Ask HN: When is it too old to be an intern? - <AUTHOR> I went back to school recently for a 2 year master's degree in information science (think: UI/UX, data science, databases, statistics), and the program strongly recommends doing an internship at a tech company during the summer in between the years.  However, I'm going to be 31 this year, and I assume most of my competition for the positions are going to be in the 18-22 range.  Will managers at SV-type tech companies (probably younger than me) even look at my application?  My background mostly linux sysadmin-ing and bioinformatics, looking to get into more analytic/statistical work like BI. <comment><USER2> I've had 3 interns on my team since last summer. One is a bit older than a typical college student, I believe she's a 26 yo bioinformatics major.

I can only speak for myself, but I look for 1) definitely a student, so expectations of going perm don't hit us by surprise, 2) either not too far off from graduation or the ability to work part-time during school 3) interest in the work, has some tie-in w/ the direction they want for their career, and 4) open to the possibility of going full-time upon graduation.

I'd love to have someone making such a transition working w/ us, we actually might have a need coming up shortly. But then again, I'm 37, and we're in SoCal...

One word of caution - make sure the scope of work is locked down. A smaller company might see you as a cheap backup system admin resource since you have background in that (under the guise of "we wear many hats here"), but you really need on the job experience before going full-time in what you want to transition to.

</comment><comment><USER3> It's much more common than when you were 22. Career changes, diff tracks through school, all sorts of reasons why people want to do internships into late 20s and thirties since the recent recession.

Companies are still desperate for top talent, and for specialized skills at growing firms (tech) that's especially true. We have interns starting with us in the summer at [http://www.thinkful.com/](http://www.thinkful.com/) (edtech) and two of them are in or finishing masters' in CS from Columbia.

As long as you're not being taken advantage of by a cheap employer I think internships are a great low risk way to try a job and career.

</comment><comment><USER4> You have a powerful background - use it to your advantage. Don't try to compete in web dev startups - go where the work is harder. Leverage your Linux / Bioinformatics background to your high advantage. Look at sensor based IoT companies, or healthcare companies, big data companies specializing in healthcare, Or DevOps.

</comment><comment><USER5> I think you give yourself a hard time - part of the reason you're older is because you're doing a post-graduate program and not everyone does that immediately after their under-grad.

So I actually have an open req for such an intern at WP Engine ([http://jobvite.com/m?3aIqcgwf](http://jobvite.com/m?3aIqcgwf)) and I think a post-grad intern with your experience would be ideal. So there's no way age would be a factor, _(and legally, it can 't/shouldn't anyway)_

On your side, I agree with other commenters that you want a clear definition of work to ensure you get the experience you actually want. You probably want to lean towards more established startups who can create a program of work that really needs your skills. We're almost 4 years old and I don't think we'd have been placed to capitalize on your skills and in return offer a meaningful experience 12-18 months ago just because the type of work your doing is probably not relevant during the 'scrappy years' of a startup.

Good luck!

</comment><comment><USER6> Two things you have to take into consideration. Are you financially able to take on a job with low pay to learn for months to a few years at a time?

The second is that if a company is going to spend resources to teach you what you need to know, are you going to want to stick around for a full-time job and contribute back to the company? I don't see this being an issue at 31 years old. I would hire a 31 year old if they were dependable, eager, and committed to staying for the duration of their internship.

I see way too many people not apply for various positions because "degree required" or "3+ years of product x knowledge". I always tell them to apply and make the company say no, don't just take yourself out of the running.

</comment><comment><USER7> I know people your age or older who have successfully transitioned careers to software development, from a standing start. I wouldn't let it put you off at all!

</comment><comment><USER8> Chris Gardner was 27 or 28 and homeless when he became a trainee at Dean Witter Reynolds. If the name isn't familiar, a movie was based on him called _The Pursuit of Happyness_ (2006), played by Will Smith.

If you meet the hiring manager's qualifications, you'll probably get a call for an interview. Just be sure to be ready to explain why they should take you.

<comment><USER9> That story was very inspirational to me. I know Hollywood glamorizes but it is a beautiful story in its own right. Good post.

</comment></comment><comment><USER10> You're never too old to be an intern! I was typically the oldest intern at the places I worked at (interned at 27 and 28).

</comment><comment><USER11> I can't imagine it'll make any difference at the hiring stage (I certainly interviewed my fair share of older interns and often found them to be very strong).

The only way in which I think it will make a difference is if you end up working for a large tech company which has an intern community. It'll be harder to fit in socially, but you won't be the only older intern in general -- some of the PhD interns I worked with were late-twenties, early-thirties -- so you won't be totally alone.

</comment><comment><USER12> As a 33 years old who's planning to return to education as soon as his wallet is comfortable enough to do so, I had similar doubts when I was thinking that I might be 38 or 40 the moment when I'll have to intern.

I guess there's no quantity of answers that you can receive to assure you that you won't meet hiring managers down the line who will be willing to deny your application just because you're old but assholes will always exist. Just do what you can do best and you will score.

</comment><comment><USER13> I don't think you have anything to worry about. It's common to do internships in grad school & it's common for people to do grad school in their 30s. Also be assured the expectations will be different & you will have a much greater opportunity to do meaningful work than a younger intern. The best thing you can do is not obsess over the title intern & figure out who you can do some interesting work with that will count toward your school requirement.

</comment><comment><USER14> They'll certainly look; SV-type tech companies are going to screen your application based on technical merit. I'd simply advise not to include your age on your application, because it's irrelevant to how beneficial an internship would be for you and the company. Once you get in for interviews they may be surprised, but any reasonable person would enjoy hearing that you're enthusiastic about improving your skills and doing an internship during the degree.

<comment><USER5> Right but the dates of his high school and undergrad programs on his resume will presumably give away that he's not 22.

</comment></comment><comment><USER15> At 31 you should be alright getting an internship. Obtaining an internship is more about your interest in then field, willingness to go full time after graduation, and your ability to bring something to the table for the time you are there. If all those criteria are met, at 31 you still have another 20-25 years (easy) of possible work in you. Most programmers stick around for only a few years in any one company anyways.

</comment><comment><USER16> I wasn't as old as you, but I did an internship when I was 23. I was married and we were expecting our first child at the end of the summer. From the perspective of work, it was fine. It was however a larger company and there were 20 interns. They all lived in intern housing and hung out together. It wasn't a big deal, but my intern experience was different from theirs.

</comment><comment><USER17> If you get on the wrong team it may not go well. What will happen is that your managers and people you work with will pretend you are 22 and treat you like a 22 year old undergrad student.

If on the other hand you are brought on specifically as a grad student info science intern working in a info science team, things may go better for you.

</comment><comment><USER18> Probably my understanding of "intern" is limited. But I believe it is okay for anyone who is still in the collage/grad-school/high-school to do an internship, no matter how old she/he is. I know people who started his PhD study at UC Berkeley at his 50s. Nothing can stop him becoming an intern.

</comment><comment><USER19> Most people will expect you to rapidly move to a higher paid position with more responsibility. If you're pitching this as a way to get your foot in the door of a company where you think you'll have a lot of potential, it makes sense.

</comment><comment><USER20> As an aside I really think its crazy that its so difficult to change careers midlife. We have a solid 40+ years of working life. That would be plenty of time for two sucessful expert level careers in two completely different areas.

</comment><comment><USER21> You can never be too old.

</comment><comment><USER22> Knew a guy in his his forties who wanted to work for an ad agency. Convinced them to use him for free for a while as a test and they wound up hiring him. YMMV.

<comment><USER23> Cool! Slave labor and/or illegal minimum wage violations. Sounds like a great company.

Only an asshole company would do this to a future employee. And only an asshole would allow themselves to be exploited like this.

Guys: work on contract. Get paid. Your lack of self-esteem affects everyone else in the workforce trying to earn a living. Don't sell yourself--or your peers--short.

<comment><USER24> Anyone wants to get paid, but not everyone has the chance at the very beginning.

<comment><USER25> If a company isn't even willing to pay you minimum wage (which is really not much in most places), it is one or more of:

1) They can't afford to, so probably aren't a very successful business.

2) They want to keep out the people who literally could not afford to live under this arrangement. (Disproportionately non-white, female, etc.).

3) You'll be of even less value to them than the minimum wage (so probably wouldn't be doing anything worthwhile/educational).

Don't take an unpaid internship, even if you can afford it. It perpetuates a terrible idea.

</comment></comment></comment></comment><comment><USER26> Most people will find it a bargain to get a 31 year old intern, with lots of experience. I wouldn't worry about it one second.

</comment><comment><USER27> We had an intern last summer that used to have his own interns before he moved to software - people will definitely look.

</comment><comment><USER28> i did it at 29 and it worked out well for me. many of the other interns were just out of college, but it didn't seem to matter that i was a bit older. after 3 months i got a full time position and stayed with the company for 4 years.

</comment><comment><USER29> isn't it a matter of ambition? if you include apprentice in your dictionary, people still do it in mid-50s.

definition: less accountability, steep learning curve, short immediate economic returns.

</comment><comment><USER30> Hahaha, very interested in seeing this. I'm same boat.</comment>


Software Has Diseconomies of Scale - <AUTHOR> http://allankelly.blogspot.com/2015/10/software-has-diseconomies-of-scale-not.html <comment><USER2> Recent discussion: [https://news.ycombinator.com/item?id=10728057](https://news.ycombinator.com/item?id=10728057)</comment>


Show HN: Minecraft Docker container for remote LAN parties - <AUTHOR> https://github.com/pjperez/docker-whminecraft/ <comment><AUTHOR> Hi HN,

(Disclaimer: I'm the one-man-band behind Wormhole Network)

As part of my work on overlay networking I'm developing a series of examples on how this technology is a disruptor.

On this specific example, you could spin up a __private __Minecraft server and get your friends to connect to it with very easy steps for everyone and avoiding complex VPN solutions, working with NAT, routing and firewall configurations (plus exposing port on Docker itself).

A tiny Minecraft hosting business could be built around this Docker image. Offer private Minecraft servers and spin as many as you can on one single server. As you don't need to tweak network configuration nor expose ports on Docker, all the servers could run on the same default port, making it very easy for your customers.

