Generalized Algebraic Data Types: A Primer - <AUTHOR> https://sketch.sh/s/yH0MJiujNSiofDWOU85loX/ <comment><USER2> This is interesting, but several of the examples are useless (such as HList) or might not be a good idea in practice. Sometimes that's an easier way to explain a concept, but it would be helpful to see more examples that show you techniques that are actually recommended, rather than what not to do.

<comment><USER3> HLists actually aren't _useless_ in practice. I know I've used shapeless to do some datatype-generic programming with them (deriving CSV rows from a case class without reflection.)

Heterogenous unions are very similar and also extremely useful (multiple effects libraries build on top of them).

</comment></comment><comment><USER4> I find the GADT syntax used in the article hard to follow... Normally this is what I see, straight out of Jannis Limperg's insanely helpful compilation of language extension examples[0]:

        data RestrictedMaybe a where
          JustInt    :: Int    -> RestrictedMaybe Int
          JustString :: String -> RestrictedMaybe String
          Nothing    ::           RestrictedMaybe a

Maybe the intention was more of a "from scratch" implementation (without using extensions) but the above syntax is a bit easier to follow in my opinion IMO.

It might also be a good idea to make note of where the polymorphism is happening (the "a") and note how it's _ok_ that the a is "resolved" in some of these constructors but not in the others.

[0]: [https://limperg.de/ghc-extensions/#gadts](https://limperg.de/ghc- extensions/#gadts)

<comment><USER5> FWIW OCaml (the linked example is using reason, a different syntax for OCaml) doesn't need a syntax extension for GADTs.

On a similar note i find the OCaml syntax easier to read than Reason's. (There is an option to toggle between the two in the linked website)

The example from your post in OCaml:

      type 'a restricted_maybe =
        | JustInt : int -> int restricted_maybe
        | JustString : string -> string restricted_maybe
        | Nothing : 'a restricted_maybe

<comment><USER6> That's essentially the same but with the type parameter appearing before the type name.

</comment></comment></comment><comment><USER7> Link just renders an empty page? On firefox, at least.

<comment><USER8> Hello, I'm the main developer of Sketch.sh and there seems to be a problem with the authentication server right now. I'm working on resolving it.

<comment><USER8> Update: apparently I'm being rate limited. [https://auth.sketch.sh/api/auth/webhook](https://auth.sketch.sh/api/auth/webhook)

Another kind of HN hug of death

<comment><USER9> Hmm, is that a Zeit thing or a Sketch.sh thing? Seems pretty worrying if a service hosted on Zeit can't deal with HN frontpage-level load.

</comment></comment></comment></comment><comment><USER10> wtf is sketch.sh and why is it so awesome?

really though, this is a comfortable experience and the seamless live-coding environment feels natural. nice work!

</comment><comment><USER11> Is is the latest trend to render markdown verbatim? Another recent post on HN: [https://news.ycombinator.com/item?id=20211778](https://news.ycombinator.com/item?id=20211778)

<comment><USER12> Zeit.co does this too. I think it's weird

</comment></comment><comment><USER13> On my iphone, I can't jump to the links, and if I try to select a URL, it switches to edit mode and I can't even switch tabs because the keyboard is constantly taking over.

I was interested by the title but will skip the article because of poor UI

<comment><USER14> I get nothing useful onscreen at all

</comment></comment><comment><USER15> Can't wait for the DSL portion of the write up -- keep up the nice work!

</comment><comment><USER16> Since there is no explanatory text, this seems to be more of a testing environment than a primer.

<comment><USER17> Try looking again - maybe you caught a version that didn't render correctly. There is actually quite a bit of explanatory text, and it's quite good!

<comment><USER16> Thank you, you are correct.</comment></comment></comment>


Ask HN: Collaboration/mailing-list service recommendations please - <AUTHOR>

I'm looking to manage a support group for a small community of not very tech-savvy users discussing sensitive health topics. Best suggestion I got so far was Yahoo groups but I'm wondering if there are better alternatives. I can help set up people manually, so ease of configuration is not a priority, but ease of use would be. Open to hosting myself but ideally it'd be a service so I don't have to worry about managing a server. At a minimum it should support mailing lists, but having a calendar and document hosting would be nice. Thanks! <comment><USER2> Wordpress + bbPress + MailChimp plugins

<comment><AUTHOR> Thank you, I'll check these out.</comment></comment>


E-cigarette smoke damages DNA and reduces repair activity in mouse lung - <AUTHOR> http://www.pnas.org/content/early/2018/01/25/1718185115 <comment><AUTHOR> [http://www.pnas.org/content/early/2018/01/25/1718185115](http://www.pnas.org/content/early/2018/01/25/1718185115)

E-cig has been promoted as noncarcinogenic and a safer substitute for tobacco. In fact, recent studies show that E-cig smokers, similar to individuals on nicotine replacement therapy, have 97% less 4-(methylnitrosamino)-1-(3-pyridyl)-1-butanol (NNAL), an isoform form of NNK, a tobacco nitrosamine and lung carcinogen, in their body fluid than tobacco smokers.</comment>


Video: The Gradual Demise of Social Media Marketing... AWESOME. - <AUTHOR> http://blog.louisgray.com/2010/05/video-gradual-demise-of-social-media.html

<comment><USER2> protip: adding "awesome" in all caps will turn people away from your submission.

<comment><USER3> Too bad I didn't put AWESOME in the initial post. :)</comment></comment>


Consciousness May Be a Lot Like Making Coffee, Say Scientists - <AUTHOR> http://gizmodo.com/consciousness-may-be-a-lot-like-making-coffee-say-scie-1729038348 <comment><USER2> This is a much better article than the awful title would suggest.</comment>


Is some music better than it can be played, and does some music need help? - <AUTHOR> http://blogs.telegraph.co.uk/culture/stephenhough/100068542/is-some-music-better-than-it-can-be-played-and-does-some-music-need-help/ <comment><USER2> Some written music can be interpreted in extremely different ways, in performance, especially if the original composer and performers of the era are no longer living. Listen to Glenn Gould play Brahms B minor rhapsody and compare it to any other performance, then compare that to another random performance, say Arhtur Rubinstein.

As for the question, all music needs an audience for a really good performance. It makes a huge difference and helps in so many ways.</comment>


SARS-CoV-2 Sequencing Resources - <AUTHOR> https://github.com/CDCgov/SARS-CoV-2_Sequencing <comment><USER2> My employer has been putting a lot of time into COVID-19 research and tools. It's great to see that work recognized here! We've all been working very hard to make tools and data related to this pandemic available to the public and researchers alike.

</comment><comment><USER3> We have a task[1] to add more sequence file formats support in radare2. Any help is welcome. You can read more about bioinformatics with radare2 in our blog post [2].

[1] [https://github.com/radareorg/radare2-extras/issues/165](https://github.com/radareorg/radare2-extras/issues/165)

[2] [http://radare.today/posts/radare2-bioinformatics/](http://radare.today/posts/radare2-bioinformatics/)</comment>


Dell Offers Customized Chrome OS Build for Mini 10V Netbooks - <AUTHOR> http://lifehacker.com/5413902/dell-offers-customized-chrome-os-build-for-mini-10v-netbooks?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+lifehacker%2Ffull+%28Lifehacker%29&utm_content=Google+Reader <comment><USER2> Very misleading title. To clarify, this doesn't seem to be an official Dell thing, but a hack.</comment>


The Graying of Academia: Will It Reduce Scientific Productivity? (2010) [pdf] - <AUTHOR> http://www.crema-research.ch/papers/2014-06.pdf

<comment><USER2> The simple answer is no. The more complex answer is still no. The simple reason is the grayhairs are already deadwood. The more complex answer is the funding system has already destroyed science so it really doesn't matter how old the scientists are.</comment>


US and France Use the Most Nuclear Energy – Can This Be Changed? - <AUTHOR> https://companycompare.co.uk/nuclear-power-stations/ <comment><USER2> It could, given that it constitutes just under 20% of US power. What do you mean by changed? Do you mean have other countries utilize more nuclear energy or do you mean to have US and France reduce their use? Nuclear power has some nice advantages especially when we are talking about Gen IV reactors such as drastically reduced, and even re-using existing, nuclear waste as wall as a greenhouse gas emissions output that is about the same as wind energy. Renewable energy would be great but these forms of energy also have their own trade-offs.

</comment><comment><USER3> Reactors are fine, just fix some political nonsense and generally ignorance/misinformation.

There are much bigger issues like coal, and other carbon based fuels.</comment>


Glitch: The Big Unlaunching - <AUTHOR> http://www.glitch.com/blog/2011/11/30/the-big-unlaunching/

<comment><USER2> We've recently had to do something similar, and I appreciate the transparency around this. Thanks for sharing your experiences and intentions with your customers, it's a good template for how others can gracefully make decisions like this.</comment>


The Copernican Revolution from the Inside - <AUTHOR> https://www.lesserwrong.com/posts/JAAHjm4iZ2j5Exfo2/the-copernican-revolution-from-the-inside <comment><USER2> I stumbled across this saying, recently: The Cross is steady while the world is turning; Stat crux dum volvitur orbis. It's the motto of the Carthusians, a monastic order founded in 1084. But I can't figure out when they adopted that motto. And as I don't know Latin, I can't tell whether "volvitur orbis" refers to the Earth or the Heavens turning. Though the English translation sure seems to refer to the Earth, as does the naive translation of "dum volvitur orbis".

If the saying was from the 11th century (or even prior to the 15th century) and refers to the Earth, that would be interesting. I realize the heliocentric model existed long before Copernicus, but an early date to the motto would add more weight to arguments correcting misperceptions of the Copernican affair.

EDIT: Looks like it may have been adopted around 1600, when it first appeared on the Carthusian shield: [https://books.google.com/books?id=gZaeGVNjIfcC&lpg=PA471&dq=...](https://books.google.com/books?id=gZaeGVNjIfcC&lpg=PA471&dq=%22Stat%20crux%20dum%20volvitur%20orbis%22%20attributed&pg=PA471#v=onepage&q=%22Stat%20crux%20dum%20volvitur%20orbis%22%20attributed&f=false)</comment>


Apple Not Throttling iPhone or iPad Cellular Throughput via Carrier Bundles - <AUTHOR> http://www.anandtech.com/show/7037/apple-not-throttling-iphones-ipads-cellular-throughput-via-carrier-bundles-

<comment><USER3> The tone of this is all wrong, even if the facts might not. Apple has previously allowed carries to completely disable tethering, for no software or hardware reason at all. That is the ultimate sellout, and since they have done it before, the original story is very believable.

