Latest Viral Craze: Ex-Staffers Bashing BuzzFeed on YouTube - <AUTHOR> http://variety.com/2017/digital/news/why-i-left-buzzfeed-youtube-1202399091/ <comment><USER2> Granted, this submission is likely receiving a lot of upvotes because the headline contains the phrase "Bashing BuzzFeed", but the concerns echo submissions that tend to be important to HN, such as the rights of individual contractors/ownership of product. Although bashing your former employer is not a good long term strategy.

Disclosure: I am currently working on a "Why I Left Apple" blog post/video, albeit _much_ different than the examples in the article.

<comment><USER3> Serious question - can someone please explain the purpose/appeal of these "Why I Left X" blog posts/videos?

I'm from a generation where you didn't publicize this kind of stuff, and I'm not quite sure I understand the intent/social value of such posts/videos outside of the "whistleblowing" types of posts. Absent of any context, these posts/videos just strike me as self promotion.

<comment><USER4> Because blogging and publishing videos is easier than ever. Nothing has changed about the culture.

In 1972, if someone left a company, they would willingly tell anybody who cared to ask. It is a frequent question during the interview process because it is insanely useful in helping to understand a potential hire. You didn't publicize this kind of stuff because the effort of typing it and Xeroxing it for your zine wasn't worth the reward of a reader getting some sort of insight into the company culture.

But now publishing that thought requires almost no effort beyond just typing it or saying it. That's it. It's just a personal story.

<comment><USER3> >> You didn't publicize this kind of stuff because the effort of typing it and Xeroxing it for your zine wasn't worth the reward of a reader getting some sort of insight into the company culture.

At least for my cohort, that's not the reason why you didn't do it. You didn't do it because it was career limiting. There was value placed on a person who had a sense of discretion.

I'm sure a lot of HR types Google their candidates. I'm wondering if any would drop a candidate for having posted these things.

<comment><USER5> And this is why it is interesting: the fact that someone is putting their name to something that could seriously damage their future career potential. It is ironic that you dismiss this as self-promotion -- of course it is -- and then point out that it could be career-limiting.

<comment><USER3> It _was considered_ career limiting for my generation. Don't know if it still is now, or if the younger generations simply don't care.

Outside of the "Why I Left" posts, a lot of younger people put a lot of content on social media that my age peer group would consider "career limiting".

<comment><USER5> I think you have to see it in a technological context, as in, what does _technology enable people to do_ that it didn't during your generation? Because it's very likely your generation would be doing the same thing had your younger years experienced the same kind of technological enabling.

Napster and LimeWire were big in my younger years and it allowed kids to illicitly amass music collections beyond what most middle-income kids could in a previous generation. Does that mean my generation were inherently more appreciative of music and/or more unethical, had Internet file-sharing never come to pass?

<comment><USER3> >> Napster and LimeWire were big in my younger years and it allowed kids to illicitly amass music collections beyond what most middle-income kids could in a previous generation. Does that mean my generation were inherently more appreciative of music and/or more unethical, had Internet file-sharing never come to pass?

The only thing that Napster and Limewire did was to allow you to get more faster. You guys were no worse than my generation who shared vinyl and recorded "personal copies" onto cassette tapes.

When I was young, schools used your "permanent record" as a scare tactic. Having a black mark on your school record could prevent you from getting certain jobs (the one example cited by my high school principal was getting into the police academy). This stuff would get laughed at today.

On the other hand, today's version of your "permanent record" (i.e., anything you've said or done online) is broader in scope and for the most part, available to everyone. While it seems like everyone is aware of the potential consequences, it also seems like people are also less concerned about them as well. I'm just amazed at some of the stuff I see on sites that use Facebook comments where everyone is pretty much posting with their real name.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Pretty interesting dynamic. As someone pointed out, these people are hired by BuzzFeed for their ability to be creative thinkers/creators who show aptitude in drawing attention to themselves. These are precisely the kind of people who would do something viral like this after quitting the company. As someone else noted, this kind of public airing is usually career-limiting, but it's different with BuzzFeed in that many industry folks tend to have disdain for BF, so publicly dissing BF might have less of a negative connotation depending on the nature of the complaint.

When I saw this headline, I immediately thought of Mark Duffy's rant in Gaeker: [http://gawker.com/top-10-best-ever-wtf-omg-reasons- buzzfeed-...](http://gawker.com/top-10-best-ever-wtf-omg-reasons-buzzfeed- fired-me-lol-1471409834)

I was surprised to see that BF apparently has such strong constraints on creative's side projects. That policy apparently doesn't apply to the investigative journalism team, where reporters seem to have free reign to open source their work and share their data.

</comment><comment><USER6> This article is more interesting than its title suggests. You think it'll be a schadenfreude-filled dish on problems with buzzfeed but no:

1\. BF trains people to go for eye-catching content _and_ personalities, so as people leave in the normal course of events they call attention to their departure as a way of helping their own career.

2\. BF basically doesn't come off as a bad place and indeed seems to be teaching these people to do, well, item #1.

</comment><comment><USER7> Clickbait header opportunity missed :( Of all places, where that would be legitimate...

</comment><comment><USER8> It seems to me a lot of these ex-BuzzFeed video producers just leave the company once they become super popular and want "more independence."

It seems like they're publicly biting the hand that fed them by making these videos: If BuzzFeed never hired them in the first place, they'd all just be no-name YouTubers.

</comment><comment><USER9> I want to know how much these people get paid. The content industry needs some transparency. Especially after that horrible stain on professionalism Huffington Post paid its writers nothing and Ariana got $315 million. Exploitation is not cool, nor is kneecapping the real market.

</comment><comment><USER10> The Chubbs parody video[0] is very funny and spot on.

[0] [https://www.youtube.com/watch?v=hPjPPuA0ERg](https://www.youtube.com/watch?v=hPjPPuA0ERg)

</comment><comment><USER11> An angle this article is kind of vague on that could potentially be of interest to HN readers would be how many of these people's relationship to BuzzFeed was through a new-ish L.A.-based video unit of theirs, BuzzFeed Motion Pictures.

BuzzFeed Motion Pictures was launched in 2014 with a big splash and a $50 million investment from Andreessen Horowitz ([http://www.hollywoodreporter.com/news/buzzfeed- raises-50-mil...](http://www.hollywoodreporter.com/news/buzzfeed- raises-50-million-creates-724513)). It's led by viral content pioneer Ze Frank ([http://allthingsd.com/20120914/buzzfeed-hires-web-video- pion...](http://allthingsd.com/20120914/buzzfeed-hires-web-video-pioneer-ze- frank/)).

Frank has characterized the unit's approach to content creation as "cheap and fast" ([http://www.latimes.com/business/la-fi-buzzfeed- studios-20150...](http://www.latimes.com/business/la-fi-buzzfeed- studios-20150809-story.html)), and they got in a fair bit of hot water last year after firing two on-camera personalities for appearing in a non-BuzzFeed video ([http://www.politico.com/media/story/2016/06/non-compete- agre...](http://www.politico.com/media/story/2016/06/non-compete-agreements- buzzfeed-firings-004600)), with Frank then warning remaining staff that "you cannot work on personal projects outside of BuzzFeed that impact your ability to work for us" ([http://adage.com/article/media/ze-frank-buzzfeed-motion- pict...](http://adage.com/article/media/ze-frank-buzzfeed-motion-pictures- employees-good/304605/), [https://www.buzzfeed.com/zefrank/being-a-part-of- buzzfeed-mo...](https://www.buzzfeed.com/zefrank/being-a-part-of-buzzfeed- motion-pictures)).

All of which makes the place sound a bit like a video sweatshop that makes its money by grinding up talented young people and then spitting them out, so it would be interesting to know how many of the complaints in this article are from people who worked at BuzzFeed in general versus how many are from people who worked at BuzzFeed Motion Pictures.

</comment><comment><USER12> Half the people who make these videos still actually work for buzzfeed.

</comment><comment><USER13> This just confirmed my dinosaur status. I had no idea what BF did or that a video factory existed to such an extent.

Don't despair, I still go to YouTube to see how to fix things.

</comment><comment><USER14> This is just about impossible to read on mobile. Pop up ads everywhere.

<comment><USER15> Only slightly better on desktop, with a video player (for unrelated content) cycling adds, and then moving down the right hand of the screen when you scroll away from it.

The web is broken. Sigh.</comment></comment>


Private justice: How Hollywood money put a Brit behind bars  - <AUTHOR> http://arstechnica.com/tech-policy/2012/08/private-justice-how-hollywood-money-put-a-brit-behind-bars/ <comment><USER2> The UK has a spectacularly weak judicial system for an industrialized country.

From the lack of judicial review of primary legislation ([1]) through a huge abundance of archaic haphazard laws, to lack of representative judges, to the ease with each political, police, partisan and private organisations can influence the judiciary, the UK system is ripe for abuse and disruption by any industry. It is also fertile ground at this time due to the dual US/UK government focus around issues of "Intellectual Property".

From a general perspective, the only saving grace, which is a relatively minor one in practice (by volume not significance), is that EU laws normally have precedence and judges are therefore unable to act completely unilaterally without risking being overturned.

Just think: what other industrial country permits unilateral _criminal_ prosecution from _private_ entities with explicit support from one of its judges?

