When Covid-19 deaths are analysed by age, America is an outlier - <AUTHOR> https://www.economist.com/graphic-detail/2020/06/24/when-covid-19-deaths-are-analysed-by-age-america-is-an-outlier <comment><USER2> Many young people in America have no health care, and delay going to the doctor until they are on death's doorstep. That might be part of it. Before I got my first desk job at the age of 32, my reality was that going to a doctor or dentist was as distant an idea as being an astronaut. I had never been, and had no idea how one would even go about trying, and had no money to pay for those kinds of services anyway. I'm sure that many people are stuck in that position for far longer (or indefinitely). After I got that first job the first thing I did was have 7 fillings and 2 root canals, saving several of my teeth.

</comment><comment><USER3> The graph on the left shows that America is doing much better than Europe as far as case fatality rate goes, about half that of Britain/Spain or Italy.

Yet somehow that positive information is turned into a negative sentiment of look how much worse the situation is, our people are younger.

Perhaps the explanation is that the two measures are fully correlated:

Patients in the US are younger, hence die less often.

<comment><USER4> The obvious interpretation of this is that in some places like Italy, the older population received much more exposure than it did in the US. In Italy, this was due to so many extended families living in the same home.

In fact, things would have skewed even younger in the US except for the nursing home debacle in NY and NJ.

It's worth pointing out that there's quite a disconnect between the US media coverage of the mortality rate here, versus the higher mortality rate in Britain, France, and other EU countries. There is also a good chance that COVID mortality in the US is being significantly overcounted.

Regardless, there's little choice at this point - we need to keep the economy open as we wrestle with minimizing hospital visits and fatalities. Let's hope improved treatments are developed at a high rate!

<comment><USER5> >There is also a good chance that COVID mortality in the US is being significantly overcounted.

It seems experts (CDC among other) suggest the mortality is quite a bit undercounted, since there are many deaths for which the person is not tested, since we lacked the testing capabilities.

One interesting place to see it is expected death rates versus actual death rates while COVID is here, and note there is no other known thing that spiked at the same time to account for the excess deaths.

What science groups or medical groups are claiming it's overcounted?

For example,

[https://www.scientificamerican.com/article/how- covid-19-deat...](https://www.scientificamerican.com/article/how- covid-19-deaths-are-counted1/)

[https://www.npr.org/sections/goatsandsoda/2020/05/13/8548736...](https://www.npr.org/sections/goatsandsoda/2020/05/13/854873605/fauci- says-u-s-death-toll-is-likely-higher-other-covid-stats-need-adjusting-too)

<comment><USER6> Is this really true though? Most states report separate numbers for cases and confirmed cases as well as deaths and confirmed deaths. In Texas there is something like a 3 order of magnitude difference between the number of reported cases and the number of confirmed cases and you can see wild discontinuities in the reporting data as they periodically change their methodology and or criteria. New York, for instance, was reporting deaths were Covid-19 might have contributed rather than confirmed deaths.

My biggest problem is that while it is trivial to find mountains of Covid visualizations, raw data with clear explanations of it's criteria and methodology is very hard to come by. I think it's quiet likely that some locations are over reporting and others are under reporting.

<comment><USER5> >Is this really true though?

According to the research papers and professional groups I've looked as this is true. If you want to discount experts that are well aware of the problems, methodologies, etc., then I don't know how you'll reach any conclusion. Non- experts are rarely more accurate than experts on complex issues.

As to methodology, CDC lists and recommends methodologies for all diseases, and COVID deaths are counted by them using the same methodology that all deaths are, whether cancer, heart attack, car wreck, etc. So there is nothing special about how COVID deaths are counted from their recommendations.

Many states seems to have political pressure to downplay COVID, but I've not seen credible complaints (or any complaints) by whistleblowers claiming they're pressured to increase death counts.

And overall death counts versus expected death counts gives a picture of likely COVID caused deaths that makes them far undercounted.

I expect scientists to arrive at pretty good counts eventually, then political and nonsense spreaders to ignore anything that doesn't suit their narratives.

Here's [1] some CDC covid methodology info - if you google CDC COVID methodology or CDC disease methodology you'll find plenty of methodology on data collection.

[1] [https://www.cdc.gov/coronavirus/2019-ncov/covid- data/covidvi...](https://www.cdc.gov/coronavirus/2019-ncov/covid- data/covidview/purpose-methods.html)

<comment><USER6> I'm not trying to pick fights with experts or claim there there is some hidden agenda to inflate death counts, I just want frank discussion of the data. Now, from the CDC methodology you linked,

"For COVIDView, the percentage of total deaths occurring in a given week that had pneumonia, influenza and/or COVID-19 (PIC) listed as a cause of death is calculated. PIC deaths are identified based on ICD-10 multiple cause of death codes J09-J18.9 or U07.1. PIC is being monitored in order to provide a more accurate representation of COVID-19 related mortality than would monitoring COVID-19 alone. Deaths due to COVID-19 may be classified as pneumonia deaths or influenza deaths (deaths due to "flu" or "flu-like illness") in the absence of positive SARS-CoV-2 test results. The combined PIC categorization also prevents double counting of deaths"

The death rate from Covid-19 includes deaths from other causes that have similar symptoms. The reasons for this are good, it's very difficult to identify between these diseases and lumping them together probably gives a more accurate result than relying on confirmed cases. There's no malice here, it's just a very difficult problem to work on, but it's also a methodology that should be likely to give a high side estimate. Then from there, they calculate excess deaths [1], which I was able to find through your link (thank you). Outside of New York/New Jersey and Massachusetts, I don't find a high disparity in the excess death ratio that supports the idea that there is significant under reporting of deaths.

You can find cause of death vs year on their charts at [2] and most of the excess deaths are from cardiac arrest or dementia. Now, that could be caused by Covid, except if we go to New York where Covid has been by far the worst in the US, you see a huge jump in respiratory deaths directly lining up with the peaks in the reported Covid cases. So are more people having heart attacks? Is Covid causing heart attacks? Are people unwilling to get treated at hospitals for heart attacks because they are afraid of Covid? These are unanswered questions and it could go any which way from what I understand. The data appears to be out, and I think it will be out for a while which is why I don't feel comfortable pushing the idea that we are under-reporting deaths or over- reporting deaths because I think that we don't actually know.

[1] [https://www.cdc.gov/nchs/nvss/vsrr/COVID19/index.htm](https://www.cdc.gov/nchs/nvss/vsrr/COVID19/index.htm) [2] [https://www.cdc.gov/nchs/nvss/vsrr/covid19/excess_deaths.htm...](https://www.cdc.gov/nchs/nvss/vsrr/covid19/excess_deaths.htm#dashboard)

<comment><USER5> >but it's also a methodology that should be likely to give a high side estimate

It's the same methodology they use for all diseases. If it's too high an estimate, they'd pretty quickly find it since it would overcount enough reasons fro death that totals would not match measured death totals.

In my original post I linked evidence and the expert reasons why counting is likely low.

>Outside of New York/New Jersey and Massachusetts, I don't find a high disparity in the excess death ratio that supports the idea that there is significant under reporting of deaths.

The CDC link had many states with many thousands of excess deaths. And remember CDC death count lags actual death counts by a few weeks, so the 118k-154k (95%-ile) they list is to be compared to COVID as of a few weeks ago, which was under 110K two weeks ago. So taking the median gives around 136K actual deaths (prob not all COVID, but majority so) vs 110K reported - approx 20% undercounted.

>So are more people having heart attacks? Is Covid causing heart attacks?

Both of those are likely true [1]. Research since then is looking like COVID is killing asymptomatic people via attacking the heart.

>I don't feel comfortable pushing the idea that we are under-reporting deaths or over-reporting deaths because I think that we don't actually know

I've found significant decent groups and projects claiming undercounting, many with decent empirical evidence. I've not found the opposite, despite looking. I posted a few to get you started - discount as you wish.

[1] [https://www.sciencedaily.com/releases/2020/03/200327113743.h...](https://www.sciencedaily.com/releases/2020/03/200327113743.htm)

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Be careful reading this graph. The x-axis is "share of total deaths, %", but these are _relative_ measures, not absolute ones. One way for the US to match the other countries would be to intentionally kill a bunch of old people.

A better graph would be "infection fatality rate, %", grouped by age, and compared across countries.

</comment><comment><USER8> Is this article like under 100 words? Or is the rest paywalled and why I only see the first two paragraphs?

<comment><USER9> It's short, but not that short. Pasted:

IT IS NOW well-known that, although covid-19 can strike even the very young, older folk face the greatest risk. In hard-hit rich countries, about 60% of all deaths from the disease are among people aged 80 and over. America, however, is an exception. Data released on June 16th by the Centres for Disease Control (CDC) show that the country's death toll skews significantly younger. There, people in their 80s account for less than half of all covid-19 deaths; people in their 40s, 50s and 60s, meanwhile, account for a significantly larger share of those who die. The median covid-19 sufferer in America is a 48-year-old; in Italy it is a 63-year-old.

Why is America such an outlier? Part of the explanation surely lies in the fact that America has a younger population than Europe does. America's median age is just 38; Italy's is 45. Another reason, perhaps, is that middle-aged Americans may be less healthy than their European peers, eg, because they tend to be more obese.

