Ask HN: Free speech friendly VPS hosts? - <AUTHOR> Are there any VPS providers that are friendly in terms of hosting free speech? Some examples:
1. Controversial but non-violent political speech?
2. Legal adult content
3. Content critical of some big business
Hosts that actively protect the privacy of clients from frivolous complaints will be even better. <comment><USER2> Your best friend here is to simply not be loud enough or known enough for someone to care. Even Cloudflare, whose founder doesn't believe in them interfering with content, decided not to harbor Nazi websites once they got attention for it.

Bear in mind, what you're asking here, is for a company to put their own reputation and business on the line to protect you. If your content is not welcome in the mainstream, a company hosting you faces boycotts, protests, resignations, leaks, etc. Even amongst people who would agree with you, they probably wouldn't be willing to take their own business on protecting yours.</comment>


How Go was Made - <AUTHOR> https://sourcegraph.com/blog/live/gophercon2015/123748269730 <comment><USER2> The article indirectly raised a few questions for me:

Why is there a massive skew favoring Googlers having their proposals implemented compared to plebes? Did the stats change after rob's talk in 2012?

<comment><USER3> The skeptic in me points at android and deduces that the whole focus of Google open source is skewing ecosystems towards google revenue and or hiring models.

<comment><USER4> The focus of Go's open source project is making a language that works well for the kind of networked software Google and many other companies write, roughly "cloud software". I am not sure what ecosystem that would skew toward Google revenue: maybe cloud providers, but Go works just as well on Amazon and Azure and Heroku as it does on Google's products. I am not sure what "hiring models" means, but I've literally never thought about anything related to the hiring process while working on Go.

For more about Go and open source, see my opening gophercon keynote, at blog.golang.org/open-source.

<comment><USER3> Thanks for taking the time to make a sincere rebuttal.

</comment></comment></comment></comment><comment><USER5> A separate issue - I never know exactly what people mean when they say this:

 _" Diverse teams are more innovative and adaptable than monocultures."_

<comment><USER6> Just that groups of different people with different thinking styles are able to come up with solutions to problems faster than a team of people who think alike or are beaten into group think by a strong central authority.

It really follows the pattern of biological diversity in ecosystems: a diverse ecosystem is able to thrive and overcome troubles more than a non-diverse one, which is actually quite fragile.

<comment><USER7> But a 'diverse' team is code for a team with both black and white people, men and women, straight and gay, etc.

So when you say that 'groups of different people with different thinking styles' you are implying that, for example, black people think differently from white people for the sole reason that they are black and other people are white. Or in other words, that if you get a random black person off the street you can assume his views will be different from a white person's?

Isn't that kind of grouping and assumption exactly what we don't want to promote? I can't reconcile this in my mind.

Anonymous because I don't want to be shamed as a racist when I'm not, but a genuine question.

<comment><USER8> The idea isn't that you make a pokemon team of people of all skin colors, sexualities and genders to have all damage types covered. It's more that cultural background and experiences made shape thinking, problem-solving approaches, etc, and if your team is 100% straight white affluent men, chances are pretty good they will all have roughly overlapping backgrounds and leave the vast majority of the human experience uncovered.

<comment><USER7> I don't get it - either it's right to look at the color of someone's skin and make an assumption about their background, or it isn't.

You could hire both a rich white guy and a poor black guy, in order to get diversity, and then find out they both love classical music, basketball, knitting, went to the same college and vote for the same political party.

If you're telling me you can look at the color of someone's skin and tell me what their cultural beliefs and background is then you're the crazy racist judgemental one!

<comment><USER9> I am glad to see this kind of doublethink addressed directly.

</comment></comment></comment></comment></comment></comment><comment><USER10> Go was made in China over 2500 years ago at which point it was called yì (弈). Then some guy had to name his programming language Go and make "Go programming" hard to search for.

<comment><USER11> Search for "golang".

<comment><USER12> What if you want to search algorithms related to the game?

<comment><USER13> It's also called baduk and weiqi, both should give good results

</comment></comment></comment></comment><comment><USER14> I have a question about the design of the garbage collector of Go. Does it also clean up goroutines that are waiting on a "forgotten" channel? And does this apply for processes waiting for each other in a cycle?

<comment><USER15> No, goroutines are never cleaned up until they exit. If they are blocked on a channel that no-one else references then they'll be blocked forever.

</comment></comment><comment><USER16> Start with an existing language (Brand X). Reimplement it almost identically with modern-looking syntax. Improve and worsen it with some change. Give it a new name. Apparently a method that works:

[http://cowlark.com/2009-11-15-go/](http://cowlark.com/2009-11-15-go/)

In all seriousness, though, they could've just independently rediscovered a lot of wise design decisions. Strange if they'd never seen this one studying programming language history, though. I'm with the author wishing they applied the innovations that have happened in recent decades or even new ones. Julia is an example of an imperative one that tries to do that.

<comment><USER17> > Strange if they'd never seen this one studying programming language history

Read this summary of Robert Griesemer's talk (The Evolution of Go) then you don't have to speculate: [https://sourcegraph.com/blog/live/gophercon2015/123645585015](https://sourcegraph.com/blog/live/gophercon2015/123645585015)

<comment><USER16> Thanks for the talk as it was interesting! A friend who pushes Go on other forums talked about how it reminded him of programming in his favorite, Wirth- style languages. Interesting that re-creating that experience was an explicit design goal with them drawing on good features of Wirth languages, ALGOL60 (not ALGOL68), and others. The ALGOL60 quote was similarly impressive:

"Hoare said of it, 'Here is a language so far ahead of its time, that it was not only an improvement on its predecessors, but also _nearly all its successors_.'"

Quite an achievement. It was had by using only experienced language designers on the committee. Modern committee-driven actions could learn from this technique of using people with brains and experience.

One of their smartest moves was how they marketed it. Many nice language designs happen but don't get any traction. Their design choices, tooling efforts, and big company support have been _much_ better than the Java rollout and many minor attempts. My hope for the language is that it replaces the use of C# and Java in as many places as possible so people don't have to learn all that mess in maintenance phase. The simpler language should make for nice legacy code work, I think.

Bookmarking the article.

</comment></comment></comment><comment><USER5> Although Go is more popular than ever, I'm not sure the following observations are good signs. Something about them makes me uncomfortable.

 _" The decision process was consensus driven."_

 _" The first Go program was the prime sieve."_

 _" In July 2008, the project became more serious."_

<comment><USER4> Can I ask why those make you uncomfortable?

<comment><USER5> Good question.

Design by consensus generally produces inferior results. The first version of the most noteworthy innovations are often the result of a single person's effort. But it's also evident big projects are the results of teams. You can't produce something big without a team.

So what makes me uncomfortable is that I don't see one of the inventors of Go having produced a rough version one before pulling other people in (but to be fair, I simply don't know).

I'm more suspicious about the first Go program. Was computing a prime sieve the number one problem the Go creators had? Doubtful. When C was being written, the authors were also writing an application they deeply needed: UNIX.

Finally, the thought of making something "serious" spoils the general hack flavor of innovative solutions. It's like a beacon that ideas are about to start being policed, which sounds like the opposite effect consensus intends to produce. It may be a good idea to keep a project non-serious as long as possible instead of optimizing it prematurely.

<comment><USER12> > I don't see one of the inventors of Go having produced a rough version one > before pulling other people in

Well, Ken Thompson _did_ create B...

<comment><USER18> Actually, he adapted BCPL by changing a bit the syntax and taking a few things out to fit into the PDP, but even the manuals were almost a copy from the BCPL ones.

[https://vimeo.com/132192250](https://vimeo.com/132192250)

</comment></comment></comment></comment></comment><comment><USER19> > Go began with Robert Griesemer, Rob Pike, and Ken Thompson. "What should a > modern programming language look like" (the story goes as they were waiting > for some C++ to compile).

Cute. Nice to keep a dig[1] going. Since that horse has been kicked quite a few times over the years, how about those in the Go community address these language criticisms:

[http://yager.io/programming/go.html](http://yager.io/programming/go.html)

For specific examples from the aforementioned link:

      The "correct" way to build generic data structures
      in Go is to cast things to the top type and then
      put them in the data structure. This is how Java
      used to work, circa 2004.

And:

      Go has the null pointer (nil). I consider it a
      shame whenever a new language, tabula rasa,
      chooses to re-implement this unnecessary
      bug-inducing feature.

Of which the latter has been regretted by its inventor[2] for years.

1 - "[C++] certainly has its good points. But by and large I think it's a bad language." (source: [https://en.wikiquote.org/wiki/Ken_Thompson](https://en.wikiquote.org/wiki/Ken_Thompson))

2 - [http://www.wisdomandwonder.com/link/2015/tony-hoare-sorry- fo...](http://www.wisdomandwonder.com/link/2015/tony-hoare-sorry-for- inventing-the-null-pointer)

<comment><USER20> Here, I'll address one of them:

"It is an extremely common occurrence for a programmer to accidentally forget to account for the possibility that a pointer may be null, potentially leading to (at best) crashes and (at worst) exploitable vulnerabilities."