[1] Yes, I am aware that without an arms-length written constitution, this would potentially make things even worse.

<comment><USER3> I'm not sure what perspective you're writing from, but I think many people in the legal profession would disagree with you.

Firstly, the UK has several distint judicial systems. I suspect in this case you're referring to the _English_ legal system (Scotland having its own, entirely separate, process). There's then the civil and criminal courts. The former are held in high regard around the world - the English courts are often the venue of choice for impartially resolving international disputes and litigation.

You can argue it is a discrepancy that private prosecutions are still allowed - at some point in the past they did actually serve a purpose - however, under the English system it is up to the government, rather than the judiciary, to correct that.

I am not pretending it is a perfect system: far from it. I think in this case the judge behaved inappropriately, and the logic being used to force a copyright claim (which is a tort, i.e, purely a civil matter) into a criminal one (conspiracy to defraud) is potentially very spurious. However, this is also why an appeals system exists.

What I'm basically trying to say in a round-about way is that I don't think the English courts are 'spectacularly weak' - they have their problems, but what judicial system _doesn't_?

<comment><USER4> The UK has a criminal copyright infringement statute; like the US, infringement becomes criminal when you do it for money.

It is news to me --- and, wow --- that private entities can prosecute crimes in the UK. Am I reading that right?

<comment><USER5> It seems odd to me that in other countries individuals _can't_ bring criminal cases - leaving everything to the "official" prosecutor (e.g the Procurator Fiscal here in Scotland).

<comment><USER4> How, exactly, do pleas and charge reductions work when the person conducting the prosecution has none of the incentives for leniency that the state does?

<comment><USER6> Are you talking about plea bargains, that American system for bullying people into forgoing their right to be tried on the evidence?

<comment><USER4> It seems like you either think we should eliminate the ability for defendants to negotiate lesser sentences, or you want to make an entirely orthogonal point about the US criminal justice system. Which is it?

Prosecutors routinely have to decide between pressing an ambitious charge with a higher risk of acquittal, or settling for a lesser charge. This happens all the way up and down the spectrum of offenses; for instance, there's something like 4 different things a mugger in Chicago can get charged with. How exactly do this balance get handled when the prosecutor is _by charter_ acting in their own interests and not the interests of the community?

<comment><USER6> para 2: I don't understand the issue. Surely the prosecutor should throw everything s/he's got and the judge and jury, who _are_ charged with protecting the interests of the community, decide what sticks? For the prosecutor to be involved in that decision seems a conflict of interest/incentive to corruption (this is the point you are making about private prosecutions, but I would argue that even a public prosecutor is rewarded for convictions).

para 1: yes, I want to eliminate the ability for defendants to negotiate lesser sentences. Like many practices we like to despise governments for tolerating (bribery, corruption, torture), it's convenient, practical and even successful in many cases, but it's totally unjust.

<comment><USER4> It's totally unjust if the world is a computer simulation in which arbiters have perfect information and there's a binary right/wrong answer to every problem. Since that's not the world we live in, I am very glad prosecutors are allowed the discretion to follow human intuition about the grade of offense to charge. Like most other government interventions, there are checks and balances regulation that discretion.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> That is bizarre. The government is, in theory at least, non biased towards any particular private interests. The fact that a private entity can launch its own investigation using its own methodology and then use said evidence to take away someones freedom is downright terrifying.

<comment><USER8> It's increasingly becoming clear that the practice is very different. There's several cases, most notably Assange and the current Megaupload trial that indicate that private entities are putting pressure on governments, who in turn put pressure on their peers in other countries. And it can't all be written off as conspiracy theories anymore.

<comment><USER9> I'm sorry, what is the private entity involved in Assange's case?

<comment><USER10> I think SAP is referring to an external entity having an influence on a government's judicial process, not necessarily strictly private. Whether it's the US Government or a special interest group. Assange's case included.

<comment><USER9> I don't think that is the intended statement at all. Please reread this sentence:

> There's several cases, most notably Assange and [...] that indicate that > private entities are putting pressure on governments, who in turn put > pressure on their peers in other countries.

</comment></comment></comment></comment></comment><comment><USER11> I can't believe what I've just read. A civil case yeah why not but criminal charges and imprisonment from a private entity after the CPS have basically said its not worth it? Scary.

<comment><USER12> English law has only partly transitioned to public prosecutions. Private prosecutions are still legally the norm, but CPS prosecuting a case is de- facto the norm, as they have the right to take over a private prosecution. In most cases, CPS either takes over a case and prosecutes it, or takes over a case and drops the charges (if evidence is wholly insufficient, or continuing prosecution is against public policy). But this leaves the awkward vestigial category: cases that CPS chooses neither to intervene to prosecute _nor_ to intervene to drop, which can go forward at a private party's own expense.

(Note: Only true of English/Welsh law; Scots law makes it much harder to bring a private prosecution.)

<comment><USER11> Thanks for the info, a quick google showing the rarity of private prosecutions in Scotland is definitely encouraging!

</comment></comment></comment><comment><USER13> Off Topic

       At the site's peak in mid-2009, STC attracted hundreds of
       thousands of users per day, earning Vickerman up to
       £50,000 ($78,500) per month in advertising revenue.

Let's say he did 999,000 users/day (to stay in the hundreds of thousands). That's still only $30K per month, if we assume a CPM of $1.00, which seems reasonable for a site like this.

<comment><USER14> CPM is by viewed ad and not unique visitor. Probably each user has 4 or 5 page views, then each page view counts for 3 or 4 ad views.

</comment></comment><comment><USER15> Somebody once pointed out that such link aggregation sites that operate outside the US seem to be getting in more legal trouble than similiar sites operating under a US domain and possibly on US soil. Is this true and if so, why?

<comment><USER16> The UK 'Government' is just a lapdog for US interests and they are scared of pissing them off. So they can get away with it. The English courts in particular are weak compared to others in the UK as well. I think they need a change of Government.

<comment><USER17> That's not true. Certain politicians have been "lapdogs", though. You think we voted for the Iraq war?

<comment><USER18> Tony Blair was re-elected, so I'm not even sure that this argument has merit.

</comment></comment></comment></comment><comment><USER19> Especially ridiculous is that the judge complains that he has no remorse for "making available" content that "infringes copyright". But of course, he didn't make any such content available. (Do .torrent files "infringe copyright"?)

<comment><USER20> .torrent files make that content available. The simplest counterargument is that if his actions didn't make that content available, what were all the visitors to his site doing?

Should a person be able to successfully defend with "What's the problem, I was only giving copies of the vault key to the people who I knew would burgle it. I never handled any of the vault contents myself!"?

<comment><USER21> Herein lies the problem. While your vault example makes sense, you can also say that someone selling knives or guns can't be responsible for people using them to murder someone else. Where do you draw the line? If you are merely providing something, where is the line where suddenly it's my fault instead of the fault of the user?

I think the difference here is that information and objects have an intended purpose - a knife is usually for chopping food, a gun is usually for... erm - however a vault key clearly can't have a use outside of using it to get into the valut. Where to .torrents fall in this? It's not the vault key situation, because there are definite good uses for them (linux distros, I believe Blizzard uses bittorrent to distribute updates?). However, the _majority_ of torrent usage is for piracy [citation needed].

So I guess what I'm saying is that all objects have a potential for negative usage and a potential for positive usage, and we're trying to draw the line somewhere in a rather undefined way.

To me, it seems unfair and harsh to be imprisoned for something that by another interpretation seems okay. I have a reasonable expectation not to be imprisoned for creating a site where people can post content. If it's coopted by the community into a place where people post torrents, it seems that right now I could be sent to jail for that.

The problem here isn't the intention of the owner of the site, just like it isn't about Kim Dotcom's intention. I don't disagree that they were completely aware that they were profiting from other people's desire to pirate. My problem is that all of these legal cases against these people seem to be brought in a way that doesn't feel 'just'.

<comment><USER20> The key part of my analogy is "that I _knew_ would burgle it". It's exactly like being an accessory to a crime. Drive a getaway car and you're not going to be able to use "hey, driving is completely legal, you can't charge me!"

.torrents themselves are perfectly fine, just like knives. I'm not making the argument that the object should be banned. But if a frothing hooligan runs up and asks for your knife because he's going to stab that guy over there, it's pretty clear that if you hand it over you've facilitated a crime.

So it's not the innate nature of the .torrents themselves, but the use of them as a nexus to set people up with illegal content. Like being a middleman selling stolen property, perhaps. You didn't steal it, but you did make it available.

</comment></comment></comment></comment><comment><USER22> A thought experiment: What if he was facilitating access to child pornography rather than Hollywood films would people be as outraged? More so? Less so?

If the suggestion of an income of up to £50,000 per month is even in the correct ballpark then this character was in the business of profiting hugely from copyright infringment and the jail time is appropriate.

The outrage about this is just windbaggery from thieves bemoaning the fact that they can't steal with impunity. And yes, depriving people of income is theft. Don't want to pay for a movie? Then watch something else.

<comment><USER23> "depriving people of income is theft" So if someone comes out with a competing product to mine, and splits the market in half, I lose (was deprived of) half my income. Was that theft? I think a more appropriate phrasing is "a government granted exclusive monopoly is a property right -- anyone violating that exclusivity is devaluing that property" which itself may be just as bad as theft (or more likely vandalism -- if someone takes my car, or destroys it on site, the damage is the same).

