JPMorgan Says Data Breach Affected 76M Households - <AUTHOR> http://www.bloomberg.com/news/2014-10-02/jpmorgan-says-data-breach-affected-76-million-households.html <comment><USER2> The real losers when this happens are the small businesses and nonprofits with recurring payments that have to contact their customers and ask them to reenter their new credit cards after they are replaced. Even in the best case, they're probably out a months revenue which can make or break a company.

<comment><USER3> If reminding customers that they are actually making recurring payments to a company causes that company to go out of business, I don't think we need to shed any tears.

<comment><USER4> I think he meant that a sudden huge drop in recurring revenue out the blue can sink a small business while it's getting established.

I could see that.

</comment></comment></comment><comment><USER5> The amount of private data about individuals that JP Morgan has makes it a very attractive target to attackers despite any difficulty (perceived or real) it takes to get the data.

Extending that logic, it means the NSA is an even more worthwhile target for attackers, because they have far more private financial data about individuals in the USA and people abroad. But you can bet that when (not if) a breach of the NSA happens, it will never be reported to the public.

The only solution here is to do away with these centralized stores of all our private and financial information, so the incentive for these attacks no longer exist. There's no amount of technological hardening that will prevent a determined attacker (state sponsored or otherwise) to give up, when the reward for a successful attack is so high. Until then, reports of massive data breaches are going to be more and more common.

<comment><USER6> What kind of decentralized storage are you proposing? How should a bank keep track of costumer accounts?

<comment><USER7> I think he was suggesting everyone stores the minimum of what they need to function. No more, no less.

<comment><USER8> The minimum of what a bank needs to operate includes your phone and contact details, social security number, your financial account number, your credit card number and your credit rating, for sure? Because, you know... they provide many of those number to you!

</comment></comment></comment></comment><comment><USER9> There are approximately 115M households in the US [1], so does this mean that two of every three households is affected by this data breach? If so, why isn't there more panic?

[1]: [http://quickfacts.census.gov/qfd/states/00000.html](http://quickfacts.census.gov/qfd/states/00000.html)

<comment><USER10> Because nobody will be liable. If there's fraud on my credit card, I just phone Chase and they'll reverse the charges. In the scheme of daily irritations, this ranks well below a parking ticket.

<comment><USER11> Your not wrong.

Especially if you have been through it before, the apparatus for handling fraud, reversing it, and cleaning things up is so tight that it's hardly even distressing anymore. The biggest annoyance would be updating any recurring payments from that card.

Which got me thinking: How much of my bank fees are spent on fraud prevention and clean up? How much cheaper could credit card processing and banking in general be if banks didn't need to spend BILLIONS of dollars in infrastructure, procedures, and automation to make these fraud cases go so smoothly?

<comment><USER12> The sticking point is that banks don't want to invest in a new system unless they can shift liability to the consumer, which is unpopular for very good reasons.

</comment></comment></comment></comment><comment><USER13> Nobody is really addressing the root of the problem here - that credit card security is a total joke.

The way the credit card system works is we all send the keys to our accounts in _plain text_ , and then store it in _plain text_.

Rather than come up with a more secure means of payment, the credit card companies force every customer to check every monthly bill on every credit card to make sure none of it was fraudulent, and somehow this is more "convenient" than using a secure method for payment.

<comment><USER14> The credit card number is _both_ your public key _and_ your private key: [http://www.icanbarelydraw.com/comic/2702](http://www.icanbarelydraw.com/comic/2702)

Related:

" _Vandalism By Design_ "

[http://www.icanbarelydraw.com/comic/2570](http://www.icanbarelydraw.com/comic/2570)

[http://www.icanbarelydraw.com/comic/2574](http://www.icanbarelydraw.com/comic/2574)

[http://www.icanbarelydraw.com/comic/2674](http://www.icanbarelydraw.com/comic/2674)

" _Should We Accept Dollars?_ "

[http://www.icanbarelydraw.com/comic/2565](http://www.icanbarelydraw.com/comic/2565)

[http://www.icanbarelydraw.com/comic/2697](http://www.icanbarelydraw.com/comic/2697)

[http://www.icanbarelydraw.com/comic/2706](http://www.icanbarelydraw.com/comic/2706)

</comment></comment><comment><USER15> It seems odd to quantify this by "households". Is this normal? Per Wikipedia there are only 117m households in the US. So they are basically saying close enough to everybody. But then I am surprised that JP Morgan even has that percentage of US households as customers in the first place!

<comment><USER16> Don't forget all of the acquisition activity over the last ten years. Providian was bought by Washington Mutual, which was taken over by JP Morgan. Add to that BankOne from the early 2000s, Bear Stearns, several other regional banks, and their massive student lending network and it's not unbelievable that they reach so many "households" even those households don't bank directly with Chase.

</comment></comment><comment><AUTHOR> I apologize for this thread being slightly duplicative of another submission.

One thing which jumped out at me from this story but was not mentioned in others was that the attacks had been traced back to servers in a Russian data center. I wonder if and how we can distinguish between:

\- Criminal hackers exploiting lax or less capable Russian law enforcement, or

\- Criminal hackers operating with the studious indifference or tacit acceptance by Russian law enforcement, or

\- State-sponsored espionage expressing a retaliatory or threatening posture in response to western sanctions against Russia.

It's very hard (as a consumer) to gauge whether the main problem here is corporate negligence, very well-supported attacks, or excess organizational size and complexity...or some combination of these 3 factors.

<comment><USER17> There is a third option. Domestic hackers who route all their attacks through places like Russia or China for the ease of deflecting suspicion/blame.

<comment><USER18> This is important. It's all too easy to route and obfuscate your trafic so that it appears to come from anywhere in the world you want. Given that, for example, the US already officially declared that they will respond militarily to a sufficiently annoying cyberattack, and that is rumoured[0] to include going (literally) nuclear, people in power should _really_ remember that just because a cyberattack seems to originate from country X, doesn't mean country X is in any way involved.

[0] - I _think_ I saw something implying this in official statements, though I can't find any good source that would confirm it right now; however the idea was discussed in media.

</comment></comment></comment><comment><USER19> I think what should happen is there should be laws that place sanctions on these companies for negligence in failure to secure their systems. That money should then go into a fund to provide security monitoring and consulting/auditing services for these businesses, retribution for those who have suffered losses due to the breaches. They clearly can't get it together and there needs to start being punishments (fine/jail) for the IT executives responsible. I hate to approach a problem with more regulation, but market forces haven't been working. I think there should be at the minimum threat of personal consequences for the executives if it is found they were negligent in their duties in any way to provide reasonable security for their systems, and to have processes in place to review code to ensure it does not have blatant security issues.

<comment><USER20> This is a horrible idea. It will immediately stifle all innovation in software. The only laws I would be in favor of are required transparency laws where you have to report all breaches with serious fines/jail for failure to comply.

The market will quickly sort things out if it has the appropriate information. People can then decide what privacy is valuable for themselves.

<comment><AUTHOR> _The only laws I would be in favor of are required transparency laws where you have to report all breaches with serious fines /jail for failure to comply._

This is already the case. The information comes from JPM's (mandatory) SEC filings. I forget the time frame but stuff like this (information that could reasonably be expected to have a material impact on the stock price) has to be reported within a pretty narrow window of becoming known to management, like 72 hours or so.

 _The market will quickly sort things out if it has the appropriate information._

By all appearances the opposite is true. I mean, where do you move your business to? I have no idea which is the most secure bank, only which ones have so far discovered and reported breaches. Neither Target nor Home Depot seem to have been punished very severely by the market if their stock prices are anything to go by.

<comment><USER20> What was the actual information taken? How was the breach perpetrated? Two pretty big pieces of information we are missing. There may also be daily breaches that aren't significant enough to impact earnings that we never hear about.

No, we do not have any kind of transparency.

The second issue (where do I go?) can't be worked out at all until we have some idea of "where do I really not want to be?"

<comment><AUTHOR> First you said you wanted a report of all breaches, now you're asking for the investigation to be run in public - rather a massive move of the goalposts. Without expressing any sympathy for the banks, I'm having trouble thinking of any business that would be willing or even able to do business under such conditions.

<comment><USER20> No, what I'm saying is that we don't have transparency in the reports. All we get is "something happened", with very few details of what "something" is. My goalposts never moved; only your interpretation of them.

Would you not agree that a data breach brought on by a disgruntled employee selling records is materially different than the same data breach caused by failure to patch systems? I don't care about the investigation (where did you get any implication I think investigations should be public); I care about the results.

<comment><USER21> This sentence:

>>Would you not agree that a data breach brought on by a disgruntled employee selling records is materially different than the same data breach caused by failure to patch systems?

Directly contradicts this one:

>>I don't care about the investigation (where did you get any implication I think investigations should be public); I care about the results.

The result is that people's credit card information got stolen. The investigation and the details -- i.e. whether it was an internal or external breach -- are not relevant to me as the customer.

<comment><USER20> Perhaps you have a different definition of investigation than I do. I see the investigation as the active bit where you are talking to people, looking through logs, trying to figure out what happened. At the end of that, you would have a report that said "this is what happened: this is the data that was lost and this is how it was done". That doesn't imply that every interview and every log file gets published.

