Mastodon 2.0 - <AUTHOR> https://medium.com/@Gargron/mastodon-2-0-e93d9d28dbb9? <comment><USER2> I started using Mastodon a few months ago, "just to see", and found great people to interact to there. And these days I'm using Twitter less and less.

Looking back, I feel like the short-messages limit is fueling flaming statements rather than good discussions. I also see how constant enabled-by- default notifications and dark patterns made me addicted to new tweets ; on Mastodon I feel less pressure to keep up with the feed constantly.

Also, the project grew from a few to 100+ contributors in a few weeks, and apparently managed this transition quite smoothly. Development is ongoing at a steady pace, including new features and major architectural changes. Congrats to the team and contributors!

<comment><USER3>
        Looking back, I feel like the short-messages limit is fueling flaming statements rather than good discussions

Quite rarely, also condensed pieces of art: [https://twitter.com/quietpinetrees](https://twitter.com/quietpinetrees)

<comment><USER4> Wow, some of those are very good.

<comment><USER5> Some more:

[https://twitter.com/MicroSFF](https://twitter.com/MicroSFF)

[https://twitter.com/ASmallFiction](https://twitter.com/ASmallFiction)

</comment></comment></comment></comment><comment><USER6> Started using just out of curiosity, about it being a federated system (just like email), I also knew about the interoperability with Gnu Social and OStatus networks, so I gave it a shot.

I launched my private instance and started from there. I can say I'm very surprised, the system works very well, never had major problems and the communication with people with accounts on other instances (since I'm the only one in mine) works flawlessly.

This is how the Internet was supposed to work (not full of walled gardens). The good thing is that we're seeing some great decentralized applications and tools appearing recently and a renewed interest in this area, which is great.

<comment><USER7> What is it about Twitter that takes 3000 people to keep going vs something like Mastodon? Is Mastodon missing something major that Twitter has? Is it just about scale?

<comment><USER8> Sales, support, marketing, accounting, business ops, software ops, management, HR. Pare those off and you might get something like Mastodon's contributor size after adjusting for scale of user base. Although I doubt many of Mastodon's contributors are full time, so a comparison is difficult.

<comment><USER7> So Twitter is big because it's big?

<comment><USER8> I don't follow. Twitter is big because of all the things I just listed.

<comment><USER9> You just listed its components, the question was about why Twitter _needs_ those things but Mastodon does not.

<comment><USER8> Because Twitter is a for-profit business, whereas Mastodon is not.

<comment><USER7> And they are up to around $2 billion in losses so far, right?

It sounds like they would be better off just being a Mastodon node.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Decentralization is just an affirmation until they fix the network lock in problem. You're still married to whatever instance you sign up with. The admin limits who you can federate with, and if the policy changes, it requires you to rebuild from scratch if you want to move.

That's what's keeping platforms like Twitter on top even though many of its prolific users now sound more like an abused spouse than anything else.

I still think the vast majority of this concern over abuse is a red herring though. People just don't like it when their curated bubble is pierced by information that contradicts it, and they confuse being corrected with persecution and social status games.

<comment><USER11> How hard would it be to start a one-user instance so that I control my identity and then using federation to communicate with other users? The willingness of other admins to federate with me would be the limiting factor, right?

<comment><USER12> Mastodon has a single-user instance mode: [https://github.com/tootsuite/mastodon/blob/8392ddbf87f5522c4...](https://github.com/tootsuite/mastodon/blob/8392ddbf87f5522c445573c50e4f21d690172bc0/.env.production.sample#L47-L48)

Most instances would federate with you immediately since they're on a blacklist model, but some instances (such as awoo.space) operate on a whitelist, meaning they'd have to vet you first.

<comment><USER13> I'm sure I can dig this up at some point, but just in case anyone knows off hand - can a single user instance run well enough on a small (1 cpu, 512mb ram) VPS running a few other lightweight services?

<comment><USER14> One CPU would be fine with just one user, but that's not enough RAM. I would consider 2GB the bare minimum, with one app server instance and one background worker process (sidekiq) running.

<comment><USER15> hugogameiro seemed to say otherwise a month ago[0]. According to his post, it takes <1GB of RAM. Have things changed since then?

[0] [https://news.ycombinator.com/item?id=15213203](https://news.ycombinator.com/item?id=15213203)

<comment><USER14> It would probably be possible to run the app server and background worker with about 1 GB of RAM. You might have to restart the workers daily to avoid OOMs (ruby/rails/puma will leak memory, you'll just accept that at some point), but that's more or less acceptable.

That still leaves postgres, redis, your web server and all other system processes. Fitting those on the same server with a total of 1 GB of RAM available is a very, very tight fit. You will probably get OOMs regularly, and upgrading Mastodon, doing backups and things like that will be painful (building assets, for example, tends to eat a lot of memory).

hugogameiro, from what I understand, runs a lot of mastodon instances on shared infrastructure. That eliminates a lot of that overhead and if you look at just the instance-specific processes, 1 GB seems realistic. If you have existing infrastructure (i.e. something like postgres, redis, nginx) and can allocate about 1 GB of RAM to Mastodon, or use something like a Heroku 2x dyno, where these components are separated as well, that might work. Otherwise, I'd opt for 2 GB of RAM.

<comment><USER13> So I decided to test this out on a 1CPU/512M DO droplet, just for fun.

I did indeed hit OOM during the setup (`bundle install` and `yarn` steps). After the first one I added a 1G swap and made it all the way through the 1.6.1 install (although the webpack precompile step damn near used up the whole swap!). Anyway 1.6.1 idles around 600M without any attempt to optimize.

I next tested an upgrade from 1.6.1 to 2.0.0 and was able to get it done (with the precompile again cutting it close - it hit 1015M of the swap, hah!). No change in memory usage, perhaps a bit more even.

Off topic - the install process was easy enough but seems like it could really do well to be (much) more automated. Do you know if anyone is working towards this? I suppose that is what Docker is for...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> So as far as my simple mind understands, mastodon is a Twitter alternative. But without the adds, true timeconsistent Timeline, without annoying have you seen this tweet yet algorithms and simply working.

But the problem is that it is a social network, that depends on your social network and its embrace of mastodon.

Am i right?

<comment><USER17> Almost, yeah.

Mastodon, and conceptually others like Gnu Social, are twitter-like alternatives, but that's not fairly telling the full story of their capabilities. These platforms bring with them decentralization benefits like classic email does. Remember when so many people's email addresses were not something like @gmail.com or @hotmail.com? When they used their own domain names (either personal, or for their organization, etc.), such as email@example.com, or jane@something .org, and lived on their own servers, though could still interact - that is, email - people from other domains, servers? Mastodon - and again others like Gnu Social - can, and in fact __SHOULD __live on separate servers and domains...though still allow for interaction. This is the bigger benefit, and personally, i believe what makes mastodon and other similar platforms pretty cool.

Now, the benefit of decentralization above may not be compelling enough for someone on a personal basis to set up/manage their own server...and for that, there certainly are several "largish" mastodon servers where you could create your own account...and STILL interact with folks on other servers, etc.

I acknowledge that i sound like a salesperson for mastodon - i assure i'm not. I'm just a fan of decentralized platforms, and admit that mastodon's UI is easy to use. But if you're curious, i invite you to start an account, and see for yourself. Worse case, you can always abandon it if you really dislike it. Visit [https://joinmastodon.org/](https://joinmastodon.org/) and scroll down to the part that helps you choose which instance to join...if you're stumped, simply join the main/first one ([https://mastodon.social](https://mastodon.social))

Cheers!

<comment><USER18> I will advocate for this software solely on the principle you have defined in this post - it is a disruption of the hegemony of Facebook. Of course, it could go wrong, but currently it is a 100% better choice when it comes to being a part of a social network and simultaneously not having your life creepily vacuumed up by Big Brother.

</comment></comment></comment><comment><USER19> Question for users of mastodon:

Given the flagship's stances on free speech ([https://mastodon.social/about/more](https://mastodon.social/about/more)), if I am a user on the flagship instance (we'll call it A) and I want to follow an account on another server (let's call it B) that posts content that wouldn't be allowed on A, would my act of following that user on B pull the content to A? And would that content be removed? or does it only get removed if it is post to A in the first place?

My concern is that users on the flagship instance would only see a curated feed of the things they follow, even if following content on server that don't have such strict content policies.

<comment><USER14> I'm not entirely sure if mastodon.social has published any policy clarifying how and under what circumstances they apply instance bans. There are two ways administrators can block other instances on Mastodon:

Silence: Posts from users of these instances are only visible to users following that user directly, but not in public timelines.

Suspend: All posts from users of these instances are always removed, even if you follow them directly.

I would suspect that most admins stick with the first option for almost all bans. That said, users who are concerned about this should stick to instances with a broad interpretation of free speech.

</comment></comment><comment><USER20> I tried to use this a couple of times, but had a difficult time choosing a community. They seemed to mostly appear the same, so I chose based on activity and uptime. But apparently those instances were largely in languages I didn't understand. The "filter out these languages" improved it a bit, if I go through and check every box except english (slightly unintuitive, there, as most people will know few languages and want to select what they know instead of what they do not know) though not completely. It seems to work better with 'local' than with 'federated' results, which can mean cutting you off from the global community if you limit yourself to local.

I wouldn't mind seeing a guide to various popular communities to choose what to pick.

<comment><USER21> Something like [https://instances.social](https://instances.social)?

<comment><USER20> That's pretty nice. I remember using it before, but maybe my selections were better this time. Thanks! Though, if you filter for 'English' it still gives second result with description "Une instance francaise...'

Also, I found a solution for the language issue, by adding a regex filter:

        .*[^\u0000-\u007F].*

It may be over-filtering a little, I am not sure. But better to filter too much than not enough, I guess.

</comment></comment></comment><comment><USER22> I'm very curious, what kind of communities and subjects have embraced Mastodon?

A while back there was a lot of noise about how it was a popular place with those uncomfortable topics that twitter had banned: [https://news.ycombinator.com/item?id=15053064](https://news.ycombinator.com/item?id=15053064)

I clicked gingerly on the links to communities at the bottom of the article - octodon.social, social.tchncs.de, mastodon.art, mstdn.io, mastodon.technology, mastodon.rocks - and many of them have a live feed of posts.

I've gotta confess I couldn't quite tell what communities there were, but I'm not an insider and I don't know how to navigate it.