<comment><USER4> So the fact that the AT&T Nexus S was throttled makes Google at fault too? By your metric every single handset manufacturer has made the "ultimate sellout".

<comment><USER5> Yes, they have, and it's very sad. There should be a clear division between the pipe and the hardware that accesses it, but this is not at all the case right now.

<comment><USER4> I agree with it as an ideal, but I'd argue Apple (and to a lesser extent Google) have done a remarkable job in wresting control away from the carriers. Complaining that they didn't get the entire job done in one shot isn't useful and trivializes the dramatically different landscape we have now vs 2006.

That said, it'll be nice to see them finish the job.

<comment><USER6> > (and to a lesser extent Google) have done a remarkable job in wresting > control away from the carriers.

Seriously? In order to get Android out on the market, Google pretty much allowed the carriers to keep all the control they had back in the flip-phone era. Their attempts to counteract that with the Nexus line has been unsuccessful, if you look at the relative sales numbers.

My friend's HTC Evo 3D on Verizon was filled with uninstallable bloatware - <USER2> think my favorite was the Nascar Fantasy League app.

<comment><USER4> You actually caught me doing what I complain about the media doing: trying to provide a balanced viewpoint where the facts lean solidly to one side. You're absolutely right -- Google's actions in initially promoting Android were not against the carriers and the nature of the OS meant that unscrupulous handset manufacturers could be (can be) bad actors in the ecosystem as well.</comment></comment></comment></comment></comment></comment>


Show HN: Find people to play games with - <AUTHOR> https://gamematch.gg/ <comment><USER2> I love this idea! Hopefully more people sign up. I suggest allowing a user to add their steam profile and automatically pull the games they own off of it.</comment>


ChubaoFS: The Cloud Native Computing Foundation's New Distributed File System - <AUTHOR> https://thenewstack.io/chubaofs-the-cloud-native-computing-foundations-speedy-new-distributed-file-system/ <comment><AUTHOR> It's great to see new work on filesystem support for Kubernetes - it is badly needed. At first glance, ChubaoFS looks interesting - it has taken ideas from Haystack (facebook) and CephFS and put a POSIX API on effectively a S3 API.

Some questions I have relate to the POSIX semantics supported and what type of applications can work well on it. The authors say deletion is asynchronous - does this mean listing of dirs is eventually consistent? Also, how does utilization-based placement work with columnar file formats (parquet, tfrecords, petastorm)? Do blocks for the same partition get spread across different servers or not?

Also, I was a bit disappointed with the lack of a reference to our work on HopsFS (Usenix FAST, Middleware) where we also do distributed metadata and small files in metadata. But i guess Sigmod is more database folks.</comment>


Puzzle: Garbage Collection - <AUTHOR> http://thoughtworks.github.io/p2/issue09/puzzle/

<comment><USER2> The puzzle is very vague. What actions can the company take? Can I add accelerometers to the bins and GPS to the trucks?

</comment><comment><USER3> What are the inputs? the weight coming from the trucks, the number of bins they have emptied, distance traveled, what? It's hard to work with such an abstract definition of the problem without clear definitions of all parts of it (and especially the constraints).</comment>


Expect Google Caffeine index update after the holidays - <AUTHOR> http://www.mattcutts.com/blog/google-caffeine-update/

<comment><USER2> In case you aren't aware of what Caffeine is: <http://mashable.com/2009/08/10/google-caffeine/></comment>


Stealth Mode - Who's In, Who's Out - <AUTHOR> http://stealthmodewatch.com/Latest

<comment><USER2> I found this interesting:

[http://stealthmodewatch.com/DisplayFiling?id=1f42cd39-ae57-4...](http://stealthmodewatch.com/DisplayFiling?id=1f42cd39-ae57-46a3-9eef-32beaef04fd0)

Joyent sold in late July 2010 for $15,000,000?</comment>


Is LinkedIn Cheating Employers and Job Seekers Alike? - <AUTHOR> http://www.pbs.org/newshour/businessdesk/2013/08/ask-the-headhunter-is-linkedin.html <comment><USER2> Age and skills seem to be a factor. The people in the video are 40+, with many doing marketing/sales. The HN community, based off the _what is your age?_ poll [1], suggests the majority here are between 21-35, so we probably are not experiencing their problem. Second, networking is a major factor, if the software keyword system is really the issue, you need to find ways around the system, email your old co-workers, etc. This is why it is important to keep learning, as tech evolves, and to _put your self out there_ , through quality work.

One thing did bother me a little, is pride a factor here? There were lower level job, but many did not want to take them, because they felt it was below them, or they were over qualified. If you are in the red, with zero money coming in, isn't anything better than nothing, at least as a gap till you find something better?

      ▁▁▂▇█▅▂▁▁▁▁▁▁▁▁▁▁▁
         | |
        21 35

[1] [https://news.ycombinator.com/item?id=5536734](https://news.ycombinator.com/item?id=5536734)

ps. I created the bar graph via [https://github.com/holman/spark](https://github.com/holman/spark)

<comment><USER3> Taking a lower-paid job can reduce your salary once you get back to your primary field. Workers have legitimate reasons to treat wages as sticky.

<comment><USER4> How can that happen? It's not like your new employer will know what you were making at the last job, and even so why should that matter?

<comment><USER5> They ask. Are you just supposed to lie or refuse to answer?

<comment><USER6> Refuse to answer. It's none of their business, and nobody can compel you to answer a question.

<comment><USER7> "I don't have to answer that." They can't compel you to answer, but good luck landing _that_ job.

<comment><USER2> I have a hard time believing that if the employer is in desperate need, and a potential employee has the skills, they cannot come to an agreement, especially if you make it in for an interview. This does not make sense. Someone is not motivated enough.

<comment><USER7> Who specified that either one of those conditions was true? If it's an example, let's be honest: If the employer is not desperate they may not respond well to being told that their question didn't pass muster. Real people who are struggling to find work are asked these questions, and real people are being discriminated against by not answering.

<comment><USER8> You say, "I don't feel comfortable sharing that information" instead of the more hostile, "I don't have to answer that"

One needs to consider it as offensive as, "Are you planning to have a child soon" or "How old are you" or, "You look real purty"

Also if a company is going to invite you all the way to their office and use up their current employees' time, it would be a very stupid thing to not want an applicant just because they don't want to discuss their current salary.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I don't get why LinkedIn gets a free pass on a lot of the shady stuff it does. Case in point: if I have a free account, public details are hidden when browsing profiles and I'm told I need to "upgrade" my account to view them. Viewing the same profile in an incognito window reveals the "restricted" details. That seems like an ExpertsExchange level trick.

<comment><USER10> I'd assume that's for recruiters, and that what you see in the incognito window is to give them a taste (perhaps they have governors to limit how much can be found per unit of time).

Not being that sort of recruiter I've only ever wanted to see that kind of thing to confirm if a particular "John Doe" is the one I'm thinking of before asking to connect to him, and personalizing the note takes care of that well enough. Otherwise I can see the profiles of people in my network just fine.

<comment><USER9> I'm definitely not a recruiter and LinkedIn could easily extrapolate that from my resume. Say for example I just want to do some due diligence on a contractor (or business associate or company exec. or whatever). I don't want to connect, just see their qualifications, general background, etc.

Logged in: [http://media.tumblr.com/ba1105d066fd8c3acca2909898d5b603/tum...](http://media.tumblr.com/ba1105d066fd8c3acca2909898d5b603/tumblr_inline_mornk0uQvp1qz4rgp.png)

Logged out: [http://media.tumblr.com/17fe723913901fe9a1e0c0c53b6ba6e4/tum...](http://media.tumblr.com/17fe723913901fe9a1e0c0c53b6ba6e4/tumblr_inline_mornmejci71qz4rgp.png)

<comment><USER10> Ah, I didn't mean to suggest you were a "recruiter", although the examples you gave could be part of the recruiting function, and it wouldn't be unreasonable for LinkedIn to want some money from your to do perform such due diligence. It would be interesting to see if they've got an account level for that sort of small scale thing.

</comment></comment></comment></comment><comment><USER11> I think the broader principle of this post is solid. It's one that I've been thinking a lot as a friend asked me to advise his dating-site startup.

I don't like the space for one major reason (and job hunting is isomorphic with dating): to optimize making money you have to fail to deliver on the expectations of those for whom you're matchmaking.

With dating/jobhunting if you create a supremely efficient market place that finds the match almost immediately your customers go away. They don't need your service any more. It behooves you to increase the inefficiency of your marketplace to deliver almost-matches that keep people interested and paying, but not quite good enough to make them leave.

Perhaps you could argue that a job board is different because employers are repeat finders and will come back again and again - the adultfriendfinder approach, people who keep getting laid keep paying.

Either way they're tough businesses to make money on AND deliver a great service.

LinkedIn does a ton of other things of course, to monetize, and isn't just a job board. But that just raises questions about some of their other practises of holding your own data hostage - which seems to be a key business model for social network monetization at the moment, and that's a whole other question.

<comment><USER12> > I don't like the space for one major reason (and job hunting is isomorphic > with dating): to optimize making money you have to fail to deliver on the > expectations of those for whom you're matchmaking.

For job hunting (but probably not dating), its at least conceivable that you can structure the charge model to one where one or the other party (or both) is paying for success in making a match (basically, that's what lots of non- web-based employment "matchmaking" services of various kinds do), so that you can, in fact, align customer satisfaction with profit maximization.

<comment><USER6> Another approach is to do something like take a cut of the first year's salary or _difference_ between the first year's salary and what the jobhunter was previously getting. That conditions success not only on making a match but on making a _good_ match, as you get paid virtually nothing if an employee gets hired but then gets fired 2 weeks later. Many recruiting firms take this approach.