Of course there is going to be some level of sanitization, but today we get no information beyond "we lost a bunch of data" (oh, look, they told us names, address, email, "and other information used to categorize customers", whatever _that_ means).

If you decide it's not relevant to you, brilliant. Don't pay attention to it. It is relevant to me, because I don't have any other way to decide who I should trust with my information security. A company losing hundreds of credit cards a day to hundreds of different hacks is much less secure in my mind than a company that loses 70M names and addresses (as far as I know, the Chase hack did not expose credit cards; mine was not replaced). The former goes unreported; the latter gets splashed all over the news.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> " The number of households affected by the attack on JPMorgan [76 million households and 7 million small businesses] compares with the 145 million personal records taken earlier this year in a breach of EBay Inc. and last year's attack on retailer Target Corp., which affected 110 million. "

Do 'responsive firewalls' exist, that would close a hacked connection just because of the size of the data that is flowing out?

[I have often thought a firewall would be a good golang project]

<comment><USER23> Typically the perpetrators in these cases will trickle the data out over a very long period of time, thus evading many alarm triggers.

<comment><USER22> What patterns would show up?

</comment></comment></comment><comment><USER24> As a Chase customer (checking/auto) who happens to be an eBay user that shopped at Target during the data breach, this is getting really old. I wonder at what point do companies start requesting we change our account numbers (similar to passwords)?

<comment><USER25> This will simply force the US towards more European style chip & pin style cards. But it will also massively accelerate the adoption of things like Apple Pay where the vendors never get access to your credit information or personal information at all.

Not that it helps a bit if they are hacking banks however.

<comment><USER26> Chip and Pin would have prevented zero of the accounts escaping Target.

There was a complete lack of encryption at key points.

<comment><USER27> Chip and Pin would prevent _none_ of the leaks, it would prevent the usage of the stolen card numbers after the fact.

<comment><USER26> Ok, let's think this through. The chip is embedded in the card, and works if you bring the card physically to the POS terminal.

The chip is _not_ part of the equation for online transactions. So if everything but the chip is stolen, the bad guys are going to use the card online.

Check out [http://krebsonsecurity.com/2014/05/the-target-breach-by- the-...](http://krebsonsecurity.com/2014/05/the-target-breach-by-the- numbers/), particularly his "by the numbers" section:

 _0 – The number of customer cards that Chip-and-PIN-enabled terminals would have been able to stop the bad guys from stealing had Target put the technology in place prior to the breach (without end-to-end encryption of card data, the card numbers and expiration dates can still be stolen and used in online transactions)._

<comment><USER28> The PIN system as used in Europe (or at least where I live) always requires you to physically enter your PIN-Number with any purchase, even online. The card alone is useless as you MUST enter the PIN-Number, and 3 wrong tries blocks the card permanently. To make purchases online your bank would send you a small device which takes: a number supplied by the online website indicating your purchase, your card and then asks you for a PIN-Number. It then does some magic and outputs a number that you would need to verify the purchase.

It seems that this is not that same type of system or am I mistaken in some way? Seems to me that it would have helped; my account number/card number/exp. date are useless on their own.

</comment></comment></comment></comment></comment></comment><comment><USER29> If someone is looking for an impossible problem to solve and be paid well: JP Morgan is spending a quarter of a billion dollars this year to achieve list level of security.

</comment><comment><USER30> Is there a breach notification list (somewhat similar to A CVE list) where companies can (anonymously at first) notify the world early and then publish technical post mortems.

Saying "76m records lost" is ok for headlines but like air traffic investigation we want to improve the whole system.

<comment><USER31> Yes - check out [https://www.fsisac.com/](https://www.fsisac.com/)

</comment></comment><comment><USER32> I haven't seen this mentioned anywhere, but Chase isn't sending email about this to their customers. If you login there's a notice, and certainly many people get updates via the news, but the lack of direct-to-customer communication is disappointing.

</comment><comment><USER33> The silver lining here is that as these breaches become more and more common businesses and financial institutions will be forced to get more serious about security. Chip and pin can't come to the U.S. fast enough.

<comment><USER34> Nah, they'll just go about their business after offering everyone a year of free credit monitoring, and wait for the next security breach. Nobody from these negligent companies are going to jail, so none of them are going to change the way they handle security.

<comment><USER35> You obviously do not work for a company like JP. Fear of jail is not the only motivator to address the gaps that led to this breach. There are likely hundreds of people there who are intensely motivated and now assigned to address this, driven by professionalism to work as quickly as possible.

</comment></comment></comment><comment><USER36> Will we ever reach a point where large scale security breaches are a rarity rather than the norm. I feel like some of these recent issues should have been preventable.

<comment><USER37> Probably not. The space of potential security holes is very large. A would-be attacker only has to find one viable one, while the people defending against those would have to find them all. There are lots of tools to stop people from opening up well-known holes, but most issues are only "obvious" or "preventable" in hindsight.

</comment></comment><comment><USER38> How soon until ALL database fields that contain personal information are encrypted so that if a hacker gains access to the data it is useless without the programs to actually access it? Why aren't we encrypting addresses, and SSN, and email, and phone number? Is this information not as important as a CC number? I think that we are starting to see that this might be almost as important if not on equal footing as our CC numbers.

<comment><USER39> Encryption comes with overhead of some sort, this far, it's not worth it. (Apparently)

<comment><USER38> I find it hard to believe that a company line JP Morgan, the largest bank in the US can't afford to put enough computing power to reduce this overhead..... at $6 billion in profit in just the 2nd quarter alone I think they could afford to invest a couple of million dollars to make sure their customers' data is better secured.

<comment><USER39> I didn't say they couldn't afford it. I said it worth it (i.e. it's not profitable).

<comment><USER38> Lets think about this.... if they can spend maybe $10 million to be able to say to their customers... "We had a breach but your personal data was encrypted with the latest technology and is safe" vs "We had a data breach and 76 million house holds now have personally identifiable information up for sale across the black market."

Do you think that the goodwill from the first statement would save them $10 million? My bet is that a bank actually being able to say that a breach was a non issue because they had actually taken all possible measures to protect your data with them because they actually might care about their customers just a tiny bit would easily drive them in a positive direction both in the short term and the long term.

</comment></comment></comment></comment></comment><comment><USER40> Do we have details on the methods used in the breach? Was it via a Trojan in an email or direct attack on vulnerable front end server?

</comment><comment><USER41> My wife just had her credit card hacked probably as a result of this (we are both with Chase). What a pain to have to deal with getting a new card and updating all the auto-pay stuff. Plus, this is probably the third or fourth time this has happened to her. They said they arrested the person, who had bought a burrito in San Diego.

<comment><USER42> From what I've read, there is no evidence of the hackers doing anything with the data they found yet. So your wife was probably the victim of some other hack (Home Depot?) or method (atm skimmer, etc.).

</comment></comment><comment><USER43> Woah! I'm glad I closed my accounts with Chase this weekend. I can't say that they have better security, but IAFCU[1] is a much smaller target.

[1]: [https://iafcu.org](https://iafcu.org)

<comment><USER35> And has a much smaller information security budget, but many of the same vulnerabilities as Chase....

</comment></comment><comment><USER44> This in the latest of a long string of security breaches makes me very happy that Apple is moving forward on tokenized payment systems and hopefully dragging many other companies along with it.

</comment><comment><USER45> In 20+ years with advent of decentralised banking (btc, etc) such stories will be impossible. Decentralised banking will not only affect security but overall money distribution in the world.

</comment><comment><USER46> Dumb question: is there an insurance service to ensure a company against errors made by their _own_ software developers?

<comment><USER47> In a roundabout way: you can insure against data breaches and costs associated with it, etc.

And if you're contracting you'd better make sure you have indemnity insurance yourself: it's something software engineers who start freelancing often (always?) overlook. But you can bet that if - for example - some security breach was pinpointed to code that you had written as a freelancer that your client will come after you.

</comment></comment><comment><USER48> Have any details come to light on how exactly the hack was achieved?

</comment><comment><USER49> Does anyone here know anything about the nature of the attack?</comment>


Ask HN: Can a smart meter be made to lie to the Grid? - <AUTHOR>

Maybe some among here might be working in the Smart Grid ecosystem and could help answer this question:
As Smart Meters become ubiquitous, for the sake of argument Can someone maliciously (using whatever exploits applicable at the moment) gain control of a number of smart meters, and would it then be possible to make those smart meters lie about their power usage to the utility grids? Then, they could create a botnet of these compromised smart meters and in turn convince the grid to pump more power to them and in the process, trigger rolling blackouts at other locations? A Denial of Service of sorts.. Is that possible?
Maybe someone here can tell me it is, but improbable, or its not and will never happen. <comment><USER2> Hacking smart meters is definitely possible, but you can't hurt the grid that way because meter data is only used for billing.

[http://rdist.root.org/2010/01/11/smart-meter-crypto-flaw- wor...](http://rdist.root.org/2010/01/11/smart-meter-crypto-flaw-worse-than- thought/)

<comment><USER3> There are smart meters that let the utility have some control over when air conditioning and other large appliances (washers etc.) are powered on. I think it would be pretty easy to maliciously turn _on_ those devices when the utility sends the command to turn them off, e.g. crank up the A/C and spin up the dryer when power is already in high demand.

