XSS vulnerability found in Github - <AUTHOR> https://github.com/Stuk/hackgh

<comment><USER2> This might look really funny, but consider this: The javascript you are executing there runs on the github domain. So it can do whatever you can do by manually clicking.

The injected script could for example submit a new SSH public key for your account (doesn't require your password again). Or just be funny and delete repos. Or just upgrading your account to a bigger, more expensive plan.

Or they could get a list of your private repositories. Combine that with the upload of a new private key and you'll get free access to proprietary code of any account.

Aside of fixing the XSS issue, they really should ask for the password again when uploading a public key.

</comment><comment><USER3> Seems to be fixed now.

Quick work by the github guys, kudos.

For those who missed it, the title attribute inside commit messages in the file list wasn't HTML encoded.

<comment> mike-cardwell They should be able to look at their database to determine if anyone else has has used this method to inject arbitrary html into a page in the past.

They should then put up a notice on their website to describe what happened, describe how they confirmed that this flaw hasn't been exploited previously, and describe what measures they will take in future to prevent this sort of problem.

In my opinion, that is how a "good", company would react. Anything less would be a disappointment.

<comment><USER4>
         |In my opinion, that is how a "good", company would react.

This is (more or less) how Github has reacted to security issues in the past. However, at the moment this seems to be a fairly small exploit, that wasn't aggressively used by any would-be exploiters. I definitely don't think github should put up a notice for this.

Would you really want to be alerted every time a website you used closed a minor security hole, that had possibly never even affected anyone? They absolutely should, if any user information was leaked, or if there was downtime involved, but you honestly do not need to keep informing users about this sort of mundane security update. At best, I would suggest it go on their blog.

Not reporting "oh we found an xss hole that maybe one or two people had used before." is NOT a disappointment.

<comment><USER5> > that wasn't aggressively used by any would-be exploiters.

Doesn't matter. A response shouldn't be measured according to how widely a security hole was exploited, it should always be responded to with full information and transparency.

</comment></comment></comment></comment><comment> mike-cardwell Didn't work for me. Then I remembered to tell noscript to enable js. Does anyone still need convincing that they should be using noscript?

<comment><USER6> Noscript uses a sledgehammer to do a scalpel's job. It would be much more widely used if it was a little more subtle, and less noticeable as most browser extensions are. Scorched Earth-like blocking is safe, but it very strongly degrades the web surfing experience. I would much rather they use a heuristics-based approach to warn users when potentially malicious scripts were trying to run, than simply block all scripts. I used it for a couple years, but stopped when I realized how annoying it made my browsing experience.

<comment><USER7> You do realize that NoScript is _not_ "block all scripts", right?

I see so many people criticizing it with no apparent experience or use of it, and this is the primary misconception I see. It is _not_ block all scripts. Why would anyone need an extension for that? You just turn off Javascript in the preferences for that. What it _is_ is a domain-by-domain whitelister.

I can't use Chrome because it doesn't have NoScript, and I end up routinely visiting domains that I didn't even realize have some foreign-loaded script that pops up some crappy survey over the page ("please give us your private info under the guise of providing site feedback we intend to ignore!"), or pops up a flash ad, or who knows what. The web is too irritating to use anymore without it. (And Flashblock.)

Also, NoScripts _does_ have heuristics, but they can't catch already-in-the- page XSS without firing too many false positives. They do have some decent protection against hostile links that have XSS-inducing strings in a query string or something. You can in fact download NoScript and configure it just for that. Personally, I've never had anything but a false positive from that check, but I don't cruise fora where such links are common.

It isn't anywhere near as hard to use as the critics say it is. I know this because I use it on three systems and I don't even bother trying to synchronize the settings somehow; it's more work to synchronize the settings that just use it in all three places.

<comment><USER8> > I can't use Chrome because it doesn't have NoScript, and I end up routinely > visiting domains that I didn't even realize have some foreign-loaded script > that pops up some crappy survey over the page ("please give us your private > info under the guise of providing site feedback we intend to ignore!"), or > pops up a flash ad, or who knows what. The web is too irritating to use > anymore without it. (And Flashblock.)

Have a look at [https://chrome.google.com/extensions/detail/odjhifogjcknibka...](https://chrome.google.com/extensions/detail/odjhifogjcknibkahlpidmdajjpkkcfn) its basically noscript with some restrictions

<comment><USER9> This is unrelated, but how did Google manage to produce such awful URLs? Is this just a base-26 encoded GUID? If so, they could've saved a few characters: [http://www.wolframalpha.com/input/?i=0xED11C880FA5611DDA6040...](http://www.wolframalpha.com/input/?i=0xED11C880FA5611DDA604001EC203A3AD+in+base+26)

Not that this is something you'd want to do in the first place, because it's hideous.

</comment></comment></comment></comment></comment><comment><AUTHOR> Something @chrislloyd and I found in Github. Nothing too serious!

<comment> mike-cardwell A nice POC would have been to write some XSS code which adds your SSH key to a users account if they're logged in when viewing the XSS. I wonder how many HN'ers that would have affected, and git repositories that would have exploited.

I don't think it is an exageration to say that an XSS flaw on something like github has the potential to be disasterous.

<comment><USER10> XSS trivially compromises your cookie. If I have your cookie, I am you. Demonstrating cute ways to do things that I could just do by logging in as you is superfluous.

Even doing that as a prank would cause a Big Red Button security audit at some companies. As in, drop what you're doing, we need to go over every line of every commit in the git repo and verify nothing like a server password was committed. Recommendation #1 from that audit will be to stop using github.

<comment><USER2> you wouldn't get access to the cookie in most browsers. The github session cookie is apparently marked as httponly in which case JS wouldn't see it.

<comment><USER10> I wouldn't trust that, since there are many paths to the cheese besides document.cookie. For example, Firefox (IIRC) will let Javascript inspect all headers from an Ajax request. The cookie is just another string there...

<comment> mike-cardwell Is that actually possible, or are you just pondering that it might be? If Firefox lets you access the raw HTTP Cookie header of a http-only cookie via AJAX, I would consider that a security bug, and report it...

I may take out 10 minutes to have a play with that later if nobody else checks first...

<comment><USER10> I have personal knowledge that it was possible in 2007. I don't keep abreast of developments in browser security that make them _more_ secure: unlike, say, Thomas and the geniuses at Matasano, all I need to know is the worst possible consequence of whatever our wonderful outsourcing partners dreamed up this time. XSS was one step below server-side code execution on our severity scale.

[Edit: This was apparently fixed in 2009 in Firefox. [http://www.mozilla.org/security/announce/2009/mfsa2009-05.ht...](http://www.mozilla.org/security/announce/2009/mfsa2009-05.html) Again, that is just one vector -- I still think HttpOnly is likely insufficient.]

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Not working for me. Is it fixed? I can see only JavaScript. IE8 on Windows XP.

<comment><USER2> mouse over the message in the file list.</comment></comment>


When Jeff Bezos decided not to become a physicist [video] - <AUTHOR> https://www.youtube.com/watch?v=eFnV6EM-wzY <comment><USER2> Also known as: [http://wiki.c2.com/?FeynmanAlgorithm](http://wiki.c2.com/?FeynmanAlgorithm)

In this case, Bezos saw firsthand how a brain teaser could be answered by "seen something similar once before" much more easily than "worked on it on a team for several hours". Isn't this exactly the sort of brain teaser that we hate seeing in tech interviews?

This one was bad enough that Bezos _left the field_ , yet Amazon (like every other software company) still asks these style of questions of its engineering candidates.