<comment><USER23> Many of the instances are organized around a particular community. For example, toot.cat is for "cats and the people that love them". witches.town is "made to provide a nice place on Mastodon for queer, feminists, anarchists and stuff as well as their sympathizers."

However, as you'd expect, you might not talk strictly about cats on toot.cat, but you'd be talking with other cat lovers. It might be difficult to discern the community from the local timelines. Also, some of the ones that you mention are just general social instances.

Each instance has an about page that you can look at to get a better idea of what it is organized around. [1]

[1]: [https://mastodon.art/about](https://mastodon.art/about)

<comment><USER24> Something important to note is that though your local instance is often closest to you, all of the instances talk and you have access to the entire network (or nearly all of it) from any instance.

</comment></comment></comment><comment><USER25> Just joined out of curiosity ([https://mstd.tokyo/@scott](https://mstd.tokyo/@scott)) and I'm pretty impressed by how smoothly things have gone... but I'm also a bit disappointed by how it handles federation.

If I try searching for tags or topics, I generally come up with zero results -- I'm never quite sure if it's because they don't exist on the instance I joined on or whether there just aren't enough users to have that tag/topic out there in the federation.

Discoverability seems very, very low out of the box and that seems like the one thing that would keep me from staying on Mastodon.

Another issue I ran into was that after I tooted a few times, I started wondering if I'd chosen a "bad" server (low activity) and started looking for ways to move my account to another server -- it feels like a waste to go and start up another account and leave my toots behind. :/

I really wish it were possible to just browse other instances' public feeds. For example, I'd love to see some stuff from mastodon.art, but I can't yet figure out a way to just browse over there short of making another account.

<comment><USER26> >Another issue I ran into was that after I tooted a few times, I started wondering if I'd chosen a "bad" server (low activity) and started looking for ways to move my account to another server

Account migration is still the top issue on GitHub. I was a bit disappointed when I saw that they announced 2.0 without it.

</comment></comment><comment><USER27> Would it be possible to write a service that connects twitter into a mastodon instance so that mastodon users can follow twitter users? I'm thiking outloud here but besides scale, are there any other drawbacks?

<comment><USER17> The original creator of mastodon has stated his preference for leaving this out of the core of mastodon: [https://github.com/tootsuite/mastodon/issues/3888](https://github.com/tootsuite/mastodon/issues/3888)

...But by the virtue of mastodon being only one open source platform that works on the overall federated universe and employs the OStatus protocol, there isn't anything stopping such a service as you described from being built...well, except for twitter eventually deciding to block access to their platform...but i'd guess that would turn the federated universe into a sort of social network martyr.

Anyway, sorry i digress...To answer your question a bit more concretely, there are options for what you asked about:

* [https://github.com/halcy/MastodonToTwitter](https://github.com/halcy/MastodonToTwitter)

* [https://medium.com/@pimterry/sync-your-mastodon-back-to-twit...](https://medium.com/@pimterry/sync-your-mastodon-back-to-twitter-3c72f2bc8626)

I'm sure there are more options; try googling. Cheers!

</comment></comment><comment><USER28> Here's a quick question I have about Mastodon instances. Most instances I visit are hidden behind a sign up home page. Is this default? How does this encourage more people to interact? Or is that the point? Happy if anyone can just point me in the right direction

<comment><USER15> On the about page of an instance[0], if you scroll down, there's "a look inside" of the federated timeline. If you know a username, you can go directly to their page[1]. You can find the username of the admin on the about/more page[2].

These are sample links to mastodon.social:

[0] [https://mastodon.social/about](https://mastodon.social/about)

[1] [https://mastodon.social/@Gargron](https://mastodon.social/@Gargron)

[2] [https://mastodon.social/about/more](https://mastodon.social/about/more)

<comment><USER29> sadly, the federated timeline is close to useless. I don't understand why it isn't the public timeline that's exposed.

</comment></comment></comment><comment><USER30> Can Mastodon work as an isolated server on a corporate network without phoning home?

We're looking for a Slack alternative (edit: with channels). Regulations prevent us from using external SaaS products.

<comment><AUTHOR> Mastodon has no home to phone to. You only host your own user's data and the data they request by e.g. following users on other instances. If your users don't follow anyone on the outside, nothing will leave your instance.

<comment><USER31> To elaborate, Mastodon.social is only a de facto home, nothing in the code privileges that instance over others.

</comment></comment></comment><comment><USER32> Mastodon seems very interesting, but I have one significant issue with it.

If every instance is decentralized, how can you be sure the instance you use is actually running the Mastodon code? How can you be sure it hasn't been modified to collect user credentials, for example?

Is there some sort of signature verification for Mastodon instances?

<comment><USER33> You can't. (and given that it's using open protocols, not forcing everyone to run the same software is part of the design)

That said, what "user credentials" would an instance collect? The only people logging into it would be user registered at this instance, "capturing" that makes no sense.

The security model is very much like the one of e-mail: To protect your data, you have to trust your provider, and for communications both the senders and the receivers server have to be trusted to handle the communication contents as expected.

</comment></comment><comment><USER34> How hard would it be to allow users on a server to sell their own personal data from a federated social network with both the server admin and some central authority taking a cut?

I feel safe in saying that users being able to sell their own data for their profit, instead of Facebook's, would get people to jump ship.

<comment><USER17> Yours is a very novel, clever idea! Being a fan of decentralized platforms, i sort of hope that these platforms get their UI, set, etc. designed in so simple a way in the future, as to allow (non-techies) to manage their own future...but what i forget to think about is not the "how", but the "why"...Your idea certainly offers a good motivator for enticing people to hop on the decentralization train, and legitimately be in control of their own data. Thanks for sharing!!

<comment><USER34> Thanks, but there's nothing novel about it. It's a recurring theme in technology (computing in particular) where something is invented, delivers short-term profit to a small group of people, and then becomes standardized in some way that allows a greater, long-term benefit to a broader audience. I'm sure some economist somewhere has even come up with a clever name for this.

Obviously the model I describe will not generate Facebook-scale wealth for any individual player, but I believe there is still good money to be made in addition to the positive externalities that come from standardization and decentralization.

</comment></comment></comment><comment><USER35> I'm the one who wrote this piece in April outlining Mastodon/GNU Social's core problem with identity portability[1]. I'm sad to see the development team has decided to focus on emojis and fancy features while kicking the society- breaking problem of federated moderation down the road. As one user put it on the open Github issue describing the problem[2]:

> Being told right up front that you should irrevocably attach your social > life to a server run by some rando.... is not a welcoming way to start using > a new service.

I still think Mastodon is best-in-class in terms of UI for open social projects, and hope the development team will consider tackling this problem. Until then, I still cannot endorse using Mastodon/GNU Social as a platform in its current state.

[1] [https://hackernoon.com/mastodon-is-dead-in-the- water-888c10e...](https://hackernoon.com/mastodon-is-dead-in-the- water-888c10e8abb1) [2] [https://github.com/tootsuite/mastodon/issues/177](https://github.com/tootsuite/mastodon/issues/177)

<comment><USER35> (For anyone interested, I can rant a little)

This problem is easily fixable code-wise, but there's hesitation to diverge from the standards upon which Mastodon is based, and the original standards body behind this particular issue has long since disbanded. Other than monkeypatching Mastodon (and potentially breaking GNU social federation), the solution would be to re-convene a working standards body to implement a "correct" spec for this problem. Since nobody seems willing to do that, monkeypatching Mastodon to make an order of magnitude more users comfortable with switching to it is probably my recommendation.

The world needs more protocol standards bodies and more engaged, engineering- minded parliamentarians.

<comment><USER12> It looks like the Social CG is still active, and they're working on the new ActivityPub protocol which Mastodon 2.0 supports. Follower migration is one of the issues they're discussing:

\- [https://www.w3.org/wiki/SocialCG/2017-10-11](https://www.w3.org/wiki/SocialCG/2017-10-11)

\- [https://github.com/swicg/general/issues/1](https://github.com/swicg/general/issues/1)

<comment><USER35> Oh, excellent! I can't believe I missed this!

</comment></comment></comment></comment><comment><USER36> "Toot"

Still can't get over it.

Definition 2 on Wiktionary: "A fart; flatus."

<comment><USER34> I don't like this word either. Not just the 'fart' aspect, or even the 'cutesy' aspect - I just don't like how closely this apes the word 'tweet' from Twitter.

</comment></comment><comment><USER37> I can't switch to Mastodon right now because most of my network is on Twitter. Why hasn't somebody built an instance that lets me interact with both networks at once?

<comment><USER38> Twitter's API is aggressively limited, so limited that third party clients barely work.

Believe me, I've tried.

</comment></comment><comment><USER39> From a tech perspective I love this project, very cool. I think it's more likely to end up partially replacing IRC than tools like Twitter/Facebook though.

<comment><USER17> I'm a big fan of open platforms like mastodon and Gnu Social, and even i acknowledge that twitter and facebook may not be fully replaced any time soon...But the world is big enough for all to co-exist. And, just because mastodon won;'t replace twitter/facebook, shouldn't stop us all from playing/working on it.

Also, my bet on what platform will (eventually) replace IRC is matrix; see [https://matrix.org/#about](https://matrix.org/#about)

Of course, that's just my opinion.

</comment></comment><comment><USER40> Is there a sane solution to following local timelines of several instances? The local timeline on my instance is quite dead, the federated timeline has so much variance it's nearly useless.

<comment><USER41> Don't think so.

Open issue "Browse Other Instances' Public Timeline" \- [https://github.com/tootsuite/mastodon/issues/1053](https://github.com/tootsuite/mastodon/issues/1053)

</comment></comment><comment><USER42> I'm interested to know if anyone's using Mastodon for discussing research / scholarly publications. Equivalent of people sharing / discussing articles on Twitter.

<comment><USER43> [https://mathstodon.xyz/](https://mathstodon.xyz/)

Is geared towards math topics. That made the rounds here earlier this year.

[https://news.ycombinator.com/item?id=14564624](https://news.ycombinator.com/item?id=14564624)

</comment></comment><comment><USER44> How do I browse the different instances out there to find the ones I might want to join?

<comment><USER17> Visit [https://instances.social/](https://instances.social/)

You can walk through the "help wizard", or click "list" link in topnav to see all of the known instances.

EDIT: I failed to mention, that you should not feel like joining one instance excludes you from the greater federation of networks...you can join one instance and follow people from anywhere else. And, if you begin to dislike the instance that you joined, simply move to another one...or even better - though a tad more work for you - set up your own personal instance, do whatever you want, and still be able to follow anyone on any other instance.