Null pointers won't result in exploitable vulnerabilities in Go (not counting straightforward DoS-by-causing-the-program-to-panic). They might, in very rare cases, result in something exploitable in C or C++, because dereference of null is undefined behavior and the compiler is free to optimize accordingly. But in Golang the language semantics require the runtime to panic on nil dereference, so that won't result in something like RCE as it technically could in C or C++ (but isn't likely to).

<comment><USER19> > But in Golang the language semantics require the runtime to panic on nil > dereference, so that won't result in something like RCE as it technically > could in C or C++ (but isn't likely to).

While you thoughtfully address the concerns Mr. Yager presents regarding the potential result of using a null pointer in Go, IMHO the more relevant fact is that Mr. Hoare identified in his own words a mistake he made _fifty years ago_ (1965) by introducing "null."

The fact that Mr. Gerrand stated in the submitted article:

"What should a modern programming language look like"

Begs the questions:

Why is this mistake oft addressed in _other_ languages repeated in Go?

What are the benefits of _intentionally_ introducing this boundary condition into the language?

Put bluntly, there is no benefit to dragging 0x0 forward in "a modern programming language." The lack of an answer to a function/method call is trivially encoded with some form of an option[1] type.

1 - [https://en.wikipedia.org/wiki/Option_type](https://en.wikipedia.org/wiki/Option_type)

<comment><USER21> nil dereference is only really critical if it can result in security issues like in C and C++. After that there are a lot of class of errors that are possible even in stronger types systems like in Haskell, nil dereference is only one of them.

The question ultimately is what is the shortest path to developing a functioning and correct program ? Compilers can be very smart and help you catch a lot of errors but they can also introduce friction if they become too slow. Everyone has different opinions about the "best" because we have different ways of getting to the end-result. Programming is a discovery process and some people prefer to think a lot upfront, some like to experiment and probably a different mix of both for every one of us.

All this to say that nil in Go is not an absolute mistake. It's just a trade- off like everything else. Since I took Haskell as an example, it's also much much slower to compile.

<comment><USER22> In my experience, unless you enable all the crazy type system extensions (which isn't a terribly good idea IMO), GHC doesn't really spend that much time typechecking programs. Most of the time is spent on optimizations, which are (0) possible thanks to purity [hooray!], (1) necessary to overcome the limitations of laziness [dangit!].

In any case, Haskell supports exploratory programming just fine. It's true that Haskell's definition of "exploring" (refine your design until you can convice GHCi and QuickCheck that it makes sense) is somewhat idiosyncratic from a Lisper or Smalltalker's point of view (refine your design until you can convince _yourself_ that it makes sense), but that doesn't make it any less legitimate. It's still experimenting, except now you have a tool to validate the degree to which the experiment has been a success. It's experimental _science_ , not experimental art.

\---

On the specific topic of nils, I think it's fair to say they're an absolute mistake in a statically typed language first released as late as in 2007. Standard ML and OCaml, both much older languages, have parametric polymorphism, algebraic data types, freedom from nils, and fast compilers: Poly/ML and OCaml's bytecode compiler, respectively. In addition, both Standad ML and OCaml have unrestricted imperative facilities, so freedom from nils is perfectly possible in an imperative language.

\---

Regarding the classes of errors that are still possible in type systems like Haskell's, I have found only one that really matters, and where the usual workarounds (e.g., phantom types) don't help. Haskell, being a mathematically- inspired language, favors programming in terms of "timeless" entities whose existence is unaffected by the number of times you use them. While appropriate for manipulating pure data (numbers, strings, lists, trees, etc.), it's awkward for manipulating ephemeral computational _resources_ , such as file descriptors or open sessions.

A language that fares better in this regard is Rust. Rust has parametric polymorphism, algebraic data types, freedom from nils (are we seeing a common theme?) and type classes, but gives up on interactive programming in exchange for precise control over data structure representation and resource management. Rust's type system design understands very well the ephemeral nature of objects: When a non-`Copy` object is passed around elsewhere, it's truly gone from the current lexical context.

\---

Now, I don't want to give the impression that I think verification is the be all and end all of computer programming. There's plenty of room for languages that let you develop "fast and loose" solutions, as opposed to follow some principled philosophy. (Ruby comes to mind.) However, Go's very own marketing suggests that this isn't what they're trying to achieve. They _do_ want a language that enforces a programming discipline. They just happen to have designed a language whose discipline doesn't provide enough benefits to justify the freedom restriction.

<comment><USER21> You are making some really good points.

One thing I would like to observe is that all the languages that you are citing that don't implement nil also implement patter-matching. All have something equivalent to the Haskell Maybe type which needs to unwrap the value upon utilization.

I would be open to admit that nil is an absolute mistake if you can demonstrate that unwrapping is as convenient as just checking for nil and then using the value (or present another mechanism that is as convenient).

In regards to possible class of errors in Haskell I can think of a few: any non-terminating program, any program that blows up the memory. It's possible to implement a Monad that doesn't obey the monadic laws. It's possible to inverse the order of arguments inadvertently if they have the same type. Any insufficiently specified type, like using Int when only a range of Int is acceptable or any String when only a URL is acceptable. I'm sure there are more ;)

<comment><USER22> > if you can demonstrate that unwrapping is as convenient as just checking for > nil and then using the value.

If you want to build a largefail at any point computation that may abort at any point in the middle, you can use the MaybeT monad transformer. Or EitherT, if you want to supply an error message when you fail. Inside a `do` block, it looks just the same as imperative code. So no syntactic convenience is lost.

But the real benefit, at least in my opinion, is the ability to design APIs that allow less room for error. In the vast majority of cases, pointers and references simply aren't intended to be nullable in the first place.

> It's possible to implement a Monad that doesn't obey the monadic laws.

And it's possible to overload operators in C++ in ways that make no sense whatsoever as well. (Using the same operator for bit shifting and stream I/O, seriously?) At least Haskell has a culture of associating laws to type classes.

> It's possible to inverse[sic] the order of arguments inadvertently if they > have the same type.

No worse than any other language. If anything, Haskell's type system makes _more_ distinctions, so this specific error is less likely.

> Any insufficiently specified type, like using Int when only a range of Int > is acceptable or any String when only a URL is acceptable.

Idiomatic Haskell would make custom types, with smart constructors if necessary. Using String when a URL is expected is simply bad API design in Haskell.

\---

But, anyway, I'd rather not continue this subthread, since the topic is Go.</comment></comment></comment></comment></comment></comment></comment>


How United Onboards New Users - <AUTHOR> http://www.useronboard.com/how-united-onboards-new-users/ <comment><USER2> So I know it's bash United week, but to be honest this is not even near the worst I've seen from large-company apps.

Obviously their onboarding process is terrible, but putting new users aside, the app works pretty fine for existing customers. It gives you your boarding I passes, flight status, and reservations automatically. You change seats and check your upgrade status. I've even booked fligjts via the mobile app before (I've never seen that "something has gone wrong" dialogue at the end).

Overall I've found it functional, which I cannot say for many other apps made by large companies (I'm looking at you Chase).

And I wouldn't go so far as to say the lack of great user onboarding experience represents some sort of culture problem. Maybe they just don't have a large team? Maybe their engineers don't have UX experience? Maybe they haven't done user onboarding studies and realized these problems? (Personally I think it's lack of staffing, but I don't actually know anybody who works on the app.)

</comment><comment><USER3> I made a rant the other day about the 25-ish step process to pre-order a expansion pack for the MMO I play for access to the first week:

1\. Open the Lodestone 2\. Click expansion pre-order page. 3\. Get redirected to expansion promo page. 4\. Click pre-order. 5\. Get sent to the EU store. 6\. Log in with your Square Enix Store Account. 7\. Find expansion and purchase. 8\. Fill in purchase details, including phone number. 9\. Pay for item. 10\. Get told to check email for purchase verification. 11\. Click verification link in email. 12\. Get asked for phone number for verification. 13\. Enter code texted to me. 14\. Get told your purchase will be activated within a few hours and you will be emailed. 15\. Receive email (20 minutes later) and click link. 16\. Log in again with Square Enix Store Account. 17\. Click redeem key. Read scary warning aout not being able to redeem anymore. Obtain Key 1 18\. Go to expansion promo webpage. 19\. Login with your Square Enix Account (not the same as steps 6 or 16) 20\. Enter Key 1 on expansion promo web page. This one you can copy and paste 21\. Redeem Key 1. Get new key (Key 2). 22\. Head to account management website. 23\. Log in again with your Square Enix Account(same account as step 19, but not as steps 6 or 16). 24\. Enter key 2 (manually, no copy and paste for you) and redeem. 25\. Enter key 2 and redeem again because the form field is case sensitive. 26\. Congratulations, you have now pre-ordered stormblood.

Reddit link since I can't figure out how to format a 26 item list without it taking up half the page here with a blank line between each item or scrolling off the edge of the screen.

[https://www.reddit.com/r/ffxiv/comments/658y97/your_handy_25...](https://www.reddit.com/r/ffxiv/comments/658y97/your_handy_25step_and_4x_login_guide_to/)

It's a wonder some of these places get it _so_ wrong.

