Full-disk encryption for all computer drives, coming soon - <AUTHOR> http://www.computerworld.com/action/article.do?command=viewArticleBasic&taxonomyName=storage&articleId=9126869&taxonomyId=19&intsrc=kc_top

<comment><USER2> My problem with encryption technology like this is that it falls into that gray area between theoretically useful and actually useful.

Equivalent software encryption has existed for a while (it's built into Vista for example). But when you read about these Government or Financial laptops getting stolen with people's private information on them they're never encrypted. Why?

Because any info that's valuable is too valuable to risk losing just because someone lost the password. I mean, he says it himself...

"it can't be brought back up and read without first giving a cryptographically-strong password. If you don't have that, it's a brick. You can't even sell it on eBay."

So when you deploy this kind of thing you have to ask yourself if there's any circumstance under which that password could get lost. I'm not against the technology I just don't know a lot of people who will be brave enough to use it.

<comment><USER3> I don't want to comment much on a story from a trade rag like Computerworld, especially when it ignores the fact that we already have better options than this press release product. But, I'll take a moment to correct you:

In many F-500 companies, disk encryption is already a corporate standard on all laptops; the organizations that are worried about losing passwords keep escrow keys. The problem people are trying to solve is, if you leave your car unlocked and lose your laptop, you don't have to cut a press release about how many SSNs you just lost.

<comment><USER2> I don't deny that there are ways in which encryption can be very useful and that a very organized company can guard against ever losing their data because of a password mishap. I'm just saying I've never met one of these companies and I've done my fair share of consulting work for companies large and small,

People are used to security that can be circumvented if need be (through an administrators password or at worst a disk recovery service). When you're talking about hardware based encryption that option is no longer on the table and I think that rightfully makes a lot of people uncomfortable. In that way it's a huge risk.

Which is why things like bitblocker (again, built into Vista) don't get used.

<comment><USER4> Big organizations don't trust individuals enough to make them the single point of failure for encryption. Most often, these organizations run key servers that have the actual key, and provide the key based on some form of auth (usually Active Directory). If the user forgets their AD password, its an easy reset; and if they leave the company or something, their data is easily recoverable.

This sort of "encryption in the sky" approach is available to consumers too. There are products by most of the big encryption vendors (like <http://voltage.com/vsn/>) that make it easy for a user to encrypt their data without putting themselves at risk for data loss.

</comment></comment></comment></comment><comment><USER5> That kind of encryption is useless, because I can't audit it. How do I know my data really IS encrypted and the key isn't just stored on the drive itself?

<comment><USER3> Proprietary hardware encryption schemes are assessed by third parties _all the time_. If you just aren't comfortable with anything but open source, that's fine. But you already rely on plenty of other security systems you can't audit.

<comment><USER5> I don't. And I really do believe that I should be able to audit any security solution I use.

I don't understand what you mean by "Proprietary hardware encryption schemes are assessed by third parties all the time". Sounds like corporate speak to me. First, any "proprietary encryption scheme" is rubbish, and second, I should be the one to assess it.

My point with the drive encryption solution was that you are told that your data is encrypted, but you have no way of checking it yourself. What if encryption is disabled in your drive? Can you tell?

The final output of any encryption solution needs to be independently accessible, so that you can verify if it resembles white noise (which it should, ideally).

<comment><USER3> So go ahead and audit them. The vendors will pay you to do it. Go thumb through a couple years of Black Hat talks for examples of people finding vulnerabilities in firmware, microcode, and closed-source cryptosystems in their spare time.

By "proprietary encryption scheme", I'm just referring to crytosystems for which you don't have the source code. You will have trouble finding any mainstream full-disk encryption vendor that isn't using something like AES, LRW-AES, or XTS-AES.

Nobody you care about is ever going to ship a product based on Super- Mega-40960-Bit-Matrix encryption. It's not 1994 anymore. There is absolutely no business case to be made for using nonstandard encryption: if you do it, you can't sell to the government, you can't sell it to any Fortune 500 company, and you get made fun of in magazine reviews.

I don't understand your "what if encryption is disabled in your drive" comment. What makes you think that's hard to check? Also, what makes you think that "secretly not encrypting an encrypted drive" would be a sane business decision for any vendor? They'd be open to spectacular liability. The first credit card processor that lost a secretly unencrypted disk drive would end up owning Seagate.

<comment><USER5> So, how do you check if your data is encrypted? Open the hard drive and look at the platters?

I'm sorry, I am not convinced. I would much rather run software than I can a) audit and b) check the output of.

<comment><USER3> (1) I think all your questions are answered at the Opal spec site: <http://tinyurl.com/aulrpj>

(2) If you think that hardware-level analysis is out of scope for assessing a corporate full disk encryption system, you're out of step with the security industry; hobbyists do hardware analysis in their spare time. There are obviously likely to be much simpler way to verify encrypted storage than "looking at the platters".

(3) Like I said originally, if you're religious about open source, more power to you. It's obvious that there's little I can say to make you happy with the TCG. But, and I mean no offense, from what little I know of you it seems like they know much more about this topic than you do.

<comment><USER5> As to (2), my point was that I have no way of doing it.

As to (3), I am not "religious about open source". My point was that at the very least I would like to be able to verify what the output is, which I can't.

Your arguments about companies' reputations being on the line are something I don't buy. This is hacker news, I buy technical arguments. And if you believe "reputable companies" don't do strange things with your keys or our data, may I kindly remind you of <http://en.wikipedia.org/wiki/NSAKEY>

Regarding (1), thanks for the reference, I will certainly learn more about the technology involved.

<comment><USER3> I don't think it's really reasonable to rule out hardware security simply because jwr from Hacker News isn't capable of assessing it, but I don't blame _you_ for not using it.

<comment><USER5> It isn't just me, Bruce Schneier doesn't trust the vendors either, and for good reasons:

[http://www.schneier.com/blog/archives/2009/02/the_doghouse_r...](http://www.schneier.com/blog/archives/2009/02/the_doghouse_ra.html)

(yes, I know this is about a hardware enclosure, not about a drive, that's actually lucky because someone could _check_ if the bytes are actually encrypted)

Now let's hear you mock Bruce :-)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Will we still own our data?

<comment><USER7> I was kind of worried when I saw "Trusted Computing", but having read the article I don't think there's any DRM-related use for it. It's really just HD encryption.

<comment><USER3> "Trusted Computing" is a bit of a bugbear; the technology behind it is totally inevitable and fundamentally innocuous. All it's saying is, the OS should be able to extract the promise of a secure channel to the chipset and the hardware. Without that promise, you lose your machine just once to a piece of malware and you can never trust it again.

<comment><USER8> I wouldn't call the idea of physical access not being the highest level (to hardware state) particularly innocuous. From the article - "You can't even sell it [a stolen drive] on eBay". Theft deterrence is nice, but the piles of bricked drives left over from xbox upgrades are disgusting.

The same eviction of malware can be achieved through a documented hardware interface to the lowest levels of microcode (say, JTAG). The current problem is not due to openness, but closed CPU microcode.

<comment><USER9> > The same eviction of malware can be achieved through a documented hardware > interface to the lowest levels of microcode (say, JTAG). The current problem > is not due to openness, but closed CPU microcode.

Would you please elaborate?

<comment><USER8> kragen's comment hits the nail right on the head. Any software update system suffers from the ability to install a "rootkit" that can emulate the update mechanism itself to ensure its own survival. I was mistaken in thinking that CPU microcode was stored in non-volatile memory on the CPU itself, but the same idea goes for any area in which such rootkits can be installed.

The simple solution is to allow easy updating of that base firmware through a dedicated hardware interface. A socketed DIP isn't hip anymore (eww through- hole), but a USB device header on the motherboard would certainly work.

I'd feel better about trusted computing technology if one of their design goals wasn't preventing physical "tampering" but instead they provided unfettered access through a debug port. However, it seems like they're aiming for the exact opposite in order to facilitate naive software, theft deterrence, and business model preservation.

<comment><USER3> Can you explain more about how the TPM facilitates naive software and business model preservation? That's not my experience with it, but maybe you've had a different experience.

<comment><USER8> Certain restrictions are impossible to encode in protocols where one's computer acts as their agent. For example, it's impossible to restrict the duplication or longevity of a document. Remote attestation restricts what code can be used to run a protocol, and thus enables implementation of such naive rules.

I don't currently use remote attestation for anything, but it's a matter of time until some bozo decides that remote attestation is the way to solve online banking security ("if only we could be sure they weren't running malware!"), and brings the technology stack mainstream.

When that happens, the non-techies (seeing no distinction) will enforce their business rules on end user's computers (they occasionally try to do this now, but run up against reality). Client-side-only verification of form fields may be laughable now, but won't be so funny with no incentive to fix it because common people cannot exploit it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> How will this affect data recovery?

<comment><USER11> If you know the passwd then tools going through the drive will not change. If you have to remove the PCB and replace it with one from another drive or you have lost the passwd then you are stuffed. Unless of course the drive maker has built in a backdoor - from past experience of security on PCs the unchangeable security passwd will probably be 'seagate'</comment></comment>


Ask HN: How do you handle authentication in Single Page Applications? - <AUTHOR> <comment><USER2> In SPA you usualy bind pages to routes or hashes.. so that points to something..

