- stream/issues/5](https://github.com/dominictarr/pull-box-stream/issues/5)

</comment></comment><comment><USER4> Any idea how it compares to CurveCP [[http://curvecp.org/](http://curvecp.org/)] and Noise [[https://github.com/trevp/noise/wiki](https://github.com/trevp/noise/wiki)]?

<comment><USER5> This protocol has no forward security; so, poorly by comparison.

<comment><USER3> This protocol assumes there's already a shared secret. So you need another one for the key exchange. Which can provide forward security. Or not.

</comment></comment></comment><comment><USER6> What are some uses people are thinking of after reading the README?

Here are some of mine:

* Encrypted live communication (video, voip, IM) via a web browser

* Could something like this be added to the SSL/TLS security in HTTP?

</comment><comment> TD-Linux Why should I ever use this instead of DTLS?

</comment><comment><USER7> This would be great as a obfsproxy plugin if I understand it correctly</comment>


Kentucky teen faces charge for naming attackers in tweets - <AUTHOR> http://www.sfgate.com/news/article/Kentucky-teen-faces-charge-for-naming-attackers-3724973.php <comment><USER2> I have very strong feelings both ways about this.

On the one hand, I believe in severe punishment for violent crimes and generally dislike juvenile protection for teenagers. Additionally, it isn't clear to me how broad the gag order was, but she should certainly be allowed to talk about what happened to her (though, if you agree with juvenile protection, I could see a gag order on anything which identifies them).

On the other hand, justice isn't only meant to serve the interest of the victim - which is something easily forgotten (which is why victims don't dictate the punishment!). What sentence best serves their rehabilitation? What best protects the public? What is an appropriate deterrent (gag order seems to kill that side of it).

It's complex, yet easy to get caught up by emotion and suggest that they themselves should first be sexually assaulted, then executed. I guess I'm trying to say that we don't know nearly enough about the case to have a valid objective opinion and even if we knew enough, most of us (myself included), don't know nearly enough about law, psychology and sociology to have an objective opinion.

<comment><USER3> Regardless, the victim has a Constitutionally protected right to speech. The purpose of gag orders is to protect the 6th Amendment rights of defendants. However, if those defendants are already convicted (which, in this case they are,) and an appeal is unlikely (they pled guilty) then the 6th Amendment purpose of the order is nullified.

As a result, a post-trial gag order is going to be exceptionally hard to justify because of 1st Amendment grounds.

Nebraska Press v. Stuart (1976) overturned a judge's gag order against the press. The entire point of a gag order or "protective order" is to protect the 6th Amendment rights of the defendant. The Supreme Court and Appeals Courts are clear in this regard.

The point is, this girl should take this case to Federal Appeals Court -- she'd win because the judge has no Constitutional leg to stand on, especially since this is post trial/conviction. She should have a right to speak about her experiences wherever and to whomever she pleases. Her right to speak cannot be infringed if there is no underlying Constitutional conflict (i.e. right to a fair trial, etc.)

<comment><USER4> My understanding is that constitutional rights of minors are not as absolute as adults.

<comment><USER5> You are incorrect. When it comes to public school, students and parents sign documents agreeing to be bound by a code of conduct and the like, effectively modifying the students' asbolute rights or even signing some rights away. But in general, citizens of the United States, regardless of age, have the same rights.

<comment><USER6> > signing some rights away.

If a "right" can be signed away, it's not really a right. I recall reading about a case where a woman agreed, in writing, to waive her right to maternity leave under FMLA. She then changed her mind, and the employer sued and lost on the grounds that rights cannot be signed away.

Looked at from that lens, you're arguing that a child's rights can be signed away. My argument is that therefore they aren't rights.

<comment><USER7> Certain rights can be signed away. A right that cannot be given up, even willingly, is called an 'inalienable' right.

Thus in most of the world today, you cannot willingly sell yourself into slavery.

<comment><USER4> Exactly.

But many of these rights (eg, the right to carry arms, the right to enter into contracts, etc) are limited to adults.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I'd think it's safe to say the accused are guilty. If you're not going to allow the public the opportunity to see that justice is served...

This gets me fuming mad! I say let the girl speak and if the judge insists she serve 180 days and pay a $500 fine, I'll send the money myself and offer her a job when she gets out. Hide the sentence from the public and protect their identities my ass. They were the attackers.

<comment><USER8> It's a juvenile case. The courts have _never_ allowed the public to the opportunity to see that justice is served.

<comment><USER5> But that's for the protection of victims.

</comment></comment></comment><comment><USER9> How is it that a victim, who had no involvement in the agreement reached, be bound by said agreement? This seems a significant failing of the justice system.