</comment><comment><USER4> Sadly this entirely skips the user registration, which probably includes the brain-dead variant of "security questions", essentially forcing you to choose from a fixed list of both questions and answers.

Pretty much everyone told United the end effect is pretty much eliminating any security, but they simply don't care.

</comment><comment><USER5> Hi all! I'm the person who made this. If you have any thoughts, please share em here. I will be checking this thread regularly. :)

</comment><comment><USER5> @davesailer Thank you for sharing this!

</comment><comment><USER6> With a blow to the head. :-)</comment>


CERN approves plans for a $23B, 62-mile long super-collider - <AUTHOR> https://www.engadget.com/cern-super-collider-higgs-boson-particle-092412017.html <comment><USER2> Made this comment below but spending billions on another collider in an attempt to essentially validate SUSY is irresponsible. A few years ago, a bunch of physical philosophers tried to justify this turn of particle physics in general away from experiment, particularly suggesting the search of symmetries and mathematical beauty (I guess) was enough of a justification for the work even though it essentially is contrary to the basic scientific principles of relying on experiment and observation. Now, we're seeing real world consequences of that mistake, billions in resources and potentially decades of man-hours to be devoted to another super-collider.

Honestly, this money could be spent on myriad other projects, not to mention towards fusion research or alternative energies (solar, wind) in general especially in the face of climate change. Again, seeing the failure of the LHC and then deciding you're going to double down is just straight irresponsible. I honestly wonder what member states are thinking when they see CERN contemplate this especially after the LHC failed to find SUSY particles.

This is just another painful reminder of how narrow minded some scientists are and so focused on their own little niche. There are so many larger problems the world is facing today, it's upsetting but not surprising no one at the table even asked the most important questions when making these plans, "is this even necessary?"

Last tidbit, there are next generation acceleration schemes using lasers that could promise much cheaper acceleration of particles on a much smaller scale (centimeters) although the brightness and general beam quality isn't quite there yet. That could be a potential route forward and be much cheaper in the long run, it just would require a) some time and research but more importantly b) the current crop of experimental scientists at CERN might find it not their expertise and so might not get the grants. Again, reiterating the narrow mindedness of scientists these days.

<comment><USER3> > Made this comment below but spending billions on another collider in an > attempt to essentially validate SUSY is irresponsible

I am in the same boat as you, more precisely I was, especially after reading guys like Jacques Ellul who had written against this particular project since back in the '80s.

But then I started thinking that keeping that many smart and motivated people busy working on stuff that will not be as societally disruptive as the work of many past great scientists is not the worst thing in the world, so I personally see those billions of euros as an acceptable opportunity cost that gives us the chance not to be the direct contemporaries of a nuclear weapons race like back in the '60s or the early '80s (because back then the "best" way to keep those scientists busy was to ask them to build bigger nuclear bombs and bigger rockets).

Incidentally I see the anti-competitive stance of the FAANG companies when it comes to their employees in the same vein. Better for a very smart engineer to spend his/her life doing menial work inside one of those companies than for him/her to build the next AI startup which in the wrong hands will not be good for society as a whole. And that type of technology always ends up in the "wrong" hands.

<comment><USER4> Spending tens of billions of dollars to keep scientists distracted so they might not potentially work on damaging projects is beyond absurd. For a start, I don't even think there's consensus that the Manhattan project wasn't beneficial as a whole, given the relative peace we've had since the second world war. What you said completely undermines a community that has undoubtedly advanced society more than any other.

<comment><USER3> > that has undoubtedly advanced society more than any other.

From here [1]

> Petrov was the duty officer at the command center for the Oko nuclear early- > warning system when the system reported that a missile had been launched > from the United States, followed by up to five more. Petrov judged the > reports to be a false alarm,[1] and his decision to disobey orders, against > Soviet military protocol,[2] is credited with having prevented an erroneous > retaliatory nuclear attack on the United States and its NATO allies that > could have resulted in a large-scale nuclear war.

There's a whole list of similar incidents (and I'm pretty sure not all of them have been officially reported). Personally I care more about the feelings of communities that don't bring us one button-push away from annihilating us as a species.

[1] [https://en.wikipedia.org/wiki/Stanislav_Petrov](https://en.wikipedia.org/wiki/Stanislav_Petrov)

<comment><USER5> Ahh..your talking about politic not science, that's something completely different.

</comment></comment></comment></comment></comment><comment><USER6> > It could be a hard sell, especially as the new collider wouldn't have as > clear a goal as the LHC did. However, particle physics and the Standard > Model are at a place where the application of science is needed to validate > theories.

I mean I understand the need to keep pushing the boundaries of fundamental physics, but how long do you justify such spending on a single project? That same money could possibly be pumped into more immediately useful "hard" applied problems like fusion reactors, clean energy, propulsion systems or pretty much any problem on the technology horizon that won't be funded by private capital.

<comment><USER7> > That same money could possibly be pumped into more immediately useful "hard" > applied problems like fusion reactors

Interesting, I just checked the number for ITER (i.e: Europe's main fusion project), the project has been estimated at around €20-30 billion (with some pessimistic estimates from the US at around €60 billion for the completion of the reactor). And that's considered a VERY HIGH cost and has been the main concern from participating countries. But somehow $23 billion for a new collider have been approved?

Edit: correction, $23 billion haven't been approved, the plans for a potential collider, estimated at $23 billion, have been approved.

<comment><USER8> Think of CERN more as a cultural endeavor. It's the big, permanent, multigenerational physicists jamboree. The big colliders are not the goal, they are merely the foundation. The meat is in the detectors and experiments that are attached and that would not be possible elsewhere. Sure, the flagship experiments are also important in their own right, but their function as a rallying point, as a halo product for everything else that is happening there is a big reason why they should be funded.

A reactor project is a much less colorful affair, focused on a single deliverable. More contractors, less postgrads. There should be money for both.

</comment></comment></comment><comment><USER9> Everyone complaining about funding of projects at CERN using a website running in the www[1] which might not exist if it wasn't for CERN...

[1] [https://en.wikipedia.org/wiki/World_Wide_Web](https://en.wikipedia.org/wiki/World_Wide_Web)

<comment><USER10> I think you need to distinguish between people complaining about CERN in general and people complaining about funding a new large hadron collider. The use of CERN and other scientific communities is well-known and, I think, widely acknowledged.

</comment></comment><comment><USER11> I'm surprised it got through. $23B is a lot of money, and it will cost A LOT more when you start adding up the operational costs. In comparison, the space shuttle was $1.5B per launch "amortized" over 135 launches.

One of the effects of the Space Shuttle is that it hogged the budget of NASA (around 30%). Really worthwhile exploration and other space science programs got less funding because the Shuttle program was so big in cost.

Is the FCC going to do the same for Physics? There's an opportunity cost here that isn't getting addressed.

<comment><USER12> This is CERN. They approved a study into building one.

They exist to study these things. Take away the toys and the institution has a hard time justifying itself. This is mostly self preservation.

In my opinion we should give the Lhc a 25 year leash and then give the whole super-high energy colliders thing a rest.

Put the funding into other research areas in physics; the reductionists have had their turn :)

<comment><USER13> You should problably note that this collider is first planned to begin building around 30 years after the LHC was in put into operation. And it will probably take longer to build as well so put around 10 more years on that and you have 40 years after the LHC was put into operation.

<comment><USER14> So $23 billion over 40 years that would make it about 50 million a year. Just a few million more than what the US military spends on viagra.

<comment><USER15> You mean ~500 million.

<comment><USER14> Woops! 500 million is correct. Thank you!

</comment></comment></comment></comment></comment></comment><comment><USER16> Honest question, what are some engineering spin-offs that could come out of this? I'm asking because I'm reminded of a Peter Thiel interview where it's mentioned that, despite changing our view of the universe, no "real world" applications came out of the quark model discovered in the 1960s.

This is different from a project like ITER, which is also hugely expensive but could be a game changer.

<comment><USER17> Here's a concrete example. Some of CERN detector technology has been spun-off as Quantum Detectors [[https://quantumdetectors.com/](https://quantumdetectors.com/)], which makes detectors for electron microscopy, x-ray scattering , and neutron detection I think.

I've personally beta-tested their MerlinEM and it's pretty damn cool. It's very different from other technologies that already exist (e.g. Gatan detectors). You can read out images at extremely fast rates (compared to traditional electron microscopy detectors anyway). I'm guessing that this comes from the need for CERN to read-out detectors fully for every collision. Who would have known that this would have been useful for unrelated ultrafast electron scattering experiments?

<comment><USER18> Understandably if you build a 15B$ machine, your engineers will come up with some clever stuff. The tech you mention is likewise tech that was developed to build the detector. I think he means to ask about actual physics we learned doing LHC experiments, that actually have a tangible real world application.