For example to have central router where you check you tokens etc. Take a look this example with auth0 and ReactJS

<comment><USER2> [https://auth0.com/docs/quickstart/spa/react/01-login](https://auth0.com/docs/quickstart/spa/react/01-login)

</comment></comment><comment><USER3> The same as in multiple page applications.</comment>


Eris: The Distributed Application Software Stack - <AUTHOR> https://erisindustries.com/

<comment><USER2> How are 'millions of separate blockchains' supposed to be secure? We have enough trouble securing one Blockchain.

Also it seems redundant to include the fruits of computations in a blockchain, for all time, when SNARK-based proofs can accomplish the same goal with much less overhead.

Correct me if I'm missing something.

<comment><USER3> True. But with an Eris chain mining doesn't need to happen.

We've taken consensus and security logic which is usually baked in to a blockchain protocol and moved it into into a smart contract kernel of the genesis block - and seeing as you can script whatever the heck you want there (as the Thelonious design is smart contract-capable), you can set the security parameters to whatever you want. E.g., specify that only certain nodes known to the administrator can process data.

This isn't a blockchain to be used in currency applications - but in data management, and application-specific data management at that. Developers can parameterise a Thelonious framework to do whatever they need it to do. Think of a social network or a corporate interactive application. In such cases it's the usefulness of the database in efficiently administering data and blockchain fault-tolerance, not token rewards, which would meant to be the primary incentive for adoption.

We have rather a lot of writing on the subject - please do check out some of our blog posts! [https://blog.erisindustries.com/products/2014/12/17/on-3p/](https://blog.erisindustries.com/products/2014/12/17/on-3p/)

</comment></comment><comment><USER4> Cool, this is like my Fire★ project ([http://www.firestr.com](http://www.firestr.com)) but for back end services. They also support creating block chains. I shall need to look at it for inspiration.

<comment><USER5> Love this line from your site: "This is not cloud software, but __grass __software. You can touch it and shape it. The possibilities are endless. "

<comment><USER4> Thanks! I think I will turn it into a catch phrase.

</comment></comment></comment><comment><USER6> Sorry, I am silly, but what kind of applications could one build with this?

</comment><comment><USER7> Previous discussion: [https://news.ycombinator.com/item?id=7899637](https://news.ycombinator.com/item?id=7899637)

</comment><comment><USER8> How is this different from Ethereum?

<comment><USER9> Thelonious is an ethereum derivative designed to be programmable so dapp makers can add in the consensus constraints they want. Maybe they don't want just anyone to mine but instead just trusted operators. Its a smart contract controlled chain so you can do this. We call these "locked down" chains they embrace the idea that some dapp makers might need to have more assurances about control over the database. Thelonious can provide alternative means of consensus for those people.

In addition we have the decerver which in its current iteration is compatible with ethereum thelonious ipfs (a bittorrent+git-like filesystem) and bitcoin. Allowing one platform to use all of these P2P technologies. We don't believe in one chain to rule them all syndrome we feel like all of these technologies can have something to contribute. Once we have incorporated dynamic module loading into the platform all you need is to write the wrapper for your favoured technology and you can start implementing some truely amazing dapps.

I hope this answers your question!

<comment><USER6> Could you make the site a bit more accessible to people outside the blockchain community by giving examples of the kind of applications that could be built with these tools?

<comment> compleat-ang Thanks for the feedback. Indeed we will be trying to do so over the coming weeks -- especially in the tutorial and blogs sections.</comment></comment></comment></comment>


Paternal stress in mice given to offspring via RNA packed into sperm - <AUTHOR> http://arstechnica.com/science/2015/10/paternal-stress-given-to-offspring-via-rna-packed-into-sperm/ <comment><USER2> Hello, I don't have access nor the time to grok the full paper. [http://www.pnas.org/content/early/2015/10/14/1508347112.full...](http://www.pnas.org/content/early/2015/10/14/1508347112.full.pdf)

Can someone give a quick ELI5 into the exact method and rough biological explanation in the study?

From what I understand roughly from the artstechnica layman explanation, the microRNA expression can be influenced by an individual's environment (in the case of the mouse, 36 hours of constant light, a 15-minute exposure to fox odor etc.) These microRNA levels act somehow as regulators/promoters to chromosome molecular structure (basically whether a particular region is wound up tightly or loosely, making that region either harder or more accessible for the DNA transcription machinery), thereby effectively regulating the accessibility and expression of the genes (in this case, genes responsible for "down regulating stress [pathways] of mice") stored in that region.

Although the innate DNA structure (source code) didn't change from parent to offspring, the environment influences (Larmakian inheritance or metaphorically the user-defined environment path) was passed down to the offspring via the microRNA (that was optimized for/influenced by the father's environment) in the father's sperm cells - such that the genes are regulated epigenetically in the child same as the father's from the get-go (e.g., inheriting the environment paths, importing the older browser's bookmarks).

I have several questions, 1) please correct my layman understanding if any of it is off (don't have access to PNAS unfortunately), 2) if someone in the field can explain how microRNA actually regulate the chromosomes and histones, 3) Even if the microRNA is passed down to the offspring, is microRNA expression level in that offspring going to remain persistent? Meaning suppose the offspring is exposed to a totally different environment in contrast to the parent, will the offspring's microRNA eventually change to match its changing environment, i.e., how does microRNA get expressed and regulated in the first place?

Thanks for posting this very interesting paper on Larmakianism making a comeback!

<comment><USER3> A quick answer to your question #1/2: microRNA (miRNA) is the substrate of a very complex piece of cell machinery that uses the miRNA sequence to find complementary messenger RNA (mRNA). When miRNA binds to its respective mRNA, the machinery (whose details I will not go into) degrades the mRNA, preventing its translation into protein. So while the DNA remains unaltered by the miRNA, protein expression is regulated on the level of mRNA degradation. MiRNA and short-hairpin RNA are tremendously useful in the laboratory setting to knock down the expression of genes without having to do gene modifications. This paper shows that miRNA can be passed from father to child through the sperm, and this miRNA can affect the way certain genes are expressed.

As for your question #3, I couldn't find any information in the paper regarding how long the miRNA persisted in the offspring. The miRNAs seem to have a long-term effect on genes in the paraventricular nucleus of the hypothalamus, but whether this is due to effects of miRNA solely in the development of the zygote, or whether the miRNA in the adult is also important, is unclear. It seems likely that changes due to the miRNA in fetal development alone could be sufficient in dramatically changing stress responsitivity, but this remains to be proven.

In another famous study, maternal nurture plays a very important role in the epigenetic development of baby mice [1]. So it could very well be that a favorable and nurturing environment may cause epigenetic changes in the offspring that might counteract the actions of the miRNA described here. Again, this is something that the paper does not show and therefore we can only speculate at this point.

Hope this helps!

[1] [http://www.nature.com/neuro/journal/v7/n8/full/nn1276.html](http://www.nature.com/neuro/journal/v7/n8/full/nn1276.html)

<comment><USER2> Thank you milkcircle for your detailed and precise answers for my specific questions! And also going beyond to bring up another paper following up on nurture in terms influences epigenetic development of offsprings. Thanks for clearing up my confusion on how miRNA works ("regulate[s] on the level of mRNA degradation"). I learn something new today thanks to you!

</comment></comment></comment><comment><USER4> So i guess the next question is: did the mice have different sperm characteristics because they were stressed? Or was it a long term change?

By which I mean, if the stressed mice were allowed to recover and have happy lives for a few months after the stress period, before mating, would these results still occur?

Because if not, then it opens the possibility that just being incredibly stressed out altered the production of sperm in some temporal manner.

</comment><comment><USER5> Great. Another thing to worry about when trying to start a family...

<comment><USER6> Starting a family isn't rocket science. Look at the world around you. It's amazing. And it was built by people whose parents didn't wear them around in a pouch until they were five, who fed them formula, who didn't eat a bunch of fish oil while pregnant, and who (gasp!) smoked or drank during pregnancy.

Parenting science is like nutrition science. Lots of studies, little consensus. Just ignore it.

<comment><USER7> They also had horrific infant mortality rate and ridiculous risk of death during childbirth, for both mother and child.

There isn't as much clear cut answers about parenting as we would like, but there is much evidence backed science which tells us what to do.

Your "Just ignore it." comment is pretty close to what the anti-vaxxers argue.

<comment><USER6> I'm pretty sure all of that drop in infant and maternal mortality rate was due to "real science" (antibiotics, surgical techniques, heroic efforts to save pre-term babies), and not the "pop science" that bombards parents-to-be. There is little scientific evidence that stuff leads to materially (not just measurably) better outcomes.

<comment><USER8> That means the advice reduces to "Pay attention to the real science, and ignore the pop science". Unfortunately that asks too much of a general audience (presupposes the ability to differentiate, which we know even PhDs occasionally have trouble with).

<comment><USER6> The real science is the stuff the powers that be will take care of for you. Just say "yes" when the doctor asks to vaccinate your kid or rush her to the NICU.

<comment><USER9> That's IMO the core of the anti-vaxx issue. The real reason is not rejection of the real science (even if it manifests this way) - it's the lack of trust in the way "powers that be will take care of (...) you" will be good for you. Politicians, pharma companies and all those scientists publishing bullshit for career/grant money fucked that up.