</comment></comment><comment><USER45> (About the page design) I don't know what medium is doing. They have bars both along the top and bottom of their page, which cramps reading. Instant reader mode click to resolve that, which shouldn't really be needed on medium.

<comment><USER20> It's kind of curious that they posted this on Medium instead of some Mastodon site.

<comment><AUTHOR> Mastodon is a microblogging platform. This does not fit into the format.

<comment><USER46> It shouldn't be posted on _Mastodon itself_ , but they should just set up a simple static blog somewhere. Medium is the opposite of Mastodon in so many ways (centralized, heavy data-collection, etc.) that it really makes no sense for them to be using it as their official method of making announcements.

</comment></comment></comment></comment><comment><USER47> I'm confused about identity in mastodon. Your identity is based on which server you use? So if you change server within the federation you are essentially a different person?

<comment><USER48> Think of it like email identities, but applied to twitter

john@ google dot com can be a different person than john@ yahoo dot com

<comment><USER47> But if you owned @example.com, you could move email@example.com from one server to the next.

</comment></comment></comment><comment><USER49> Mastodon seems cool, but I haven't used it enough yet. Does anyone have a client that they would recommend? Preferably a terminal-client?

<comment><USER50> This came up on a search, but I don't know if it's any good: [https://github.com/ihabunek/toot](https://github.com/ihabunek/toot)

<comment><USER49> Yeah, I've seen a few others via searching around, but I haven't heard any reviews or anything. Thanks

<comment><USER50> I've had good luck treating stars and forks on GitHub as reviews. It means it served someone's needs, so it's probably worth trying.

</comment></comment></comment></comment><comment><USER51> The only meaningfull way to use it is with your own domain so you can change the hosters easyly without loosing your whole network of followers/friends. You can self host for sure but it would be nice to be able to just use your domain with one of the hosters for starters, is there such a possibility?

</comment><comment><USER52> Ah, mastodon again, wonder how it is going. Logs in..

Your home timeline is empty! Visit the public timeline or use search to get started and meet other users.

Double checks, yes following people, checks again... closes tab, goes back to somewhere else.

<comment><USER53> This happens if you don't log in for a while, the server stops updating your timeline for you, and it will be empty when you first log in. If you wait a few minutes it should populate again.</comment></comment>


Reddit isn't a "Brain Drain", it's a Climate Change - <AUTHOR> http://www.reddit.com/r/TheoryOfReddit/comments/15goza/is_reddit_experiencing_a_brain_drain_of_sorts_or/c7mde44

<comment><AUTHOR> What I took away from this idea is that reddit never did really change, they just "became". The entire site was curated from the beginning, but once the community took over, they changed it for themselves to what they wanted. The original people are there, but there's an overarching "new" crowd.

So, in curating a community, it's important to realize that people will change the landscape for themselves, and without strict curating and moderation, people will create their own community. It wasn't very obvious when I thought about it.

</comment><comment><USER2> I always thought someone should start a reddit-style site for adults, say over 40.</comment>


Why George Lucas, Eric Schmidt, (and yes, Steve Jobs) Should Go to Jail - <AUTHOR> http://www.nakedcapitalism.com/2014/01/george-lucas-eric-schmidt-steve-jobs-go-jail.html <comment><AUTHOR> Yves Smith's conclusion:

 _What is stunning is all the exchanges among top executives. The filing quotes numerous e-mails among Jobs, Sergey Brin, Adobe CEO Bruce Chizen, and other Silicon Valley heavy-hitters that talk openly about the agreement and various threats when a member to an agreement falls out of line. By contrast, in the AMD case above, the parties to the lysine cartel were very careful to hold meetings where they'd discuss price fixing overseas, where that action was not criminal. The brazenness is remarkable._</comment>


Bootstrapping an MMO with its MVPs - <AUTHOR> http://thestartuptoolkit.com/blog/Bootstrapping_an_MMO_with_its_by-products

<comment><USER2> I'm a bit confused by the tone of this article. It sounds like the writer doesn't really understand the gaming industry, indie games, or the flash gaming market.

 _plus sponsors are salivating with anticipation for his upcoming "games" which are actually nothing more than gameplay prototypes and/or funding infusions._

What? Steambirds isn't really a game? All its polish and carefully refined gameplay doesn't get it past prototype status? Even a seemingly simple game like that takes months to create for just one person. There is nothing about the game that feels unfinished. To me this sounds like if you told people you work as a senior programmer at a (funded) web startup and they ask "Oh, cool! So, what do you do for money?"

 _One of my favourite tidbits is that he did no direct sales -- he just uploaded to a game licensing site and gave them 10%._

This makes it pretty obvious he is ignorant of the flash market. This is par for the course in Flash games; you almost never see people do direct sales (Captain Forever being a notable exception) and 99% of the games you see are sold to sponsors and then put on the sponsor portals. I find it pretty weird that he thought it was some dangerous and ingenious business model that Andy thought of himself.

Sorry to have one of those "but someone is WRONG on the INTERNET" moments, but I would have liked the article if it just weren't so ignorant of what its writing about.

<comment><USER3> The first question comes down to perspective. I totally agree that from the player/portal's perspective it's a full, polished game. But from his perspective, and given his ongoing business intent, it's acting as more of an internal prototype that he had the good sense to polish and sell.

On the second, my reaction is less about its novelty compared to the rest of the flash game biz, and based more on how it compares to web startups in general. Even a market as commoditized as display advertising still relies on a lot of personal contacts and haggling. It's a nice surprise to see a B2B market that can run so efficiently.

</comment></comment><comment><USER4> Very interesting stuff, specially for those of us building our dream mmos (<http://developingthedream.blogspot.com/>)

I wouldn't have gone the route he did though, I probably would have invested the original million dollars in something a bit safer than a software company that yields less profit.

After working on my game for a year now and don't ever see myself selling it if/when I release it. I'd much rather live off a little bit of money and make the game I want.</comment>


15k? Heartbleed bug worth more like $1M - <AUTHOR> http://run-node.com/15k-heartbleed-bug-worth-more-like-1-million/

<comment><USER2> Users, like the author of this blog, benefit from a secure SSL implementation as well: it makes sure our data is secure. How much has the author voluntarily paid to the person who discovered the bug?

It's quite easy -- and probably completely ineffective -- to come out and say _someone_ should pay this man one million dollars. In my opinion, it's a lot more helpful to shell out some money yourself, at least if you think other people are obligated to do so.

I don't mean to say that this guy should just "shut up and pay up" \-- not at all. My point is that it's often a lot more effective to, when something needs to be done, do 1% of what needs to be done, instead of asking "other people" to do 100% of it. If we all do the latter, nothing gets done, and if only 100 people do the former, it's done.

</comment><comment><USER3> Bounties should work in principle: people who rely upon and care about having a secure crypto implementation should be willing to put up money for bug bounties.

Seems like people don't care enough to put up the cash. Why?

There are data breach insurance policies for sale. Why aren't these insurance companies putting up bug bounties for responsibly disclosed vulnerabilities? Is there a market gap here?

<comment><USER4> The other side of the market reportedly works much more efficient. Tons of middlemen sourcing the latest 0days and paying more the higher to the top of the pyramid they get.</comment></comment>


Firefox, champion of the *open web (* may include DRM) - <AUTHOR> https://blog.mozilla.org/blog/2015/05/12/update-on-digital-rights-management-and-firefox/?blah=blee

<comment><USER2> Please don't editorialize titles when submitting stories to HN.</comment>


Show HN: I built an AI app to tag a resume with the closest job title - <AUTHOR> https://notyce.me <comment><AUTHOR> To let the job seekers aware on how their resume is being viewed at the recruiter end. Helps with suggestions and required skills to fit for their dream job role.

</comment><comment><USER2> On latest firefox it looks weird. Its not clear how to upload. Click does not work, drag and drop neither

<comment><AUTHOR> Thanks for trying. I just tried, looks like working. Could you help me with your OS and firefox version, please.</comment></comment>


JooJoo Refunds Smell Awfully Fishy - <AUTHOR> http://gizmodo.com/5494572/joojoos-refunds-smell-awfully-fishy

<comment><USER2> I believe Fusion Garage's story, actually. PayPal has been slow to refund money to an actual bank account/credit card for me in the past. Not surprising.

Maybe their email exchange and the whole bank account thing sounds a bit weird, but perhaps they were really trying to make it right for the customer.</comment>


AMD Open Source Driver Supports Latest GPUS - <AUTHOR> http://news.softpedia.com/news/open-source-amdgpu-linux-driver-released-supports-the-latest-amd-gpus-496545.shtml <comment><USER2> Hopefully the kernel driver rewrite pays off, and not just in time saved supporting separate Catalyst and free kernel modules. AMD on Linux is infamously slow, and while their Windows driver situation has never been particularly good, they get crushed by Nvidia.

Thats also bad, because they are also the most freedom hostile major hardware manufacturer on the market. Some other contenders like Broadcom, Intel, and Qualcomm all participate some engineer time somewhere in the open stack, albeit not across all their products, but literally nothing Nvidia makes is open at all, and they even go the extra mile nowadays to use signed drivers to stop Nouveau development.

Anyone who cares about eventually seeing a world where GPU programming is as open as CPU is (was) also cares to see AMD succeed on Linux, being the only major discrete GPU developer out there besides Nvidia, and whose legacy IP has gone into the largest mobile GPUs on Android as well (Adreno). They might have proprietary power management firmware on their cards, but at least they publish the ISA. Can you imagine a CPU without an open instruction set?

<comment><USER3> I'm not sure what applications you're talking about when you say they get crushed by Nvidia.

AMD has faster integer operations so they're much better for hashing operations like bitcoin mining and password cracking.

Nvidia is better at floating point ops which are used in computational biology and neural nets. Also they use CUDA which is the only interface supported by many libs.

AMD has better open source drivers than Nvidia. By far. Their default open source drivers are actually usable on Ubuntu, while with Nvidia you have to install ridiculously unstable Nvidia proprietary drivers to just watch flash videos.

On Windows for games, AMD cards are competitive for almost every given price point. At the top, r9-390x beats GTX 980 by a little.