<comment><USER20> Too much of this debate is around how to define 'theft'. Really the issue is that folks are accessing a service providing entertainment (movie, tv show, game, music) without paying the requested fee by those who provided it. Whether or not it fits into the various definitions of theft people throw around is largely immaterial.

</comment></comment></comment><comment><USER24> I'm glad there is private-sector criminal prosecution in UK, wish it was here in the US as well. Then maybe cops would think twice before murdering citizens; they currently get off free every time because the DAs never prosecute one of their own.</comment>


Will HN go dark in protest of SOPA on Jan 18? - <AUTHOR>

From this poll it seemed the users of HN were strongly in support of a blackout:<p>https://news.ycombinator.com/item?id=3454179 <comment><USER2> Stop back in 5 days and find out, or send PG an e-mail.</comment>


Pax Mongolica - <AUTHOR> http://en.wikipedia.org/wiki/Pax_Mongolica

<comment><USER2> The Mongol invasion, although destructive for probably all civilizations of the time, had definitively a positive effect to the survival of eastern romance culture. In the dark ages the amount of migrating population was so great that for quite some time they outnumbered the descendants of the former Roman Empire around Carpathians and Balkans. The dominance of the vulgar-Latin speaking population suffered serious setbacks and were being confined to smaller and smaller less accessible areas like mountainous regions. The west- most areas of the Mongol raids were around Carpathian Mountains up to Pannonian Basin and were they went through, they basically cleaned the densely-populated lowland of the most of its inhabitants. Its a known fact that the Mongol incursions were disastrous for Hungarians, Poles, Russians, and other populations that were in the region at the time, but on the other hand they were vital for romance population. Of course, the romance population suffered from those raids too, along with other cohabitant populations, but after that, that mountain-descending romance population become dominant again. Have not Mongols come, the fate of the eastern romance population around Carpathians would have been the same as the one of the former eastern romance populations south of Danube - for a while they probably would have managed to manifest some cultural and even political power (like the Vlach-Bulgar Empire of Asănești), but in the end they would have been assimilated completely.

</comment><comment><USER3> The Mongol horde displayed unparalleled ruthlessness in Eastern Iran:

The garrison at Merv was only about 12,000 men, and the city was inundated with refugees from eastern Khwarezmia. For six days, Tolui besieged the city, and on the seventh day, he assaulted the city. However, the garrison beat back the assault and launched their own counter-attack against the Mongols. The garrison force was similarly forced back into the city. The next day, the city's governor surrendered the city on Tolui's promise that the lives of the citizens would be spared. As soon as the city was handed over, however, Tolui slaughtered almost every person who surrendered, in a massacre possibly on a greater scale than that at Urgench.

</comment><comment><USER4> The book that heydenberk mentions above is remarkable in that it presents a very different picture of the 'ruthless Mongol hordes' as a well disciplined and very flexible moving force.

The thing to consider if they were so brutish as presented in books and media then they would have collapsed from within.

And if they were simply brutal eventually there would have been revolt.

The book presents them as able to learn quickly from each place they conquered. One of the first groups in Asia they came across were excellent accountants. The non-literate Mongolians brought them along to inventory further conquests.

That is remarkable.

They built a network of roads ( a memorable sentence from the book - paraphrase: "The only structures the Mongolians knew how to build were bridges - so that they would always have a way back home"

They had no religion that they wanted to impose. No particular ideology.

They came up with innovative answers to problems that included prototypes for paper currency; law between states; religious tolerance.

They could be brutal - but to the noble/clerical ruling classes, supposedly not so much to the peasant and trade classes. And compared to what? Life for peasants was pretty much 'nasty, brutish and short' as it was. It seems possible that the Mongols could have offered them a better bargain they they were getting from King and Church. And that is why there was not sustained revolts.

There is an oft quoted cliche "History is writ by the victors..."

In this case not true. They were non-literate in Ghengis' generation. The history of the Mongol invasions were written by the vanquished upper classes.

<comment><USER5> I agree that they were certainly a disciplined and flexible moving force. But I also think they were every bit as brutal as presented in books.

I'm not the most studied person on Mongol history but the impression I'm left with is that you can piece together accounts of the Mongol invasion in the texts of ancient russia, europe, china and the middle east. In russia they call them the huns, in europe there's a legend of "prestor john". All accounts share the same ruthlessness.

<comment><USER6> You're mixing up your history. The Huns were an entirely different nomadic people (separated from the Mongol Empire by about a thousand years). Prestor John was a mythical Christian king who lived beyond the Islamic lands and whose land was full of wealth and treasures.

<comment><USER5> No I'm not.

The russians of the time called the mongols by the ancient name "huns." Or at least, those that wrote the history did.

Prestor John was the mythical christian king who was purportedly laying waste to Islam from the east as Europe was attacking in the crusades from the west. Of course, at that time, it was Genghis Khan that was attacking the Islamic states from the west.

</comment></comment></comment></comment><comment><USER7> A great book on the subject is "Genghis Khan and the Making of the Modern World"[0], a revisionist history which emphasizes the institutions and liberalism of Genghis and Kublai Khan's reigns while not soft-pedaling the violence that made it possible.

[http://en.wikipedia.org/wiki/Genghis_Khan_and_the_Making_of_...](http://en.wikipedia.org/wiki/Genghis_Khan_and_the_Making_of_the_Modern_World)

<comment><USER4> I simply had to visit Mongolia and did at the earliest I could. I loved it when I was there in the mid 90s. Very challenging place for me to be and it took me out of my shell a bit. Nothing was obvious for me at the time... ("is that a restaurant or a private house?, etc)

I think about this book all the time. I am honestly nto enough of a historian to judge it overall but the portrait of Ghengis Khan is very striking.

Only slightly tongue in cheek - he was as disruptive in his time as Google. Not because of his cruelty (he supposedly forbid his troops from pillaging and raping and sent the accountants in first...) The deliberately did _not_ destroy towns if they could avoid it so that they could keep the productive capacity going. And they learned every step of the way. New techniques, new technologies.

They engineered a relatively safe road back to the homeland. To insure they could return and they could send back earning of war.

This book answered a nagging question I always had about Mongolia:

1) How did they conquer without leaving a standing army? If they were so brutal then those left behind would revolt, eventually.

2) Did they offer the tradesmen a bagain - give up the yoke of Nobility and Church for a 20% cut and relative safety trading with the other town?

This is an amazing book.

<comment><USER2> "How did they conquer without leaving a standing army? If they were so brutal then those left behind would revolt, eventually."

From the "Mongol invasion of Khwarezmia"¹ about cities which opposed resistance:

1\. Otrar - "Genghis killed many of the inhabitants, enslaved the rest"

2\. Bukhara - "Survivors from the citadel were executed, artisans and craftsmen were sent back to Mongolia, young men who had not fought were drafted into the Mongolian army and the rest of the population was sent into slavery."

3\. Samarkand - "After the fortress fell, Genghis reneged on his surrender terms and executed every soldier that had taken arms against him at Samarkand. The people of Samarkand were ordered to evacuate and assemble in a plain outside the city, where they were killed and pyramids of severed heads raised as the symbol of Mongol victory."

4\. Urgench - "As usual, the artisans were sent back to Mongolia, young women and children were given to the Mongol soldiers as slaves, and the rest of the population was massacred."

5\. Gurjang - "Upon its surrender the Mongols broke the dams and flooded the city, then proceeded to execute the survivors."

6\. Merv - "Tolui slaughtered almost every person who surrendered, in a massacre possibly on a greater scale than that at Urgench."

7 Nishapur - "Tolui put to the sword every living thing in city"

Then an outlier:

"After Nishapur's fall, Herat surrendered without a fight and was spared."

Now, let's see... who wants to revolt?

¹ [http://en.wikipedia.org/wiki/Mongol_invasion_of_Khwarezmia_a...](http://en.wikipedia.org/wiki/Mongol_invasion_of_Khwarezmia_and_Eastern_Iran)

<comment><USER4> Well - except they did not leave a standing army. Once they get up to Hungary they have thousands of km to get back.

Genghis' goal was always to return. Not occupy. They had to make sure they could get back.

</comment></comment></comment></comment><comment><USER8> It also completely destroyed Russian culture for example and set them back hundreds of years[1]. Payments to Mongols continued up until almost 1500.

[1] [http://en.wikipedia.org/wiki/Mongol_invasion_of_Rus%27#Impac...](http://en.wikipedia.org/wiki/Mongol_invasion_of_Rus%27#Impact_on_development)

<comment><USER9> It's debatable, but from your reference it seems like the opposite:

 _It has been argued[by whom?] that without the Mongol destruction of Kievan Rus ', the Tsardom of Russia and subsequently the Russian Empire would not have risen. Trade routes with the East came through the Rus' lands, making them a center for trade from both worlds. Mongol influence, while destructive to their enemies, had a significant long term effect on the rise of modern Russia, Ukraine, and Belarus._

— [http://en.wikipedia.org/wiki/Mongol_invasion_of_Rus%27#Impac...](http://en.wikipedia.org/wiki/Mongol_invasion_of_Rus%27#Impact_on_development)

<comment><USER10> It seems unlikely, considering the fact that the lands conquered by Mongols were later the most backward parts of Europe till at least XXth century.