</comment></comment></comment><comment><USER13> I never understood the "Job Seeker Premium" badge. It just makes you look desperate in my mind.

<comment><USER11> right - like a candidate anti-pattern - this person so lacks confidence in their abilities that they're trying to game the system to get attention (unfair probably but I'd be shocked if that wasn't the perception of many employers)

</comment></comment><comment><USER14> No problems with the main thrust of the article, but the conclusion that "America's jobs crisis needs to be looked at as a failure of employers and job boards to ensure an accurate and fair employment process" is laughable. The problems with the re-employment engine are multifold, and not trivially reducible to a single sentence.

An interesting, and more nuanced take on the issue from a very different angle, which at least starts to grasp the enormity of the problem: [http://lesswrong.com/lw/hh4/the_robots_ai_and_unemployment_a...](http://lesswrong.com/lw/hh4/the_robots_ai_and_unemployment_antifaq/)

</comment><comment><USER15>
      > But the question for everyone else is, why are employers
      > (who pay to access the database) and job seekers (who
      > pay for database positioning) playing along while
      > LinkedIn sells everyone out with this game of payola?
      >
      > And where does it leave LinkedIn users who just want to
      > meet one another to do business? While some of us are
      > working to help job seekers form appropriate,
      > substantive relationships that they can cultivate --
      > and benefit from -- over time, LinkedIn keeps coming up
      > with silly products that cheapen the meaning of
      > networking and connecting with other people.

I'm curious about this myself... Both employers and potential employees seem extremely hesitant to change their behavior. I can't help but feel that each side doesn't really want to deal with the other, and everyone is hiding behind websites and resumes, and sites like LinkedIn reap the rewards.

There's probably some interesting social science here. If anyone can enlighten me, I'd love to hear about it.

(edit: by "change behavior" I mean relying on the old system of: "you send me your resume, I'll put it in the trash." Supposedly 80-90% of jobs go unadvertised, and yet the vast majority "job search" by hurling resumes at the remaining 10-20%.)

</comment><comment><USER16> Personally I don't pay for any premium services for LinkedIn but I can say that my LinkedIn profile consistently gets me quality calls from recruiters. In fact, it led me into a series of consistently better paying jobs quite quickly.

I devoted consistent effort to building my LinkedIn network over time so I have a very large number of connections now. I get the sense that the system is underprovisioned for me, because the site is slow as hell, often I can't see the messages and invitations I've been sent until I've done several reloads.

I actually would pay for a premium service that is overprovisioned for me and fast enough for me that I'd want to spend more time with it.

</comment><comment><USER17>
      > But the question for everyone else is, why are employers
      > (who pay to access the database) and job seekers (who
      > pay for database positioning) playing along while
      > LinkedIn sells everyone out with this game of payola?

There is no "payola" in searching the database. Job seekers aren't paying for database positioning, they are paying only to be at the top of the list of "here are people who applied for your job". This is mentioned by Corcodilos in his article then immediately handwaved away as if it doesn't matter, but this point completely changes the thrust of his argument.

You don't show up at the top of _search results_ no matter what kind of account you have; your payment or lack thereof does not manipulate organic search results. It only puts you at the top of a list of people who applied for jobs using the "Apply for jobs" function. The value for the free account- holder and for the recruiter is still intact.

<comment><USER18> But it's all about perception - LinkedIn has got perceptibly more slimy, less about connecting, and it has now started taking money for rankings. If the sign on the brothel door says our women will give head for cash but they have to love you to screw, do you think anyone will believe it?

Admittedly like all walled gardens, there is no business model - the value lies in the network and any and all attempts to monetize that are called taxation. We only accept that from one place

</comment></comment><comment><USER19> Disclaimer: I work on a competing job board site at Stack Overflow Careers 2.0

LinkedIn (as opposed to CareerBuilder apparently) isn't really cheating anyone. They're charging for a stupid feature to make a quick buck off of naive or desperate candidates. I can't figure out how a feature like putting a resume on the top of a pile solves any problem to do with matching candidates with employers. Much less why good employers would care about this arbitrary order. At least (apparently) they aren't biasing search results in their recruiter platform.

We've taken the route of only charging employers for access to advertise jobs and company pages on Stack Overflow, and search profiles of developers on Careers 2.0 (no crappy contingency recruiters allowed). Not only do we not want to charge candidates, I don't exactly know what we'd be charging them for that would help clear the market more efficiently.

<comment><USER20> > I can't figure out how a feature like putting a resume on the top of a pile > solves any problem to do with matching candidates with employers. Much less > why good employers would care about this arbitrary order.

It helps them get through the human keyword filter in HR faster, which (theoretically) makes them more likely to get an interview. Even many "good" companies have issues with poor HR filter functions, and on top of that a majority of the jobs seem to be with "bad" companies.

I agree, though, that its set up to prey on the naive and desperate. Those for whom any job is better than no job, or simply think this is how "the game" is supposed to be played.

</comment></comment><comment> w0rd-driven While the article focuses on LinkedIn, it could likely just be titled "Are Job Boards..." because the article mentions CareerBuilder and Monster. I know CB does it but wasn't paying attention to notice if Monster did.

Something definitely feels slimy about the practice from a job seeker standpoint. Simply because I can't afford it, or place a high value on the cost I'm now at a disadvantage to another applicant. To borrow from another HN comment, it's akin to entering a cheat code while I'm just here normally playing the game. While I don't mind cheating in single player games, this is akin to wallhacking in a FPS.

Having said that, I also don't mind it at all because if I get a job this way it proves I did so on my own merit and those that paid were complete suckers. There is definitely a sense of achievement that comes with that.

I will always wonder how this came about though. How this became acceptable. I understand it's a business but creating unfair advantages in what amounts to some people's livelihood (in their mind at least) seems like playing with fire. There's also the very real threat that this is snake oil. Can anyone prove paying actually improves your chances? These companies could easily be charging for a "service" that only exists in name and actually does absolutely nothing behind the scenes.

</comment><comment> no-opinion I'm a student at a bush league school that doesn't have many connections to my field. Would it be in my interests to make a LinkedIn account for internship purposes?

<comment><USER21> You should absolutely have a LinkedIn account and begin to build the network. Just don't PAY for your LinkedIn account.

<comment><USER22> I feel like the "network" benefit of LinkedIn is close to zero. That is, when was the last time anyone said "I would like to talk to person X at Company Y. Oh, one of my friends is connected to person X. I'll ask that person for a warm introduction" Is anyone seeing or doing that?

<comment><USER23> I've certainly done that. When job-hunting, if I find a job posting I'd like to apply for, I'll check to see if there's anyone in my 2nd or 3rd-level network who's worked for that company.

<comment><USER24> I do the same, but somewhat differently. The primary reason is that I only accept connections to people I have _personally_ met and interacted with. (The few exceptions to that rule are people whom I've had extensive online dealings with.) The network information tells me who is likely to know more, and more importantly, could probably help to skirt the "Great Wall of HR" by introducing me personally with the people doing the actual hiring. _Outside_ LinkedIn.

When someone in my personal network pings the hiring manager and asks if they can connect me with them, I'm already ahead of the rest. Even if the response is to send the application in through the regular channels, the hiring manager now knows to expect my application. And perhaps most importantly, they know that I have been already vetted for fit and sanity by a person in their personal network. I can refer to that link in the application cover, and help it stand out even further.

The in-system introductions at LinkedIn I consider worthless. Use those, and you get flagged as someone just clicking buttons.

Networking is crucial on any creative field. But if you're willing to artificially "enhance" your network, you're just devalueing that very network - and by extension, yourself. The only things that really matter are the personal connections. They are the ones that can help you - and the ones that you are willing to help yourself.

</comment></comment></comment></comment></comment><comment><USER25> The problem comes down to trust and incentives. The "promoted" job board model leads to a middle man agent ("agent" in the Economics sense) with asymmetric information who is incentivized to give poor advice. LinkedIn wants you to trust their matching algorithm, but then goes behind your back and supplants the best matches with whoever the highest bidder happens to be.

Instead of benefiting when their customers get value from their service (successful placements), LinkedIn is profiting from desperation and frustration (the more unsatisfied costs - "free" grade users, the more potential paying customers), and simultaneously making the search process more difficult for all parties involved.

LinkedIn's position in the job search marketplace is as a monopolist provider of up-to-date candidate information, a valuable side effect of their primary virtue: being the winner take all social network for the corporate world.

Rent-seeking behavior from monopoly providers with asymmetric information should surprise no one. Rent-seeking behavior leading to angry market participants should surprise no one.

<comment><USER26> Rent-seeking in silicon valley isn't spoken about enough. Rent seeking has and will always be around, but is it increasing?

When we are talking about rankings and matching algo's in the hands of monopolies be it Google, Facebook, YouTube et al its a great mystery to me why the advertising industry trusts them so much.

</comment></comment><comment><USER27> Worst case scenario seems to be that you're advertising to potential employers that you're having trouble finding a job... That doesn't seem like a good thing to point out...

</comment><comment><USER28> I run a user group and network a lot with other developers. I noticed that in the past two years all the elite developers that I knew, the top half of one percent, were pulling their profiles from LinkedIn.

Have to laugh because companies looking for the proverbial 'rockstar developer' are increasingly never going to find them on LinkedIn.

</comment><comment><USER29> Betteridge's law of headlines:

"Any headline which ends in a question mark can be answered by the word no."

[http://en.wikipedia.org/wiki/Betteridge's_law_of_headlines](http://en.wikipedia.org/wiki/Betteridge's_law_of_headlines)

</comment><comment><USER30> Charging the applicant for a monthly premium listing service does nothing to help companies find good employees, though I think a small change could make it beneficial to both parties.

Offer "premium" application placement on a per application basis instead of monthly. This would provide a signal to the employer that the applicant is particularly interested in _this_ listing and not just spamming resumes.

It would provide a similar signal to a customized cover letter, but the employer can see the signal without the necessary investment of time to read a cover letter.

</comment><comment><USER31> New headline game: if a headline suggests linkedin or facebook or google may be doing something a little bad, they're actually doing something five times worse.

</comment><comment><USER32> I hate LinkedIn. The pay walls and forced semi-hidden profiles are insanely annoying.