<comment><USER8> Because it's not a contract, it's a court order.

<comment><USER10> The thing that's bothering people is that it's a court order that limits the rights of the victim. If I lose my wallet and someone finds and returns it to me, I am free to publicly name and thank them. It seems wrong that if I am sexually assaulted instead, there is a court order preventing from doing the same thing, gagging me about my own (unwilling) experience.

I'm sure there's plenty of legal precedence for this kind of thing. I don't know much about law. But I'm not talking about the legal basis for the argument. I'm talking about how wrong the conclusion seems based on the human factors.

<comment><USER11> In what civilized society are criminals tried, convicted, and executed on the basis of public opinion?

I'm not saying that this particular case is worthy of a gag order, but the theoretical justification seems completely sound to me.

I also find your appeal to "human factors" to be rather vague. Human factors often include things like blind rage and thirst for vengeance. These are not things to build a legal system (or really, a society) on.

<comment><USER12> Don't be so hyperbolic. We're talking about blame, not execution, not any kind of punishment. And aren't they already convicted by the court system?

<comment><USER13> You're not serious are you ?

Have you not seen the many cases of vigilantism when people's names/addresses have been posted online.

There have been some terrible situations on Reddit and 4chan.

<comment><USER12> That sort of mob vigilantism is loosely coupled with actual guilt. It's more about tossing out a name and some kind of accusation, with people only sometimes checking if it's true before acting. Naming people at all is a problem, the additional factor of guilt is far less of one.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I'm annoyed that no one is reprinting the names. If she's going to do the time she at least deserves that satisfaction, and the gag order doesn't apply to anyone not a party to the case.

<comment><USER12> I had assumed it would be easy to find. But I went to her twitter and it's now private. I'm baffled.

<comment><USER14> The attackers names are apparently Will Frey III and Austin Zehnder, Sophmore lacrosse players attending the Trinity High School in Lexington, KY.

Pics here: <http://www.bluegrassbats.com/5715.html>

</comment></comment></comment><comment><USER15> In violation of a court order. This shouldn't come as a surprise. Regardless of whether she's right or wrong, this is a decision where the price was clear. It was her choice to pay it.

<comment><USER16> Why is there always a comment from the legal fatalism gallery in every HN thread like this? Can we not strive for victim's rights or for more human policy-making?

Beyond that, it's annoying, obvious, and contributes nothing.

<comment><USER17> Naming people on the internet in regards to sexual crimes is dangerous. I understand the frustration of her and her family and I cannot say she was wrong to make the injustice public.

With that said, this is not a clear cut issue. I hope grace prevails and we do not attempt to ruin the boys lives in pursuit of vengeance. This is not something a mad internet does very well and would be a justifiable reason for the court to ban publication.

<comment><USER18> So sexual assault is OK as long as they are kids? I have four kids and often think courts are ridiculously stupid for trying them as adults.

However, two of my kids are daughters. As the victim, their rights should trounce the rights of the attackers. That doesn't _necessarily_ mean naming them, but if they aren't going to be named (which is usually the right thing to do for juveniles), they must be appropriately punished.

Unfortunately, we are missing whether they were appropriately punished. From her perspective, I'm sure the answer is No, but objectively, we don't know the answer.

I can't imagine how much it would suck to be a judge.

<comment><USER19> >So sexual assault is OK as long as they are kids?

OK? of course not. But it shouldn't destroy their whole lives, the way being publicly named would. As long as you're a kid you deserve another chance, even after murdering someone. That's the whole point of trying juveniles differently.

</comment></comment></comment></comment></comment><comment><USER20> Brave girl.

<comment><USER21> No. Irresponsible, immature child.

<comment><USER22> If these guys wanted their reputations intact, maybe they shouldn't have sexually assaulted an incapacitated minor.

<comment><USER23> You're implying that they're not minors themselves.

<comment><USER24> Other than the part where we don't typically release the names of minors, what's your point?

<comment><USER23> So we're engaging in the double-standard where minors make superior victims for the tabloids due to their immature status, but as perpetrators we're willing to try them as adults?

The fact that minors have greater legal protection isn't because they're cute little kiddies, but because it's generally accepted that their decision-making isn't as mature. You get a bit more leeway for bad decisions when you're young - hell, in my state, people under 10 years of age simply cannot be tried for murder.

Given your combative 'screw them even if they're minors' tone, would you really support trying minors as adults?

<comment><USER22> I don't believe in an invisible line of maturity at 18 years old, no. If it were up to me, I'd decide it case by case, not by some blanket law. But that's pretty unmanageable.