</comment></comment><comment><USER4> There was a seminar at UC Berkeley on this, on 8-April (I didn't attend, though, and can't attest to its quality).

Link to a video: <http://www.youtube.com/watch?v=nj64jVIvKQU>

From the seminar abstract:

The smart grid will use automated meters, two-way digital communications technology, and advanced sensors to save energy, improve electricity efficiency and reliability. Use of these systems exposes the electrical grid to potential cyber security and privacy risks. For instance, there have been media reports of fears that a hacker could gain control of thousands, even millions, of meters and shut them off simultaneously; or a hacker might be able to dramatically increase or decrease the demand for power, disrupting the load balance on the local power grid and causing a blackout.

</comment><comment><USER5> What you've imagined is pretty elaborate. You're assuming that meters can 'request power' and have more directed to them, and somehow this causes a blackout (nothing in your statement said everyone's microwave & A/C switched on at the same time, now that's how you cause a blackout). Since the goal of the smart grid is the opposite -- "demand-response" -- that is, getting appliances to 'turn off' or go in to a low-power mode when there isn't enough supply, the scenario you imagine is unlikely.

That said, I'm sure we'll here of some amazing hacks that we didn't imagine ahead of time. :)

EDIT: Ok, didn't think of this when I originally replied. Meters are being issued with a "Remote Disconnect" feature so utilities can disconnect non- paying customers. Seems like that will be hackable.

<comment><USER6> That still seems to be open to attack. Force all meters to low-power mode to cause a "blackout", or perhaps fast cycle power modes in attempt to hurt poorly made equipment.

<comment><USER7> In Florida, we have FPL On Call[1], a smart meter program that allows the power company to turn off your A/C, heating, water heater, or pool pump. I suspect that if my A/C got cut off in the middle of summer, I'd probably just use the pool 8)

But yeah, the fast cycling would probably break something.

[1]: [http://www.fpl.com/residential/energy_saving/programs/oncall...](http://www.fpl.com/residential/energy_saving/programs/oncall.shtml)

</comment></comment></comment><comment><USER8> You could probably hack the smart meters, but how should `pump[ing] more power to them' work? The utilities just try to hold the voltage constant, as people are drawing power.

</comment><comment><USER9> The ComEd (Chicago area) "smart meters" are really just recording meters, but there is the option to have ComEd automatically cycle the load to your A/C compressor when the real-time price gets too high.

I guess one could play havoc with that, make the utility think all the load guards are operating when they're not, or vice versa. Don't think it would be enough to whipsaw the grid into chaos unless everyone has it. Right now adoption is pretty low.

</comment><comment><USER10> See the work of Travis Goodspeed [http://travisgoodspeed.blogspot.com/2010/03/smartgrid- skunkw...](http://travisgoodspeed.blogspot.com/2010/03/smartgrid- skunkworks.html)

</comment><comment><USER11> Meters are not just straight up kW/h devices. They can be used for power quality analysis, fault analysis, and whatever else the supplier can meter. <http://www.selinc.com/metering/>

Note that in certain deployments you might have meters operating as sensors (SCADA type setup), then some sort of central station running logic. So you of course can consider that an architecture for a hacker to exploit.

For a brief note, this describes what happens: [http://www.smartgridnews.com/artman/publish/commentary/Why_Y...](http://www.smartgridnews.com/artman/publish/commentary/Why_Your_Smart_Grid_Must_Start_with_Communications-526.html)

You can find some information in relation to this here: <http://blog.iec61850.com/> which is run by <http://nettedautomation.com/>.

Cybersecurity in the power industry is a rising wave. It's been growing, but Stuxnet really drew many eyes onto SCADA / power systems in the industry.

</comment><comment><USER12> Most of the smart meters aren't billing rated currently. Also the meter's don't control how much electricity is generated.

As far as device control goes most of them only turn on and off simple switches. The only area that is of concern is running people's furnaces or air conditioning too much. Lots of vendors are moving away from directly controlling the temperature and just focusing on controlling energy usage.

</comment><comment><USER13> Wouldn't the utility have smart meters at its own nodes? In other words, they should be able to tell when the data gathered beyond a node that something doesn't add up. Then they can look at usage patterns and find out what changed.

Will the big, slow utility do this? Eventually.</comment>


Ask HN: Is web app "specific gravity" a good metric? - <AUTHOR>

I realized, like many of us, that I have been consuming a lot of tasty, long form content on Medium lately. It has evolved exactly into a kind of macro-micro-blog.
But yesterday a page was loading slowly, despite the minimalist layout and I decided to "view source" to find the culprit. And there was a 40K LoC closure compiled behemoth.
The Medium home page contains about 25 story links. The web app loads about 500kB (gzip) of html, js, css. Ignoring images, and assuming each story link contains about 1kB of information this yields a very low info to app density.
Formally we define the web app information density to be the amount of human-usable information on the page (number of unicode chars * 16-bits for example) divided by the size of the web app payload. The value can be normalized against some "ideal" value for comparison sake.
Is this a meaningful metric?
And is Medium.com's 8% specific gravity optimal? <comment><USER2> I think measuring "human-usable information" is a slippery slope. You'll start with just believing that only human-language text qualifies, but the definition can be pushed.

For example, "human-usable information" could be added by changing the color of certain words. If our site is meant to teach English, changing all nouns to the color green is useful and definitely "human-usable information," right? But how do you measure the amount of information it conveys?

It's ultimately very philosophically hard. This matters because a webapp's assets (images, styling, scripts) are as much a part of its content as the actual text on a page. But if you confine your definition to encompass only human-readable text, I don't think it's useful.

<comment><USER3> And good like trying to deal with image size and resolution...

</comment></comment><comment><USER4> Professional Web Analyst here. My day job is working with metrics on web sites. I'll try and weigh in.

First, we can argue and pontificate and philosophize all we want, but ultimately there is no proof of the pudding except the tasting. This is a falsifiable hypothesis. It can be tested, so it should be tested.

That said... I can see two potential issues with this metric.

1\. It's a ratio metric. Whenever you metric by taking two numbers and combining them into a single number (in this case, by division), you are losing information. You are saying that several very different scenarios are basically equivalent. You are saying that your current density of 25 story links in a 500KB app, is basically indistinguishable from 1 story link in a 20KB app, which is also the same as 500 story links in a 10MB app.

It also means that there are two ways to "improving" this metric. If you want to double the current density of 5% up to 10%, you have two options: One is trimming the fat from the app so it takes up half the space. The other is making your stories twice as long. Your metric will not distinguish between these two cases. I'm not sure that's a good thing. In particular, having stories twice as long has no impact whatsoever on the homepage.

2\. It's a "means-to-an-end" metric. If this metric is meaningful at all, it's because of the relationship to content load times and how much extraneous junk is on your homepage. But... you can just measure load times and homepage click-through directly, and optimize for those. This provide additional value beyond what those metrics give you. If anything, it provides less value by over-focusing on just two things, which is only one part of content load time, and is only tangentially related to design bloat.

If you've already decided that content load times are unacceptable and you want to make them faster, this is a metric that you can look at and it will make an engineer say "huh" and give you an idea of how much room for improvement it is. You can use it as a benchmark, and compare to other apps to get an idea of whether your design can be streamlined. But setting this as a top-level metric and optimizing for it is just as likely to lead you astray as to have a meaningful impact. And if your content load time is already acceptable, I don't see the value in what this brings.

tl;dr It has use as a secondary metric, if you've already decided to slim down your page, to compare against other sites and give an idea of how much you can improve. As a top-line stat, improving this metric does not have a strong connection to improving your app.

</comment><comment><USER5> How would you measure, say, Google Drive's specific gravity? GitHub's? I'm confused because you use a single page as a representation of the entire application.

</comment><comment><USER6> The information density of English text itself is also fairly low. Regardless, the metric you are proposing is not only bad it's also dangerous.

What you want to measure is how "good" is this site? But you can't measure goodness easily, so you use different proxies like number of returning visitors, how long each reader stays on the site and also the average latency of page loads.

How large a web page is, in bytes, though, is not a good proxy for anything. It has a marginal impact on latency (which is much more dependant on _how_ you serve the page, if you use gzip, cdn:s, blocking javascript files etc) but other than that it's not a relevant metric for "web site goodness."

</comment><comment><USER7> I think I'd be a lot less happy if I worried about things like this.

</comment><comment><USER8> I think it's an interesting metric that can act as a starting point for a more in depth understanding, but by itself its pretty hollow.

<comment><USER9> Good idea.

The metric seems like it could show false positives for pages, that have "bad" values, so you could investigate if it's okay or not.

But when it shows a "good" value, it has probably a size that matches the content and nothing is critical.

</comment></comment><comment><USER10> Sounds great, and no, that doesn't seem optimal--1.7MB total for those 25 links.

But that seems to be where we're at now, unfortunately.</comment>


Facebook is the first to jump into ARM servers - <AUTHOR> http://semiaccurate.com/2010/08/23/facebook-first-jump-arm-servers/

<comment><USER3> For a fleet of "scale-down" servers to be practical the first problem is that the admin cost per server must be very low. With, ohhh guesstimate 70,000+ servers, Facebook presumably has that metric under control.