I wish I had the resources to build a competitor centered around openness and UX. It should monetize on really strong programmatic job matching, driven by the improved data from reducing all the UX friction. Somebody, please accept the challenge.

<comment><USER33> What resources would you need?

<comment><USER32> I suppose if I were to undertake it, all I would need is time (i.e., some savings) to produce a rough first version. To really build it, the help of other engineers on the back-end, especially to implement job matching algorithms. I'm mostly into UI.

Getting users would be a whole other challenge. I can see the web/tech crowd adopting something for its superior UX, but then you're up against Github, which provides far more utilitarian value and accomplishes a bit of the professional social networking in one fell swoop. When it comes to everybody else, I think that business partnerships, marketing, and sales are key. That's more help needed.

I think it's totally viable, I'm just not in the position to do it. I hope somebody is.

</comment></comment></comment><comment><USER34> And they keep extending their footprint ([http://www.mercurynews.com/ci_20568679/linkedin-expands- offi...](http://www.mercurynews.com/ci_20568679/linkedin-expands-offices-into- sunnyvale)). Sigh!

</comment><comment><USER35> I wish the internet could actually solve high unemployment.

</comment><comment><USER36> Dear PBS: I don't want to localize my PBS experience. I just want to read the article. :P</comment>


Edison's greatest invention was a way of thinking about technology - <AUTHOR> https://www.theatlantic.com/magazine/archive/2019/11/edmund-morris-edison/598357/ <comment><USER2> To claim Edison's best invention is a cross-disciplinary invention collaborative and that we need more of that today...what would the author think of maker spaces, of the numerous interdisciplinary departments and majors out there? Hackathons too? They're all the same spirit, though admittedly they look a lot more like a tech giant than Edison's quaint campus.

To my mind, Edison picked many low hanging, simple fruits, and the inventions that remain to us in the 21st century are simply far too complicated to churn out by the 1000 patents. Could anyone today have 1000 patents to their name, nevermind a dozen legitimately world changing ones?

<comment><USER3> Seems Edison's patent record was broken in 2008.

[https://en.wikipedia.org/wiki/List_of_prolific_inventors](https://en.wikipedia.org/wiki/List_of_prolific_inventors)

Alas no metric to measure the quality of these patents. Though I'd say that how much a patent made would be probably the best metric upon that. Though a list of patents and profitability of said patents by inventor is going to be much digging and research to collect all that data.

I would say though that some of the most profitable patents have been for drugs and would not be supprised that the top 5 drug patents would of made more money than all of Edison's patents, but that's just a gut feeling and may be wrong.

<comment><USER4> The fact that there's no _widely used_ metric to assess patent quality doesn't mean that no such metric is _possible_.

Covered devices, total licensing revenue, enabled market sector, energy throughput (after Leslie White's societal metric), would be possibilities. Assessing those could still pose challenges.

Though the attempt might reveal that patents aren't actually all that useful.

<comment><USER3> Eddison, in his lifetime made around $12m from his patents and he died around 1931. So scaling that amount (so would be around $1Bn), does appear to fall short upon many drug patents. For example - the drug Lipitor's patent made over $100Bn.

But things are never just about money as a comparison metric, just that when you can reduce things to that metric, hard not to compare.

<comment><USER4> It's not how much money the patent inventor makes, but how much is creditable, in total, to the invention.

Figuring out how to allocate that amongst contributing inventions is ... an "interesting" problem.

As examples, take what Vaclav Smil notes as the inventions powering the world: Otto cycle, Diesel, and Turbine engines. Of the three inventors, Diesel died a suicide and near if not bankrupt (or at least insolvent), Parsons (turbine) did well, Otto AFAIU made workman's or salaryman's wages, but nothing terribly impressive.

The typewriter (you're likely using something inspired at least in part by it), Turing machine, Unix, and synthetic insulin are all inventions which have returned vastly more in net social benefit than their inventors ever saw, for various reasons.

The elevator made possible an entire class of structures. Safety brakes on railroad carriages likewise, as did Bessemer and subsequent steel (wrought- iron rail was used previously, but would split easily).

The net _social_ return of modern medicine is, by many accounts, singularly _unimpressive_. Pharmceuticals in particular may return large revenues and profits, but deliver little by way of additional lifespan, reduced mortality, or more complex measures such as QALYs (quality-adjusted life-years). See Robert J. Gordon's _The Rise and Fall of American Growth_ , which discusses this at length, or the work of Victor Fuchs, health economist.

Some devices (or substances, availed via processes) are absolutely essential to various modern activities. Others could be fairly readily substituted at relatively low additional cost. The models for accounting for this appear ... poor at best.

<comment><USER3> Exactly - it is hard to quantify how beneficial to humanity that a patent/invention/discovery is. No clear metric beyond fiscal alas.

May well find that some of the best inventions are the ones we take for granted and in their time - made nothing. Tinned food, being one of the greatest ever as a way to preserve food (Nicolas Appert). Then their is the tin opener.

I suppose one way to quantify it would be sit down to work out what inventions you used in a week and with that, not all inventions are used by everybody, but some common ones we take for granted are, and in a way that we glibly just dismiss or overlook them.

<comment><USER4> I agree it's challenging, but I don't think it's _impossible_ , at least in aggregate and as a first-order estimate. Or that fiscal is all we're left with.

The case of inventions long going unsung is a whole 'nother aspect. Or of inventions that came around at one point in time but really didn't hit their prime until far later.

Example: The drilling rigs which were used during the early part of the petroleum era -- 1859 - 1900 or so, were based on a 1,300 year old Chinese method for salt brine drilling. The main change since has been the introduction of rotary cutter heads (in the early 20th century, possibly late 19th), rather than a fixed bit at the drillhead itself. And yes, there've been incidental improvements in metalurgy, diamond-coated cutters, carbide steel, drilling muds, and more recently, hydrofracking (itself dating to the 1950s).

For measures of impact, I'd look to the work, again, of Vaclav Smil, who's quantified a bunch of this stuff and has some good thoughts on how to go about that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> This article is quite fascinating. See some parallels to Elon Musk's story. Intense curiosity of youth, building a business early, any business, and using that money to finance future businesses. Also, I see evidence in Edison of first principle thinking.

Funny Edison's rivals last name was Tesla ;-)

Also amusing that he had a lab in Menlo Park, but the New Jersey one ;-) It became Bell Labs, which paved the way of research labs as an idea, leading to Xerox Parc, then the PC and Arpanet. Wow!

Thought experiment, what would a modern, open source "cross-disciplinary invention factory" look like? Is this what GitHub is perhaps?

I think so, after watching a recent GitHub Satellite talk that had some of the scientists who developed the first picture of a black hole present. They said their team was ~200 people, but the contributor count of all the open source project transitive dependencies they used was on the order of 20,000+ people[1].

How will that idea evolve and how can we all participate in that evolution?

1\. [https://youtu.be/E5GDI__r_Is](https://youtu.be/E5GDI__r_Is)

<comment><USER6> GitHub and open-source are Amazing, for sure.

But if you're looking at something close to inventions(and not "just" useful product features) from open source, I would look for open-source projects that are publically funded , maybe with some criteria to filter important projects from the noise.

<comment><USER5> Interesting point, thank you. This is why I shared the video last night of how we are starting to open source research created by our tax dollars, but _not_ the software [1].

Do you have any ideas on what a modern "cross-disciplinary invention factory" would look like?

1\. [https://news.ycombinator.com/item?id=21297448](https://news.ycombinator.com/item?id=21297448)

<comment><USER6> I agree, sharing code is better for the research community. But once you share everything, you sort-of lost your edge.

And since we live in a very competitive society, that's a big problem. Not just for academia, btw.

As for ideas: I think AI and code offer us new ways of capturing expertise(search engines already do so to some extent) - and that may mean everybody could build a cross-disciplinary team "on the cheap".

But even with that, inventing important things still feels like it would require a lot of work and experimentation and tools - so it would be an expensive business.

<comment><USER5> > I agree, sharing code is better for the research community. But once you > share everything, you sort-of lost your edge. And since we live in a very > competitive society, that's a big problem. Not just for academia, btw.

Interesting. As a taxpayer, I'd like to see legislation passed to mandate open sourcing code I've paid for. I have compassion for researchers careers though, but am not well versed anywhere near enough in the machinations of that to suggest a solution.

> But even with that, inventing important things still feels like it would > require a lot of work and experimentation and tools - so it would be an > expensive business.

This feels a bit like capitalism as practiced today. Not judging it. Just curious if there are new approaches to be discovered and applied here.

</comment></comment></comment></comment></comment><comment><USER7> Overhyped "all american" lawyer-backed patent hero who championed at claiming the credits for other peoples work and did not refrain from Goebels style marketing by means of electrocuting elephants in order to shed false light at the competition at the expense of society at large. People like Edison should be expurgated from platforms like HN.

</comment><comment><USER8> I thought his greatest invention was buying/shifting the market with money.

</comment><comment><USER9> This "innovation is a team sport" thing seems hugely important to a lot of people. Why is that?

Most of the innovation I find really inspiring and valuable is more of the "lone genius" kind. I also really like the "give credit where credit is due" creed of open source and scientific research, and to me that sort of requires that you can trace innovation back to individuals.

</comment><comment><USER10> Can anyone share the trick without making me read his life history?

<comment><USER11> Collaborate. Hire people to help you, don't try to be a lone genius.

<comment><USER12> Or even a lone patent acquirer in Edison's case.</comment></comment></comment>


FigurePool - online graphics editor now open for beta subscriptions - <AUTHOR> http://figurepool.com FigurePool - a new online graphics editor and sharing platform now open for beta subscriptions. Reserve your spot in the early release now! <comment><AUTHOR> Another batch of screenshots revealed. Look at how easy it is to search and embed images and WebPage screenshots into your graphics and diagrams.