</comment></comment></comment><comment><USER19> I'd guess Prof. Sabine Hossenfelder (herself a physicist, and a Research Fellow at the Frankfurt Institute for Advanced Studies) must be pretty annoyed, to put it politely. She posits that a lot of current physicists are working with outdated notions of "beauty":

(quote)

 _But if it's clear that putting forward new hypotheses just because they are beautiful doesn't mean they're likely to be right, then why do theorists in these fields focus so much on beauty? Worse, why do they continue to focus on the same type of beauty, even though that method has demonstrably not worked for 40 years?_

 _... So I have historical evidence, math, and data. In my book I lay out these points and tell the reader what conclusion I have drawn: Beauty is not a good guide to theory-development._

 _I then explain that this widespread use of scientifically questionable but productive methodology is symptomatic to the current organization of academic research, and a problem that's not confined to physics._

(/quote)

\---

I'd also recommend listening to the EconTalk podcast[2] where Hossenfelder was a guest.

\---

PS: I'm not judging this decision of funding, not least because I'm no where near qualified :-). I like what CERN does in general (and I sometimes interact with one of their Cloud Infrastructure teams.)

[1] [http://backreaction.blogspot.com/2018/10/you-say- theoretical...](http://backreaction.blogspot.com/2018/10/you-say-theoretical- physicists-are.html)

[2] [https://www.econtalk.org/sabine-hossenfelder-on-physics- real...](https://www.econtalk.org/sabine-hossenfelder-on-physics-reality-and- lost-in-math/)

<comment><USER20> Oh come on, every second sentence she writes outside of a book mentions her books. Do you really have to quote /that/ part.

I am a Prof. for Nuclear Physics, so maybe HEP-adjacent and biased. I don't think I will ever get much use of LHC/FCC myself (EIC will do that for the stuff I'm doing), but I'm happy if they will build it. It's a fallacy to believe that this money takes away from other research. There would be enough money to do all possible research if one really wants to. Just a point to consider: A lot of money for the military is essential to prop up the economy. The same, maybe more effectively, is true for research, with the added benefit that you educate people, and maybe find some cool new stuff.

<comment><USER19> Sorry, I didn't meant to quote "that" part (by that I take it that you're referring to the "beautiful theory" aspect — _edit: I think you were referring to the mention about her book_ ) to provoke. I just wanted to briefly mention Hossenfelder's position as I haven't seen it mentioned when I saw the thread.

And yeah, this might be a "piddling" amount compared to the military spending.

On the whole, we're in agreement; as the 'PS' in my first comment hints, I'm of course all for anything that instills scientific curiosity in the broader public, while discovering new stuff or carefully sussing out bogus hypotheses.

<comment><USER20> No offense taken! If anything, I'm annoyed by her, not by you quoting her.

I meant the "in my book" part. But thinking about it, it's important to give the context: she is trying to sell a book, and why I don't want to speculate whether it's her primary motivation, it is /one/ motivation, otherwise she wouldn't mention it all the time.

</comment></comment></comment></comment><comment><USER21> HN: Governments don't fund enough scientific research projects.

Also HN: Governments shouldn't be funding this scientific research project.

Can't win with this crowd.

<comment><USER22> I mean it's obviously all about funding the right projects isn't it? Going to an obviously hyperbolic extreme for the sake of the argument, say that the EU invested billions in determining if the moon is really made of cheese then that's obviously a waste of money even if it is a scientific investment.

There's a non negligible amount of people, even those who have worked at CERN previously, saying that it just doesn't make sense to put more investment into a new supercollider which might just show that there's an energy desert of particles in the regime it's testing.

You're also falling prey to the fallacy that HN acts as a single entity, in reality everyone here has different opinions and can't just be all lumped in one bucket saying HN thinks this or that. It's obviously going to seem contradictory if you view it as if it's a single person

<comment><USER21> ==I mean it's obviously all about funding the right projects isn't it?==

So is everything in life, but that doesn't help us actually determine which are the "right projects".

==Going to an obviously hyperbolic extreme for the sake of the argument, say that the EU invested billions in determining if the moon is really made of cheese then that's obviously a waste of money even if it is a scientific investment.==

That you have to go to such a ridiculous argument seems to say something about your stance. What would we learn if we discovered the moon was made of cheese? Why would it matter? What is the scientific impact of a cheese moon? Without those answers it isn't really a scientific investment.

==There's a non negligible amount of people, even those who have worked at CERN previously, saying that it just doesn't make sense to put more investment into a new supercollider which might just show that there's an energy desert of particles in the regime it's testing.==

And a non-negligible amount of people, even those who currently work at CERN, think it is worthwhile. We could play this game all day (which is my entire point). If the test fails, we still get to learn something new. A foundation of the scientific method.

==You're also falling prey to the fallacy that HN acts as a single entity, in reality everyone here has different opinions and can't just be all lumped in one bucket saying HN thinks this or that. It's obviously going to seem contradictory if you view it as if it's a single person==

You seem to be falling prey to the fallacy that all people who worked at CERN act as a single entity. In reality, people who have worked at CERN have different opinions. Similarly, I've seen many posts about how HN is a hive mind. I guess that is just when it suits the narrative.

</comment></comment></comment><comment><USER23> Alternative link that doesn't have a redirect to an advertising.com address or forced tracking cookie acceptance

[https://phys.org/news/2020-06-cern-council-endorses- larger-s...](https://phys.org/news/2020-06-cern-council-endorses-larger- supercollider.html)

</comment><comment><USER24> More precisely, CERN approves spending a few million to consider more detailed plans for a $23B, 62-mile long super-collider.

</comment><comment><USER25> $2 billion was sunk into this 40 TeV collider before it was cancelled

[https://en.wikipedia.org/wiki/Superconducting_Super_Collider](https://en.wikipedia.org/wiki/Superconducting_Super_Collider)

<comment><USER26> Canceled in part because of our $255 billion budget deficit, a number that seems quaint today.

</comment></comment><comment><USER27> It's truly awkward that engadget uses 62-mile, when it should use the 100km unit.

<comment><USER28> It's even more amazing that you take the time to comment about this.. why do you care so much about the unit specified?

</comment></comment><comment><USER29> most of the comments are about the cost-to-deliverable tradeoff, which is pretty high. But we have to consider that the new particle accellerator is not the only thing that will be created. An enormous amount of infrastructure will have to be developed and researched, including new hardware to handle all the events, new detector hardware, magnets, etc. All of these are pretty usable outside of a particle detector or even science environments, because many of the hard parts are engineering problems. I think the "useless" part of this 23B investment is far smaller than we think.

For evidence of that look at the past, two projects that immediately come to my mind as being pushed by CERN: HTTP and KiCad. But there are surely some more.

<comment><USER30> > _we have to consider that the new particle accellerator is not the only > thing that will be created_

The problem with this argument is it works for any spending.

The cost of $23bn on a new collider is potentially _not_ spending $23bn on other, more fruitful, physics experiments.

</comment></comment><comment><USER31> This article and the title (and subject) seems invite uninformed speculation. Some people who are pro-particle-research will point out that you never know what is there till you look. Others will point out CERN has not achieved much with the LHC yet and that this research is highly speculative.

I have 2 questions:

Can anyone make a good case why this is necessary? The only experiment listed is Higgs Dark matter work. But that seems speculative and also is already being done at ATLAS.

If this is not speculative, is it still a good use of money compared to spending the same cash on (say) genetics or AI or nano materials, all of which seem to be areas both in need of funding and with high potential for break throughs?

<comment><USER32> This isn't starting tomorrow. This is going to take 2-3 decades, starting with a design study.

So part of the point here is future-proofing. Upgrades to LHC are due to take place. We don't know what the outcome of experiments after those upgrades will be. We don't know where other research will get us to over the next decade or two.

If we want a new collider in place _3 decades from now_ then it is time to start planning, so that if we find out a decade from now it is essential for future progress we've got a decade less to wait.

It's not a given this will be built - we have at least decade and a half to decide whether to put down the full amount. But that is not a justification for not spending a tiny fraction of the cost to take the project forward.

<comment><USER31> I take you're point, but this is all still entirely speculative as far as I can tell. Do we need it now? No but we might in 30 years! Or we might not. And there is no good reason to think we will.

Particle physics has felt very tapped out for a while. And we still have the LHC and LHC upgrades to answer the few questions left Remember.

<comment><USER32> It may be entirely speculative (I don't know), but that is CERNs leaderships _job_ \- if they don't plan ahead and spend small amounts on design studies _now_ and it turns out new hardware is needed, and they need to start a project from scratch ten years down the line, then that's potentially 10k+ people (CERN currently has 2.5k on staff, of which a lot are not scientists, and ~12k external "users") having their experiments delayed for 10 years. Of course not all experiments would be affected.

CERNs yearly normal budget is ~$1.2bn. Spending a few million on design studies and planning now is a pittance as risk mitigation against delaying future experiments.

Once there's a need to commit serious cash, then these questions needs to be answered.

<comment><USER31> Sorry, I misunderstood your previous comment. I'm totally fine with them designing it and making the case for it. Actually having a good justification is a long way off imho. But a few mil for feasibility and a few more to work out what it could do is a smart exercise.

</comment></comment></comment></comment></comment><comment><USER33> I guess this might be a stupid question, but how does the size of the circle matter ? I mean, the particles are going in a round, wouldn't that be like infinite from the particles prespective, so is it related to the turn rate or something ?