Next, certain types of workloads don't make sense. Anything CPU-bound or poorly scalable (eg. traditional database workloads). Again FB should have plenty of work that scales out relatively effortlessly (note the relatively) and have moderate memory and bandwidth requirements per process. Though in the aggregate you'd expect very large usage of both!

For suitable workloads, working back of the envelope, ARM will hopefully lead to some highly competitive, if not new record, scores on metrics like requests/joule or requests/$. Enery consumption and server cost being important at that scale..

Now for the in-memory caching or database workloads, which want either more memory or faster CPUs, Flash can be used to address capacity at the cost of a couple of orders of magnitude extra latency - albeit a couple less than hitting disk. Back of the envelope, anything that looks too much like a traditional database workload I'd leave on grunty x86 machines. Ditto for any CPU-bound.

So, lets speculate on how to build a machine based on ARM for the types of workloads we care about. Lets assume we don't design a new core but work with a vendor on a System-on-Chip using ARM hard macros. This is very back of the envelope and we'd need to break out spreadsheets to get this nailed down right.. but lets have some fun..

Our hypothetical SoC would be

. Cache-coherent quad-core Cortex A-9 @ 2GHz . PCIe interface on chip . 1Gb ethernet interface on chip . SATA ports on chip . Memory controller

connected to 4GB ECC memory per server. I'll get back to storage.

Now, this should be small and quite low power server. Within a 1U sled we should be able to pack say 6 or perhaps 8 of these, along with dual power supplies (for the entire sled of machines). If possible I'd have distributed power redundancy by including a battery in the sled rather than hooking up to external UPS.

I'd use an internal 1Gb switch which itself is connected to the top of rack switch. We get local cheap communication between the servers, plus we make cabling significantly easier and keep the cost of the top-of-rack switch down. A more whacky alternative would be to use short-range radio. Fewer wires, potentially more bandwidth, but something I'd like to hammer on in the lab before going anywhere near the datacenter.

Now, for the pesky 4GB per server memory limit and storage. We have a few interesting options. We can add flash per server, or, given the $/GB perhaps one machine in the sled gets it and acts as a local memcached server with the ability to fall back to accessing remote ones. We could also have a local file server with, for example, 1TB of storage via 2 flash-augmented disks (eg. seagate momentus xt disks). With good staging of data, we could even make this sled a good building block for throughput-oriented data-intensive work (eg. mapreduce type work). We have lower IO bandwidth but we've also kept the CPU performance down to levels where we have a fighting chance of feeding them.

Obviously, you need your software to run there. Chalk one up for relatively easily ported open source code without being dependent on a slow-moving vendor.

The above is rampant speculation and there are many interesting design points - it's great to see someone trying new things and taking advantage of changing hardware ratios to profit.

<comment><USER4> > With, ohhh guesstimate 70,000+ servers

That could be about right. I know the number was 20,000 at the end of 2008 from sources within Facebook.

</comment></comment><comment><USER5> I doubt these are for running php or other services-more likely acting as a key-value stores (which is what they already used memcached for). See <http://www.cs.cmu.edu/~fawnproj/> for a cmu research project that did this and produced great perf/watt numbers.

<comment><USER6> Hardware key/value store appliances is a great startup idea.

<comment><USER7> Disclaimer: I work on a key/value store, so take my opinion with a grain of salt even though I'll stay clear from self-promotion, yadda yadda.

Without distribution a key/value store is a hash table. To have any value added it's going to need to be a distributed key/value store. Distributed key/value stores, however, run just as well on commodity hardware. Problem is very few companies work at a scale at which per machine efficiency, power or other cost savings are going to matter; that's a very small market and one that's difficult to sell to.

On the other hand, a customized Linux distribution with a nice UI for deploying key/value stores would be a good idea.

<comment><USER6> My back-of-the-envelope calculations showed that a hardware-based key value store (custom chips driving DRAM plus ethernet interfaces in a 1RU chassis), would use so much less power than an average x86 server that you could charge a great price thanks to the TCO / power savings.

<comment><USER8> Can you check that you're not becoming obsolete due to Moore's law before savings recoup costs ? Also, consider the potentially reduced product flexibility of hardware vs software.

</comment></comment></comment></comment></comment><comment><USER9> Most recent comment on the story, (purporting to be) from Jonathan Heiliger:

 _This story is completely false. Facebook continuously evaluates and helps develop new technologies we believe will improve the performance, efficiency or reliability of our infrastructure. However, we have no plans to deploy ARM servers in our Prineville, Oregon data center._

</comment><comment><USER10> "One size does not fit all." Eventually, we're going to see a heterogenous data centre consisting of machines with different specs, that are suited for different workloads. (minor edit.)

<comment><USER11> Hint: The rest of the world already works like that. See: zOS on Power, Solaris on Sparc, HP/Tandem Nonstops (I think are now on x86), IBM i on whatever it runs on, HPUX on x86 (I think), AIX on Power, Linux on Mainframe, Windows NT4, XP, 2000, 2003, 2008 (all running critical tasks)...

Cheap Linux/x86 servers own most of the web space. But the rest of the world runs much more heterogeneously. (And that list above ignores real legacy stuff.. You can buy all of that currently (with the exception of the older windows stuff))

<comment><USER12> I don't think it's _just_ the web space. Maybe academia's different, but over the past 10 years, a lot of infrastructure we used to use Solaris/Sparc for (and miscellaneous other more exotic things) has all been transitioned to a mix of Linux/x86 and Windows Server/x86--- email servers, compute clusters, payroll, course registration, pretty much everything.

<comment><USER11> Oh I agree - the general trend is in the direction of win/linux on x86. But it feels like the web world has gone almost exclusively x86. Maybe it's just the web got their quicker -- but acting like linux on ARM is revolutionary is perhaps overdone. (Especially considering Linux runs on x86, x86-64, IA64, PowerPC, Mainframe, Cell, and probably some other processors that are used in datacenters)

<comment><USER13> The list of supported Linux architectures (form kernel.org):

Although originally developed first for 32-bit x86-based PCs (386 or higher), today Linux also runs on (at least) the Alpha AXP, Sun SPARC, Motorola 68000, PowerPC, ARM, Hitachi SuperH, IBM S/390, MIPS, HP PA-RISC, Intel IA-64, AMD x86-64, AXIS CRIS, Renesas M32R, Atmel AVR32, Renesas H8/300, NEC V850, Tensilica Xtensa, and Analog Devices Blackfin architectures; for many of these architectures in both 32- and 64-bit variants.

We could also say: pretty much everything under the sun.

</comment></comment></comment></comment></comment><comment><USER14> My thought was that they want enough separate cores to handle a case where 1 core is handling 1 user's page load.

So for a midsized datacenter with say 200 racks, each ARM based rack could have 320 cores in it, giving 64K cores.

Since a FB page may take 200ms to load (or some other load time internal to FB response time targets), such a setup could handle 64K * 5 (i.e. 5 users per second at 200ms/page) or 320K simultaneous users per second; figuring 30 seconds of viewing time per user, this gives you almost 10 million users' worth of capacity.

(all numbers back of the envelope, hypothetical)

</comment><comment><USER15> Perhaps predictions from the mid 90's will finally come true: RISC will win and x86 will be held back by its legacy baggage. This is more notable for how long the predictions failed to come true. (The turnabout would make it even more interesting.)

<comment><USER16> Precisely what baggage is holding x86 back? The only thing that I know of is the variable length instruction encoding and these days, that seems helpful: it allows you to use smaller instructions which benefits caching. The extra cost of decoding instructions on silicon is negligible.

In general, I don't understand your comparison of RISC vs x86. The original premise of RISC, namely having very simple chips that can be clocked real fast because of their simplicity has long since been abandoned. Modern RISC chips have all the crazy complexity of x86 chips: you'll find big pipelines and dynamic register renaming and multiple execution units galore. And modern x86 chips internally look a lot like modern RISC chips as well: after they convert native instructions into micro-ops, there doesn't seem to be much difference.

<comment><USER15> _Precisely what baggage is holding x86 back?_

A part of my point is that it hasn't been holding x86 back for a _long time_. A part of the article's point is that perhaps it will soon. Reread my comment with a skeptical tone.

<comment><USER16> Ah, thanks for explaining.

</comment></comment></comment></comment><comment><USER17> Still have a working Netwinder in my drawer. Maybe this time around it'll work out for ARM, would be cool.

</comment><comment><USER18> Expect Intel 'Empire strikes back' in 2011 - they have the talent, fabs, money, patents.

<comment><USER19> All that and they still couldn't ship Larrabee. There's only so much you can do with a haphazardly designed ISA that dates from the late 70's. ARM is overwhelming dominant in the mobile market and very, very cheap.

To my mind Intel's quixotic purchase of McAfee only shows that they've cornered themselves into a market that's peaked.

<comment><USER20> They couldn't ship Larrabee to hit it's market window (i.e. to compete with the GPUs when it would/might have been ready). They haven't given up yet and in the meantime they're shipping it for HPC experimentation and the like.

You're right about the "haphazardly designed ISA" but they've still made it run _very_ fast by throwing a lot of engineering effort at it.

