Data-mining 10,000 Facebook status updates to graph breakup patterns - <AUTHOR> http://www.geekosystem.com/facebook-breakup-graph/

<comment><USER2> It's been said that the credit card companies have such good data on spending patterns that they can predict major life events, such as weddings and divorces.

Anyway, I called Amex and they wouldn't tell me mine...

</comment><comment><USER3> original post: [http://mathiasmikkelsen.com/2010/10/amazing-facts-about- face...](http://mathiasmikkelsen.com/2010/10/amazing-facts-about-facebook-and- breakups/)

although still no y-axis :(

</comment><comment><USER4> I'm curious to see if this guy will get a letter from Facebook's legal department, like Pete Warden did.

</comment><comment><USER5> Based on their election widget and access to demographic information, Facebook probably could put together scarily accurate, realtime election results.

</comment><comment><USER6> This is quite US-centric.

<comment><USER7> The world is US-centric.

<comment><USER8> Facebook isn't. From <http://www.facebook.com/press/info.php?statistics> : "About 70% of Facebook users are outside the United States"

<comment><USER9> But it isn't the US vs the World, its the US vs other individual countries. Which other countries make up 30% of Facebook's population?

</comment></comment></comment></comment><comment><USER10> This means 10000 status updates that mentioned a break-up. I did not guess that at first and was surprised how many of 10000 random updates could have been breakups...

<comment><USER11> Probably looked at relationship status changes. I'd personally be interested in seeing the opposite -- i.e., peaks in people starting relationships, as well as the inter-arrival periods of relationships.

</comment></comment><comment><USER12> Hm. Any idea why people break up so often before Christmas?

<comment><USER13> "I'm thinking about breaking up anyway, and I don't feel like spending a bunch of money on a Christmas gift."

</comment></comment><comment><USER14> 10,000 statuses over the course of year is not a significant percentage. Did he just pool his friends status's?</comment>


Ask HN: How much equity when joining a 1M revenue startup? - <AUTHOR> I consulted for this company since inception and now they are doing 1M in revenue per year.
They are bringing me in as CTO for 1.5% + salary
Do you think this is a good deal?
Thanks. <comment><USER2> Do you feel it is not a good deal? Or do you think you should be negotiating for more? Maybe because you think that's what you should be doing or you believe they expect you to do so?

If the deal feels good and you feel great then why the second guess?

</comment><comment><USER3> Did you ask about dilution and things like what happens to your shares if the company sells for 3x or .5x etc? There's a number of things to know before hand but 1.5% seems nice to my uneducated eyes.

<comment><USER4> This. Look up "dilution". The VC could have 2X or higher. At the end you could get none of those magic beans.</comment></comment>


Ask HN: How to keep a mobile office running without power? - <AUTHOR>

In two about weeks we'll move our startup from the city to a a big outdoor soccer camp (we do a soccer app). We're planning to rent a mobile home and stay there for a week and we don't know how often we'll be near a regular power-outlet, so we're looking for a solution that let us keep using our laptops continuously.
Either by having a big battery pack inside the mobile home that can power  us for at least 24 hours - preferably more - and then be recharged somewhere. Or even better, some sort of solar-power arrangement so we don't have to worry about re-charging.
What can we do that's still not to expensive to be able to power 3 laptops continuously? <comment><USER2> Why not rent a gas-powered generator?</comment>


HyperMac responds with vengeance, and non-patent infringing adapter - <AUTHOR> http://www.engadget.com/2011/01/06/hypermac-responds-with-vengeance-and-non-patent-infringing-adap/

<comment><USER2> How is that responding with a vengeance???</comment>


Ask HN: Any good books on the economic impact of automation? - <AUTHOR> Within my tech circles I keep hearing talk of a "universal basic income" in regards to the oncoming wave of AI and automation where not only blue collar but also white collar jobs are made redundant.<p>Are there any economists who are writing on this topic? Politicians keep talking about bringing back "manufacturing" but no one is talking about AI and what the labor market will look like a hundred years from now. <comment><USER2> 1\. Race Against the Machine by Brynjolfsson and McAfee

2\. The Second Machine Age by Brynjolfsson and McAfee

3\. The Lights in the Tunnel by Martin Ford

4\. Rise of the Robots by Martin Ford

5\. Average is Over by Tyler Cowen -specifically, the parts about labor market bifurcation and man-machine pairs

Brynjolfsson and McAfee are MIT economists. Top notch. Cowen is also an excellent economist at George Mason.

<comment><AUTHOR> Thank you, i'll take a look at these. I've read Average is Over and will probably buy his new book in Feb. as well.

</comment></comment><comment><USER3> I think Brian Hanson did good work on looking that far.

But looking ahead 100 years isn't really withing the reach of economists.</comment>


Ask YC/PG: Is it ok for me to accept angel funding before getting into YC? - <AUTHOR>

I recently applied to YC. On the application I put that there were no other investors. However, since then, there has been interest and I have an investor anxious to close pretty quickly.
It's not a significant stake, and more of just providing a buffer - if I need it.
Will it affect my application if I accept the investment and how would you guys handle that - if I am accepted - given that a new legal entity will be created by you guys. I would want to carve out a portion of equity from the new entity for them - is that something that is a deal breaker/stopper for you guys?
Thanks. <comment><USER2> It's not a deal-breaker unless it's botched. The right way to do it would be to use a convertible note written so that YC funding wouldn't trigger conversion. If you have a lawyer who can arrange that. But you'd have to incorporate, and you (and we) would then be stuck with however you did, so we'd hope you did it right.

If it's a small amount, is it enough to make the legal bills worth it?

<comment><AUTHOR> That's exactly what I was thinking about. Having the first round post-YC funding, trigger the conversion. That way, the sweetner is that if I am accepted, and it so happens that the w11 rounds are anything like S10 (i.e. largely convertible notes), then it works out better for them then because they would be converting to equity while the later stage investors are just getting their notes.

I was trying to avoid running up large legal bills, for the amount considered.

The investor can be considered 'friends and family'. I was thinking that maybe we do up a general agreement on some terms - i.e. everything that a 'standard convertible note' would have with a few tweaks. Then if I am accepted into YC, I then formalize it then - with the documentation that you guys have.

Would that suffice, or would you still want me to do everything with an attorney first?

As an aside, I am not in the US - so doing the official legal documentation and incorporating up there might be more tricky, if I were to do everything on my own (which is why I was thinking of a general agreement with acceptable terms on both sides - with specifics to be hashed out later upon incorporation).

<comment><USER3> > I was thinking of a general agreement with acceptable terms on both sides - > with specifics to be hashed out later upon incorporation

Starting a company is hard enough without building it on a ticking bomb. It's one thing to make a desk from a couple of sawhorses and a board, it's quite another to play lawyer.

Why do you think that you know enough to get this stuff right?

BTW - not just any attorney will do, you need one who has actually done angel- funded startups before in the relevant jurisdiction.

<comment><AUTHOR> I understand that is the general rule of thumb, and I do agree with it. But I am simply looking at the economics of it.

Does it make sense to spend $4K (for example) on legal fees for a deal where I am getting an $8K investment. These aren't the actual figures, but I imagine the legal fees would be at a similar ratio.

<comment><USER3> > Does it make sense to spend $4K (for example) on legal fees for a deal where > I am getting an $8K investment. These aren't the actual figures, but I > imagine the legal fees would be at a similar ratio.

Does it make sense to risk your startup over an $8k investment?

> But I am simply looking at the economics of it.

Are you looking at economics or merely comparing two numbers, whether or not they're the right numbers? The cost of doing it wrong is not limited by the amount invested, let alone the amount of money you "save".

Yes, there's some chance that you might not screw it up, or that your company might fail anyway, rendering the whole thing moot.

How much is the additional risk actually worth?</comment></comment></comment></comment></comment>


This Indian Airport Runs Entirely on Solar Power - <AUTHOR> http://www.popularmechanics.com/technology/infrastructure/news/a16986/cochin-airport-solar-power/

<comment><USER2> Cost of buying solar directly from china ( no tariffs) - 1 dollar / watt.

An average person can live on 2kWh a day.

A 100 w solar panel outputs 470 Wh in bloody england.

500 dollars of installed solar.

1kWh of lead acid battery is 150 dollars.

You can go completely solar for the next 30 years for 1500 dollars and adopting a DC electricity lifestyle.

Tldr : trade protectionism is stupid, especially when some other country's taxpayers are paying for it.</comment>


Why I won't be returning my Microsoft Surface RT - <AUTHOR> http://www.edandersen.com/2012/10/28/why-i-wont-be-returning-my-microsoft-surface-rt/

<comment><USER2>
        I really am sick of lugging around proper laptops when I could just remote into a beefy machine under my desk

VNC/etc has worked fine on iPads for years. What makes the Surface better than an iPad + bluetooth keyboard?

<comment><AUTHOR> It supports pointer devices. The covers have trackpads built in and USB mice work a treat.

<comment><USER2> Ok, so what makes it better than a laptop then? The touchscreen which you don't use? I don't get what's new about it.

</comment></comment></comment><comment><USER3> Thats true. Buy Microsoft Surface, Only if you know, what you are buying. Keep the Surface with you. It is going to be a Huge hit. Peoples will find out the drawbacks, not only find out- but there is a race among few Apple fanboys to write huge posts about showcasing negatives.</comment>


The impact of water vapor on afternoon rainfall - <AUTHOR> https://phys.org/news/2020-05-decoding-impact-vapor-afternoon-rainfall.html <comment><USER2> This rambling account may not do justice to the original research, but I found it just another example of how naive ML correlations find it impossible/difficult/laborious to re-discover basic platitudes of a specialist field.