Whatever the cause, the relative youthfulness of America's covid-19 victims means that the coronavirus is robbing Americans of more years of precious life. A recent study by a group of Scottish researchers estimated the number of years of life lost to covid-19 by age, taking account of the victims' underlying health conditions. It found that in Italy, people who died in their 50s, 60s, and 70s typically lost 30, 21, and 12 years, respectively. Those in their 80s lost five years, on average.

Applying these estimates to the victims of America's outbreak, a back-of-the- envelope calculation suggests that covid-19 has so far shortened the lives of its American victims by 11 years, on average, compared with about nine years in the hardest-hit European countries. America may not yet have reached the same rate of covid-19 deaths as the likes of Britain, Spain and Italy. But the contagion in America is far from contained. Anthony Fauci, one of the experts in charge of America's response, has warned of a "disturbing surge" in new infections in parts of the country. And when the age profile is factored in, there is even more reason for Americans to be disturbed.

</comment></comment><comment><USER10> This video from UCSF explains the correlation of corn syrup, obesity and diabetes, which also explains the corona mortality age distribution in the US:

Sugar: The Bitter Truth (2009)

[https://www.youtube.com/watch?v=dBnniua6-oM](https://www.youtube.com/watch?v=dBnniua6-oM)

It's a 90 minute video, so to summarize:

\- US decreased fat in processed food, but compensated with HFCS (corn syrup)

\- HFCS contains fructose, which is poisonous in large quantities, which we are now eating (almost half a pound per day per person)

\- the additional calories in processed food caused Americans to gain 25 pounds in 20 years

If you drink regular soda with HFCS, then you should switch to one can of cane sugar soda (from Mexico), or one diet can per day. Look at labels and avoid HFCS whenever possible.

You can do a quick reality check on the above by comparing group photos from the 1960s and today - nobody was fat back then, except for Mama Cass.

<comment><USER11> Is corn syrup (instead of HF corn syrup) ok to consume, or is it too pretty darn bad fer ya?

<comment><USER10> The reporting says it's the fructose amount that's highest in importance, since the liver warehouses it, and that seems to cause metabolic diseases, followed lower in priority with large sucrose/glucose amounts.

So fructose in a single fruit with natural fibers is ok, but half a kilo per week or more of raw fructose is toxic.

This is a more watchable video with industry slides admitting there's a problem (similar to cigarette industry):

The Secrets of Sugar - the fifth estate (2014) (42 minutes)

[https://www.youtube.com/watch?v=K3ksKkCOgTw](https://www.youtube.com/watch?v=K3ksKkCOgTw)

I really encourage people to learn about this topic since it directly affects quality of life. If you get free soda at work, skip the HFCS containers.</comment></comment></comment>


Quiet You Tube - <AUTHOR> http://quietyoutube.com

<comment><USER2> Check out ZENTUBE... <http://znt.nu/>

</comment><comment><AUTHOR> A single serving site I've been meaning to build for a while. The inability to disable comments finally did me in.

<comment><USER3> You might want to say what it it does on the frontpage. I thought it just auto-muted videos or something.

<comment><AUTHOR> Added; thanks for the input!

</comment></comment></comment><comment><USER4> genius, i need something like this for NYT, WSJ articles

noise free reading

<comment><AUTHOR> <http://lab.arc90.com/experiments/readability/>

<comment><USER4> cool, Kafka on the front page, i'm sold

and it works like a charm</comment></comment></comment>


Did Hotmail get a new spam filter this month? - <AUTHOR>

I just realized that my outlook.com mailbox went from mostly spam to very little spam about 2 weeks ago. Did they announce a new spam filter? I like it! <comment><USER2> Not sure if related but it appears all Hotmail users have now been migrated to outlook.com as of a couple of weeks ago:

[http://midsizeinsider.com/en-us/article/microsoft- readying-o...](http://midsizeinsider.com/en-us/article/microsoft-readying- outlookcom-for-relea)

Apologies that was the best link I could find.</comment>


Show HN: GTD, ToDo Lists & Timer under the 1 roof (iOS app) - <AUTHOR> http://www.gsdfaster.com/#showhn

<comment><USER2> Great looking app! Minor nit: the free version's name doesn't quite fit the personality of the rest of the page.

<comment><AUTHOR> Thank you for the compliment (I am the developer of the app). The FREE version is many many versions outdated inc. the name. The paid version will be going Freemium soon so everyone can experience the new UI/UX and features free of charge.

</comment></comment><comment><USER3> Great App! There are a lot of productivity apps out there, but most of them are overloaded with useless functionalities, this one seems to be very simple and solves the major needs. Let us know once Freemium version is out.</comment>


Synthetic Steak Is Coming: How About Burgers with Everything Except the Animals? - <AUTHOR> https://www.kqed.org/science/1947260/hows-our-appetite-for-lab-grown-meat <comment><USER2> A lot of people focus on the creepy factor, but I'd argue that this is vegan and a lot of people have health needs that aren't easily met without eating meat. Plus the article emphasizes the eco-friendly ramifications of this. Sounds like lab meat won't consume the massive quantities of water and produce the insane amount of methane that growing cattle does.

<comment><USER3> It's as creepy as a smelly tank of algae growing your vitamins. (Essentially compost.)

</comment></comment><comment><USER4> > Farms generate a hefty carbon footprint. Raising animals in California emits > 8 percent of the state's total greenhouse gases. That's more than all the > state's oil refineries combined.

Ummm...

This is readily explainable by California having a lot of cattle ranches (it's an agricultural powerhouse in numerous categories, cattle ranching being among them) and relatively few oil refineries. Curious how this would compare to, say, Texas (which has an abundance of both, last I checked).

<comment><USER5> I wonder how much of California's total gaseous emmissions is comprised of the CO2 that the state's people exhale.

</comment></comment><comment><USER6> Extremely excited about this. Becoming vegetarian meant missing chicken wings (I've found awesome alternatives), burgers (Beyond Meat!), Mexican food (several vegan options in my town now) and finally steak. Steak is the last meat-based food I cannot stop craving after almost ten years...</comment>


The Rise and Fall of Halsey Minor (CNET Co-Founder) - <AUTHOR> http://www.pehub.com/59744/halsey-minor-barely-escapes-foreclosure/

<comment><USER2> Charlottesville is a beautiful town, but the real estate market there is messed up. The prices haven't come down as much as they should have since the popping of the bubble, a local family controls a huge percentage of land, and so on. The walking mall is great and the university keeps things interesting, but in spite of it all, it is still "small town" by urban standards.

</comment><comment><USER3> It was CNET, not Cnet, CNet, cnet, C|Net, etc.

Sorry, pet peeve (former employee).

</comment><comment><USER4> This is a bit tabloid-y for hacker news, no?

<comment><USER5> True, but it's an interesting story covering a range of tech entrepreneurship topics/eras in a brief format: The 90s bubble, successful angel investing, entrepreneurship, excess, and how all those things can bring the self- destruction of an individual.</comment></comment>


Get Your SaaS in Gear by Talking to Your Peers - <AUTHOR> https://medium.com/startup-lesson-learned/69ea8596f609

<comment><AUTHOR> What is your experience with customer dev. vs. talking to other SaaS folk?</comment>


Forge (python) signatures for fun and profit - <AUTHOR> https://github.com/dfee/forge <comment><AUTHOR> I was frustrated by the trade-off between writing repetitive function signatures, and writing function signatures that have no meaning. So I wrote `forge`.

It's 100% tested, well documented, Python 3.5+, and is available on PyPI as `python-forge`.

As far as I can tell, it's the only Python package that provides a toolkit for re-writing signatures. Docs: [https://python- forge.readthedocs.io/](https://python-forge.readthedocs.io/)</comment>


Turning Words into Hex Codes - <AUTHOR> http://digg.com/2017/hexadecimal-words-colors-c0ffee <comment><USER2> Why not link to original (source) site instead of a commercial site? [http://c0ffee.surge.sh/](http://c0ffee.surge.sh/)</comment>


Gov. Jerry Brown signs AB168: bans employers from asking about salary history - <AUTHOR> http://www.ocregister.com/2017/10/12/in-bid-to-fight-gender-pay-gap-gov-jerry-brown-signs-salary-privacy-law/ <comment><USER2> They don't need to ask. Equifax is already tracking that for employers. :-/

</comment><comment><USER3> "The law also requires employers to provide applicants, upon request, with a salary range for the jobs they seek."

Now that's going to create one hell of a mess. Someone didn't think that through.

<comment><USER4> Having not read the specific wording of the law I am curious, couldn't an employer just fulfill their legal obligation by saying the salary range is 1 to 300k dollars?

<comment><USER3> No, because it has to be true. All companies have their own scales, and they would probably get sued for not accurately disclosing those. There are also exceptions, which would go outside of the range and invite scrutiny/lawsuits as soon as a minority discovers one single white/Indian male whose salary exceeds the stated target range for "senior engineer".

It's one thing for employers to voluntarily provide a good faith range, which some will, but another when they expose themselves to a gender discrimination lawsuit by being wrong.

Also, everybody is going to insist on max(range).

This law seems to create a lot of legal landmines that I don't think will be beneficial. High earners can volunteer their salary anyway.

</comment></comment></comment><comment><USER5> Good step. Should also remove background checks, credit checks, and drug tests.

<comment><USER6> Why?