<comment><USER11> The argument is that the effect of the invasions on both the Rus and other peoples in regions the Mongols conquered or subjugated might have been hugely beneficial to the ability of Tsars to rule a huge amount of land from St Petersburg afterwards, most of it to the east.

That's is entirely consistent both with it decimating the earlier civilisation across a smaller region centered on Kiev, and with it having a negative impact on economic and cultural growth in that region and surrounding regions which was felt centuries afterward. Especially if you consider Tsarist rule that Mongol invasions arguably paved the way for to be amongst the factors responsible for the relative backwardness of the Russian Empire.

</comment></comment></comment></comment><comment><USER12> Yes, and Marco Polo is a captivating series.

</comment><comment><USER13> Folks, what is this doing here?

<comment><USER14> Somebody's been browsing Wikipedia while watching Marco Polo.

<comment><USER13> Well, I guess they no longer teach history in middle school.</comment></comment></comment>


Ask HN: I have trouble completing my work because it's mind-numbingly boring - <AUTHOR> Howdy everyone, I'm using a throwaway account for plausible deniability if any of my coworkers see this.
I have been at one of the big large megacorporation "brand-name" companies for almost two years now, and in the last year I have become incredibly bored with the work, due to most of it reducing to "add a field to this class, make a PR, wait two hours for it to be approved, repeat".
In a bit of irony, I have trouble actually completing these tasks because I find them so boring that I can't actually focus on them.  With COVID exacerbating things, I am afraid that I'll be fired, or arguably worse, "professional purgatory" with no chance of ever being promoted to receive more interesting work.
I plan on talking to my manager about this, but due to past events that would be too personally identifying to go into, doing this is likely not going to lead to an optimistic outcome.
I guess I have two questions:
1) what do people do to stay motivated if you're given work that doesn't interest you in any capacity?
2) What do you do if your manager is uncooperative with you?  Do you quit your job? Do you look for a transfer within the company? <comment><USER2> 1) There will always be "boring" work regardless of whether you run your own company or you are a Jr. Software Dev. When faced with boring work I always recommend: A) Challenge yourself do to this in the most excellent way possible: Is everything perfectly named? Layout is beautiful? Met all of the coding standards in place at your workplace? Is the change documented in end- user facing documentation? B) Could this be automated? If it is truly that mind-numbing and routine could you write scripts to do this with a few inputs? C) Can you delegate this to a more junior staff member?

2) Not sure "how" your manager is being "uncooperative"... Is he/she only giving you boring work? Sometimes managers dole out boring work if they think the person cannot handle more challenging tasks. Have you proven that you can be Excellent (See 1A) at all times? Have you nicely asked to be given the chance for a greater challenge?

It is going to be a tough "sell" to your manager if you are not completing boring tasks because you cannot focus on them. You'll probably need to prove your competence and excellence before you'll be granted tougher assignments.

Best of luck!

<comment><AUTHOR> I know there will always be boring work no matter what job I were to have; the issue is that _none_ of the work I've done in the last year has been stimulating.

Your ideas aren't wrong, though the codebase that I work on is almost 20 years old, and making the code perfect, or even reasonably improving it, is going to require a lot more planning than a single engineer can provide. However, I will ask if this work can be delegated

I've brought up concerns about this to my manager (though admittedly in a tangential way since, again, there are reasons to avoid mentioning dissatisfaction that I can't go into). I have no doubt that the issue might be a feedback loop now; I underperform on the boring work and as a result I keep getting assigned worse work.

EDIT: I want to make it clear, I'm not trying to be defensive; I'll take criticism from your perspective and I appreciate the input.</comment></comment>


The Deceptive Simplicity of 'Peanuts' - <AUTHOR> https://www.theparisreview.org/blog/2019/10/23/the-deceptive-simplicity-of-peanuts/ <comment><USER2> I grew up reading newspaper comics during the "Calvin and Hobbes" era. I read Peanuts but I never understood its appeal as seemed extremely dull.

Later I read a collection of Peanuts from around 1955 and it was incredible. Kinda like early Simpsons

<comment><USER3> I grew up in the same era, thinking the same thing. I'll have to go check that out.

<comment><USER2> Even more surprising is to go back and read early Garfield.

<comment><USER4> Maybe when a cartoon hits syndication that the quality dips?

I read somewhere that is when Bill Waters (of Calvin & Hobbs) quit creating, when syndication was his only viable option moving forward. (I think he was burning out)

I loved Garfield as a kid, but as an adult it was really dull. I tried to even enjoy the old stuff... But this makes Garfield awesome again: (you may need some Garfield experience before appreciating this)

[https://garfieldminusgarfield.net/](https://garfieldminusgarfield.net/)

<comment><USER5> I guess people just get tired of having to be machines of continual creation. It must be terribly wearing. I'm not surprised it becomes just crank-turning after a while.

Unrelated but I'd like to plug this which is brilliant, though it seems the author burned out a while ago. One of the best comics I've come across [https://abstrusegoose.com/](https://abstrusegoose.com/)

Hit Random a few times and you'll start getting some good ones. He seems to be a high level physicist so there are some impenetrable bits of maths etc. which you can safely skip.

<comment><USER6> If you skip the abstruse stuff, it's just goose.

<comment><USER5> I've no idea what you mean, but upvoted anyway for making me chuckle

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Chris Ware is a fantastic author of comics. His "Building Stories" is truly a masterpiece of the form and I highly recommend it to all.

[https://en.wikipedia.org/wiki/Building_Stories](https://en.wikipedia.org/wiki/Building_Stories)

<comment><USER8> That looks great, reminds me of Understanding Comics by Scott McCloud, which was used as textbook in my intro to philosophy. [https://en.wikipedia.org/wiki/Understanding_Comics](https://en.wikipedia.org/wiki/Understanding_Comics)

</comment></comment><comment><USER9> What a beautiful short take on how we build our own work, unknowingly at the time, by looking at our predecessors' work.

</comment><comment><USER10> Schulz should have quit in the 70's. He dragged it on for far too long.

<comment><USER11> He would have died sooner. I say that only partly in jest. When he was going to retire, he wrote the last strip ahead of publication and people were wondering what it would be. It was basically a thank you to the fans. He died the day it ran in the papers.

Edit: he died the day before.</comment></comment>


Testing the Resolution of the Human Eye - <AUTHOR> http://ipvm.com/report/testing_the_resolution_of_the_human_eye <comment><USER2> This is misleading on several levels. The size of an image (measured in MP) has almost nothing to do with the angular resolving power of a camera, and even less to do with the resolution of the human eye.

The article didn't mention that every camera tested likely has a slightly different focal length / field of view. Two cameras with the same resolution but different focal lengths will score very differently in these tests. For example, a 32mm lens will see much more detail on the chart than a 14mm lens, even with the same resolution sensor.

Additionally, none of these cameras have the peripheral vision capabilities of the human eye. Our brains pick up quite a lot of information outside the tiny rectangle that these cameras are able to capture. The resolving power of the eye also changes from the center of our vision to the periphery - just because we can read the E on the chart in the middle of our eye doesn't mean we can read it from the edge of our vision.

Comparing eyes to cameras at this level of simplicity is mostly meaningless.

<comment><USER3> People don't often realize how poor our visual acuity is everywhere outside the fovea, the area of sharp central vision a few degrees wide (that's a few fingers held together at an arm's length). We need saccades and microsaccades and lots of processing power and plain guesswork on part of the brain to patch together the image we "see". The resolution of a camera sensor, on the other hand, is not a function of the angular distance from the center of the image.

[http://en.wikipedia.org/wiki/Fovea_centralis](http://en.wikipedia.org/wiki/Fovea_centralis)

[http://en.wikipedia.org/wiki/Saccade](http://en.wikipedia.org/wiki/Saccade)

[http://en.wikipedia.org/wiki/Microsaccade](http://en.wikipedia.org/wiki/Microsaccade)

<comment><USER4> This is an awesome comment!

</comment></comment></comment><comment><USER5> But can you see the entire line of that chart _without moving your eyes at all_? In terms of a single 'snapshot' of our vision, the resolution is atrociously bad. Only a very small area in the middle of our field of view has significant detail (test this by looking at some writing in the distance then stare at the first letter and try 'reading' the rest of the writing without moving your eyes - it'll just remain an indistinct blur).

<comment><USER6> If we're making it a competition, I'll note that the human eye natively supports edge detection, and it operates in a much wider range of light. Eyes also come pre-packaged in a format that allows for quite accurate determination of distance at no extra charge. While cameras have a slightly broader spectrum, eyes work in a far greater range of brightness - and seeing in the near dark is far more useful than seeing the LED on the end of a remote. Eyes are perfectly mobile, and don't require external power. Eyes have a much faster traverse and can move to and focus on a target much more quickly. If you're turning, eyes will give you a stable image of the world around you to help keep your reference - cameras will just give you motion blur. Eyes are very difficult to replace, admittedly, but they have pretty astonishing self-healing characteristics and last for decades of constant use - in the rain, snow, desert heat, even underwater (though admittedly the image isn't great). Not to mention that if you roll your cameras, people will just be confused as to your emotional state, and of course, it's harder to feel a knot of love when staring into your significant other's IP cam...