The possibilities are endless :) hope you enjoy it!</comment>


Show HN: Free Automated QA Testing: AI Finds, Creates, & Repairs Your UI Tests - <AUTHOR> https://qanairy.com/ <comment><USER2> I was unable to sign up. Nothing displayed at [https://app.qanairy.com/](https://app.qanairy.com/) after clicking on the sign up link.

<comment><AUTHOR> Hi, I'd love to look into that and fix that for you. Could you possibly tell me what browser you're using and what country you're located in? Thanks!

</comment></comment><comment> Lex-2008 nice! This video explains the "discovery" part: [https://www.youtube.com/watch?v=JdaWJt1yD1M](https://www.youtube.com/watch?v=JdaWJt1yD1M)

Wonder how good it can be with more complex sites, incl those needing authorisation

<comment><USER3> We have a process that allows you to create test users that can be used for authorization. As the discover runs, the system will capture the forms that it finds and needs you to classify. All you need to do is tell us which forms are login forms and the system will continue discovering tests using the login credentials you provide. If you have a complex site with many different user roles, simply add test users with different roles and Qanairy will use each of them to generate tests.</comment></comment>


How To Be Creative - <AUTHOR> http://gapingvoid.com/Moveable_Type/archives/000932.html <comment><USER2> 38 bold exhortations to live life creatively. Here's my favorite:

"Sing in your own voice.

Piccasso was a terrible colorist. Turner couldn't paint human beings worth a damn. Saul Steinberg's formal drafting skills were appalling. TS Eliot had a full-time day job. Henry Miller was a wildly uneven writer. Bob Dylan can't sing or play guitar.

But that didn't stop them, right?

So I guess the next question is, "Why not?"

I have no idea. Why should it?"

<comment><USER3> One HN-relevant Picasso quote. . .

 _Computers are useless. They can only give you answers._

and one that always cheers me up since I make more logic errors than anyone I know. . .

 _I am always doing that which I can not do, in order that I may learn how to do it._

\--Pablo Picasso

<comment><USER4> Picasso also outlived his talent.

[http://www.amazon.com/Old-Masters-Young-Geniuses- Creativity/...](http://www.amazon.com/Old-Masters-Young-Geniuses- Creativity/dp/0691121095/ref=sr_11_1?ie=UTF8&qid=1230920697&sr=11-1)

</comment></comment></comment><comment><USER5> _"A lot of people in business say they have twenty years experience, when in fact all they really have is one year's experience, repeated twenty times."_

This has always been my favorite quote from this essay, probably because to goes double for the software industry. Having 10 years experience programming poorly makes you a _worse_ hire than someone with no experience at all.

</comment><comment><USER6> This may be a repeat appearance on the front page, but I welcome it any time!

<comment><USER7> Agreed.. this is always worth re-reading every few months. It's a fantastic read.

</comment></comment><comment><USER8> "Beware of turning hobbies into jobs"

Don't most hackers turn their hobbies into jobs? How does that work for you?

<comment><USER9> i've had some success but mostly irritation over this... for the most part computers in general are both my hobby and my career, and that mostly works out, although can be exhausting, so i find other things.

specifically aspects of computerdom, administration like things used be a hobby for me, but not anymore now that i'm an admin, so my hobby is programming.

then i got moonlighting work on special programming projects. lots of fun, but now i just feel like making art and music more... and hopefully i can avoid making those a job just because i want to keep it fun.

i don't know... i might go back into design fulltime and become just a hobby hacker again, but i guess i need that in depth analysis of systems troubleshooting to feel relevant. it used to be a cool rewarding hobby, but now it is a cool and rewarding job, so i guess i can't complain, and it still works for me

</comment></comment><comment><USER10> Iterate over and over until you find something interesting.

<comment><USER11> Yea thats what I do but I have an efficiency function which judges my iterations so I know if an iteration is actually good or not.

</comment></comment><comment><USER12> stop reading huge lists and go fucking make something

</comment><comment><USER13> There's also a nice pdf version here: <http://www.changethis.com/6.HowToBeCreative>

<comment><USER14> It is nicer but it doesn't have all the 38 points.

I like the layout though.

</comment></comment><comment><USER15> _Everybody has their own private Mount Everest they were put on this earth to climb._

I stopped reading there.

<comment><USER16> why?

<comment><USER15> Because it's overgeneralized, useless, feel-good nothingness.

</comment></comment></comment><comment><USER17> They missed #1: 10% inspiration, 90% perspiration.

<comment><USER18> It's 1:99, not 10:90.</comment></comment>


I Defeated the Tolkien Estate - <AUTHOR> https://the-toast.net/2014/12/08/defeated-tolkien-estate/ <comment><USER2> I didn't realize this was fiction at first. Skimming through I hit the opening of the fifth paragraph:

>Tolkien refers to Quendi people as "elves," a common term in his time, but considered highly offensive today.

...and was wondering what flavour of advanced outrage culture is now being offended at calling fictional elves "elves".

Solid read nevertheless.

</comment><comment><USER3> for some more context: [https://austinhgilkeson.wordpress.com/2014/12/09/the- real-re...](https://austinhgilkeson.wordpress.com/2014/12/09/the-real-red- book-of-westmarch/).

Also the OP is from 2014.

</comment><comment><USER4> This very much reminds me of [https://en.wikipedia.org/wiki/The_Last_Ringbearer](https://en.wikipedia.org/wiki/The_Last_Ringbearer) which will shamefully probably never see an English print release. It's an interesting work of research and writing.</comment>


How Oil Extraction Could be Changing How Planet Spins - <AUTHOR> http://paul.kedrosky.com/archives/2010/02/how_oil_puts_th.html

<comment><USER2> This is false. All the Earth's crust occupies less than 1% of Earth's volume, and it is formed by the lighter rocks. And oil is only a very little part of it.

Technically the moment of inertia change, but the effect is very small and impossible to measure.</comment>


How Nature Does TDD (Eigen's Paradox) - <AUTHOR> https://en.wikipedia.org/wiki/Error_threshold_(evolution) <comment><USER2> Please don't editorialize the titles of stories you submit to HN. Using the original title unless it is misleading or linkbait allows readers to interpret the story for themselves.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><AUTHOR> Gotcha, I'll move to using the original article title from now on.</comment></comment>


On the world's most wonderful programming language - SETL - <AUTHOR> http://setl.org/

<comment><USER2> I propose a minimum standard for all programming languages:

 _show example code on the home page_

You will save the audience a lot of time, and be able to convey a lot about your language in a much more concise way. Great for that first taste.

<comment><AUTHOR> I agree... But it is not my web site :)

For example, the set-valued expression

         {1..n}

is the set of integers 1 through n, and

         {p in {2..n} | forall i in {2..p-1} | p mod i /= 0}

is the set of primes through n. (The first vertical bar here is best read as such that, and the second as a pause.)

<http://setl.org/doc/setl.html#Overview>

<comment><USER3> That made me think of Haskell, so to compare here is the equivalent(and of course totally inefficient) Haskell version:

      [p| p <- [2..n], all (\i -> p `mod` i /= 0) [2..p-1]]

So, has this language more to offer than list comprehensions?

<comment><AUTHOR> I believe, what Haskell is generating is list. What SETL is making, is set.

Could this syntax be used over any monad?

[edit] Of course, there are things like */[1..n] for finding factorial, but that is fold in Haskell. It's neat for scripting, and for me, for circuit complexity explorations.

</comment></comment></comment></comment><comment><AUTHOR> Does anyone work on GNU SETL?

Does anyone here have source of GNU SETL?

I find it really interesting and useful, and for ages there has been no source available or news...

</comment><comment><USER4> do you know Python? :)

<comment><AUTHOR> Well... SETL influenced ABC, which influenced Python. [1][2]

[1] <http://en.wikipedia.org/wiki/ABC_%28programming_language%29>

[2] <http://en.wikipedia.org/wiki/Setl#History>

[edit] There's list comprehension in Python... Are there set operations?

[edit2] [2]</comment></comment>


Germany's Federal Network Agency wants to regulate XMPP clients - <AUTHOR> https://translate.google.com/translate?sl=de&tl=en&js=y&prev=_t&hl=de&ie=UTF-8&u=https%3A%2F%2Fwww.golem.de%2Fnews%2Fmeldepflicht-bundesnetzagentur-will-hundert-jabber-clients-regulieren-1703-126929.html&edit-text= <comment><USER2> For context, Bundesnetzagentur (literally "federal network agency") is a German agency that regulates five kinds of networks – electricity, gas, telecommunications, post, railways. The telecommunications part of their work is supervised by the Bundesministerium für Verkehr und digitale Infrastruktur (literally "federal ministry for transport and digital infrastructure" i.e. highways and data highways).

One of its tasks is to ensure non-discriminatory access to infrastructure markets for all market participants: Former state monopolies have to share their infrastructure at a reasonable price to competitors, for example. Another task is consumer protection: In february 2017 they decided that an internet-enabled child's doll containing a microphone accessible remotely without any indication to the people using that doll should be "verboten" since they classified it as a hidden wiretapping device.

The federal network agency claims that XMPP clients have to be registered according to a German law that says that one has to be registered with (but does not need permission from) the agency if providing public communication services commercially.

[https://en.wikipedia.org/wiki/Federal_Network_Agency](https://en.wikipedia.org/wiki/Federal_Network_Agency)

Edit: As other hackernews have pointed out, only the telecommunications stuff is supervised by the BMVI.

<comment><USER3> > It belongs to the Bundesministerium für Verkehr und digitale Infrastruktur > (literally "federal ministry for transport and digital infrastructure" i.e. > highways and data highways).

That's blatantly wrong. It's the Federal Ministry of Economics and Technology (Bundesministerium für Wirtschaft und Energie). You even mentioned the Wikipedia article which states it right.

<comment><USER4> The departments of the agency working on telecommunication law are exclusively supervised by the Bundesministerium für Verkehr und digitale Infrastruktur. Only the other areas plus all administrative supervision is done by the Bundesministeriums für Wirtschaft und Energie.

("Belongs to" is probably too strong either way. They are not part of a ministry.)

<comment><USER3> Ah you are right they introduced that change late 2013.