My father-in-law was just embezzled by his accountant. It's mostly been spent, so he will get pennies in the dollar back. (I'm not well versed in legal matters...I had no idea crime could be so profitable, even after you get caught.)

It sucks that he got screwed over, but it'll suck more if the next guy has the same experience.

There must be _some_ kinds of questions employers can be permitted to ask to help this?

<comment><USER3> A background check would have done nothing to warn him. If he ends up in court over it, it will be public record, and that's all you need.

<comment><USER6> Isn't checking criminal records the raison d'etre for background checks?

</comment></comment></comment></comment><comment><USER7> Effective January 1, 2018. Just in case anybody is job hunting right now.</comment>


Ask HN:Thoughts on written tests for interviews.  - <AUTHOR>

Ask HN:Thoughts on written tests for interviews.
I have been job hunting for a while, had many interviews, and have recently found an acceptable end.
One thing that I was very not prepared for as a possible interview environment was 'written tests.'
During my in person interviews at two of the companies that I perused I was asked to sit down, in a quiet room, and take a  test.
-- The first company had me fill a 'mechanical aptitude' multiple choice test (1 hour) -- The second company had me fill a written test on my knowledge of the python programming language (2 hour)
I had never heard of this as an interviewing mechanism. At the time of leaving both companies was frankly quite displeased about the experience. I felt they were wasting my time.
Looking back at it, my position may have been a bit egotistical; but I still believe that the goals of these tests could easily be met by an at-home coding sample.
Any input to this as an interview mechanism (on either side) would be very much appreciated. <comment><USER2> I've never heard of this. If someone is making you take a two hour test, you should probably just walk away from the interview. They clearly have no value of your time.

</comment><comment><USER3> What did the python test consist of, if you don't mind sharing? I'm curious as I've never heard of this before...

</comment><comment><USER4> Care to say which companies do these tests?

<comment><AUTHOR> Both were in Seattle

One builds and designs Scanning Electron Microscopes

The other provides tools for supporting/maintaining self organizing networks over cellular communication towers.

I don't plan on naming them directly, but, neither had me sign an NDA for the interview process.

<comment><USER4> I've heard of the written psych type of exams before. I don't think they're great, but as with any interview method, it's something of a cargo cult and folks stick to it.

<comment><USER5> I've never experienced that but have had friends who have. The psyche test as well as the technical exam. These were corps in Toronto, Canada.

There are days where I feel incredibly lucky to have a career in tech/software. When I think about the interview process, those good vibes disappear. I started my career at the point where talking tech with the interviewer for 30-45 mins got you the job. I think back in those days, software wasn't as sexy. So, none of this need to get rid of the guy who read programming in 24 hours. Things have gotten overboard in my humble opinion. Tech has gotten broad. So very broad. Yet, we expect candidates to know the littlest details. I've been up and down the stack ... frankly, I've probably forgotten more than I know right now.

One thing people mistaken is that startups have a lower bar when it comes to technical interviews. I mean, the big, faceless corp has HR people administering tests with scantron. How can the interview process be worse? Well .. pretty much every start up I've spoken to has disappointed me. Multiple road interviews, homework assignments, code while we watch you type. So much soul sucking :(

I miss the good old days.

<comment><USER6> I upvoted this.

I started in 1988. Interviews were like you said, and I absolutely do not see any difference in the quality of hires today as back then. And, how could I? It's the same population of skills, distributed across companies (okay, that is too hand wavey, it assumes everyone is employed, that today's high salaries do not attract posers, but still).

My first job was to generate statistics and otherwise mine data for cancer for the government (IOW, rather important to be able to do what you are asked to do). That interview lasted about 1 hour, and I was made a verbal offer on the spot. That was their style, and the result were just as good (better, I'd actually argue), then any "go read a CS book for a month and practice for your multi-round whiteboard" style of interview.

If you can't measure me in about an hour, you have a problem. A more senior role might require more,because you'll want to know not only my coding, but how I might run a team, run a project, interact with clients, and so on. Call it 2-3 hours.

<comment><USER5> I think this started with Microsoft and Google. Before Google, Microsoft was infamous for being one of the few places in tech having a 1 day interview. They flew you out to Seattle and gave you brain teasers. People realized the brain teasers didn't work and they just transformed into white board coding interviews. But that was just Microsoft. Then, Google came on the scenes and started paying more than Microsoft. I remember starting salaries jumping from 60K to 80K around 2004-2005. That was likely a direct result of Google. At the same time, Google copied the Microsoft hiring process, which was not the industry average to begin with. In fact, they made it harder. The whole ... hire people smarter than you crap started. The Google anti-interview loop was born (the hypothesis is that every employee at Google has a set of 5 people who, if they were on their interview loop, would reject the employee for their current job). People whose first jobs were around 2004 think this is the way it should be for everyone. And then, we are in our current situation where startups can't find anyone qualified to hire and job seekers find it impossible to get employed.

I think what this does is lower programmer mobility and encourage more people to do startups. I don't like the first result, but I do like the second.</comment></comment></comment></comment></comment></comment>


Court interprets Creative Commons licence terms in copyright lawsuit - <AUTHOR> http://www.teresascassa.ca/index.php?id=196%3Acourt-interprets-creative-commons-licence-terms-in-copyright-lawsuit&option=com_k2&view=item <comment><USER2> So that poor guy just chose the wrong license. It should be CC BY-NC-ND-SA, not CC BY-SA.</comment>


90 X86 Servers in 2U No Cooling Needed - <AUTHOR> http://www.teamdgs.com/SR90_addc.html <comment><AUTHOR> I submitted this - I have no connection to the company but I was just curious what the HN community thinks. Has anyone tried one of these out?

What were the good points? What compromises are being made? What workloads does this seem particularly well suited to serve?</comment>


Control line - <AUTHOR> https://en.wikipedia.org/wiki/Control_line <comment><AUTHOR> Model aircraft flown using a pair of very thin, very strong control lines attaching one wing to the pilot on the ground.

The combat competitions, in particular, are pretty spectacular, involving two very manoeuvrable aircraft trailing streamers behind them, and attempting to cut the opponent's streamer.

[https://www.youtube.com/watch?v=N7loHjrssQg](https://www.youtube.com/watch?v=N7loHjrssQg)</comment>


Leveraging the Boundary Between Client and Server in a REST API - <AUTHOR> https://spin.atomicobject.com/2017/11/07/restful-api-client-server/#.WgG7Q2dgI4A.hackernews <comment><USER2> As much as this approach might work well for side-projects, it would definitively lead to a few pain points for bigger teams or projects. The main being that you are binding the display of your data (frontend) to your server (backend). In many cases this means multiple deploys for a single purpose, and also multiple people involved to solve a problem that might actually be very simple.

I've also seen many times this leading to the anti-pattern of building an endpoint to every single new page/feature. Once you reach hundreds of endpoints where some of them are very similar, things starts to get messy.

I believe in most cases the API should empower the user to express and manipulate the data in every way the domain allows, even if it means building complex urls/queries sometimes.</comment>


Ask HN: Has someone automated best practices for AWS? - <AUTHOR>

I'm looking for a configuration tool that will let you declaratively specify the condition of your AWS account (mostly IAM, user permissions, roles, etc) in code or config.  Perhaps similar to Chef, Ansible, Puppet, etc, but not for individual instances, but rather for the AWS metadata itself.
Has someone built this? <comment><USER2> Check out AWS CloudFormation (AWS specific) or Terraform.

[http://aws.amazon.com/cloudformation/](http://aws.amazon.com/cloudformation/)

[https://terraform.io/](https://terraform.io/)

</comment><comment><USER3> You can do this using the AWS library or cli tools, combine that with Ansible etc and it works nice. Also, have you checked out Netflix for all their open source tools for AWS? They have a couple that dig into AWS and inventory what you have and allow you to make changes etc.

IIRC, Ansible has an inventory command, you just have to run it per AZ. I don't do the Ansible work everyday so it may be slightly different now.

For our configuration we use Ansible alone with the AWS API library and cli tools. So for example, we have backups scripted via cli tools and shell scripts but those scripts are configured and deployed using Ansible. In other places we have tools deployed via Ansible that use the Node API into AWS to get more information and make some minor setting changes.

</comment><comment><USER4> Ansible has plenty of cloud modules for AWS. you can describe your whole AWS environment from VPC , Security Groups, Routing tables, etc. You might not be able to find everything but you can also use the AWS Cli to handle IAM roles and user permissions. You have to use a mix of both Ansible and plain AWS Cli to achieve your goal.

<comment><AUTHOR> It's sooo limited in what's implemented.</comment></comment>


Namecheap upstream issues, says Do Not Try To Register/Modify/Buy right now - <AUTHOR> http://status.namecheap.com/?p=13788

<comment><AUTHOR> I have cart errors, I hope I get my domains I carefully listed so I can buy.</comment>


Apple Watch: "Don't concentrate on the finger" STFU and listen, golden marketing - <AUTHOR> http://lessthunk.com/2015/03/11/apple-watch-dont-concentrate-on-the-finger-stfu-and-listen-their-marketing-genius-is-golden/

<comment><USER2> >Apple WATCH is a mass market platform for greater things Agreed -- it's complimenting the phone to save time.</comment>


Algol 60 implementation (1964) [pdf] - <AUTHOR> http://www.softwarepreservation.org/projects/ALGOL/book/Randell_ALGOL_60_Implementation_1964.pdf <comment><USER2> A very interesting book; I have already read some parts, and also implemented a few things: [https://github.com/rochus- keller/Algol60](https://github.com/rochus-keller/Algol60).