If you discretize features from a continuous domain, like space-time chunking of "afternoon rain", then it will degenerate into a hybrid CNN-RNN ML system. Wet soil in the morning will depend on "overnight rain" and "morning dew". Then "overnight rain" might suppress afternoon rain, if it drains moisture from the atmosphere etc. etc. There will be various spatial and temporal influences expressed as Bayesian priors.

One fact that I found surprising when I first heard it, but within 10 seconds realized was obvious, is that water is lighter than air (N2 O2 v. H2O). I imagined that clouds need convection currents from hot land causing temperature gradients, for moisture to rise into cooler layers, then condense and rain. But water (MW 18 g/mol) is lighter than air (MW 29 g/mol), so it just rises and rains (unless there is a temperature inversion anti-convection barrier). I imagine many such 'obvious' facts of fluid dynamics that elude CS ML hammer-nail practitioners.

</comment><comment><USER3> Sadly the active radar sensor on the pictured SMAP satellite failed shortly after launch [0]. I've been looking for news on NASA's NIAC Phase 2 R-MXAS studies which, while it looks like it would require some serious material science breakthroughs, could provide near-continuous soil moisture data over an entire continent which suddenly seems even more useful [1].

[0] [https://www.nasa.gov/press-release/nasa-soil-moisture- radar-...](https://www.nasa.gov/press-release/nasa-soil-moisture-radar-ends- operations-mission-science-continues)

[1] [https://www.nasa.gov/directorates/spacetech/niac/2019_Phase_...](https://www.nasa.gov/directorates/spacetech/niac/2019_Phase_I_Phase_II/Rotary_Motion_Extended_Array_Synthesis/)

</comment><comment><USER4> I can rationally appreciate that creating a weather model is an iterative process but still it does weird me out that something as basic as this is being actively researched. Even after reading this I still have trouble saying "we're just figuring out how moist air leads to precipitation".

<comment><USER5> "Over the Southern Great Plains, we found that when the wind brings less moisture, dry soils are associated with increases in rainfall amount; and when the wind brings greater moisture, wet soils are associated with increases in rainfall amount. In the current study, we find that, actually, in many regions, the opposite is true for the likelihood of afternoon rainfall," Welty said.

I'm certainly surprised that it's _so_ nuanced as to be completely the opposite in different areas.</comment></comment>


Computer program deciphers a dead language that mystified linguists - <AUTHOR> http://m.io9.com/5576734/computer-program-deciphers-a-dead-language-that-mystified-linguists <comment><USER2> The headline is technically correct, but quite misleading. The language in question, Ugaritic, was deciphered in 1932. As it was discovered in 1929, it can hardly be said that the decipherment was an arduous process. The significance of the computer program is along the lines of:

> The key strength of our model lies in its ability to incorporate a range of > linguistic intuitions in a statistical framework.

As someone working in NLP, this is quite remarkable, and I don't mean to detract from it; but it should be noted that the model (like the linguists) relied on the fact that Ugaritic is closely related to Hebrew. It would be impossible to use such a model to decipher Linear A, which is probably not related to any known language. (But the model could perhaps be used to check if linguists had overlooked any connection between Linear A and another known language.)

<comment><USER3> Exactly, hardly a lost language.

I happen to have taken an Ugaritic class in college, and after a semester could read the texts without too much trouble. I am a native speaker of Hebrew, so the roots are similar, which made it not very hard.

It used a novel alphabet (likely the first ever) that was a phonetic abjad (no vowels) derived from Akkadian cuneiform (in turn derived from Sumerian cuneiform).

As far as "few tablets" goes, I happen to have used VERY thick books full of transcriptions of Ugaritic tablets. One of the advantages of knowledge about Ugarit (the city) being lost is that until the recent rediscovery of its ruins it lay mostly undisturbed.

So, if we discover another language with close genetic ties to a known tongue and an alphabet that's different but similar, we'll have just the thing :) Of course, this is better than what we had before, my jest doesn't mean to detract!

Onwards with Linear A :>

</comment></comment><comment><USER4> > _The computer program relies on a few basic assumptions in order to make > intuitive guesses about the language's structure. Most importantly, the lost > language has to be closely related to a known, deciphered language, which in > the case of Ugaritic is Hebrew. Second, the alphabets of the two languages > need to share some consistent correlations between the individual letters or > symbols. There should also be recognizable cognates of words between the two > languages, and words that have prefixes or suffixes in one language (like > verbs that end in "-ing" or "-ed" in English) should show the same features > in the other language._

So... it's a statistical decoder ring? Impressively effective, and a _distinct_ possibility for accelerating the decoding of newly discovered languages, but that doesn't sound like much more than a Markov chain attached to a diff tool.

Also:

> _The lost language of Ugaritic was last spoken 3,500 years ago. It survives > on just a few tablets, and linguists could only translate it with years of > hard work and plenty of luck. A computer deciphered it in hours._

That's not "mystifying" to linguists, that's a mildly tough nut to crack. Mystified them for a while, certainly - but so do many small-sample-size languages.

edit: have not read the "original paper", this is all based off the article.

edit2: a brief skim of the original paper implies it finds cognates by statistically-similar use of morphemes. It appears they've got their whole algorithm in there, if anyone cares to investigate more deeply. So I wasn't _too_ far off at least, and the article's writer did a decent job explaining how it worked. Much better than newspapers typically manage :)

</comment><comment><USER5> Same story, different source, some comments already:

<http://news.ycombinator.com/item?id=1477122>

</comment><comment><USER6> This is a very tightly-knit gang of uber hackers. Their last project was a program which generated articles _for_ Wikipedia:

<http://people.csail.mit.edu/csauper/?page_id=64>

</comment><comment><USER7> That gives me hope for Perl code from the 90s being intelligible even 1000 years into the future.

<comment><USER8> It may be intelligible 1000 years from now, but probably no sooner ;-)

</comment></comment><comment><USER9> So.. What did the translations actually _say_?

<comment><USER4> > _The surviving Ugaritic texts tell the stories of a Canaanite religion that > is similar but not identical to that recorded in the Old Testament, > providing Bible scholars a unique opportunity to examine how the Bible and > ancient Israelite culture developed in relation to its neighbors._

I missed it the first time through too. No idea what was in the data set however, nothing mentions that.

</comment></comment><comment><USER10> Darmok and Jalad at Tanagra

Sokath, his eyes opened

</comment><comment><USER11> So what. I do this with "javac" every day.</comment>


TiVo confirms its customers will soon see ads before DVR recordings - <AUTHOR> https://www.theverge.com/2019/9/21/20876976/tivo-pre-roll-ads-commercials-dvr-recordings <comment><USER2> Forced advertisements are such a terrible trend. I can stomach it a bit when it's to support an otherwise unfunded service, like a website that is funded only through ads, but from a device manufacturer?

> even those with a lifetime subscription plan.

That's not cool at all.

</comment><comment><USER3> Time and again it has been shown: it doesn't matter if you pay, corporations _will_ abuse any amount of control that you give them.</comment>


Why I Quit Coffee and How That's Been Working Out - <AUTHOR> http://www.humansarenotbroken.com/why-i-quit-coffee-how-thats-been-working-out/ <comment><USER2> I really never enjoy anecdote-experiments, there always seems to be too little information to conclude anything.

Under the takeaways after two weeks, he mentions that it was easier for him to fall asleep and wake up. But there is no mention on the number of hours pre/post the experiment and no mention on what times he would drink coffee. If he stayed awake 18 hours when he drank coffee and only 16 hours when he didn't, it would make sense he felt more awake in the morning.

I guess I am just annoyed at any of the claimed health benefits through a small anecdote.

<comment><USER3> I had the same thought. Correlation certainly doesn't equal causation, and there's really not enough context or info in the post to say it's one or the other. Anecdotal at best.

</comment></comment><comment><USER4> So the op has stopped drinking coffee and was clear of headaches which he thinks is due to Dandy Blend.

However, he is still getting a considerable fraction of the caffeine he got previously, but now from tea. If he is still taking the active drug, Caffeine, why would he expect any withdrawal?

<comment><USER5> Agreed. I think black tea, in particular, can have like 75% of the caffeine in the same quantity of coffee. See, for example, the table at [https://en.wikipedia.org/wiki/Caffeine#Natural_occurrence](https://en.wikipedia.org/wiki/Caffeine#Natural_occurrence)

<comment><USER6> There's obviously some difference in metabolism of caffeine from coffee and from tea.

I drink 3-4 huge 0.5L cups of green tea during the day and it has no energizing effect. I rarely drink coffee but when I do, it energizes me a lot.

</comment></comment></comment><comment><USER7> Disclaimer, coffee-lover here.

I have extensively researched pros and cons of giving it up, as well as done experiments on myself (going on and off, changing frequency, changing volume, changing diet around the coffee, etc.), because I am very health conscious, and don't like to feel I am "addicted" to any one thing.

So I hope I am not rationalizing based on my bias, but I see a wide distribution of research results (and anecdotal evidence like this article), so I think it comes down to the individual.

Certainly lifestyle, diet and health, but quite possibly specific to the genotype. We now know that specific mutations, alterations and combinations impact everything from how you digest (or don't) folates, gluten, sugars etc, and the impacts of all those (and more) on serotonin, dopamine and other neurotransmitters.