As for McAfee, I don't know what they bleep they're trying to do there, but I suspect they can afford it (especially since AMD didn't keep their eye on the ball for so long). Their previous failed communications and media ventures didn't seem to materially hinder their bread and butter CPU/chipset business.

</comment></comment></comment><comment><USER21> HipHop is going to get a lot less production-ready.

<comment><USER22> Why? [I don't know much about it] Facebook's HipHop JIT transforms PHP to C++ and then they compile it with g++ (or at least that's what they say.) GCC supports ARM already.

<comment><USER23> HipHop is not a JIT, it is an AOT compiler.

<comment><USER24> While we're correcting people, HipHop isn't an AOT compiler, it is a source code transformer[1].

[1] <http://developers.facebook.com/blog/post/358>

<comment><USER25> If your definition of Compiler is broad enough, there's no difference.

<comment><USER23> That doesn't even require a broad definition. From Aho, Sethi, and Ullman: "a compiler is a program that reads a program written in one language - <USER2> source language - and translates it into an equivalent program in another language - the target language."

<comment><USER25> Except that if you interpret that literally, pretty much _any_ program is a compiler. I can translate a text file in the "ASCII language" to the "UTF-8 language" with Notepad++, for instance.

<comment><USER23> I don't remember my models of computation class so well, but wouldn't ASCII and UTF-8 be alphabets, not languages?</comment></comment></comment></comment></comment></comment></comment></comment>


Alan Kay at OOPSLA 1997 ("The computer revolution hasn't happened yet") - <AUTHOR> https://www.youtube.com/watch?v=oKg1hTOQXoY <comment><AUTHOR> inlining the pinned comment by Joel Jakubovic from Youtube as it is easy to miss:

      07:00 "On the Fact that the Atlantic Has Two Sides"
            Kay: "On the Fact that Most of the World's Software Is Written On One Side Of The Atlantic!"
      07:30 Two types of math: computers = practical math
            structures of a much larger kind, consistent
      08:55 Debugging goes on in math as well
      10:00 What's being done out in the world under the name of "OOP"?
      10:33 Infamous C++ quip
      10:50 Same feelings about Smalltalk! Meant to be improved. Not syntax, or classes. Taken as given...
      13:00 Math as gears
      13:35 Analogy to 60s programs: SCALING A DOGHOUSE!
      18:00 Pink plane / blue plane
      21:30 Data abstraction in 1961 US Air Force
      23:25 Contrast that with what you have to do with HTML on the internet! Dark Ages!
              Presupposes that there should be a "browser" that should understand its format.
              "This has to be one of the worst ideas since MS-DOS"
              What happens when physicists decide to play with computers :P
            Browser wars, which are 100% irrelevant [to the big picture]
      25:30 The internet is starting to move in that direction as people invent ever more complex HTML formats, ever more intractable.
           This same mistake made over and over again
      26:00 Sketchpad: very much an object-oriented system
      26:50 Simula
      27:50 Better Old Thing vs. New Thing
      29:20 Molecular biology: cell physiology and embryology (morphogenesis)
      30:00 First assay of an entire living creature: E.Coli; biological info processing
      34:10 Only takes 50 (40) cell division [cycles?] to make a baby!
      35:20 Computers: slow, small, stupid. How can we get them to realise their destiny?
      36:00 Doghouses, clocks don't scale 100x very well. Cells scale by 1,000,000,000,000x.
            How do they do it, how might we adapt this for building complex systems?
      36:40 Simple idea that C++ has not figured out.
            "No idea so simple and powerful that you can't get zillions of people to misunderstand it"
            Must not allow the INTERIOR to be a factor in the computation of the whole
            Cell membrane keeps stuff OUT as much as it keeps stuff IN
            Confusion with objects from noun+verb-centered language. "Our process words stink"
      37:50 Apologies for "Object-Oriented". Should have been Process/Message/間 (ma) -Oriented
            Stuff IN-BETWEEN objects. What you DON'T see.
      39:25 An object can act like anything. You have encapsulated a COMPUTER!! The universal simulator!
            Take the powerful thing you're working on and not LOSE it by PARTITIONING UP your design space!
            That's the bug in data/procedures.
            Pernicious thing in C++ and Java by looking like the OLD THING as much as possible.
      40:35 Virtual Machine
      41:00 UNIX processes: like objects, but too much overhead. "3" ought to be an object; but it can't be a UNIX process.
      41:50 Bio-cells can't share their DNA. OUR "cells" can! No need to e.g. engineer a special virus to change the DNA (e.g. cystic fibrosis)
      43:00 "An object is a virtual server" Every object should at least have a "URL"
            I believe every object should have an IP
      44:10 So far we've been CONSTRUCTING software; soon we'll have to GROW it
            Easy to grow a baby 6 inches; never have to take it down for maintenance!!
            Can't grow a Boeing 747! Simple mechanical world; only object was to MAKE the artefact, NOT to grow it
      44:55 How many people STILL[1997] use a dev system that forces you to develop OUTSIDE of the lang?
            Edit/compile/run? Even if it is "fast". Cannot possibly be other than a DEAD END for building complex systems!
            [20 years later, in 2017: has anything changed?]
      45:50 ARPANET, the precursor to the Internet.
            From the time ARPANET started running, expanded by 8 orders of magnitude.
            Not ONE PHYSICAL ATOM in the internet today that was in the original ARPANET!
            Not ONE LINE OF CODE of the original remains in the system!
            System expanded by 100,000,000x, has changed every atom and every bit and has NEVER HAD TO STOP!
            That is the metaphor we ABSOLUTELY MUST apply to what we THINK are "smaller" things!
            When we think programming is "small", that's why our programs are so BIG.
      47:45 LISP, meta-reflection. "Maxwell's Equations" of software
            Saddest thing about Java (possibly before reflection API?)
            Java originally for programming toasters, not internet, but still --
            How can you hope to cope with stuff without a meta-system?
            Represents a real failure of people to understand what the larger picture is / will be.
      50:10 Meta-programming. Bootstrapping on top of the language itself.
            Tyranny of a single implementation.
      52:15 Dozens and dozens of different object systems, all with very similar semantics, but different pragmatic details.
            Think of what a URL is, a HTTP message is, an object is, an obj-oriented pointer is...
            Should be clear that objects should not have to be local to the computer.
            Interop is possible basically for free under this stance.
            Things like JavaBeans and CORBA will not suffice.
            Objects will have to DISCOVER and NEGOTIATE what each other can do.
            Prod and poke each other to see response.
            Must automate this!!
      55:20 1970s: Abstract Data Types. Assignment-centered thinking.
            C++ like MS-DOS: no-one took seriously, because who would ever fall for a joke like that? ...
      57:35 McLuhan: "I don't know who discovered water, but it wasn't a fish!"
      58:10 3 stages of new ideas:
            Dismissed as mad.
            Then: totally obvious.
            Finally: original denouncers claim to have invented it!
            Smalltalk, sadly, went this way.
            We don't know how to make systems yet!
            Don't let what we DON'T know become a religion!
            Before coming out into the world, Smalltalk was very good at making obsolete previous versions of itself.
            Squeak: bootstrap something better than Smalltalk!
            Think of how you can obsolete the damn thing!
      1:01:30 Pipe organ: "Play it grand."

      Let us combine all this with Bret Victor's work, and lay the foundations for the real computer revolution yet to come.</comment>


Ask HN: How do you respond to people who tell you they are bored? - <AUTHOR> I know a non-trival number of people who once in a while tell me they're bored. Unfortunately I never relate to these people. I always find something to do, now and always, anywhere in any situation. So when I come across these folks, I really don't know how to respond in a constructive way. I've told them what they could be doing in the past but that seems to be a temporary fix at best.
Kids who tell me they're bored really make my head explode!
So HN, what would be a good constructive response to "I'm bored"? <comment><USER2> I believe your main issue with understanding these things is that you're conflating (absence of) workload and boredom. Boredom stems from not having anything that engages a person in a positive way. For example, I can be drowning in work and still be bored out of my mind, even while working. The work being done is perceived as being tedious, rote and without positive emotional impact.

That being said, finding something "fun" to do for a bored person is no easy task. And sometimes nothing seems appealing to the bored person. You can try dragging them along, so that they'll get engaged in the process of doing something, but there's no guarantee that this will work. Sometimes people just need to be bored, I guess.

</comment><comment><USER3> The following was taught to me by my dear friend, Reginia. If it worked on someone as stubborn as I am, it will work on anyone.

Just tell them this:

      When you say, "I'm bored," you're actually saying, "I'm boring."

Essentially, bored people are boring, and boring people are bored.

Surprisingly, it's entirely true. It also works in reverse; interesting people are interested, and interested people are interesting. Fascinating people are fascinated, and fascinated people are fascinating.

<comment><USER4> Let's play a fun game of "Spot the logical fallacies!"

> If it worked on someone as stubborn as I am, it will work on anyone.

Hasty generalization

> When you say, "I'm bored," you're actually saying, "I'm boring."

Ad hominem

> ...and boring people are bored.

Affirming the consequent

> Surprisingly, it's entirely true.

Argumentum ad ignorantiam

<comment><USER4> > It also works in reverse

Circular reasoning

</comment></comment></comment><comment><USER5> If someone tells you they're bored they're usually looking for help making a decision about something or permission to do something.