The Algol 60 language report appeared in May 1960, so exactly sixty years ago.

<comment><USER3> And ESPOL/NEWP were one of the first dialects used for systems programming, 10 years before C was born, still being sold by Unisys.

<comment><USER4> As a reminder, we are still looking for complete distributions of the Burroughs B6700 MCP releases that include ESPOL/NEWP so we can complete an emulator and preserve this system into the future.

<comment><USER3> No chance getting collaboration out of Unisys?

<comment><USER4> We received some files from Release II.1 (early 1972) but it is missing significant components. After that time we have bits and pieces but nothing complete. We remain hopeful that someone has a distribution tape from the 1970s and we would expect that to have all the needed components.

</comment></comment></comment></comment></comment><comment><USER5> Also interesting to see the hardware which this compiler was designed for: [https://en.wikipedia.org/wiki/English_Electric_KDF9](https://en.wikipedia.org/wiki/English_Electric_KDF9)

</comment><comment><USER6> For context, the first FORTRAN compiler was delivered in 1957[1] and LISP in 1958[2].

My eye was caught by this remark, a propos the careful specification of Algol 60's syntax,

> indeed many early languages were virtually defined by the action (not always > predictable) of their compilers.

But they immediately qualify that with

> Unfortunately the rigour with which the syntax of ALGOL is defined does not > extend to the semantics...

[1] [https://en.wikipedia.org/wiki/Fortran#History](https://en.wikipedia.org/wiki/Fortran#History)

[2] [https://en.wikipedia.org/wiki/Lisp_(programming_language)#Hi...](https://en.wikipedia.org/wiki/Lisp_\(programming_language\)#History)

<comment><USER7> LISP more like 1960 for LISP I -- see [http://www.softwarepreservation.org/projects/LISP/lisp15_fam...](http://www.softwarepreservation.org/projects/LISP/lisp15_family/#LISP_I_and_LISP_1.5_for_IBM_704,_709,_7090_):

J. McCarthy, R. Brayton, D. Edwards, P. Fox, L. Hodes, D. Luckham, K. Maling, D. Park and S. Russell. LISP I Programmer's Manual. Computation Center and Research Laboratory of Electronics, Massachusetts Institute of Technology, March 1, 1960.

        Copy 1: Computer History Museum Lot X????.200?, George Michael donation. http://bitsavers.org/pdf/mit/rle_lisp/LISP_I_Programmers_Manual_Mar60.pdf
        Copy 2: Science and Technology Collection, M.I.T. Museum, Cambridge, Massachusetts, catalog number 1993.053, donated by Timothy P. Hart. Missing cover and Acknowledgements. http://www.softwarepreservation.org/projects/LISP/book/LISP%20I%20Programmers%20Manual.pdf
        Copy 3: From Supplementary Materials for Oral History of Phyllis A. Fox. The History of Numerical Analysis and Scientific Computing, Society for Industrial and Applied Mathematics (SIAM). http://history.siam.org/sup/Fox_1960_LISP.pdf</comment></comment>


The Bitcoin Fluid Dispenser 2.3 - <AUTHOR> http://andyschroder.com/BitcoinFluidDispenser2.3/

<comment><AUTHOR> The Bitcoin Fluid Dispenser 2.3 is an improvement of The Bitcoin Fluid Dispenser II that includes Near Field Communication (NFC), Bluetooth communication, and the bitcoin payment protocol. Using the bitcoin payment protocol with a Bluetooth connection allows for payment to be made with no internet connection on the customer's mobile phone or tablet computer.

Two new videos have been created. The first includes a technical discussion and demonstrates the NFC, bitcoin payment protocol, and bluetooth offline transaction features using Schildbach's Bitcoin Wallet. The second video shows compatibility of the system with more bitcoin wallets (breadwallet and mycelium) and demonstrates the bitcoin payment protocol using QR codes and HTTPS, and NFC without the bitcoin payment protocol.</comment>


JPMorgan Settles With Federal Authorities in Madoff Case - <AUTHOR> http://dealbook.nytimes.com/2014/01/07/jpmorgan-settles-with-federal-authorities-in-madoff-case

<comment><AUTHOR> Quoting from them article:

 _JPMorgan, having served as Mr. Madoff's primary bank for more than two decades, had a unique window into his scheme. In a document outlining the bank's wrongdoing, prosecutors argued that "the Madoff Ponzi scheme was conducted almost exclusively through" various accounts "held at JPMorgan."_

 _On two occasions, in 2007 and 2008, JPMorgan's own computer system raised red flags about Mr. Madoff, according to prosecutors. But both times, prosecutors say, JPMorgan employees "closed the alerts."_

 _"JP Morgan failed to carry out its legal obligations while Bernard Madoff built his massive house of cards," George Venizelos, a senior F.B.I. official, said in a statement._

 _The F.B.I. and prosecutors traced the problem to JPMorgan "willfully" failing to create sufficient controls against money laundering. "There was no meaningful effort by the Bank to examine or investigate the Madoff Securities banking relationship," prosecutors said._

Any current or former JPM employees out there? Your comments will be especially, especially welcome.</comment>


The spread of true and false news online - <AUTHOR> http://science.sciencemag.org/content/359/6380/1146 <comment><USER2> [https://news.ycombinator.com/item?id=16547005](https://news.ycombinator.com/item?id=16547005)</comment>


An Oral History of LimeWire - <AUTHOR> https://melmagazine.com/en-us/story/an-oral-history-of-limewire-the-little-app-that-changed-the-music-industry-forever <comment><USER2> "Tan: The fact that users would "own" songs was the deal-breaker for a lot of the dinosaur record labels. I remember one meeting with a music label I won't name, where the exec in the room basically told us, "If you listen to a Madonna song, I want you to pay us for that privilege. You never own music, you simply buy a license to consume that music at that moment. Next year, when you want to listen to that same song, I want you to pay us again. Thirty years from now, when your grandchildren want to listen to that Madonna song, I want them to pay us. You will never own this music, you only buy a temporary right to listen to that music at that moment, nothing more." "

This just encapsulates everything about the modern digital content landscape.</comment>


Ask HN: Joining the fast paced SV world as a self-taught midwesterner? - <AUTHOR> Some people leave tech hubs to settle for a more slow paced life, but I am the opposite. I'll looking to switch it up more. I want to move out west and try a new way of looking at work. The culture of highly valuated unicorns and meal substitutes seems weird and enthralling at the same time.
I'm a self-taught web developer working for 7 years now, but my work, and overall pace in life in general, feels very slow and uneventful. Not to mention being underpaid. So even if I wanted to go on a sabbatical, and go on an adventure traveling to do something fun, I cannot afford it.
Not even the local start-ups are doing it for me. They don't pay me well, and I still feel like a cost center in these places. Everywhere I go, there are cowboy coding practices in place, and developers go unappreciated.
And all for what? Uninspired products that I can't really get into. It's one thing if I had a job that paid decently, but at this point in my life, I don't want to work just anywhere. Hardly anyone in the local area is doing anything "sexy". I read articles about self-driving cars, IOT, automated stores, but most importantly, B2C products that I can actually relate to. I don't want to work for a stuffy business, or make small sites that only get 100's of hits per day- I want to be part of the bustling tech scene. I want to understand why RSUs are important to SV when no company in the Midwest (that I know of) offers them.
I know the grass is greener on the other side. I'm mainly interested replies that are in support of my goal, but with advice on how to get ready for tech hubs in general. Should I go straight to unicorn and big tech companies to apply? Or start with something more humble, but local to SV? I want to see it through as a midwesterner, who's been mostly in slow-paced underpaid jobs and rarely traveled out of state. And if anyone has had a similar experience to mine, that would be even more awesome to hear from you. <comment><USER2> What do you have to lose by trying it out?

Get a job and relocate. Promise yourself to stick it out for at least a year.

If you love it, stay.

If you hate it, return to where you are now, with a greater appreciation for the things you missed. No harm, no foul.

And if there are some aspects you love and others you hate, perhaps check out one of the other tech hubs (Seattle, Austin, New York, Denver, Boston, etc) - they each have a different flavor. Different pace. Different weather. Different focuses. Different balance. Different values.</comment>


Comcast not welcome in city, council says - <AUTHOR> http://arstechnica.com/business/2014/10/its-a-terrible-company-comcast-not-welcome-in-city-council-says/

<comment><USER2> The future of our information superhighway seems to be the tollbooth hell of the Chicago area.</comment>


Ubuntu One Music Store Available for Download - <AUTHOR> http://crenk.com/ubuntu-one-music-store-available-for-download/

<comment><USER2> I'm not sure the information on this site is correct, but it seems kind of strange to have to pay twice when buying music. You're paying first for the actual mp3s and then you're paying a monthly fee when what you bought(and want to store in the cloud) exceeds 2GB?

Since the files are the same and there's no need for duplication on UbuntuOne's servers why would they need to charge you for storing them on their servers?

<comment><USER3> I can't be sure, but maybe they are giving everyone their own copy so stuff like accidentally removing things people already bought doesn't happen.