What is the possibility that we find the same for coffee/caffeine - that it impacts us each differently? Strong, from what I see.

And we know very few things exist as islands or vacuums...what about the myriad of combinations of genetics, environment, diet/nutrition, exercise, sleeping habits, type of work, emotional health, sun exposure, etc?

I know the above is not helpful to those of us looking for simple, binary "answers", but I am not sure those exist for something as powerful as coffee/caffeine.

If HN folks know of more research that disproves (or is at least evidence against) that hypothesis, then I would love to read it.

</comment><comment><USER8> I just quit coffee last week. Crazy that it's been a week now. I had gotten sick and didn't have any coffee for 2 days. This prompted me to just go all the way and stop it altogether.

One big thing I saw drop was my anxiety. Anxiety has been passed down by my father, and while it's somewhat mild in me, my dad & sister would be having panic attacks at my age. For me, I never went into a straight panic but it can be hard for me to feel safe. I'm a very hard worker with a lot of responsibility, so of course the anxiety has plenty to feed upon ("This isn't done, gotta do this, gotta do that."). Coffee would fuel that kind of behavior as if it were some kind of battle and take it all on. Then when the inevitable crash came, I would have to be looking to supplement it.

Like I said, I'm only a week in but what the OP says about waking up is very true and probably my favorite aspect of quitting coffee. I'll wake up at 6:30 and wanna just get up. When 11 or 12 rolls around, I fall asleep very naturally and wouldn't be able to stay awake even if I wanted to. It's worth a shot for everyone. Unlike the OP, I went completely cold turkey on the caffeine I should mention.

<comment><USER9> I've had the same experience. I had coffee all through my college years. Had a few scattered experiences with anxiety attacks, but I always attributed them to test stress.

After I started working and the responsibility and the need for creativity grew, I found the anxious episodes start to grow and become quite debilitating. I started to experiment with different parts of my lifestyle: sleep, caffeine, exercise, relaxation.

In the end I narrowed it down to caffeine. The anxiety went away. I felt more awake throughout the day and sleep cycles easier to maintain.

I don't want to claim too much on creativity, but I do feel the ability to relax and let my mind wander has eased the creative process. Instead of the laser focus I'd get when on caffeine my mind could calmly move to less pressing tasks and make those subliminal connections I would have missed if I was too set on an issue.

That said I do miss the taste of coffee. I'll occasionally sip a decaf or latte and feel some of those symptoms return slightly, but knowing its cause has helped a lot.

</comment></comment><comment><USER10> I have quit coffee for the last two years, aside from a very rare (once every four months or so) dessert coffee.

I used to depend on coffee intellectually, I always had to have a cup next to whatever work I was working on, and a pot brewing to back up the cup when I was finished.

Quitting was very difficult, but I have learned to appreciate moving through work slowly, carefully, cautiously, and with regular pacing, that I can meta- regulate with multiple levels of thought and planning. When I used to drink coffee, it just felt like all of my attention was superficially and strictly devoted to whatever work I had to pound out.

I still drink tea, from white tea to oolongs, but this has no where near the effect coffee has on me. Caffeine from coffee makes me feel like someone has thread tied into my eyeballs and into the center of the prefrontal cortex of my brain, and is pulling on it with shaking hands. I assume that is hypertension. It's the worst 'focused' feeling I know of, and I absolutely can not get work done in this state any longer.

I really like being able to think slowly, with occasional minor distractions. It's more reliable, has more coherency, and builds on itself naturally.

</comment><comment><USER11> I had to quit coffee about 7 months ago, after to developing a moderate case of something called chronic prostatitis. Of all the symptoms and things I have to avoid, coffee is still the thing I miss the most.

It's not just the boost, or the taste and smell, although I do miss all of those. Mostly it's the ritual in the morning, and the social experience of "grabbing a cup of coffee" with someone that leaves a big void in my life. Making my rooibos chai or having cup of herbal tea with someone is just not the same.

This condition may not ever go away, so I've sort of come to terms that coffee may have left my life for good, but before I never would have considered cutting it out completely. I didn't find that it impacted my sleep or productivity as long as I didn't drink it too late in the day.

Anecdotally, even after 7 months without caffeine, I find that I'm still much groggier in the morning than I used to be. My sleep at night hasn't improved.

Overall would not recommend ;p.

<comment><USER12> Can you explain your personal symptoms, experiences, and how you happened upon discovering your condition? What made you go to the doctor and get diagnosed? I really dislike looking up medical conditions online.

<comment><USER11> Not sure this is relevant in a coffee thread, but for me it started with urinary tract infection symptoms (frequent, burning urination) which is what brought me to the doctor. I started antibiotics, which improved it slightly but it didn't go away completely. When it returned and got much worse, the doctor referred me to a urologist who diagnosed it as prostatitis. After months of various antibiotics and a half dozen specialist visits at $200/pop I finally gave up on going to the doctor, as he didn't seem any ideas outside of pumping me full of more antibiotics.

As fugoogs mentions, non-bacterial chronic prostatitis isn't well understood and there isn't an effective standard treatment protocol. There are theories ranging from it being caused by nano-bacteria that do not show up in normal tests to it being a muscular tension issue that can be resolved with physical therapy.

<comment><USER12> Ahh, I mistakenly interpreted your quitting of coffee as coffee being part of the potential cause, rather than a requirement as part of treatment of prostatitis (not that coffee absolutely didn't contribute to it, as you say it's not well understood). I still appreciate learning about your experience dealing with the condition! Thank you.

</comment></comment></comment></comment><comment><USER13> I'm young and averaged 3-4 cups a day, along with 3-4 large glasses (500ml) of water every day for the last 2-3 years or so. I decided to give up coffee at the start of march, but found it quite difficult. I had none of the "common" symptoms (headaches, tiredness, etc) - but I found it difficult to get over not having a cup in my hand. I swapped it out with decaf coffee (which has more caffeine in it than I thought) and have been much happier with my temperment and general energy levels.

</comment><comment><USER14> Quitting caffeine had been one of the best things I've ever done with my life. It clears up my frequent headaches, stabilized my sleep patterns and normalized my energy levels through out the day.

Another important effect is that it allows me to use caffeine as medicine. It is very effective on its own and in combination with analgesics.

Quitting was a month of torture, but definitely worth it. Do not try and quit child turkey ; I recommend slow weaning.

</comment><comment><USER15> "Please enable JavaScript to view this site."

No, I will not. It's really not that hard to make a site readable without JavaScript; if they can't be bothered, I can't be bothered to read their stuff.

<comment><USER16> You can, however, apparently be bothered to comment on HN about it.

</comment></comment><comment><USER17> I've stopped drinking coffee after being addicted to it for about 16 years. First week was terrible, then the withdrawal effects stopped. I pretty much feel the same now as I was after drinking my first cups of coffee. I've got more energy over the day because there are no phases of low caffeine anymore.

Also, not being addicted to it makes things like occasional energy drinks in emergencies really useful. I needed to rescue a lost couchsurfer in the middle of the night - which I wouldn't have been able to do before. A few sips of energy drink made me really awake in order to drive safely. There's so much difference between the the effects on when you are addicted to it and not.

</comment><comment><USER18> I really like and enjoy good coffee. I buy roasted beans and I like to grind myself since I am the only one that drink coffee in home and beans preserve the taste and smell better.

I can go without coffee for few days, I alternante with "mate" [1]. Mate is awesome because how it taste, it is very different from one yerba to another and is awesome because the way of drinking it. I literally can drink 2L of mate through the morning while working.

[1]: [http://en.m.wikipedia.org/wiki/Mate_(beverage)](http://en.m.wikipedia.org/wiki/Mate_\(beverage\))

</comment><comment><USER19> I quit drinking coffee around the end of last summer and replaced it with around a litre of green tea mixed into a shake that consists mostly of oat, nut and seed meal, blueberries, honey, and a few spices which replaces my breakfast entirely. This generally keeps me fed until lunch or after depending on my activity level. I don't miss coffee and the most drastic effect has been an almost complete elimination of heart burn. I do still have the occasional cup of coffee but find my taste for it has waned.

<comment><USER20> would you mind posting your recipe for that? Is it palatable? How much do you make and how long does it take you to consume it?

<comment><USER19> Sure, I'd compare the taste to a blueberry muffin but, you know, in liquid form.

1L freshly steeped green tea (2 min, less if you dislike the flavour)

1/2 cup quick oats

1/2 tsp. nutritional yeast

1/2 tsp. flax seed meal, finely ground (use a coffee grinder if too coarse)

pinch of salt

cinnamon to taste

1 to 2 Tbsp. nut butter (I use soy and I've also tried cashew and almond but I find them too oily, coconut oil is an option too, use whatever you prefer)

1 to 2 Tbsp. of creamed honey, using regular honey will make it much sweeter

1/2 or 1 cup of frozen or fresh blueberries or other fruit

2 or 3 Tbsp. of milk, powdered or fresh

I also add a multivitamin and other supplements but they aren't necessary.

Combine ingredients in a blender and blend for a minute or so until the oatmeal is reduced to the consistency of a shake. Serve hot or cold.

I usually drink half the mixture immediately and then either save the rest for a mid-morning snack or continue drinking it while I'm starting my day. I've experimented with adding other seeds and grains but I find this mixture to be the most to my liking but it is an adaptable recipe so you can add whatever you prefer.