<comment><USER6> It's really hard to argue with the track-record of those politicians, pharma companies, and bought scientists. Infant mortality rate is one-third of what it was even in 1970. And that didn't happen from "empowered parents" making decisions based on advice they read on the internet. It was the medical industrial complex--including those companies selling NICU equipment for a few hundred grand per bed--saved all those lives.

<comment><USER10> > It's really hard to argue with the track-record of those politicians, pharma > companies, and bought scientists.

As a lawyer, you should know it's pretty easy:

"Past performance is not necessarily indicative of future results."

Quod erat demonstrandum.

<comment><USER9> It's simpler than that. Past performance is something you get used to, and if you grow up around something working, you sort of assume it's always been like that. Part of the reason why every new generation wants to dismantle the systems set up by their grandparents.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> More proof that genetics is not read-only.

<comment><USER12> No, this doesn't permanently alter the DNA sequence.

<comment><USER9> Doesn't matter. It's the "reflections on trusting trust" kind of thing - we, our parents, grandparents, etc. form a chain; some runtime modifications to replication mechanism could propagate forward indefinitely, without changing the DNA in the process.

<comment><USER13> Nice insight. To save a few clicks to those remembering this classic (or reading for the first time!):

[https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...](https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf)

</comment></comment></comment></comment><comment><USER14> That's interesting that the mice with stressed parents dealt better with stress. I've typically interpreted this strain of study as a sort of depressing, "rich get richer" of biology concept where every generation gets more stressed out until they somehow get removed from the gene pool. But it seems like the exact opposite is the case, that there is an adaptive numbing effect

<comment><USER15> "Dealt better with stress" is not the conclusion (inference) that concerns them in the paper:

"This is relevant, and problematic, _because blunted stress responses in humans are associated with neuropsychiatric disorders like depression, schizophrenia, and autism._ " (emphasis mine).

<comment><USER14> I interpreted it to mean that they have a blunted stress response, nothing more. Maybe a lot of people that undergo stress have a twofold reaction: 1. downregulate the response to similar stressors 2. still have some bad feelings about what happened

I would rather have 1 & 2 than just 2 alone. So yeah, when they say "associated with" they aren't saying "caused"

</comment></comment></comment><comment><USER16> I suggest this review, published in Cell from 2014: "Transgenerational Epigenetic Inheritance: Myths and Mechanisms" [http://www.sciencedirect.com/science/article/pii/S0092867414...](http://www.sciencedirect.com/science/article/pii/S0092867414002864) (Open access)

and this series Kevin Mitchell: [http://www.wiringthebrain.com/2013/01/the- trouble-with-epige...](http://www.wiringthebrain.com/2013/01/the-trouble-with- epigenetics-part-1.html) (The Trouble with Epigenetics)

</comment><comment><USER17> They chose to show the cortisol data from the last paper[1] as a schematic...strange choice. Compare Fig 1F in this new one to Fig 1 from the previous work. The unexplained difference between control groups from the two papers is bigger than the effect they see due to injecting micro RNAs.

[1] [http://www.jneurosci.org/content/33/21/9003.abstract](http://www.jneurosci.org/content/33/21/9003.abstract)

<comment><USER17> I extracted the data from the two figures and made a plot: [http://s21.postimg.org/8it9wt9ut/Cort.png](http://s21.postimg.org/8it9wt9ut/Cort.png)

At least the 2013 Control and 2015 PBS (the control for the current study) should be similar. They need to explain why the results are so different and figure out what is required to get reproducible results before they conclude the treatment is responsible here.

Also, in the supplemental methods they write: "Data greater than 2 SDs above each group mean were removed from analyses". That is not a legitimate reason to drop animals from the study. It appears they dropped four mice only to create the impression of less variable outcomes (and to help get "significance").

I am not confident this effect would replicate in an independent lab, they seem to be playing games with the analysis.

</comment></comment><comment><USER18> Also Starvation is genetically encoded

"Aftermath of hunger affects three generations in study of epigenetic changes."

[http://www.nature.com/news/starvation-in-pregnant-mice- marks...](http://www.nature.com/news/starvation-in-pregnant-mice-marks- offspring-dna-1.15534)

</comment><comment><USER19> I wonder if there is some sort of evolutionary force at work here. Sort of some kind of heads up that you're coming into the world at a stressful time, better bring your best game kind of thing. Do we also father more aggressive children when we perceive we are threatened?

</comment><comment><USER20> [https://en.wikipedia.org/wiki/Lamarckism](https://en.wikipedia.org/wiki/Lamarckism)

</comment><comment><USER21> Awesome. I guess my daughters will need SSRIs and assorted drugs to get them through life. Just bleeping great.

<comment><USER22> Same problem here. What can I say. It's tough man, but you just have to pull through it.

At least we are lucky, that we were born at a time where there's medication that makes you feel at least semi-normal. By the time I decide to have children, I hope humanity will be better equipped to handle the various mental illnesses.

</comment></comment><comment><USER23> miRNA here refers to microRNA, and that mRNA refers to messengerRNA ?

<comment><USER24> Yes, mRNA <always> refers to messenger RNA. miRNA nearly always refers to microRNA.

[https://en.wikipedia.org/wiki/List_of_RNAs](https://en.wikipedia.org/wiki/List_of_RNAs)

<comment><USER22> I usually just call them 'miRs' to prevent confusion and misuse of both terms.

</comment></comment></comment><comment><USER25> The equivalent of those mice experiments in human would be a tiger chasing you around for two weeks, and you finally managing to escape and reproduce. Modern men have nothing to worry about here.

</comment><comment><USER26> This makes complete sense with me and my dad.</comment>


Nobody wants to read your shit (2009) - <AUTHOR> https://stevenpressfield.com/2009/10/writing-wednesdays-2-the-most-important-writing-lession-i-ever-learned/ <comment><USER2> I have come to loathe narrative-form journalism, and I think this is why.

Headline: Elon Musk will push people through tubes at 300mph.

Me: Whoa cool, what sort of tech is he going to use to pull that off?

Article body: I sit pensively outside of a rustic cafe with my laptop. The early morning dew is still steaming off of the cobblestones.

Me: _close tab_

<comment><USER3> Narrative-form journalism is ruining the internet.

Me: "This chicken breast I cooked is too dry."

Google Search: how to cook chicken breast

Article Title: 3 Ways To Cook Your Chicken So It's Not So Dry - Inspired by This New York Chef

Article Content: (4 paragraphs telling the story of how they author couldn't cook chicken well, which culminates with an embedded YouTube video of a 10-minute long video produced by an entirely different cooking website with even more extra content in it)

<comment><USER4> Hmm. The internet created much of it.

Search engines don't like simple straight answers - the page, and site must have "enough" text. Adsense pages have a minimum length, while writers have stretched and stretched to make the weakest pages long enough, with synonyms, ideally with intro, ad, distraction, filler, discussion of last week's recipe, the pan set with affiliate link, and a load or two before you see the key point and leave. If they can squeeze in another 40 words they're allowed another ad block.

Trouble is, there seems little sign that the escalation out of control is peaking... Even though adsense is not quite the blight it once was.

<comment><USER5> > Search engines don't like simple straight answers

I would say they clearly do - but the people providing the answers don't.

Compare the recent move of Google to provide answers with 0 clicks to the source ("How old is Paul Rudd?", "potato cooking time" both provide answers in the topmost result box for me).

<comment><USER4> That's google on their own site providing an example of do as I say not as I do. :)

They've always discouraged and penalised sites that do that themselves. The search guidelines always talked up what was needed on a page quantity wise, and discouraged brevity. Adsense brought additional, and longer restrictions, and then assorted SEO recommendations and some snake oil to talk around the subject, include synonyms etc.

All that drove a certain style of writing content for the web that has escalated into a very particular - and easily recognisable - style of waffle. That's almost never what's needed for accuracy, readability or quick answers. Long form journalism for the web is a bastard child of traditional long form journalism and SEO inspired waffle, and probably the most annoying of the lot.

</comment></comment></comment></comment></comment><comment><USER6> This is an overprescribed and oversold lesson that might be more harmful than good. On the one hand, he is trying to teach people the importance of empathy and perspective taking for any creative individual. But on the other, if you believe that no one cares about X, then you are less likely to begin creating X. You are also less likely to get emotionally involved in the first place which might do more harm.

The opposite message might be a better one. There are always advocates for your products, writing, etc. who want you to succeed. Your goal is to find these advocates and work with them to create something that they love so much that they tell others and help you to increase the number of advocates. If you can build a little cult around your work and then expand it, then maybe there will be people willing to read your shit after all.

<comment><USER7> Like all lessons, it depends on the student. Personally, the author's way of thinking has been immensely helpful. I grew up an optimist, not able to understand why others couldn't see things the way that I did. After a few failed product/content launches and a few years of grinding later my self- bullshit meter is way more sensitive. This has led to me producing better products, features, and generally more success in my work life. Like the author, I assume no one wants to use my stuff at the outset, and this forces me to fight to overcome this.

But again, it's probably more a function of who this advice is given to. I've seen plenty of people get discouraged after making this realization. The key is to be aware that no one cares and then do it anyways.

<comment><USER8> As an optimist, you could realize that nobody wanting to read your stuff isn't because you suck, it's just because everybody's too busy to give a shit, and not about you personally. (It doesn't rule out you sucking, but nobody wanting to read your stuff isn't a reason to get discouraged.)