</comment><comment><USER2> Looks promising! Just subscribed for the beta and can't wait for the release.</comment>


Samsung TVs start inserting ads into your movies - <AUTHOR> https://gigaom.com/2015/02/10/samsung-tvs-start-inserting-ads-into-your-movies/

<comment><USER2> Well, yes, this happens when one buys hardware that is locked in to specific vendor's software.</comment>


Quantum Computer Comes Closer to Cracking RSA Encryption - <AUTHOR> http://spectrum.ieee.org/tech-talk/computing/hardware/encryptionbusting-quantum-computer-practices-factoring-in-scalable-fiveatom-experiment <comment><AUTHOR> I'm looking for research on quantum encryption (which is only briefly mentioned at the end of the article). Is anyone aware of work being done for this, specifically how the quantum keys would be stored?</comment>


SSH with Facebook Auth - <AUTHOR> https://www.scaleft.com/blog/servers-with-friends/ <comment><USER2> Wouldn't this give Facebook indirect control over your server? If Facebook wanted to they could just ban your account. Or change your password. Also it is far more likely that a hacker is going to gain access to your Facebook account over well protected SSH.

<comment><USER3> I think the idea is that you would use their service to specify the authentication method, and they would provide the ability to log in via that specification. They aren't forcing you to use FB; it is merely a demo of one of many authentication methods they'd be able to let you choose from:

> an experiment where you can share your servers with your friends by using > Facebook as the authentication mechanism. It's a quick way to show how > versatile the ScaleFT authentication platform can be: Give us a reliable > authentication mechanism, and we can log you into a server with it.

<comment><USER2> Still. The idea that it is a service means that you are still handing over indirect control.

<comment><USER4> Hey, one of the founders of ScaleFT here.

You're absolutely right that when you're using ScaleFT you're trusting both us (as operators of the CA) and your identity provider (in this case Facebook, but we have a bunch of other options more suitable for most businesses).

Handing over control isn't necessarily a bad thing. For example, I trust Google to operate a secure and reliable email service much more than I trust myself, leaving me to focus on my area of expertise. But trust is a complex thing and there are certainly situations where handing control to any third party is unacceptable.

For organizations that require complete control we can integrate with any SAML or OpenID Connect identity system, and we offer an on-premise version of ScaleFT.

<comment><USER5> > I trust Google to operate a secure and reliable email service much more than > I trust myself

Hopefully, Google would soon integrate features that let it auto-reply to your incoming messages. It can be _trusted_ more, after all.

</comment></comment></comment></comment></comment><comment><USER6> Tell me when the opposite happens, when I can use a key pair to login to Facebook.

<comment><USER7> and still have them ask for your phone number! . I'd also love if you could log in to Messages with a key pair

</comment></comment><comment><USER8> This sounds like a horrible idea.

<comment><USER5> This is yet another _neat_ mechanism of giving up control. By using Google/Chrome, you _inform_ Google of pretty much what you're doing. Now the same thing is being extended to ssh.

</comment></comment><comment><USER9> I think [1] is a better link, which actually explains how it works.

[1] [https://coreos.com/blog/international-friendship- day.html](https://coreos.com/blog/international-friendship-day.html)

</comment><comment><USER10> I'd downvote this if I had the points. It's anti-security to trust your SSH login to anyone.

</comment><comment><USER11> You've got to be kidding me.

</comment><comment><USER5> Facebook: All your servers are belong to us.

</comment><comment><USER12> If this becomes popular, I will build a new internet.

<comment><USER12> Someone is even beating me to it. [1]

[1] [https://news.ycombinator.com/item?id=12256866](https://news.ycombinator.com/item?id=12256866)</comment></comment>


Ask HN: Liquid simulation resources - <AUTHOR>

I'm trying to find out information about simulating the motion of a blob of liquid moving on a hard surface.  I know nothing about this sort of thing; where should I start reading? <comment><USER2> EDIT: Coding from scratch will be hard. Go Blender!

I briefly looked at writing an iPhone app to simulate the Wave Machine. As far as I can gather, fluid simulation is quite a massive (graduate school level) topic.

<http://developer.nvidia.com/GPUGems/gpugems_ch01.html>

The references section (1.6) is a good starting point (including this one) <http://www.darwin3d.com/vsearch/FluidSim.txt>

<http://graphics.pixar.com/library/>

[http://www.google.com/search?hl=en&q=FEA+%2B+droplet+%2B...](http://www.google.com/search?hl=en&q=FEA+%2B+droplet+%2B+simulation)

</comment><comment><USER3> scientifically correct? If no, check with the blender foundation. Blender has had fluid sim for a while now. www.blender.org</comment>


Introducing Visual Studio for Mac - <AUTHOR> https://webcache.googleusercontent.com/search?q=cache:Vk2On-9psscJ:https://msdn.microsoft.com/en-us/magazine/mt790182.aspx+&cd=23&hl=en&ct=clnk&gl=us <comment><USER2> A lot of Microsofts recent work has been really interesting if not surprising. Linux support in Windows and Visual Studio (as a cross platform target _with_ debugging!), VS Code, bringing on Xamarin... Etc.

I'm Glad to see them pulling their head out of the sand. It wired to see them changing place with the post Jobs Apple. (In regards to head in sand :P)

</comment><comment><AUTHOR> Any idea why this was flagged as dupe? Can't see any other articles on if showing up...

<comment><USER3> [https://news.ycombinator.com/item?id=12948043](https://news.ycombinator.com/item?id=12948043), but no idea why this one is a dupe now (since the top comment explains it was buried to avoid flagging future posts as dupe).

</comment></comment><comment><USER4> looks basically like the Xamarin Studio editor, which is basically MonoDevelop.</comment>


Tesla's Betting You'll Pay $9,000 for a Software Upgrade - <AUTHOR> http://www.bloomberg.com/graphics/2016-tesla-model-s/ <comment><USER2> Maybe this is just pointless pedantry but...

This isn't a software upgrade. It's an on/off switch.

There's a difference. A software upgrade implies some new code which cost real money to develop is being made available. That's not the case here.

As others mentioned, manufacturers do this already for cost reasons (reducing variation) on other software, but in that case it's legitimately a software upgrade because the new software being turned on cost actual money to develop which they recoup by putting it behind a paywall.

In this case, it probably actually cost Tesla money to implement the software to cap the battery.

What we have here is software being used to implement a paywall on hardware to recoup hardware development costs (presumably developing the 75 battery cost more than developing a 60 would have). _It 's a software-controlled hardware upgrade_ which happens to not actually be implemented as an upgrade because of cost control reasons.

I don't know that there is precedent for this precise business model.

<comment><USER3> Sure there is, nVidia and ATI/AMD have done pretty much exactly this sort of segmentation of many consumer->pro video cards in drivers practically forever.

<comment><USER4> I think that with graphic cards it is a little different: the manufacturing process is simply not perfect, so attempt to produce card with 56 Streaming Processors (Pascal) can result in 40 SP units working fine and 16 being broken. So you disable broken units and sell the piece as lower end card instead.

<comment><USER3> They also do it on cards that pass the higher-end binning process fine and sell them downmarket anyway when there is more demand there.

</comment></comment></comment></comment><comment><USER5> So we're going to have jailbroken Teslas that have the full range but can't update their software OTA...

Current cost of Li-ion battery is $145/kWh. It surprises me that they'd chose to give away $2250 worth of battery simply because it costs more to develop a new one. I understand the batteries they use are pretty modular - the cost of adjusting down capacity should be minimal. I'm speculating that they expect a large portion of buyers of the 60 model to upgrade to the more expensive version to recoup the costs. They could make the price of the upgrade a decreasing function of the age of the vehicle because no one would want to update an old car.

<comment><USER6> If the cost is $2,250 and they charge $9,000 for the post-purchase upgrade, then they only need 25% of buyers to upgrade the battery later for it to break even, and that's ignoring any cost savings in the manufacturing process.

</comment></comment><comment><USER7> Soon Tesla will send you a text message as soon as your battery is low, trying to sell you a temporary boost so that you can get to the next charger safely. At least my mobile provider does that as soon as my data volume is almost used up.

<comment><USER8> I'm curious of the implications of intentionally crippling a critical product with software. For instance, if your life depended on your Tesla having enough battery to drive to the next charger, would Tesla be responsible for your death? After all, they could have saved you at virtually no cost; they intentionally forbade you to fully use a product you fully purchased, resulting in your death. Maybe someone else can articulate this in a better way or knows more about the ethics.

<comment><USER9> > fully purchased

Did you? The remaining battery is essentially lent to you.

</comment></comment></comment><comment><USER10> This is nothing new. Many car manufacturers have premium features already built in to the car but disabled in the software (because its cheaper to build fewer variants). Volkswagen charges a premium for remote window control despite all cars being manufactured to support the feature.

<comment><USER11> this is very different, the closes comparison i could think of is bmw selling a 320i and 328i which both have basically the same engine running different amounts of turbo pressure, but EVEN THERE the engine internals have the be quite a bit different.

<comment><USER12> It's exactly the the same engine but there is a tradeoff for the performance. The one with more horse power will generally either have less fuel efficiency or produce more emissions.

<comment><USER11> Eh, I'd assume different pistons and camshafts, but googling doesn't return any definitive answers. Could be wrong. Maybe I'm giving BMW too much credit.

</comment></comment></comment></comment><comment><USER13> Since MS can't even get me to use Windows 10 for free I doubt it.

 _reads article_

Oh. An anti-feature.

> The only difference is that the software on the lower-end version limits the > capacity of the S60's battery, crippling its range. In fact, owners can > instantly transform a lowly S60 into an S75 at any time for a fee of $9,000 > ($500 more than if they'd initially bought it that way). They don't even > have to bring the car to a service center. Tesla flips the software switch > remotely.

<comment><USER14> This is the reason for me that closed source software [that does dubious things] is doomed to fail.

As users find out about things like this, and as it starts effecting them more and more, there will be an aura of distrust.

Currently, I'd say programmers or IT-related people are the only ones that care about this. But as soon as the consumer sees they need to pay 9k for something they already have? Closed source software is done for.

<comment> rm_-rf_slash Echoes of the utopian infancy of the Internet. Only the tech community significantly cares about this stuff, most people couldn't be bothered with how the software is made as long as it works. Just like in previous generations of technology and capitalism, there will always be enough people who grumble and pull out their wallets to keep the profits flowing.

<comment><USER14> When people have to fork over 9k, I'd bet they will start caring.