<comment><USER34> It is more related to the needed strength of the magnets to keep the particles on track and also the synchrotron radiation. The first issue is that the lower the radius of the circle, the stronger magnetic field is needed because of the increased centrifugal forces. The second issue is that synchrotron radiation leads to loss of energy. It is again proportional to the acceleration perpendicular to the vector of the velocity of the particle [0].

[0] [https://en.wikipedia.org/wiki/Synchrotron_radiation](https://en.wikipedia.org/wiki/Synchrotron_radiation)

</comment></comment><comment><USER35> Aside from the gamble that any fundamental research represents, consider the immense amount of training CERN generates every year, with several thousand physicists and engineers continuously involved. That sort of a mix generates more learning than the sum of its parts, because everyone has opportunities to learn from many related fields. If the money was instead split into many smaller projects it wouldn't generate the same _kind_ of learning, because each project would be a tiny silo compared to CERN.

</comment><comment><USER36> > The aim is to start construction of the new tunnel by 2038

Why wait so long? Surely the tunnel is the easiest part of the project, and the Swiss are very good at digging tunnels. The article goes on to talk about funding issues, but I'd imagine they'd be able to start digging the tunnel now and round up funding over the years by expanding their organization or lobbying the EU harder.

</comment><comment><USER37> This is simply the reaction of CERN to the competition from China, which is planning to build an 80km collider:

[https://en.wikipedia.org/wiki/Circular_Electron_Positron_Col...](https://en.wikipedia.org/wiki/Circular_Electron_Positron_Collider)

</comment><comment><USER38> > The aim is to start construction of the new tunnel by 2038

Not in my lifetime, I guess.

<comment><USER39> Did you know that though vitrification, state of the art cryogenics researched have achieved to preserve 100% of the structure of a pig brain? The science for preserving with 100% accuracy your brain is already here. Those scientists use this technology to preserve organs and the cryogenic property is just a side effect. We simply need an enterprise that reproduce their results on human brains (shouldn't be different than a pig brain) and that commercialize it.

The process replace blood and other brain fluids with a chemically toxic fluid. Which means that while the structure is preserved, any attempt at resurrecting the brain would need an advanced technique that would gradually replace the toxic fluid with fresh blood/Cerebrospinal fluid and the replacement should be 1) total 2) the replacement process should not destroy structure. Intermediary new kinds of fluids in the process might make the transition easier/safer. Once your brain is filled with the right amount of blood and of cerebrospinal fluid and has no toxic fluid left in order for the brain to function, a minimal level of hormones / molecules will need to be dispatched in the brain.

Once all of this is achieved remains the problem of interfacing your brain with a new body.

Happily once cryogenized (technically doable today) resolving all the others necessary steps will take time and you will have time. With not so much money you could be kept vitrified (not frozen) for a millennium or two. It seems unlikely but still is a possibility that an advanced civilization could not by design uncryogenize you without affecting your structure. But the structure being preserved they could make a copy of you (numeric or not), while this has its lot of metaphysical issues It's still a path far more hopeful than eternal death. As a reminder our normal life is mostly as metaphysically weird as most of our cells are replaced every 5 years? What's define YOU is totally unclear and continuous

<comment><USER40> Have they been able to wake the pigs back up yet?

</comment></comment></comment><comment><USER41> Also discussed 4 days ago: [https://news.ycombinator.com/item?id=23577124](https://news.ycombinator.com/item?id=23577124)

</comment><comment><USER42> Has anyone considered a collider in space? It seems like you could have huge distances. And just let the particles fly in the vacuum between acceleration points?

<comment><USER20> If you want to store the beam, you need a ring. And the size of the ring is given by the minimum bending radius, which is given by maximum field strength you can achieve, and energy loss from bremsstrahlung in the bends, which you have to put back.

So space doesn't really help: You'll still need a circle of magnets. Approximating the circle with a polygon means you split up a smaller circle with straight segments. But these straight segments are not really useful.

<comment><USER42> That's sad. I really thought space could open up some new physics.

<comment><USER20> Certainly can, see AMS :)

<comment><USER42> What's that?

<comment><USER20> The Alpha Magnetic Spectrometer: [https://home.cern/science/experiments/ams](https://home.cern/science/experiments/ams) [https://ams.nasa.gov/](https://ams.nasa.gov/)

It's essentially a HEP-style(ish) particle detector, mounted on the ISS, to study cosmic rays.

</comment></comment></comment></comment></comment></comment><comment><USER43> Non-scientist here - do existing colliders like the LHC become useless, or can they still be used to make new scientific discoveries?

<comment><USER44> No, as you can see in the drawings, the old accelarators are always integrated as pre-accelerators into the chain, feeding the next larger ones.

LHC will feed this new accelerator, this is why they intersect at two points.

</comment></comment><comment><USER45> I heard a top phycists are going to china as they are building the next generation there. Is this a strategy to stop that.

<comment><USER46> It's more like hedging their bets. The Chinese proposals (CEPC + SppC) are simultaneously underwhelming in terms of performance specs and over-ambitious in terms of timescale. There's also always a chance that they will never materialise. If they do actually get built, construction of the FCC will be cancelled and CERN will participate in (and hopefully improve) CEPC+SppC. Similarly if Japan builds the ILC, FCC-ee will be cancelled and CERN will join that while bringing forward the FCC-hh.

</comment></comment><comment><USER47> Is someone able to ELI5 what the previous LHC actually achieved? (not a loaded question, I genuinely don't know)

<comment><USER48> The big one was the discovery of the Higgs boson, a missing piece of the so- called 'standard model' of particle physics, plus a bunch of other stuff (lack of evidence for super-symmetry so far, discovery of some tetra- and pentaquarks states, potentially some hints of physics beyond the standard model from B-meson decays, ...).

In large part, it 'merely' confirmed our current theories, disappointing people hoping for revolutionary discoveries.

<comment><USER20> That's the headliner so far, but LHC has produced an enormous amount of data. There are also some quite interesting findings for example from LHCb: Tetraquarks: [https://arxiv.org/abs/2006.11952](https://arxiv.org/abs/2006.11952) Lepton flavor violation: [https://arxiv.org/pdf/2006.07287.pdf](https://arxiv.org/pdf/2006.07287.pdf)

<comment><USER46> LHCb has not seen lepton flavour violation, and neither has anyone else outside of neutrino oscillations.

LHCb, Belle and BaBar have however seen hints of lepton flavour non- universality.

<comment><USER20> You are right, I miss-typed, I had non-universality in mind.

</comment></comment></comment></comment></comment><comment><USER49> I see plenty of critical theory majors complaining about STEM in this thread. What has the world come to.

</comment><comment><USER31> Can anyone comment on the claim that making large numbers of Higgs' bosons will explain dark matter?

<comment> T-A It's a plausible idea, but there are no guarantees. The reasoning goes like this:

So far, the Standard Model is holding up quite well (too well in fact; it would be nice to have some glaring discrepancies pointing to new physics). According to the Standard Model, all fundamental particles with mass get that mass by interacting with the Higgs field. Now, assuming that dark matter also consists of particles with mass (plausible), it's a fair guess that those particles also get their mass by interacting with the Higgs field. And if they do, we should be able to produce them by making Higgs particles (excitations of the Higgs field); when those decay, they will produce pairs of any particle species which they interact with (provided that those particle pairs are less massive than the Higgs particle; and even if they are not, their existence should indirectly affect Higgs decay to other particle species in ways which may be possible to study).

An obvious way this idea could fail is that dark matter gets its mass from a different Higgs field than the Standard Model one (SUSY generally requires more than one Higgs field, and GUTs can have lots). Another is that dark matter is not just another particle but something more weird.

</comment></comment><comment><USER50> Super exciting! For reference, current Large Hadron Collider is 17 miles (27 km).

</comment><comment><USER51> Why not in km?

Why do miles even come into eu science projects?

<comment><USER52> It's an American report. Dollars as well are used for currency. Natural in the title.

The km etc. are expressed in the report.</comment></comment>


Hacking PayPal Accounts with one click - <AUTHOR> http://yasserali.com/hacking-paypal-accounts-with-one-click/ <comment><USER2> Pivotal paragraph: "We have found out that an Attacker can obtain the CSRF Auth which can be valid for ALL users, by intercepting the POST request from a page that provide an Auth Token before the Logging-in process, check this page for the magical CSRF Auth "[https://www.paypal.com/eg/cgi- bin/webscr?cmd=_send-money"](https://www.paypal.com/eg/cgi- bin/webscr?cmd=_send-money"). At this point the attacker Can CSRF "almost" any request on behave of this user."

He captured a cross-site request forgery token which was valid for all users.

<comment><USER3> Someone (or even more frightening, multiple someones) at Paypal didn't understand the point of CSRF tokens. A new random value for each request is essential to maintain the integrity of the measure. CSRF tokens should never be used as a type of global authentication value. The fact that this made it to production is mind-blowing.

EDIT: Looks like I am wrong on HN. Damn.

<comment><USER4> Don't worry, everyone on HN is wrong.

<comment><USER5> This is quite paradoxical. :)

<comment><USER6> It's just not true, i.e. false.

Assume that everyone was lying. Then this statement is true, but as a lie it must be false. Contradiction. So this case is not possible.