<comment><USER9> Right, this is how I think about it. For the most part, when people ignore you or are apathetic to what you're doing, it's not because they have any negative feeings toward you or your creation, but because they are busy and self- absorbed (like all of us), and are likely bombarded by ads and pitches from all angles. Plus everyone is already using 20 saas tools and has 100 books on their reading list and replies to 50 emails per day and so on. Our attention is extremely over-saturated.

Being is this state creates a strong bias against even _considering_ adding another new thing to the pile, so the bar is just very high to get a typical person to care. That's why it's better to not seek out typical people in the beginning, but early adopter types who actually _like_ trying all the new things.

</comment></comment></comment></comment><comment><USER10> "Client's Disease" is an interesting thing. I think 9 times out of 10 I work with a client on their website or landing page there's either far, far too much copy (and nobody really wants to read it all) or the copy is written with the assumption that everyone already "gets" it.

It's always interesting asking them to take a step back, or to get someone else that's never seen the product in the room and asking "look at this website - what does this company do?" It's _really_ easy to assume that everyone else understands your product just because you look at it every day and it's clear to you.

<comment><USER11> As someone who writes copy for a living, I can tell you one reason that happens. The client may insist on a word count or an agency links payment to word count. If the client insists that a page must have 500 words of copy and they'll pay me X amount for those words, they're going to get 500 words whether or not that's the right choice.

</comment></comment><comment><USER12> And even if they want to, they can't because it's down...

<comment><USER13> It's probably the infamous HN hug of death

<comment><USER14> Sweet, sweet irony

</comment></comment></comment><comment><USER15> Webarchive: [http://web.archive.org/web/20190325160113/https://stevenpres...](http://web.archive.org/web/20190325160113/https://stevenpressfield.com/2009/10/writing- wednesdays-2-the-most-important-writing-lession-i-ever-learned/)

</comment><comment><USER16> This is a good thing to remember for anybody who creates.

I would follow it up with something equally important: _You don 't have to write for any freaking body else besides yourself -- and many times life requires you do to exactly that._

When I started blogging, I did a lot of thrashing around. I still do. As a freelance writer with a bit of a similar background to this guy's, I was quite perplexed. Wasn't I sweating blood enough? Am I so scatter-brained? I used to write copy that _sung_.

What the hell is going on?

What was going on was that my brain was working through some complex problems. The only way it could do that was to dump it all out there, edit like hell, then see what the fuck I was trying to say.

Sometimes I was wrong. That sucked. For a long time, on many subjects I refused to take a stance one way or another. That also sucked -- for me.

Creatively writing, then editing your work like you hate everything you could possibly say? It has a beauty and magic of clarifying thought that nothing else I've seen in my life does. It's the most magical thing I've come across.

So yes. If you know what you want to say and you're just looking for a good transaction, buckle the hell down and write like a copywriter. But be aware that you're missing all of the good stuff. If you're only putting out what was already in your head without the re-organization, cross-pollinization, and sythesis part of intelligence, you're not being creative. You may sell a crap- load of stuff, but all you're doing is re-organizing somebody else's ideas into stuff people want to consume.

<comment><USER17> Editing in general is one of those things that I hope and wish and pray and hope that I don't have to do...I mean, everyone else is able to get it right the first time!

Nope, just our perception of the world. Everyone is editing. Especially the stuff we really care about.

<comment><USER16> I don't believe in using algorithms to rate people online, but if I were forced to do so, I would judge them by the number of comments they deleted and/or edited. Oddly enough, this post was a bit of a drive-by for me. It's not a good habit to get into.

Edit.

I used to have a mandatory three-edit rule. I am changing that to five -- at least for essays.

The world needs more editing, my friend. Everybody's got an opinion, nobody seems to be able to organize their thoughts.

</comment></comment></comment><comment><USER18> Just recently saw an ad on the web that I actually clicked. Was pretty surprised, because it happens maybe once a year or so. The ad said: "New restaurant in [hometown]" (big text) with simple yet captivating graphics. It had a few additional points (smaller text) that I read after I got interested. Worked really well. The noiselessness of it felt pretty refreshing.

<comment><USER19> But how did you know you wanted to click it without a random picture, usually containing an attractive person, that's completely unrelated to the topic of the ad?

</comment></comment><comment><USER20> Cached Version: [https://webcache.googleusercontent.com/search?q=cache:https:...](https://webcache.googleusercontent.com/search?q=cache:https://stevenpressfield.com/2009/10/writing- wednesdays-2-the-most-important-writing-lession-i-ever- learned/&strip=1&vwsrc=0)

</comment><comment><USER21> This author specialises in historical fiction. I remember reading a book of his (Gates of Fire) maybe 15 years ago and in my opinion he sticks to his prescribed advice well. That book had a great tempo, great characters, great story. It respected my time as a reader.

The flip side is that it's not the kind of book that would win awards.

<comment><USER22> _The Legend of Bagger Vance_ is probably his best known book (and the book is a lot better than the movie).

_Gates of Fire_ is very good.

</comment></comment><comment><USER23> The insight that communication is inherently transactional explains a lot about advertising/media. Maybe others find it obvious. But it took me a long time to figure out explicitly and work out the ramifications.

<comment><USER24> A great book on this idea is "Human Behavior and the Principle of Least Effort" by George Kingsley Zipf.

"The entire behavior of an individual is at all times motivated by the urge to minimize effort" -Zipf

</comment></comment><comment><USER25> The great Drayton Bird would broadly disagree. People who care about your shit _do_ want to read your shit; as a rule, they matter much more than people who don't care about your shit.

As I'm typing this, Apple are an hour and forty minutes into their "special event". Thousands of viewers from around the world are watching a movie-length sales presentation. Apple will at some point promote the same products through 30-second commercials, but those long presentations play a vital role in building the culture that surrounds Apple.

If you're selling dish soap, then sure, nobody really cares and nobody is going to read your shit. If you're selling a video game or an industrial machine or a piece of fine furniture, a substantial proportion of the people who might actually buy your shit will enthusiastically read your shit.

That doesn't give you license to be sloppy or lazy or needlessly verbose, but it does give you the freedom to use as many words as you need to communicate the merits of your product.

</comment><comment><USER26> I understand the author is trying to teach the importance of putting yourself in the reader's mind, and he's packaging that message in a kind of tough love.

He's not wrong, but if you take his article at face value you'll miss something very important.

Over the past few decades, I've had several hundred articles published in print, blogged extensively, and run a reasonably popular podcast.

By far my most successful content has been when I have opened up and shared honestly about my experiences and explained in detail how certain events and decisions affected my life.

People are happy to read your shit if you are sharing something honest. Honest, personal communication is so rare these days, people will actively seek it out. What causes readers to tune out is authors who try to fake this kind of sincerity, or who try to engage the reader emotionally while they themselves hide behind the fiction of being an objective observer.

</comment><comment><USER27> > When you, the student writer, understand that nobody wants to read your > shit, you develop empathy.

That's a bold claim. I'd argue part of the reason that no one likes advertising is that the writers, by and large, don't have empathy with my feelings, they are trying to force the issue.

Clickbait headlines, for example, attract me...and if the article behind it does not fulfill the headline (which it so often does not), I'm ticked off. I don't feel empathized with, I feel used, cheated, thwarted. I can easily rattle off other, similar examples, but the end result is the same: Empathy would be great, but empathy is not necessarily what the "student writer" learns. And if your writing is trying to get around my feelings rather than fulfilling them, you are left with an unhappy user.

<comment> mark-r Then that's a failure of the clickbait author to apply the principle beyond the headline. Certainly there's an epidemic of that, but it doesn't mean the advice is unsound.

<comment><USER27> I didn't comment on the advice, I commented on the conclusion the author made that learning that people are uninterested in your material leads to empathy.

It'd be great if it did, but that's hardly a given.

<comment> mark-r The author was extrapolating their own experience which did lead to empathy, conjecturing that anybody else going through the same process will have the same insight. I think the implication is that to be a success at advertising the empathy is a necessary skill, and you will either pick it up or wash out.

Certainly there are other paths to writing that would not lead to the same insight.

</comment></comment></comment></comment><comment><USER28> Here is a summary/review about it: [https://muratbuffalo.blogspot.com/2016/06/nobody-wants-to- re...](https://muratbuffalo.blogspot.com/2016/06/nobody-wants-to-read-your- shit.html)

Here is a summary/review for his earlier book: War of Art. [http://muratbuffalo.blogspot.com/2016/04/book-review-war- of-...](http://muratbuffalo.blogspot.com/2016/04/book-review-war-of-art-by- steven.html)

Finally, Draft No.4 was a really good read. [http://muratbuffalo.blogspot.com/2019/03/book-review- draft-n...](http://muratbuffalo.blogspot.com/2019/03/book-review-draft- no-4-by-john-mcphee.html)

</comment><comment><USER29> The author says that the right way to proceed is to provide the user value. The problem is something the author implies earlier, that lying works. You don't have to provide value to consumers to have a successful financial relationship with them. You do need to transact some wholesome value if you want to have a mutualistic relationship with people, but in the context this essay operates, it's not required to be a marketing success.

You don't have to exercise empathy in any warm way. The marketer can _successfully_ model people as data points that respond to stimuli. That's a kind of empathy too, a kind of perspective work, it's just not what people want when they say empathy.

</comment><comment><USER30> Ironic, because nobody can read his shit due to Wordpress crapping out.

Use a static site for static content!