Bored is a state of indecisiveness - no one wants to do something they might feel isn't enjoyable or useful, so being in a state of boredom is a function of not being able decide on something to do, or not being able to think of something to do (although that's much more unusual). The simplest solution is to incentivize a particular action and change the situation to make something more worthwhile than all the other things. To do that you need some knowledge of what motivates the person though, and some power to make the change.

It's worth noting that sometimes being bored is a perfectly correct state to be in. Occasionally I'm 'bored' in the middle of a large project. That's a sign that there are things I've yet to form a cohesive strategy for. 'Bored' in that case is actually shorthand for 'need some downtime to think'.

<comment><USER6> Totally agree overall. In general bordom to me is usually a state of indecisiveness for most people. And there are those who just can't figure out what to do next. In some cases I think it can also be a sign of depression too, not that I am an expert there, just something I feel I have seen personally many times.

I have major issues with the phrase "I can't". I raised my kids to never say "I can't...." because to me that is saying you failed before you even tried. Trying and failing is better then never trying to begin with. I am ok with failure and with "I need help on xyz", but not "I can't". To me "I'm bored" is in that same boat.

</comment></comment><comment><USER7> Ask them questions - try to dig in to why they are bored and find threads of things that interest them.

I'd say the holy grail is incepting interest ;-)</comment>


Ask HN: Is it legal to charge for GPL source code? - <AUTHOR> I was reading the user manual of a device I got and they offer the source code of GPL software they use, but charge a fee.
The following is what's written on the user manual of the device:
"GPL Declarations The device contains – in part – some free software (software licensed in a way that ensures your freedom to run, copy, distribute, study, change and improve the software). This free software is also contained in the firmware update files that are distributed together with the software installation packages. The free software contained within the firmware includes a version of X-LOADER, U-BOOT, LINUX, LIBSYSFS, LIBUCI, LIBUSBIP, ETHTOOL, UCLIBC, QT and BUSYBOX.
Further, for at least three (3) years from the date of distribution of the applicable product or software, we will give to anyone who contacts us at gplcoderequest@<redacted>.com, for a charge of no more than our cost of physically performing source code distribution, a machine-readable copy of the complete corresponding source code for the version of the software that we distributed to you."
So, is that legal? <comment><USER2> In _general_ , yes, you can charge for GPL'd code.

[https://www.gnu.org/licenses/gpl- faq.en.html](https://www.gnu.org/licenses/gpl-faq.en.html)

That said, I'm not 100% sure about the scenario where you distribute the binaries without the source, and invoke the "written offer" clause. It's not totally clear to me if you're allowed to charge in that specific circumstance or not.

Edit: OK, at least for the GPLv2, the answer is "yes":

[https://www.gnu.org/licenses/old- licenses/gpl-2.0.en.html](https://www.gnu.org/licenses/old- licenses/gpl-2.0.en.html)

 _You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:_

 _a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,_

<comment><AUTHOR> I see it now! Thanks!

Taken from the link above:

If I distribute GPL'd software for a fee, am I required to also make it available to the public without a charge?

No. However, if someone pays your fee and gets a copy, the GPL gives them the freedom to release it to the public, with or without a fee. For example, someone could pay your fee, and then put her copy on a web site for the general public.

<comment><USER3> There are VC-backed companies distributing binaries based on GPL code, which discourage their customers from releasing (or even asking for) source. E.g. the vendor won't sell to anyone unless the order size is six figures or greater. This reduces the chance that the customer cares about either source or the GPL. Even if the customer cares about the source, they may not want to offend the vendor, e.g. lose early access to new features.

<comment><USER4> _> E.g. the vendor won't sell [the source] to anyone unless the order size is six figures or greater_

Note that this is illegal in GPL v2. It contains a clause to prevent exactly that kind of malicious behaviour:

 _> ... for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code ..._

However, GPL v3 explicitly allows for that practice:

 _> You may charge any price or no price for each copy that you convey, and you may offer support or warranty protection for a fee._

<comment><USER3> Sadly they are charging for binaries and most customers are unaware there is GPL source associated with the binaries.

<comment><USER5> If the customer is inattentive enough that they don't notice the licence, that's their own fault.

</comment></comment></comment></comment></comment></comment><comment><USER5> I really like that they spell out what free software they use; that's a good sign.</comment>


Show HN: STACKS, Unlockable, Personalized Magazine Articles for iPad  - <AUTHOR> http://www.themagazinechannel.com/

<comment><AUTHOR> My first project completed after 4 years of HN and volunteering with Startup Weekend. It was this or stick with being a lawyer. All our articles come from published print magazines. Additional archives and new titles unlock as the app users increase. New, awesome publications coming soon, please help spread the word.</comment>


Ask HN: Can I buy the domain of next Facebook with namecheap? - <AUTHOR>

I'm wondering if Namecheap can handle the domain of the next Twitter or Facebook? Thanks ;) <comment><USER2> Before you make the next facebook, you should probably learn the difference between buying a domain name and having a server. But to answer your question: as long as they're secure enough to resist attempts to hack in and switch your domain ownership, you should be fine.

<comment><AUTHOR> Hah, this was more a parody of <https://news.ycombinator.com/item?id=5766663> hence the wink but good on ya for the honest comment.</comment></comment>


Visualizing Transport Options with Transitive.js - <AUTHOR> http://conveyal.com/blog/2014/04/28/transitive-intro/

<comment><USER2> In the demo ([http://conveyal.com/transitive.js/](http://conveyal.com/transitive.js/)) the blue and orange line unnecessarily overlaps with each other near Rosslyn, and the path from Start to End through Farragut North Area is unnecessarily overlapping with blue and orange line. Any particular reason?

<comment><USER3> Yes, that's a known issue; the crossing minimization piece still needs some refinement. Hope to have it fixed within the next week.

</comment></comment><comment> nevi-me This is a great initiative, I remember sometime last year I wanted to create schematic transit map for a few of the services in my city, only to realise that there might not be software to automate the process. Would have been great if I took out some paper and Inkscape to try it out, but I moved on to more important things. Definitely will be following the project, maybe I can create a GTFS bridge with my dataset and try out the project :)

<comment><AUTHOR> Thanks for the feedback! Project is definitely under daily development and subject to changes but it should be ready for reuse soon.

We use OpenTripPlanner for translating GTFS in a format to use with this. What type of bridge did you have in mind? What city/services were you looking at?

<comment> nevi-me I'm in South Africa, developing a public transit planner for Johannesburg and surrounds (you can check it out at [https://rwt.to](https://rwt.to) [search for "Naledi, Soweto" to "Hatfield Square, Pretoria" as an example], also obviously still under development).

I opted not to use GTFS as it didn't meet my needs with regards to many things, for example I built a pricing engine/calculator which calculates prices dynamically based on a set of rules, and as a result for train services that are priced based on track distance, I needed to draw the tracks accurate to a few meters per km, so that I can extract the pricing information from there.

When I have time in the near future, I want to write a Node.js script that converts the data that I have to GTFS, fairly trivial but not a priority at this point :)</comment></comment></comment>


Google X Lab will reveal another 'moonshot' next month - <AUTHOR> http://thenextweb.com/google/2013/03/12/google-x-lab-will-reveal-another-moonshot-next-month-but-its-not-working-on-a-space-elevator/

<comment><USER2> Not much here, other than solid confirmation that Google X is NOT working on a space elevator.</comment>


Google Transparency Report – requests from government agencies for user data - <AUTHOR> http://www.google.com/transparencyreport/userdatarequests/

<comment><USER2> Interesting how requests from Russia, Turkey and Hungary are consistently ignored, how China is not on the list, and how Brazil's requests have very high compliance rate (similar to the U.S.)

</comment><comment><USER3> I wonder why Austria isn't listed, while both Swiss and Germany have a lot of requests.

</comment><comment><USER4> The part I find interesting is the ratio of user accounts specified to # of requests. E.g. the United States made ~8k requests for ~16k user accounts.

<comment><USER5> It also has a 90% compliance rate, higher than the rest. In the previous months it reaches 93 and 94%.

</comment></comment><comment><USER6> In complying, what kind of data does google provide?

</comment><comment><USER7> According to this, "URLs requested to be removed from Search per week" has increased 10-fold over the past six months.

<http://www.google.com/transparencyreport/removals/copyright/>

</comment><comment><USER8> Does this mean that my govt. can read all of my mails if they want to? Am I missing something?

Why is no one complaining?

Isn't there an email service which has 0% compliance? I would shift to that, now!

<comment><USER6> Call the Privacy Commissioner/Ministry of your country.

</comment></comment><comment><USER9> Wow Canada has a similar population and political system as Australia but we only had 50 vs Australia's 523.

What's going on there?

<comment><USER10> Canada has the Bell (telephone) and Rogers (cable) duopoly. In addition, both of them offer internet service and cellular data service. Odds are, if the Canadian government (agencies and governments underneath the Canadian federal government or any of the provincial governments and their subordinate agencies) ever did need information about anyone they could call one of these two companies first.