<comment><USER4> Open source drivers are meaningless for gaming, the compiler and driver specific optimizations are not open sourced for AMD neither in the old nor the new driver, and do not seem to ever be. While it's true that AMD has "better" open source drivers I would not go as to say by far, because they are usable and that's about it, you can't use them for gaming no more than you can use the OSS Geforce ones, and on the closed source part NVIDIA driver quality trumps AMD, I wish we were back in the old ATI days with my Hercules Radeon 9800 pro but we aren't. AMD at this point constantly lags behind NVIDIA on everything from performance, to feature support, memory utilization and power consumption.

On the GPGPU front NVIDIA is only "better" at FP when you are talking about HP, FullP is just horrid on everything but it's Tesla and 1st Gen Titan cards. And since you don't need to use FP as much because OpenCL and DX-Compute push towards using advanced INT32 operations (mu, mua, sad) it doesn't fair well, NVIDIA dominated when all of the real world applications used FP in their implementations even when you only had to deal with ints (e.g. SHA256) now when you can do INT32 operations it's dragging it's ass behind GCN for most things that people here would care about (Bitcoin, bruteforcing passwords) even if you are buying Tesla's.

<comment><USER5> > _While it 's true that AMD has "better" open source drivers I would not go > as to say by far, because they are usable and that's about it, you can't use > them for gaming no more than you can use the OSS Geforce ones_

That is wrong. Since a few versions (since Gallium3D arrived, if I got that right) at least you absolutely can use them to game. I played Witcher 2 on them last week. Also many easier games work fine and stable (Kebal, Mark of the Ninja, Mount & Blade… not hard stuff, but still needing working drivers with 3D performance).

<comment><USER4> Being capable of running a game and being viable for gaming are 2 different things, i can run Witcher 2 on a MBP13 with Intel Iris Pro on medium settings at an acceptable frame rate. Neither OSS drivers are going to be viable for a gaming machine e.g. SteamOS Box when It's actually intended to be a gaming machine rather than a machine that occasionally can run games older than X amount of years.

<comment><USER6> You need to check the Phoronix Test Suite numbers, for a number of games on all but the latest AMD hardware the OSS drivers are actually faster than the Catalyst ones. One area where the OSS stack is functionally less than Catalyst is OGL 4.3+. I too use the OSS Radeon drivers and find that they are within a few percentage points of Catalyst numbers and occasionally double digit faster.

OSS drivers for the latest AMD hardware (<1 year old) is hit and miss.

EDIT: clarification

<comment><USER4> I can check what version I had in SteamOS but 20-30% performance difference in modern games between OSS and closed source AMD drivers as far as 2-3 weeks ago goes on modern AAA titles with Linux support.

I could care less about <1 year old games or synthetic benchmarks tbh.

<comment><USER6> The versions of the drivers in SteamOS are well behind up to date stable, let alone testing. You can easily pull in one of the many PPAs that track the latest stable and/or testing kernel/MESA/DRM/DRI stacks (such as xorg-edgers, obiaf or others).

If you are not happy with what is provided by stock SteamOS then your issue is with Valve's distribution not the current state of the drivers.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> FreeSync (open standard), Mantle (open standard), open source drivers. AMD doing all the right things.

G-Sync (closed source software and hardware), crippling PhysX for multi-GPU setups, misrepresenting VRAM (GTX 970 controversy), etc. Stay classy, NVidia.

<comment><USER8> Whats going on with the next graphics API?

I was under the impression Mantle work stopped to fold efforts into Vulkan and MS making DX12 more low level to make sure their lunch is not eaten.

<comment><USER7> Indeed they've stopped working on Mantle in favour of Vulkan and DX12. However, Mantle seemed to be the trigger or at least a driving force for getting the other vendors to modernise their APIs.

</comment></comment></comment><comment><USER9> Rather disappointed that R9 290(X) won't be supported in the new Open Source drivers. Currently I have the 290 paired with a Corsair H100i closed loop cooling, unfortunately there's no option to do the same with R9 390(X) (yet).

However, the upside is that Linux as a viable gaming OS starts to become a real possibility.

PS. I also wanted to thank game developers who put the time and effort to port or made their game Linux-compatible.

<comment><USER10> While it's true that the R9 290 uses the older radeon kernel module, that older kernel module isn't going anywhere and is definitely still supported. What's more, a large part of the usermode driver ("radeonsi") is actually the same as for the newer cards.

</comment></comment><comment><USER11> So, does those drivers support GPGPU/OpenCL (or other ATI similar API)?

</comment><comment><USER12> Fingers crossed for good multi-monitor support!</comment>


I Determined My Health KPIs by Analyzing the Leading Causes of Death - <AUTHOR> https://www.sachinrekhi.com/how-i-determined-my-health-kpis-by-analyzing-the-leading-causes-of-death <comment><USER2> This is a great breakdown of risk factors. It's smart to focus on the riskiest factors.</comment>


Please rate our new landing page. - <AUTHOR> https://dragdis.com/index-b?utm_expid=62885031-0.MT689rjeTqy8Wox1xf0bSg.1

<comment><USER2> The main text says "Drag & drop anything anywhere," so naturally I selected some text on the site and tried to drag it around. Nothing happened.

<comment><USER3> Agree. Why you guys don't just embed it as expandable sidebar on your website to get real taste how Dragdis works?

<comment><USER4> I bet they don't want to scare away those using a browser that requires a plugin for Dragdis to work.

<comment><USER3> Maybe. But that could evolve in plugin for websites (think Disqus) which can help them grow.

</comment></comment></comment></comment><comment><USER5> Some feedback from an Evenote Premium customer who uses their Web Clipper 50 times a day:

1\. Love the autoplaying videos – it's very easy to understand how the service works at a quick glance, and the UI looks slick.

2\. You could tell us if it's free, paid, or freemium. I'm less likely to try a web app that doesn't explain up front what it costs to use it.

3\. If it's free, it might be worth reassuring people how you expect to keep it running. (e.g. "Use it free or go PRO and get x, y, and z.") I feel nervous about collecting thousands of links and images in a free web app I've never heard of that has no clear business model in place.

4\. In the first video, dragging-and-dropping a link to bookmark a page looks like a sluggish process that I wouldn't want to repeat many times a day, possibly because the location bar and your interface are at opposite sides of the browser. Perhaps mention if there are shortcut keys to dump bookmarks and file them later? Evernote's Web Clipper has a bunch of keyboard shortcuts ([http://d.pr/i/FlIl](http://d.pr/i/FlIl) ) – it feels like using vim once you learn them, and I wouldn't want to go back to a drag-and-drop only experience.

<comment><AUTHOR> This is really really helpful! Thank you so much!

We are working on integrating Dragdis with Evernote, so that on the sidebar you would see your notebooks and could drag to them.

The main value is not just to save stuff, but to save it in an organized way, that means in a particular notebook. You wouldn't be able to do that with keyboard shortcuts.

Let me know what you think!

Thanks!

</comment></comment><comment><USER6> Product looks pretty cool.

However, I'll give you a -5/10 for another tiny font size and font weight product page. Even Apple who, as far as I can tell, originated that style, doesn't go for such extremes.

There's no way anyone on a large screen is going to read the minuscule body copy.

"I really love how the tiny font almost blends into the background and forces me to squint", said no one ever.

I don't think the video background works either, it's too distracting, and makes the headline hard to read when it blends too much with the background color.

The headline is also fairly weak and lacks clarity. Your product is only tangentially about dragging and dropping. On the other hand, I can't see how you can avoid talking about bookmarking or "saving for later", which seems to be the main purpose. So I would mention that somewhere in the headline/subhead.

The fact it's in the cloud seems to me to be a point of parity at best, given that Chrome can already sync your bookmarks by itself. Same with Evernote.

Besides, the formulation is a bit clumsy given that I do _not_ want to drop what I'm saving just _anywhere_. I want it to be organized. I want to drop it where I can find it.

My guess is that you mean I can drag and drop it _from_ anywhere, but again, that's kind of a platitudinous feature these days.

The main benefit I see in the product is that it gives me a higher level of granularity as I can save sub-elements of a page directly, instead of bookmarking a whole page, or resorting to a third party, out-of-the-browser program to save and organize e.g. images independently. So it seems to allow me to save _exactly what I need_ , more easily.

(Note that I have no idea if something similar already exists).

<comment><AUTHOR> This is so interesting. How differently people perceive and understand words and things. I'm not talking only about your comment, i'm talking about all HN comments here.

By saying anywhere we meant any location, that means any specific Dragdis folder (that creates organizing) or (soon to come) apps folder.

Thanks for your comment!

<comment><USER6> The fewer words you use, the more that tends to happen.

</comment></comment></comment><comment><USER7> After watching the video, it occurred to me that all I can do with this is share and save. And that's the end result, the goal; dragging and dropping is just a way to do it. Even your own points below are about _collecting_ information and _accessing_ it, nothing else.

And "drag & drop anything anywhere"? It seems that "anywhere" is just a special toolbar on the right side of the browser.

So... I have nothing against systems to collect and organize information; Evernote is just as bloated as OneNote, and everything else is even worse. But they most difficult thing here is "organize"; to this moment, instead of saving links in any of this services, I end up just remembering how to google them up. And this particular service doesn't seem to offer anything significantly better.

</comment><comment><USER8> I think you should increase the focus on being multi-device. You're competing (I think) with Evernote and Pocket for example, both have outstanding cross- platform capabilities.

This looks fantastic when I want to save something from my laptop browser, but increasingly I find myself saving from a mobile. This is fine for Pocket or Evernote, I just share it to their app, but that's not an option here. I'm also not convinced from your landing page that I can have a satisfactory reading experience on mobile, you don't show that at all. You say I can access the data - but assuming you do have a good mobile reading view, you should show that.

<comment><AUTHOR> It's a bit different then this :) We will integrate with Evernote and Pocket so everything from desktop will go to those apps were you said already have a great reading experience. We have strong mobile strategy, but at the moment focusing to "nail" the desktop experience.

Thanks! [http://dragd.is/iY2XH](http://dragd.is/iY2XH)

<comment><USER8> That's awesome! 2 way sync with Pocket would be amazing, this is a much better reading experience on desktop and I can use Pocket for now if necessary on mobile. You'd also get the awesome IFTTT ecosystem Pocket is in if you're not going to be able to match that for a while, saving from Feedly to Pocket is awesome and it'd be great to get saved RSS in Dragdis too!

I was just about to edit in that I really like your focus on pictures, that's where what I currently use falls down badly. I can definitely imagine I'd save more images using this.

In terms of your desktop experience, would you consider one click (not drag) page saving? In your video it looks really tedious dragging from the URL bar to a sidebar on the right when you could just have a button to save in one click and categorise later.