<comment><USER31> > Use a static site for static content!

Far easier said than done.

Is there a "user-servicable" static site generator? I'm not aware of one, if it exists.

Wordpress may be a pile of junk but as a CMS you can hand it off to almost anyone and they'll be able to use it.

<comment><USER32> Put Comet Cache and Cloudflare in front of it. Comet Cache generates generates static files from wordpress, and Cloudflares "keep my site up if it goes down" keeps copies of the static files.

<comment><USER31> The problem with that kind of solution is that a lot of stuff stops working. For example, a static site generator can still support stuff like search functionality by generating the required files, but a wordpress plugin is going to be unaware that a static site is being generated.

<comment><USER32> In my experience, Comet Cache is pretty smart about not breaking dynamic plugins. And Cloudflare gives you a lot of power over what should and shouldnt be cached through settings and explicit page rules.

</comment></comment></comment></comment></comment><comment><USER33> Since his site is down right now:

 _My first real job was in advertising. I worked as a copywriter for an agency called Benton & Bowles in New York City. An artist or entrepreneur's first job inevitably bends the twig. It shapes who you'll become. If your freshman outing is in journalism, your brain gets tattooed (in a good way) with who- what-where-when-why, fact-check-everything, never-bury-the-lead. If you start out as a photographer's assistant, you learn other stuff. If you plunge into business on your own, the education is about self-discipline, self-motivation, self-validation.

Advertising teaches its own lessons. For starters, everyone hates advertising. Advertising lies. Advertising misleads. It's evil, phony, it's trying to sell us crap we don't need. I can't argue with any of that, except to observe that for a rookie wordsmith, such obstacles can be a supreme positive. Why? Because you have to sweat blood to overcome them–and in that grueling process, you learn your craft.

Here it is. Here's the #1 lesson you learn working in advertising (and this has stuck with me, to my advantage, my whole working life):

Nobody wants to read your shit.

Let me repeat that. Nobody–not even your dog or your mother–has the slightest interest in your commercial for Rice Krispies or Delco batteries or Preparation H. Nor does anybody care about your one-act play, your Facebook page or your new sesame chicken joint at Canal and Tchopotoulis.

It isn't that people are mean or cruel. They're just busy.

Nobody wants to read your shit.

There's a phenomenon in advertising called Client's Disease. Every client is in love with his own product. The mistake he makes is believing that, because he loves it, everyone else will too.

They won't. The market doesn't know what you're selling and doesn't care. Your potential customers are so busy dealing with the rest of their lives, they haven't got a spare second to give to your product/work of art/business, no matter how worthy or how much you love it.

What's your answer to that?

1) Reduce your message to its simplest, clearest, easiest-to-understand form.

2) Make it fun. Or sexy or interesting or informative.

3) Apply that to all forms of writing or art or commerce.

When you understand that nobody wants to read your shit, your mind becomes powerfully concentrated. You begin to understand that writing/reading is, above all, a transaction. The reader donates his time and attention, which are supremely valuable commodities. In return, you the writer, must give him something worthy of his gift to you.

When you, the student writer, understand that nobody wants to read your shit, you develop empathy. You acquire that skill which is indispensable to all artists and entrepreneurs: the ability to switch back and forth in your imagination from your own point of view as writer/painter/seller to the point of view of your imagined reader/gallery-goer/customer. You learn to ask yourself with every sentence and every phrase: Is this interesting? Is this fun or challenging or inventive? Am I giving the reader enough? Is she bored? Is she following where I want to lead her?

When I began to write novels, this mindset proved indispensable. It steered me away from Client's Disease. It warned me not to fall in love with my own shit just because it was my own shit. Don't be lazy, Steve. Don't assume. Look at every word through the eye of the busy, impatient, skeptical (but also generous and curious) reader. Give him something worthy of the time and attention he's giving you.

The awareness that nobody wants to read/hear/see/buy what we're writing/singing/filming/selling is the Plymouth Rock upon which all successful artists and entrepreneurs base their public communications. They know that, before all else, they must overcome this natural resistance in their audience. They must find a way to cut through the clutter. As a fledgling cub at B&B, I remember days, weeks, months when our various creative teams did nothing but beat our brains out trying to find some way to make the dull exciting and the unlovely beautiful–and to make the beautiful-but-overlooked gorgeous too.

How, you ask? You'll know you're on the right track when beads of blood begin to pop out on your forehead._

</comment><comment><USER34> This is great advice for technical writing, including ads, sitcom script pitches and scientific papers, all of which are addressed to humans with a very limited attention span.

In literary writing however, the opposite is true: the person picking up a novel, or even a short story, _wants_ to read your shit. That's why people read literature (as opposed to ads or technical manuals). Because they enjoy reading. And the more of it there is to enjoy, the more the enjoyment lasts. Like a good meal, good literature makes you want to eat more, More, MORE. And then have a nice glass of wine and a cigar as you sit in front of your fireplace on your bearskin rug. Ish.

I mean, have you ever heard anyone say "I'll just pour myself a nice Chianti and relax with a nice paper on variational autoencoders", or some such? Nah. People read technical writing because they have to, because they need the knowledge locked inside. Not because they _like_ it!

This is why technical papers are written so as to minimise the amount of attention one has to invest in the task of reading them. For instance- a good technical paper keeps summarising itself. The title is a one-line summary of the work done. The abstract is a slightly longer summary. The introduction is a still slightly longer summary, with a short outline of what you are about to read anyway at the end. The related work section is a short summary of previous work in the field. The framework section summarises your intuitions of several years' work, admittedly hiding any excitement you might have felt about figuring out something new behind a barrage of impenetrable shibboleths of your field. The implementation section is a short summary of about ten thousand (wo)man hours of hair pulling. The experiments section is centered on a visual summary of what was achieved (plots). And the conclusion section summarises the paper you just read, just in case you missed the point.

It's an awful, ugly, horrible way to write that sucks all the joy out of writing and reading. It's really a kind of straightjacket. And, to be perfectly honest, far from the article author's assertion that it somehow helps "hone your skill", I find that it only achieves what a straightjacket achieves: restrain you while you go mad.

</comment><comment><USER35> I read most of the articles from the bottom up nowadays. Most of the writers don't get straight to the point because they click bait too much and they know that they have to fill up their articles with as much bullshit as possible in order to compensate for the lack of relevant content. If the article is long enough you might fall for the trap of wanting to save it for later rather than dismiss it completely.

The sole mission is to bait you into that cost-per-click and cost-per- thousand-impressions profit generator, that's it.

</comment><comment><USER36> > You acquire that skill which is indispensable to all artists and > entrepreneurs: the ability to switch back and forth in your imagination from > your own point of view as writer/painter/seller to the point of view of your > imagined reader/gallery-goer/customer.

That's pretty similar to the API design, where you have to switch rapidly from the point of view of implementer to the point of view of user and back again.

</comment><comment><USER37> From the title, I hoped that this was somebody from academia ranting about the high volume of low quality that their (early stage) colleagues are publishing.

</comment><comment><USER38> (2009) is missing in the title

</comment><comment><USER34> Some advice about pitching TV scripts and designing Magic: the Gathering cards by Mark Rosewater, who's done both, for a living:

[https://magic.wizards.com/en/articles/archive/making- magic/r...](https://magic.wizards.com/en/articles/archive/making- magic/roseanne-any-other-name-part-1-2011-03-14)

</comment><comment><USER39> It depends on who you are and where you are. If you are in a small community where you know everybody and you write/release something related to that community, then probably you have a good amount of "clients" or readers there. That's my experience and it worked good so far, and I never did anything simple, short, fun or sexy.

</comment><comment><USER40> Hold up. This guy's advice on making art is: "Reduce your message to its simplest, clearest, easiest-to-understand form"?

I guess this is a road map to making great art such as uhhh [checks notes] _The Legend of Bagger Vance_ and _Above the Law_.

<comment><USER40> Snark aside, I really believe this is terrible advice for an artist. I'd argue that most worthwhile art does not have a message, and if it does, the work is not a "reduction of that message into the simplest clearest, easiest to understand form."

What enduring work of art fits this description? I think that most great artworks are great because they are complex; because their "message" is something elusive that unfolds over time with deeper engagement.

This entire tough-love-self-help attitude of "nobody wants to read your shit" also seems completely counterproductive. I much prefer the advice making your work to satisfy yourself, emotionally and intellectually without worrying too much about who wants it, and to find a community where you're interested in what they're doing - so they will probably be interested in what you're doing at least in the general outlines - which can serve a place to test and develop your ideas and craft.

</comment></comment><comment><USER41> Here's my lesson on advertising: Everybody wants your stuffs because they think "another everybody" wants your stuffs.

</comment><comment><USER42> > When you understand that nobody wants to read your shit, your mind becomes > powerfully concentrated.

This reminds me of a scene from _The Inner Circle_ [1] where Tom Hulce's character has just told Stalin that the Russian projectors were just cheap copies of the Germans'. The bureaucrat who is responsible is standing right there and realizes that he is now literally begging for his life.

If beforehand he would have been officiously polite to this mere underling he now becomes powerfully concentrated. His every word is chiseled with a singular intent, to convince the projectionist to moderate his view ever so slightly, just enough to spare him his life if not his dignity.