//edit: But how it is stated in the parent post is still wrong ;)

<comment><USER2> I edited my post to clarify that.

</comment></comment></comment></comment></comment><comment><AUTHOR> Original (in German): [https://www.golem.de/news/meldepflicht- bundesnetzagentur-wil...](https://www.golem.de/news/meldepflicht- bundesnetzagentur-will-hundert-jabber-clients-regulieren-1703-126929.html)

TL;DR German Federal Network Agency (BNetzA) contacted more than 100 developers of XMPP clients, in or outside Germany. BNetzA considers XMPP- clients to be "telecommunication services" and requested developers to register with German authorities, as required by the German "telecommunication law".

Here's a relavant tweet by Xabber developer from Chelyabinsk, Russia:

[https://twitter.com/Xabber_XMPP/status/844865634672435200](https://twitter.com/Xabber_XMPP/status/844865634672435200)

Update: Corrected BND -> BNetzA, was a wrong translation.

<comment><USER5> > BNetzA considers XMPP-clients to be "telecommunication services"

But that is exactly what network clients provide: telecommunication services. IFF the relationship between the states and the governed was healthy you wouldn't bat an eyelash at the suggestion.

Problem is elsewhere.

<comment><USER6> > IFF the relationship between the states and the governed was healthy you > wouldn't bat an eyelash at the suggestion.

Please clarify what suggestion you mean: that XMPP clients are telecommunication services or that their developers need to register?

<comment><USER5> The client is a component of a communication service. Such components used to be (mainly devices and) developed solely by corporations already integrated into the 'system'.

You don't trust the system, and you have good reasons for that, and the 'system' doesn't trust actors it does not control.

It is that simple.

<comment><USER6> I just asked for a clarification of what suggestion you exactly meant in your original comment and I still have no idea after this response.

</comment></comment></comment></comment></comment><comment> photon-torpedo The interesting bit is that they explicitly point out part 7 of the TKG (telecommunications act) which details the telecommunication provider's duties in assisting law enforcement agencies, such as providing interfaces for targeted surveillance.

Relevant part of the law:

[https://translate.googleusercontent.com/translate_c?depth=1&...](https://translate.googleusercontent.com/translate_c?depth=1&hl=de&ie=UTF8&nv=1&prev=_t&rurl=translate.google.com&sl=de&sp=nmt4&tl=en&u=https://www.gesetze- im- internet.de/tkg_2004/BJNR119000004.html&usg=ALkJrhizUtlFGCANtatJPtuf8nRlx4hPlg#BJNR119000004BJNG001800000)

See especially paragraph 110 and following.

So I wonder if they want developers of XMPP software to implement surveillance features?

</comment><comment><USER7> Here's the page the Xabber guys were referred to: [https://www.bundesnetzagentur.de/EN/Areas/Telecommunications...](https://www.bundesnetzagentur.de/EN/Areas/Telecommunications/Companies/Notification/NotificationRequirement- node.html)

It's in English, but the registration form is in German: [https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sac...](https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sachgebiete/Telekommunikation/Unternehmen_Institutionen/Anbieterpflichten/Meldepflicht/Meldeformular_pdf.pdf;jsessionid=F0427467E2779E03415AF0AB9CD01C6D?__blob=publicationFile&v=13)

Here's a cursory overview (IANAL!): They want the name of your company, and for companies outside Germany, the name of a representative in Germany; and a way to contact you. Page 2 concerns access providers, e.g. ISPs. Page 3 concerns service providers, with provisions for all manner of services from VoIP, Email, messaging, VPNs and more general network solutions, and a field for "other" ("include brochure where applicable"). They close with some explanations, and a threat of fines up to 10000 EUR in case of non- cooperation.

Fun stuff.

The list of companies that have complied is public: [https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sac...](https://www.bundesnetzagentur.de/SharedDocs/Downloads/DE/Sachgebiete/Telekommunikation/Unternehmen_Institutionen/Anbieterpflichten/Meldepflicht/TKDiensteanbieterPDF.pdf;jsessionid=F0427467E2779E03415AF0AB9CD01C6D?__blob=publicationFile&v=62)

It's 149 pages at around 20 entries per page (there's also an Excel version available). Facebook is not listed. Google is, hilariously with the note that there is an ongoing legal dispute on whether they are required to register.

</comment><comment><USER8> I find this bit of their reasoning particularly curious:

> _The authority argues that the software would also take over functions of a > server in so-called Over The Top services (OTT services) and thus not to be > assessed as pure software._

If I'm not misunderstanding that, the agency asserts that a software requires regulation because it _opens a port for listening_.

On the risk of being alarmist, my suspicion for some time is that the next step in centralising the internet will involve stronger legal hurdles for usage of the internet that does not conform to the standard "dumb client+cloud backend" pattern. I fear this is the beginning of exactly that.

</comment><comment><USER9> The translation is wrong, it is the Federal Network Agency. Comparable with the FCC in the US but it also regulates other network based markets. But they have nothing to do with the BND.

See [https://www.bundesnetzagentur.de/](https://www.bundesnetzagentur.de/)

<comment><AUTHOR> You're right, sorry, it's not BND, it's BNetzA. I'll correct the posts.

</comment></comment><comment><USER10> Isn't it a bit too late?

XMPP was big-ish ten years ago, maybe. Today even Google discontinues its client.

<comment><USER11> I don't think XMPP is going away any time soon, but it certainly is not the most used thing out there.

However, I think that's part of why they've made this request. I think the problem is that it is late enough in the lifecycle of XMPP that no one large group (politically speaking - let's talk minimum of 100,000 people with similar political interests) really cares about it. That makes this not at all controversial, so it allows them to set a precedent.

I do not live in Germany, though, so I don't know if there's already precedent, or if the German people really even care about this. Hell, I don't even know if making XMPP service providers register is at all harmful or restrictive. All I can comment on is how it looks to me, and it looks like a power grab from over here.

<comment><AUTHOR> Registration per se is not harmful or restrictive - except that some (figuratively speaking) poor developer in Russia now has to deal with a four- page form in German which isn't even really suitable for software.

The problem is not the registration, the problem is that BNetzA considers software to be "telecommunication services" and thus subject to regulation. There are 152 paragraphs in the TKG ([https://www.gesetze-im- internet.de/tkg_2004/index.html](https://www.gesetze-im- internet.de/tkg_2004/index.html)), how much would it cost a software vendor to comply with everything? Or how much would it cost even to find out what a software vendor would have to comply with? There was a pretty good reason Google went to court over the question whether GMail is a "telecommunication service" or not ([https://www.noerr.com/de/newsroom/News/gmail-ist-ein- telekom...](https://www.noerr.com/de/newsroom/News/gmail-ist-ein- telekommunikationsdienst-im-sinne-des-tkg.aspx)). Google lost, by the way.

From the other hand, the list of "providers" includes a lot of organisations like "Antennengemeinschaft Schreiersgrün e.V" \- roughly translated as "Antenna community of the village Schreiersgrün (registered society)".

<comment><USER11> It does seem pretty odd to consider software a telecommunication service, to me, absolutely. All the software is doing is wrapping up a message for someone else to send. It would sort of be like considering envelopes, paper and writing (when taken together) to be a mail service.

Taken another way, if we think of XMPP as a telecommunication service, and require providers to register, do we also consider HTTP to be a telecommunication service, and also require registration of every public access HTTP server? Both are protocols that, at their core, pass messages. Who's going to ratify all of those forms? This feels like it would be expensive to enforce, and if the law does not explicitly name XMPP (or explicitly define the difference between a telecommunication service that it covers and one that it does not in a way that excludes such widely used things as HTTP), it should not be selectively applied to XMPP. It should either be rewritten, or applied to technologies that existed or were expected when it was drafted.

</comment></comment></comment></comment><comment><USER12> Germany also wants you to pay for a broadcasting license (costs up to $10,000) if you continuously livestream online, regardless of whether you are making any money from livestreaming.

All of this reeks of ham-fisted overregulation.

<comment><USER13> It is a kind of fallout from a long overdue reform of that law area. In theory you even have to stop 'sending' your website between 6:00 and 22:00 if it contains adult content, same law. The reform failed due to the totally insane requirement of rating every single website for child protection. As it is a law with state and federal parts, you have lots of duplications and weird rules.

So the 'register all XMPP clients' is a side effect of german regulations that still consider Internet to be mostly just a slight variant on Phone&TV&Radio.

In the past (1980s/1990s) you had (in theory) to register any BBS service as a telecom provider, but they didn't even have a proper form to do the registration.

</comment></comment><comment><USER14> Regulating a specific application layer protocol is like regulating to speak English in the phone call.

The result: We'll use yet another protocols and natural languages.

</comment><comment><USER15> Lost in translation: Not the BND (German Federal Intelligence Service) wants to regulate it, rather it is the Bundesnetzagentur (think FCC).</comment>


Gallup Study Shows Well-Being in Decline Across America - <AUTHOR> https://www.citylab.com/life/2018/03/the-unhappy-states-of-america/555800/ <comment><USER3> It's interesting that at the same time well being is going down, obesity, diabetes and depression are increasing according to this study. I wonder how much negative well being is being driven by the obesity epidemic. We already know that obesity has a measurable impact on healthcare spending, does it not stand to reason that it could cause other society wide problems?

<comment><USER4> I would think it's the other way around. People are less well off, so they find comfort in cheaper and unhealthier foods.

<comment><USER3> This chart shows dental care going up a lot. A lot of dental work is more or less discretionary spending. I'd say this shows people care about how they look (also probably why exercise is increasing), but aren't willing to cut back on unhealthy foods.

Further median income has been increasing in the U.S. If poverty causes obesity to increase, I'd expect that since the U.S. economy is rebounding that obesity would start decreasing.

<comment><USER5> The US real median income rate has only just now surpassed levels seen in 2007 and, before that, 1999; you can read that as, "median income is now higher than ever before", or you can read that as, "US working families lost two full decades worth of wage increases". Both statements would be true.