IANAL but it seems like this would make the data _yours_ instead of them providing it as a streaming service. Which means if they are e.g. forced by a court for whatever reason to not provide a specific song anymore (if the author plagiarised it for example), they can't take it away again from you because it's yours. If it were a simple service you could access to get a copy, they might be forced to not provide that anymore.

</comment></comment><comment><USER4> I hope they offer giftcards come x-mas</comment>


Salesforce fires red team staffers who gave Defcon talk - <AUTHOR> http://www.zdnet.com/article/salesforce-fires-red-team-staffers-who-gave-defcon-talk/ <comment><USER2> I was one of the people that was there when it happened. My coworkers and I were asking one of them questions after the talk. The goons were kicking us out of the rooms because it was the last talk of the day and they wanted People to leave. We were talking in the hallway and asking him questions when we ran into the other presenter there(And people were asking him questions too). Anyway few mins later I see our old executive walk to them and tell them they have to talk. They started walking and talking but it was right in the open and you could pretty much hear them. They end up stopping and looks like they were trying to defend themselves. Few mins later the executive leaves and the end up walking back to the group that was still waiting to ask them questions (including us). They had been fired effective immediately.

The executive is Jim Alkove. He is a moron and our security org has completed revamped after he "left" to join other companies. All the recent advancements in Microsoft security/Win10 were because we no longer had a leader like him.

Feel sorry for these guys.

<comment><USER3> In a large corporation I worked for a long time, if EVP fires somebody on the spot it means that EVP is next to go. I assume this will be the case for Salesforce.

<comment><USER4> Wait, what's the reason for that rule? Sounds interesting.

<comment><USER5> Firing someone on the spot in a public setting is either a drastic overreaction (and why that's fireable is obvious), or a response to a complete blindsiding … at a level at which the job is to not get blindsided.

<comment><USER6> Either way, it's a complete PR catastrophe, at a level at which the job is _not to do those_.

<comment><USER7> It's also a complete HR catastrophe. How could anyone feel comfortable in their position, knowing they could be fired at any moment, publicly and without warning? Terrorizing your employees is completely unacceptable as a manager.

Edit: I guess I don't have much experience with HR at large companies - I use the term to refer to aspects of management related to maintaining employee wellbeing, workplace culture etc.

<comment><USER6> HR doesn't care about that! Not unless it's actionable. Good way to lose your star contributors, sure, but past a certain basic point retention isn't really part of HR's role.

<comment><USER8> "Retention isn't part of HR's role"

Really? I've always seen HR as a sort of "union for un-unionised employees". They help you get stuff out of the business, and help the business get the most out of you.

Perhaps I've only encountered the good kind of HR.

<comment><USER9> A significant aspect of HR (at least in the UK) is protecting the company from its 'resources', and ensuring that the company has a robust (i.e. legally defensible) paper trail when disputes arise. E.g a process for putting people on an 'improvement plan' in response to poor behaviours / performance, and which can ultimately lead to dismissal.

Back in the day, the term 'anti-personnel department' was often used.

And don't get me started on the use of the term 'human resources'

[Edit] - more detail. I'm a techie but have occasionally had line management (in addition to tech lead) responsibilities. The first time I took on these duties, I had to do the relevant HR training and was amazed at the attitude: a little bit of 'duty-of-care' and a lot of 'follow-this-process-to-make-sure- the-law-is-on-our-side'

<comment><USER10> My experiences of UK large company HR departments was basically that they were the hit squad - if they were in the building then you knew _someone_ was in major trouble.

I had an interesting experience a couple of years back when everyone in our office was called to a surprise meeting with HR _except_ me.... I had already resigned, everyone else got the bullet in that caring way that HR departments are famous for.

<comment><USER11> A company I worked at did something similar; those who were being kept were told to go somewhere else, not to go to that meeting. Those that were still around were herded into the classroom, to be met by the HR head and a hired goon of a security guard. The entire office was being closed, but the _way_ it was done was more hurtful to those folks than the basic business decision.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> If you're close to the Silicon Valley tech community you know the Salesforce datacenter organization and recently security organization has been taken over by many ex-Microsoft executives who are fairly clueless when it comes to security.

This has left the security organization mired in internal political turmoil and has triggered the exodus of most intelligent security professionals from the organization.

This situation appears to be a case of the new and confused security executive mentioned in comments on this thread over reacting.

I say "confused" because for the presenters to get this far they obviously has gone through levels of approval for the talk and presented material internally. This talk was indeed presented before at the Chatham House Red Team Summit in SF where many tech company Red teams were present and code released to some collaborating parties. If you don't know what is going on in your own organization with your directors you are confused.

I say "over reacting" because any decent security executive knows you can't ask a team member to pull a Defcon talk on extremely short notice as it would be damaging to their personal reputation in the community. Firing them for not pulling the talk is completely idiotic as it's likely burn the organizational reputation with the security community. It was likely just a snap decision by said confused executive who did not understand the ramifications of his decision. If you fire someone after they get off the stage at Defcon you more than likely have overreacted.

Sadly these are the types of this that happen when you have poor leadership at high levels. I feel bad for the good security folks still left at Salesforce who have to tolerate this garbage. Luckily there is a massive demand for good security professionals so they should have no trouble finding other employment, hopefully with competent leadership.

<comment><USER13> Using a throwaway account as my username is very close to my real name :-(

 _If you 're close to the Silicon Valley tech community you know the Salesforce datacenter organization and recently security organization has been taken over by many ex-Microsoft executives who are fairly clueless_

This. A thousand times this. The Microsoft rot started in the Datacenter and Security org but is fast spreading to all of infrastructure resulting in a culture that is dramatically different from the rest of Salesforce.

If you're from Microsoft (or better yet, a crony of a high up Microsoftie in Salesforce) you are guaranteed to receive a plum job with a bump up of at least two or more seniority levels and preferential treatment in every aspect.

It's not hard to find examples of mid level ICs (level 61 - 62) being brought in as Senior Directors, level 63's being brought in as principal architects etc. What about non microsoft people ? Well, in that case we need to 'carefully consider the feedback', 'be conservative in our approach', 'avoid being too generous' etc.

Every process, from hiring, to promotions, to appraisals has been systematically corrupted and taken over almost exclusively by Microsoft people with the inevitable results.

It's like watching an aggressive strain of flesh eating bacteria at work. It would be comical the amount of damage this is causing Salesforce if it weren't for the enormous human impact.

<comment><USER14> Wait, there are 63 or more levels of management at salesforce? Is the a level 1? Is there anything higher than 63? What's the distinction between a 61 and a 62?!

Sounds more like Futurama's bureaucracy skit.

<comment><USER15> There are "80" levels at Microsoft [1]. But they begin around 59 for engineers.

The levels at Salesforce are a lot more coarse [2].

[1] [https://www.quora.com/What-are-all-the-job-levels-in- Microso...](https://www.quora.com/What-are-all-the-job-levels-in-Microsofts- technical-career-track)

[2] [https://www.quora.com/What-does-the-Salesforce-career- ladder...](https://www.quora.com/What-does-the-Salesforce-career-ladder-look- like-both-in-software-development-and-management)

</comment></comment></comment></comment><comment><USER16> _The unnamed Salesforce executive is said to have sent a text message to the duo half an hour before they were expected on stage to not to give the talk, but the message wasn 't seen until after the talk had ended._

Which said unnamed executive should have known was patently unreasonable to expect to be received and read in time.

Sounds like a failure in basic communication, somewhere in the organization. And if someone in the C-level feels they need to intervene at the last minute to set things straight -- this very strongly suggests point source of the failure was most likely somewhere _in the middle_ layers (or at the C-level itself) - not with the frontline engineers.†

But which at Salesforce is apparently no protection against getting hung out to dry.

† Especially when we read the parts about "The talk had been months in the making" and that the executive pulled the plug at the last minute "despite a publicized and widely anticipated release."

<comment><USER17> There's a good chance that those guys didn't even have their phones on. If something is that urgent you don't text, you call, and if the call doesn't go through you find someone else that you can call who can go to the people involved and so on until you have _guaranteed_ timely delivery and if you can't achieve that then you're going to have to live with the consequences.

Doing a 'fire-and-forget' text message and then attaching grave consequences to the timing is ridiculous.

<comment><USER18> I thought it was SOP to not bring your phones to DEFCON

<comment><USER19> From what I've read, all you really need to do is turn off wi-fi, which is already fairly paranoid given that no one is realistically going to burn a serious chipset zero-day on random people at a conference. Fake cell towers do occasionally happen but rapidly lead to arrests.

<comment><USER20> "random people" who with high probability may have undisclosed 0day exploits stockpiled on other devices.... yeah if I'm an APT author DEFCON attendees are (the hardest to exploit and most paranoid [read: likely to get caught by]) the ideal target for any nation-state. not to mention that the conference is often attended by multiple state agencies which makes the target even juicer. yes it's an extremely hard and dangerous group of people to attempt to exploit, but that doesn't detract from the potential value and payoff of a successful APT exploit on said group of people

<comment><USER21> That's not how Nation State actors work. One of the things that makes Nation State actors dangerous is they have the patience and resources to attack a high value target at the most likely to succeed point. Backing that up, they generally have the intelligence to know when that best time is. And they for sure know that it's not at defcon when everyone is, as you say, paranoid and on the alert. They're going to get you at home, at happy hour with your non- security friends, in that bar with the great but insecure wifi and no 4g.