<comment><USER3> I love the Feynman Algo. I hold over 60 patents (not bragging) often times colleagues will ask me if I can teach them to be innovative. After being asked this question a number of times and giving it a lot of thought, the answer I give now is the following:

"No, no one can teach you to be innovative or creative, you already are. Humans are the most innovative creatures in the history of this planet, innately, look at all we have created. All you need to do is to un-learn to not be creative. We are all constantly taught, either in school, the military, by our family or by our peers, our company we work for, whatever... to NOT be creative; to in effect comport. First un-learn that. It will unleash your creative/innovative abilities."

Jeff Bezos may not be a physicist but somewhere along his path he learned to stop NOT being innovative.

<comment><USER4> I think what Bezos says in the interview is funny, but also very directly clarifies further what you're saying. The smartest guy at Princeton solved this problem ...

Not because he was actually smart (ok, perhaps a good memory). Not because he was able to do math really fast, or really accurate, or in his head. None of that. NOT EVEN because he figured out this problem on the spot. That was quite simply not it.

But because he had solved a metric fuckton of problems before, and then got lucky.

I agree with your statement (just got one patent to my name though), but a very important caveat is that you have to learn something (and preferably more than 1 thing) thoroughly before unlearning it. And learning first and then unlearning is vastly different from not learning it at all.

<comment><USER5> The guy didn't get lucky, the guy has experience and has worked hard. The same thing happens in software, the developer with extensive experience across many areas, that has studied tons of different things is more likely to solve a novel problem than the developer that is one dimensional and master of one tool.

I often see people say things such as, "I have tons of experience with language Y and framework Z and that's all that matters, who cares about trees, graphs and all that ridiculous interview questions..." The big tech companies are looking to innovate and lead, and that's why they ask these questions.

If someone is new to programming and begins by telling me what framework they are considering learning, I often tell them to forget about the framework and learn the language. The language is the foundation that frameworks are built on. Algorithms & Data structures are the framework on which software is built on.

The only time I frown upon such questions is if someone is testing you for exact syntax of the language instead of making sure you understand the nature and solution of the problem.

<comment><USER6> You pretty much argued the opposite of your point.

Asking algo and whiteboard questions completely ignores the "extensive experience across many years". I can spend years gaining deep expertise in an area, and that means absolutely nothing. All that matters is I practiced for 2 months white boarding algo questions under time pressure.

Or to put it another way. Spent 5 years getting a PhD? Who gives a f*ck. Can you code a DP problem in 20 minutes? You're hired!

<comment><USER7> So you only need to spend 2 months practicing, and yet you refuse to put in the effort ?

<comment><USER8> I am sorry but this is insulting. You should practice what makes you better at your job, not jump through hoops for someone else's entertainment. So yes, some of us, are logical enough to not join the hazing ritual. Just cause you want to do it doesn't mean others should.

<comment><USER7> Just think of it as part of the job. The trade off is minimal, while the benefit is clear. If you still don't want to do it then its cool, less competition for those who want.

<comment><USER6> My point was that the interview process is flawed. It's really just a proxy for an IQ test (a gameable one). I think for a company like Google, it is somewhat understandable - they have very mature processes, strict coding guidelines, and overall very little choice in the tech you use. They are hiring for a "smart cog" rather than "innovative/experienced engineer".

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Everyone is jealous of someone. It is amusing to compare Bezos's awe at Yasantha to that of many of his engineers towards him - or for that matter, my awe of anyone who can pass Amazon's recruitment process.

See this except from a biography of Bezos:

>... To the amazement and irritation of employees, Bezos's criticisms are almost always on target. Bruce Jones, a former Amazon supply chain vice president, describes leading a five-engineer team figuring out ways to make the movement of workers in fulfillment centers more efficient. The group spent nine months on the task, then presented their work to Bezos. "We had beautiful documents, and everyone was really prepared," Jones says. Bezos read the paper, said, "You're all wrong," stood up, and started writing on the whiteboard.

>"He had no background in control theory, no background in operating systems," Jones says. "He only had minimum experience in the distribution centers and never spent weeks and months out on the line." But Bezos laid out his argument on the whiteboard, and "every stinking thing he put down was correct and true," Jones says. "It would be easier to stomach if we could prove he was wrong, but we couldn't. That was a typical interaction with Jeff. He had this unbelievable ability to be incredibly intelligent about things he had nothing to do with, and he was totally ruthless about communicating it."

Yasantha is an interesting fellow, with contributions in wireless networking, AI, chip design and various other fields.

In this article Yasantha describes Bezos's legendary work ethic[1].

>Yasantha described how students once dared each other to complete a computer science assignment in a single line of coding. "Finally, I gave up and did this in 10 or so lines of code," he added, "But I remember Jeff working through all night, in pursuit of the most compact solution, and turned in a two-line solution that was probably the shortest anyone could do…"

>"It goes to prove that Jeff is tenacious, and will not give up like most of us would when presented with a challenge," he said.

>"He sets his goals and sticks to them. I think that's a quality that has made him who he is," Yasantha added.

Think what it meant for someone such as him to give up on his dream to be a theoretical physicist.

Despite his tenaciousness he was forced to conclude there were levels of abstraction he could not reach through hard work.

[1] [http://www.dailynews.lk/2018/09/22/local/163321/lankan- solve...](http://www.dailynews.lk/2018/09/22/local/163321/lankan-solved-math- problem-amazon-founder)

<comment><USER9> I don't want to stroke the Bezos ego more than necessary - but he's not dumb. Geniuses don't get rich by just being geniuses (think of Tesla holed up towards the end in a shitty hotel). What you need is a smart person who can recognize other people can be smarter - and they need help, that you can provide. I mean this without a trace of sarcasm - it's a bit of ego with a bit of humility (whilst ensuring you retain the stock) I've always plugged Bezos into the Edison mold.

<comment><USER10> No need to hedge your praise. Bezos is pretty close to a modern Edison (along with Edison's questionable ethical choices).

</comment></comment></comment><comment><USER11> Reminds me of the story that Paul Allen recounted about Bill Gates going off to Harvard rather pumped up about his abilities relating to math (Gates has said he considered wanting to teach math as a profession when he was in high school) and then realizing he wasn't good enough at it to keep up with the elite math students there. That to keep up with them you'd need to be among the best in the field and even if he was good, he wasn't math-genius level good.

</comment><comment><USER12> It's better to fail fast than to waste 5 years getting a PhD you don't really need. I've had a lot of professors who started out pursuing theoretical physics in grad school, but quickly switched to experimental physics after realizing that they were simply not the right material for theory. I was always surprised to hear it, because I regarded those professors as very bright. It is very humbling.

</comment><comment><USER13> Tangentially, I wonder how the world would be if Jeff Bezos had become a theoretical physicist and hadn't founded Amazon. Perhaps he could've done just good-good instead of good-bad (tilting more and more to the bad side). Would someone else then have founded an Amazon-like company? That seems highly unlikely since even now, nobody else seems close to it on the combination of technology, retail, reach, growth and influence.

</comment><comment><USER14> What a great little story.

I would definetly like to be better at telling stories like this.

When I try to tell stories I always end up on irellevant tangents. That have almost nothing to do with the main point. Or I get stuck in some detail and forget what I was talking about.

<comment><USER15> I agree, he really sells it when he says "Yasantha" starred at the problem. Every sentence is clear and concise. It moves the story without adding anything extra. My story would still be going on — I would have hit on all of the major food groups; DMCA, Freemium model, and Publishing rights.

<comment><USER16> The key to being a good story teller, is telling the same story over and over again, refining it and removing any fluff from the story. This is what separates great comedians from just ok comedians as well. They're telling a story that has been refined in front of an audience to land just right.

</comment></comment></comment><comment><USER17> This is off topic, but are there any physicists working today that are the modern day version of a Feynman, Einstein, Dirac, Wheeler, Bethe, Bohr, etc...?