</comment></comment><comment><USER7> I've been reading the comments and something stuck out to me. It's not uncommon for people to have 20/15 vision with corrective lenses. The lenses don't zoom the image in, as far as I can tell; and so, the 20/20 number we often come up with has nothing to do with the resolution of the eye as a sensor, but more to do with the focusing power of the lens. It might be more useful to consider 20/15 or 20/10 as what humans can see, since the lens is whats failing on the eye, not the sensor in the back. To that end, too, it'd be nice to see some really good glass to mitigate the lenses failings there. There are charts that relate lens sharpness to sensor acuity. As long as the lens sharpness is approximately equal or better, we should have an accurate result.

Also, I have 20/15 vision with contacts in and both eyes open (weaker with just one eye open, as is normal); and, when I can see letters, I can see them pretty well defined. I'm not sure how much of that is mental post-processing, though.

</comment><comment><USER8> it is very probably that using GIMP "curves" they would be able to bring a lot of details on 5MP and 10MP "blind" images. The digital cams lack dynamic range. A "blind" dark image is very possibly somthing like this rough simplified illustration - 0 where black and 1 [out of 255] where white. To us both values look black, ie. very close to 0 vs. 255. Using a tool like "curves" one can remap 1 to say 100 while 0 is still 0 and this will frequently make a reasonable, though somewhat noisy image.

Or in other words, they judged performance of camera vs. eyes by using human eyes. It would be interesting if they send the images to, for example, OCR.

</comment><comment><USER9> Very interesting. However this only tells half the story about human vision, what about color depth, dynamic vision range, and speed (flash something fast on screen)?

<comment><USER10> Half? More like 1% or less. Dynamic range is incredible (1,000,000:1 according to [http://en.wikipedia.org/wiki/Human_eye#Dynamic_range](http://en.wikipedia.org/wiki/Human_eye#Dynamic_range)), one should test vision in darkness peripherally (rods have lower resolution, but higher sensitivity than the cones in the fovea. There are claims humans can see individual photons), etc.

Even limiting one to these experiments, test subjects should dark adapt for at least one hour before a measurement (given that te article doesn't mention it, I think it is unlikely that was done). That can make a huge difference.

Some (and more, including "The brain contains 10^12 neurons, 10^14 of which are in the cerebellum.") of the numbers you ask for are in [http://white.stanford.edu/~brian/numbers/node2.html](http://white.stanford.edu/~brian/numbers/node2.html)

<comment><USER11> Is the neuron number meant to be a joke, or is the 10^14 being greater than 10^12 a typo?

<comment><USER10> It is a joke, and an indicator of how little we really know. In the same vein, that text has:

 _Number of neurons in the brain in 1974: 10 billion_

 _Number of neurons in the brain in 1994: 100 billion_

(Wikipedia gives 85 billion on [http://en.wikipedia.org/wiki/List_of_animals_by_number_of_ne...](http://en.wikipedia.org/wiki/List_of_animals_by_number_of_neurons))

</comment></comment></comment></comment><comment><USER12> As the editor of the post, I'd love to get technical feedback and happy to answer any questions.

<comment><USER13> 1\. As others sugges, if you have a RAW setting on your cameras, you should use that. If you don't, you should probably get one that does.

2\. I'm going to disagree with the naysayers who say this is useless. You can partially defang them by pointing out that while this doesn't fully test a camera against a human eye, it is a reasonable test on its own merits and generally answers the question that people are _actually asking_ when they ask "what's the resolution of the human eye?" (After all, the difference in capabilities goes both ways; sure, human eyes are a great deal more sensitive on many measures, but would someone please show me their eye's 10x optical zoom? (Hello to the 2040s!))

A further observation that "megapixels" is not useful would be called for, though. We're really comparing angular resolution for a certain set of settings. But we can accept "megapixels" as a slang term if we also fix certain other camera parameters to ones common to consumer cameras in the market.

3\. Using eye charts is a good idea, I think. I've seen comparisons that try to compare rod density on the human eye, but that's really hard. I'd consider adding a note that standardized eye charts measure what humans can _really see_ rather than try to compare two extremely different hardware platforms directly.

<comment><USER12> We are using IP cameras, that's our area of research / focus. As such, those types of cameras so not have a raw option.

We used H.264 with default quantization. We could have certainly used MJPEG, as these types of cameras support that but in our preliminary testing, it made no difference.

That said, I do agree that a completely uncompressed, raw, image could make a modest difference. For our domain, IP cameras, we just don't deal with raw images.

</comment></comment></comment><comment><USER14> I know the tests were done by a company selling IP cameras but there are many cameras available which would make better competitors to the human eye. For instance the Leaf Aptus-II 12 which produces images with a size of 80 Megapixels.

<comment><USER12> We do not sell any IP cameras. All we 'sell' is research and testing.

Our focus is on IP cameras only, ergo the type of cameras we selected.

</comment></comment><comment><USER15> Fun fact: The human eye sees in higher resolution for red and green than for blue. Blue light is scattered more as it passes through the eyeball (and as an evolutionary result, blue detectors are sparser on the retina).

</comment><comment><USER16> There are also algorithms that convert the raw data from the sensor into a compressed stream. That would downgrade the quality of the camera.

Though, that does make me wonder if our meat software does something similar.

</comment><comment><USER17> First sentence: All sorts of wild guesses and theoretical calculations exist about what the resolution of the human eye is, with 576MP a common claim.

576MP is not a resolution. Article immediately closed.

<comment><USER18> Resolutions are commonly measured in pixels. Or are you expecting something rectangular and ISO standard like 1920 x 1080?

Divide by pi, take the square root, multiply by two, we're talking about 27000 pixels in diameter.

That said, I don't agree with a lot of the methodology. If pixels are what we're going for, it only makes sense to me to count rods and cones.

<comment><USER19> No, I think the GP means _angular resolution_ – i.e. pixels _per unit of solid angle_ – which one might presume is the figure of merit here.

<comment><USER20> It's trivial to transform the units, and it's easier to understand megapixels or xxxxp. Terrible reason to close the article.

<comment><USER19> _It 's trivial to transform the units_

…except they're not dimensionally compatible. You need to know the solid angle subtended by those pixels. That's like saying you can trivially transform 60 miles per hour into a distance. You can't, unless you have time.

More importantly, the solid angle in question is not obvious – are we talking just the fovea (area of the eye with highest density of cones [1]), the eye as a whole, or the solid area subtended by a standard computer monitor, or…?

[1] [http://hyperphysics.phy- astr.gsu.edu/hbase/vision/rodcone.ht...](http://hyperphysics.phy- astr.gsu.edu/hbase/vision/rodcone.html#c2)

<comment><USER20> The angle is the field of view. Because of the eye's uneven resolution you need to have some idea of how they're handling the field of view no matter what.

It's like saying '60 miles per hour from Vermont to West Virginia'. There's some fuzziness about where exactly you put the end points, but you have a good idea.

Basically, using raw angular resolution would _also_ be too vague without context, but if you have context then megapixels are sufficient.

</comment></comment></comment></comment></comment></comment><comment><USER21> That's a little more than 4k (8.3MP). I think I was expecting it to be a little higher than that.</comment>


Transmission BitTorrent Client OSX/Keydnap Malware Incident Q+A - <AUTHOR> https://transmissionbt.com/keydnap_qa/ <comment><USER2> Simple file check if you are infected:

      if [ -f "/Applications/Transmission.app/Contents/Resources/License.rtf" ] ||
         [ -f "/Volumes/Transmission/Transmission.app/Contents/Resources/License.rtf" ] ||
         [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/icloudsyncd" ] ||
         [ -f "$HOME/Library/Application Support/com.apple.iCloud.sync.daemon/process.id" ] ||
         [ -f "$HOME/Library/LaunchAgents/com.apple.iCloud.sync.daemon.plist" ] ||
         [ -d "/Library/Application Support/com.apple.iCloud.sync.daemon/" ] ||
         [ -f "$HOME/Library/LaunchAgents/com.geticloud.icloud.photo.plist" ];
      then echo "OSX/Keydnap detected.";
      else echo "You're good.";
      fi

Source: [https://gist.github.com/kaizensoze/ca96d039b295db220951d42ca...](https://gist.github.com/kaizensoze/ca96d039b295db220951d42ca7c83d89)

<comment><USER3> And to run it from the clipboard:

        pbpaste | sh -

<comment><USER4> Why not this?

        curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/ | bash

<comment><USER2> Your line downloads and executes the latest version of the gist, it could have changed from a file check to a virus installer by the author (unlikely, but I have to point it out). To be a bit more safe (while trusting that GitHub is not compromised) pin a known, verified version:

      curl https://gist.githubusercontent.com/kaizensoze/ca96d039b295db220951d42ca7c83d89/raw/a26e5a025ea21d3a0af536eeca49619272d0068f/quick-osx-keydnap-check | bash

(sorry for the overlong line)

<comment><USER5> this pattern is just as dangerous (maybe less for github if you trust them) because you can detect curl and deliver malicious code: [https://www.idontplaydarts.com/2016/04/detecting-curl- pipe-b...](https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash- server-side/)

<comment><USER2> > this pattern is just as dangerous

As a general pattern, please do not do this. In this specific case I think most people trust the service (GitHub) and their DNS recursor + SSL library. Attacking these is not on the level of "random drive-by phishing", more like "targeted high value state sponsored".