<comment><USER22> Or they'll get you while you're in the security line at the airport on your way home.

<comment><USER21> I guess it depends which State we're talking about, but yes.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> I was not at the conference and have no first hand knowledge of what happened.

But before everyone gets on their high horse, please pause to reflect:

This was all company work product being presented by company employees who were on a company funded conference trip. Therefore there is an approval process for vetting presentations as well as a legal process for opensourcing code. This is standard practice at all companies.

Now what do you think is more likely: That the PR department would approve of a talk titled "meatpistol" (FIXED) (have you seen the slides?) and the legal dept would approve of open sourcing the code and then at the very last minute both groups would change their mind and try to pull the talk, or that the presenters never got the OK in the first place, the company found out at the last minute, asked them to pull the talk and they refused?

How likely is it that they would get official approval for their talk under a "Chatham's rules" meeting in February to for a presentation in Augustat the end of July? Isn't it more likely that they got some initial approval for a talk in February, but that PR still wanted to vet the actual slides in AugustJuly? (I'm assuming that the slides were made after February.) Which PR department gives approvals like that? What legal department works this way? In my experience, stuff like this happens at the last minute, because that's when you're finishing your slides (as well as your code), and generally PR is going to ask that you make some changes to your slides and they will want the final copy before signing off. Now maybe I'm wrong and the article is correct, but I think it's unlikely.

Moreover given that Salesforce can't talk about this matter, who do you think is the source for the article and whose side are you hearing?

The last few days have really highlighted how quick people are to pile on with outrage and self-righteous indignation before getting all the facts.

<comment><USER2> During the talk they told us why they called it meat pistol.. it's an anagram for metasploit. Meat Pistol made sense because it shoots out malware implants.

Also why pull out in the last 30 mins? And why fire them? No warnings ? Mistakes happen, you don't fire a director for something like that. The PR process is to make sure the company's image looks good, who better knows the Defcon audience? Hackers or PR people who don't understand the framework?

There is really no other way to see it than Salesforce fucked up.

<comment><USER24> _> During the talk they told us why they called it meat pistol.. it's an anagram for metasploit. Meat Pistol made sense because it shoots out malware implants._

I wonder why they didn't pick Metapistol.

<comment><USER25> What are you more likely to remember a week from now: Meatpistol or Metapistol? Reminds me of the resistor color code mnemonic, something I memorized for life the first time I heard it.

<comment><USER26> Ahh! Violet! I miss her.

<comment><USER27> Leave her alone, she's just 7.

</comment></comment></comment></comment></comment></comment><comment><USER28> It's probably way too early for us to know what's really happened here. If you're unfamiliar with this stuff, you should know that Salesforce has a large and relatively savvy security team, including people who have presented at offensive security conferences in the past.

There's a lot of weirdness in the reporting here; for instance, the notion that Salesforce management had a meeting with members of their own team under "Chatham House rules".

<comment><USER29> I wasn't familiar with "Chatham House rules". But it is allows members to present controversial arguments but prevents anyone from associating their arguments to them after the fact. For example, I can cite the argument later but not say who made the argument in order to prevent them from political repercussions. [https://en.m.wikipedia.org/wiki/Chatham_House_Rule](https://en.m.wikipedia.org/wiki/Chatham_House_Rule)

Certainly very weird that the environment was that charged politically that these rules were needed.

<comment><USER30> Red Team operations can be very controversial as they risk impacting day-to- day operations and data integrity, and can have legal repercussions. I expect they would have this sort of meetings relatively often, regardless of this particular case.

</comment></comment></comment><comment><USER31> Seems like a bad idea for a public SaaS company that relies on trust from customers that their data is secure to piss off their own offensive security team by firing them suddenly without even a warning received.

I expect that lots new Salesforce vulnerabilities will be discovered and disclosed.

<comment><USER32> >I expect that lots new Salesforce vulnerabilities will be discovered and disclosed.

Oh even worse no new vulnerability discovery and disclosure which in turn decreases the security of Saleforce products.

<comment><USER33> Oh, they will be discovered and disclosed, just not to Salesforce or the public but to "interested third parties".

</comment></comment></comment><comment><USER34> Much of the talk on this is about wether it not SFDC has a 'right' to do this, or if it's legal. Frankly that's all immaterial - this sounds like a perfect way to either lose most of your security staff over the next 6-8 months, or get yourself fired. Not sure the exec in question was planning on either of those outcomes, but they are the most likely.

</comment><comment><USER35> That seems like a tad bit of an overreaction on Salesforce's part. The only mismatch here was the expectation set around the availability of the tool's source? So yeah, it was clear the tool is owned by Salesforce and ultimately something like that is decided by the company, but saying you're going to "fight to have it open sourced" and advocating to have tooling you build be shared outside of your company doesn't seem like a fireable offense to me. Look at what it's done for companies like Facebook and Google.

What the hell, Salesforce? This looks bad. There's either more to the story or this is just extreme knee jerk.

</comment><comment><USER36> EEK. When speaking in front of a large audience, it's generally a good idea to either mute your phone, or ditch it entirely before you get up onstage.

To get canned for not responding to a text message 30 minutes before a talk - which you were already approved for - seems terribly unfair and a decision probably made in the heat of the moment.

<comment><USER37> I don't think that "not responding to a text mesaage" was the actual reason.

<comment><USER38> They got fired right after the talk, looks like the person on the other end took it too seriously.

</comment></comment></comment><comment><USER39> Oh, the irony! Months before he was fired, in his talk [1] at QCon London 2017 (March 5-7), Josh Schwartz jokingly said: "I am going to tell some stories and hopefully I won't get fired for sharing this stuff but we'll see how it goes".

[1] How to Backdoor Invulnerable Code: [https://youtu.be/EGshffkzZsY?t=680](https://youtu.be/EGshffkzZsY?t=680)

<comment><USER40> Salesforce PR in the house!

<comment><USER41> That's a really old account to just have 10 karma...

<comment><USER42> Hey! I'm not doing much better and I'm very sensitive about it.

<comment><USER43> I'm in Australia, so I almost never see stories as they start rising. :D

And I may have locked my last account (i336_) a while back by setting "noprocrast" to a ridiculous value, which I TIL that day actually is not fixable. This is a new account. I'm debating whether to ask for my old account to be unlocked, or to start again.

FWIW, this account's first post went badly - [https://news.ycombinator.com/item?id=14909407](https://news.ycombinator.com/item?id=14909407) (downvoted to 0) - and I got bitten a couple days ago as well - [https://news.ycombinator.com/item?id=14975515](https://news.ycombinator.com/item?id=14975515) (down to -1), hmph.

</comment></comment></comment></comment></comment><comment><USER44> Why in the hell would Executive Dumbass, er Jim Alkove, send such an urgent request via an asynchronous form of communication? Is he a moron (obviously)?

If I wanted to ensure something did or didn't happen, and time was a critical factor, I would call, talk in person, or use some other form of synchronous communication to ensure my message was received. I certainly wouldn't blast out a text message and then have a baby tantrum after the fact.

<comment><USER45> Considering he was present at Defcon and could've simply talked to his employees he def. is a moron.

</comment></comment><comment><USER46> Very weird. Seems possible that some clueless higher-up found out about it at the last minute and said "don't you dare let this happen," some middle manager tried to stop it, failed, panicked, and threw Schwartz and Cramb under the bus to evade blame. Could also be office politics bullshit; a high-up was gunning for them with no real justification and ginned up a smokescreen to fire them.

Either way, "director of offensive security" is a pretty hefty-sounding title to fire off-the-cuff like an incompetent intern.

<comment><USER47> "Could also be office politics bullshit; a high-up was gunning for them with no real justification and ginned up a smokescreen to fire them."

Ding, ding, ding! We may have a winner.

Here's my guess - the guys that got fired were more than technically competent (basically experts going off what I've read), but probably were pushing the envelope in terms of what Salesforce, or more specifically Salesforce's large enterprise customers, felt comfortable having discussed out in the open.

</comment></comment><comment><USER48> Screenshot of original tweet: [https://twitter.com/framerate/status/891862938268573696](https://twitter.com/framerate/status/891862938268573696)

</comment><comment><USER49> My impression of the security team at Salesforce is that it's always been a bit of a fiefdom with little input or control from the mothership.

Maybe a plausible explanation of what happened here was that all awareness / approval of the talk was limited to that team, and when an exec outside of the security team heard about it, they freaked out, causing all of this.

</comment><comment><USER50> I'd be fascinated to learn more of the backstory here, because the story as reported so far is baffling.

<comment><USER38> Looks like the executive who messaged them 30 mins before took it personally that they ended up presenting even though he asked them not to so he fired them. Otherwise it makes no sense to fire people right after they finish their talk, unless of course you got an ego to show.

Either way Salesforce really fucked up here.

<comment><USER16> Right. Even if he legitimately felt the engineers were out of line in some way -- firing them at a public conference (and not just any conference - but that industry's leading annual conference) is just dumb.

</comment></comment></comment><comment><USER51> I find it hilarious that at the end of the post it says "Contact me securely" and goes on to give a PGP fingerprint. All while being served up via http...

<comment><USER52> It's up to you to check the Web of trust of this fingerprint. It being served over HTTP is not an issue at all. Even in Trust on First Use I would argue delivering over HTTP is not an issue.