I've been reading James Gleick's _Genius_ and it was a question I had when reading about 23 year old Richard Feynman.

<comment><USER18> Ed Witten?

[https://en.wikipedia.org/wiki/Edward_Witten](https://en.wikipedia.org/wiki/Edward_Witten)

<comment><USER19> Well, Witten is Einstein/Bohr caliber. Feynman was not.

<comment><USER20> Why do you say that?

</comment></comment></comment></comment><comment><USER21> Looks like that other guy is not a "great theoretical physicist" now either: [https://www.linkedin.com/in/yasantha-rajakarunanayake- aa2356...](https://www.linkedin.com/in/yasantha-rajakarunanayake-aa23568/)

<comment><USER22> he made many contributions to other parts of science (wireless, communications), though, that I doubt bezos would be able to so the point still stands.

<comment><USER21> I think you're short changing Bezos. From everything I heard, the dude is as sharp as a tack.

</comment></comment></comment><comment> lars-b2018 Had Bezos continued in the theoretical physics direction, I am sure he would of been successful and productive in the field. He would of got the math. Great theoreticians have imaginations that are able to come up with ideas that have "fit". The mathematics help you get there, and help you understand the problem, but the imagination and creative thinking skills are crucial. Bezos has this ability - Amazon's success I think demonstrates this very well.

</comment><comment><USER23> "The face book (which was an actual paper book at that time)"

I love that line.

</comment><comment><USER24> actually Bezos doesn't say what the titles says. I like factual titles

</comment><comment><USER9> We are going to pick on the size of that tie-knot right?</comment>


Ask HN: Hypertext Software from Early 90s - <AUTHOR> Back around 1991-93, I remember being in a school computer lab reworking the science curriculum in some type of hypertext software. I can't recall whether it was DOS, Windows or Mac based as we had access to a variety of machines (Amiga too).
There were cards/pages, buttons we could position for moving between them. I think it either had a dark background by default or ability to set a dark mode. I keep thinking of purple/pink and green as a colour scheme. I don't think it was Hypercard.
I keep thinking PageLink? PageLinx? Linksystem?
Can anyone familiar with that era of computers think of what the software might have been? <comment><USER2> There's AmigaGuide ([http://code.iamkate.com/articles/amigaguide/](http://code.iamkate.com/articles/amigaguide/) , most screenshots look like they have a dark theme but generally not purple/pink).

Dark theme with purple/pink sounds like the windows 'high contrast dark' theme, which shipped with Windows 95 & 98, and might have shipped with 3.11 / Workgroups as well. In that case, any card-based hypertext system that ran on Workgroups is a possibility. It looks like that includes Authorware ([https://en.m.wikipedia.org/wiki/Adobe_Authorware](https://en.m.wikipedia.org/wiki/Adobe_Authorware)), StorySpace ([https://en.m.wikipedia.org/wiki/Storyspace](https://en.m.wikipedia.org/wiki/Storyspace)), and probably KMS.

Early versions of HyperTIES ran on DOS: [https://www.cs.umd.edu/hcil/hyperties/](https://www.cs.umd.edu/hcil/hyperties/) ; some HyperTIES images resemble what you describe: [https://www.cs.umd.edu/hcil/hyperties/ecs_intro.gif](https://www.cs.umd.edu/hcil/hyperties/ecs_intro.gif)

<comment><AUTHOR> Don't think it was any of them. Pretty sure the background was black, and I don't remember that being a theme we picked. Think it was a default?

Authorware was used a few years later when I worked in an educational multimedia unit. This one in the early 90s was very basic.

</comment></comment><comment><USER3> HyperCard?

<comment><AUTHOR> No, I don't think it was HyperCard.</comment></comment>


Vim novice tutorial videos - <AUTHOR> http://www.derekwyatt.org/vim/vim-tutorial-videos/vim-novice-tutorial-videos/

<comment><AUTHOR> This is the novice tutorial page, but the table of contents [http://www.derekwyatt.org/vim/vim-tutorial- videos/](http://www.derekwyatt.org/vim/vim-tutorial-videos/) also links to intermediate and advanced tutorials, and plugin showcase videos.</comment>


Basic Command-Line Data Processing in Linux - <AUTHOR> http://symkat.com/1/five-text-processing-tools-you-should-know/

<comment><USER2> Even after using linux command line for years it is always useful to see how others use it. I tend to overuse perl regex's to massage the data how I want it and underuse awk.

my norm is cat file | perl -p -e "s/. _from ([0-9\\.]+) ._ /\1/g" to get the ip out of the same datafile.

regex's seem to help with messy data or data that contains inconsistent delimiters.

(some of the stars got stripped by HN so the above won't work)

<comment><USER3> _(some of the stars got stripped by HN so the above won't work)_

Try putting a couple of spaces in front of your code line, like this:

      cat file | perl -p -e "s/.*from ([0-9\.]+).*/\1/g"

See <http://news.ycombinator.com/formatdoc>

Edit: for simple regexes, sed works well, too, and probably loads slightly faster than perl.

</comment></comment><comment><USER4> I just learned about another one a couple of days ago: cut. Can't believe I never knew of its existence.

Also, for programmers, I'd recommend ack over grep.

<comment><USER5> Thanks for the tip. I'd never heard of that one either. It seems like a simpler awk, or at least small subset of awk.

</comment></comment><comment><USER6> I started a wikibook on this stuff a few years back. Includes material on inline perl, gnuplot and has lots of examples. Check out: [http://en.wikibooks.org/wiki/Ad_Hoc_Data_Analysis_From_The_U...](http://en.wikibooks.org/wiki/Ad_Hoc_Data_Analysis_From_The_Unix_Command_Line)

<comment><USER7> So very cool! Thank you for posting.

</comment></comment><comment><USER8> For my part, I don't use awk for anything more complicated than one-liners. I used it for a while, stopped when I was working on something else, and forgot all the awk-specific stuff.

My MO these days is if it's anything more complicated than an awk one-liner like awk '{print $2 " " $NF}', I'll use Python or, lately, Ruby. (Perl would be fine, too, if I used it in other contexts often enough.)

That said, there's nothing quite like, well, _programming_ your environment. The extent to which you can manipulate files, directories, and text in *nix right out of the box makes me feel privileged to understand it. I can remember a time when renaming a bunch of images en masse seemed tantalizing but out of reach. I've since learned quite a bit, and even though it's relatively mundane now, it still feels magical. Upthread, someone called it "moving mountains." That's precisely it, and I love it.

Yes, yes. I'm a complete and utter nerd, etc.

</comment><comment><USER9> It's also useful to know that 'sort -u' removes duplicates.

<comment><USER10> Although it was important to use the -c flag on uniq for this particular problem, which is not available with "sort -u."

Which I guess just goes to reinforce the Unix philosophy of tools that do one job and do it well.

</comment></comment><comment><USER11> They forgot sed.

</comment><comment><USER12> As others have mentioned, tr and cut are extremely useful. Although I had overlooked them in the past, expand/unexpand are also very useful! They convert tabs to spaces, or spaces to tabs. Of course there are other ways to do that, like substituting with sed, translating with tr, or printing tabbed data using $1/$2/etc. with awk... they just aren't as simple.

</comment><comment><USER13> See also "Opening the software toolbox" by Arnold Robbins, part of the GNU Coreutils documentation.

[http://www.gnu.org/software/coreutils/manual/html_node/Openi...](http://www.gnu.org/software/coreutils/manual/html_node/Opening- the-software-toolbox.html#Opening-the-software-toolbox)

<comment><USER14> GNU Coreutils documentation as a whole is very useful.