Furthermore, while median income has increased, the bulk of economic gains are still not making their way into the average household. This is so broadly accepted as true that there's an entire Wikipedia article about it: [https://en.wikipedia.org/wiki/Income_inequality_in_the_Unite...](https://en.wikipedia.org/wiki/Income_inequality_in_the_United_States)

Opioid and other drug abuse _probably_ correlates well with poverty (example [https://www.theatlantic.com/health/archive/2017/04/joblessne...](https://www.theatlantic.com/health/archive/2017/04/joblessness- and-opioids/523281/)), and that problem has become a national conversation recently.

</comment></comment></comment></comment><comment><USER6> This data seems weird to me because it look like positive well-being is correlated with suicide. The states in their top quintile like Montana and Colorado are also top states for suicide. So either their survey method biases against people who are about to kill themselves, or well-being as they define it isn't enough to live for.

<comment><USER7> I associate rural activities with increased wellbeing. Living in or visiting nature. I also associate guns with rural activities. I wonder how those states correlate with gun control.

Suicidal thoughts are often strong but momentary. If there is a gun available, one can take action on the feelings before they pass makeing a momentary thought permanent. Heartbreaking.

So my hypothesis is that the same restrictions on society and or culture that decrease the chance of suicide also reduce wellbeing.

<comment><USER8> I associate urban living with more daily physical exercise. Rural residents, non-ranching and non-farming residents, drive everywhere and walk little. If they aren't doing a daily exercise like running or hiking, the carless urban dweller is getting more daily walking in. I know I certainly did when I lived in Tokyo. It was way more easy getting a gym trip under my belt in Tokyo.

I recall reading a study correlating elevation with suicide. It might explain the suicide rates in MT/WY/CO.

Found it!

[http://theconversation.com/the-curious-relationship- between-...](http://theconversation.com/the-curious-relationship-between- altitude-and-suicide-85716)

</comment></comment></comment><comment><USER9> There are some studies that show that suicide rates are the higher than normal in areas where manufacturing jobs have dried up. Surprised nobody even mentions that on HN, although on second thought, it's probably not that surprising.

</comment><comment><USER10> My first question off the bat is why didn't they at least explain why they didn't just try using the same type of data that the UN nation study did - <USER2> UN study shows the same marked decline in America over time.

[https://www.theguardian.com/world/2018/mar/14/finland- happie...](https://www.theguardian.com/world/2018/mar/14/finland-happiest- country-world-un-report)

<comment><USER11> "We did this study that's similar to another, less detailed study because we wanted to focus on our country and differences between states within our country and, because, that's what scientists do."

</comment></comment><comment><USER12> I hesitate to trust umbrella measurements of the health of our economy when I know I cannot trust so much else of I read. Corporate advertising and public relations will reasonably generate an environment of cynicism.

Why do I trust this article's claims? I don't necessarily. But, it reflects what I observe and my understandings of how humans live with one another.

America is a society optimized for individualism, but humans are social beings. This is basic stuff, but it's undermined through propaganda and shame.

<comment><USER10> To your last point, America is also so large and diverse it's going to be hard to come up with too many sweeping conclusions from data like this. There's always going to be a few success stories about _individualism_ but that doesn't help the median person who is just making ends meet, barely, and the homelessness issue that is worse in America than probably anywhere on earth especially given our cumulative wealth. The UN does have a happiness measure for what it's worth, it's probably better for smaller more homogenous countries. It interesting to compare what the UN study measures versus the American only one here. [https://www.theguardian.com/world/2018/mar/14/finland- happie...](https://www.theguardian.com/world/2018/mar/14/finland-happiest- country-world-un-report)

<comment><USER13> I don't think the homogeneous part is accurate. Four of the top eleven countries in the happiness ranking are Switzerland, Australia, New Zealand and Israel. Those are among the least homogeneous of any western countries. All have over 25% of their populations who are immigrants.

</comment></comment></comment><comment><USER14> If anyone else is wondering how subjective wellbeing, aka happiness, is measured...

"how people feel in their day-to-day lives across key dimensions of well- being, including physical health and wellness; having supportive personal and family relationships; financial and economic security; having a sense of purpose; and connection to one's community."

<comment><USER15> Why do you think it's less interesting or important because it's subjective data?

<comment><USER16> Was the comment changed, or are you inferring something from the comment you replied to?

<comment><USER15> I might have misunderstood it. I thought they were saying, "If you're wondering how subjective this is..." (implying that it's not an informative measurement)

</comment></comment></comment></comment><comment><USER17> is it so surprising?

the slightly less than average person is suffering to some degree (most likely minor), and that suffering is escalating to the point where average people feel it.

</comment><comment><USER18> Wow, my home state of South Dakota at the top of the rankings.

Snow days must have something to do with it.</comment>


Mercurial Oxidation Plan: Using Rust in Mercurial - <AUTHOR> https://www.mercurial-scm.org/wiki/OxidationPlan <comment><USER2> So what happens to the people use tier 2 or tier 3 platforms such as *BSD, Illumos, etc when python is much more widely supported than rust[0]?

[0] [https://forge.rust-lang.org/platform-support.html](https://forge.rust- lang.org/platform-support.html)</comment>


Rock in the USSR: New photos of the Leningrad underground during perestroika - <AUTHOR> http://calvertjournal.com/features/show/6563/igor-mukhin-leningrad-photos-perestroika-viktor-tsoi <comment><USER2> In the late 80's I remember my aunt was a huge fan of Victor Tsoi. I was too little to understand but looking back it is hard to describe how popular he was with that generation:

[https://en.wikipedia.org/wiki/Viktor_Tsoi](https://en.wikipedia.org/wiki/Viktor_Tsoi)

He was the father of Soviet rock scene. Even though his (and his band's - Kino) songs would probably be deemed more pop than rock these days.

Grupa Krovi (Blood Type) is probably my favorite and his most known song:

[https://www.youtube.com/watch?v=K69_m4gtZDk](https://www.youtube.com/watch?v=K69_m4gtZDk)

A mix of Tsoi video clips:

[https://www.youtube.com/watch?v=0iSfWYM0yJs](https://www.youtube.com/watch?v=0iSfWYM0yJs)

<comment><USER3> Another one of his famous songs: Кукушка (Kukushka: cuckoo)

[https://www.youtube.com/watch?v=rJItrpLE8rE](https://www.youtube.com/watch?v=rJItrpLE8rE)

Tsoi was a great artist who died way too young.

<comment><USER2> Thanks. Really like that one as well.

</comment></comment></comment><comment><USER4> these were fun times.... Wind of change and absence of Putin

<comment><USER5> Then again my understanding is that Putin came to power much because Yeltsin road that wind of change into the ground...

<comment><USER6> Iraq wouldn't have happened if the USSR had their shit together. NATO aggression and the subsequent destruction of Yugoslavia was what really sealed the deal. The Russians realized they were next (see: Chechnya) and decided to stop playing nice.

<comment><USER7> Iraq and pretty much everythink bad in the middle East stems from ussr ivasion of Afghanistan. It's not the sole target for blame (plenty Of that to go around for everybody) but it's what (re)started to dumpster fire.

</comment></comment></comment></comment><comment><USER8> I remember it was a big deal in the 80's for Iron Maiden to play behind the Iron Curtain.

</comment><comment><USER9> reminds me of the russian copies of foreign vinyl records on x-ray pictures

</comment><comment><USER10> why here?</comment>


Projected growth of Tiger Mosquito range in northeastern US (2013) - <AUTHOR> https://www.ncbi.nlm.nih.gov/pmc/articles/PMC3614918/ <comment><USER2> I'm amazed by the spread of various Asian mosquito breeds throughout the world in my lifetime. When I grew up in Los Angeles (90s/00s) the only time I remember ever getting a mosquito bite was while camping in the Summer. Fast forward to ~5 years ago and there has been a persistent outbreak across LA of the Tiger mosquito and several other species. It's so bad that you simply can't be outside around sunrise/sunset without taking the necessary precautions. We now have a division within the pest control authority that deals specifically with tracking and eradicating them.

Two years ago I moved to Southern France only to find it's the exact same story.

We're dealing with an airborne virus pandemic now, but I can easily imagine the day when the Global North is dealing with the same mosquito-borne diseases that decimate parts of Africa and Asia.

<comment><USER3> The global north _has_ dealt with the same mosquito-borne diseases that decimate parts of Africa, inasmuch as malaria used to exist in Europe (even as far north as Finland) and in the southeastern United States. However, efforts were made to eradicate malaria there over the 19th and 20th centuries and were successful.

<comment><USER2> I'm aware of these efforts and just pointing out that it's likely to happen again. Not to mention we won't be able to blanket the nation in DDT this time...

</comment></comment></comment><comment><USER4> These bastards are all over Southern Europe nowadays. They're normal mosquito evil twins. Silent, smaller, bites itch more and allergic reactions are bigger.

<comment><USER5> Yea we have them here in spain. I swear it feels like they are more intelligent as well, as they follow me around the house. I can walk from upstairs down the stairs and i can see them follow me.</comment></comment>


ODROID-C1 – Quad Core ARM Linux computer - <AUTHOR> http://hardkernel.com/main/products/prdt_info.php <comment><USER2> Their technical details page seems to push eMMC pretty hard but their prices, 64GB for $80 [1], seem really high compared to a microSD card. Can anyone with experience comment on whether the eMMC has anywhere near the value for its price?

[1] [http://hardkernel.com/main/products/prdt_info.php?g_code=G14...](http://hardkernel.com/main/products/prdt_info.php?g_code=G141628557245)

<comment><USER3> Yes, it does. SD cards are not really designed for being used as a root file system. They are OK at streaming writes and reads, but once you start getting non sequential they slow down like you wouldn't believe. Which, yes, I know, is super weird for what should just be some glue logic around a NAND.

I was investigating corruption and performance problems with our root filesystem on an SD card. The cards would be great a obvious benchmark style tasks, but when I recorded the block access pattern from our driver and replayed that on a Linux desktop with O_DIRECT, we'd not only get under 200KiB/s average access speed (which matched what we were seeing on the embedded system), but we would also get corrupted sectors (ie. we write it just fine, but we just get an error back from the card when we go to read the sector) in less than a day of sustained writes (once again at only 200KiB/s). And this was with high quality SanDisk cards that were then verified by them to be real cards (for a while we thought that clones had made their way into our supply chain). Using a weird form factor eMMC chip in an SD card got rid of these issues. There's also "industrial" SD cards that are around the same price that I suspect are basically the same thing.