Asumme that not everyone was lying. E.g. some other post is false. Then this statement is false. This fits together if you have another post that is false.

<comment><USER7> [http://aeon.co/magazine/philosophy/logic-of-buddhist- philoso...](http://aeon.co/magazine/philosophy/logic-of-buddhist-philosophy/) found this on hn a while ago. You might find this relevant to the logical paradox you are exposing

<comment><USER8> This is why I can't take philosophy serious anymore.

Examples like the "this statement is false" thing are just rife with equivocations and other blatant nonsense. Yes, there is such a thing as "neither true nor false", but every example for "both true and false" I've seen is based on lousy thinking and semantic games.

Also, as a JS programmer, the distinction between true/false/neither/ineffable is very familiar (i.e.: true/false/null/undefined, null denoting the absence of a value and undefined denoting the absence of a definition -- though of course in practice the distinction is rarely necessary resulting in a lot of confusion and unnecessary double checks).

It's got nothing to do with "mysticism". It's just arm chair linguistics.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Paypal should literally pay upwards of $100k for a bug like this. This is a game changing systemic security issue putting literally every single customer at risk, as well as put at least a minor dent in a the brand of a $40 billion dollar company. $10k is a joke.

Wouldn't say $10k isn't nice. Rather, I'd say that history has told us people are susceptible to money. And if someone can choose between $10k and selling information worth much more, let's just conservatively say without pulling numbers from my ass, people would choose the latter option more than Paypal ought to want them to, and that this costs them way more than the $10k they'd otherwise lose. I think that's a pretty fair statement.

Anyway, about the issue itself... Really don't know what to think, it's pretty insane, puts a lot of things into perspective once more. (the whole 'if Paypal can't secure xyz, can my local hospital keep my health records safe, am I equiped to handle my own digital security responsibilities?' train of thought).

Oh if anyone feels like thinking this through, how bad do you guys think this hack could have turned out if deployed by a malicious group? Paypal is pretty walled in with various limits, fraud checks, frozen accounts, multi-day bank transaction processing, reversible transactions, partnerships with banks to do chargebacks there, and they do KYC on every account. The offramps are therefore pretty limited unless you completely expose your identity. Of course they could buy a ton of stuff online, but how anonymous would the shipping be, and what could you buy with Paypal that would be liquid enough, would ship quickly and could be received fairly anonymously (you don't want to use this hack and end up with 100 playstations and on 3-day shipping to your own home and have police arrive before the goods do!). I wonder what the best plan of action would be, I can't really come up with any solid way to actually walk away, anonymously, with a ton of money but surely there must be one. Indulge me if you want!

<comment><USER10> Their bug bounty is $10k, plus you get to talk about it, plus you don't go to jail. That's a pretty compelling package when compared to the $100k but your suspicious activity is forwarded to the cops.

<comment><USER11> Plus you don't have to figure out how to hide $100K on your taxes.

<comment><USER12> I personally would take the 10k because the reputation from finding a bug like this alone is worth more than that, but pretending I wanted to go black market, I can't imagine it would be particularly hard to launder money as long as you paid the taxes that came with that money.

</comment></comment></comment></comment><comment><USER13> Reminds me of how PayPal implemented 2FA, then someone immediately found a bypass since they only made 2FA a requirement for a particular web login page instead of EVERY login entry-point (ie mobile or APIs). PayPal's security continues to be embarrassingly bad.

<comment><USER14> They're not laughably bad, they have had to manage a huge, aging software system and build infrastructure on top and around it.

They may have made many mistakes, but some of the smartest people I know work there, and most of the work they do is first-class.

<comment><USER13> > most of the work they do is first-class

Are we talking about the same PayPal?

Have you seen their web interface or their APIs? It hasn't evolved at all in 10 years. It's the same convoluted, bloated, and slow web experience as it was in 2005. Just because a few smart people work there doesn't mean the project is outputting quality software.

Countless software companies have been able to take aging and massive codebases and evolve them to more modern usable states. Most of the time these big companies such as Microsoft or Oracle still output bad software but at least they show signs of evolution and investment. From an outsiders perspective Paypal is particularly bad at this, their software quality and UX has been in a perpetual stasis while Stripe and others eat their lunch. And that's not simply because of their famously bad customer service.

<comment><USER15> I'm not a PayPal fan - but at least on my account, the UX has changed significantly since 2005 (especially last year or something), and I could find everything I need for my accounting easily.

<comment><USER16> The general consumer interface is great now. The business interface, however, is not. It's still the same slow UI from 2005. Actually, it feels like they are still running on servers from 2005. Simple (email, date range, etc...) searches take FOREVER.

<comment><USER17> The business interface is also upgraded unless you decided to opt out.

<comment><USER16> Can't say I noticed an opt-in, thanks for the info.

<comment><USER17> Ah, I thought I was automatically upgraded but it was a while ago.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I think I speak for us all when I say ???????!!!!!!!. This exploit is as big as they come. They should have paid him many times their $10k maximum bounty in exchange for an NDA, as I am sure I am not alone in saying that this shakes my confidence in PayPal. While I have never trusted them as far as random account freezings etc., I didn't ever expect something as fundamental and serious as this. When you think of all the engineers they must have dedicated to security, it is almost unfathomable that this was missed.

<comment><USER19> Security is hard. I think the more important thing here is that Paypal fixed it quickly and honored the bug bounty. I'd be more worried if they tried to shove it under the rug.

<comment><USER18> > _Security is hard._

Secuirty _is_ hard. But activating tokens before a user has actually logged in is a breathtakingly incompetent, fundamental design flaw. How such code ever made it into the production code base of a company responsible for protecting billions of dollars along with financial information for a significant portion of the world is incomprehensible. It makes me wonder what else is lurking over there.

</comment></comment></comment><comment><USER20> 10K for this kind of vuln is very cheap on their part.

This is serious when you consider that they are moving millions of transactions every day...

CSRF valid for ALL users, ouch!

<comment><USER21> If it's any consolation, 10k USD is about 14x the median monthly salary in Egypt.

[http://sites.miis.edu/educationinegypt/files/2013/05/CIEsala...](http://sites.miis.edu/educationinegypt/files/2013/05/CIEsalaryEgypt.pdf)

<comment><USER22> Consider what the finder could have sold the exploit for, and the damage it could have caused.

I think given that you could effectively steal from any account for which you knew the email was worth significantly more than 10k.

<comment><USER23> > you could effectively steal from any account for which you knew the email

If you succeed in CSRF attack him, that is.

</comment></comment></comment></comment><comment><USER24> Paypal's Bug Bounty program, for the curious: [https://www.paypal.com/webapps/mpp/security/reporting- securi...](https://www.paypal.com/webapps/mpp/security/reporting-security- issues)

<comment><USER25> Paypal detects that I'm in Brazil and gives me the brazilian version of the website, in which the link is 'Not Found'.

There is no locale on url whatsoever. I have to manually change my country to United States in their menu and then I'm able to access the url. So annoying.

Why not showing the page with a simple warning such as "Sorry, we don't have this content in your language, here's the original:"...

<comment><USER26> From what I've understood about Paypal, international entities are more or less completely separate from Paypal US (hence these sorts of events).

Commonly it was API features that work subtly differently depending on the region of the world you're in, but help pages also end up with completely different URL schemes.

<comment><USER27> They cannot be: I had an account at the american Paypal and it was automatically transferred to Brazil when they opened here.

<comment><USER28> Huh, they just told me to open a new account in Europe...

</comment></comment></comment></comment></comment><comment><USER29> Oh man. Security is hard, and I expect security flaws to be found in almost any software.

But these don't _seem_ to be flaws that you'd have if you were spending as much money/resources/prioritization on security as I'd expect a business in Paypal's business to be spending.

Am I wrong?

<comment><USER30> well, by definition you're wrong.

it wouldn't surprise me if companies such as paypal have moles who actively compromise software through subtle means. if it can happen in the government it can definitely happen in a huge software company.

<comment><USER31> Possibly even -by- the government. No tinfoil hat needed; thanks, NSA!

</comment></comment></comment><comment><USER32> Thanks for this. Another reason for me to get off Paypal as fast as I can. I understand that vulnerabilities can exist with any system but Paypal just continues to amaze. Unfortunately, I still have 3 customers on paypal :(

</comment><comment><USER33> Anyone know what the interception proxy/tool he's using in the screenshots is? I could really have used that a few days ago

<comment><USER34> It's Burp Suite. [http://www.portswigger.net/](http://www.portswigger.net/)

</comment></comment><comment><USER35> Scary stuff. My Paypal was compromised earlier this week; wondering if this vulnerability or one like it was used.

</comment><comment><USER36> I can only imagine how much money he got for this one. Very serious bug given how easy it was to reproduce.