Note: I am not at all sure if Canadian laws allow for this kind of thing, and I am not all accusing either company or any of their competitors of being party to such a request. I'm merely indicating that because of the market dominance of two very large telecommunication companies who practically own the cables underground, the airwaves above, and reasonable number of media outlets in Canada between them, the number of requests an entity would need to make to gather information about someone is pretty small. I would not be surprised if the order of requests for information went something like: call Rogers and get any info, call Bell and get any info, call Google and get any info.

Edit: added "In addition,"

<comment><USER9> Good point, subpoena to a domestic company deeply connected to the government would be easier than targeting Google. I'm not sure what Australia's telecom situation is, but I'd imagine that would also be the case.

<comment><USER11> ISP doesn't have a year of gmail account content.

</comment></comment></comment></comment><comment><USER12> Probably just easier to hack the accounts.

</comment><comment><USER13> Is this obtained only with a subpoena or with a warrant?

<comment><USER14> This just represents requests, rather than actual fulfillments or valid requests.

<comment><USER15> It does show the compliance rate of the request which I think is really high in some countries considering Google may not have been legally obligated to comply.

<comment><USER16> I wonder what kind and what amount of data is released. There's a range from the IP address that created, say, a YouTube video to an accounts entire GMail history to the entire Google profile associated with that account, including visited web pages as learned from ad networks etc. Not sure if they even store the latter in a way that could be part of a targeted request.

A breakdown by product would be a start.

On a sidenote that page has been available forever, it's not a new thing.

</comment></comment></comment></comment><comment><USER17> India has defended her 2nd position consistently. Wonder what percentage of it was demanded by political parties (especially the ruling ones) out of their vested interests.

<comment><USER18> Although India is listed second by number of requests, in terms of (unique) requests per capita, it comes near the bottom of the pile.

Similarly, Brazil comes in third, but is fairly average (amongst the countries listed) in terms of requests per capita.

The United States leads by a long way, then Australia, France, the United Kingdom, and Hong Kong.

<comment><USER17> No, I was just concerned about bare number. Hope this clears.</comment></comment></comment>


Rewrite Tor in Rust - <AUTHOR> https://trac.torproject.org/projects/tor/ticket/11331 <comment><USER2> The OP is likely nothing more than wishful thinking, but I can see why people are intrigued by the prospect. An important thing to note is that it's entirely possible to perform a slow, gradual integration of Rust code into a C/C++ codebase (such as Mozilla is doing with Firefox), but only if your codebase is sufficiently modular with well-defined interfaces for Rust-based libs to slot into. If all you've got is a big ball of mud, then your first step is to work on the modularization of your codebase (which, IMO, has a good chance of increasing your code quality regardless of whether you eventually decide to introduce any Rust).

<comment><USER3> You end up having to toss a layer of c around your c++ last time I checked. Does c++ even have an abi yet?

<comment><USER4> well, not a standard one. That's what extern "C" is for : if you want a standardized API, C always had one.

<comment><USER5> Neither C nor C++ have a standardized ABI, if by standardized you mean part of their respective ISO standard. Nor they could, as the many of ABI properties (names, calling conventions, layout, object and executable file format) are intimately platform (as in OS and CPU) specific.

Most platform officially specify their C ABI, and many also specify their C++ ABI (usually in therm of the C one). Itanium C++ ABI (plus the platform specific psABIs) has become the de facto C++ ABI for many unix and unix-like platforms.

</comment></comment></comment></comment><comment><USER6> As a side note, Galois have written an implementation of Tor which happily interacts with official tor, for use in HalVM based unikernels. So, if you want ephemeral tor nodes, HalVM is a pretty great way to get it working.

Edit: Video about it [2]

[1] [https://github.com/GaloisInc/haskell- tor](https://github.com/GaloisInc/haskell-tor) [2] [https://www.youtube.com/watch?v=oHcHTFleNtg](https://www.youtube.com/watch?v=oHcHTFleNtg)

</comment><comment><USER7> Is there an anti-pattern for this kind of thing? Its a two line bug report suggesting years of development effort. There is a huge multiplication factor between the time invested by the bug reporter and the time required to do what he asks.

<comment><USER3> Only if your goal is to doom the existing tor project. Lots of great research projects start this way. Often times it influences the main project or merges.

<comment><USER8> what good would come of this, to be honest?

</comment></comment></comment><comment><USER9> The discussion is 10 months old and never went anywhere. What makes this relevant now?

</comment><comment><USER10> It would be a bit embarrassing to rewrite in Rust and then have the network penetrated because they screwed up the crypto during the rewrite...</comment>


China factory jobs dry up as trade tensions hit manufacturing - <AUTHOR> https://www.ft.com/content/dc8c670a-0652-11e9-9fe8-acdb36967cfc <comment><USER2> [https://outline.com/hxZAZS](https://outline.com/hxZAZS)

<comment><USER3> Thank you!

</comment></comment><comment><AUTHOR> The reasons may not necessarily be directly attributable to trade tensions, as there appears to be a debt-induced slowdown in China at the moment. Another article from ft.com to support this: "China industrial profits decline for first time in 3 years" ([https://www.ft.com/content/e1d2b1c4-099a-11e9-9fe8-acdb36967...](https://www.ft.com/content/e1d2b1c4-099a-11e9-9fe8-acdb36967cfc)) (non-paywall: [https://outline.com/qZdpNr](https://outline.com/qZdpNr))</comment>


Student creates powerful catalyst from potassium - <AUTHOR> http://phys.org/news/2015-04-student-powerful-catalyst-potassium.html <comment><USER2> Video: [https://www.youtube.com/watch?v=ikP1jiDDp6A](https://www.youtube.com/watch?v=ikP1jiDDp6A)

</comment><comment><USER3> The read cube link doesn't work for me.

I kind of get the weirdness of the result and the usefulness of silanes. But nothing explains what you have to do with potassium tert-butoxide to get this to work. That may be why some comments remark on the irritation -- no specifics.

If I could access the paper I probably still could not understand the process but maybe someone could translate it into lay speak.

Also the potential for new chemistry seems extremely interesting but again the specifics are missing. I guess we are talking about the same old quantum mechanics, so what would be new -- some larger scale effect that no one every realized was implied by the physics? Or what?

<comment><USER3> OK, found a library with the subscription, and the key sentence in the paper seems to be:

We observed that the combination of a bulky basic anion (that is, Ot-Bu, trimethylsilanolate or bis(trimethylsilyl)amide) and, importantly, a potassium countercation led to the desired C–Si bond formation.

But I don't understand it at all. Lay speak translation needed.

<comment><USER4> Hi there, I'm Kerry - one of the researchers who wrote the paper. Basically, you have a molecule with a bunch of carbons bonded to hydrogens - like R-C-H (where R is the rest of your molecule). Then you mix in our catalyst (K-OtBu, the potassium tert-butoxide catalyst) and a silicon compound (let's say Si-H) and then stir it up, and you get your final product: R-C-Si-H! A very simple explanation for what is no doubt an extremely complex mechanism.

A bit about the specifics of that quote - so we don't know the specific way this catalyst works, just that it works (we're working on finding it out!!) But we've observed several important things - and one of them is that the potassium ion in that potassium tert butoxide salt is absolutely necessary for the reaction to go. Analagous ions like Sodium or Lithium (going up the periodic table) don't work AT ALL. You NEED this potassium ion - which has never been seen before in chemistry, really. You'd expect sodium and lithium to maybe work less well, but to not work at all? Something weird's going on.

Let me know if I didn't answer your question - I can probably get a bit too technical sometimes, habit really :(

<comment><USER3> That really helps. Thanks very much.

</comment></comment></comment></comment><comment><USER5> Does anyone have insight into what type of silicon product they were creating and it's usefulness (if any)? I'm not sure if I missed it in the article or if it just wasn't there.

<comment><USER6> An organosilane is basically any molecule with a Si-C bond. This reaction step creates the Si-C bond, so you could (in theory) use it to prepare any organosilane by starting with the correct Si- and C- containing fragments. Organosilanes currently find wide use in industry as hydrophobic coatings, adhesion promoters, and as useful intermediates in drug synthesis.

It's a little hard to describe just how unbelievable this discovery is. Before this, if you were to propose research in this area, you would most likely be laughed at. It's a bit like if you discovered a hard drive could also be used as a microprocessor. In both cases, there seem to be very good reasons why it could never work. In this case, however, those reasons just happened to be wrong.

EDIT: Free access to the original paper here: [http://rdcu.be/cmm5](http://rdcu.be/cmm5)

<comment><USER7> So what will happen now ? since we no longer know how (some) catalysts work, will this start a race of scanning materials(i.e. combinatorial chemistry) to find catalysts ?

<comment><USER8> > since we no longer know how (some) catalysts work

It's not like we ever knew exactly how things work at the molecular level. Chemistry is still an expanding field, there are theories to explain molecular combinations in most cases but there is not fixed, absolute theory behind it that explains everything in every single case.

> race of scanning materials(i.e. combinatorial chemistry) to find catalysts

What for ? There's tons of literature already available (more than you can absorb in a single lifetime), and experiments need to be carefully planned and understood, and not just randomly thrown at multiple targets.

<comment><USER9> >experiments need to be carefully planned and understood, and not just randomly thrown at multiple targets.

Well, if you automated the process...

<comment><USER8> > Well, if you automated the process...