To avoid this discussion I did not include the curl version in my original posting.

</comment></comment></comment></comment></comment></comment><comment><USER6> They never responded with details of what they were doing to improve security after the last incident: [https://forum.transmissionbt.com/viewtopic.php?f=1&t=17938](https://forum.transmissionbt.com/viewtopic.php?f=1&t=17938). The outside appearance is that they didn't address the problem seriously enough.

<comment><USER7> Yeah, I was thinking, didn't this happen before?

<comment><USER8> One of their servers or dev machines might have a rootkit. At this point, wiping basically everything is required.

</comment></comment></comment><comment><USER9> Second time that this has happened to Transmission this year. Last time a ransomware got included. If you're a Transmission user then be _very_ cautious when installing new versions.

<comment><USER10> Main reason that I only install stuff like this from my distro's repositories. Anyone know if this would have affected homebrew and such on OSX?

<comment><USER11> Homebrew packages verify checksums, so very unlikely to be affected.

<comment><USER7> And where do the checksums come from?

<comment><USER11> Changes made by GitHub pull requests. I'm sure an anonymous contributor who submits only a checksum change, without version bump, would most certainly fail review.

<comment><USER7> I don't believe that's true.

I'm googling to try to find how Homebrew uses checksums and where it gets them. But not everything homebrew installs comes from GitHub, so I don't see how checksums for all of it could come from 'Changes made by GitHub pull requests'.

And it looks like homebrew checksums both source packages and pre-compiled binaries. There's no way an upstream dependency would be providing their own checksum for a homebrew compiled binary. Homebrew also switched from using MD5 to using SHA1 recently ([https://github.com/Homebrew/brew/blob/master/share/doc/homeb...](https://github.com/Homebrew/brew/blob/master/share/doc/homebrew/Checksum_Deprecation.md)), obviously all of their dependencies didn't switch in unison too, which suggests the checksums do not come from the dependencies themselves.

Looking for more info about this, having trouble finding it. To have confidence in homebrew's checksum system, one needs to know how it works and where they come from, but having trouble finding it.

Or did you mean the checksum is made in a PR to homebrew's own repo? Right, but the question is still where it comes from. If it was generated from bad source obtained from upstream, it will of course be bad. It's just verifying that the package as installed matches what homebrew maintainers meant to install; but that's no guarantee that what homebrew maintainers meant to install wasn't bad in the first place. Since transmission was distribution bad packages itself due to a hack, I'm not following how homebrew providing a checksum means that it can't re-distribute bad packages from upstream. It does mean that homebrew itself is harder to hack than transmission, but doesn't necessarily help when transmission is hacked.

</comment></comment></comment></comment></comment></comment><comment><USER12> So what happened with the codesigning? That's pretty much the only viable line of defense for the average user (nobody is going to be verifying SHA signatures, or the site is going to be compromised along with the download)

Was the malware version also signed with an official Apple Developer ID? The same ID? Is a change of ID verified with the auto-updater?

If there was a malicious Developer ID, has it been revoked by Apple?

<comment><USER13> According to this article [1], the compromised app was indeed signed – but with a different Developer ID than usual.

Anyone with a credit card can sign up for Apple's developer program and start signing apps.

[1] [http://www.welivesecurity.com/2016/08/30/osxkeydnap- spreads-...](http://www.welivesecurity.com/2016/08/30/osxkeydnap-spreads-via- signed-transmission-application/)

<comment><USER14> > According to this article [1], the compromised app was indeed signed – but > with a different Developer ID than usual.

That's the terrible part about all of this. Having signed applications without any verification of the signer is pointless.

A simplistic, yet more secure approach, would be to have domain validated keys that could be used to sign applications. Browsers could then verify that the application downloaded from example.com was signed with a key for example.com. I think OSX already stores " _This was downloaded from the scary internets!_ " in a separate resource fork so this info could go there as well. Maybe even cut out the middle mad and put them in DNS SRV records so you don't even need a central CA. If DNS gets compromised the client's have bigger problems already.

Unfortunately like all things like this, it'd be forever before it's widespread enough to be useful.

<comment><USER6> It's not completely pointless, as it allows Apple to (silently and quickly) release updates which distrust that Developer ID, however a stronger protection would be to pin apps to a particular Developer ID.

</comment></comment></comment></comment><comment><USER15> It's nasty that a free software project has to deal with this, given their limited resources. This shows the importance of reproducible builds and using package managers with verification like APT or homebrew.

</comment><comment><USER16> More info on the malware:

> The OSX/Keydnap backdoor is equipped with a mechanism to gather and > exfiltrate passwords and keys stored in OS X's keychain. The author simply > took a proof-of-concept example available on Github called Keychaindump. It > reads securityd's memory and searches for the decryption key for the user's > keychain. This process is described in a paper by K. Lee and H. Koo. One of > the reasons we think the source was taken directly from Github is that the > function names in the source code are the same in the Keydnap malware.

Source: [http://www.welivesecurity.com/2016/07/06/new-osxkeydnap- malw...](http://www.welivesecurity.com/2016/07/06/new-osxkeydnap-malware- hungry-credentials/)

<comment><USER17> Wow. I'm the author of keychaindump. Didn't expect to become a malware co- author.

<comment><USER18> Seemed pretty likely though don't you think?

<comment><USER17> I guess any security tools and scripts are bound to be used for naughty stuff at some point, but I thought "real" malware writers would put more effort (at least obfuscation) into their products. Keychaindump is a crude hacky PoC, and I honestly didn't expect it to get directly copy-pasted into "serious" malware.

<comment><USER19> Evolution doesn't work hard for no reason.

</comment></comment></comment></comment></comment><comment><USER20> I'm not a Transmission user, but this makes me wonder, as a sort of Ask HN question: How long do you wait before updating software?

If you always update as soon as possible, then you risk getting hit by a compromise like this one, or you could suffer other unintentional bad effects of a botched update.

But the longer you delay updating, the more you raise your risk of becoming a victim of a new vulnerability that's just been patched and is now in the wild.

<comment><USER2> Neither during this or the previous incidence the updates were compromised (they were checked by the installed binary). Only fresh downloads from the website.

<comment><USER20> I haven't read much about this, so perhaps I'm not understanding clearly, but if the downloaded binary from Transmission's "website server" was replaced, then how is that not a compromise?

I genuinely feel for the developers, and I personally would not blame them if I was affected, but unless the data was intercepted enroute from their server, then I think they have to accept some degree of responsibility for the whole delivery chain to the end user.

<comment><USER21> Well, they do accept some kind of responsibility: it is spelled out clearly in the license what they accept, and you can choose whether you prefer the terms defined in GPL, or MIT (Transmission is dual-licensed).

<comment><USER20> Do you mind linking to that? Please quote the relevant part of license if you have time.

I ask that because I think they'd be insane to accept responsibility.

I searched on their site, briefly, but I couldn't find this.

I haven't checked MIT license but the GPL 3.0 has got this clause about liability limitation.

16\. Limitation of Liability.

IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

To me it sounds like it means whatever happens after you use our software, it's not our fault! Which sounds like a reasonable license for open source free software, to me.

<comment><USER21> Exactly that. They give you their work for free (as in freedom and also as in beer), so why would they accept anthing more than a responsibility to provide you with the source and wish you a good luck? If you want protection, you can buy commercial support for a GPL-licensed software, if it exists for the software in question, or look for an insurance company to buy insurance against any calamity. Why would Transmission developers provide such thing, and what's more, for free?

</comment></comment></comment></comment></comment></comment><comment><USER22> That's not the first time this has happened... [http://gizmodo.com/yes- ransomware-can-affect-macs-too-176323...](http://gizmodo.com/yes-ransomware- can-affect-macs-too-1763239644)

</comment><comment><USER2> Service announcement: You were only at risk when you downloaded fresh copies from the website. As with the previous incident, updates within the app were safe and checked.

<comment><USER23> It's pretty scary that they still haven't fixed the Sparkle RCE vulnerability from a few months back. Attackers with access to their servers could've installed malware for every user, even if they didn't install the update.

</comment></comment><comment><USER24> Kinda sucks, and I haven't followed Transmission for a while, but them transitioning more to Github is a good thing -- I trust Github more than a self hosted solution, in general. It sucks they've been compromised twice in a year, but hopefully this will help mitigate some of that.

</comment><comment><USER25> I like Transmission, but this is the second serious security problem they've had this year. Once you can forgive, but twice and it's time to look for a new BitTorrent client.

<comment><USER2> FYI: Transmission binaries are now hosted on GitHub, so it is very unlikely that anything like this can happen in the future without compromising developer machines.

<comment><USER26> Question is, how implausible do we think it is that a developer's computer gets compromised?

<comment><USER27> Well, a developer's local machine will typically be much less likely to be compromised than a always-on, publicly-broadcasted machine.