<comment><USER37> Says in his blog comments he got paid $10,000

</comment></comment><comment><USER38> Should have used js, fuckin noobs</comment>


Ask HN: How is predictive suggestion possible on encrypted services like Gmail? - rajesh-s Even if it's done locally on device, where would they get the training data set for it to work so well?<p>Same goes for reply response, follow-up reminders and other new features that if offers. <comment><AUTHOR> It's not encrypted e2e. Google sees the plaintext and operates on it.</comment>


Show HN: Monod, our secure Markdown editor built with React - <AUTHOR> https://monod.lelab.tailordev.fr/ <comment><USER2> That's nice, but why is it better than [https://stackedit.io/editor](https://stackedit.io/editor) or [http://dillinger.io/](http://dillinger.io/)? is it open-source?

I wish I had a better Markdown editor for [http://templates.alhur.es/](http://templates.alhur.es/) \-- although a React dependency wouldn't be good for the page size.

<comment><AUTHOR> We needed a way to support templates, because we really write any kind of documents in Markdown. AFAIK StackEdit does not support templates like we implemented. I did not know Dillinger, which seems to be close to StackEdit.

So if I had to quickly benchmark, I'd say: Monod has this notion of templates, speaks CommonMark (no hackish markdown), and is offline-first. Yet, the main reason we wrote it was to learn React.js.

We are working on open sourcing it this week!

</comment></comment><comment><USER3> How hard would it be to export a flat HTML version of the rendered document? Extract the DOM somehow, discard the react-specifics, ...? Or would it be easier to push the Markdown into a dedicated renderer?

EDIT: thanks at fiatjaf for mentioning alternatives, Dillinger has HTML export already.

<comment><AUTHOR> mmh, it would be relatively easy but why would you do that? I'd be glad to know your use case.

<comment><USER3> Write HTML files to share online. If you use Markdown, you always need a conversion somewhere, PDFs are big and slow, ... HTML file I can do basic formatting, throw some default CSS on it and it looks and feels good on basically any device, can be e-mailed, ...

<comment><AUTHOR> Makes perfectly sense, thanks!

</comment></comment></comment></comment><comment><USER4> Unfortunately, it's not open-sourced (yet?): [https://github.com/tailordev](https://github.com/tailordev)

<comment><AUTHOR> It will be open source this week. I am currently working on it, so stay tuned :)

<comment><USER4> Okay, but why the downvote?

<comment><AUTHOR> What do you mean? I did not downvote anything. That was a good (and expected) question/comment.

<comment><USER4> Thanks! Sorry, but almost at the same time you replied somebody downvoted me. I apologize!

</comment></comment></comment></comment></comment><comment><USER5> The Github page says William Durand is part of the company.

A nice surprise and some fond memories: he has been the mantainer of Propel ORM for several years.

I miss Propel and I feel thankful for it. Propel had is own problems, but it was the fastest and sanest way to develop the db layer I've ever used.

I wish you good luck with your new venture, William!

<comment><AUTHOR> hehe thank you!

</comment></comment><comment><AUTHOR> It is open source now! [https://github.com/TailorDev/monod](https://github.com/TailorDev/monod)</comment>


How to use pulsars for interstellar navigation - <AUTHOR> http://www.technologyreview.com/blog/arxiv/23576/

<comment><USER2> Interesting. However, the article overstated the potential range of the system. While a system like this would easily be valid within and nearby the solar system, it certainly wouldn't work at an arbitrary point in the galaxy. The beam of a pulsar is relatively narrow, so as soon as you move out of the region of space swept out by the beam the system would break down. (Of course, this could be trivially be worked around by incorporating more pulsars, but that goes beyond the scope of the original article.)

<comment><USER3> Agreed, the article is discussing interplanetary navigation, but the title is hyping it as interstellar. Whilst pulsars might have the reach to cover the local bubble, I would hardly call it interstellar. If your travel between planets only includes a handful of stars it would be far easier to track them than use this system.

Probably the best way to navigate on a galactic setting is to use the galactic core as a type of sundial. There's very little point of navigating off the galactic point, unless you'd prefer to die in very empty vacuum instead of merely empty vacuum. So all you need to do is select a set of galaxies aligned with the plane that are bright enough to track from anywhere in the galaxy. The core obstructing one of these galaxies would put you in a (relatively) very narrow band of space and the obstruction of two would define your position even more. The pinpoint accuracy can then be computed over time by triangulating between the remaining visible galaxies.

To be honest, it's not like you're going to need instant information updates in interstellar space. To even use a visual measuring system you have to be travelling at non-relative speeds, which then means you don't have to worry about hitting that star in front of you for at least 5-10 years. I'm sure a pocket calculator could compute the angles to find your position in that amount of time.

<comment><USER4> Navigation at relativistic speeds should be quite doable with a simple transform in your visualization system.

This navigation system can be used around multiple stars, hence it's _technically_ interstellar, like a local hick-town airport that gets one commuter flight from Canada is _technically_ international.</comment></comment></comment>


Man tracks down stolen iPhone using location app, resulting in fist fight - <AUTHOR> http://www.dailymail.co.uk/news/article-2259611/Man-tracks-stolen-iPhone-using-location-app-films-violent-confrontation-thief.html

<comment><USER2> Link to the video - <https://www.youtube.com/watch?v=gOWGEArhKU8></comment>


Show HN: Ideas to Solve Sibyl Attack Problem for an Identity Proof System - <AUTHOR> https://medium.com/six-degrees-of-separation/ideas-to-solve-sibyl-attack-problem-for-an-identity-proof-system-33952f0047ed <comment><AUTHOR> Author here. Hey, Hacker News! I'm developing an identity proof system based on the idea of six degrees of separation. I'm writing a series of posts, which I'll then transform into whitepaper.

In this post I brainstorm ideas to solve the sibyl attack problem. I believe bringing together location-proof service (FOAM - [https://foam.space/](https://foam.space/)), staking and face recognition algorithms can solve the problem.

Will be happy to hear your thoughts and critique!

Previous posts on HN - [https://airtable.com/shrNQ0VClgqBiHmkL](https://airtable.com/shrNQ0VClgqBiHmkL)</comment>


Electric scooter companies will require permits in San Francisco - <AUTHOR> https://techcrunch.com/2018/04/17/electric-scooter-permits-will-be-required-in-san-francisco/ <comment><USER2> SF is doing a reasonable job, they should be commended for not coming down hard on the scooters.

The "tech companies are privatizing the streets" meme doesn't make sense. Any scooters are less objectionable than the private cars that killed 14 pedestrians last year. Delivery vans are corporations taking up space on the street. The street has benches, planters, parked bikes, phone boxes, mail boxes, and 20 other "private" things. The public street is for shared use by everyone, not a commercial free zone of only charming activities.

The whole thing is pretty wild. For example the scooters are all unlocked, the app just turns on the electric motor. That seems crazy to me, every kid in the city is going to borrow them. And I've seen a bunch of homeless people kick pushing them down the street. So maybe they all end up in backyards, and the companies go out of business. But maybe I'm wrong and it's a minor problem. They make enough to pay for the loses, and become a nice transportation option.

Long term there's certainly a place for permitting, but it's much better to do permissive experiments than to guess every possible downside.

As a counterexample, NY is still confiscating electric bikes. What a waste.

[https://www.outsideonline.com/2298141/are-we-living- golden-a...](https://www.outsideonline.com/2298141/are-we-living-golden-age- cycling)

Kudos to SF for experimenting.

<comment><USER3> NY is ticketing motor vehicles operating on bike paths and without the legally required lighting or registration. Comply with the law and ebikes are perfectly fine.

</comment></comment><comment><USER4> I suspect regulators have learned from Uber and AirBnB that if you take a "wait and see" approach to regulating startups, by the time you decide to regulate they're already big enough they think they can thumb their nose at regulators with impunity.

And while some people might cheer regulators losing power, the regulators themselves are seldom among them.

</comment><comment><USER5> As a selfish consumer, I LOVE these scooters & want the city to "figure it out" to make them viable ASAP.

Shut up and take my money, ok? ;)

</comment><comment><USER6> > Yee, noted how he's heard from seniors and people in wheelchairs who are > "being imperiled and inconvenienced because they are having to navigate > around scooters and bikes."

This is one of the more unconvincing statements in this article. The massive convenience win that shared bicycles, scooters, cars etc bring to cities is well worth the "inconvenience" of them being parked on the sidewalk.

I think SF needs to go the route of Shanghai, Beijing, Shenzhen etc and designate MANY, MANY bicycle parking zones on the city's sidewalks.

As long as the companies are decentized to allow their machines to be a public nuisance (fines), they will pass on the cost of poor parking behavior to whomever actually place the scooter in a dangerous / rude / thoughtless place. See the "Mobike Score" [0].

I hate the rhetoric that the streets are being vitiated by shared transportation. There are simple fixes to these problems.

[0] [https://mobike.com/us/faq](https://mobike.com/us/faq) (Mobike Score)

<comment><USER7> Are you being sarcastic? You really think that Shanghai is a good model for this? Did you not see this photo set?: [https://www.theatlantic.com/photo/2018/03/bike-share- oversup...](https://www.theatlantic.com/photo/2018/03/bike-share-oversupply- in-china-huge-piles-of-abandoned-and-broken-bicycles/556268/)

The sidewalk is a public resource. Companies shouldn't be able to use it without paying the public for its usage. A restaurant needs a paid permit just to put chairs and tables in front of their building, why should it be any different for a scooter company?