</comment></comment></comment><comment><USER21> I had to quit coffee a decade ago because of a cardiovascular adventure that I had.

I don't know anything about physical effects such as headaches and weight gain; I didn't experience any of those and anyway they sound a little like TV hype to me. But I also have the experience of giving up smoking a couple of packs a day (gave it up many years before I quit the coffee) and while I never find myself wanting a cigarette, I'd still love a cup of dark first thing in the morning. It is a good thing in life.

<comment><USER22> > _I don 't know anything about physical effects such as headaches and weight > gain; I didn't experience any of those and anyway they sound a little like > TV hype to me._

TV hype? Caffeine is a drug. Don't know about weight gain, but headaches and such as well documented.

</comment></comment><comment><USER23> I have never consumed coffee on a regular basis. I like working out of cafes (I'm a nomad and working from my hostel room is drab too often a week), so I often resort to Hot Chocolate or a tea. Sometimes these are overpriced so I end up going with coffee, but I have about one cup every 2-3 months I would say.

If you find yourself having to drink coffee a lot outside of a cafe, it may not even be a caffeine addiction. I think for a lot of people it's just the feel and action of a coffee cup, something to do with your hands when you're stuck on that bug or waiting for your code to build/program to launch. I think a mug of hot water is great in these circumstances. Hot water is also great for digestion, keeps your mouth (and digestive tract) clean, is pretty much free, and keeps you warm just as well as anything else in a cold room.

It's a habit I picked up because my mom used to make me drink a big glass of hot water after I had icecream growing up, and I continued to do that after cold foods even after leaving home. I can't recommend hot water enough.

<comment><USER24> I love me a mug of hot water with a bit of honey mixed in. It's kind of like drinking tea, except without the actual tea flavor (for which I've never acquired the taste), and it's super-easy to prepare.

</comment></comment><comment><USER25> I stopped drinking coffee regularly about half a year ago. Before, I drank about a liter of fairly strong coffee per day, now I drink one to two liters of green tea.

Early withdrawal was unpleasant, mainly fatigue and headaches (then again, I've seen alcoholics detox, caffeine is withdrawal is a walk in the park in comparison), but that lasted only a couple of days.

My biggest surprise was that the "booster" effect of coffee in the early morning might have been a pure placebo effect - I am still quite groggy when I get up in the morning (then again, I get up 05:40 on workdays), but that clears up by the time I leave for work, plus I do not get the early afternon crash anymore.

On the other hand, the vegetative effects of coffee were substantial in retrospect, I now sweat a lot less, and my blood pressure has gone down.

I still do drink coffee on occasion, mainly on weekends, but a) it is not as strong, b) I drink less.

Also, green tea is an awesome substitute in terms of taste. The coffee I used to drink tasted like sewage in comparison.

<comment><USER26> > _My biggest surprise was that the "booster" effect of coffee in the early > morning might have been a pure placebo effect_

It's not necessarily placebo, but the fact that your body has adjusted to caffeine, so you need it in the morning to reach "normal" levels.

<comment><USER27> But he is saying that he experiences the same ramp-up in the mornings without caffeine, so what he thought was the experience of going from uncaffeinated to normal appears to have been unrelated to the caffeine and was actually the experience of going from just-woken-up to awake.

</comment></comment></comment><comment><USER28> I kind of had similar experience with my sleep patterns. I used to be kind of moderate to heavy coffee drinker and suffered from erratic sleep times. I cut out coffee to single cup in the morning and stopped the bright lights and monitors at night and effect has been quite amazing. I sleep early now and get a good night sleep and wake pretty early.

</comment><comment><USER29> When Angelo mentioned that Dandy Blend, "an extract of roots and grains" including barley and rye, was gluten free, that seemed highly dubious. But it was nice to see such a thorough answer as the #1 FAQ on dandyblend.com/faq.asp! ... But excuse me while I go pump another shot of espresso.

</comment><comment><USER30> I really recommend anyone who drinks black coffee try brewing their own loose leaf tea - greens, blacks, oolong, yerba matte. Start with distilled water and add honey to taste, maybe even hemp milk (very creamy, nutty flavor, and omegas!)

Matcha is great and quick also!

</comment><comment><USER31> Similar experiences and I quit coffee ~ 6 months ago. I switched to cacao; initially ground cacao beans and settled on cacao powder. For ground beans, I tried Choffy and Crio Bru through a coffee maker and then a french press. I liked it but wanted a deeper cacao flavor, moving to powder. To drink cacao with powder, I fill my travel mug with water, pour the water into a single cup coffee maker (no grounds in the filter) and place 1 1/2 - 2 T of cacao powder (usually Viva Labs or TruVibe for criollo cacao) into the mug, which mixes with the dispensed hot water. The cacao provides a boost, in a different way than coffee, and health benefits.

</comment><comment><USER32> Caffein is the most widespread psychoactive drug by far. It's surprisingly hard to stop drinking it after twenty years. For many people the body starts acting like it's been poisened, and you can't sleep a whole night through without going to the toilet to pee. Quit coffee, and it stops after a few days.

Politicians that wants to keep up the war on drugs and continue to criminalize drug use, should try to go for a week without caffeine. I got a problem. I love coffee, but I have to stop.

</comment><comment><USER33> I probably drink more coffee than water a day.

Anywhere from 2-3 cups to 10+ cups. I have a super high caffeine tolerance that I can easily throw back a cup or 2 right before bed.

Getting close to 10 or over probably ly pretty bad. My digestive system is very quick, all this coffee running through.

Like others posted. I do it for the taste.

Occasionally I switch to teas in between cups of coffee but there are many days I go without coffee without any noticable effects.

</comment><comment><USER34> I cut way back on coffee as well. I still drink a few cups a week. I've increased my green tea consumption greatly thanks to [https://tomotcha.com/en/](https://tomotcha.com/en/) Check it out. High quality green tea direct from Japan. Some very unique varieties that I don't regularly see in the states. Cheers!

</comment><comment><USER35> I don't drink a lot of coffee, perhaps one or two cups a day - not every day.

Instead I used to drink energy drinks, at one point it was one a day (think RedBull sized). It's now been almost 6 months. It's so incredibly difficult to walk by and not feel tempted by their tastes and smells, but I know that if I were to drink it, it'd make me sick.

</comment><comment><USER36> Since I quit drinking coffee regularly, over a year ago, I've been all around more efficient/productive.

No more, "I can't do that until I get my morning coffee." This is important because I get my highest quality work done in the mornings.

Unlike the author, I've almost been lured back by the idea of "bullet proof coffee."

</comment><comment><USER37> I quit coffee when I started strength training specifically to boost my workouts. A regular coffee drinker develops a tolerance towards caffeine and the only benefit that coffee provides at this point is withdrawal suppression. I now take a 200 mgs caffeine pill 30 mins before a workout and it it a tremendous training booster.

</comment><comment><USER38> I quit coffee two years ago to help curb anxiety problems. I noticed I get less done, now, but what I do get done is of a higher quality, and I am less obsessive. It seems that slow, expansive thinking is more useful than turbocharged, focused thinking for certain kinds of work. Definitely a better default mode, at least.

</comment><comment><USER39> Does anyone actually have opposite effect from coffee than expected, i.e. feeling asleep after having a cup or two? Happens to me all the time, I never experienced any usual caffeine effects... I can go to sleep normally after drinking 5 cups of strong coffee... What is wrong with me?

<comment><USER40> I don't feel sleepy after drinking coffee, I simply don't feel it having any effects on me whatsoever. That being said, I can't stand the taste of it either, so I've probably had less cups of coffee in my life than some people have on a daily basis. Tea though... that's another story ;-)

</comment></comment><comment><USER41> A word of warning from someone who drank 2-3 cups/day of coffee for 50 years: go easy. Too much coffee will give you gastro-esophageal reflex disease (GERD), then you can't drink any more coffee, alcohol, or eat chocolate or vinegar.

I'd start with 3 or 4 cups a week.

</comment><comment><USER42> I don't drink coffee terribly frequently, but I'm still intrigued by this Dandy Blend drink... has anyone else tried it? Even for the samples, it costs $11.60 to have it shipped to eastern Canada, so I'm a little hesitant.

<comment><USER43> Dandy blend is excellent and comes very close to giving me the "coffee fix" without the actual coffee.

Is supposedly very healthy as well.

</comment></comment><comment><USER44> [http://www.antipope.org/charlie/blog- static/fiction/toast/to...](http://www.antipope.org/charlie/blog- static/fiction/toast/toast.html#club)

</comment><comment><USER45> Counter-point:

I've lived without coffee/caffeine in the past, but I've never felt better and more productive than now, when I drink 1-2 coffees in the morning & stricly avoid any more caffeine than that.

It helps to set up a working rhythm for me.

</comment><comment><USER46> No one cares Why You did anything. These "Why I..." Articles are self- indulgent narcissistic click-bait. Utter trash that shouldn't be published.

</comment><comment><USER47> i drink a lot of loose tea Like Oolong, green tea, yellow tea and black tea. Matcha and yerba are also good.

there is so much tea in the world that there will be something for everybody. You just have to learn to brew it correctly. for example most green teas dont like more then 80C hot water.

Teas like Matcha can have the same effect like coffee but without the sudden drop of energy after a short time.

</comment><comment><USER48> The problem is I drink coffee for the taste. If there was decaf without the bad aftertaste, I'd give up caffeine immediately.

<comment><USER49> I drink decaf nearly every morning and these have been some of my favorites so far. Hope you find on you like.