These were not kids. They were 17, committed a serious crime then bragged about it. Then they got their names mentioned in public by a victim who feels like this destroyed a part of her youth.

I feel no pity that she may have found a way to return the favour.

<comment><USER23> So if 17 isn't a minor in your eyes, what's the point of referring to it as a crime against a minor, since the victim was also 17?

The point I'm making is that the guy I was responding to was trying to have his cake and eat it too.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> What did they boys gain from the plea agreement? Were they facing more severe charges? Did they managed to not have their names entered on the sex offenders register?

</comment><comment><USER26> Why is this on Hacker News? Because Twitter is tangentially involved?

<comment><USER27> Yeah we should get back to more important stuff like, why vim is so much better than textmate :p

I feel like hn articles are more an expression of the community's interests than centered around a specific set of topics. Kinda the vibe I've always got anyways.

</comment></comment><comment><USER28> The girl should have the power to ruin the lives of these boys. If they get a job, she should be able to send a letter to the all their coworkers describing what they did to her. When they enroll in college, she ought to be able to take an ad out in their college newspaper. If they are on Facebook, she ought to be able to take out ads targeting women in the cities where these men live. She is in possession of the truth and nothing should hinder her right to communicate that truth, up to the point of publicly shaming these men into suicide.

I'm not saying she has these rights, I'm just saying she ought to. The truth is not something that should be silenced, even if that means that a few upper- class rapists from the South might not get the life their parents tried to buy.

<comment><USER29> > _"The girl should have the power to ruin the lives of these boys."_

The danger with granting such power is that you also risk granting it in situations where it isn't deserved.

</comment></comment><comment><USER30> One of the nation's top First Amendment scholars thinks the court order is unconstitutional, likely to the point of being "transparently invalid":

<http://www.volokh.com/2012/07/22/the-dark-side-of-privacy/>

While it would have been better for her to appeal the order first instead of just violating it, it's almost certain this judge will be benchslapped on appeal.

</comment><comment><USER31> So, if you want to cover up something bad you've done, just make sure you get charged with a crime, and the court will protect you? Strange system.

</comment><comment><USER32> How is it that only the girl's name is released and published in the article? Seems like if the two guys pleaded guilty, we should know all of the parties involved.

<comment><USER33> I quote from the article:

"The Associated Press does not normally report the names of sexual assault victims, but Dietrich and her parents say they do not want to shield her identity and want her case to be public."

The the AP is still bound the court order and probably can not name the perpetrators.

</comment></comment><comment><USER34> <https://twitter.com/savymarie_> is her twitter account, but it seems to be protected.

</comment><comment><USER35> What an ironic case... They fucked (raped) her, took photos, and shared them with other people.

She can't talk about any of this with other people.

The justice system baffles me.

<comment><USER21> The article didn't say that she was raped. The boys were charged with first degree sexual abuse.

<comment><USER35> Oh, I'm sorry. I thought that's just legal-speak for rape. What does it mean, really?

</comment></comment></comment><comment><USER36> someone start a kickstarter for this girl.

</comment><comment><USER37> I think the kids deserve some free pizza courtesy of 4chan...

<comment><USER38> This is childish, stupid and hurts nobody but the pizza stores.

<comment><USER39> To be fair, I'm sure like all costs the pizza stores ultimately pass them on to their customers.

<comment><USER40> How would a franchise operation do that? If corporate sets the prices and the franchise eats the bill for these pranks, then it sounds like the franchise owner is losing out.</comment></comment></comment></comment>


Visual Guide to NoSQL - <AUTHOR> http://blog.nahurst.com/visual-guide-to-nosql-systems?tag=nosql

<comment><USER2> Please, no.. That visual is about as misleading as it gets. It is not about CA vs CP vs AP. In fact, even talking about it in those terms obscures the actual implications of the "CAP" theorem.

Short of going into a rant on the topic, please do check out: [http://www.igvita.com/2010/06/24/weak-consistency-and-cap- im...](http://www.igvita.com/2010/06/24/weak-consistency-and-cap- implications/)</comment>


Twitter 'flat lined' with new user base - <AUTHOR> http://edition.cnn.com/2010/TECH/01/26/has.twitter.peaked/index.html

<comment><USER2> I think Twitter has actually done a poor job of communicating what they are.

They got pigeonholed as being about "what I had for lunch" and they haven't totally broken out of that in the mind of the broader public.

Their internal documents that leaked to TechCrunch indicated that they have a much clearer and more ambitious vision internally, they really need to get that across to the general public.

It feels like there's some internal conflict about their commercialism vs their desire to be hip. That's a hunch, though.

</comment><comment><USER3> And they will go downhill from now on...</comment>