</comment></comment></comment><comment><USER9> What is the purpose of this landing page?

If it's to get new users to sign up, "Get started" should literally allow me to get started - i.e perform a step that is absolutely necessary towards using the product, not create an account.

So something like installing a browser plugin and/or a sandbox to try the product out - basically anything that gets me to my "aha" moment - would work better imo. I think that would then convince more people to sign up.

<comment><AUTHOR> Hmm... didn't test for this. We are doing some integrations with 3rd parties. Will try this on their landing pages.

Thanks!

</comment></comment><comment><USER10> My internet is pretty slow at work, so the video although nice looking was choppy and really bad. Not sure what you can do about it, but it didn't look good at all.

<comment><AUTHOR> Whole team is now discussing about this. Thanks for the comment!

<comment><USER11> I have good internet. I am in Korea though, so that might have been part of the problem, but the video was VERY laggy and annoying.

</comment></comment></comment><comment><USER12> I'm not sure how you want us to rate you? On a scale from 1 to 5? 1 to 10? 1 to 100?

Immediately some things come to mind. Why would I want this? Why would I need drag and drop functionality when I already have that?

I had to spend a minute or so "analyzing" your landing page to surmise that this is some type of mashup of clip to Evernote and pocketapp?

<comment><USER12> Additionally the video on the landing page takes up 1/2 of the "above the fold" on my 27" screen. That seems like a lot of screen real estate to give over to a video of someone surfing the web in a nice house...

<comment><AUTHOR> Thanks for your comments! I've dragged them to my feedback folder. (that's one of the use cases :))

</comment></comment></comment><comment><USER13> First thought is that the link to "See how Dragdis works" takes you to a youtube video that shows pretty much the same thing as what plays in the page background. I don't think you need both.

I like the concept, though I didn't play around with it to see whether the implementation was what I would hope it to be.

<comment><AUTHOR> Totally agree. We have A/B test on this. Here's the link: [https://dragdis.com/?utm_expid=62885031-0.MT689rjeTqy8Wox1xf...](https://dragdis.com/?utm_expid=62885031-0.MT689rjeTqy8Wox1xf0bSg.0#/)

At first we worried that people will not "get" the product without full video, but killing the video link and exposing social buttons increased conversion 5% for the past day.

Thanks for you comment!

</comment></comment><comment><USER14> Wow. Annoying animation. Taking up 50% of screen real estate.

Further, "Drag and drop images, links, selected text, videos or GIFs to your private folders or post directly to Facebook, Twitter & (soon to come) Tumblr, Dropbox, Pinterest etc."

So, I select some text, drop it, then what?

</comment><comment><USER15> The immediate register form when clicking "Get started" is very off putting. I was actually looking for which browsers/OSes you support, not looking to register and get settled. Being able to install it and then "log in or register to sync between computers" would be much nicer.

</comment><comment><AUTHOR> Thank you in advance! [http://dragd.is/7XEr9](http://dragd.is/7XEr9)

</comment><comment><USER16> A buddy of mine and I had the same idea a while back but we never attempted to implement it because it seemed like it would be difficult to do on mobile. I'm hoping these guys can execute on mobile because it would be exactly what we wanted.

<comment><AUTHOR> We have a strategy on mobile. It some terms it's even better on mobile :)

<comment><USER16> I'm curious how you're planning on doing it on iOS. There weren't a lot of very helpful APIs to access in UIWebView at the time I was looking into doing this idea. Didn't seem impossible, just very difficult.

</comment></comment></comment><comment><USER17> You may consider adding HTML5 support for your background and demo videos, as click-to-play for Flash is gaining traction.

I use it, and right now I can't click-and-play the background video, I have to whitelist the whole domain.

</comment><comment><USER18> I don't really get what the site is about. Sure I can "Drag & drop anything anywhere", but why would I want to spend my day dragging and dropping things around? What does the dragging and dropping enable me to do?

</comment><comment><USER19> This might just be me, but the very heavy demography targeting in the video kind of puts me off. I'm not a Mac user. I'm not an interior designer. Yes, I do like to save quotes and links, but I'm not all those other things. Really meeting your target audience in advertising is great when you KNOW your target audience, but in this case it feels like you're locking yourself into a very specific target audience that a lot of potential users aren't going to be a part of, and why?

I'm not sure if this is constructive or if it's just personal opinion, but I hope it's of any help. If not, just disregard it, it looks good overall.

<comment><AUTHOR> Yeah, we're targeting Creative Professionals as our early adopters. Sorry if it puts you off.

Thanks for the comment!

</comment></comment><comment><USER20> The marquee video lags.

I do feel like the landing page adequately communicates what the product is.

Overall, interesting product that I'd like to check out!

</comment><comment><USER21> The idea is great, but there is a problem with using the Chrome extension in incognito mode - when I start dragging anything, the sidebar opens empty..

<comment><AUTHOR> Wait a sec or refresh. You should get a login page. Thanks!

</comment></comment><comment><USER22> What I assume is the background video bluescreened my windows 7 machine. Yikes! All I saw was video artifacts begin to form on the page and then POOF!

</comment><comment><USER23> At first glance, it's pretty but distracting. I had a hard time deciding whether to focus on the video behind the words or the words themselves.

<comment><AUTHOR> Got ya! Thanks!

</comment></comment><comment><USER24> The videos were super choppy for me. Maybe you could preload some percentage of the videos before they start to play?

</comment><comment> tech-no-logical confusing. the background video got my attention but didn't really tell me what you're selling. clicked the get started button... create an account ? no. so back. looked closely at the text to find out it's a browser extension... that was the bit of info I would've liked to see earlier...

<comment><USER25> The background video certainly grabbed my attention. And wouldn't let it go!

It would be great to have a video showing the principles behind the product but the video as it stands is too distracting. It zooms, scrolls or switches view every one to two seconds. I didn't think I'm slow, but the current video the switch from user-focus to screen-focus is too quick to get a feel for what's going on.

Maybe slow it down a bit or stick to one or two key video angles?

Just focussing on one point. Apart from that lots of other good comments here.

</comment></comment><comment><USER26> this may sound bumb, but ... with all the designy ui and pristine graphics and all... after staring at it for 10 seconds I still have no idea what is this all about. Everything is way too spaced out and I need to dig deep. For most users these days means they simply leave your site.

<comment><AUTHOR> Thanks for the comment! [http://dragd.is/7XEr9](http://dragd.is/7XEr9)

</comment></comment><comment><USER27> It's fine. Clear, it just works and boring. That layout is becoming a standard for landing pages.

<comment><AUTHOR> Yeah, agree with you. We tried outrageous stuff in the past, but this thing works the best. In the end of the day it what matters the most. But yeah will keep on trying ;)

Thanks!

</comment></comment><comment><USER28> Love the video as background, explained to me very well what Dragdis was about. Great tool!

<comment><AUTHOR> Great! Thank you! [http://dragd.is/7XEr9](http://dragd.is/7XEr9)

</comment></comment><comment><USER29> i like it, yes its standard but its extremely functional. and maybe there is some bias because i like the concept of dragdis but regardless the site is clear and concise

<comment><AUTHOR> Yeah, we're having this dilemma fresh vs. effective :)

Thanks! [http://dragd.is/7XEr9](http://dragd.is/7XEr9)

</comment></comment><comment><USER30> No Google+, no Twitter, no Facebook. How do I sign up?

<comment><AUTHOR> You can do it with email. Finding the button? :)

<comment><USER30> Weird. I completely missed that.

</comment></comment></comment><comment><USER31> the landing page looks great but i'm a bit skeptical of the product itself</comment>


Ask HN: Too Good to Go for the United States? - <AUTHOR> Too Good To Go[0] is an app/service which connects its users to shops and restaurants in Europe who are happy to sell any unsold food they have at a heavily discounted price rather than it going to waste.
Currently, I am not aware of any such app/service that is available for the U.S. right now. I did take a look through Google's Play Store and saw 2 or 3 apps that have a similar model, but they didn't look any good. I probably wouldn't trust them with my payment info as a user.
I am also not aware that TGTG is planning to bring their service to the U.S. any time soon. So I come here today, wondering if there is an unfilled niche right now. Are there really tons and tons of good food going straight to the garbage when I'm here in California avoiding eating out due to the often unstomachable prices for what you get? Tons of good food that probably aren't going to people who need it the most and can't afford it because the incentives aren't there for restaurants to donate it? I've certainly never heard of stuff like that being done around here.
I don't have the brains to make such an app/service, but you guys on HN might, so I'm making this post to spread some awareness and maybe spark some inspiration. Could it work? Would restaurants and shops sign up for it?
[0] - https://toogoodtogo.com/en <comment><USER2> Get in touch with East Bay Food Not Bombs - they already do similar work, could help you flesh out your proposal (well maybe not 'flesh it out' as most of them are vegans) and I know they have contacts with some tech co-ops that might be able to pick up the ball and run with it. [http://ebfnb.org/](http://ebfnb.org/)</comment>


Bloomberg stands by Chinese chip story as Apple, Amazon ratchet up denials - <AUTHOR> https://arstechnica.com/tech-policy/2018/10/bloomberg-stands-by-chinese-chip-story-as-apple-amazon-ratchet-up-denials/ <comment><USER2> Could a freedom of information request reveal that apple did or did not contact the fbi about the alleged silicon trojan horse?</comment>


SF millennials won't be able to buy a home for 20 years, says survey - <AUTHOR> https://sf.curbed.com/2018/12/13/18139261/millennial-renters-homebuyers-san-francisco-apartmentlist-down-payment <comment><USER2> Every dollar paid in rent increases the value of property in support of those who already own it. It's a double whammy.

I myself benefit from this situation, but see it's vicious cycle.

As long as people keep paying rent, rents will rise and property values will rise as well. It's not sustainable indefinitely, and I see problems on the horizon as people change their priorities.

<comment><AUTHOR> The only direct variable which has an inverse relation to the vicious cycle is the property tax rate, as higher property taxes increases the effective price for property ownership. In California due to Prop 13, the property tax rate (of ~1% of the initially appraised market value of the home) gets negated by inflation, and it's further countered in regions such as the Bay Area by the sustained increase in demand from the influx of residents and higher wage growth.</comment></comment>


Where are the best full-time coding bootcamps? - <AUTHOR> <comment><USER2> Try Lambda school, I'm not a shill I am however going to be a student.