<http://www.gnu.org/software/coreutils/manual/> To read on the command line, try:

info coreutils

Also see,

<http://en.wikipedia.org/wiki/GNU_Core_Utilities>

</comment></comment><comment><USER15> Hacker News readers probably have at least a passing familiarity with Unix/Linux, but it's still refreshing to be reminded that you can move mountains with short commands.

<comment><USER16> And even for someone who knows all of this, knowing a good guide makes it easy to handle requests for help (often preemptively). This is one I can (and just did) send to a friend who's less familiar with Unix.

</comment></comment><comment> Andrew-Dufresne I think paste (merge lines of files) also deserves mention. Besides that, I have found tail and column to be extremely useful.

</comment><comment><USER17> I've been using Linux for a while now, and I never thought about how powerful those simple commands can be.

</comment><comment><USER18> sinc people already pointed out the missing ack & comm, I'll add: no love for tr?

</comment><comment><USER19> Best textutil you probably haven't heard of (or have forgotten about): comm(1)

<comment><USER20> I find "diff -y" more intuitive, but I didn't know comm and will explore potential uses.</comment></comment>


What It's Really Like To Work At Fab - <AUTHOR> http://betashop.com/post/53834299838/what-its-really-like-to-work-fab

<comment><USER2> I'm not sure what Fab does really, but just looking over the article I came across this gem:

 _The bit about holding out pay was a joke to get everyone's attention. It worked._

Did everyone really know that it was a joke? Later on he says...

 _It was a joke. We have about a thousand jokes just like it. "If you have time to xyz, you have time to get fired." It's a joke about staying focused and not getting distracted._

I don't know him, I don't work with him, but I have worked with people like him and they were hated. They thought their jokes were funny. When people are being threatened as a joke, they have a bunch of names they like to call Mr. Funny, but the names aren't as nice as "Mr. Funny"

<comment><USER3> Yeah, it's amazing how oblivious the author of the article is. Some people just don't get other people.

</comment></comment><comment><USER4> As a boss, there are at least two things you never joke about: employees getting paid and employees getting fired. It's not worth the risk that there will be one person in the office your humor doesn't land with. And it's not worth the risk that you may not make a payroll and have to do some real layoffs all-too-soon thereafter.

</comment><comment><USER5> I don't know anything about Fab and didn't read the previous article but I think it unlikely that the CEO of a company can write an accurate blog entry titles 'What It's Really Like To Work At X'

To write such an article a lot of research and talking with staff would have to happen and judging by the jokes in his emails and the tone of the article he hasn't done that and probably should sooner rather than later.

</comment><comment> brown9-2 This is a horrible attempt at trying to stifle whatever criticism the original article made.

Repeating "it was a joke" is a childish defense and makes one wonder if management is mature enough to understand that when you, as the boss, send an email with a joke in it like "you might not get paid!", chances are some employees might not get that it's a joke.

Some people tend to think that behavior can't be malicious if you don't intend it to be malicious. This is false.

And this of course isn't even a defense, it's just repeating meaningless aspirational buzzwords. So why even bother?

 _Claim. [Fab] applies a culture of meticulous control.

Fact. Our employees have an intense amount of freedom within the structure we've created to make Fab great._

It's also very obvious you are just playing word games if Bloomberg says "11 executives left" and your response is "well we only had so many C-level departures..."

</comment><comment><USER6> It sounds like it's really awful to work at Fab from his description. His responses show an incredible lack of understanding as to what working for him is really like.

> Claim. A message on Feb. 4 carried the subject header "Do you like getting > paid?" Goldberg told employees they were required to have a photo uploaded > to the "team" page on Fab.com "in order to be eligible for the next company > pay period. No exceptions."

Fact. We pride ourselves on humor and transparency at Fab. As part of our major relaunch relaunch of our employee pages on Feb 5 we required every employee to be listed publicly. The bit about holding out pay was a joke to get everyone's attention. It worked.

Reality - This is not a joke, and it is not even remotely funny. He says "It worked." If it was a joke, there wouldn't be any "it worked."

>Claim. An e-mail on Oct. 11 from Shellhammer, who serves as chief design officer, forbids people from modeling Fab's products. Employees had been inserting themselves into shots of the company's wares posted on its website. "If you have time to model, you have time to get fired," Shellhammer wrote.

Fact. It was a joke. We have about a thousand jokes just like it. "If you have time to xyz, you have time to get fired." It's a joke about staying focused and not getting distracted.

Reality - This is also not a joke. A boss can't joke about firing his employees. It just isn't possible. Anyone who doesn't realize this isn't somebody most people will have any desire to work for.

Edit: Apparently he also threatened to put a bullet in a former employee's head for potentially leaking something. Clearly this guy has huge issues, and I suspect that the work environment at Fab is incredibly toxic. He isn't doing himself any favors with this post - [http://gawker.com/266979/a-bullet-in- your-head](http://gawker.com/266979/a-bullet-in-your-head)

</comment><comment><USER7> What many leaders don't understand is that their words carry the weight of an anvil, even if you're "friends" or a have a David Brent "jokey" office persona.

It's nearly impossible for an employee to tell if a superior is serious or joking, especially if they've been inconsistent in the past. It's anxiety inducing for employees to wonder if they are dealing with "friend boss" or "will I get passed over for a promotion boss" when someone drops by their cubical for some brainstorming.

Even brainstorming can be ambiguously "brainstorming" or "I actually want to see your reaction so I know if I can trust you".

I know all of this because I have made all of these mistakes in the past.

</comment><comment><USER8> They made a "joke" in written form "threatening" to not pay people if they didn't submit a picture to the company profile? Smacks of something a thud headed manager like Michael Scott would do.

</comment><comment><USER9> I did not know about this Bloomberg article, but now I do. They could have just let it go, but now it gets to the HN frontpage. What a dumb move

I know folks who work at Fab in non-tech roles and it is indeed a demanding environment with long hours and high turnover. But this is fairly typical of NYC ecommerce startups though...

<comment><USER10> What if it's not a dumb move? Meaning, what if it's a good thing to be honest with people that working at a startup is hard, that it's emotional, that it's human, that people make mistakes? I think opening up a bit about our culture -- which is hard driving, passionate, etc. isn't a dance in the park and can break some dishes along the way? That's pretty true of all startups.

<comment><USER8> Are you him? God, you're a fucking moron. Shut the hell up. Your mouth is doing more harm than good. Oh, and quit being an asshole.

"What if it's not a dumb move?" It is, objectively, a dumb move. Clearly. Take a hint. We "Y-Hackers" don't play favorites, and as is clearly evident by the "eating" you're seeing, we actually know how to be hard working, supportive, and breed a culture that isn't rife with subversive fear and subtle intimidation. You're wrong. Admit it. Fix it.

</comment></comment></comment><comment><USER11> I had a job interview with Fab's CEO once. He impressed the hell out of me - charismatic, strong vision, ambitious - but it was blatantly obvious to both of us that I wasn't a good cultural fit for the company, and that was as far as it went.

Just based on that one interview, I doubt too many people get through Fab's entire hiring process who aren't already a cultural match. I certainly couldn't work there, but some of the things that bother me (mandatory coatracks and clean desks?) they probably consider benefits.

</comment><comment><USER12> I... don't know if that blog response is going to achieve the goal it was intended to. At the very least, the CEO might spend some more time considering how being the boss affects what is or is not a funny 'joke'.

<comment><USER13> Indeed. Using "do this or you're fired" to get an employee's attention is disrespectful and manipulative, it's not funny - unless you are Michael Scott.

There have to be more creative ways to assert an important company initiative. Surely there is a more 'Fab' way.

<comment><USER14> > Using "do this or you're fired" to get an employee's attention is > disrespectful and manipulative, it's not funny - unless you are Michael > Scott.