<comment><USER4> Most SD and μSD cards have embedded microcontrollers [http://www.bunniestudios.com/blog/?p=3554](http://www.bunniestudios.com/blog/?p=3554) — I wonder how much of the corrupted-sector problems you were getting are really just bugs in their firmware? Or things that could be worked around with better firmware?

<comment><USER3> Yeah, it was almost certainly firmware bugs combined with already marginal NANDs. ie. the NANDs probably would have been fine if they were babysat a little better, but they were probably bottom of the barrel. That's kind of the SD card market in a nut shell any way.

That being said we tried many different SD cards from quality vendors and found pretty heavy bugs and performance related issues among all of the non "industrial" versions.

So, yes, the problems don't have to be intrinsic to the form factor, but empirically you're more likely than not to have issues with them.

</comment></comment></comment></comment><comment><USER5> Just wanted to post that my interaction with (and purchases from) ODROID have been fantastic. They also have this really cool magazine they release from time to time:

[http://magazine.odroid.com/assets/201412/pdf/ODROID- Magazine...](http://magazine.odroid.com/assets/201412/pdf/ODROID- Magazine-201412.pdf) (that's Dec. 2014's issue)

It's a great platform to learn on, no fuss ordering (a little waiting), and the platform is both cheap (they're one of the rare companies that has reduced the price of a product going from one release to another).

Also, the C1 beats the pants of Pi B+. :)

No complaints here.

</comment><comment><USER6> I wonder what kind of "license issues" are present in the current software?

 _" U-boot/Kernel/Linux source code will be released 15-Dec-2014. Android source code will be published in February after cleaning some license issues."_

Looks like the biggest problem with most of these ARM boards (raspberry pi included) is the dependency on some closed-source binary blobs, at least for boot, and sometimes even the entire kernel is a closed branch off some old release.

<comment><USER7> I've never dealt with an ARM core that needed some magic object-only blob to boot. They're almost all using Denx U-Boot.

If the _GPU_ needs an object loaded to boot, like the RPi, that's another story. But a decent SoC should be able to start without the GPU getting in the way.

<comment><USER8> IIRC, for the Raspberry Pi, the GPU controls the CPU (or, at least, it boots first), which makes the blob necessary.

<comment><USER9> Correct. But this is just the first stage bootloader; the GPU boot ROM loads a second stage loader from the SD card, which then loads the kernel and launches the ARM straight into it. None of this is encrypted or signed as is usual on Android devices.

[http://raspberrypi.stackexchange.com/questions/10489/how- doe...](http://raspberrypi.stackexchange.com/questions/10489/how-does- raspberry-pi-boot)

<comment><USER10> The license conditions do, however, forbid you from using the first-stage bootloader on anything other a Raspberry Pi. That is, if you somehow manage to get hold of another board with the same Broadcom SoC that's somehow compatible with the bootloader, you're not allowed to boot that with it.

</comment></comment></comment></comment></comment><comment><USER11> Anybody make something similar with dual ethernet? I'd like to replace my aging Alix-based home router/vpn ([http://www.pcengines.ch/alix2d3.htm](http://www.pcengines.ch/alix2d3.htm)) with something like this.

<comment><USER12> If 100M is enough for you, I'm developing a new board with 2 RJ45 for industrial ethernet, which has a 40 pin connector compatible to that of RPi B+, but the circuit is adapted from beaglebone black. It's scheduled for end of January 2015.

[https://docs.google.com/document/d/1X9RrbkUpiTQ-S6Acken-5fv7...](https://docs.google.com/document/d/1X9RrbkUpiTQ-S6Acken-5fv7yYq2DTr_1zOjf6zabn0/edit?usp=sharing)

<comment><AUTHOR> I'm very interested in your board as it would probably make for a great *BSD firewall, do you have any contacts? as I cannot find any on that page.

<comment><USER13> Not sure what your budget (power or $) is, but I use this for an almost identical situation:

AMD fanless barbone w/ dual NIC (Jetway $215) [http://www.newegg.com/Product/Product.aspx?Item=N82E16856107...](http://www.newegg.com/Product/Product.aspx?Item=N82E16856107110)

SSD 64GB ($62 sandisk) [http://www.newegg.com/Product/Product.aspx?Item=9SIA4UB22Z51...](http://www.newegg.com/Product/Product.aspx?Item=9SIA4UB22Z5185)

4GB RAM (no ECC) ($38 gskill) [http://www.newegg.com/Product/Product.aspx?Item=N82E16820231...](http://www.newegg.com/Product/Product.aspx?Item=N82E16820231265)

So, $315 and ~15W max. I bet this could serve a small office well. Someone should get this down to $200 with minimal specs (and no video or audio).

It has dual Realtek NICs; it runs pfsense and openVPN well, and you can also run squid and snort if you're into it (I haven't learned how to use them yet, but I plan to).

</comment></comment></comment></comment><comment><USER14> would be interesting to know if this odroid is better or worse than a device like Cubox[1] and CuboxTV[2]. They are more expensive but they include case, power supply etc..

[1] [http://www.solid-run.com/products/cubox-i-mini- computer/](http://www.solid-run.com/products/cubox-i-mini-computer/) [2] [http://www.solid-run.com/cuboxtv/](http://www.solid-run.com/cuboxtv/)

</comment><comment><USER15> I heard something, that the software (hardware drivers and other things) support for these not so much sold devices is sparse. Does anybody know more? I guess, they ported some Linux on it, but how about media server software (like XBMC/Kodi) and other stuff??

<comment><USER16> I have the Odroid XU3 (which I think runs the same version of their Ubuntu). XBMC/Kodi runs on it, but I get a crash intermittently when fast forwarding a movie. VLC works perfectly. Chromium and Firefox runs superbly. I was unable to get Flash working so Amazon Instant Video and HBOGo don't work. Wireless with the $8 usb dongle they sell works perfectly.

<comment><USER17> Have you tried the pepper flash player?

[http://forum.odroid.com/viewtopic.php?f=8&t=2374](http://forum.odroid.com/viewtopic.php?f=8&t=2374)

</comment></comment></comment><comment><USER4> This looks pretty cool. How well documented is its GPU?

The Raspberry Pi folks managed to pry documentation out of Broadcom [http://www.broadcom.com/docs/support/videocore/VideoCoreIV-A...](http://www.broadcom.com/docs/support/videocore/VideoCoreIV- AG100-R.pdf), with an FFT example included in the standard distro [https://github.com/raspberrypi/userland/blob/master/host_app...](https://github.com/raspberrypi/userland/blob/master/host_applications/linux/apps/hello_pi/hello_fft/gpu_fft.txt), resulting in porting the Deep Belief image-recognition SDK to that GPU [http://www.raspberrypi.org/more-qpu-magic-from-pete- warden/](http://www.raspberrypi.org/more-qpu-magic-from-pete-warden/) and SHA-256 [http://rpiplayground.wordpress.com/2014/05/03/hacking-the- gp...](http://rpiplayground.wordpress.com/2014/05/03/hacking-the-gpu-for-fun- and-profit-pt-1/)

I'd love to be able to do that kind of thing on the ODROID-C1, especially since its GPU sounds like it's a lot faster! I see that they're designed by ARM rather than Broadcom, and there's a reverse-engineering effort that has produced something of a GL implementation on them [http://limadriver.org/](http://limadriver.org/) that has Quake 3 Arena running on it already, and faster than the binary driver, but not yet playable [https://libv.livejournal.com/23886.html;](https://libv.livejournal.com/23886.html;) but that effort seems to have stalled last year. But it sounds like it was, at the time, limited to working from reverse engineering rather than official documentation [https://archive.fosdem.org/2013/schedule/event/operating_sys...](https://archive.fosdem.org/2013/schedule/event/operating_systems_open_arm_gpu/), and while ARM has a lot of development documentation on their Mali site [http://malideveloper.arm.com/develop-for-mali/sample- code/](http://malideveloper.arm.com/develop-for-mali/sample-code/), none of it seems to be for the GPU itself, but rather for the OpenGL ES implementation they've written for it.

So what's the deal? Is the GPU really actually totally undocumented officially, with the only available information being a dead open-source project that produced a half-complete free-software OpenGL implementation for it by reverse engineering? Or is there more stuff out there I'm missing?

(In any case, it's pretty incredible that in 2014 you can already buy an 8-processor single-board computer that you can program for US$35.)

<comment><USER18> I have the Odroid-U3 which is similar enough.

It's amazing running Android. The drivers are all there and it can do 1080p playback no worries. Netflix for Android runs perfectly. So does every emulator going from the N64 generation back. Easily the best box short of a media PC to connect to your TV at the moment.

It's not as good with standard Linux. The graphics drivers aren't there at all. 1080p playback doesn't really work. Example link you can read up on yourself- [http://forum.odroid.com/viewtopic.php?f=83&t=3214](http://forum.odroid.com/viewtopic.php?f=83&t=3214)

<comment><USER4> I think you may have replied to the wrong comment, since what you said has nothing at all to do with what I was asking or saying in the comment of mine to which you attached it.

</comment></comment></comment><comment><USER19> The SoC seems to be Cortex-A5, while many of the other boards around are Cortex-A9. Looking at the comparison between those two types, that might have been one of the trade-off made, as the A5 is targeting the lower end devices, and has less performance than a same clock rate/core count A9.

It's not necessarily bad, but good to know for better comparison.

</comment><comment><USER20> If anyone else is interested, it sounds like HDMI-CEC should be working within the next week or so.

[http://forum.odroid.com/viewtopic.php?f=61&t=7479#p58825](http://forum.odroid.com/viewtopic.php?f=61&t=7479#p58825)

</comment><comment><USER21> How does it perform for Computer Vision/ Image Processing tasks? Couldn't find anything mentioning openCL or anything of the sort

<comment><USER22> No OpenCL for Mali 450.

</comment></comment><comment><USER23> With lots of 64bit ARM chips coming to the market in the near future, I would wait just a little bit more.

<comment><USER24> This board only has 1GB RAM and no support for fast secondary storage (only USB2) so having 64bit address space would provide little benefit.