Bootcamps get a bad rap and rightly so in most cases, do heavy research before you do anything.

</comment><comment><USER3> HackReactor in SF and Turing school in Denver. Have spoken at and worked with graduates from both.</comment>


Show HN: Free Thai-English dictionary for iOS - <AUTHOR> http://itunes.apple.com/app/id707246890

<comment><AUTHOR> I post this in case any language learners out there haven't discovered the app yet. Having an offline dictionary on the go is invaluable, and while most other Thai dictionaries for iOS are based on the LEXiTRON resource ([http://lexitron.nectec.or.th/](http://lexitron.nectec.or.th/)), which is really meant for Thais, this app is based on the crowd-sourced material of Thai-language.com, which is meant for English-speaking learners of Thai.</comment>


The Pleasures and Pains of Coffee (1830) - <AUTHOR> http://blissbat.net/balzac.html <comment><USER2> Balzac was a wild guy, and prolific. Here's how he worked:

Balzac drove himself relentlessly as a writer, motivated by enormous literary ambition as well as a never-ending string of creditors and endless cups of coffee; as Herbert J. Hunt has written, he engaged in "orgies of work punctuated by orgies of relaxation and pleasure." When Balzac was working, his working schedule was brutal: He ate a light dinner at 6:00 P.M., then went to bed. At 1:00 A.M. he rose and sat down at his writing table for a seven-hour stretch of work. At 8:00 A.M. he allowed himself a ninety-minute nap; then, from 9:30 to 4:00, he resumed work, drinking cup after cup of black coffee. (According to one estimate, he drank as many as fifty cups a day.) At 4:00 P.M. Balzac took a walk, had a bath, and received visitors until 6:00, when the cycle started all over again. "The days melt in my hands like ice in the sun," he wrote in 1830. "I'm not living, I'm wearing myself out in a horrible fashion–but whether I die of work or something else, it's all the same."[1]

[1] [http://meaningring.com/2015/05/06/daily-rituals-balzac-by- ma...](http://meaningring.com/2015/05/06/daily-rituals-balzac-by-mason- currey/)

<comment><USER3> I've also heard "50 cups a day" estimated for Voltaire. If true, it probably means something more like 50 shots of espresso, but I'm still skeptical in both cases.

<comment><USER4> 50 cups is up around the LD50 for caffeine if drinking drip coffee, iirc.

<comment><USER5> Maybe not if you work up to it.

<comment><USER6> Exactly, tolerance is a massive factor in whether you get a headache, or a seizure.

</comment></comment></comment></comment></comment><comment><USER7> I could write similar paens to Matcha, and the harsh truth, coffee lovers, is that the top feature of green tea is that it is not coffee.

Coffee , as is this piece by Balzac), is like dramatic prose, whereas green tea is like a haiku. Coffee seeks to kick the door open with it's legs, applying the full force of the femur (caffeine), sending the imbiber into a frenzy of activity, while green tea knocks on the door first (L Thanine). And isn't a polite knock enough to open many a door?

Coffee's influence is like a sugar rush, an exaggerated high followed by an artificial low, while green tea's influence is like a smooth lift-off.

For some reason, I end up choosing coffee when I'm stressed, and it worsens matters. I go for matcha when I'm well-rested and want to be productive, and it always leads to a good work session.

<comment><USER8> You can always take l-theanine with coffee, the combination is a common nootropic.

<comment><USER9> Indeed, YMMV but I take 200mg of L-Theanine with my morning coffee and I find it does a lot for my "caffeine jitters'. Research is mixed, but some trials suggest it is a real and substantial effect. Supposedly they have a synergistic effect when taken together, helping focus/attention even more than caffeine alone. It's not airtight, but L-theanine is cheap enough and the effect is noticeable enough for me to make it worth it. Probably the only nootropic I feel that way about. Some of my friends describe it as the closet thing to "legal adderall" you can get.

<comment><USER10> I've tried coffee / tea with L-Theanine and haven't really noticed a difference in focus, jitters, or anything like that. Then again I don't really get coffee 'jitters', or at least I don't notice it.

I was very interested in caffeine / theanine as a nootropic but after a few days of trying I've given up on the pursuit.

<comment><USER9> Yeah it's very YMMV. Although if you've never had caffeine jitters then you just may not be drinking enough to notice the effect. And supposedly the ratio matters. I "dose" at a 100mg:200mg caffeine:theanine ratio.

<comment><USER11> Also the brand/form of L-theanine seems to matter as well. I've tried several and the random cheap brand I purchased at the local health food store seems to have had the most noticable effects.

</comment></comment></comment></comment></comment></comment><comment><USER12> Pretty impressive from a linguistic standpoint how close an 1830's document reads like something that could have been written today (with perhaps a touch of pretentious formality). Try reading the communications of the US Founding Fathers less than a century before, and the stylistic changes are like night and day.

<comment><USER13> Translation from French, as others have pointed out. The original text is longer, and covers stimulants other than coffee, such as tobacco and sugar:

[http://www.bmlisieux.com/curiosa/excitant.htm](http://www.bmlisieux.com/curiosa/excitant.htm)

The French is slightly dated in some ways, but definitely could have been written today (albeit by an old school literary type, of which we have plenty).

<comment><USER14> it sounds like you are fluent in french. how closely does the phrase "liver spots" match the original text?

<comment><USER15> Here is the relevant French excerpt:

"Enfin, j'ai découvert une horrible et cruelle méthode, que je ne conseille qu'aux hommes d'une excessive vigueur, à cheveux noir et durs, à peau mélangée d'ocre et de vermillon, à mains carrées, à jambes en forme de balustres comme ceux de la place Louis XV."

The original text states "... with mixed/blended ochre and vermillion skin"

</comment></comment></comment></comment><comment><USER16> I alternate coffe with orzo coffee, barley coffee, or chicory coffee. They look like coffe, taste like coffe but have no have caffeine. And "natural". It's good to trick the addiction.

[https://www.amazon.co.uk/gp/aw/s/ref=is_s_ss_i_0_11?k=barley...](https://www.amazon.co.uk/gp/aw/s/ref=is_s_ss_i_0_11?k=barley+coffee)

<comment><USER17> > taste like coffee

For wildly varying values of 'taste'...

<comment><USER18> Yeah, I'm not sure what coffee they've been drinking, but I've never found e.g. chicory to be anything even _slightly_ like good coffee.

<comment><USER16> Try barley then

</comment></comment></comment></comment><comment><USER19> I had an experience the other day that fit the later scenario he describes. Had to go home and take a nap. It was a throbbing headache and feeling to vomit, all because of coffee on an empty stomach!

I guess I don't have thick black hair and enough liver spots to handle it. :(

<comment><USER20> I'm not terribly addicted to coffee and actually prefer decaf (hate the jitters), but for the last few weeks I've been drinking 2-3 cups a day at work. I got a terrible headache on Saturday, just because there was no longer a steady supply of caffeine. Caffeine hangover is real.

<comment><USER21> Did you replace the coffee intake with other liquids? Usually when I see people experience "caffeine headaches", they tend to be the types who get most of their liquid intake from caffeinated sources. So, they end up with a headache from mild dehydration.

<comment><USER22> I was starting my day with a pot of coffee, and water/herbal tea throughout the day. I figured a pot a day wasn't good, so I went cold turkey after I ran out; had a horrid dull throbbing headache for the next few days (thought I was coming down with something till I realised).

</comment></comment></comment></comment><comment><USER23> It's pleasing that a great French writer expounds on coffee, and (a century later) a great British one treats us to the requirements for a nice cup of tea: [https://www.theorwellprize.co.uk/the-orwell- prize/orwell/ess...](https://www.theorwellprize.co.uk/the-orwell- prize/orwell/essays-and-other-works/a-nice-cup-of-tea/)

</comment><comment><USER24> Is coffee a zero sum game? for me, I noticed that with time you have to keep increasing the dose to keep the same level of effect.

<comment><USER25> Supposedly, the number of adenosine receptors in your brain increases over time with caffeine consumption, creating a tolerance to caffeine.

I've read articles [1] which suggest that cycling off caffeine for 7-12 days helps reset the number of adenosine receptors to the baseline.

[1] [http://www.smithsonianmag.com/science-nature/this-is-how- you...](http://www.smithsonianmag.com/science-nature/this-is-how-your-brain- becomes-addicted-to-caffeine-26861037/)

<comment><USER26> There is a limit to how many receptors you can have, which limits how much "wakeup" coffee can produce. Once you hit the limit and fill them up, the only affect you get from more coffee are the negative problems. I vaguely remember it being like 400mg of caffeine or something like that.

<comment><USER27> 400mg is about 3-5 cups of coffee a day depending on the roast.

<comment><USER28> Except at Starbucks, where their coffees are large and strong!

Tall 260mg Grande 330mg Venti 415mg

<comment><USER17> Venti=20oz, a 'cup' of coffee is typically considered to be 5-6 oz, so the numbers still line up.

<comment><USER29> It's also three shots (by default) making the lining up even clearer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> Is drinking coffee on an empty stomach actually considered harmful? I do it daily every day of the week. My first meal of the day is lunch a few hours after I've had either an Americano with 2-3 shots of espresso, or a regular coffee with 1-2 espresso shots in it. Almost always black.

On a low carb diet, I get GI distress generally after eating lunch, but outside of dieting I haven't noticed any adverse effects related to it. I've been doing this every weekday for over 2 years now.

<comment><USER29> "Doctor, doctor! I haven't any symptoms!"

</comment></comment><comment><USER31> I remember reading this on HN like 4 years ago and have been trying to find it again ever since! Thanks for posting.

<comment><USER32> Ah yes - previous discussion, 37 comments. 108/125 points depending on who you ask ;)

[https://news.ycombinator.com/item?id=7921691](https://news.ycombinator.com/item?id=7921691)

</comment></comment><comment><USER33> That's eloquent and evocative, and resonates just as well today, 200 years later. I was going to comment on how such a mundane observation from long ago makes for an interesting read in and of itself, but it's clear from the content that this wasn't a condition oft-encountered by common folk; there was significant social stratification that made coffee (and coffeehouses) a pastime or performance-enhancing substance of the _haute_ and _petite_ _bourgeoisie_ and not of everyday wage-earners, while the same is hardly true today.

From nightshift millennials to busy gen-X professionals, from the purpose- oriented to the traditionalists, from the pines of the Nordics to the pampas of South America, the populace of lots of countries is quite caffeinated throughout.