[1] [https://www.imdb.com/title/tt0103838/](https://www.imdb.com/title/tt0103838/)

More to the point, I think this writing advice is appropriate (very appropriate) for proposals and cold calls, where you do not have an ongoing relationship with your reader. In that case you are literally begging for your relevance. But in normal communications, clarity and simplicity is the rule. Orwell's advice comes to mind: _insincerity is the enemy of clear language_.

</comment><comment><USER43> This is definitely not true or long form sales pages wouldn't exist, nor engineers would bother reading details to make sure the product will work for them. It al depends on the audience. My guess is the person who wrote it wanted attention.</comment>


Indeterminacy – John Cage (1959) - <AUTHOR> http://www.lcdf.org/indeterminacy/s/15 <comment><USER2> Background: [http://www.lcdf.org/indeterminacy/about.html](http://www.lcdf.org/indeterminacy/about.html).

The recordings are mesmerizing: [https://www.youtube.com/watch?v=bT3guS2QRxY&list=PLSmCf-s1jG...](https://www.youtube.com/watch?v=bT3guS2QRxY&list=PLSmCf-s1jGIWXK1bd1CaWCgS3wjsuFHXf)

Here's the one about the two monks: [https://www.youtube.com/watch?v=bT3guS2QRxY#t=14m8s](https://www.youtube.com/watch?v=bT3guS2QRxY#t=14m8s).

That's actually the second one about two monks. The first is [https://www.youtube.com/watch?v=bT3guS2QRxY#t=1m](https://www.youtube.com/watch?v=bT3guS2QRxY#t=1m).</comment>


How to evolve a watch - <AUTHOR> http://scienceblogs.com/pharyngula/2007/10/how_to_evolve_a_watch.php <comment><USER2> And the conclusion is, God was a hacker?</comment>


How to Use Trend Micro's Rootkit Remover to Install a Rootkit - <AUTHOR> https://d4stiny.github.io/How-to-use-Trend-Micro-Rootkit-Remover-to-Install-a-Rootkit/ <comment><USER2> >the Bruteforcing Processes code doesn't make sense, are Trend Micro developers not aware of enumerating processes via ZwQuerySystemInformation?

As someone whose work involves screwing around with Windows' internal, whenever I see codes like this, I immediately think that the developer doesn't trust Windows' API. I guess that Trend Micro believes there's a chance that ZwQuerySystemInformation has been hooked by a malicious process and its data is unreliable, and they would rather retrieve the information themselves by scanning the memory manually.

<comment><USER3> It is a tool to detect rootkits

A good rootkit would certainly exclude itself from the info returned by ZwQuerySystemInformation

<comment><USER4> That's exactly the reason.

</comment></comment></comment><comment><AUTHOR> The main thing is that Trend Micro is basically doing the same thing volkswagen did. Cheating in tests to get certified.

<comment><USER5> In this case, the regulatory board is Microsoft, and there's nothing telling us (yet) that there isn't a partnership in which they gave them certification knowing about some of their dirty tricks.

</comment></comment><comment><USER6> So Trend Micro cheats to get Microsoft certified, and my employer then uses Trend Micro virus scanning to get certified for HITRUST. It's turtles all the way down.

</comment><comment><USER7> Cheating in a driver qualification test is _not_ a good look.

Surely Trend Micro should be penalised in some way by Microsoft?

</comment><comment><USER8> In the early screenshot where it shows the directory listing for "%TEMP%\RootKitBuster", three entries jump out (to me) as immediately interesting:

      * sqlite3.dll
      * scan_db.sql
      * DB <-- a folder name

That scan_db.sql is likely full of SQL statements.

And SQLite can have user defined C functions added.

Depending on when those SQL statements are run (just for initial DB creation? during every run? etc), it could be a cheap and easy way to get your code running in a high privilege context. :)

</comment><comment><USER9> Seems the installation still going without one agreeing to the license is very odd

<comment><USER10> Maybe they thought that, as it's essentially unenforceable in EU anyway, they might as well not bother? ;)

</comment></comment><comment><USER11> It always amazes me how using Windows never feels safe. It is literally a sieve in terms of security.

</comment><comment><USER12> "Most of the driver feels like proof-of-concept garbage that is held together by duck tape."

Oouch!

</comment><comment><USER13> TrendMicro does too many BS things in Japan. Many devs getting recognizing it but still their products are adopted many places.</comment>


Ask HN: Looking for a web designer - <AUTHOR>

I'm looking for a web designer to redesign our home page and overall CSS/HTML design. I'll take raw CSS/HTML, but bonus points if you can edit our Django templates directly. You would just be responsible for mock-ups and CSS/HTML implementation. I have a designer I work with for illustrations (logo, icons, etc.), and I do the javascript myself.
My website is http://www.trailbehind.com
1. Is any talented designer on HN looking for a paying gig?
2. Can anyone recommend a good designer?
3. If you don't have a personal contact, are there any resources you can point me at for finding a designer? I've looked at http://www.99designs.com, but I'd prefer a standard contract on an hourly or project basis to a design contest. <comment><USER2> i've had success with designoutpost.com

</comment><comment><USER3> I am primarily a test automation engineer, but I have done some HTML/CSS work in the past. (For example, <http://www.calliopetalent.com> I did some updates for, adding some javascript, tables redesign, etc. to an old site originally built in the late 90's - personal references from there available on request.) Shoot me an email if you want to discuss further offline - email@example.com. I work full time but can squeeze some contract stuff in as well. :-)</comment>


Is Stack Overflow "secure"? Kind of... - <AUTHOR> http://www.troyhunt.com/2012/08/is-stack-overflow-secure-kind-of.html

<comment><USER2> You can track the latest on this issue at: [http://meta.stackoverflow.com/questions/69171/why-doesnt- the...](http://meta.stackoverflow.com/questions/69171/why-doesnt-the-stack- overflow-team-fix-the-firesheep-style-cookie-theft)

<comment><USER3> Via that link, I found this answer. <http://meta.stackoverflow.com/a/69177>

Out of curiosity, does anyone know how much traffic I'd have to hit before my "$20 SSL certificate" started being a chokepoint and bottleneck? If I were able to hit stackoverflow levels of traffic, I'm sure I'd be able to figure out a way to afford it (although maybe even they haven't yet), but I'm curious at lower levels of traffic if I should still worry.

<comment><USER4> The price of the certificate is irrelevant. The issue is that encryption and decryption eats CPU cycles, so running all traffic via HTTPS on a busy site is going to require significantly more processing power.

<comment><USER3> I realize that. I'm asking how much traffic can be handled by a simple single server before it starts dying due to SSL CPU cycles.

I do realize now that my question is too simplistic and obviously varies according to the nature of the application, server config, etc. So won't expect any answers for it. :)

<comment><USER4> Definitely a question I can't answer. Although these days SSL is rarely implemented on each individual server. Instead, load balancers handle SSL and traffic is passed unencrypted to the backend servers doing the real work (presumably at this point, you're on a secure network). Many hardware load balancers even have specialized chips for handling SSL.

</comment></comment></comment></comment></comment><comment><USER5> The only clarification I'd make here is the distinction between "public wifi" and "unencrypted wifi". Some cafes I frequent have WPA2 secured networks with the SSID and password made freely available. I'm pretty sure that solves the Firesheep problem (I don't know for sure, but I'm reasonably confident that other people on the WPA2 network still can read my connection).

<comment><USER6> _I'm pretty sure that solves the Firesheep problem_

With most WiFi encryption (basically except WPA2 Enterprise, which won't be in use in cafés) you can still receive the traffic as long as you see the initial handshake for the device connecting to the network. Sniffing software like Wireshark or Aircrack-NG can handle the decryption transparently.

Once you can see the traffic Firesheep or something like it will work in the same way as on an unencrypted network.

</comment></comment><comment><USER7> Not sure why the author goes through pains not to call out the fact that SO is _not_ secure in the layman sense. In general, if a service requires users to understand the lack of SSL and to take security into their own hands, the service is not secure. Worse than that, SO does not even explicitly communicate this to users.

Also, the author omits a crucial workaround. When on a public network, communication can be made secure if routed through an encrypted tunnel to a known-secure network, such as with a properly configured VPN.

</comment><comment><USER8> > _The only instance in which I'd really urge caution is that public Wi-Fi > scenario, particularly when you're in an environment surrounded by other > people with technical know-how._

The first condition is satisfied whenever you're in a coffee shop, airport, hotel, university campus, wifi-enabled public transportation ... i.e. pretty much everywhere except your own home and possibly your workplace. Some of these places use WPA, but most I've seen don't use any encryption. The second condition shouldn't be too easy to satisfy, either, particularly when you're in a place like the Bay Area.

Blacklisting isn't good enough when it comes to security, we all know that. So the advice should rather be: Anyone can steal your Stack Overflow session at any time whatsoever, _unless_ you're using an Ethernet cable or your own secure Wi-Fi. (Even then, your ISP or a three-letter government agency could see your traffic, but they're probably more interested in watching you than impersonating you.)

<comment><USER9> I don't think it's a safe assumption that the only parties upstream from you are ISPs and TLA government agencies. If script kiddies are hacking major corporations I think it's a safe bet that ISPs are vulnerable, too. Your Stack Overflow "identity" may not be of great value, but it's worth keeping in mind that any cleartext traffic is vulnerable. Being cognizant of sending data over the Internet in cleartext is a good thing, to me.

</comment></comment><comment><USER10> wow, it stuns me how people can write so much text for something so trivial. what's your point?