<comment><USER6> I'm sure there are other advantages to AArch64, like a larger set of registers, that could still make it worthwhile. At the very least it might push down the prices on the old armv7 CPUs.

<comment><USER25> The native AES encryption instruction set on AArch64 might also be really useful if you do any kind of encryption.

</comment></comment></comment></comment><comment><USER26> Is it possible to buy a tablet display without the actual tablet computer? I want something inexpensive and lightweight and efficient to pair with this for display and a regular lcd monitor isn't that.

<comment><USER27> This might be what you're looking for: [http://hardkernel.com/main/products/prdt_info.php?g_code=G14...](http://hardkernel.com/main/products/prdt_info.php?g_code=G140383714860)

<comment><USER26> Ok yes that's it except I just bought a quad core tablet and it only cost like $150 so the screen by itself should not be $120. I mean you can buy tablets for $50..

Heres one for around $50 [http://www.buydisplay.com/default/7-hdmi-lcd-module- display-...](http://www.buydisplay.com/default/7-hdmi-lcd-module-display- touchscreen-vga-video-driver-board)

</comment></comment></comment><comment><USER28> what display outputs does it have? I didn't see any in the summary, which makes this a different market than the raspberry pi

<comment><USER29> 1.5 GHz Quad core and 1Gb RAM not enough difference?

<comment><USER30> and a 3D hardware acceleration... this thing is so cool.

For $35 you can get a really decent computer. Makes it really viable for people to run a small unix dev machine or buy a bunch of these to run a miniature server farm.

<comment><USER31> I'm thinking of upgrading my Pi cluster ([http://github.com/rcarmo/raspi- cluster](http://github.com/rcarmo/raspi-cluster)) to a set of these boards. Mostly waiting for some benchmarks to come in and the holiday season to go away...

<comment><USER32> Why? The point of your "cluster" is clearly not performance.

<comment><USER33> Its a cheap way of running a home lab to experiment with clusters

</comment></comment></comment></comment></comment></comment><comment><USER34> form factor is clever, should be a drop in replacement for most people's pi cases too!

[http://linuxgizmos.com/35-dollar-quad-core-hacker-sbc- offers...](http://linuxgizmos.com/35-dollar-quad-core-hacker-sbc-offers-rpi- like-expansion/)

<comment><USER31> The power socket is on the side, and the HDMI connector is now a micro. There will be some adjustment required...

<comment><USER35> I have a RPi B+ case from ModMyPi that is fantastic, I bet they'd be willing to modify it for the ODROID-C1 if enough people asked.

</comment></comment></comment><comment><USER36> Curious about the power consumption.

<comment><USER15> In some other news, I read something about ~2x that of a Raspberry, I think it was about 0,5A. That seems to me a fair deal for much more speed.

Also you get a 1GBit Ethernet port, I think Raspberry has only 100MBit/s.

<comment><USER37> With that chip you should get around 2.5x faster single-thread performance (mostly due to the higher clock speed), and 3 more cores inside as well.

<comment><USER15> Yes, the higher performance is rather appealing. Of course one of the reasons for the success of the raspberries is the low energy consumption, but sometimes it is just to slow. A little reserve really would be good for media centers or also if you want to have a small server solution.

Of course best would be some device with low power consumption when less work is to do and which can go to full power if needed. Multiple cores would be good for that, if the device could deactivate unneeded cores or even reduce the clock speed.

I am looking forward for more power saving devices, since servers which run all the day should consume less than today.

<comment><USER36> There might be opportunity for lower energy, speculating if the SoC has better dynamic power abilities, and even without it, can finish it's work earlier and go back to deep sleep longer.

</comment></comment></comment></comment></comment><comment><USER38> Can these be netbooted, thus, not needing an SD or eMMC card at all?

</comment><comment><USER21> has anyone tried running openCV on this thing?</comment>


Btc.com launches recovery tool to get your "trapped" Bitcoin cash - <AUTHOR> https://cointelegraph.com/news/btccom-launches-recovery-tool-to-get-your-trapped-bitcoin-cash <comment><USER2> Regardless of what they did; you just need to give them props for still sticking around after all of this. They have always been shady, but they have also always been loyal.</comment>


Facebook and Instagram Are Down - <AUTHOR> https://facebook.com <comment><USER2> Also GitHub is down (cannot use the website nor push to my repos)

</comment><comment><USER3> They are still up in the UK.</comment>


Early antibiotic use 'may predispose children to weight gain and asthma' - <AUTHOR> http://www.theguardian.com/society/2016/jan/26/early-antibiotic-use-may-predispose-children-to-weight-gain-and-asthma <comment><USER2> I wish it were easier to avoid their use, but without antibiotics my kids would spend like half the year with ear infections, miserable (and making everyone else miserable) and lethargic at best. Then there's strep—last year I discovered the hard way how dangerous that can be if you don't treat that _very_ soon after symptoms start (I'd never had it, didn't realize what was happening/how serious it was at first)

<comment><USER3> I had strep every year around the holidays as a kid. It's a common, and easily treatable infection, but extremely dangerous left alone. It can go from bad to really bad, quickly, especially when it travels to the heart.

<comment><USER4> The danger to the heart is believed to be from the immune response to the strep, not the infection directly.

[http://www.mayoclinic.org/diseases-conditions/rheumatic- feve...](http://www.mayoclinic.org/diseases-conditions/rheumatic- fever/basics/causes/con-20031399)

<comment><USER3> Symptoms are the bodies response to infection. Regardless of what happens, because strep is present, then it occurs.

<comment><USER4> The point of my comment was that the infection does not travel to the heart. The immune response to the infection in the throat ends up having consequences elsewhere.

</comment></comment></comment></comment></comment><comment><USER5> I've noticed that if I am very sick, even with antibiotics, I don't start getting better until 5+ days after first dose. Wondering what my body would naturally do with those five days, I've basically stopped going to the doc and just fight it off myself.

Really haven't noticed a difference. I'm talking stuff like ear pain, pink eye, severe sinus pain, ect. Don't know what I've had (since I didn't go to the doc, though I don't think they know half the time anyway..), but I survived it.

I'm sure there are valid reasons for antibiotics, but they are clearly over prescribed.

<comment><USER3> You're an outlier then. Within twenty-four hours of taking an antibiotic, I've always felt MUCH better. I will agree they are over prescribed, especially for things that don't even respond to antibiotics(viruses). But there is no denying their effectiveness.

<comment><USER6> How do you know he's the outlier?

<comment><USER7> Occam's razor. Antibiotics aren't over-prescribed/over-used just for giggles. It's because when they're actually necessary, they usually improve one's health quite quickly.

</comment></comment></comment></comment><comment><USER8> Whenever you read the word "may" in the title of an article about a scientific study, you should mentally fill in the end..."then again, it may not"

<comment><USER9> Unbelievable.

</comment></comment><comment><USER10> I wonder if there's a correlation between kids with asthma/weight gain and pre-labor antibiotics given to the mother to control Group B strep.

That seems like it could be the sort of study that could be done based on a medical records search, as the data should be recorded. (not that it's easy to get the data...)

</comment><comment><USER11> Antibiotics were first discovered around WW2. Use of antibiotics was rampant in early years (it's come down since then, but is still excessive).

Why do we see a rise in obesity only in the last 20-30 years?

<comment><USER12> One of my pet theories is that is has to do with the decline in cigarette smoking.

</comment></comment><comment><USER13> It's funny, I've seen this before and my experience is the exact opposite. I've got 2 kids that were on what feels like a million antibiotics when they were young, one's thin, one's average. I've got a 3rd kid was NEVER on them at all, he's obese. I know this and other studies are population averages and all that, but it always surprises me when my experience is the exact opposite. Something to do with what gut microbes were killed or something?

</comment><comment><USER14> Killing gut microbes considered harmful...

<comment><USER15> What?

<comment><USER14> I think a lot of people are suggesting these days that interfering with gut biome with things such as anti biotics can have far reaching effects on the rest of your system.

Maybe you don't agree with this but I think there is research suggesting, for example, having the wrong gut bacteria can make you more likely to be over weight, be a factor heart disease and even diseases like Alzheimer's are implicated.

<comment><USER16> Even depression. If you read about candida or yeast overgrowth, it is believed to cause some kind of inflammation which might be linked to depression.

<comment><USER17> Careful though. There is a lot of pseudoscience and quackery around candida and yeast.

</comment></comment></comment></comment></comment><comment><USER18> It's an interesting hypothesis but unfortunately a cohort study with no randomized control and n=236 isn't really meaningful. There's no control at all here and the sample size is _tiny_.

<comment><USER19> 236 is a massieve sample size and it is more than sufficient for showing an effect here. The p-values are below 0.001, and while p-values aren't everything, it's a strong indicator that the result is statistically significant.

<comment><USER18> Sure, the correlation is statistically significant. Without a control to infer causality the results become much less interesting.

To infer causality in an epidemiological study such as this you need very large cohorts with very specific results.

Even with huge cohorts you still have relatively indefensible results. The 7 country study is a good example: [https://en.wikipedia.org/wiki/Seven_Countries_Study](https://en.wikipedia.org/wiki/Seven_Countries_Study)

<comment><USER20> Particularly since one of the connections they postulate is between antibiotics and asthma, I'm curious how they control for respiratory infections which seems like a much more likely common cause.

</comment></comment></comment></comment><comment><USER21> Interesting article and it is a coincidence in my life. My wife is pregnant and has been diagnosed with Group B strep and the dr has said she will be given Ampicillin during labor. I have some concerns regarding this, and now I read this article.

Dr says that there is 1 in 1000 chances of the baby getting (very) sick. With the antibiotics the chances are 1 in 4000.

I am wondering if anyone here has had experience with this.

<comment><USER22> Ped doc here. Group B strep can cause severe sepsis in neonates and I would definitely recommend that she get 1-2 doses of an antibiotic while in labor. I have not seen any good evidence that this sort of treatment causes any problems down the road for the baby. Furthermore, if you consider the mechanism that this paper suggests, it involves the manipulation of gut flora. A neonate's GI tract is sterile when it comes into the world, and is colonized over the first months to years of life. So since there are no bacteria to affect, this proposed mechanism should have no relevance. Also, Amp's half- life is just a few hours so no long-lasting presence in your baby. Don't mess with group B strep--before we understood how to deal with it, it made a lot of babies very sick and many died.