</comment><comment><USER34> Reading that essay, I kept thinking if his next step would be inserting the coffee rectally. I'm surprised he never got to that point.

</comment><comment><USER35> There's also Bach's _Coffee Cantata_.

[https://en.wikipedia.org/wiki/Schweigt_stille,_plaudert_nich...](https://en.wikipedia.org/wiki/Schweigt_stille,_plaudert_nicht,_BWV_211)

</comment><comment><USER36> Relevant

[http://video.newyorker.com/watch/exclusive-clip-of-le- cafe-d...](http://video.newyorker.com/watch/exclusive-clip-of-le-cafe-de- balzac-from-the-new-yorker-presents)

</comment><comment><USER37> Would love to find the original french.

<comment><USER38> It was linked elsewhere in this thread: [http://www.bmlisieux.com/curiosa/excitant.htm](http://www.bmlisieux.com/curiosa/excitant.htm)</comment></comment>


A Traffic Analysis of Windows 10 - <AUTHOR> http://localghost.org/posts/a-traffic-analysis-of-windows-10

<comment><USER2> "Information transmitted:

All text typed on the keyboard is stored in temporary files, and sent (once per 30 mins) to:"

No. Way. I don't believe it. Someone please investigate.

Edit: looking at the comment section of this article it appears there are other skeptics that raise good points. I'd love to see someone attempt to independently investigate this. If I had time I'd do it.</comment>


Indefinite prison for suspect who won't decrypt hard drives, US government says - <AUTHOR> http://arstechnica.co.uk/tech-policy/2016/05/indefinite-prison-for-not-decrypting-hard-drives-usa/ <comment><USER2> The best part of this whole story is the unintended consequence of attack. Don't like someone, encrypt a zip drive with drivel, toss it in his car and call the cops. Say you saw him looking at what could be kiddie porn. The guy doesn't know the password. Life in prison. No excuse.

This applies not merely to Bob in Accounting that's a dick, but to everyone: Congress! Start sniping political enemies. A jump drive here. A hard drive there. Soon, you could have 6 or so Congressional individuals going to jail for a child porn ring. The Feds would think it's a great prisoner dilemma. No one's turning on each other. Again, anonymous tip claiming that the right honorable Representative Duggans was watching kiddie porn late at night in his office. The same tipster told the police that while he was jacking it he thanked Representative O'Connel for the present over the phone (make sure to wait for an actual call so their is evidence).

Sure eventually all of this will die down. Until then, for $100 bucks and a few hours you can sit back, eat some popcorn and watch the system implode. Do it right and you'll get years of fun for everyone.

<comment><USER3> Or you could just put actual kiddie porn on the planted hard drives and save yourself this entire legal conundrum.

<comment><USER4> Coming up with real fake evidence is a lot harder than just coming up with a random blob that the cops think is evidence the suspect is hiding.

E.g. are you really able to carefully craft a filesystem image that you're sure has no metadata that proves the innocence of the suspect?

<comment><USER5> Eh, not so hard. Proxy their internet for a browsing session, and you put thumbnails of images in their cache. If they have any encrypted drive, or any encrypted blobs (could push those into their cache as well), and they're not going to have a great day.

Cached images has been enough to put away more than a few folks - there was also recently a story about using exactly that tactic against a suspected spy.

<comment><USER4> This is really moving the goalpost from the grandparent's comment of "encrypt a zip drive with drivel, toss it in his car and call the cops".

Yes of course you can get an active MiTM session going you can do a lot of shady stuff.

<comment><USER5> It can easily be used in tandem with the encrypted drive, to create probable cause to suspect the drive.

And MiTM is far too simple to do. One of my friends was able to rickroll many a person with about $100 of gear. It was always troubling to watch my computer connect to my home network while at a conference, with no real notification to me.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is an important constitutional issue! The subject may be deplorable, but the root issue is not.

If it is a "foregone conclusion", then they should have no problem convicting the guy without forcing him to testify against himself. If it is not a "foregone conclusion", then they have been lying and are illegally (unconstitutionally) depriving him of his freedom for months, without even charging him with a crime!

<comment><USER7> >Investigators say they know child porn is on the drives. His sister saw some of it and the suspect is said to have shown his family an illicit video, too.

So that's their basis for this "foregone conclusion" apparently. That at one point in time it was witnessed.

That is very dangerous logic.

The sadest thing in this is that it took child pornography to make the headlines, not political activism or journalism but the most despicable crime in our modern society.

<comment><USER8> It's also totally insignificant. He could have broadcast it all over Times Square. That in no way waives his right against self-incrimination under the Fifth Amendment.

Also, every prosecutor in history has thought their entire case in chief was a "foregone conclusion." That's totally irrelevant.

<comment><USER9> It's baffling to me that people are treating "he _will_ be found guilty" as evidence that he's already guilty and can be punished freely. We've got a code of laws specifically designed to avoid Inquisition-style "accusation of guilt is presumption of guilt" thinking.

<comment><USER10> In the past in Europe, there existed the concept of "partially guilty." Someone got shot and you were seen in the vicinity of the crime scene with a gun? You're 25% guilty. Then you're tortured (since you're 25% guilty, it's not torture of an innocent, but punishment), and under torture you "confess", making you fully guilty.

Source: Foucault's Discipline and Punish

<comment><USER9> That's absolutely fascinating, thank you. I need to finally suck it up and go read _Discipline and Punish_.

As much as I'm not on board with "confession through torture", I wonder if non-boolean guilt could help sort out some of the dumber quirks of our legal system. As is we just have "innocent" and "guilty" (which is either 51% chance of guilt in civil cases, or 'beyond reasonable doubt' in criminal ones).

But we're clearly fumbling around for new values. The Supreme Court decision about retrials (that "probably would have been found innocent at original trial" is not enough to justify a retrial) clearly makes more sense in terms of real-valued guilt - we can then set some actual standard for retrial, which is different from the standard for conviction. Perhaps you get convicted at 90% guilty in criminal cases, but don't get to open a retrial unless your estimate drops to 70% guilty.

Now I'm fascinated. What would real-valued guilt look like in a modern system?

</comment></comment></comment></comment></comment></comment><comment><USER11> I find this interesting, as I would almost certainly have forgotten my password by now, it only takes me 4-6 months of never using a password to forget it, so I wonder what happens if you can't decrypt your drives, due to honest forgetting from sitting in jail refusing to, or from some sort of deadman's switch or similar that drops keys after N days.

<comment><USER12> > or similar that drops keys after N days

This cannot exist on "dumb" hardware.

</comment></comment><comment><USER13> >... it's a "foregone conclusion" that illegal porn is on the drives, ...

Obviously not if the government needs the suspect to tell them where to find the porn in the keyspace. The porn at this point literally does not exist on the computer. The government is asking the suspect to find it for them there.

So the question here is; can the government compel someone to help the government find evidence against them?

This reminds me of something a Pakistani coworker said. He said that in the area of Pakistan he grew up in they had the best police force anywhere. There were no unsolved crimes. Someone always confessed...

So this is the same sort of thing. Torture someone long enough with indefinite detention and they will eventually come up with something to indict themselves with. There has to be something illegal in any well used computer.

<comment><USER14> Pretty sure that's in violation of the fifth amendment (self-incrimination).

</comment></comment><comment><USER15> Contempt is appealable, and in stories about appeals for long contempt sentences it appears that the likely sentence for the underlying matter is a factor. So, as a practical matter, this might mean that refusal to unlock a drive will net you the same sentence as if you were tried and found guilty for whatever crime was supposed to be on the drive.

</comment><comment><USER16> This effectively makes forgetting one's password a crime with a lifetime jail sentence... Not bad, not bad

<comment><USER17> No it doesn't. They found evidence on his computer that strongly suggests there is child porn on the encrypted drive, there are witnesses that claim "John Doe" showed them child porn _and_ he admitted to knowing the password initially, it was only later he claimed he forgot.

Prosecutors need sufficient evidence to obtain from a judge warrants, and in this case a decryption order, before they can hold you in contempt of court.

Of course, the evidence required for a warrant is still typically less than what is necessary to convict. The issue here is something to do with fifth amendment rights, which honestly I don't know a lot about because I'm Australian.

</comment></comment><comment><USER18> Thats pretty scary.

I've travelled with encrypted drives where I didn't know the password before. (Forgot it & was bringing the drive to someone for their own use after formatting).

</comment><comment><USER19> I agree with the overall idea that this is an interesting/problematic case, but I think the discussion would be better served if we stopped assuming that the authorities here are morons.

No, forgetting your password is not a lifetime sentence. No, not knowing the password for an item you've never seen is not a lifetime sentence either. Refusing to obey a judge's order, however, _will_ get you in trouble. Again, these people are not morons, and if they say the guy is only pretending to have forgotten his password (a dishonest criminal? shocking), they might have a good reason.

<comment><USER20> The reasons are stated in the article (the suspect never mistyped his password, and always remembered it), and addressed by the commentators you criticize (under pressure and after seven months without typing it, it is not impossible that you forget a possibly complicated password).

Even if you think that chances are high that the guy both is guilty of some crime and remembers the password, that still leaves the "what if he is actually innocent and actually forgot his password" case. Indefinite prison sure seems a hard sentence in the latter case, which you cannot refute beyond reasonable doubt.

<comment><USER21> > The suspect never mistyped his password, and always remembered it

They even went so far as to say he always got it right on the first try.

I found that very interesting... How would they possibly know that? If they had a key logger obviously they would already know the password.

Does FileVault store some indication of failed login count? That isn't reset after a valid login?

<comment><USER21> Actually, does this mean that Apple could be logging successful / unsuccessful decryption counts for FireVault volumes? Is there some sort of lock-out feature they are running?

</comment></comment></comment></comment><comment><USER22> Apart from the obvious assault on the presumption of innocence here, is there a cryptographic file-system that stores a secret X and Y that given a key k_x would decrypt the content X and given k_y would decrypt the content Y without revealing to an attacker that there are multiple contents?

If yes, than one could store a real secret X and store a false secret Y, something that looks like a secret enough to be perceived as a secret. Then in case of torture, government persecution, etc, the victim could reveal only Y.

<comment><USER23> Yes, this was a feature of Truecrypt, though I'm not familiar with the underlying crypto.

<comment><USER24> It just uses data layout. Normal volumes have some wasted space filled with random data. Volumes with hidden volumes inside them fill that space with a second header. If the outer volume is naively mounted, writes can destroy the data stored in the inner volume.