[http://www.vervecoffeeroasters.com/collections/coffee/produc...](http://www.vervecoffeeroasters.com/collections/coffee/products/vancouver- water-processed-decaf)

[http://shop.parlorcoffee.com/collections/frontpage/products/...](http://shop.parlorcoffee.com/collections/frontpage/products/decaf- colombia-la-serrania)

[http://bowtruss.com/collections/coffee/products/copy-of- deca...](http://bowtruss.com/collections/coffee/products/copy-of-decaf-mexico- altura)

[http://bowtruss.com/collections/coffee/products/decaf- brazil...](http://bowtruss.com/collections/coffee/products/decaf-brazil- almendras)

[https://counterculturecoffee.com/store/coffee/slow- motion](https://counterculturecoffee.com/store/coffee/slow-motion)

<comment><USER50> Here in the UK I get my decaf coffee through the mail from [https://www.pactcoffee.com](https://www.pactcoffee.com) – it's bloody delicious.

</comment></comment></comment><comment><USER51> I never started drinking coffee regularly. When I drink some, it makes me talk and laugh.

</comment><comment><USER52> I love coffee. I love drinking it and I love the effects it has. I love the feeling of a waking up with a nice hot cuppa every morning as I read the news. I love getting a cup in the afternoon after lunch. I love making coffee for my wife, and I love when she offers to make me a cup when she makes herself a cup. I love coffee even though since I started lifting weights and eating well, I don't really need it.

Every comment when I wrote this was about giving up coffee. I wanted to offer a different perspective.

<comment><USER53> I used to smoke cigarettes quite a bit for a number of years. If you replaced everything in your comment about coffee to the corresponding language about cigarettes, I would've resonated perfectly with your description assuming I still smoked.

I gave up smoking but continue to drink coffee, so your comment still does resonate :)

disclaimer: I'm not trying to compare the effects of coffee and nicotine, and I don't know the first thing about the physiological basis of addiction.</comment></comment>


Ask HN: Anyone else without Facebook stuck trying to get a Oculus for Christmas? - <AUTHOR> I wanted to get my spouse an Occulus Go for Christmas. The item was on stock on Dec 19, and 5 days to ship seemed like plenty of time. So I ordered and got the nice message.
But one day later - "Your Oculus order number 61544 placed on December 19 has been canceled
As I contacted support, "Our team is currently reviewing your order. It's important that you do not create any new orders during this time. Once we have an update we will notify you. Please note that once an order has been canceled, we are unable to reinstate it. (...) Alternatively, you can order through one of our retail partners. Details on this option can be found by clicking here."
So I did try a 'retail partner' with the same result - order cancelled.
Then 2 days later (today) "Thank you for your patience while we reviewed the situation. Our apologies for the delayed response. We have re-reviewed the cancellation and determined it was done by our system unintentionally. We would like to request that you please create a new order and message us back with the order number. Once we have the new order number, we will review it to ensure there aren't any issues."
Needless to say, I will not order from Oculus as it will never arrive on time for Christmas.
The same credit card, phone number and address worked just fine for getting a laptop from Microsoft, but not for getting an Oculus from a Oculus 'partner' that had it in stock.
So I'm really wondering what happened, and if Facebook is using its database to flag orders as the only unusual thing about me is that I do not maintain a Facebook profile.
I really wonder if that's what caused the issue? It is too easy to blame their 'system' without telling why.
So I'm asking here: did anyone else experience similar problems when ordering from Oculus?
They haven't told me why the order was 'unintentionally' cancelled, and I doubt they ever will. I asked more than once. <comment><USER2> Are you in Canada? Google showed me a few reddit threads where Canadians had their order canceled a few times when trying to pay online. OP in that thread said using Paypal account eventually worked for them.

Here is a reddit comment from an Oculus support staff acknowledging they are looking into issues Canadians are having ordering Oculus Go (from 6 months ago) [https://www.reddit.com/r/oculus/comments/8mro5b/payment_refu...](https://www.reddit.com/r/oculus/comments/8mro5b/payment_refused_when_purchasing_oculus_go_from/dzpxltf/)

<comment><AUTHOR> No I'm in the US, and I paid with a regular credit card.

The worst is they tell you not to place another order (using paypal for example) while investigating.

</comment></comment><comment><USER3> Sorry for the meta-comment but this just made me laugh out loud:

"December 19 and 5 days to ship seemed like plenty of time"</comment>


Show HN: Celery – buying bitcoin and dogecoin - <AUTHOR>

https://www.gocelery.com
Frontend is Backbone, compass and a bunch of other stuff. Backend is python/appengine and some node thrown in.
Would love to hear some feedback -- positive or constructive. <comment><USER2> [https://www.gocelery.com](https://www.gocelery.com)

</comment><comment><USER3> Just post the link in these cases, it is better.</comment>


Will Apps Like Prisma Replace Human Artists? - <AUTHOR> http://caspy.com/will-apps-like-prisma-replace-human-artists/ <comment><AUTHOR> Or at the least the demand for Human art. People might say that the genre for abstract art will still exist. I think googles deep dream has that area covered. What are your thoughts?</comment>


Aaron Swartz Says He Co-Founded Reddit; Reddit Founders Say He Didn't - <AUTHOR> http://www.betabeat.com/2011/08/22/mixed-messages-early-reddit-employee-says-he-co-founded-reddit-reddit-founders-say-he-didnt/

<comment><USER2> Grammar school all over again. These guys actually consider themselves grown men?</comment>


As We May Think (1945) - <AUTHOR> https://www.theatlantic.com/magazine/archive/1945/07/as-we-may-think/303881/ <comment><USER2> And here is all began....</comment>


Even with 2FA, Google accounts can be hacked with just a phone number - <AUTHOR> https://ello.co/gb/post/knOWk-qeTqfSpJ6f8-arCQ <comment><USER3> I work as a sales rep in-store for a telco. From a security perspective, it's ridiculous.

We use computer monitors which customers face from the same angle as us. I'm sure someone thought it would make the retail scenario more inclusive, but security-wise it's a mess. I can't verify account details without pulling up those same details for the customer to see. So I ask people for their details, click the button, and cross my fingers that they're right. If they're wrong, what then? They might legitimately not have known whose name it was under. It might be under their dad, mom, partner or business' name. Doesn't matter, the system has absolutely no design affordances to allow multiple people various levels of security privilege in accessing and altering accounts which are used by more than one person.

Furthermore, we have no organisational clarity about access privileges. Everyone makes up their own standards. Some people in the company are very strict, and won't do a SIM swap without photo ID or full ID over the phone. Some people will do one if the customer quotes the same last name and could be theoretically the account-holder's child. But does it matter when any customer can easily find out name, DOB and address from coming in store, then call up and get the SIM changed over the phone? We do have account PINs but very few people set them. And you could find it out in store if you were sharp-eyed.

There's a constant tension between providing a good customer experience and protecting security and privacy. But our commission is based partly on customer experience feedback scores - and if you're the one asshole who tries to follow all the rules (or follow what you decide should be the rules, because there aren't any haha) then you're gunna get a) bad feedback and b) alienate and make life difficult for the majority of ambiguous security events, which I'm sure are 95-99% trustworthy people.

Anyone relying on two-factor auth with a phone number who uses my company is vulnerable. Simple as that. It would take a determined attacker a day to get control of your number. All you'd notice was that your SIM stopped working. It would all be too late by the time you'd gotten a new one re-activated - <USER2> you're still vulnerable.

I'm not sure what telcos are like in other countries but I doubt much better.

<comment><USER4> I feel bad for the telcos (and other agencies that try to keep our private info). I called up my ISP a few months back and was presented with a variety of security questions that I couldn't provide the answer to. I certainly didn't know the 4 digit passcode I created 2+ years ago and I haven't used since. My fist couple guesses on my favorite movie were wrong. It was only after my second guess of my best friend during elementary school (probably worth a blog post on the changing winds of our memory) that I was able to access my account. The problem was that I threw all sorts of answers at the customer service rep on the other end of the phone. They were willing to ignore all of my incorrect guesses in hope I would eventually hit on something they could verify. But that is exactly the problem. If _I_ wasn't _me_ I wouldn't want someone getting as many opportunities that I got to eventually hit the right answer to _prove_ they are me. So where do you draw the line between customer support and customer security without either enraging real customers or allowing people to illegally access customer accounts?

TL;DR Someone create a startup to better identify people remotely.

<comment><USER5> A mobile carrier's identity verification could be augmented by asking questions about who you called recently.

Remote identity verification over the internet is not solved perfectly, but FIDO's U2F is pretty good. Hardware tokens cost money which most people won't buy, which is one problem. To prevent getting locked out you have to buy (and the service has to support) multiple hardware tokens, but that protects against loss or breakage. To prevent targeted token theft attacks, the token needs some kind of biometric verification (iris scans would be good), but that gets very expensive in a device that needs to be reliable and yet kept on a keychain.

That or something similar is the only way to provide verification while preventing the creation of a centralized identity database [I think a cryptographically assured identity verification system that dramatically limits identity repudiation would turn into a privacy nightmare dwarfing current identity database efforts being made by many companies]. With something U2F-like, each company or service stores their own verification seed value that is used in the future to verify you. It could be on a mobile device, like standard TOTP auth, or on a separate specialized hardware token. It could use pre-shared seed values and hashing, or nonces and asymmetric crypto.