</comment></comment><comment><USER23> Good, that the usage of antibiotics is rising in cattle-breeding.

The blind usage of the fruits of progress is one of our biggest problems in a world, where many problems of human beings have relieved by the same.</comment>


Tonight Jupiter making closest approach in nearly 50 years - <AUTHOR> http://hosted.ap.org/dynamic/stories/U/US_SCI_JUPITERS_APPROACH?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2010-09-17-18-14-25

<comment><USER2> These always seem a little overblown. Jupiter was very nearly as bright last year.

[http://www.wolframalpha.com/input/?i=magnitude+of+jupiter+se...](http://www.wolframalpha.com/input/?i=magnitude+of+jupiter+september+20th+2010)

-2.92

[http://www.wolframalpha.com/input/?i=magnitude+of+jupiter+au...](http://www.wolframalpha.com/input/?i=magnitude+of+jupiter+august+15++2009)

-2.86

So the ratio in brightness is

2.512 ^ 0.06 = 1.0567

If wolfram alpha is to be believed, it's going to be just about as bright next year.

[http://www.wolframalpha.com/input/?i=magnitude+of+jupiter+oc...](http://www.wolframalpha.com/input/?i=magnitude+of+jupiter+october+15++2011)

<comment><USER3> The distance to Jupiter varies between very far and very, very far.

</comment></comment><comment><USER4> The article states "Around midnight, it will be directly overhead." This depends where you are, and it will not be true for most humanoids. From Washington, DC, for instance, it will be 45 degrees up from the horizon at midnight: [http://www.wolframalpha.com/input/?i=jupiter+sky+position+fr...](http://www.wolframalpha.com/input/?i=jupiter+sky+position+from+washington+at+12:00am)

From Oslo, Norway, a little under 9 degrees: [http://www.wolframalpha.com/input/?i=jupiter+sky+position+fr...](http://www.wolframalpha.com/input/?i=jupiter+sky+position+from+oslo+at+12:00am)

<comment><USER3> If it's directly overhead on midnight (over the equator), it must be a Sun- Earth-Jupiter alignment, which makes sense as it is the closest distance between both planets in the Earth year.

</comment></comment><comment><USER5> When I was a kid in the 70s, I could distinguish a moon of Jupiter as a separate blip with my naked eye.

<comment><USER6> Really? That seems unlikely. Very few people have ever made such a claim, though it does seem that it could be possible.

<http://www.denisdutton.com/jupiter_moons.htm>

<comment><USER5> Yeah, I get lots of people saying that. All I can say is, I was there, I could see it, my brothers and sisters could see it.

We used a telescope to spot, then when the moon was at its furthest distance, with the naked eye, could see a separate blip.

Lived on a farm in Iowa, nobody for miles, no lights to mess things up.

<comment><USER5> You know, what bugs me is, people talk and talk about this, write articles and posts, but nobody GOES OUTSIDE AND LOOKS! You think writing an article about it would be worth investing in an afternoon driving out of town to where it gets dark, tilting your head up at the sky, and squinting. But no, decades go by with no new info on the topic, people just repeating what amount to urban legends.

</comment></comment></comment></comment><comment><USER7> This reminds me of an incident on Friday night: I noticed an unusually bright planet in the sky, and checked it out with Google Night Sky on my Android phone. When I zoomed in, the software showed the disc of Jupiter _overlapping_ with Uranus. I sure was amazed!

I checked now, and the planet conjunction list at [http://en.wikipedia.org/wiki/Conjunction_%28astronomy_and_as...](http://en.wikipedia.org/wiki/Conjunction_%28astronomy_and_astrology%29) indicates that this conjunction has happened several times recently, but won't be happening for a while now.

</comment><comment><AUTHOR> Checkout my Palo Alto viewing party using my company's event creation service: <http://poig.com/pings/4c9798d0d4ac14411c00001f/>

I'll be at Arastradero Preserve in the Palo Alto Hills tonight around 11PM with a telescope and some buddies. Exit off Page Mill from 280 and head west towards the hills. Take a RIGHT on Arastradero and drive up about a mile and take a right into the parking lot.

WE WILL HAVE A LIMITED SUPPLY OF SIMPLER TIMES BEER

<comment><USER8> Here's a case where I want to look at what you've posted, and I can't because you want me to login via Facebook first.

Anyway, have a great time, and I hope the vis is terrific.

<comment><AUTHOR> I know! I'm going to have to do some tinkering to make the links public

</comment></comment></comment><comment><USER9> Is there a good iPhone app that uses both the GPS and the Compass to do star finding and identification?

<comment><AUTHOR> I'm using Planets, apparently it has 3 mil downloads and it's free

<comment><USER9> Installed... Thanks

</comment></comment></comment><comment><USER10> Thank you. There is a NASA app for iPad that could be useful as a learning aid.

</comment><comment><USER11> In NYC it will appear as a stalled airplane between clouds.

</comment><comment><USER12> And of course it is completely overcast here :(

</comment><comment><USER13> More info: <http://en.wikipedia.org/wiki/Jupiter>

<comment><USER14> Thanks, even more info here: <http://en.wikipedia.org/></comment></comment>


The World's Most Innovative Companies - <AUTHOR> http://www.forbes.com/innovative-companies/list/

<comment><USER2> This list should really be named "The World's Most Overvalued Companies", since the metric they use for "Innovative" is how highly the company's stock is valued relative to revenue: [http://www.forbes.com/sites/innovatorsdna/2013/08/14/how- we-...](http://www.forbes.com/sites/innovatorsdna/2013/08/14/how-we-rank-the- worlds-most-innovative-companies-2013/)

<comment><AUTHOR> OP here. I just found it hugely hilarious that Salesforce was rated #1 :)</comment></comment>


Geologist predicts EPA toxic mine disaster in Colorado - <AUTHOR> http://www.silvertonstandard.com/news.php?id=847

<comment><USER2> It seems the geologist even underestimated the disaster He was advising residents to check their water at the time so they could compare it later for contamination. Instead of a hidden change in water parameters, we got a river that looks like carrot juice.

<comment><USER3> The water could have become dangerous before the river changed color?

<comment><USER2> I just assumed that from the geologist advising people to test their water so they would have a baseline - so they would be able to make claims later. Obviously there's no need for such proof now.</comment></comment></comment>


Evaluating the Rescue of Fannie Mae and Freddie Mac - <AUTHOR> http://libertystreeteconomics.newyorkfed.org/2015/10/evaluating-the-rescue-of-fannie-mae-and-freddie-mac.html#.Vh_RsRNViko <comment><USER2> _The many legislative proposals to date all reflect the crosscurrents of trying to protect the taxpayer, preserve support for the thirty-year fixed- rate mortgage, and keep homeownership affordable to a wide spectrum of borrowers._

It seems to me that making housing affordable is a better goal than making home ownership affordable.

Any program targeted at home ownership should at least be benchmarked to actual ownership and not nominal debt based ownership. So for example, a policy that results in twice as many people taking out home mortgages but fewer people owning more than 50% of the equity in their homes isn't encouraging ownership, it's encouraging mortgage taking.

</comment><comment><USER3> _The conservatorships have also strikingly failed in relation to our fifth and final objective of producing long-term mortgage finance reform. As Treasury Secretary Henry Paulson wrote, "We described conservatorship as essentially a 'time out,' or a temporary holding period, while the government decided how to restructure the [government-sponsored enterprises]." However, starting the conservatorships turned out to be easier than ending them, and the "time out" has now stretched beyond its seventh year with no clear path to reform._

What did the government expect? It's not like Fannie and Freddie are going to ask to be released from conservatorship and re-assume the risk that they are currently sharing with taxpayers. TARP, QE, bailouts, nationalization, and government conservatorships were all designed with the aim of preserving the status quo and keeping the system running on pre-recession paradigms. None of the organizations that benefit are going to voluntarily relinquish access to these crutches.

Releasing the two GSE's would be a great test to see if the Fed and government's plan for reform and economic stability has really been effective.

<comment><USER4> > None of the organizations that benefit are going to voluntarily relinquish > access to these crutches

Except of course that that's exactly what most of them did. By taking preferred stock the treasury gave the banks an incentive to buy back the shares and make the treasury a bit of money on the side. Much better than the UK government buying common stock and being stuck with it till they sell at a loss (as they're doing now).

My understanding of the GSEs is that they're still haggling over precisely what form they ought to take in the brave new world i.e. it's not particularly that they want to be state run.

<comment><USER3> For the banks, the real crutch is the mental/precedence crutch of - buy back your equity and go back to running things as normal, and if the system fails we'll bail you out through nationalization yet again, so for now you can continue to operate under the taxpayer-shared-risk assumption.

Using preferred stock was intelligent design in a micro level, but at a macro level the incentives and risk/reward profile constructed by the bailouts and liquidity injections is completely perverse.

</comment></comment></comment><comment><USER5> As a programmer, I think it's better to just "Let it crash". The reasons that they left are so high level, they are meaningless. This is a 10 paragraph article on an evaluation of the global economy. How was this published with any degree of sincerity?

<comment><USER6> That presumes there are no consequences to "let it crash".

A programmer for a respiration system software would not necessarily "let it crash", as this could kill someone.

The same applies for institutions that back the global economy. Letting Freddie and Fannie crash meant that $5 trillion in mortgage-backed securities would evaporate. That would trigger a global depression on par with an asteroid crash or super volcano eruption.

"The reasons that they left are so high level, they are meaningless."

The article is pretty concrete as to its summary of the situation with the GSEs, and ended with a conclusion (with backing paper link) that they should be replaced by a private system. I'm not sure what more you'd want?

"How was this published with any degree of sincerity?"