</comment></comment></comment></comment><comment><USER15> Licensing vs ownership of things I buy is getting to be a real grey area. Businesses definitely want to license content to me rather than sell it, at least in a legal sense.

For example, when I buy a DVD, I don't really own it. I own a physical copy of the media with a license to only play it in an approved player.

This has spread a bit for example to gaming. Katamari Damacy for the 360 was actually shipped with DLC on the game disc that you had to pay additional money to unlock, and it wasn't the only one.

If I were rich enough to afford a Tesla, I guess it would probably be against the license to use the hardware I have to the fullest (if I didn't pay for it), because Tesla doesn't want that and I've only licensed their software.

<comment><USER16> I think there is a difference from the game. The disc for the game costs the same to produce regardless of whether you buy the DLC or not. The larger battery costs more to produce regardless of whether you pay for it or not and (slightly) hurts the performance of cars that don't have the upgrade (it's literal dead weight).

I guess I don't really care, especially if there is good disclosure for expensive physical devices (because I can then not buy them).

<comment><USER15> It is definitely different which is what makes it interesting. Since you're maybe getting something you didn't pay for. On one hand, it is dead weight if you can't use it, which is even worse (since it degrades performance) but if you can jailbreak it you get it for free. But either way, it definitely has a real physical cost, it's not just code.

</comment></comment></comment><comment><USER17> Does Tesla try to justify this practice anywhere? Buying a software for a superior navigation system I understand but hobbling the performance of a car seems pretty shady.

<comment><USER6> Would you prefer that they not sell the cheaper version at all, or would you prefer that they sell the cheaper version with a physically smaller battery that costs a lot more money to upgrade?

<comment><USER18> I'd prefer to not have to jailbreak a car.

If this is the future for electric car business models where we have software defined features, I'm going to disengage as an early adopter. I actually think they should not sell the cheaper version because it dilutes the brand and the software upgrade starts to make the brand give off an enterprise subscription stench.

Where does this business model end? Am I going to have to renew my battery algorithm subscription yearly or my car turns into a piece of locked out hardware? Maybe I have to pay regularly to download self-driving updates? Am I going to have to pay to support the infrastructure to receive updates long after my car ends its production run?

<comment><USER6> That's a slippery slope argument not supported by the facts.

You don't have to jailbreak. You can get the car fully unlocked from the factory. But it costs more.

So again, what would you prefer, not having the lower cost option, or having the lower cost option be hardware limited? Or is there some third option you want?

</comment></comment></comment></comment><comment><USER19> The ultimate DLC. What happens when Tesla's update server goes down, a car is factory reset, and that it's no longer possible apply that $9,000 IAP? (ICP?)

</comment><comment><USER20> Hm, do the batteries used by Tesla have the same kind of "extended lifespan if rarely fully charged" issues that apply to the kind of cells used in most laptops? If so, then I'd be curious about whether this is implemented as a cap on the battery charge - I might actually prefer the lower capacity if it means my batteries last years longer.

<comment><USER6> Yes to all. However, unlike most consumer electronics, Teslas allow you to manually set the maximum charge it will take at any given time. I usually keep mine at 90%, for example, and only charge to 100% for long trips.

If you take the 75 option, you could keep the charge limiter set to 80% for normal use and achieve the same effect as keeping a software-limited 60 at 100%, but with the option to bump it up when you need more.

</comment></comment><comment><USER21> I wonder if they might considering letting you pay for the use of the bigger battery for a short period of time. For example, if you want to take a road trip you could pay $10/day to make use of the full capacity.

I expect that could be very popular.

<comment><USER22> Even better would be per charge probably. Pay $5 to charge once to 120% (or however much it is).

</comment></comment><comment><USER23> I don't think this is a software upgrade or newer version of the software. They are simply saying for additional money they can enable additional features that are already part of the cars code base. Like buying an in-app purchase in an iPhone app. Or like on BMW enabling all the connected features.

While I imagine the author hoped to try to put this in a negative light to stir up controversy, this of course is actually a great thing. As with any other car, if you have a car and want much better mileage or a big new feature like self driving, you won't be paying 9K for the feature you will be spending 50-100K+ since your only option is to buy an entirely new car every few years to get the latest features.

Any to get the new features I don't need to pay all the thousands associated with getting a new car, as well as negotiating on a new car, and everything else associated with it. Of course Tesla could just offer all features and build in the 9K in the car, and thus not allowing anyone who can't afford all the features to ever have a tesla. Instead they price it so people who want a tesla but dont necessary need some of those features a chance to buy the car, and then later get those features if they save up. Win win for everyone.

But most likely people complaining will be the same people who complain about the entry level storage on an iPhone. They would rather apple not sell it at all, than let people who can't afford the higher amount be able to buy an iPhone at all.

</comment><comment><USER24> This actually seems like a really nice option. It allows you to get a loan for a cheaper car, and once that is paid off, you can upgrade it.

<comment><USER25> That's a very interesting way to look at it.

</comment></comment><comment><USER26> I don't get the controversy.

You may have a 75 kWh in your car, but you didn't pay for it. You paid for a 60 kWh so that is what you get to use.

Tesla has merely optimized the logistics a the battery upgrade, pre-delivering it and pre-installing it, doing 99% of the work at no charge. When you pay for it, they can make the upgrade as easy as an in-app purchase.

<comment><USER11> Is there supposed to be a /s at the end?

Isn't the price kind of arbitrary? Would you accept this with any other product? Like buying a cheaper house because some of the rooms are walled off, or a hard drive that has a few GB of unremovable data, until you pay more.

<comment><USER26> Well, let's say I don't have any children, but I think I might have 2-3 in the next 5-10 years. I would definitely buy a small house with a nice master at a lower price that I can instantly upgrade later, especially if I don't actually see the walled off rooms and the footprint of my house just somehow magically changes in software. It sounds awesome and I would definitely sign up for that.

</comment></comment></comment><comment><USER27> 9k for forty miles range? Really? They are betting wrong.

Plus I wonder how long before someone hacks these cars for personal use only?

</comment><comment><USER28> Just like every other car manufacturer?

My understanding is that you choose which car to buy, and then you pay them thousands to flip a bit to enable extra horse power, on the same hardware.

Or you get some shady garage to chip it for you.

<comment><USER11> this isn't true. you can barely get any additional power out of naturally aspirated engine with software tuning, and sure you can do this for a short while on turbo engines but good luck running it reliably without spending money on various other modifications like cooling, engine internals, etc. manufacturers tune for a combination of gas milage, longevity, and to meet emissions regulations.

</comment></comment><comment><USER29> this is just market segmentation, which is almost always sensible from the company's standpoint, and shady from an intuitive pov because our intuition works in terms of repaying the company's cost to provide us with value, whereas segmentation works by extracting the maximum amount of money from the overall market.

</comment><comment><USER30> Wasn't this done with Windows NT and Windows NT Server decades ago? It was just a configuration setting to upgrade.

</comment><comment><USER31> Isn't this indirect evidence of too little competition? It has happened in the past with Intel for example...

</comment><comment><USER32> And this is different from the "GPS Navigation" .."upgrade" most other manufactures make you pay $2,000 - $3,000 for...when the GPS is built in by default to almost every new car now.

This is actually a really smart move by Tesla. They are able to offer a lower cost version of the car, without changing anything on the manufacturing side. Thus increase sales through a lower price entry point.

</comment><comment><USER33> Funny. This company likes to get brownie points for being environmental. We all know that those batteries are not guilt-free when it comes to the environment. They're wasting our earth's precious resources by putting extra capacity which may never be used ;-)

<comment><USER24> This is kind of an absurd point because it's not obvious that manufacturing different types of batteries would actually be more environmentally friendly.

More complicated logistics could also be detrimental to the environment.

</comment></comment><comment><USER34> Well... it's not unusual for companies to ship the same product with different pricing and crippled performance. It's being done all the time. This is just "the next level".

I wonder if you can "hack" it yourself :)

<comment><USER35> Definitely not worth bricking your entire battery over $9,000.</comment></comment>


Trust, Slavery and the African School of Economics - <AUTHOR> https://www.economist.com/middle-east-and-africa/2020/05/21/trust-slavery-and-the-african-school-of-economics <comment><USER2> > A trip to Albania ended his blind affection for socialism.

Traveling the world is probably the best way of educating people about human issues. I wonder if we replaced the first two years of college in America (general education stuff) with a trip around the world, what would happen?

I was talking to a friend from a third world country about this and I mentioned that VR has the potential to open people's eyes about human conditions around the world. And he said, "Nope. That's a terrible idea." I asked why and he said, "VR can't convey suffering."

Let's say, for sake of argument, that it costs $50,000 to send one student around the world. That's within an order of magnitude for most colleges for the first two years. Plus, it would drop due to economies of scale (also since we're talking about huge numbers of students, we could use boats instead).

<comment><USER3> Yup, this is a very sensible guy. Another important point from the OP:

> His school is not part of efforts to "decolonise" the African academy. Any > student of politics must read Rousseau and Madison, he argues. The aim is to > add to the sum of human knowledge, not subtract from it.

Efforts to "decolonise" academia, particularly in the humanities and social sciences where the "decolonisation" meme is most relevant, have backfired horribly. And here we have a sensible scholar from Africa telling it like it is and not mincing his words.

<comment><USER4> Decolonization seems to be a Trojan horse for a different type of Western colonization. It's one thing to take western ideas and make them your own (Botswana). It's another thing entirely when western influences try to attach themselves to peoples history and culture in order to change them into faithful subjects without a voice of their own.

<comment><USER3> Well, historically this whole "decolonisation" meme was pushed by non-Western influences from the socialist and "non-aligned" bloc. But you're right that nowadays it mostly survives in some parts of the West, such as elite academia. A zombie revenant of dead influencers' propaganda from decades past.

</comment></comment></comment></comment><comment><USER5> _" The words struck a chord with Mr Wantchekon. Now a professor at Princeton University, he was born in Zagnanado in central Benin. Some of the music he listened to in his youth—such as that of Orchestre Poly-Rythmo de Cotonou—had songs that warned against trusting those close to you."_

I checked; The music is ... astoundingly beautiful. Orchestre Poly-Rythmo de Cotonou: [https://open.spotify.com/artist/2hzzC6W1jnkn6x6RyutlB3?si=Zd...](https://open.spotify.com/artist/2hzzC6W1jnkn6x6RyutlB3?si=ZduTuQsXTZuhrROsELqBNQ)

<comment><USER6> Thank you for this - my first music recommendation from HN!