</comment></comment></comment></comment><comment><USER28> You might want to install Objective-See's free BlockBlock tool to block these type of things:

[https://twitter.com/objective_see/status/771189100355264512](https://twitter.com/objective_see/status/771189100355264512)

Also, their other (free, open source) tools are very good too, like KnockKnock and RansomWhere:

[https://objective-see.com/](https://objective-see.com/)

</comment><comment><USER29> > Am I at risk?

Instead of "Blah-blah, less than a day, go check yourself", they could grep the logs for IPs (and session cookies if they log that) of lucky winners and explicitly inform them, when they hit any page on their site. Then show generic version to everyone else. This takes all but 5 minutes to set up.

<comment><USER30> Nice idea with a major problem: If they did this, the absence of such a message could suggest that you were not affected, when in fact you could be (changed IP, cleared browser, etc).

False negatives are pretty bad in this case, better for users to check themselves.

<comment><USER29> No, you are missing the point.

It will all remain exactly as it is now, except for the case when they recognize a visitor that is likely to have downloaded the malware. In this case they should throw an extra warning.

<comment><USER30> You would be right if nobody besides the affected people would ever know that they are doing this.

But as soon as other people know or hear of it, they will go check the website to "see if they are affected". Even if the website has a huge disclaimer telling people that they could still be affected, the absence of the warning would still suggest that they are not affected, even when they could be.

</comment></comment></comment></comment><comment><USER31> This is happening too often... so, what other BitTorrent clients are you using on Mac OS?

</comment><comment><USER32> Are there any good alternatives to Transmission on OS X?

<comment><USER33> RTorrent [https://pmukhanov.wordpress.com/2014/01/19/installing- rtorre...](https://pmukhanov.wordpress.com/2014/01/19/installing-rtorrent-on- mac-os-x/)

Text console based, so it can run headless and/or in the background in a screen/tmux session.

<comment><USER34> I've been using rtorrent for years and I wouldn't ever suggest anything else. It's just so damn simple and reliable. I love the concept of watch directories too. Upload a torrent file to a specific directory, and the data will be downloaded to a specific directory. You can have multiple watch directories for different types of data.

</comment></comment></comment><comment><USER35> They say that the infected file was only there for a day, but maybe it would behoove them to do some bash-fu w/ their logs and get an approximation of the number of users affected!

</comment><comment><USER27> Wow, I downloaded a binary from the website in that exact timeframe.

Luckily, it was only the CLI version, which I was putting on an Ubuntu system...

</comment><comment><USER36> Are Transmission releases usually codesigned?

<comment><USER2> Yes. And updates are checked within the Transmission app.

<comment><USER36> Looks like it was signed by a different developer:

[https://news.ycombinator.com/item?id=12403906](https://news.ycombinator.com/item?id=12403906)

In comparison to Windows, macOS doesn't really seem to show the developer in the normal user flow.

<comment><USER37> Yep. That's at least _one_ advantage for macOS apps that use _Installer.app_ ¹ to install; _Installer.app_ makes it really easy to see the certificate².

――――――

¹ — [https://en.wikipedia.org/wiki/Installer_(OS_X)](https://en.wikipedia.org/wiki/Installer_\(OS_X\))

² — [http://f.cl.ly/items/1s1E3n19273M1l3i3S2X/developer_id_insta...](http://f.cl.ly/items/1s1E3n19273M1l3i3S2X/developer_id_installer.png)

</comment></comment></comment></comment><comment><USER38> I will be using Deluge now.

</comment><comment><USER39> Time to switch to qBittorrent.

</comment><comment><USER40> According to the article, the title is wrong

"The infected file was available for download somewhere between a few hours and less than a day."

<comment><AUTHOR> Thanks for the correction. I wrote the original title based on the warning on their homepage: "Critical security notice to users who downloaded Transmission 2.92 for Mac on August 28th or 29th".

</comment></comment><comment><USER41> I would have thought that Mac users would be a good target in general because they might have better income than Windows users...

<comment><USER42> Maybe per person, but probably not in aggregate.

<comment><USER43> Android users have way more money in aggregate, but iPhone apps make more money. This is because iPhone users have a lot more disposable income, while Android users are cheap.

<comment><USER44> Or they re more willing to spend frivolously.

</comment></comment></comment></comment><comment><USER45> Again? :(

<comment><USER46> That's what I thought as well: [http://news.softpedia.com/news/transmission- bittorrent-clien...](http://news.softpedia.com/news/transmission-bittorrent- client-website-hacked-again-to-spread-mac-malware-507771.shtml)

</comment></comment><comment><USER47> I notice that they don't sign their releases.</comment>


Verizon patents set-top box w/ camera for targeted ads - <AUTHOR> http://arstechnica.com/tech-policy/2012/12/how-to-get-targeted-ads-on-your-tv-a-camera-in-your-set-top-box/

<comment><AUTHOR> From another site reporting this news,

"Verizon gave a few examples of how the technology could be used: if a couple is arguing, an ad for marriage counseling would pop up while sounds of cuddling would prompt an ad for contraceptives."</comment>


Catching the Great American Eclipse at 35,000 Feet - <AUTHOR> https://blog.alaskaair.com/alaska-airlines/solar-eclipse/ <comment><USER2> This is nothing new from Alaska Air. I congratulate them for this! In fact this happened near Hawaii [https://blog.alaskaair.com/alaska- airlines/news/eclipse-flig...](https://blog.alaskaair.com/alaska- airlines/news/eclipse-flight/) in 2015.

<comment><USER3> Alaska is a great airline. I fly about 70k miles per year on them and am very rarely disappointed.

<comment><USER4> What do you like about them?

<comment><USER5> I also really like them as an Airline, and use them often to go to and from Hawai'i. Their staff is usually very kind and the planes are clean. I don't remember the seat sizes.. I am not a 'big' person so not an issue for me (at least yet)

<comment><USER6> They get the basics right. The seat sizes aren't anything special but that's okay for most people.

</comment></comment></comment></comment></comment><comment><USER7> another cool one is the 70's one using the Concorde: [https://motherboard.vice.com/en_us/article/8q8qwk/the- concor...](https://motherboard.vice.com/en_us/article/8q8qwk/the-concorde-and- the-longest-solar-eclipse)

<comment><USER8> Love that plane looks futuristic, reminds me of that scene from 2001: Space Odyssey

</comment></comment><comment><USER9> Does anyone have pointers on where I could get an estimate on average maintenence costs / flight hour & fuel costs for a Boeing 737-900ER?

Interested in working up a rough number for how much this cost to make happen. Can't imagine it was profitable.

And very cool!

 _Edit:_ Per Boeing [1], they quote $151 / flight hour in actual service on a 737-800. Random site [2] gives fuel on a 737-900ER as 0.17 km per litre / 0.40 NM per gallon.

 _Edit2_ : After some digging, here's the flight track: [https://flightaware.com/live/flight/ASA9671/history/20170821...](https://flightaware.com/live/flight/ASA9671/history/20170821/1409Z/KPDX/KPDX)

[1] [http://www.boeing.com/commercial/aeromagazine/aero_15/costs_...](http://www.boeing.com/commercial/aeromagazine/aero_15/costs_story.html#2)

[2] [https://www.aircraftcompare.com/helicopter- airplane/Boeing-7...](https://www.aircraftcompare.com/helicopter- airplane/Boeing-737-900ER/29)

<comment><USER10> A small sized business jet charters for about $1,000 an hour. I'd guess a long 737 would go for between $10,000 and $25,000 an hour.

Edit: Here are some charter prices: [http://www.aircharterguide.com/Aircraft/Manufacturer/BOEING](http://www.aircharterguide.com/Aircraft/Manufacturer/BOEING)

<comment><USER11> Conklin and de Decker are a respected (though not perfect) source for variable operating costs for various airframes.

They list the various BBJs (which are based on 737s) at $5360-$5749 per hour.

[https://www.conklindd.com/ReportTemp/ACEWebReports/_%20BBJ_%...](https://www.conklindd.com/ReportTemp/ACEWebReports/_%20BBJ_%20BBJ%202_%20BBJ%203_2017082520125160.PDF)

BBJ3 is based on the 737-900ER

<comment><USER9> Thanks! So that looks like ~$26,125 for a 4.75 hr flight in pure costs (fuel, plane and engine maintainence) exclusive of crew pay. If the numbers are totalling the line items above.

So call it around $50k all included.

Depreciation doesn't look like it's in that number either, but I'd say that's probably ignorable when you're as heavily utilized as a major carrier plane is.

That seems like a good ballpark number for something a carrier would agree to. Not something to do every day, but arguably worth the PR and not going to torpedo the company either.

<comment><USER11> The CdD figures usually do include crew costs, so they attempt to be "all-in" numbers, minus cost of financing.

The reason they're $0 on the report you're looking at is they're trying to sell you the report with the actual figures, not that those costs haven't been included.

Crew rates for majors are published. Here's Alaska's: [http://www.airlinepilotcentral.com/airlines/legacy/alaska_ai...](http://www.airlinepilotcentral.com/airlines/legacy/alaska_airlines)

Call the flight crew $300/hr, and the cabin crew probably another $150/hr.

<comment><USER9> Ah, was confused as they lined them up below the total line, so was assuming they might break them out.

</comment></comment></comment></comment></comment></comment><comment><USER2> Here is a picture I took after messing with the aperture and having quite a long lense [https://i.stack.imgur.com/YvyJB.jpg](https://i.stack.imgur.com/YvyJB.jpg) from Robinsville NC. I swear you can see stars in there but could be wrong.