I have the same question for your post. You come across as "I don't understand it, therefore it must be wrong/insincere". Could it be possible that they have an idea what they're doing, and you are not the target audience for this article?</comment></comment>


Fuzed+EC2 Screencast: Instant Capacity - <AUTHOR> http://jointheconversation.org/2008/06/06/fuzed-and-ec2/

<comment><USER2> Hi, Tom Preston-Werner here, one of the fuzed developers. Keep in mind that Scott is running Rails in development mode. We'll be doing more experiments with EC2 and production Rails to see what kind of numbers we can push with that setup, and also what kind of performance we can do for static assets. We'll put our results into the Readme once we have some solid, repeatable statistics for you.

</comment><comment><USER3> Yeah, but can it automagically scale my database layer for me?

<comment><USER2> No, Fuzed does nothing to help with database scaling. If you're going to scale big you'll need to deal with that separately. We hope that Fuzed will free up your time to deal with those interesting DB scaling issues!

</comment></comment><comment><USER4> Great video demonstrating the scale up. I wish more devs would throw together a rough video, often it's easier than trying to parse a wall-of-text.

</comment><comment><USER5> I'll play with databases and a more realistic, cached, hardened Rails app next. If anyone wants to help pay my EC2 bills, I'll do even more :)</comment>


Ask HN: AWS or Azure for HIPAA compliant web form? - <AUTHOR> I need a basic HIPAA compliant web form for a medical office.
I'm looking at setting up a server on AWS or Azure that will host the form. I will use use an iframe to add the form the practice's website that will be hosted on a Digital Ocean droplet.
The Azure/AWS server won't store any data but it will be transferring it to a HIPAA compliant email address (office 365 email address).
I'm somewhat confused on what the best route to take is. I was thinking about building the form on a low resource vm to reduce cost as much as possible. If a simple vm server is all I need, are there any benefits to using AWS or Azure in terms of being HIPAA compliant? In other words, does either platform make it easier to be HIPAA compliant? <comment><USER2> Neither. There simply isn't a way to do "basic HIPAA" in either. You basically need to fully commit to being HIPAA compliant if you go directly with a service.

At Carol Health, we use a provider called Healthcare Blocks to manage a HIPAA compliant environment in AWS. They take care of most of the infrastructure compliance. While, we take care of the application side. Datica and Aptible are direct alternatives to Healthcare Blocks.

Those options would give you a more traditional hosting route. You could also use a services like True Vault. It's kind of like Stripe for HIPAA data. All of the HIPAA-sensitive data is communicated directly to TrueVault. Your server then deals with non-PHI data.

<comment><AUTHOR> Thanks for the help, I appreciate it.

> You basically need to fully commit to being HIPAA compliant if you go > directly with a service.

Do you mind explaining that a little more? Are there specific actions that need to be taken in order to be HIPAA compliant if no data is being saved on the server?</comment></comment>


Thoughts on Keybase.io - <AUTHOR> http://blog.lrdesign.com/2014/03/thoughts-on-keybase-io/ <comment><USER2> The author may have some points; I have not inspected the protocols or the source completely, but the arguments made in the post are misleading and inaccurate descriptions of keybase. Seems like there may be some subtle yet festering bias.

1\. They are not "rolling their own" crypto. keybase seems to be an interesting wrapper around gpg that helps you establish links between accounts using "proofs of knowledge of secret keys." I haven't tried the service yet; but one can inspect the code:

npm install -g keybase-installer

keybase-installer

grep gpg ~/.npm/keybase/0.0.43/package/lib/*.js

2\. "Keybase's pitch is that rather than use a web of trust..."

It is not mutually exclusive. Since you have it installed, try

keybase -h

keybase track <id>

That seems to subsume web-of-trust

"limits on that identification are two-fold...<security of twitter>...and...<soundness of tweeting>"

So it is actually the same argument repeated. The first 3 Mission Impossible movies also demonstrate that when you meet someone in person, they might be Ethan Hunt instead of the person you think they are. For the paranoid, there are out-of-band mechanisms around this (that can also be used with keybase). Even without those, keybase is an out-of-the-box mechanism for linking identities that is weakly sound over the Internet.

3\. "...doing this right" One of the founders, Max Krohn, was at RealWorldCrypto this year. He is an MIT phd and he certainly knows quite a bit about applied crypto. He is also a systems person and comfortable making tradeoffs between usability and security.

If keybase allows 1m more people to easily create and use keys, even if their day-to-day workflow is not secure-against-state-adversaries, that would be progress.

</comment><comment><USER3> "A public directory of publicly auditable keys? Allow me to introduce PKS (an example server) - a decentralized system for distributing public keys."

In my opinion that thought process is exactly what's wrong right now.

Just compare the two interfaces [1] and [2] and you'll see why why your average person won't be happy to use the pgp.mit.edu keyserver to verify identifies. It's cluttered, complicated and the presentation once you searched for a name is subpar. I'm not saying that keybase is the best way to do it but it's a good start to make the existing tools (Like the webinterface of pgp.mit.edu) prettier and easier to use.

[1] [http://pgp.mit.edu/](http://pgp.mit.edu/) [2] [https://keybase.io/](https://keybase.io/) (search field in the header)

<comment><USER4> Many clients do the PKS search for you. Using the website is always going to be suboptimal, you have to copy keys around. Way better to let your client of choice do it.

</comment></comment><comment><USER5> Unfortunately I think this particular review is missing the point of Keybase. In the same vein as attacking Twitter for not making the follow relationship symmetric or attacking Instagram for ruining the dynamic range of pictures, this author is (mostly) attacking Keybase for the very point of what Keybase is.

PGP has failed to reach even a moderate userbase outside of crypto enthusiasts, and while part of this, as the author suggests, is painful UI, a large part is also that the web of trust model is unreasonably demanding for most cases.

Keybase asks: who are you on the internet if not the sum of your public identities? The fact that those identities all make a certain claim is a proof of trust. In fact, for someone who knows me only online, it's likely the best kind of trust possible. If you meet me in person and I say "I'm sgentle", that's a weaker proof than if I post a comment from this account. Ratchet that up to include my Twitter, Facebook, GitHub, personal website and so forth, and you're looking at a pretty solid claim.

And if you're thinking "but A Scary Adversary could compromise all those services and Keybase itself", consider that an adversary with that much power would also probably have the resources to compromise highly-connected nodes in the web of trust, compromise PKS servers, and falsify real-world identity documents.

I think absolutism in security is counterproductive. Keybase is definitionally less secure than, say, meeting in person _and_ checking that the person has access to all the accounts you expect, which is itself less secure than all of the above _and_ using several forms of biometric identification to rule out what is known as the Face/Off attack.

The fight isn't "people use Keybase" vs "people go to key-signing parties", the fight is "people use Keybase" vs "fuck it crypto is too hard". Those who need the level of security provided by in-person key exchanges still have that option available to them. In fact, it would be nice to see PKS as one of the identity proof backends. But for practical purposes, anything that raises the crypto floor is going to do a lot more good than dickering with the ceiling.

And I don't buy the "don't reinvent crypto" argument at all. Sure, it's a bad idea to use your own password hash instead of bcrypt, but maybe you think you can do better and you end up creating the foundation for Litecoin. A general- case argument against any innovation is a dangerous thing.

With that said, I totally agree about uploading your private key to Keybase. That's one very scary basket to put all your eggs in and I don't trust it at all. Luckily, it's optional.

<comment><USER6> I think the issue is not so much that a scary adversary could simultaneously hack Twitter, GitHub, etc - that seems hard. The real problem is that all these services will, in the default configuration (no 2-factor auth), perform password resets via your email account. Thus if you succeed in hacking someone's mail account you can take control of their other accounts and go ahead and verify a new keybase profile. Unfortunately there's no way to know externally if someone uses 2-factor, so it's hard to judge how meaningful a Keybase profile really is.

The mitigating factors here are:

1) Most "good" services at least those used by the tech geek community do support 2SV these days, which would raise the bar somewhat for people who use it, although I suspect several of those services will still unlock 2SV for you if you say you lost your second factor and know enough about the account (Google does).

2) Someone would obviously notice that their passwords had all been reset and could sound the alarm.

But in practice, I think this feels like not much different to just verifying ownership of an email address, which is what CA's already do (and there are PGP CA's if you don't want to use X.509). Comodo will do it for free, it's integrated with the browser via the HTML5 keygen tag, and it takes just a couple of minutes.

<comment><USER7> Also, the age of the tweet or gist would be a red flag. If the signed gist is 2 years old and hasn't even modified since, you can pretty safely assume that if the keybase public key matches the signed message in the gist, nothing nefarious has happened recently.

</comment></comment></comment><comment><USER7> I agree with the OP about uploading private keys being bad, but you don't have to do that – everything works without doing that as long as you are comfortable in the command line. Whether or not uploading private keys should be an option is a good question (I think they probably should not be uploaded ever), but the site is still early beta so they should be given time to work this out without getting thrown under the bus quite yet.

I disagree that the existing public key repositories are what people should be using and that the twitter/github integration is pointless. In today's world, we often want to communicate with people we have never met in person. An old tweet or a gist that hasn't changes in a long time seems like a pretty safe way of verifying someone's identity. Apart from the NSA[^1], it's hard to imagine a situation where both keybase was compromised with a bad public key, and twitter/github was compromised by invisibly changing an old tweet (not possible to edit without a big hack) or a gist (not possible to edit without creating a change history within a big hack). So this makes a lot of sense to me as a way to easily verify identity.

[^1]: At this point I'm not sure I would trust any encrypted online communication if the NSA wanted to read it.

</comment><comment><USER8> I agree that the Twitter integration doesn't seem enormously useful. However the GitHub integration seems to be somewhat useful for code signing at the very least.

Knowing that the binary or tarball you got was created by the account you are trusting to have actually written it isn't perfect, but it's pretty good for a lot of situations.

</comment><comment><USER9> There are a few funny things about keybase. First, should they even make it an option to give them your private key? I believe they should not.

The thing this doesn't solve is it opens the door for new attacks. What happens if I make a page identical to twitter on twtr.com, that shows a keybase user verifying a fake public key. Keybase could easily accomplish this and this attack isn't that different than other attacks we have seen on the web.

In my opinion...keybase doesn't buy you any new level of security...it's just supposed to be a user friendly way to distribute keys, even though you still have to do the work of verifying them yourself.

</comment><comment><USER10> Honest question: can somebody explain what problem Keybase addresses?</comment>