Or Tony Soprano.

</comment></comment></comment><comment><USER15> Please don't ever joke about firing people.

Would you say: "I have a gun in my desk, I'll shoot you if you don't..."? I hope you wouldn't.

<comment><USER16> It seems he might've said a variant of exactly that...

[http://web.archive.org/web/20080613100445/http://www.cheezhe...](http://web.archive.org/web/20080613100445/http://www.cheezhead.com/2007/04/05/jobster- silence/)

<comment><USER17> For those of you (like me) who didn't want to read the whole thing. (I got the 'bullet' keyword from a different link that Uperte posted elsewhere and searched for it in the link that the parent posted)

"Goldberg did apparently threaten a female employee, saying he'd put a bullet in her head if he found out she had been part of or leaked a rumor about an executive leaving the company. This employee breaks down crying afterward and shortly thereafter submits her resignation. She is no longer with Jobster. After some prodding, Goldberg apologizes in a company-wide manner, emphasizing that he wouldn't really put a bullet through someone's head."

</comment></comment></comment><comment><USER10> Hi. Jason Goldberg, CEO of Fab here. @betashop. I'm happy to answer any questions you have.

I must say that given my involvement in the Y-Hacker community it saddens me a bit to see you eat one of your own, but that's life I guess.

Is it smart to joke about people getting paid and getting fired? Of course not. Yes, we know that getting fired isn't the sort of thing to normally joke about. But before haters hate on us, come visit Fab's offices. We have this thing at Fab called "do your one thing" - the notion that everyone should focus on doing the one thing they are the best at above all other things and that the accumulation of everyone's one things creates a great organization. No one's one thing at Fab is to be a professional model.

<comment><USER18> Hi Jason. It's nice to see that you've taken the time to comment on this submission and answer any questions we have for you.

You acknowledge that it's inappropriate to joke about payment and firing employees, but you continue to do it. I don't see using the Michael Scott- esque excuse of "come visit our offices" as appropriate. Here's my question for you. Do you feel, honestly and completely, that you have not created a toxic work environment in the slightest with your behavior? How are Fab's offices' different than any other startup's?

</comment></comment><comment><USER19> I was wondering how he could hire and keep engineers in this market with such a terrible attitude towards employees, but then I looked at the jobs page and saw that all engineering seems to be in India.

And it looks like it works for them! Their product is very nice, which used to be very hard if not impossible to achieve with engineering outsourced to India.

As an American software engineer, this is a bit unsettling.

</comment><comment><USER20> Is it funny when CEO makes a joke on getting paid or not?

<comment><USER21> It never is.

<comment><USER14> The whole thing reminds me of some mob boss intimidating someone. He makes a "joke" about, oh, breaking their arms, sits there with a straight face for a few seconds. Then he starts laughing, and after a second the other guy laughs too, nervously. Yeah, that joke was hilarious.

<comment><USER15> It would be funny if he said HE wouldn't be paid... or HE would be fired...

</comment></comment></comment></comment><comment><USER22> _The bit about holding out pay was a joke to get everyone's attention. It worked._

 _It was a joke. We have about a thousand jokes just like it. "If you have time to xyz, you have time to get fired." It's a joke about staying focused and not getting distracted._

Saying 'it was a joke' is just a lame-ass excuse for being an insensitive douche bag. Sorry but not sorry.

</comment><comment><USER23> In this blog post the author corroborates most of the points made by Bloomberg. That is not a takedown.

</comment><comment><USER24> > It was a joke. We have about a thousand jokes just like it. "If you have > time to xyz, you have time to get fired." It's a joke about staying focused > and not getting distracted.

The irony is strong here, that OP wrote a blog post to defend all their jokes that are meant to keep employees from getting distracted.

The thing about jokes is, they should have an element of truth to them that the audience will pick up on. If you're in a position of power over someone, be honest and straightforward, instead of trying to be clever with your amateur stand-up comedy career.

You still can have a fun work culture without acting like a drunk frat boy.

</comment><comment><USER21> This guy has some weird sense of humor: [http://gawker.com/266979/a-bullet-in- your-head](http://gawker.com/266979/a-bullet-in-your-head)

</comment><comment><USER10> What it's really like to work at any fast growing startup. [http://betashop.com/post/53908788656/what-its-really-like- to...](http://betashop.com/post/53908788656/what-its-really-like-to-work-at- any-fast-growing)

</comment><comment><USER25> Translation: joke -> threat.

Sounds like bullying to me. No place for that. No exceptions.

</comment><comment><USER26> Hey cool, a company that I would never, ever, ever want to work for.</comment>


LaTeX CV Template - <AUTHOR> http://jblevins.org/projects/cv-template/

<comment><USER2> I quit my job because of a cartoon about having a LaTeX CV.

I had no plans of making a move, when I saw this cartoon on reddit: <http://stevehanov.ca/blog/index.php?id=56>

So I redid my CV from scratch in LaTeX, and it looked pretty good (<http://danielromaniuk.com/files/Daniel_Romaniuk_CV.pdf>). All of this CV business made me curious to poke around, so I pinged the few companies that are involved in flight simulation.

It turns out they each had a few average-interesting positions available, and my wife and I are both sick of living in Dubai, so I send out a few CVs. A few months later, I accepted a job at the last company where I worked. I was just waiting for an email about my security clearance going through. And waiting. And waiting.

To make a long story, I didn't get the job. The combination of a job freeze and an endless security clearance process slowly made the offer disappear.

Just as well though. I have really interesting plans now to move next year, and it's a thousand times more ambitious and exciting than where I would be now if it had all worked out. I guess I just needed to get that damned LaTeX CV out of my system.

Edit: oh yeah, and I formally quit my current job during this whole process, thankfully they had the grace to cancel my resignation when the new thing fell through. That was a stupid thing to do, kids.

</comment><comment><USER3> You may also find some nice examples here: <http://www.tuteurs.ens.fr/logiciels/latex/>

Translation:

 _CVs: here are several CV examples, with different layouts, and using different techniques. It is true that for someone who is not familiar with LaTeX, common text processing software might be easier for typesetting a simple CV. This said, using LaTeX is also seeing how other people use it..._

 _o CV1 (cv1.txt,cv1.ps.gz): simple_

 _o CV2 (cv2.txt,cv.cls,cv2.ps.gz): more complex, but also nicer, it uses its own document class 'CV', written to that purpose (...)_

 _o CV3 (cv3.txt,cv3.ps.gz): simple and elegant_

Files can be found here: <http://www.tuteurs.ens.fr/logiciels/latex/templates/>. You can also check UK TUG's FAQ (<http://www.tex.ac.uk/cgi-bin/texfaq2html?label=cv>).

But in my opinion the best thing is to write your own template from scratch so that it matches best with your personality.

<comment><USER4> I am a lazy person. So the best thing for me is to use somebody else's template.

</comment></comment><comment><USER5> If you're thinking about having your CV in latex, you might want to think carefully about whether or not you're doing it wrong.

Most people compile their latex CVs to PDF. If you using a recruiter, this is a pain for most recruiters as they like to remove contact details from the CV before passing it on. Recruiters are generally not tech savvy enough to remove it from a PDF. There are also some places that demand CVs in Word format. As shitty as it is, Word is the de facto document format for HR.

If you do insist on using Latex for a CV though, there are some gorgeous templates on CTAN. Just bear in mind that some might not appreciate it as much as if it were written in word.

<comment><USER6> Although I agree, the other side is that making it impossible to edit CV's will force recruiters to let _you_ make the CV. I get CV's from recruiters that are so full of nonsense and boilerplate HR-speak that it's painful to watch, and it's very obvious that the recruiter put those things in himself. If I ever need to work with one I'll fight tooth and nail to get them to let me make my own CV to send around.