<comment><USER53> It is an issue because you could MITM this and give a different address and fingerprint. This seems highly unlikely but is possible.

</comment></comment></comment><comment><USER54> I was at a talk at a Math Conference where the speaker wasn't allowed to give the talk due to it being Classified. This speaker was able to register at the Math Conference with the talk and canceled it at the last minute during the presentation. I don't believe that that person had any issues after the talk and was not fired from their position as a researcher.

From what I can read about this the case is similar but in both actions it was a miscommunication. The speakers should have been informed that it was unacceptable. They should have been talked to about their instability to give the talk and the talk should have been cancelled. I would like to hear the other side of the story from Salesforce to give a full judgement but, I would expect a reprimand at best and not a firing.

<comment><USER55> That is a very different situation-

1\. The researcher you are talking about should have known the content was classified well before he did the talk. Whether it was classified or not was not based off the decision of a executive.

2\. The punishment for revealing classified data to an audience is clearance loss & likely prison. It is not comparable to revealing proprietary company data that is not classified or not even covered under ITAR.

</comment></comment><comment><USER56> There are methods better than a text to get a hold of someone. Phone, emails, whatsapp, twitter, facebook, calling the conference management, calling colleagues at the conf, go nearby the stage at the beginning of the talk.

Oh and try to be there on time if you need to do something that critical.

</comment><comment><USER57> Staffers, or staff? Seeing this phrase more often but to me it's always been restricted to taking about staff of political campaigns...

<comment><USER50> It's also commonly used for newspapers. I agree, I find it unusual to apply it to generic employees.

</comment></comment><comment><USER58> Zdnet apparently thinks it's okay to redirect me (on mobile, after making it halfway through the article) to a scammy website promising I'd won a $1000 gift card, then hijacked my back button so I couldn't leave. Anyone else experience this?

<comment><USER23> ublock origin is your friend.

<comment><USER59> wonder if this is related to mike johnson leavin?

</comment></comment></comment><comment><USER26> Most people at Defcon use a "burner phone" (a cheap supermarket feature-phone) while there. Nobody who is sane would turn on their work phone anywhere near the Defcon conference. I go there every year with a throwaway phone and laptop.

So nobody will see a text message in a timely manner, unless they knew the burner phone number.

<comment><USER60> The term "most people" is terribly exaggerated. Defcon is not nearly as scary as some people make it out to be. If you have the latest security updates across your devices, disable wifi and take a few other precautions things are fine. I was there this year as saw just as many late model iPhones (most likely not a burner) in peoples hands as I did at any other conference I attended.

<comment><USER61> My burner phone, with disabled wifi, bluetooth, and data, was owned this year.

<comment><USER62> I gave up on burner phones because they were typically old and terribly vulnerable with no possible way to update - think older Android phones. Although, I did win the WiFi Village Fox & Hound hunt a few years back using a Samsung S4, but I had that thing locked down to using only a WiFi strength meter app and of course it was running CyanogenMod back when that was still a thing.

These days I update, backup, and lock down my daily use iPhone before going. See my post earlier in the comments for more details on that. In terms of what was happening in the last two years at DEF CON that could get you with all the steps I took, OpenLTE networks were tricking phones into attaching to them and the most disturbing thing I saw of that was middling of TLS. However, it was of course with a self-signed certificate so as long as you didn't accept the cert, you were likely fine.

If you had an older phone and one without all the latest updates and wasn't configured to be mostly silent, then your experience could be very different. There are a surprisingly high number of SMS exploits which still work to this day on a large number of phones and of course SS7 has architectural weaknesses which will likely never be fixed.

<comment><USER63> > OpenLTE networks were tricking phones into attaching to them and the most > disturbing thing I saw of that was middling of TLS

I am sure that many folks would be very interested in seeing any supporting data/captures. This is incredibly uncommon.

<comment><USER62> Someone had put a map together of the OpenLTE / catchers they found but I can't find it. In my particular case, I had WiFi off the entire time and received certificate validation failure notices four times at different locations while at DEFCON. Given I was only connecting with LTE, there could only be one explanation for those certificate warnings. I was being redirected to an OpenLTE or other cellular base station and someone was running a MitM proxy or solution like SSLSplit on the connection.

Unfortunately when it comes to calling it "incredibly uncommon", we really don't have any widely deployed solutions to identify rogue cellular base stations so it's very difficult to say how often it happens IRL although the only times I've ever seen it happen have been the last two years at DEF CON.

</comment></comment></comment></comment></comment></comment><comment><USER64> I didn't see this myself but the guy who works the drivethru at my local burger king told me that the red team has perfected the flame grilled whopper and they had to be fired because they had gone too far

</comment><comment><USER65> The exploit name certainly has sexually violent connotations to me. I imagine that anyone who has been sexually assaulted would feel very uncomfortable working in an organisation that condoned such language - something like 10% of the population.

I'm not condoning firing as a response - that's as thoughtless and unimaginative as the name. And perhaps the name isn't even if reason for it - that doesn't seem to be clear. But come on guys, try to stay classy.

<comment><USER66> I don't think that was related to the firing, from what I can tell, however I do agree with you, I thought the name was a bit distasteful and not appropriate for an open source project.

<comment><USER67> Why all this morality police? It's just humorous, and to understand the double meaning, it requires quite a bit of imagination.

To be fair, I think it's more common for security projects to take on more aloof names. Who could forget "John The Ripper" or "back orfice" from the cult of the dead cow? I'm sure there are many more ..

<comment><USER66> > I think it's more common for security projects to take on more aloof names

True, although I also find the negative sides of "hacker culture" more pervasive and less challenged than "brogrammer" culture or whatever term you want to use.

> Why all this morality police?

I find it overly sexualised, from a very masculine perspective. That's not really appropriate in a professional context in my opinion, but more than that, it can really put some people off the industry. Unfortunately, those people it puts off are disproportionately from groups that are already minorities in the industry, and so it helps in some small way, to perpetuate the lack of diversity.

Obviously this particular example really is only a small part of the problem, but it all contributes, and one of the easiest ways to do our part for increasing diversity and making the industry more welcoming is to do things like improve the naming of our projects.</comment></comment></comment></comment>


The cost of LIDAR is coming down - <AUTHOR> https://www.washingtonpost.com/news/innovations/wp/2015/12/04/the-75000-problem-for-self-driving-cars-is-going-away/ <comment><USER2> LIDAR is pretty cool because you don't have to do object recognition on the point cloud to know what you shouldn't be bumping into - since the data comes back "already 3D" you have distance and size information and just need to calculate speed. Another benefit LIDAR has is its high resolution as compared to RADAR.

Where LIDAR typically falls down is in adverse conditions (rain, snow, low sunlight in the horizon). There's a group at my university, MDAR, who is prototyping a tech to better overcome the adverse weather issues through a better laser sensing technique.

Here's an article with a little more technical information [1].

Disclaimer: I've done some part time work on market research for MDAR.

[1] [http://articles.sae.org/13899/](http://articles.sae.org/13899/)

<comment><USER3> _you don 't have to do object recognition on the point cloud to know what you shouldn't be bumping into - since the data comes back "already 3D"_

This is true of any pointcloud system though. No system returns density though, so you still have to make assumptions about what is worth running into at what resolution. So if a leaf falls in front of your car, you don't immediately slam on the brakes.

I don't know of any vision systems that do object recognition immediately, in fact I'm not even sure that is possible - or desirable. I guess if you baked segmentation into the firmware it would serve as a fast classifier, but AFAIK nobody is even talking about doing that as you would need a very well trained vision library and classifier to deploy to FPGA.

I make the distinction because we build fairly dense pointclouds with monocular RGB cameras and VSLAM. LIDAR isn't required anymore. LIDAR is faster with lower error tolerances today, but nowhere near as cheap or portable. I suspect monocular SLAM will overtake LIDAR in the next couple of years as it's getting faster and more accurate everyday.

<comment><USER4> I agree VSLAM is good and getting better everyday, but I don't necessarily agree it'll displace LiDAR for autonomous vehicles. The first generations will probably have both. Sure, LiDAR is more expensive, but we're talking about avoiding collisions here -- I believe the extra safety is worth it. I don't think portability is not a big issue for cars (though it is a bigger concern for smaller aerial vehicles). LiDAR will still work in the dark, and potentially with much more range than cameras can. Having worked with vehicles using both technologies, I'd feel far better on the LiDAR-equipped one.

<comment><USER3> 100% agree currently. Your point about dark I was totally overlooking, so I think that's the big difference that makes LiDAR better long term until something better comes along.

</comment></comment></comment></comment><comment><USER5> I'm more excited by the possibility of a small light-weight LIDAR device that can be attached to drones for terrain mapping.

My wife is an archaeologist and we've seen lots of discoveries of buried historical sites found by flying over areas with airplanes and expensive (and large) LIDAR systems. It would be great to be able to disrupt that with prosumer equipment.

<comment><USER6> Imagine this as a consumer technology: 3d scan your home, car, yard and I'm sure game developers will create titles that "take place" at your home.

<comment><USER7> It's already possible to do it with any drone that can take good quality photos: [http://www.makerbot.com/blog/tag/uav](http://www.makerbot.com/blog/tag/uav) The resolution depends on the quality of the pictures and the number of them.