"i don't really care that the stackoverflow guys don't care because it doesn't really matter"

"i'll just post it here knowing that it won't help the average joe either, because he will never read or understand what i wrote"

who's the target audience for that post? if you're just explaining cookie theft ssl and openid to unknown audience by the example of stackoverflow. by all means write it in the first paragraph.

have some respect man

<comment><USER11> A little harsh. I think it's a good reminder for all of those new products and services being developed as we speak who can make this a priority now instead of having to layer it on later.

Would that fit your definition of a "call to action?"

I'm working on a side project now which uses a similar approach for security (delegate it). While I had already planned on making sure the app would be available over SSL, this was a good reminder of why.

The beautiful thing about the Internet and, indeed, free choice is that you could have stopped reading this article and moved on at any time.

<comment><USER10> but it's not. the way i see it, op seems to have a rather big audience. but it rather reads like a highschool it essay. see if he had been in any way related to stackoverflow the message would've been ok, but too long.

"A little harsh. I think it's a good reminder for all of those new products and services being developed as we speak who can make this a priority now instead of having to layer it on later."

i hope you see the irony. you're right with what you say. but it would be even better of a place if people would actually try to create something of value, both positive or negative. but this is somewhere in between.

something with more value and much more precise is the stackoverflow link someone posted in this thread

[http://meta.stackoverflow.com/questions/69171/why-doesnt- the...](http://meta.stackoverflow.com/questions/69171/why-doesnt-the-stack- overflow-team-fix-the-firesheep-style-cookie-theft)</comment></comment></comment>


The Irrational User - <AUTHOR> https://medium.com/startup-grind/cognitive-bias-ad5f9fe7f59b#.vtd8omt4x <comment><USER2> The best UI and UX designers have an intuitive grasp of human psychology, in all its counterproductive stupidity.</comment>


Ask HN: Is there an app like Duolingo but to practice math or physics? - <AUTHOR> <comment><USER2> [https://brilliant.org/](https://brilliant.org/)

</comment><comment><USER3> i have only used the non-mobile app but you should give anki a try: [https://www.ankiapp.com](https://www.ankiapp.com)

in college i had all my math and physics definitions and formulas in anki cards. man... i lost all that stuff!</comment>


Book Review. Tiny Habits (2020) by BJ Fogg - <AUTHOR> http://muratbuffalo.blogspot.com/2020/02/tiny-habits-2020.html <comment><USER2> Reminds me of this quote by Larry Bernstein from Bell Communications Research:

"Prototyping cuts the work to produce a system by 40 percent."</comment>


The NSA Searches Ten Times as Much of the Internet as It Said It Does - <AUTHOR> http://www.theatlanticwire.com/politics/2013/08/nsa-better-data-collection-math/68490/

<comment><USER2> I can't get excited or depressed about these numbers, because at this order of magnitude and with as little as we know about the workflows and storage mechanisms involved, there is no meaningful difference between 0.000004% and 0.00004%, or indeed 4%, considering how vague the definitions are of whether something is being inspected, whether it can be or is stored, etc.

That said, the more data (numbers, policies, or what have you) the better. Get it all out there, fact-check the hell out of it. If you want to do a puzzle, first you have to pour out the pieces.

<comment><USER3> The problem as I see it is that no matter how much they store. If they so wish they can search for you!

The potential for abuse is just to high.

Originally I was so what some random stranger at some big department might have some info on me.

A friend said to me once "think of your worst enemy, whoever that may be, if they had every piece of communication you ever sent on the internet or if they had list of every website you ever went to, would you be worried?"

That clarified things for me. Not that I have enemies in that respect (at least I hope not) but if I did would I want them to have access to this information.

We do not know who has access to this info and business leaders (especially in countries other than the US) are having their conversations monitored and that info is apparently being passed to business leaders in the US.

We can't have this.

<comment><USER4> I really hope that someone in Hollywood (or a Fiction author) sees the potential here. What would an anti-Snowden have done in his place? Monitor his girlfriend? Dig up dirt on a romantic rival? Blackmail a senator?

Or for that matter, now that politicians know this power is out there, how about a Senator finding an anti-Snowden to get dirt on a political rival?

You basically take "The Lives of Others" and have a modern-day script with a few search-and-replaces.

<comment><USER5> Yes. A thousand times yes. Forget Minority Report. Build up an entire script based solely on the facts of what we already know the NSA's systems are capable of right now.

The script should try to weave in every abuse scenario that is practically possible: Digging up for personal vendettas and blackmail. Insider trading. Manipulating politics or the economy in other countries. Manipulating politics or the economy in our own country. Sock puppeting. etc.

Design the script to play to the fears of every politically influential group.

There are more than enough facts out there now to weave a very plausible story that looks like a prequel to 1984.

<comment><USER6> Guardian journalist Charlie Booker is the showrunner of a series called Black Mirror on Channel 4 in Britain where each episode is centered around exploring the potential impact of technology in the near future.

There are some scripts written up for a third series and the NSA revelations would be perfect to explore in a show like that. The problem, as is the general case with this issue, that far too few people are actively engaging it. Black Mirror drew around 1.6m viewers at its highest point, but this was admittedly only in the UK and there was no hot button issue being explored.

</comment></comment></comment></comment></comment><comment><USER7> Who cares what percentage of the total internet traffic is monitored? This is a totally disingenuous metric to put forward. Most of the traffic on the internet is not meant to be private. Most of the traffic probably even isn't created by humans.

Interesting metrics to debate:

What percentage of American emails are recorded by the NSA? 0.0004% or 100%? What percentage of American phone calls are recorded by the NSA? 0.0004% or 100%? What percentage of American text messages are recorded by the NSA? 0.0004% or 100%?

</comment><comment><USER8> If you ignore various entertainment traffic (HD video etc) - which is the biggest component of the multi-petabyte "information exchanged on the Internet" \- one could be monitoring/capturing 100% of the information that matters (emails and social media postings), and still technically be within that fraction of a percentage point.

<comment><USER2> Exactly. I have a little bandwidth counter in my rainmeter and it tells me that so far this month I've used about 50 gigs download and 20 gigs upload. So incredibly little of that is content that is sensitive or really even meaningful. If I send one email to a terrorist, then download one movie, then only like a couple kilobytes out of several gigs is actually "interesting" data.

</comment></comment><comment><USER9> >Our figure is valid; the classified information that goes into the number is more complicated than what's in your calculation.

>Our overall number is valid. I'm not sure why you're calling this a "discrepancy" when the number in the white paper is valid.

I wonder if they expect anyone to believe them.

<comment><USER10> This is straight out of Kafka.

</comment></comment><comment><USER11> I'm getting flashbacks to the VerizonMath Fiasco.

[http://verizonmath.blogspot.com/2007/08/original- recording-o...](http://verizonmath.blogspot.com/2007/08/original-recording-of- verizon-customer.html)

</comment><comment><USER12> I don't believe what the NSA says publicly.

</comment><comment><USER13> The NSA? Caught lying? I am shocked. SHOCKED.

</comment><comment><USER14> Does the NSA search more than Google?

<comment><USER15> Even with what they admitted I think it was said they search more than Google. If this 10x story is true, then it makes it all the more true.</comment></comment>


PSA: Google Cloud has issues again - <AUTHOR> Seems like the issues are similar to the ones on Sunday.<p>Edit, More info: https://status.cloud.google.com/incident/cloud-networking/19010 <comment><USER2> Test success!</comment>


A hackathon exclusively for women - <AUTHOR> https://www.hackerearth.com/women-hackathon-2015/?utm_source=hn&utm_medium=link&utm_campaign=women

<comment><USER2> I can imagine the backlash if the title read "A hackathon exclusively for men".

</comment><comment><USER3> but what about a hackathon for men? WHAT ABOUT A HACKATHON FOR MEN? also, why isn't anybody encouraging men to take teaching, childcare, or nursing jobs (which pay less than software development)? there have i hit all the squares in the HN reverse-sexism-concern-trolling bingo card?</comment>


Where the Heat and the Thunder Hit Their Shots - <AUTHOR> http://www.nytimes.com/interactive/2012/06/11/sports/basketball/nba-shot-analysis.html

<comment><USER2> Not sure how many of you are basketball fans, but if you have even a cursory interest in the sport I suggest you check out this year's NBA finals. It is widely regarded as one of the most anticipated match-ups in many years. OKC's stars are all under the age of 24 which means they should dominate for years to come. We have literally watched these guys grow up before our eyes and they finally get their shot at the title this year.

LeBron James has been lambasted for leaving his hometown team to try to win a championship with the Heat which has evaded him so far. The Heat are the most hated team in the league. By contrast, the Thunder is led by the league's leading scorer Kevin Durant who's appears to be one of the most humble superstars in the league. It's the ultimate good guys vs. bad guys matchup. LeBron, likely fueled by all the criticisms about his ability to perform in the clutch and his will to win, appears to be on a mission to prove everybody wrong and finally win his first championship. To put it in perspective, facing elimination in game 5 versus the Celtics, LeBron put on one of the best playoff performances in history scoring nearly half his team's points (<http://www.nba.com/games/20120607/MIABOS/gameinfo.html>).

The series will be on ABC so you don't need cable to watch it. Catch at least one game.

<comment><USER3> > The Heat are the most hated team in the league.

I'd say Heat and Thunder are tied for most hated team.