<comment><USER7> Recruiters also sometimes make stuff up. It's a lot of fun walking into an interview where the interviewer thinks you know java, and you haven't actually touched it since 2001.

Apparently the recruiter assumed that since I used it when working in at a chem lab in college, I must still know it. Therefore, it belongs on my "skills" section.

</comment></comment></comment><comment><USER8> This thread is reminding me a bit too much of the business card scene from American Psycho:

<http://www.youtube.com/watch?v=qoIvd3zzu4Y>

but uh, nice CV's guys.

<comment><USER9> I am pretty sure everyone is posting their own and favourite CV + templates to help people who are about to make a CV, not as some form of alpha male ego competition.

</comment></comment><comment><USER10> I really like moderncv, check [http://www.ctan.org/tex- archive/macros/latex/contrib/modernc...](http://www.ctan.org/tex- archive/macros/latex/contrib/moderncv/)

An example [http://mirror.ctan.org/macros/latex/contrib/moderncv/example...](http://mirror.ctan.org/macros/latex/contrib/moderncv/examples/template_classic_green.pdf)

You can also easily integrate your existing publications via an bibtex file

Edit: Fixed the link, sorry!

<comment><USER11> ModernCV looks a lot better than the OP, especially with fontspec.

</comment></comment><comment><USER12> I forgot whose online LaTeX CV template I used to create my own resume, but it was very nice and helpful for a TeX noob like myself, better looking than this one. This is what mine looks like, with very minimal changes in layout/design compared the original: <http://www.scribd.com/doc/37894947/Resume-of-Muhammed- Hoque>

<comment><USER13> Can you share the template?

<comment><USER12> Well, it's compiled using XeLaTeX, which really is necessary for the template. It also requires a bunch of LaTeX packages I had to track down through Google I think, so you'd have to do the same. Also you should get the Fontin font, or another professional font (Fontin is free though). Here's the tex file used to render my PDF resume: <http://pastie.org/1173737>

<comment><USER13> > Well, it's compiled using XeLaTeX

That's fine, I'm already using XeLaTeX. Thanks.

</comment></comment></comment></comment><comment><USER14> Here is also a nice one using XeTeX and some cool fonts: <http://nitens.org/taraborelli/cvtex>

Or this interesting two-column-CV movement: [http://www.cv- templates.info/2009/05/advanced-two-column-lat...](http://www.cv- templates.info/2009/05/advanced-two-column-latex-cv-template/)

<comment><USER15> That first link is great! I kind of hate the look of Computer Modern, but like LaTeX, so I've been using Hoefler Text (and before that, Baskerville) in my resume for the last five years.

</comment></comment><comment><USER9> Ill probably clean it up and package it tomorrow, but people are free to take my html template as well.

<http://daleharvey.org/>

<comment><USER16> I like the clean look, though the yellow-green links are hard on my eyes. I'll definitely be using this in the near future. Thank you!

</comment></comment><comment><USER17> Thanks for sharing this template. I'm not sure if the OP is the writer of the CV, but I just have to comment on the CV itself. They've done some good stuff, but this CV doesn't show it off at all. To wit:

4 pages! The last page only lists an almost certainly irrelevant security clearance? And it looks like one solid wall of short snippets. Where's the meat? What did you really study? Why should anyone care which conferences you've been to? I'd rather see a three sentence abstract of your three best papers. Which scholarships are you most proud of and which could have been awarded to a bag of lettuce?

I know you will have a cover letter with it, and a CV will be skim-read, but as the reason to create a CV in LaTeX is to intrigue and delight, so the content itself should also titillate and ultimately, sell!

<comment><USER18> This looks like most academic CVs I've seen. This is a domain- accepted/encouraged practice. Moreover, this guy is a newly minted academic; you should see how long they get when you stick around: <http://www-cs- faculty.stanford.edu/~uno/vita.pdf> (Large PDF Warning)

<comment><USER17> Yes, Knuth has done an incredible number of things and his CV reflects that. For mere mortals, a CV that long looks kind of kooky and you can bet a recruiter is not going to print more than the first few pages.

However, I expect you are right about academia and these are acceptable, although I'd still put a summary of my best work on the first page. BTW, an effective CV for Knuth would surely be:

 _Donald Knuth_

and I'm not sure it needs the Donald.

<comment><USER4> Yes, his name brand is strong enough. Though I guess Knuth doesn't use his CV for getting hired.

</comment></comment></comment></comment><comment><USER19> You can use my CV as a template too:

<http://yury.name/media/lifshits-cv.tex>

Result: <http://yury.name/media/lifshits-cv.pdf>

<comment><USER20> Just out of curiosity: you finished a MSc in 5 years but a PhD in 2 years?

Where I come from (Sweden) it's the exact way around :)

<comment><USER21> Judging by his year of birth, he did a 5 year undergrad/MSc program.

<comment><USER19> Yes. I did 5-year diploma program (it's closer to Master than to Bachelor), then completed PhD in two years. I had the same advisor at both places, so the large part of my PhD thesis was done during undergrad years.

</comment></comment></comment></comment><comment><USER22> This is better than most LaTeX CVs I've seen, but I'd still only call it decent looking at best. Got my hopes up.

<comment><USER23> What would you recommend to do CVs in? Would you be willing to share what yours looks like?

</comment></comment><comment><USER24> When I had to make my first (reasonably) professional looking CV while applying for undergrad Co-Op jobs last Winter, I chose to do it Latex and tweaked the moderncv template ([http://www.ctan.org/tex- archive/macros/latex/contrib/modernc...](http://www.ctan.org/tex- archive/macros/latex/contrib/moderncv/)).

Since nearly everyone else's resume is written in Word or some other word processor, every employer noted that it was exceptionally well done.

Time well spent : ).

<comment><USER25> I've had problems with my moderncv based CV. Some companies want the CV to be in DOC.

On the one hand I could just say that I don't want to work in such a company, but when it's the recruiter and not the company demanding it, I don't really know what to do.

(At the moment I'll just send them a link to one of the PDF to DOC sites that are all over internet.)

<comment><USER26> I've used latex2rtf for such things, followed by some light manual fixups and saving as .doc. It's annoying and I tend to consider if I really want to apply to such a company or not, but sometimes it is worth the extra hassle.

</comment></comment></comment><comment><USER27> This is my favorite LaTeX CV template: [http://linux.dsplabs.com.au/resume- writing-example-latex-tem...](http://linux.dsplabs.com.au/resume-writing- example-latex-template-linux-curriculum-vitae-professional-cv-layout-format- text-p54/)

I prefer the 2 column layout it uses, the left column for the section headings and the right column for information. I think it looks unique and definitely not something created in a word processor.

</comment><comment><USER28> I'm a big fan of CurVe: <http://www.ctan.org/tex- archive/macros/latex/contrib/curve/>

Among its other nice features, it makes it easy to custom compile your CV for a specific purpose.

<comment><USER29> I like Curve exactly for that feature. You can have multiple versions, e.g., with or without mugshot (photos are standard in Europe and considered weird in the US). And depending on whether you're sending this to industry or academic people, you either put in a short list of the "most interesting" publications or the foot-long full publications list, or the other way round for "open- source software I'm involved in".

</comment></comment><comment><USER30> To be really convinced, I'd need to see how it gets translated into HTML as well. That was a weak spot with LaTeX last I remember - which was admittedly a while ago.

Having your resume in an easy-to-see-at-a-glance format is not optional, in my opinion.

<comment> loup-vaillant Then surely you could come up with a little script which translate a source CV in HTML, in LaTeX, and in nicely formatted plain text. You could also avoid some work by using something like Markdown.