<comment><USER6> > Hardware tokens cost money

All your excellent examples will dwarf mine, but I'll still tell it as a very cheap medium:

When I was at Fortis Luxembourg, the bank gave me a passive token: A card with a few dozen digits on it. At each login it would request 3 of those along with the password.

The key point of this is, it never transmitted the full key over the wire. So someone who intercepted the communication could never rebuild my full password.

Cost for the bank? A few cents. Security? The best I ever had from banks.

<comment><USER7> _> Security? The best I ever had from banks._

I'm baffled. In Germany, the chipTAN method [1] [2] is pretty standard, which uses the bank card as a cryptographic element. And usually, German IT seems to be years behind the industry standard (e.g. I don't know a popular German e-mail provider that offers 2FA.)

[Edit] This is the best thing about chipTAN: _Even if the computer is subverted by a trojan, or if a man-in-the-middle attack occurs, the TAN generated is only valid for the transaction confirmed by the user on the screen of the TAN generator, therefore modifying a transaction retroactively would cause the TAN to be invalid._ [/Edit]

[1] In action: [https://www.youtube.com/watch?v=5gyBC9irTsM&t=41s](https://www.youtube.com/watch?v=5gyBC9irTsM&t=41s)

[2] [https://en.wikipedia.org/wiki/Transaction_authentication_num...](https://en.wikipedia.org/wiki/Transaction_authentication_number#chipTAN_.2F_cardTAN)

<comment><USER8> So the chipTAN generator reads the details of the transaction optically, and then you just confirm them ?

Pretty clever. On my chipTAN (Belgium, ING) I have to enter the number by hand (part of the account# of recipient, amount).

On the positive side mine does ask for a PIN before generating the TAN, so is probably a bit more secure (balanced with a wear of the keys on the TAN generator, of course - so it is arguable which one is better)

</comment></comment></comment></comment></comment></comment><comment><USER9> Disable SMS for 2-step and SMS for password resets and use a 2-step mobile app.

[https://support.google.com/accounts/answer/1066447](https://support.google.com/accounts/answer/1066447)

<comment><USER10> After enabling 2FA, disabling SMS for 2-step and SMS for password resets, and ensuring that you don't have any phone number set as a way to get into you account, what is your plan for continuing to use your account if your phone is stolen?

<comment><USER11> Backup codes.

<comment><USER12> It's also possible to install the seed for the TOPT generator on multiple devices - all the ones I've bumped into have a mechanism for typing in a long- ish string as well as scanning a QR code - record that string (secured like a password, in something like 1Password) and you can always re-seed another device to come up with the same codes. I've got all mine on two phones and a iPad - one of the phones is usually in my pocket, the other is almost always at home.

As always, it's a security/convenience tradeoff - I've gone from needing "something I know and something I have" to "something I know and any one of several things I have".

Your tradeoffs there may vary - if I were a political- dissident/whistleblower/drug-czar I'd probably consider the risk of losing access altogether preferable to opening up additional avenues for vulnerabilities - an NSA-level adversary would probably have a significantly easier time if they knew they only needed to stealthily subvert one of several devices (at least one of which I don't usually have on my person) to get access to all my tfa secured assets, but the additional risk if I'm protecting myself from 4chan-grade griefers or non-network-pervasive internet criminals is - for me - low enough to accept for the additional reliability and convenience of multiple authorised tfa token generating devices.

<comment><USER13> In my experience, when setting up a new device, you have to scan the QR or type in a code, then verify a generated key or two to "confirm" the new device. I'm not sure if that's an optional step, but it seems like you'd need to log in first, thus creating a chicken-egg situation for yourself. I'm sure you could enroll another device (e.g. tablet that always stays in the house, SO's phone, whatever), but it doesn't seem like it'd work as you spelled it out.

Backup codes may be a good option if kept somewhere very safe.

<comment><USER12> The "enter a generated code to confirm" step is to confirm at the server end that you've got an identical seed - they (presumably) use that before committing that seed to your user account (to ensure you aren't about to lock yourself out). It's mot needed at the client end.

I've got at least gmail, aws(/amazon), Github, Dropbox, Zoho, and several TOTP TFA protected WordPress sites on 3 different devices using this method. It definitely works. I see additional devices start to generate the same codes when I add the same seed (so long as their clocks are reasonable synced...)

This is using the Google Authenticatior app on iOS and Android, I _think_ any RFC6238 compliant TOTP app that lets you type in a string to key it should "just work".

</comment></comment></comment></comment></comment></comment><comment><USER14> What strikes me most in these stories, is how you always have to find some higher ranking company employee through personal connections in order to get a tiny possibility to take your account back.

These companies build on their users but, when their users need them, they betray them.

<comment><USER12> People need to be much more aware of the fact that you don't own your gmail address, or your Twitter/Facebook/LinkedIn/Instagram/whatever account. Those companies encourage people to build their reputations and networks and "personal brands" inside their walled gardens, while repeatedly demonstrating that they won't lift a finger to help protect the user's custodianship of "their" usernames.

Unfortunately - when you explain this to people there's no really good answer to their immediate "so what should I do?" question.

I no more "own" the bigiain.com domain than I own "bigiain" on HN, or "email@example.com". While I can ensure I keep paying for it's registration, I have no doubt that if Monsanto or Goldman Sachs or Apple launched an new thing and trademarked it "Bigiain", my registrar would fold instantly to a legal demand from their lawyers, and I'd be just as out-in-the-cold as all those people without friends-of-friends in high enough places at Instafacetwigoo to "fix things", or with publicity platforms like @mat behind them.

I suspect in the future, there'll be a well known way to tie your online activity/reputation/network to a strong public key (with some distributed blockchain-like revocation/renewal audit trail). If anyone's working on something like that - I'd love to hear about it...

<comment><USER15> I think it's a good idea to own your own domain name, at least as a tech savvy user. You can still use Google Apps with it (Google for work now?).

That being said, I think it's a bit unfair to say companies won't lift a finger to help protect their users usernames. On the technical security level, many companies put a lot of effort into things like 2F, general internet security, etc. In particular Google, but also Dropbox, github, and others. On the service level (i.e. what happens when you have to talk to someone) everybody could probably improve quite a bit. OTOH that's costly and would ultimately need to be paid for by the customers somehow.

On the legal level, there isn't really anything these companies could do for you. If you do not own a trademark for your chosen domain name (account name, page name, ...), you'll lose it to someone who does [0]. That also won't change if you have all kinds of friends in all kinds of places - your problem then is basic trademark law, not the goodwill of some company (that has to adhere to the law, after all).

Disclaimer: I work for Google.

[0] possibly with the exception of the account or domain name being your legal name, but I don't think there's a general norm for that.

<comment><USER14> Technical measures to prevent account theft are always welcomed but they stop there; at prevention. As most of us know through experience though, poop happens.

In our era, for many people an account at an online social network is part of their identity. Losing it can be devastating. An account at Google is even more; it is one's documents, emails, contacts, calendar, photos, various data and digital purchases. So it is very important that there is support when you need it. Is it really so costly? I don't know. How many cases of account theft are there every day if the technical (prevention) measures are good? Maybe affected users are willing to cover some of them?

</comment></comment></comment></comment><comment><USER16> This just happened to me. The same timeframe, the same vector of attack, but a different target. They wanted my Twitter handle. Fortunately it was an old handle that Twitter had locked down and was not transferable. The hacker succeeded in making me lose my handle for a few days, but some friends came to my aid and I was able to get resolution through Twitter support.

My telecom company was helpful at first, but then we began to see circle-the- wagons behavior from them. We were at least able to get the call forwarding off of the account, but they would not tell us any details about what had happened on the account.

Until your story (and even now) I'm not exactly sure if my hacker had been able to forward the text messages or simply routed the phone call to his phone and using Google's password reset process was able to get a robo call to accomplish the same thing.

All of this is seriously making me consider creating my own 2FA service, only slightly better.

One quick recommendation I would add would be to put a passcode on your account with your mobile provider. Just call them and say "I'd like to add a passcode to my account", so you can at least add one extra layer of security there.

<comment><USER17> I would advise to have them write on the account that in no circumstance are they to authorize you without the passcode.

This is the weakest part of the chain. We all forget our passwords.

<comment><USER18> Every cell phone carrier out there CAN NOT allow you to make changes to an account or get any personal information from an account without properly identifying yourself with an authorized name on the account, plus the last four of the account holders social OR an account PIN. If a customer can not provide these over the phone they need to visit a store with a photo ID matching the account holder to get access to the account.

Note, this isn't specific to any carrier, this is FCC regulations that poorly trained CSR's ignore.

<comment><USER19> Unfortunately it is not that hard to get someone's first name, last name, and their entire SSN (not just the last 4 digits), especially if you have a bit of money to spend and know the right places to look.

Personal aside: does anyone know if I could call Verizon support and ask them to require a specific passcode be used before accepting any call relating to my account? Before I call and ask, I'd like to know the odds of them actually agreeing and actually abiding by it.

</comment></comment></comment></comment><comment><USER20> This article is conflating two things:

\- two factor login (you need password + sms text)

\- account recovery (using only a phone) THIS IS DUMB.

I only use an alternate email for recovery (my wife and I cross). Thus, each recovery account is still 2FA secured.

There's already been a story floating around about a young kid charging his dad's credit card because of the phone recovery option (he had the android phone in this case). This is NOT the same as 2FA auth.