</comment></comment></comment><comment><USER8> LIDAR is not the only way for visual odometry as shown with the kitti challenge, stero camera show similar accuracy than LIDAR : [http://www.cvlibs.net/datasets/kitti/eval_odometry.php](http://www.cvlibs.net/datasets/kitti/eval_odometry.php)

The same is true for object detection : [http://www.cvlibs.net/datasets/kitti/eval_object.php](http://www.cvlibs.net/datasets/kitti/eval_object.php)

And tracking : [http://www.cvlibs.net/datasets/kitti/eval_tracking.php](http://www.cvlibs.net/datasets/kitti/eval_tracking.php)

</comment><comment><USER9> Since there are so many experts on the thread, say these are deployed in every car on the road. How will one tell its own laser reflection from everybody else's, if there's a hundred lidars per city block scanning simultaneously?

<comment><USER10> Light travels really fast. As each pulse has an extremely short length, and there aren't that many scans per second comparative to the lengths of the pulses, collisions should be rare. When you do have a collision, it will look completely different from the pulses around it, so you can easily discard it.

<comment><USER9> Are you guessing or do you know this for a fact? I know that in radars for example this is dealt with using matched filters (i.e. filters tuned to extract known, but delayed signal through correlation), but that requires continuous, modulated signal.

</comment></comment></comment><comment><USER11> Fewer laser elements means cheaper, but also means lower resolution. I agree that a combination of video and radar works well for current active driver aids in cars. LIDAR isn't necessary.

<comment><USER12> True but what resolution do we need? The smallest object a car would need to stop for would be what, a cat or racoon? We don't need snowflake resolution.

<comment><USER11> 32 elements might be able to detect objects that small. It depends on how far away they are.

</comment></comment></comment><comment><USER13> Does anyone know of any examples of a "solid state" lidar as mentioned in the article? Im unable to visualise how such a thing would actually work, and its got me excited!

<comment><USER14> Maybe they use a digital micromirror device also used in dlp projectors. By using a fish eye lens you could use the mirror array to look around and calculate the traveling distance of light pulses.

I am also thinking about a 3d camera. Maybe those are getting good enought to measure distance.

<comment><USER15> Another possibility might be to use multiple solid state laser transmitter/receiver pairs located close together, kind of like ink-jet printer nozzles. Because they're discreet, you would lose some resolution compared to a continuous scan system, but it might be OK for the purpose of staying in a road.

And, since the vehicle is moving (most of the time) anyway, maybe multiple returns can be integrated something like a synthetic aperture radar system to form a more complete picture.

</comment></comment></comment><comment><USER16> What happens after one of these things fails on a 10 year old car? Given the track record of most electronics on cars, this doesn't seem to be that unlikely.

Given these kinds of liability concerns, it might be that reducing the cost of the tech won't reduce the cost of the product much.

<comment><USER17> I guess the computer will tell you to get the sensor replaced? "By 2018, they are expecting to have a third-generation system in place which will be the size of a postage stamp and will sell for under $100." [http://blog.lidarnews.com/postage-stamp-sized- lidar/#sthash....](http://blog.lidarnews.com/postage-stamp-sized- lidar/#sthash.delhMrNV.gbpl)

</comment></comment><comment><USER18> Finally. I was pushing for this back in 2003, but the volume wasn't there.

There are quite good eye-safe flash LIDAR units.[1] Advanced Scientific Concepts in Santa Barbara makes some.[1] A pulsed laser sends out a flash, and the receiver has a 128x128 pixel chip with time of flight counters for each pixel. Range in hundreds of meters, in sunlight. No moving parts except a fan. Cost is about $100K, because they are hand-made using custom ICs produced in tiny volumes. Space-X uses one on the Dragon spacecraft to dock with the space station.

Back in 2003, when we were preparing for the DARPA Grand Challenge, I went down to Santa Monica to see the thing. But the demo was of components on an optical bench, aimed out a garage door into a parking lot. The technology wasn't ready to use yet, but it was clearly the right idea, something that would become cheap in volume. They were working more on making the device more sensitive than on making it cheaper, because they were getting DoD funding. Some of their units even have a photomultiplier tube stage, like an image intensifier. The photoelectric effect is at the atomic level, and so fast you can use it in front of a time of flight device.

So we ended up using the SICK LMS scanner, like everybody else.

There's a tradeoff between field of view and range with flash LIDAR, because there's a limited amount of illumination power. A single one of these devices won't give a full circle of scan, like the Velodyne rotating devices.

There's a cheaper, but less precise, approach, used in the Kinect 360. That's the ZCam technology. See p. 13 of this paper [2] for how it works. It's a phase-shift type LIDAR; the outgoing beam is modulated with an RF signal, and the phase shift of the RF carrier is measured on return. That's also all solid state, but not as good at rejecting interfering illumination. It doesn't have digital counters for each pixel; the timing system is analog. So they don't need counters running at tens of GHz behind every pixel.

Once someone is ready to order > 100,000 flash LIDARs, they'll get cheap. The technology is not inherently that expensive.

The main reason for having a LIDAR is not to see obstacles. It's to profile the terrain ahead. You can detect potholes and drop-offs. Since we were driving off-road for the DARPA Grand Challenge, that was absolutely essential. Automatic driving systems for on-road use can sleaze by without doing that. Most of the time. Until they encounter a big pothole, or are misled by road markings into a ditch. That's why Google has that LIDAR up on top.

[1] [http://www.advancedscientificconcepts.com/](http://www.advancedscientificconcepts.com/) [2] [http://tesi.cab.unipd.it/47172/1/Tesi_1057035.pdf](http://tesi.cab.unipd.it/47172/1/Tesi_1057035.pdf)

<comment><USER19> I have a friend who worked at ASC and got to play with their "Portable 3D Flash LIDAR Camera Kit"[1] a few years after you saw the tech on an optical bench. Paired with a optical video camera, you get a full-color 3d scene in realtime 30fps. Pretty neat.

Their stuff is much smaller and more advanced now and they're pushing the OEM angle pretty hard[2].

[1] [http://www.advancedscientificconcepts.com/products/older- pro...](http://www.advancedscientificconcepts.com/products/older- products/portable.html)

[2] [http://www.advancedscientificconcepts.com/applications/autom...](http://www.advancedscientificconcepts.com/applications/automotive.htm)

<comment><USER18> They've made a lot of progress. But their site says "The ASCar website is not providing product or company details at this time. The company will begin promoting its products in 2015." Getting the price down by three orders of magnitude is tough for a small startup, especially since the technology pushes the limits of the technology at the high price point.

<comment><USER19> (They're still small, but have been around since 1987.)

My office is right next door to ASCar's. I won't say much because it's probably privileged information but let's just say things seem to be coming along quite nicely.

</comment></comment></comment></comment><comment><USER20> Not mentioned in article but bodes well for drones, aerial mapping, etc.

</comment><comment><USER21> What wavelengths are typically used for LIDAR?

<comment><USER22> Infrared.

<comment><USER23> Infrared is a wide band though, 0.7µm-1mm.

It looks like LIDAR products typically operate in the near-infrared, with two products I picked at random operating at 905nm[1] and 850nm[2]. They'd want to pick bands that are invisible to humans, ones where laser diodes exist that can be modulated, and ideally bands that suffer minimal attenuation from environmental factors like water. NIR meets those criteria pretty well.

1\. [http://velodynelidar.com/docs/datasheet/63-9229_VLP16_Datash...](http://velodynelidar.com/docs/datasheet/63-9229_VLP16_Datasheet_Rev- A_Web.pdf)

2\. [https://sick- virginia.data.continum.net/media/dox/6/16/516/P...](https://sick- virginia.data.continum.net/media/dox/6/16/516/Product_information_TIM_Series_Incrediby_good_at_detection_absolutely_accurate_at_measuring_en_IM0042516.PDF)</comment></comment></comment>


Ask HN: Hacker tips to maintain a good romantic relationship? - <AUTHOR> I believe folks here on HN are mostly problem solvers and are data-driven and fact-driven and of course have their own drawer of heuristics accumulated from problem solving. I wonder what tips the folks on here might give based on their experience on handling and maintaining their love life based on above mentioned qualities <comment><USER2> Always remember that while you and your partner tend to agree on many things, you will always discover things where you don't. It is neither's job to force change on the other's thoughts and beliefs, but instead to accept their ability to have them. You can always compromise, which means learning and change for both of you.

</comment><comment><USER3> A romantic interest isn't really compatible with deep focus work, IMHO, so I'd argue that you're better off not attempting to maintain one in the first place.

</comment><comment><USER4> Tinder, birth control, don't get married.</comment>


UptimeTrack – Free Website and Server Monitoring - <AUTHOR> http://www.uptimetrack.com <comment><USER2> I don't know anything about UptimeTrack. Can they be trusted with information about my servers? I know it is a small amount of information, but it is non- zero.</comment>


Facebook users sue over alleged racial discrimination in housing, job ads - <AUTHOR> http://arstechnica.com/tech-policy/2016/11/facebook-users-sue-over-alleged-racial-dhttp://arstechnica.com/tech-policy/2016/11/facebook-users-sue-over-alleged-racial-discrimination-in-housing-job-ads/iscrimination-in-housing-job-ads/ <comment><USER2> Outragists gonna outrage ...

It is not a private company duty to prevent third parties from discrimination. Chase the discriminators.</comment>