<comment><USER30> Scripts like that exist, but didn't work so well last time I checked, so I currently use open office, which can output both pdfs and html, even if the pdf output is not as good looking as LaTeX.

<comment> loup-vaillant Err, I talked about _writing_ such a script.

<comment><USER30> I don't think it's quite as easy as you make it out to be.

<comment> loup-vaillant If you want to make something configurable, useful for many people besides yourself, then it may not be trivial. But I was talking about making something tailored to your needs.

Now to the specifics, the only semi-serious difficulty I see is parsing the source code. Once you've done that, printing is really easy, even when you make it customizable. I've done that with HTML[1].

[1]: <http://www.loup-vaillant.fr/projects/ussm>

</comment></comment></comment></comment></comment></comment><comment><USER31> Wow, right on time. Thank you HN.

And also, I wonder how HN CV tips would look like.

</comment><comment><USER32> All of these seem very targeted towards people coming from academia. I have always put work experience up at the top as it has been the bulk of what employers care about.

<comment><USER33> Sure, but that should be independent of the TeX template. At least in the few I looked at, you can create sections with any title in any order.

</comment></comment><comment><USER34> Since we are all adding our own, here's my contribution: Source: <http://www.thomasdimson.com/res.tex> Results: <http://www.thomasdimson.com/res.pdf>

The template may lack some negative space but I think it is pretty reasonable. The content is crusty and questionable :)

<comment><USER35> Shouldn't the f in food be capitalised?

<comment><USER34> It is odd what the eye is drawn to in these situations. Fixed and thank you.

</comment></comment></comment><comment><USER36> I tried a few LaTeX templates on CTAN awhile ago and settled on simplecv:

[http://www.ctan.org/tex- archive/macros/latex/contrib/simplec...](http://www.ctan.org/tex- archive/macros/latex/contrib/simplecv/)

It's fairly boring, but simple to use and flexible. Best, it makes good use of the space on the page without looking too cluttered.

</comment><comment><USER37> I used this template when I redid my résumé a few months back. I like how it does away with those extraneous bullets and lines found on many résumés; it is uncluttered, elegant, and very readable.

</comment><comment><USER4> You should also have a look at the currvita package. It's documentation also has some general information about writing CVs.

</comment><comment><USER38> Why not make it a fully fledged site.</comment>


Qualcomm's 60GHz Wi-Fi 10+ Gbps network & wire-equivalent latency 802.11ay - <AUTHOR> https://www.qualcomm.com/news/releases/2018/10/16/qualcomm-dramatically-extends-wi-fi-experiences-5g-era-60ghz-80211ay <comment><USER2> Sounds promising from bandwidth perspective, but I think the use will be restricted as this frequency has very low penetration through walls and obstacles. It would require a huge number of APs to cover an entire office, just as no home user would understand the low coverage.</comment>


The state of TLS ciphers - <AUTHOR> https://blog.cloudflare.com/staying-on-top-of-tls-attacks?

<comment><USER2> While this is an excellent summary of the RC4 attack and a good prioritized list of ciphers to use, it's still important to note that the vast majority of TLS-related vulnerabilities involve improper use of TLS libraries, plain old misconfiguration, and questionable certificate authorities. See "The Most Dangerous Code in the World" ([https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf](https://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf)) for a sobering account.

Having personally implemented certificate validation logic (for tlslite, though it's not mainlined yet), my own sense is that the X.509 validation process has now become so complicated that it violates any reasonable person's definition of a minimal "trusted computing base" (cf. microkernels for more philosophical discussion of minimality as a security goal). For example, see section 7 of RFC 5280: name validation alone now subsumes all the complexity of Unicode normalization.

</comment><comment><USER3> For anyone wondering, Wikipedia has a nice table that show which browser support TLS 1.1/1.2, and which don't.

[https://en.wikipedia.org/wiki/Transport_Layer_Security#Web_b...](https://en.wikipedia.org/wiki/Transport_Layer_Security#Web_browsers)

Basically:

\- Chrome Stable support TLS 1.1, Chrome Beta/Canary support TLS 1.2

\- Firefox Stable support TLS 1.0. You can enable TLS 1.1 by setting "security.tls.version.max" to "2" in about:config. Support is not considered stable, and you might have some problems: [https://bugzilla.mozilla.org/show_bug.cgi?id=733647](https://bugzilla.mozilla.org/show_bug.cgi?id=733647)

\- Firefox Aurora/Nightly supports TLS 1.0. You can enable TLS 1.1/1.2 by setting "security.tls.version.max" to "3" in about:config. Like Firefox Stable, support is not considered stable and you might have some problems.

\- Opera 15 support TLS 1.1.

\- Opera 12 support TLS 1.0. You can enable TLS 1.1/1.2 by checking "Enable TLS v1.1" and "Enable TLS v1.2" in opera:config

\- IE 10 support TLS 1.0. You can enable TLS 1.1/1.2 by enabling them in Windows, and forcing IE to use them. See [http://netsekure.org/2009/10/tls-1-2-in- windiows-7/](http://netsekure.org/2009/10/tls-1-2-in-windiows-7/)

You can use sites like [https://sni.velox.ch/](https://sni.velox.ch/) and [https://cc.dcsec.uni-hannover.de/](https://cc.dcsec.uni-hannover.de/) to see which version of TLS is your browser using.

</comment><comment><USER4> > That's what the latest RC4 attack shows. Specifically, there are biases in > the first 256 bytes of keystream generated by RC4. Those first bytes are > likely to be used to encrypt the start of an HTTP request and may include > sensitive information such as a cookie used for logging into a web site.

I didn't pick this up from the previous discussions on the vulnerability. Basically, RC4 is vulnerable _under an HTTP request /response usage pattern_\--one where you make lots of little TLS connections that share some initial plaintext worth protecting.

In other words, if you've written a webapp which does everything over one long-lived TLS websocket (including doing the client authentication after the connection upgrade using websocket messages, rather than transmitting that in a cookie), then you have much less to worry about, and RC4 can probably be safely preferred to AES-CBC ciphers in your ciphersuite configuration. Though you still might consider padding your websocket connection with an initial 256 bytes of meaningless data that the server knows to ignore (which is not much additional overhead relative to the lifetime of the socket, really.)

<comment><USER5> I don't think this is true. I think you're assuming that the vulnerability has anything to do with how your app works, when it in fact targets browser behavior. The attacker uses (e.g.) Javascript, loaded from some random site, to generate a bajillion connections to your site, each of which will bear session cookies.

The 256 byte padding doesn't help either, because of the Fluhrer-McGrew biases.

<comment><USER6> Are the Fluhrer-McGrew biases actually exploitable? After all, they've been known for over ten years, but no one seems to have been particularly concerned about them before.

<comment><USER5> Yes, the summary of the full Patterson/Bernstein paper says the attacks on the Fluhrer-McGrew biases are easier in practice to exploit than the first 256 bytes --- which _also_ were known for over ten years but weren't taken seriously until last year.

</comment></comment></comment></comment><comment><USER7> I'm curious why CloudFlare includes !EDH as part of their cipher suite options... Guessing they were just following the recommendations from [https://community.qualys.com/blogs/securitylabs/2011/10/17/m...](https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating- the-beast-attack-on-tls), but having a specific reason would be interesting to know. EDH ciphers _are_ generally slower (so I could see why a company that wants connections to be fast wouldn't want to use them), but at the same time, they also allow for forward secrecy. Seems like CloudFlare might want to prioritize forward secrecy over speed, as per [http://blog.cloudflare.com/cloudflare-prism-secure- ciphers](http://blog.cloudflare.com/cloudflare-prism-secure-ciphers). Maybe I'm missing something here, though... Perhaps that !EDH should be !ADH?