Particularly of interest to me is the 'slightly slippery' beat it appears to have. It seems slightly off in places, but pleasingly so.

<comment><USER5> Yes! I know next to nothing about African music - just starting to learn about it - but I'm certain that these incredibly subtle wrinkles in time are on purpose. Willful. Being celebrated. In some songs there are beautiful little rhythmic foreshadowing events - the last note of a bassline let slip almost imperceptibly two, three times, in preparation for hitting the listener with a twist or impact. All on a barely noticeable level, interwoven.

I also feel an incredibly strong sense of collaboration in African music. Which is - I guess ironic?, in the context of the article. Painfully and poignantly. It's interesting.

I'm going to mention Pamelo Mounk'a, M'Pongo Love, Franco, Coupé Cloué, Docteur Nico, Tabu Ley Rochereau, and Simba Wanyika/Les Wanyika, in case their music brings as rich a reward to others as it has to me. From there it goes all over the place – and Africa is big! And old! And beautiful and full of joy and subtlety and craft.

<comment><USER7> Thank you for sharing. I'd love to find more of this sort of thing through HN.

</comment></comment></comment></comment><comment><USER8> Articles like this break my heart. The thing that stops ideas like the ones in this article taking root are, ultimately, the beliefs of ordinary people.

The real secret of education is it is the only method humanity has discovered to stop people making the same stupid mistakes every single generation like all the other animals.

There is a remarkable strategy for being very successful: identify and stop doing things that cause failure. It isn't the silver bullet but as strategies go more people should try it. Instead, everyone goes along with joining personality cults.

<comment><USER9> > _The real secret of education is it is the only method humanity has > discovered to stop people making the same stupid mistakes every single > generation like all the other animals._

Strongly disagree. There are plenty of educated people doing stupid, evil, destructive things. What would have saved them is a proper upbringing in a healthy community. Some colleges are now toxic institutions that achieve the opposite.

</comment></comment><comment><USER10> [https://archive.vn/LefC3](https://archive.vn/LefC3)

</comment><comment><USER11> > Another result of Mr Wantchekon's political past is a preference for > empiricism over ideology. A trip to Albania ended his blind affection for > socialism. His school is not part of efforts to "decolonise" the African > academy. Any student of politics must read Rousseau and Madison, he argues. > The aim is to add to the sum of human knowledge, not subtract from it. "Be > angry but also be thoughtful," he says.

This is something that should be impressed upon all the Americans who throw around the term "decolonization." What would "decolonizing" say Bangladesh (where I am from) mean? Should we abandon the use of English? Dismantle our Supreme Court, an institution we inherited from the British? Dismantle our legal system built on British common law, or our constitution built on the American constitution and the Magna Carta? Abandon capitalism and free markets (which 80%+ of the population support because it has revolutionized the country)? Abandon western ideas like religious freedom, secularism, feminism, individualism, etc? What would we replace those things with?

<comment><USER12> Have you had conversations with academics who are interested in decolonizing their fields? People are interested in decolonizing history aren't saying that we should throw away all study of european history. They are saying that we should add more voices. This has been a project for decades, with more voices of women and poc being represented in historical analysis.

Necessarily, this means reducing the amount of time spent on "traditional western civilization" in the classroom, since there is only so much time. But go check out a renaissance history course taught by a young faculty member. White men continue to dominate the discourse. We've just added some more voices alongside them.

<comment><USER13> Brazilian here. Around here, it usually means adding low quality voices to the discussion.

Although there are a few pushing for recognition of good local work, those few tends to be attacked from both sides of the discussion.

<comment><USER12> If your opinion is that female and poc voices are "low quality" then I don't know what to say...

This isn't adding voices for the sake of it. This is adding voices because those voices are an essential part of historical understanding and history suffers if you exclude them.

<comment><USER13> Bad authors are bad, and good authors are good whatever sex and skin color they have. Individual author qualities are much more relevant than the social context they are immersed; if somebody doesn't understand they society they are talking about, reading them is worthless, it doesn't matter if it has an incredibly different and interesting culture.

Around here there is plenty (but trending down) of pushing for authors on the basis that they are local, or non-white, or not male, or poor. There is also a lot (and trending up) of pushing for authors on the basis that they are from some "world-class" place/culture. Both approaches are classist/racist/sexist and plain stupid. Labels like "decolonizing" usually come from the first group, and anybody trying to judge local authors based on their own merits is quickly outed from that group with the argument that judging works done by such class/race/sex is classist/racist/sexist, so people using that label are almost never on the actually unprejudiced group.

Besides, forcefully changing authors based on prejudice has the double effect of teaching locals that they aren't expected to create high quality work and delegating competent locals to a life of obscurity, because if you can't judge their work, you can't discover that it's any good either.

But anyway, that says nothing about the subjects of study. It is always worthy to study the cultures that helped forming one's own.

<comment><USER12> > Bad authors are bad, and good authors are good whatever sex and skin color > they have.

Again, "voices" not "authors".

And this is the whole point! People aren't elevating worthless voices for diversity sake. People are resolving a problem where valuable voices were excluded because of their identity. We are getting closer to a fair analysis, not further from it.

<comment><USER13> By "voices" you mean diversity on the subject being studied? If so, I completely agree.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Slavery and branding are two things which predate recorded history.

We pretend like anything has changed but in actual fact the same rules apply as always.

Money alone is enough to set the world in motion. If you value peace prepare for war. The only way to make any money is to sell the fruits of someone else's labour. You can't buy loyalty.

</comment><comment><USER15> This is very prescient as right now the radical leftists are busy destroying the icons of anti-slavery and black success. Marxist's always destroy the good history when they take control. If you don't know where you are from you can be led anywhere. We'll see slavery again in this country if we forget our past.

</comment><comment><USER16> "data-mining skills" \-- I cringed at this phrase used by the journalist. Data mining is not a worthwhile skill, in fact its more of an insult. It's a curse any scientist worth his salt tries to avoid.</comment>


Intel Security True Key - <AUTHOR> http://www.intel.com/content/www/us/en/architecture-and-technology/true-key/intel-true-key-technology.html <comment><USER2> This is an adorably bad idea:

\+ As fdik said above, you can't change your fingerprint or face easily, and it's always public

\+ Face recognition and fingerprint scanning are not robust against spoofing — there are known ways to circumvent both

\+ You can be compelled to authenticate a biometric without a warrant

Don't use biometrics as a password; use them as a username.

<comment><USER3> > Don't use biometrics as a password; use them as a username

Even then people's faces change and through accidents fingerprints can also be changed / removed and then you're shit out of luck. I'm terrified I would store my important shit in something like that then get into a car accident or something and be no longer able to open it.

<comment><USER4> Implement it like the Xbox Kinect auto-signin where you still have a username but the camera lets the device figure it out on its own. That way people can still manually enter their username in the event of any disfiguring injury or technical glitches but don't have to normally.

<comment><USER3> Right but the post I was responding to said to use biometrics as the _username_ hence my comment. You're suggesting using it as a type of password :)

<comment><USER4> No I'm not, I'm suggesting it be used to identify the user, then they can enter their password the same as always.

</comment></comment></comment></comment></comment><comment><USER5> True Key makes use of the Intel Management Engine (IME). It gives a hint at what Intel is up to with the IME. One of the intended uses is "identity protection", storing secrets like e.g. biometric data in the realm of the IME, and to ultimately get rid of passwords.

Considering the security concerns regarding the IME, I doubt that it is a good idea to hand your passwords over to Intel (ME). At least I don't want to support this technology by using apps that utilize the IME.

To read up on the IME there is a free book by one of the developers on it...

[http://link.springer.com/book/10.1007%2F978-1-4302-6572-6](http://link.springer.com/book/10.1007%2F978-1-4302-6572-6)

Inside is an entire chapter on Intel's identity protection.

<comment><USER6> Interesting that Apple is doing similar things with the embedded ARM stuff in the new touchbar MBPs.

<comment><USER7> The thing is that Apple actually has a pretty good track record for security and not violating the privacy or integrity of customers' products. I have a lot more trust in Apple doing this correctly. I'd be fine with Intel taking on secure computing, but there's been some pretty bad stuff with the IME (like sending data to the internet outside of user control when using intel NICs), so I'm skeptical of this approach (especially when they're talking about facial recognition as a security measure).

<comment><USER5> Just to give an idea of how bad the stuff is with the IME, I recommend reading up Chapter 4 here:

Intel x86 considered harmful by Joanna Rutkowska

[https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf](https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf)

The IME is basically a second computer inside your computer, running as the most privileged component on the platform. It has privileged access to all components of the system, and runs as long as the computer is plugged in or has battery (even if it the computer is switched off). It is under the control of Intel, they decide what the IME does, and it can use the NIC as it pleases, unnoticeable for the host system. It can not be disabled, switched off or removed. The rootkit researcher Rutkowska described it as "an ideal rootkiting infrastructure".

<comment><USER8> Even if I would not consider "... considered harmful" essays as screamers for attention, I would still take detraction about ME with a grain of salt, because:

* it's easy to counteract, just not use an Intel NIC * it gets a lot of scrutinity * Intel is quite open about what it does, short of releasing signing keys for the firmware * the mobile platforms have similar secure enclaves (think baseband processors on phones), which nobody actually audits

All of these make me think Rutkowska found out that bashing x86 gets her attention, and now she uses it as a beating horse.

</comment></comment></comment></comment></comment><comment><USER9> They never seem to understand:

Your fingerprint like your face can be the username, but never the password.

Your fingerprint is exactly like your username: you cannot change it and you always leave it in public.

<comment><USER10> You can use fingerprints as a password. They aren't perfect but in many situations they are fine.

Security isn't black and white.

<comment><USER11> Dear IshKebab,

We at startup xyz take security seriously. We regret to inform you that on the night of 1st December 2016 our database was compromised. The database contained your name, address and fingerprint data.