</comment></comment></comment><comment><USER25> I'm quite surprised that they can break Freenet but can't break FileVault (I remember reading an article about a Filevault master password that is short and brute-forceable but can't find it atm). I would have bet the other way around.

<comment><USER26> Freenet has only symbolic privacy protection for downloaders. Privacy is supposed to come from your node requesting not only blobs it is downloading for itself, but also blobs other nodes have requested from it. Unfortunately, as far as I understand, freenet's routing algorithm is such that these two classes of requests come from blatantly different statistical distributions. The further a requested blob is from a node's address the more likely it is the node is requesting the blob for itself. Another layer of protection is the blocks being encrypted, but if they are publicly published that can be changed with a bit of scraping.

What this means is that by running a single freenet node you can monitor half a hundred others. What's surprising is that it hasn't been done earlier. You don't even have to commit a crime to do it as a civilian.

This could have been avoided if freenet was hoisted on top of tor (not totally trivial because freenet runs over udp) or had an onion routing layer of its own. If the glaring privacy flaw was fixed freenet would have amazing properties which tor lacks, namely very safe and scalable (no dos unless you take down the whole of freenet) static hosting and non-realtime communication in general, and utter censorship resistance. Trying to figure out who has a blob only spreads it around more.

It's a shame the ideas behind tor and freenet haven't come together in a popular project.

</comment></comment><comment><USER27> This certainly points towards having more widespread support for plausible deniability, no? Are there any mass encryption tools that are reasonably simple to set up providing this (besides TrueCrypt Hidden Volumes)?

Would someone continue to be held in contempt if they furnished a decrypted drive that didn't contain the information that court held as a "foregone conclusion" that it contained?

<comment><USER28> Why besides TrueCrypt?

<comment><USER29> because it's supposed to be broken and/or backdoored since may 2014 when the development abruptly stopped and weird warnings appeared on the official site to switch to alternative programs

<comment><USER30> There's no evidence it's been "backdoored since may 2014." There were no changes at that point in time.

<comment><USER31> "supposed [...] since may 2014"

</comment></comment></comment></comment></comment><comment><USER32> In the UK, this is actually legal sadly.

<comment><USER33> Sections 49 & 53 of the RIPA allows for up to two years imprisonment for failing to provide unencrypted copies of key material. Not quite the same as life. Although I wouldn't be surprised if they managed to abuse it in this way.

<comment><USER34> > Although I wouldn't be surprised if they managed to abuse it in this way.

Simple. Imprison someone for two years. Demand they provide key material again. Rinse and repeat.

<comment><USER35> Idk how it works in the UK, but in the US you can't charge someone for the same crime twice.

<comment><USER36> .. Unless they've committed it twice. 'Failure to abandon your fifth amendment rights', 05/2016\. 'Failure to abandon your fifth amendment rights', 05/2018\. 'Failure to abandon your fifth amendment rights', 05/2020\. etc.

</comment></comment></comment></comment></comment><comment><USER37> Seven months imprisoned without trial and counting. The technicalities about contempt and hard drives are a distraction; the real injustice is that, as a routine matter, the US government no longer gives trials without extensive pre-trial punishment.

</comment><comment><USER38> and what happens if I forgot my password?

<comment><USER7> >The defendant, who is referred to as "John Doe" in court papers, claims he forgot the passwords. The suspect's identity is Francis Rawls, according to trial court papers.

> In fact, Doe had multiple layers of password protection on his devices, and > he always entered his passcodes for all of his devices from memory. Doe > never had any trouble remembering his passcodes (other than when compelled > to do so by the federal court), never hesitated when entering the passcodes, > and never failed to gain entry on his first attempt.

<comment><USER33> Which in itself isn't really valid. Under immense stress, memory fails. I'd wager facing a long prison sentence for a crime that will make you a big target in an already hostile environment would be pretty stressful.

<comment><USER39> I was going to comment the same thing. If I'd been imprisoned for 7 months, there's a good chance I'd forget my password manager master password too... I remember it now because I enter it multiple times a day. After 7 months, under duress and stress? I'm not sure if I would...

<comment><USER33> Meanwhile a laptop I didn't access for 3 months has a boot password (that I must not have needed for >3 months ontop of that) is now locked away and without any ability for me to login to.

And that was without going to prison

<comment><USER40> Open it up and remove the CMOS battery for a while then replace it. That will remove a BIOS password. OTOH, if you encrypted the drive...

<comment><USER33> > if you encrypted the drive...

Yep, LUKS AES-256. I seem to recall someone demonstrating how to crack LUKS for fun, but I can't remember where I found that article, nor enough keywords to find it again. I might just be failing at Google, mind.

</comment></comment></comment></comment></comment></comment></comment><comment><USER41> _The exam showed that Doe accessed or attempted to access more than 20,000 files with file names consistent with obvious child pornography_

Is nobody else alarmed that OS X apparently logs any and all( or at least 20k records )file accesses by default? This is way too many to be found in the HFS journal, so it's clearly intentionally logging all accesses.

Edit: They also appear to have been able to deanonymize the defendant's FreeNet usage, though this could have easily been OPSEC violations rather than technical shenanigans.

</comment><comment><USER42> Scary sh#t. What if inmate forgot the password? I cannot remember 4-digit PIN on a year old card I hardly used.

</comment><comment><USER43> Ars Technica chose to illustrate this article with a perspective-distorted screenshot of md5-crypt-encrypted passwords, the entire point of which is to prevent the person who has the encrypted password from being able to decrypt it.

</comment><comment><USER44> The ACLU or EFF need to jump on this case. The precident set by this is too important to leave to some randomly assigned public defender.

</comment><comment><USER45> What would happen if the suspect destroyed keys prior to arrest? (ignoring the similar difficulty of proving this)

</comment><comment><USER46> One more reason to have plausible deniability features.

</comment><comment><USER47> Why doesn't the Fifth Amendment cover this?

<comment><USER48> For much the same reason that it's not against the fifth amendment to ask a suspect to unlock a safe.

[http://lawcomic.net/guide/?p=2897](http://lawcomic.net/guide/?p=2897)

</comment></comment><comment><USER45> what would happen if a suspect destroyed the keys?

</comment><comment><USER49> Obligatory XKCD: [https://xkcd.com/538/](https://xkcd.com/538/)

<comment><USER50> In case you're curious, this is often called rubber-hose cryptanalysis:

[https://en.wikipedia.org/wiki/Rubber- hose_cryptanalysis](https://en.wikipedia.org/wiki/Rubber-hose_cryptanalysis)

<comment><USER42> In Russia, if you are curious this is often called rectal high temperature cryptanalysis. There is manual.

[http://lurkmore.to/%D0%A2%D0%B5%D1%80%D0%BC%D0%BE%D1%80%D0%B...](http://lurkmore.to/%D0%A2%D0%B5%D1%80%D0%BC%D0%BE%D1%80%D0%B5%D0%BA%D1%82%D0%B0%D0%BB%D1%8C%D0%BD%D1%8B%D0%B9_%D0%BA%D1%80%D0%B8%D0%BF%D1%82%D0%BE%D0%B0%D0%BD%D0%B0%D0%BB%D0%B8%D0%B7%D0%B0%D1%82%D0%BE%D1%80)

</comment></comment></comment><comment><USER51> "USA land of the free..." Really what happened with your country ? In EU you can't imprison someone for not decrypting hard drive if he says it can incriminate him, everyone understand this but not the biggest democracy in the world?

<comment><USER52> The whole EU? No, a small island has some lunitic laws.

[https://en.wikipedia.org/wiki/Key_disclosure_law#United_King...](https://en.wikipedia.org/wiki/Key_disclosure_law#United_Kingdom)

<comment><USER53> Well, to be fair the UK is more like the 51st state than part of the EU.

</comment></comment></comment><comment><USER54> Let's not use euphemisms like "kiddie porn" and realize the danger that child pornography feeds the child slavery industry. The core issue is that the suspect is potentially hiding his network, clients or victims' identities. Until he surrenders his hard drives, the truth may never come out.

<comment><USER55> If there is useful information for law enforcement unrelated to the case at hand, it seems that we have plenty of already-existing mechanisms. They could offer him immunity in exchange for unlocking the drive, thus completely skirting the fifth amendment issue, or they could convict him based on other evidence, and offer favorable sentencing in exchange for unlocking the drive.

The fact that he is being compelled to offer evidence against himself seems like the dubious part of this whole proceeding.</comment></comment>


Show HN: Campus Bubble pitch deck - <AUTHOR> http://thecampusbubble.com/investors/

<comment><AUTHOR> Where are those famous HN critiques? Feedback hugely appreciated.</comment>


Prebake: Block EU Cookie Notices with Adblock - <AUTHOR> http://prebake.eu/

<comment><USER2> I like it! Can you include a link to uBlock Origin as well?

This being mostly rules that hide DOM elements by CSS I wonder if it works with uMatrix too. Last I checked uMatrix didn't seem to support hiding stuff in the DOM, only blocking resources.

<comment><AUTHOR> In my uBlock Origin I've found an option box (so it's easy). Just search for "Prebake" in options->filter of uBlock with Ctrl+f (or cmd+f on OS X).</comment></comment>


Privacy vs. "I Have Nothing to Hide" - <AUTHOR> https://kevq.uk/privacy-vs-i-have-nothing-to-hide/ <comment><USER2> +1 "I really hope the tech giants start respecting their user's privacy"

Their business is make money with their users (or used). We must demand a new way to make money, start to think again that privacy matters. But new generations has been striped of that thought, and it's hard to change that mind… Let's continue offering different choices, different and ethical services… Greetings

</comment><comment><USER3> The author should probably revise the targeted advertising argument: many people I know feel they prefer targeted ads. "If I'm going to see ads I'd rather see ads for stuff I might actually want."

<comment><USER4> I prefer being able to support websites by looking at ads. I prefer looking at relevant ads over Viagra or hot chicks in my area.

I'm not willing to run 3rd party scripts in my browser I'm not willing to have my personal data collected and shared with 3rd parties

I value my privacy higher than the survival of websites, if they can't survive without endangering me I'm sorry but you're going to have to find other ways to monetize.

<comment><USER5> Problem is, there is close to nothing that an average web user can do in order to prevent any of these things from happening.

</comment></comment></comment><comment><USER6> "Everyone has committed a crime, it's about who we decide to prosecute" \--KGB [https://outline.com/x8FJ5B](https://outline.com/x8FJ5B)</comment>