<comment><USER4> I'm a die hard NBA fan and have never heard of anyone hating the Thunder.

Why do people hate the Thunder?

I can see the argument that some Seattle fans would resent that the team left, but I think their anger would be directed toward the owners involved or David Stern - not the team itself.

<comment><USER5> For Seattle fans, it's not merely _that_ the team left, it's _how_ they left. Some of Clay Bennett's e-mails got leaked, and they make it clear that while he was publicly promising to try to keep the team in Seattle (which was a condition of the original sale) he was privately saying he'd move the team to OKC ASAP. As long as Clay Bennett is involved with the Thunder, the majority of Sonics fans are going to be against them.

Also remember that of current Thunder players, only Nick Collison was on the team before Clay Bennett arrived. Kevin Durant played one year in Seattle but it was already common knowledge that the team was going to leave, so fans didn't really take to him much. All of the other rotation players were added after the move. So there aren't any beloved players left on the team to mitigate the anger coming out of Seattle.

It's similar to LeBron being thought of as a villain. It's not _that_ he left Cleveland, it's _how_ he left Cleveland. To a lot of fans in both cities, it felt like their guy/team lied about wanting to stay, left under dubious circumstances, and disrespected the fans and the city on the way out.

<comment><USER6> The Sonics don't have _any_ beloved players still in the league, but Gary Payton outspokenly refused to have his number retired by the Thunder.

</comment></comment></comment></comment></comment><comment><USER7> The source of this is: <http://courtvisionanalytics.com/>

Kirk Goldsberry does these. He's been doing this for a while. The NYT may have developed the library that they're using here (I'm not sure), but the idea and the data visualization concept are his.

</comment><comment><USER8> Goldsberry was great at the MIT Sloan Sports Analytics conference[1]. The charts really highlight a player's strengths and weaknesses. A quick look at Ray Allen's chart (in Goldsberry's conference paper) shows how much better he is when he goes to his right. Kobe really needs to cut down on those 12-15' baseline jumpers that he seems to favor.

When I look at the graphics from the NYT article, the player whose chart really sticks out is James Harden. His efficiency this year is amazing and a lot of it has to do with shot selection. Most of his shots are 3-pointers or within 8' which are considered the two highest value shots on the court. Some team with a Moneyball style general manager (somewhat common in the NBA from my understanding) will pay him handsomely yet probably still not what his contribution merits.

[1] <http://www.sloansportsconference.com/?p=6132>

Edit: trivial edit for small error

<comment><USER9> I wonder how much the quality of the shots he takes are a function of his teammates and their offensive sets. Would be really interesting if shot quality could be completely decoupled from the environment.

<comment><USER10> Yeah, its not the simple - you can't just take a look at the data and tell the players, "take these shots, not these shots." Generally, you get a sense of where you're most effective and where you're not, but either the offense doesn't set you up that way all the time, the defense is doing too good of a job, and the shot clock is running out.

Bottom line, IMO its really helpful to look at these (I love data visualization) but you have to be careful not to fall into the trap of oversimplifying.

</comment></comment></comment><comment><USER11> I thought these might be D3/SVG visualizations, but it looks like a custom chart library developed by NYT themselves, with drawing done in a Canvas element.

I think a browser might choke on this many visualizations in SVG but I'm not sure. I've seen libraries take all sorts of approaches, but I'm leaning towards Canvas for really fluid and precise graphics.

Edit: I'm baffled why someone would downvote this.

<comment><USER12> Looking at chart2.js - canvas if the browser supports it with a fallback to flash.

</comment></comment><comment><USER13> How are the statistics from which these visualizations are generated captured? Does the NBA have equipment on the court or in the arena to track players and the ball (something like how professional tennis is monitored)? Is it manual, with a person recording their own observations about player/ball placement? Post-game video analysis?

<comment><USER14> Not the NBA, but some teams use a system called SportVU[0] that do auto player&ball tracking.

I used to work on the system, so I can answer (some) questions about it.

[0] <http://www.sportvu.com/basketball.asp>

<comment><USER15> How does it work?

<comment><USER14> Short version: Using a number(six) of dedicated video cameras around the venue and (a lot of) image processing.

There is a nice article in wired about it(include a picture of one of the cameras and the view from another) [http://www.wired.com/playbook/2011/04/nba- data-revolution/al...](http://www.wired.com/playbook/2011/04/nba-data- revolution/all/1)

<comment><USER16> How is the system calibrated? Are the cameras at fixed angles or mounted to a base that measures their angles?

<comment><USER14> The angles are important, but also the position relatively to the court(which is different in every venue).

The calibration is done by matching(automatically or manually) known world points to pixels from the cameras. (This is a very common practice in image- processing systems)

</comment></comment></comment></comment></comment></comment><comment><USER17> I looked at the team graph and thought it wasn't going to be very informative, but was surprised to see some of the very distinctive player patterns (e.g. Battier).

The graphics are brilliant. Is the image -> graph effect part of some library I haven't heard of?

</comment><comment><USER18> Shane Battier is one of the smartest players in the NBA, and you can see it in action by looking at his shot chart.

<comment><USER19> There's a massive (old) article on Battier - [http://www.nytimes.com/2009/02/15/magazine/15Battier-t.html?...](http://www.nytimes.com/2009/02/15/magazine/15Battier-t.html?pagewanted=all)

Apparently, he's such a good team player (picking good positions, herding opponents into weak positions, doing things which are bad for his stats but good for the team) that he can almost shut down Kobe. OK, Kobe still scores a lot when he's guarded by Battier, but only because Kobe always gets the ball.

He'll memorize every one of those heat maps (along with every other dataset his coach can get him), and use that knowledge to mess up his opponent's attacks.

<comment><USER18> Great article!

"Battier's game is a weird combination of obvious weaknesses and nearly invisible strengths."

</comment></comment></comment><comment><USER20> Please forgive me for bringing up something not directly related to this particular series, but economics professor Dave Berri ran some linear regressions on the box score stats of basketball games, and claims he can accurately measure how much wins per season each player is responsible for. (e.g. Team A won 40 games last season, player 1 produced 15 wins, player 2 produced another 10, player 3 produced another 8, and the remaining wins divide among the other players). He has a (sort of official) blog: <http://wagesofwins.com/> I'm bringing this up because I think this may be of interest to the HN community. I, for one, was fascinated with his claims and their implications, hope this will interest some of you :-)

</comment><comment><USER21> I saw this posted earlier under a different title. The word "stunning" was in there referring to the use of images. Just interested in why you changed it and if there was any observable improvement in views/votes from the change.

</comment><comment><USER22> Anyone else think the granularity is a bit too high on these? Neat concept, but I have to wonder if they wouldn't be a lot easier to interpret with about half the point density.

</comment><comment><USER23> Is there a publicly available data source for basketball stats like this? Curious where these datasets come from...

<comment><USER24> No publicly available that I've seen. Most companies use STATS inc

</comment></comment><comment><USER25> For those of you wanting to dive deeper into the data, try basketball- reference.com's PlayIndex+: [http://www.basketball-reference.com/play- index/plus/shooting...](http://www.basketball-reference.com/play- index/plus/shooting.cgi?&player_id=bryanko01&year_id=2011)

</comment><comment><USER26> Do yourself a favor before watching the NBA finals -- check out this 5 minutes preview of the finals: [http://www.bballbreakdown.com/2012-nba-finals-preview- heat-v...](http://www.bballbreakdown.com/2012-nba-finals-preview-heat-vs- thunder/)

Best analysis I've seen yet.

</comment><comment><USER27> This is pretty awesome. I love solid data, but it seems to me that this might be too much data and too few substantial takeaways...but the graphs are still fun to look at.

</comment><comment><USER28> Incredible visualization. Seriously one of the best I've seen all year.

</comment><comment><USER29> I like how it shows where a player is comfortable and good (red clusters), and where a player is just comfortable (light green clusters).

</comment><comment><USER30> Does any one know where to get access to the raw data? Does the NBA provide them "upon request" or did the author compile them manually?

</comment><comment><USER31> As best I can tell it does not include free throw attempts. If that is correct, the data and therefore the visualization is seriously incomplete and misleading.

<comment><USER32> A player's free throw ability does not need any real visualization. It comes down to number of attempts, and percentage made. Adding them would skew these visualizations and wouldn't tell you anything you couldn't easily figure out by looking at a player's stats.

<comment><USER31> Hhmm. I was assuming the purpose of such a visualization was to understand the offense, which can't be done without including free throws. Perhaps it serves some other purpose, like employing "front-end developers".

<comment><USER33> Visualizing the ratio points from the line vs the rest of the floor could be interesting, but it doesn't say much about how they run their offense.

As others noted, free throws occur at the same place every time and would seriously skew the chart - especially for lowpost/longrange players like James Harden.

Maybe a step closer would be showing where a player was fouled that led to shots from the line.

</comment></comment></comment></comment><comment><USER34> Please no random sports fan chit-chat here. This is Hacker News folks. We have lots of other mainstream places for that sort of thing. Thank you.

</comment><comment><USER35> Very cool. Now all you need is bunch of robot-basketball players with this data plugged in, and those guys' asses are kicked to high heaven, lol!!

</comment><comment><USER36> For those of you watching the game tonight there is a live fan chat running from 9pm at - <http://www.LiveBasketballChat.com/go/17762></comment>