</comment><comment><USER21> There's a balance between keeping others out and preventing yourself being locked out. Every time you add another factor, you also have to add another recovery option in case you lose that factor:

1) Password(A)

:| Hacker must break A

:| Losing A locks you out

2) Password(A) + SMS recovery(B)

:( Hacker must break A or B

:) Losing A and B locks you out

3) Password(A) + SMS(B) 2FA

:) Hacker must break A and B

:( Losing A or B locks you out

4) Password(A) + SMS(B) 2FA + SMS password recovery(B)

:| Hacker must break B

:| Losing B locks you out

5) Password(A) + SMS(B) 2FA + SMS password recovery(B) + Code sheet(C)

:( Hacker must break B or (A and C)

:) Losing B and (A or C) locks you out

6) Password(A) + SMS(B) 2FA + Code sheet(C) + 3rd channel password recovery(D)

:) Hacker must break (A and (B or C)) or (D and (B or C))

:) Losing (A and D) or (B and C) locks you out

Only the 6th option is unambiguously better than a single password. I guess using a friend's phone for password recovery and your own for 2FA would achieve that.

<comment><USER22> You could also have 2 SIM cards in your phone, one number known, one for additional business. A lot of phones have sockets for 2 SIM cards, and the cost is almost nothing.

</comment></comment><comment><USER23> "and every so often, I would get authorization code texts for the Gmail account that was tied to my Instagram handle"

As far as I know these authorization texts are only sent when your Gmail username and password have been entered correctly. This would indicate that the attacker knew your long random password. Keylogger? From there they only need your 2fa to access your account.

<comment><USER24> If I'm not mistaken, the attacker set call/msg forwarding on his phone via his telco and then they chose the "forgot my password" option where a SMS text from Google (now going to attacker's phone) can be used to reset the password.

</comment></comment><comment><USER25> Well I heard from a friend of mine that in Argentina the cellphone provider can access to your info.

The case was this one. He was cheating her girlfriend, a friend of her accessed to my friend's text messages log, saw the evidence, and told to the gf about it. Apparently, but I never confirmed this, the friend (the one who read the messages) worked in the cellphone provider of my friend.

Since then I know I can't trust in my cellphone ever again, but I always was suspicious about this could be possible.

<comment><USER26> Of course your cell phone provider can access your call logs. Probably even fairly low-level workers can get full access under certain conditions.

And of course some workers will abuse that access for personal reasons.

What did you expect? That workers at a phone company wouldn't be able to access your account info? Ideally, it would be compartmentalized, but...

<comment><USER27> I would expect auditing if not compartmentalization, and big legal risks from unauthorized access that mean a majority chance of getting fired.

</comment></comment></comment><comment><USER28> This is why I always recommend against using SMS-based 2-factor. Without even doing any serious research, it seemed pretty obvious to me from day one that _at the very least_ someone like NSA/FBI could forge your number somehow with or without the carrier's help, but there's also the potential for other attackers to do it, too.

Call forwarding didn't even cross my mind, but it just goes to show how ridiculously broken SMS-based two-factor authentication really is then, and even worse than I thought.

Ideally what I'd want is an NFC ring or a smart band/watch that can use FIDO's U2F or a similar protocol that works through NFC, to do 2-step verification for me.

<comment><USER29> > Ideally what I'd want is an NFC ring or a smart band/watch that can use > FIDO's U2F or a similar protocol that works through NFC

I've got my eyes on a Yubikey NEO for just this kind of use: [https://www.yubico.com/products/yubikey-hardware/yubikey- neo...](https://www.yubico.com/products/yubikey-hardware/yubikey-neo/)

<comment><USER30> Keep your eyes on the nfc ring too [http://nfcring.com](http://nfcring.com)

</comment></comment></comment><comment><USER31> This is a good reminder that your phone may not be as secure as you think. In many countries governments are able to get access or ask for this type of change to be made from the national telco's.

The reactions you can take at the moment are to use a mobile App, (or preferably a security key!) rather than SMS backup, and if You're feeling especially uncharitable to your phone company, change the backup number google makes you enter to a google voice number rather than that of your actual phone - creating a circular situation where it can't really be used as a method for account recovery / hijacking.

</comment><comment><USER32> This article brings up a question about protecting email addresses that I'm hoping a HN reader can answer.

I have a unique email address for PayPal--different from my normal email address--that I want to keep secret. The problem is that every time I make a purchase, the merchant gets this email address (in addition to the normal email address I gave to the merchant). I know that merchants get it because I get junk mail at my secret PayPal address from merchants I did business with.

Is there no way to make a PayPal payment without PayPal handing my email address over to the merchant?

As a related question, why do I have to trust the merchant to redirect me to PayPal's website to make the payment? There are many ways I can get fooled into entering my PayPal password directly into merchant's website (for example, the merchant opens the PayPal site in a frame or pop-up, so you can't verify that it's really PayPal). Isn't there a way I can open my _own_ browser window, login to PayPal, and give some sort of invoice number to PayPal to direct payment to the merchant?

<comment><USER33> > _(for example, the merchant opens the PayPal site in a frame or pop-up, so > you can 't verify that it's really PayPal)_ //

You can right-click the page in Firefox and choose "view page info", then on the security tab you can see if it's paypal, see the certificate, etc.. Someone could hijack right-click, it's going to be a bit of effort though. I think in FF shift+rightMouseClick overrides normal right-click to give you the browser menu, but probably that's capturable by the site too.

Ctrl+I is the shortcut, but I don't think it handles frames.

</comment></comment><comment><USER34> This is why "2FA" is supposed to actually be two factors. If you're using a phone number for 2FA, then authentication still boils down to the same thing: Something you know.

<comment><USER35> It's still two factors. If someone has only your phone but not your password, they still can't log in. The problem here is that the phone number was also used as a password recovery option, which effectively means you only need the phone to log in. I suspect most gmail users with 2FA are doing this, which defeats the purpose of 2FA. It just becomes "different factor".

It's the password recovery by phone that's the weakness. But I think people getting locked out of their own account is probably a bigger problem for Google than people getting hacked, so they err on the side of saving your from getting locked out.

<comment><USER34> No, it's not two factors. Access to the phone number is entirely based on _something you know._

</comment></comment></comment><comment><USER36> Interesting, so adding 2FA actually decreased security... Well shit. Interesting case that shows just how unpredictable such things can be.

As far as I understand, though, 2FA increased the attack surface in this case. A web interface itself still remains impenetrable, doesn't it (know your hard- to-guess password and you should be fine)? Mobile provider was the weakest link and any system is as secure as its weakest link.

<comment><USER37> It's similar to security questions in that way. If you answer them truthfully, then they can be used to attack you.

<comment><USER38> You should have the same answer for all security questions and it should be an easy to remember pass phrase about the service

</comment></comment></comment><comment><USER39> 1\. Email account with 2FA

2\. Email randomized password stored in PasswordDatabase

3\. PasswordDatabase is stored in CloudDrive

4\. CloudDrive randomized password stored in PasswordDatabase

5\. CloudDrive with 2FA

6\. PasswordDatabase secured by weak password

7\. 2FA codes from 2FApp

8\. PasswordDatabase, CloudDrive, Email only available together on devices with a human-friendly password. Those 3 and the 2FApp are all on the phone, secured by human-friendly password, on me always.

(How do I make 8 mathematically stronger?)

<comment><USER40> 3 combined with 6 sounds like a recipe for disaster if someone manages to compromise your CloudDrive account (probably not by breaking the password, but by social engineering or a method similar to the one in this article). If they get that, they have your encrypted password database, and if that has a weak password... you're totally SOL. The password database's password is one you want to be /very/ strong.

<comment><USER39> Do you recommend I memorize a GUID? It's not quite "Correct Horse Battery Staple"

Has any CloudDrive service been socially engineered? I didn't find any results in my rudimentary search.

<comment><USER40> Personally, I have a password that my password manager generated that I use for it. I had it written down in my wallet for a while, but after typing it multiple times a day for a while I memorized it and since destroyed the paper. It's a shorter password than what I use for my stored passwords, but I think it strikes a good balance. (And it's not a GUID, but if you think you could memorize that then it probably couldn't hurt. That's risky, though -- if you forget, there go all of your passwords for everything!)

I don't know of any off the top of my head, but there was that time a few years ago when Dropbox accidentally let anyone in without a password. This isn't to pick on Dropbox, but security lapses happen and it's wise to have multiple layers of strong defense to reduce your risk. (Also, if someone compromises the email associated with your CloudDrive, they can use that to get your CloudDrive by invoking a password reset.)

EDIT: Wolfram|Alpha estimates the entropy of a password generated using the constraints I used for mine as roughly 85 bits (the relevant space would take 14 trillion years to enumerate). It actually has a pretty information-heavy password strength estimator (though I can't attest to its reliability as I'm not familiar with the internals).

</comment></comment></comment></comment><comment><USER41> [https://news.ycombinator.com/item?id=8255807](https://news.ycombinator.com/item?id=8255807)

SMS is not two factor authentication, and should never be part of an authentication system.

</comment><comment><USER42> This is precisely why I thought Digits was such a terrible idea (check my comment history, it's there.) SMS is so incredibly insecure that anyone relying on it should not consider themselves security savvy. SMS TFA is lipstick on a pig. Cellphones are so cheap these days, they should all come with a TFA app pre-installed. I'm also not too keen on websites making it so easy to change your username. The story of @N on Twitter comes to mind. Is anyone working on Digits without the SMS part?

<comment><USER19> It's not just SMS that's the problem though. In many cases any random person off the street can call up your telco, pretend to be you, and get all of your calls and voicemail forwarded to them.