<comment><USER12> Mercury was visible to the naked eye, but I didn't see much else. Was not really looking for stars though.

Nice shot, btw.

<comment><USER13> Where I was watching (the "day tripper" area at Solartown in Madras, Oregon) there was one bright point source reasonably near the Sun which I assume was Mercury [1]. Overall the sky was brighter than I expected, and if there were stars visible there were not many of them.

There was also some idiot's drone buzzing above us, with red lights on two of its opposite arms and green lights on the other two arms.

[1] or rather, I assume it was the same planet you saw.

<comment><USER14> That was Venus. not Mercury.

<comment><USER15> It was neither. It was Regulus. Mercury was further away (still relativelly close) and Venus was much further away.

<comment><USER15> Amazing how one gets downvoted for stating simple, trivially verifiable facts.

[https://i.imgur.com/VYqvYHAr.png](https://i.imgur.com/VYqvYHAr.png)

[http://www.americaneclipse2017.org/maps/the-sky-during- total...](http://www.americaneclipse2017.org/maps/the-sky-during-totality/)

[http://www.skyandtelescope.com/astronomy-news/observing- news...](http://www.skyandtelescope.com/astronomy-news/observing-news/total- solar-eclipse-all-sky-maps/)

</comment></comment></comment></comment></comment></comment><comment><USER16> I travelled last minute London -> Chicago -> Portland -> Salem to see my first total eclipse. The Saturday night flight to Portland was packed with excited passengers, all talking about the eclipse. The captain (Spirit Airlines) even announced the flight as the 'Eclipse Express', to cheers from everyone.

</comment><comment><USER17> I was watching the eclipse in Corvallis and, about 10 minutes before totality, a plane jetted around at high altitude and left a contrail[1]. The new cloud, in the otherwise perfectly clear sky, began to drift toward the sun and I thought, "There could be few better symbols of the attitude that some of %0.0001 have to the rest of us than this." Fortunately, even though the contrail did drift over the sun during totality[1], it was very thin (and dark) and did not distract and the event in the least.

I'm glad Alaska Air did this flight over the Pacific and not where they would distract hundreds of thousands of people with their flight. Anyone know how to find out what flight (or private jet) was the one I saw was? Would be an interesting fact to add to my memory of the event.

Please forgive the many artifacts from this smartphone camera.

[1] Before totality ([https://njarboe.com/eclipse/beforeTotality.jpg](https://njarboe.com/eclipse/beforeTotality.jpg))

[2] During totality ([https://njarboe.com/eclipse/totality.jpg](https://njarboe.com/eclipse/totality.jpg)). This photo was right at the beginning of totality and in no way captures what I saw, but does show where the contrail ended up. I was more interested in experiencing the eclipse than trying to get a photo.

<comment><USER18> Fascinating that you have no idea what flight it was, but you immediately chalked it up to another example of "the 0.0001%" harming you.

That's pretty ridiculous. For all you know, it was on some kind of humanitarian mission. Statistically, of course, it was probably just a routine commercial jet full of average people.

What's crazy to me is someone on the ground in a small town thinking that the global ATC system should route around them (and apparently all small towns and random gatherings of people) so that they won't miss seeing an eclipse.

<comment><USER17> Earlier in the day, before the eclipse, there were a dozen or more private jets flying over my sister's place into the local airport when the previous days there were none. Some even had to circle (to wait for others to land?). This probably primed my mind about private jets. Then this jet was not just flying straight through but came from the south, turned to the east, and then headed south. Could have been NASA? That is why I was querying about how one would find out about it? My thought about it was more of how perfect the symbolism would be if the jet was say Ellison's than a knee jerk reaction against the 0.0001%. The efforts and accomplishments of many 0.0001% er's have brightened my life over the years and I wish most of them the best of luck.

<comment><USER19> Did you do a replay on one of the ADS-B sites?

Try fr24.com, you can go back one month without an account I think. Convert your local date and time to UTC.

Here you go, jiggle the time slider around a bit. This is for 17:00 UTC, 09:00 PDT, on 21 August 2017:

[https://www.flightradar24.com/2017-08-21/17:00/12x/44.61,-12...](https://www.flightradar24.com/2017-08-21/17:00/12x/44.61,-123.26/9)

You can pause and click on an aircraft icon for more information. Some will have their registrations blocked on request but usually have their type indicated ( so you can determine bizjet or airliner ).

<comment><USER17> That is a cool website. I would guess the plane is the one labeled FA7X on this site. Looks like it came from Boeing Field, flew out near Newport on the coast, followed the eclipse path just north of Corvallis out to eastern Oregon, and then back to Boeing Field landing around 10:54am Pacific. It was going fast and at high altitude (about 41,000ft and 430 knots), unlike most of the other planes in the area. Its altitude probably explains why it was the only jet creating a visible contrail. If this was the jet, it shows how bad eye witness testimony can be as it flew almost due east over where I was. The site says its a Dassault Falcon 7X; so a bizjet type plane. No tail number like many other planes shown. A quick google did not get me a list of the planes in and out of Boeing Field that day, but I would imagine it's available somewhere.

<comment><USER19> Glad you found it. The 7X is popular for eclipse hunters, they can cruise high and stable and have good-sized windows and can take about 18 people with all their kit; they also form their contrail aft of the tail due to the engine location, so less interference for photography.

I have a couple of friends who flew on one over the Faroes during the 2015 eclipse, there were more than a dozen chartered aircraft circling for that one.

</comment></comment></comment></comment></comment></comment><comment><USER20> Best part of the video: [https://youtu.be/8FwF1DvksIQ?t=52s](https://youtu.be/8FwF1DvksIQ?t=52s)

<comment><USER21> Agreed. Seeing the moon's shadow racing across the Earth was pretty damned slick.

</comment></comment><comment><USER22> I was on this flight, and it was incredible! AMA

<comment><USER23> What was it like EXITING totality? Was it like God said, let there be light?

<comment><USER22> It was pretty incredible. The "diamond ring" really bursts out over the edge of the moon, and then it's glasses on or look away, because the sun's back.

</comment></comment></comment><comment><USER24> How much do flights like these cost?

<comment><USER22> You couldn't buy a ticket, invite and media only.

</comment></comment><comment><USER25> How much did the guest have to pay?

</comment><comment><USER26> How many planes crossed the total solar eclipse's path? probably a bunch...

</comment><comment><USER27> Concorde (or the Tu-144) could've kept up with the shadow

<comment><USER28> They did this on June 30, 1973. While it stayed in totality 10x longer than would have been possible on the ground, it did not stay for the entire path of totality. Look at the umbral velocity - only the bottom of the parabola is obtainable by even a Concorde.

[http://xjubier.free.fr/en/site_pages/solar_eclipses/TSE_1973...](http://xjubier.free.fr/en/site_pages/solar_eclipses/TSE_19730630_Concorde001.html)

</comment></comment><comment><USER29> But it`s kinda very beautiful !!

</comment><comment><USER30> God that music...

</comment><comment><USER31> Who's ready for the next one?

</comment><comment><USER32> steve mnuchin is that you?

</comment><comment><USER33> Did people really call it the Great American Eclipse? I hadn't seen that phrase before this.

<comment><USER22> Yep, I think it was a Twitter trending topic.

</comment></comment><comment><USER34> Is anyone else bothered by the term "American" eclipse? I don't think astronomical events have any notion of nationality.

<comment><USER35> It was the first Total Solar Eclipse to be seen over North America since the 70's...

<comment><USER36> First total solar eclipse visible in the contiguous U.S. since 1979. Not first over North America if Mexico is in North America. Mexico in 1991.

<comment><USER37> The August 1, 2008 total eclipse started in northern Canada.

</comment></comment></comment></comment><comment><USER38> >Great American Eclipse

That is rather egocentric to be honest. It is just a solar eclipse that happened to be visible in the U.S. this time.

[https://en.wikipedia.org/wiki/List_of_solar_eclipses_in_the_...](https://en.wikipedia.org/wiki/List_of_solar_eclipses_in_the_21st_century)

<comment><USER39> I disagree. Calling it the 'Great American Eclipse' is fair because it crossed over the entire country coast to coast making it accessible to just about every major population center by car. It was also only visible in America.

That's pretty neat.

<comment><USER40> The title really rankles me -it was a brilliant eclipse and it was an eclipse only viewable in America, I understand this completely but it still rankles possibly irrationally.

I am not opposed to calling things American when, like I am not opposed to calling the 20th Century the American Century but there is something deeply annoying in claiming an astronomical thing as one's country.

It's like a form of possession and maybe its the Sun but for some reason it really really annoys me to give the event an American adjective.

<comment><USER41> You should ideally be more annoyed at a century being called the American century because it's insulting to all the other people and nations who also existed and were doing their shit. On the contrary, the eclipse literally did not exist for those outside America.

<comment><USER40> But it is equally also not something you owned that is the only point I am making - noone is saying 'literally' it's the world's eclipse, it just rankles when someone takes possession of something they do not own - rational or irrational. Perhaps something more interesting to explore would be me and 10 others in the thread above think that way.</comment></comment></comment></comment></comment>