Problem is, the understanding cannot be automated at this stage. Combinatorial experiments are great to optimize an existing process, it's not that great at finding new stuff or new insights.

</comment></comment></comment></comment></comment></comment><comment><USER6> The Caltech student newspaper interviewed some of the researchers involved: [http://loridajose.com/?p=249](http://loridajose.com/?p=249)

</comment><comment><USER10> A very inspiring story of perseverance and the ultimate payoff. I wonder if it will take off the way the discovery and subsequent development of the transistor (which had a similarly difficult birth process) did for electronics.

</comment><comment><USER11> I wonder how will this impact the rare-metal industries around the world, especially the ones in China.

</comment><comment><USER12> What an incredibly irritating article to read.

Can someone find a more normal article on this, that just says what the catalyst does, and leaves out the "birthing story" and other nonsense.

<comment><USER6> I didn't find it irritating at all, but perhaps you would prefer this article: [http://phys.org/news/2015-02-cheap-abundant-chemical- outperf...](http://phys.org/news/2015-02-cheap-abundant-chemical-outperforms- precious.html#inlRlv)

<comment><USER12> Thank you!

The article is so much better I'm stunned that both are located on the same website.

It's like finding kindergarten stories and college age stores in the same book.

<comment><USER13> Not really, more like finding both in the same book store. Different audiences like different formats, so if you can have both you get more viewers.

Personally I hate the narrative form of news reporting, I like just the facts.</comment></comment></comment></comment>


Google Is Now a 'Tier Two' Employer, Says Recent Comp-Sci Grad - <AUTHOR> https://www.linkedin.com/pulse/google-now-tier-two-employer-says-recent-comp-sci-grad-carlson?trk=hp-feed-article-title <comment><USER2> <i>"For full time specifically, you get equity at a startup. If it IPOs, you make millions if you're one of the first 100-1000 employees."</i>

Not really. You can make millions if you're a founder... As a regular employee you have more chances to make millions by going to Vegas than with stock options.

<comment><USER3> Are there _any_ tech IPOs that made employee #1000 millions? IIRC Facebook only came close even if you ignore the "s", and Google "only" made hundreds of people millionaires.

<comment><USER4> Allegedly, there were over 1,600 Twitter employees with options valued over $1M at IPO:

[http://www.businessinsider.com/twitter-ipo- created-1600-mill...](http://www.businessinsider.com/twitter-ipo- created-1600-millionaires-2013-11)

</comment></comment></comment><comment><USER5> When I got out of school 4 years ago, people were already making the same arguments. While Google isn't perfect, I can't imagine a place I'd rather work, where I can really dig into technical details of things while having freedom to set my agenda in many ways, very smart coworkers and predictably high compensation. I don't think any of those things have changed in 4 years.

Talking about top CS schools/going to Stanford is really irrelevant. I went to Carleton College, which has a nice little CS department but not really well- known, and got a liberal arts education. Because I did some open-source work and maybe because of some academic projects, I was able to get lots of interviews and offers, all in the same range as people are discussing today. All Stanford does at a company like Google is get your foot in the door-- small, poorly run startups may hire on that basis, but that's it.

My one piece of advice for people who want to get into the tech industry: Choose one open-source project and contribute to it over a long period of time (ideally starting in high school, but never too late). The short time span of college courses and lack of large projects (a semester is not long) means that you can't really develop the skills that you need to be effective by that alone. Large, open-source projects give you real experience in structuring code to be maintainable, working with others and receiving feedback, and understanding and changing existing code that other people wrote. It might also get you some nice internal references.

</comment><comment><USER6> The student mentions that Google's pay is "average" and the housing stipend is taxed more than wages, bringing the overall compensation down to on par with other employers in the valley. Fair enough.

He then says that other more prestigious startups are paying more and allow employees to be on the ground floor and have a bigger impact - I'm curious to see a list of _these_ companies.

I also wonder if "fresh out of grad school" versus "worked at Google for 2 years + grad school" gets you into these startups. I still believe seeing Google on your resume gets you a second look.

</comment><comment><USER7> According to one recent grad. Why is this even an article?

<comment><USER8> I can say from my interactions with CS students at top schools that this attitude is common. Google is no longer seen as innovative; everyone wants to work for Facebook or Apple now. Google isn't seen as a bad company to work for, just not sexy like it used to be. It's like going to work for Microsoft: you'll make good money and get some interesting projects, but major engineering decisions happen in an ivory tower and you just have to roll with the punches.

<comment><USER9> Should recent grads be making major engineering decisions for any established company? This article smacks of entitlement.

A very few recent grads may be able to make major contributions. How do you know if you're one of them?

<comment><USER8> Some are, yes. We're talking about the top CS students at schools like Stanford, Berkeley, CMU and MIT - these kids are in the top 10% of the top 1% of students. They may not be making major decisions on day 1, but they expect to be able to grow into a role where they are at least a voice at the table within a year or two.

<comment><USER10> > these kids are in the top 10% of the top 1%

And the unit is... ?

</comment></comment></comment></comment></comment><comment><USER11> The writer of this article has a pretty faulty premise: it's all about the money. After close to a decade of working as an employee in startups, some that failed and some that succeeded, my view is that the last thing you want to do is join a startup for the money. You join (and more importantly, stay) because of the other benefits: the independence, the impact, and the camaraderie. Unless you're working on the next unicorn - and realistically, you're not - you're not going to come out with much cash. Google and Facebook are exceptions, not the rule.

I eventually left the startup space to see what the rest of the world is like, and I can tell you that the money is much better out here.

</comment><comment><USER12> This is a pretty bizarre single data point. However, if this sentiment is actually popular amoung "top CS students" these days I wonder what companies they consider to be tier one.

</comment><comment><USER13> TIL that even students from top CS program have no idea about taxes if they think that housing stipend is taxed higher than ordinary income.

He is not alone though - compensation director at Box tried to convince me that higher salary is significantly better than lower salary + bonus because of higher taxes on bonus.

<comment><USER8> There is some truth to this actually. Companies often charge both sides of payroll tax on bonuses, which adds another ~6%. IIRC some states have a bonus tax as well.

That said, higher base salary is usually better than lower salary + bonus because your annual raises are larger on a higher base. Variable comp also just kind of sucks period - you get a big windfall at some point in the year, but you can't plan for it because you don't know how big it will be.

<comment><USER13> I have never heard about companies charging both sides of payroll tax on bonuses - is it even legal? Anyway, Google does not do it and California does not have any extra tax for bonuses so it does not matter in this case.

With that, I agree that having higher guaranteed salary is better than having the same expected variable comp but the comment was about taxes.

</comment></comment></comment><comment><USER14> "Recent Comp-Sci Grads say all sorts of things that vary in cleverness," says recent TA.

</comment><comment><USER15> I would rate big companies i.e. Google, Facebook, Amazon, Microsoft and startups all at tier two places of work, when you take social and pressures of work into consideration. Good companies to work for are any that 1) do something you are interested in. 2) Don't require you to work longer than 40 hours a week.

The problem I see is big companies, and startups is the amount time they require their employees to work, which is normally over 40 hours and can be upwards of 60 hours average per week.

Paying 100k at 40 hours a week is $48 an hour.

Paying 100k at 60 hours a week is $32 an hour.

I work with undergrads always tell my best students to avoid Facebook, Amazon, Microsoft, Google companies. Longer hours means more stress. Big companies get employees to work longer by offering food and games at work. I tell them find a company that does cool stuff and only asks for 40 hours a week. I tell them I know working for interesting research companies getting paid $80k and working ~30 hours a week. Which is getting paid more per hour than the person working at a company earning 100k and doing 60 hours per week.

I checked up and Google isn't too bad from what I can see online. Some say 40[1] Others say 50-60 [2] Places like Facebook, Amazon, Microsoft are worse places to work.

[1] [http://mashable.com/2012/05/10/reddit-users- google/](http://mashable.com/2012/05/10/reddit-users-google/)

[2] [http://www.quora.com/How-many-hours-a-day-do-Google- employee...](http://www.quora.com/How-many-hours-a-day-do-Google-employees- work-on-average)

</comment><comment><USER16> If not Google, who _are_ the tier-1 employers?

</comment><comment><USER17> The article fails to answer then who is in Tier 1?

</comment><comment><USER18> Not a convincing article. Google is a great employer. May be people's expectations have risen.

</comment><comment><USER19> Lower prestige? I think this is true. People may not be consciously aware of it, but due to the company's core business model, i.e. basically adware and spyware, non-billionaire employees will almost certainly incur a hit to their social prestige account.

</comment><comment><USER20> That's a common criticism of google; that everyone there is so educated and qualified, you have PHD comp sci people writing unit tests.

<comment><USER21> Would that be so bad?

<comment><USER22> Not in itself, no. I'd be happy to have a PhD writing unit tests for me, but if they're overqualified for that (which I think is the assumption we're making) I'd probably rather have them working on a harder problem.

I think the point is that it's not an efficient use of their skills.

<comment><USER23> Which is why it wouldn't happen. Interns and entry level grads are doing testing; they hire PhDs specifically for doing the kind of research they were doing at university. But the original comment wasn't serious anyway, just making a point.

<comment><USER24> Most PhDs write terrible unit tests or don't test at all.</comment></comment></comment></comment></comment>