</comment></comment><comment><USER43> This leaves so many open questions. Foremost: How did they guess his GMail password? Is there a way to access GMail without knowing the password? Ie. by sending a reset password per SMS?

<comment><USER44> They enabled call forwarding and got Google to call with a password reset code.

<comment><USER45> Its not clear how they got his phone number though.

<comment><USER46> Phone book? Leaked address book? Leaked account database? Assume your phone number is public knowledge.

</comment></comment></comment></comment><comment><USER47> At least now, more people will accurately describe it as two-step verification rather than two-factor authentication.

They are entirely different. If SMS OTPs were actually 2FA, the hacker would have needed to steal the phone too.

The difference between two-step verification & two-factor authentication. [https://ramblingrant.co.uk/the-difference-between-two- factor...](https://ramblingrant.co.uk/the-difference-between-two-factor-and- two-step-authentication/)

</comment><comment><USER48> This sounds like an argument for adding hardware multi-factor auth in google. It's not a panacea, but a good starting point that can't be easily spoofed or hijacked.

<comment><USER49> They already have it: [https://support.google.com/accounts/answer/6103523?hl=en](https://support.google.com/accounts/answer/6103523?hl=en)

And it adds nothing, since it still has fallbacks to the existing systems.

<comment><USER50> You should be able to remove less secure authentication mechanisms via accounts.google.com, after setting up a security key

<comment><USER24> You still need to keep atleast one backup method in case the security key is corrupted/broken/lost etc.

<comment><USER50> Print out a recovery code and keep it somewhere safe.

</comment></comment></comment></comment></comment><comment><USER51> So is the takeaway that we should all disable SMS-based options for receiving 2FA codes, because it weakens your 2FA to the level of your (non-2FA) cell phone account?

I think when I enabled iCloud 2FA it included 2 channels for communication with my phone: one as a named iOS device (where the OS handles receiving and displaying codes), and another as just its phone number. Is that for SMS? Why would they even do that?

<comment><USER52> Yes. Not everyone using a Mac has an iOS device.

<comment><USER53> Also, what happens when your iOS device gets lost or stolen?

<comment><AUTHOR> You use your backup 2FA codes (which you've stored in a few different locations -- all offline -- including probably your wallet) to get back into your account. From there, you re-seed the 2FA.

</comment></comment></comment></comment><comment><USER54> Wild.. you know, using google voice for a number of years, I switched to using mvno operators for my cell phone a few years back... Now, I'm glad they don't allow call forwarding on those accounts.

Though it seems like a lot of work, It's hard to imagine going through this... with a similar mindset.

</comment><comment><USER55> A bit late to the party but here's a good story about this: [http://williamedwardscoder.tumblr.com/post/24949768311/i-kno...](http://williamedwardscoder.tumblr.com/post/24949768311/i-know- someone-whose-2-factor-phone-authentication-was)

</comment><comment><USER56> Yet one more reason we shouldn't be letting telcos provide our phone numbers. They are painfully inadequate when it comes to security. And our mobile numbers are now probably the most important identifiers we have, due in no small part to the proliferation of SMS 2FA.

</comment><comment><USER57> Incredible the lack of barriers in place for adding a forwarding number to a cellphone account. Maybe the attackers got the last 4 of his CC from a hacked set? Or maybe the same for his social. And from there they were able to authenticate with the telco rep

</comment><comment><USER58> voicemail, then call forwarding, i wonder what is the next. People often ignore many of the service settings and leave them as is (me as well), which potentially creates chances for intruders.

</comment><comment><USER59> His recovery email address attached to the account must've also been hacked if he had two-factor on, as google always starts the recovery process from that email.

</comment><comment><USER60> This story sounds like a déjàvu: [https://news.ycombinator.com/item?id=7141532](https://news.ycombinator.com/item?id=7141532)

</comment><comment><USER61> Immediately called my mobile carrier and asked them to disabled the ability to add/change call forwarding.

</comment><comment><USER62> I appear to have missed something.

How did the hacker know his mobile number?

Domain name registration?

<comment><AUTHOR> That's my guess based on a pretty easy to figure out WHOIS. But security by obscurity here only goes so far: if someone really wants your phone number, there's lots of ways to get it.

</comment></comment><comment><USER63> There is always a weak link. Ugh.

</comment><comment><USER64> i need help unlocking my goggle account on my phone

</comment><comment><USER65> The browser "back" button for the website is broken...

</comment><comment><USER66> If it were me, I'd ditch the two letter handle, and with it the bother.

Of course it's not me.</comment>


Ask HN: A way to turn any table into graphic tablet? - Come-rad

Hi, hackers. Artists all over the world use graphic tablets like Wacom to draw pictures. Is there a technical way to achieve this without touch enabled surface? One might think about some smart pen capable to track pressure, but I've not found any. Thanks. <comment><AUTHOR> why not just add three microphones to your table and use a dump stick as your pencil. the sound waves are delayed proportional to the distance. by correlating the three signals you are able to get the distance between pencil and microphone. knowing the position of your three microphones you are able to calculate the position of the pencil.

i think there was a demo with piezo microphones on a wall or chipboard, but i'm not able to find it.

<comment> Come-rad Are there any issues with other noises using this approach? And what's the level of preciseness if you remember.

</comment></comment><comment> Come-rad Laser (as in the mouse), I guess, should work.</comment>


U.S. Marshals Are Arresting People in Texas Who Have Outstanding Student Loans - <AUTHOR> http://nymag.com/daily/intelligencer/2016/02/us-marshals-forcibly-collecting-student-debt.html?mid=twitter-share-di <comment><USER2> This has been debunked, the dude was wanted for not showing up for the court multiple times for a loan he took at a later date. This is being overly exaggerated.

edit: I cannot find the link right now, but chron or some houston based tv channel had an article about it.

<comment><USER3> Can you give us relevant links to the debunking?

<comment><USER4> [https://www.google.com/search?q=Paul+Aker+%22debunked%22](https://www.google.com/search?q=Paul+Aker+%22debunked%22)

<comment><USER5> I don't read the top result as a debunking. If they can arrest you for failing to show up in court related to a unpaid student debt, that seems equivalent to being able to arrest you for an unpaid student debt.

<comment><USER6> No, you can be arrested for failure to appear in court when summoned regardless of the basis, even if the basis of the summons is not itself an arrestable offense.

Further, the summons wasn't about student loan debt, per se, it was about an unpaid _default judgement_.

What led to the arrest wasn't the student loan debt, it was a series of failures to follow court orders or even respond to lawsuits.

Constitutionally, you cannot be arrested for inability to pay a debt (including a student loan debt) in the US. There are a whole lot of real problem cases of systems set up in such a way that one could argue that people are, in fact, arrested for what amounts to inability to pay a debt, and that's a real problem (John Oliver did a good piece on this a while back) -- but this isn't one of them. This is someone arrested for just ignoring court orders and hoping they would magically go away. The fact that the orders ultimately stem from a student loan debt is rather beside the point.

<comment><USER7> That the court order stems from a student loan debt is not beside the point. It is the exact point.

<comment><USER6> > That the court order stems from a student loan debt is not beside the point.

It is entirely beside the point: he wasn't arrested for an unpaid student debt, or even for an unpaid default judgement from a case he failed to respond to over a student debt, he was arrested for _failure to appear_ when summoned to court.

That's not being arrested for debt, student loan or otherwise.

<comment><USER7> You're arguing legality - I'm arguing morality.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Article with context:

[http://www.texasmonthly.com/the-daily-post/whats-really- goin...](http://www.texasmonthly.com/the-daily-post/whats-really-going-on- with-student-loan-debt-collection-in-texas)

Original discussion, 70+ comments:

[https://news.ycombinator.com/item?id=11110473](https://news.ycombinator.com/item?id=11110473)

</comment><comment><USER9> Entry into the middle class is now gated by a system of indenture in which you must purchase on non-bankruptable debt a certificate to be considered for a middle class job.

(... unless your parents are rich or you're part of the small percentage who qualify for non-trivial student aid or scholarships.)

<comment><USER10> You can also join the militarily or devote half your time to applying to scholarships.

I know people who have done both. Paying for college has many different opportunities, you don't need to pay with loans. That is just the most "convenient" thing to do. Hell, I'm even doing it!

<comment><USER11> Or work and save money for college Or go to a community college Or go to a local state college

Nope, get a loan

<comment><USER10> Yea. I feel upset about my situation but when I objectively look at how I got here I understand that it, in my situation, was a 'choice'.</comment></comment></comment></comment>


New domain bitstress.com being used in dns amplification attacks - <AUTHOR> http://dnsamplificationattacks.blogspot.com/2013/09/domain-bitstresscom.html

<comment><AUTHOR> Many dns amplification attacks have made use of the domain isc.org due to it's large size and entry count. It looks like someone has now registered and setup the new domain bitstress.com, as a possible alternative. Note the large number of odd entries in the zone.

Some people have been using iptables to suppress dns amplification attacks, by referencing isc.org with variations on the following theme/hash:

-A INPUT -i eth0 -p udp --dport 53 -m string --hex-string "|03697363036f726700|" \--algo bm --to 65535 -j just-drop

Here's a new variation for the new bitstress.com domain:

-A INPUT -i eth0 -p udp --dport 53 -m string --hex-string "|0962697473747265737303636f6d00|" \--algo bm --to 65535 -j just-drop</comment>