<comment><USER8> More vitally, did you not see this astounding photoset of abandoned dockless vehicles? [https://slate.com/business/2018/04/astounding-photos- capture...](https://slate.com/business/2018/04/astounding-photos-capture- graveyards-of-unused-dockless-vehicles-in-american-cities.html) . They litter virtually every city street, and yet we're somehow willing to ignore the relentless space they waste.

<comment> et-al Aside from the fact that one needs to be licensed for them, obey some generally accepted rules of the road, and "abandon" their vehicles in an orderly fashion.

I understand we're going through the growing-pains period with these dockless vehicles, but Lime, Spin, and Bird have no excuses for not taking any precautions against this. _Especially_ Lime since we've seen issues with dockless bikes in China before they were brought here. The reason why these companies don't care is because their bikes/push-scooters are so cheap to manufacturer. They've basically created disposable vehicles.

So I'm glad lawmakers are doing something about this. And yes, of course there are other issues we need to tackle for SF sidewalks with feces and needles.

<comment><USER9> > and "abandon" their vehicles in an orderly fashion.

Never mind that we set aside large parts of our public space for people to curbside park. If we were to set aside two parking spots per block for bicycles, you wouldn't have any problems with them being left on sidewalks.

<comment> et-al I agree, but the point was about the weak comparison in the snarky Slate post.

Like I said, we're in a transition phase in American cities. More people are willing to ride bikes (and e-scooters) these days. And with these changing needs, cities will replace car parking spots with bicycle/e-scooter/motorcycle parking.

</comment></comment></comment></comment></comment></comment><comment><USER10> I live in San Francisco. These things are everywhere, the people who ride them leave them anywhere as well. Sometimes just laying flat on the ground even. I hate that they take sidewalk space. Hopefully they'll figure it out... but I'm all in for designated parking areas for these things or taking them off the sidewalk.

<comment><USER11> We clearly live in a different San Francisco. I see them all over, but have only seen maybe 1-2 (out of hundreds) that are blocking anything or knocked over. And the ones that are laying flat are likely knocked down by someone who dislikes them.

</comment></comment><comment><USER12> Everybody complaining about these scooters will get used to it. They're not very inconvenient, they're literally just objects on the sidewalk that you need to walk around. I use them all the time, they're a quick, efficient way to get around. Also fun to ride.

<comment><USER13> Simple solution: There should be painted areas on the sidewalk to put them, and regulators should be able to fine companies if they're found outside of it, which will then pass that fine onto the user that left it there.

<comment><USER14> I can physically pick one of these up and move it outside of the box. Who gets fined now?

Where do the boxes get painted?

Your solution is not simple.

<comment><USER15> Actually Bird just implemented a feature after the cease and desist that requires you to take a picture of your parking job.

<comment><USER16> Are there unique identifiers that are visible in a photo panned out far enough to show the context in which the bike was parked?

(Leaving aside the fact that you could take the photo at any favorable location within minutes of your destination... or just change the photo metadata.)

</comment></comment></comment></comment></comment><comment><USER17> There's also a need for better hardware security on the scooters themselves; I saw at least two in SOMA this morning missing their batteries.

</comment><comment><USER18> SF has learned its lessons from Uber (and presumably read up on the bike sharing problems in China).

My take on these scooter startups is that they won't make it very far: [https://www.inc.com/alex-moazed/electric-scooter-startups- in...](https://www.inc.com/alex-moazed/electric-scooter-startups-in-battle- with-san-francisco.html)

</comment><comment><USER19> Carelessly placed scooters are a mild irritation, around the same level of annoyance as over-enthusiastic tree-planting requiring me to duck and weave almost constantly as I walk along the sidewalk.

But the real problem that needs to be addressed is the idiots riding the scooters on the sidewalk, expecting pedestrians to dive out of their way.

</comment><comment><USER20> i am generally in favor of alternative modes of transportation but these scooters annoy the hell out of me.

everyday i walk down 2nd street there are scooters randomly strewn around. some are upright, some are to the "side" of the sidewalk, but there is also a group of them that look like they're just randomly thrown to the ground.

also sadly sf is just not very friendly to non-car transportation in the first place. so the alternative is people riding these things ride them on the sidewalks, which is annoying for pedestrians.

also a safety issue: i've seen maybe only 3-4 people ride one with a helmet. maybe that's on the user of the scooter, but then again none of the scooter companies seem to address it since that'll probably mean less rides for them.

i support the idea, but they make the city aesthetically more unpleasing than it needs to be and makes my morning walk to work and back more annoying.

<comment><USER21> Cars are ugly, litter the streets and are exceptionally dangerous.

<comment><USER20> if you agree with that point why would you continue to encourage that to expand to the sidewalks?

<comment><USER22> Because every scooter is 1 less uber ride across town, or 1 less car on the road.

</comment></comment></comment></comment><comment><USER23> Undocumented scooters are a problem. They take the work away from us cyclist who haul tourists everywhere.

</comment><comment><USER24> For those wondering why the permits:

> "This is a basic permitting scheme to allow the professional staff at SFMTA > to permit these with sensible, regulatory frameworks and to be able to > confiscate unpermitted vehicles or devices," Sheehy said.

<comment><USER25> That doesn't answer the 'why'.

I have read the article, and still have no idea what specifically the city wans to regulate. What types of rules and requirements are the councilmembers and SFMTA expecting to put in place? Are there specific restrictions that are in the interest of the city's residents, or is this just a money-grab?

<comment><USER26> Presumably permitting will allow the city to control the amount of scooters on the streets to control public space congestion and ensure that those who operate in the city are following rules regarding placement, education and safety.

<comment><USER27> Is there an actual problem being solved or is it just a solution in search of a problem?

</comment></comment></comment></comment><comment><USER28> Title is kind of misleading. They are talking about permits for companies to deploy them for scooter-sharing services, not for a person to operate one.

<comment><USER29> Ok, we've rephrased it to reflect that.</comment></comment>


Blind spots that smart people should be aware of - <AUTHOR> http://www.rajeshsetty.com/2011/11/24/blind-spots-that-smart-people-should-be-aware-of/

<comment><USER2> Has hacker news turned into cosmopolitan? This really didn't say much, and said nothing actionable. Might as well been a list of 'people you meet at the office party'

<comment><AUTHOR> The goal of the article was to raise awareness of some blind spots that smart people face. Just being aware of them is already a good first step. Hacker News is a place where so many smart people hang out and I thought people here will relate to one or more items in the list.

</comment></comment><comment><USER3> Also known as 'blind spots the socially well-adjusted and naive should be aware of'. Unfortunately, no ways to recognize whether _you_ are suffering from one of these blind spots. It's easy to brush it off as 'yeah, I know folks that have this problem'

<comment><AUTHOR> Blind spots are hard to see and probably that's why they are called "blind" spots. I have found time and again that discussions with my mentors brings forth some blind spots to the forefront. Mentors have an uncanny ability to notice things that we should be noticing. They may not have all the answers but the probing questions they ask can make us aware of at least some of the blind spots.

My $.02 of course.</comment></comment>


Disruptive Technology: Skype Launches all you can eat phone service for $9.95/month - <AUTHOR> http://www.digitalhome.ca/content/view/2465/206/

<comment><USER2> What would be disruptive is an iPhone-like device with unlimited 3G-speed-or- better data loaded up with skype, a jabber/irc client, and the iphone's other goodies.

Why are we still paying per-text-message and why do we still have monthly minute limits? It's all data anyway.

The disruptive moment is when wireless net connections become as flat- rate/fast/boring as wired net connections.

<comment><USER3> I thought it wasn't all just data. Don't some cell networks still have circuit-switched voice and packet-switched data?

<comment><USER4> Currently telecom is all IP based. Telcos have a circuit switched system at the last mile for backward compatibility and profit reasons, but from your local CO to the terminating call CO is IP based. The telcos also own the internet connections as a tier one providers, so most of it is privately routed.

But yeah, the circuit switched system still exists only for backward compat. for the existing system. Cost for call routing has gone down significantly for telcos ever since the 1990s. (Some shithole countries do not apply.)

</comment></comment></comment><comment><USER5> Hmm. Now if the quality were as good as my POTS service. I pay France Telecom about 40 Euro a month for unlimited calls across Europe and North America. That seems like a good deal to me because it always works and the quality is good.

</comment><comment><USER6> This will become useful to me (more to my wife, actually) once they add Russia to the list of countries considered as the world.

That said, we pay ~$10-15 per month for intl. calls through skype currently, so the savings aren't _that_ big.

</comment><comment><USER7> Looks like they dropped SkypePro, which was the unlimited US+SkypeIn yearly bundle.

</comment><comment><USER8> Disruptive? Really?

<comment><AUTHOR> Wikipedia:Disruptive technology Examples of true disruptive innovations, ie. innovations that are lower in performance and lower cost, succeeding are rare. Occasionally, a disruptive technology comes to dominate an existing market by either filling a role in a new market that the older technology could not fill (as cheaper, lower capacity but smaller-sized flash memory is doing for personal data storage in the 2000s) (<http://en.wikipedia.org/wiki/Disruptive_technology>)</comment></comment>