Please see a plastic surgeon about resetting your fingerprints at as soon as possible.

Thank you, Startup Xyz

<comment><USER10> Obviously fingerprints can't be used in that situation, buy think about something like your front door lock. You don't need paranoia-level security (you probably have breakable windows anyway) but you want to stop random people who aren't motivated enough to steal your fingerprint from walking in.

Or think about locking your phone. Most people only want to stop their friends and family - they're not going to copy you fingerprint. Even FBI nearly defeated by TouchID. (You're probably thinking that they could have easily bypassed it, but they only had 48 hours to do so.)

<comment><USER12> I don't understand the qualifier "in that situation": the user cannot determine what the "situation" may be at some point in the future.

I _do_ use the fingerprint reader on my iPhone, and I believe that the fingerprint data is never sent to another device. Ever.

There are real problems to using the iPhone fingerprint with apps, in that the apps tells me it needs to store an encrypted version of my password on iCloud in order to enable fingerprint unlock. The Bad Guys could get my encrypted password and I might never know.

But I wouldn't have to change my fingerprint in that case.

<comment><USER10> In the situation where a website stores your fingerprint.

</comment></comment></comment></comment></comment></comment><comment><USER13> The truth is that we can't trust INTEL. Their CPU micro-code or ME (Management engine) can and does "phone home" to the internet, grab updates and update the CPU. They don't allow the customer to turn this OFF, which betray's the customer who purchased the CPU. Anyone who can sign the update and intercept the download channel can update your CPU with you having no ability to protect yourself. We can't trust intel.

Intel needs to allow 3rd parties to build a small piece of hardware for private key storage, generation, signing and encryption, with self-distruction upon tampering. Then customers need to be able to go to the store, pick which vendor they want, and they plug it into their motherboard. By selling them in the store when the customer can make a surprise purchase, then that prevents tampering upon shipping withe ecommerce deliverables.

<comment><USER14> What are some good resources to learn more about the phone-home functionality in their microcode? I've been trying to find more details and have been unable to do so.

<comment><USER15> You've been unable to find that information because no such "functionality" exists. Microcode just patches bugs or configuration details of the CPU; it doesn't "phone home".

<comment><USER16> How could it possibly patch bugs without phoning home? Are you claiming that it is self modifying code?

<comment><USER14> I wouldn't consider "running an update where it pulls new code" to be "phoning home", any more than my car is "phoning home" when I drive it to the dealership for repairs.

The implication the comment I was replying to gave was that the device sent unexpected network traffic back to Intel HQ, with the connotation that it was doing so to leak information about my system.

<comment><USER16> "Running an update where it pulls new code" is definitely an example of phoning home, and it opens the door to all sorts of vulnerabilities, such as the one featured in the Apple vs the FBI case.

<comment><USER17> Intel microcode updates on Linux are provided through regular distribution repositories. There is no phoning home feature.

<comment><USER16> Do they get updated when you run the package manager, or do they update automatically?

<comment><USER17> Binary packaging systems download microcode.dat (a text blob containing microcode) from Intel during the build process. Microcode.dat gets converted into an initramfs image that supplies the new microcode early in the system boot. Users download the built binary package, which then modifies the boot parameters of their system.

So normally only the build servers contact Intel. Source-based distributions may. But even then the source files are verified with cryptographic hashes (which are in turn signed by the maintainers' private keys).

Edit: I may have misread your question. I thought you were asking by implication if the microcode blob is pulled after the install. If not, then: No. Updates happen when the package manager decides.

[https://www.kernel.org/doc/Documentation/x86/early- microcode...](https://www.kernel.org/doc/Documentation/x86/early- microcode.txt)

[https://gitlab.com/iucode-tool/iucode-tool](https://gitlab.com/iucode- tool/iucode-tool)

[https://downloadcenter.intel.com/download/26400/Linux- Proces...](https://downloadcenter.intel.com/download/26400/Linux-Processor- Microcode-Data-File)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I'm rather concerned about the face recognition part and how easily that might be fooled. Has anyone tried that?

It's an interesting take on a password manager though, I do like the second factor through an additional device before it grants access.

<comment><USER19> Although not this particular face recognition. I managed to fool face recognition passwords in the past with a simple photograph of the person. As you would expect it works perfectly fine.

<comment><USER20> This is part of the reason Windows Hello won't use standard webcams for facial recognition. They require a depth camera (very unusual feature on laptops, usually marketed as Intel Real Sense) so that a simple photograph isn't enough to fool the camera.

This is still far from perfect though; a truly determined bad actor could create a passable 3D model, or even a face mask, and probably still fool the sensor. It just takes more work. The whole point of passwords is that no one can know them but the person intending to use them. Using a publicly visible part of my body is just asking for trouble.

</comment></comment></comment><comment><USER21> First, it's important to realize that biometric identifiers are not constitutionally protected in the United States under the fifth amendment given current legal precedents:

"A Virginia Circuit Court judge ruled Tuesday that police officers cannot force criminal suspects to divulge cellphone passwords, but they can force them to unlock the phone with a fingerprint scanner."

Source: [http://blogs.wsj.com/digits/2014/10/31/judge-rules- suspect-c...](http://blogs.wsj.com/digits/2014/10/31/judge-rules-suspect-can- be-required-to-unlock-phone-with-fingerprint/)

Second, as others have already noted, you cannot hide or change most biometric identifiers and some people may not even have them at all. Therefore, passwords will always be the safest, most accessible option. However, more education regarding their creation, use, and support needs to occur:

Password Strength: [https://xkcd.com/936/](https://xkcd.com/936/)

Password Reuse: [https://xkcd.com/792/](https://xkcd.com/792/)

NIST's new password rules – what you need to know: [https://nakedsecurity.sophos.com/2016/08/18/nists-new- passwo...](https://nakedsecurity.sophos.com/2016/08/18/nists-new-password- rules-what-you-need-to-know/)

Personally, I like to choose a small token representing the site or service at hand, then surround it with multiple pass phrases I've memorized over the years. This creates a strong password which is both unique and easy to remember. Not to mention when a site I use is inevitably hacked and my hash is stolen, I only need to update a single instance of this pattern--not reevaluate my entire system.

</comment><comment><USER22> Nice try, NSA.

</comment><comment><USER23> > Intel Security

Hmmm... Let's Google that.

> Intel Security Group (previously McAfee, Inc. /ˈmækəfiː/[3])

And I'm out of here.

<comment><USER24> And in honor of the sacred McAfee traditions, Intel Security True Key is bundled by default within the Flash installer; once you've downladed the default installer, you can't even opt out of it. You need to pay attention and unchecked the bundleware _before_ downloading it. Sneaky!

<comment><USER25> Also worth saying is that if True Key is installed via Flash Mcafee bundle you can't actually uninstall it, you have to manually remove the service and delete the files/reg keys.

</comment></comment></comment><comment><USER26> Fingerprints can be faked in very ingenious ways. For example, [1] gives "Hacker fakes German minister's fingerprints using photos of her hands".

Photos. Not even required to recover the fingerprint from the surface of something. Tell me how secure is that.

[1] [https://www.theguardian.com/technology/2014/dec/30/hacker- fa...](https://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german- ministers-fingerprints-using-photos-of-her-hands)

</comment><comment><USER27> After reading all the comments there is not one person who is in support for the biometrics as a secure method but I see people being okay with biometric on iPhones by saying apples security better.

</comment><comment><USER28> Fingerprint technology is hackable, easily so.

Edit: Face recognition is even easier. Iris scanners are the only sure way to recognize someone.

<comment><USER29> > Iris scanners are the only sure way to recognize someone

For now.

</comment></comment><comment><USER30> My skeptic-sense is tingling!

</comment><comment><USER31> Here is the English landing page on Intel's direct site: [http://www.intel.com/content/www/us/en/architecture-and- tech...](http://www.intel.com/content/www/us/en/architecture-and- technology/true-key/intel-true-key-technology.html)

<comment><USER32> Thanks, we've updated the link from [https://www.truekey.com/de](https://www.truekey.com/de).

</comment></comment><comment><USER33> Can the mods or OP change the url to the english version? [https://www.truekey.com/](https://www.truekey.com/)

<comment><USER34> The owner of this website (www.truekey.com) has banned the country or region your IP address is in (BY) from accessing this website.

Awesome.

<comment><USER35> Strangely - Tor may work. I connected via a Brazillian VPN (from Australia) and got a Cloudflare challenge.

<comment><USER34> I don't see why I'd want to use a service that bans my country from even accessing their website.

</comment></comment></comment></comment><comment><USER36> >AES-256, one of the strongest encryption algorithms available

Hmm... I'd take 4096-bit GPG over this any day. I rather like using pass[0]

[0][https://www.passwordstore.org/](https://www.passwordstore.org/)

<comment><USER37> Little do you know that gpg uses a symmetric cipher like AES-128, only encrypting the symmetric key with your asymmetric RSA keys.</comment></comment>


A hacker is wiping Git repositories and asking for a ransom - <AUTHOR> https://www.zdnet.com/article/a-hacker-is-wiping-git-repositories-and-asking-for-a-ransom/ <comment><USER2> I don't understand the business model. Since git is distributed, I have a copy of the repo in my hard disk. In the shared repos, we all have copies of the repos in our hard disk. So I don't expect that too many people will pay.

<comment><USER3> While it seems to have been used indiscriminately, I guess this is really targeted at _private_ repos.

Yes, you'll likely have several copies of the code on dev machines, but you won't want the source to be made public.

</comment></comment><comment> ga-vu So there's an update on the story. Hacker scanned the internet for Git config files and used credentials he found inside to access accounts all over the place

</comment><comment><USER4> "A GitHub search reveals that at least 392 GitHub repositories have been ransomed, so far."

That is a lot of pwned repos. I wonder why GitHub hasn't sorted this out yet.

<comment><USER5> Search results don't include private repos.

Wonder how many of those got hit.

Lots of security people will be up tonight reviewing logs.

<comment><USER4> Good point, we have no idea how many private repos have been compromised and I assume people won't come forward either.

The messed up part is that the repos are probably worth waaaay more than the ransom, especially if the companies are making money.

I wonder how many security people will be walking out the door TBH.</comment></comment></comment>