<comment><USER8> From Adam Langley, who works at Google on their SSL stack, on his post "How to botch TLS forward secrecy":

In the case of multiplicative Diffie-Hellman (i.e. DHE), servers are free to choose their own, arbitrary DH groups. <snip> ... it's still the case that some servers use 512-bit DH groups, meaning that the connection can be broken open with relatively little effort.

Full article of his at [https://www.imperialviolet.org/](https://www.imperialviolet.org/)

<comment><USER9> For posterity: [https://www.imperialviolet.org/2013/06/27/botchingpfs.html](https://www.imperialviolet.org/2013/06/27/botchingpfs.html)

</comment></comment></comment><comment><USER10> Nice write-up of the current state. I've been more and more interested in the process of moving to ECC. Some CAs are issuing dual certs (ECC and RSA), but I'm not sure how good support in browsers and client libs is.

</comment><comment><USER11> One key takeaway from a security course I followed at uni was to never use a stream cipher if avoidable. They tend to be much more malleable than block ciphers, and are generally less understood.

<comment><USER5> Yeah that security course was wrong. And, for what it's worth, the "safe" ciphersuite in TLS 1.2, AES-GCM, is also a stream cipher.

<comment><USER12> Not to mention AES-CTR if you want a non-AEAD mode. I think the bias against stream ciphers has something to do with the failure of all stream ciphers submitted to NESSIE, but the eStream project has yielded useful stream ciphers.

</comment></comment></comment><comment><USER13> Does anyone know why CloudFlare uses TLS internally? I'm assuming they mean over their intranet of web servers, so if those are behind a firewall with their iptables configured properly, then what's the point of using TLS?

<comment><AUTHOR> We have 23 locations around the world where we have servers. Those servers need to be administered, monitored, backed up, rebooted, and synchronized. So we make extensive use of SSH and TLS.

Yes, there are all sorts of firewalls and iptables rules to create an 'intranet' across the world, but that doesn't stop the actual packets from passing the public Internet. There's really no reason not to use TLS.

<comment><USER14> Is what you noted in the post still what you use for the nginx ssl_ciphers string? When I ran that through `openssl ciphers -v` I got wildly different ordering from what is shown as cipher priority in the post.

<comment><AUTHOR> Ah. It looks like I've put the wrong configuration in the blog post. My fault. I shall update the blog post with the correct configuration.

Here's what we are currently using:

      ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
      ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
      ssl_prefer_server_ciphers   on;

<comment><USER7> Why do you turn off the CAMELLIA ciphers?

</comment></comment></comment></comment></comment><comment><USER15> Is it useful to stuff the first 257 bytes of a HTTP response with a set-cookie with a 1-second expiry containing random nonsense?

<comment><USER5> No.

<comment><USER16> Why not? Sounds like a reasonable band-aid to me.

<comment><USER5> Because there is a viable attack on the whole keystream, not just the first 256 bytes.</comment></comment></comment></comment>


Do Not Trust Google - <AUTHOR> https://lukeboyle.com/blog-posts/2020/08/do-not-trust-google <comment> joe-collins > You don't have to agree with them politically to see that Google is applying > different standards to conservative content than to more liberal content.

Or, perhaps a _balanced_ set of standards is being applied, and the author's Overton Window is off-kilter, and the supposedly "(merely) conservative" content described therein remains outside of the actually-balanced metric for search ranking?

(Granting, yes, perfect balance for any actor or reference frame is impossible; and _accepting_ that some degree of filtering-scare-quotes- censorship is a positive, pro-social quality in a search engine.)

<comment><USER2> Yeah... using Breitbart as an example was really unconvincing.

I recently spent an hour of my life trying to convince an acquaintance that a video she found on breitbart claiming the "Frontline Doctors of America" were fighting to expose a conspiracy to suppress a 100% effective covid-19 cure was faked.

That's not "conservative" content, that's propaganda that puts people people in imminent physical danger.

<comment><USER3> This is exactly the problem, though. By suppressing this stuff, they validate the narrative that "THEY don't want you to know the truth" (whoever the hell they is). This stuff doesn't go away. It just migrates to different platforms and every time it's taken down it gains credibility among the faithful.

This is the current paradox that plagues us.

<comment><AUTHOR> Yeah, I agree with this statement. I'm actually not very familiar with Breitbart's content so I don't know if it's really a conspiracy website as is being suggested here. But yes I believe censoring these websites does add legitimacy to them

<comment><USER4> So, is the Flat Earth, 9/11 conspiracy, moon landing conspiracy or anti- vaccine even more legitimate because it's more deranked or otherwise less visible?

This logic does not work. However, conspiracy theories do not use logic and facts.

Breitbart is not being suppressed for their views or opinions, but uncritical spreading of dangerous falsehoods. Sadly, some people do not understand the difference as they drunk the "post-truth" Kool-Aid.

<comment><AUTHOR> Thanks for your point of view. I'm going to keep researching to find some alternative examples

</comment></comment></comment></comment></comment></comment><comment><USER5> _" \- what kind of users go to that websites (and does the user searching fit that profile)?

\- how much traffic does the website get?

\- how relevant the content is to the search term (SEO magic)?

\- and, most importantly, does this website fit an acceptable narrative?"_

Google analytics seems like a real trojan horse. Surveillance with a side of analytics. Google benefits much more from such a product themselves, compared to the site owner/manager, who supposedly gets thses analytics 'for free'. It's all such a clever and deceptive trick: "just install this small GA snippet and maybe use our tag manager and get _detailed insights_ ". I know it's nothing new, but sometimes it just dawns on me how socially accepted all this trickery has become...

<comment><AUTHOR> Yeah absolutely, GA is quite terrifying. And they just ignore "do not track" settings on browsers. Recaptcha is another one trojan horse imo. With recaptcha v3 you get that single score to determine how legitimate of a user you are. I've been outright blocked from sites because of my recaptcha score.

</comment></comment><comment><USER6> > There's plenty of evidence to suggest that Google is manually making these > decisions to block conservative websites

So show us the evidence.

<comment><USER7> The graphs of traffic flatlining overnight aren't convincing evidence to you?

There are definitely blacklists. Here's one that was leaked for news in "Google Now" (aka assistant/suggested stories):

[https://pv-uploads1.s3.amazonaws.com/uploads/2019/08/news-bl...](https://pv- uploads1.s3.amazonaws.com/uploads/2019/08/news-black-list-site-for-google- now.txt)

See the bottom section labelled, "sites flagged for peddling hoax stories".

</comment></comment><comment><USER8> > As people increasingly are using search to navigate the web (as opposed to > typing a URL into the address bar), this traffic increases, those people see > more ads, Google makes more money.

Pardon my ignorance but I thought all of Googles search advertising was pay per click and not pay per impression?

<comment><USER9> The ads appear above search results and so are often clicked on.

</comment></comment><comment><USER10> Perhaps I'm reading too much into this, but perhaps a site trying to seriously discuss bias against Breitbart shouldn't use :ok: as a favicon.

</comment><comment><USER11> invidio.us appears to be shutting down, which is a shame, as I was happy to learn there was a sort of startpage.com for youtube.

<comment><AUTHOR> Yeah that's unfortunate. Seems like the maintainer is feeling burned out.

invidiou.site is another instance you can import your invidious data to

</comment></comment><comment><USER12> "If you believe in a free and open internet then you have to agree this is wrong."

I don't have to agree. Perhaps it was 'wrong' before that Breitbart ranked as high as they did earlier.

I can still go to Breitbart.com - no one is stopping me from going there. No one is stopping them from setting up their servers, hosting their content, and doing all that stuff. They don't get as much 'free' exposure via google as they used to. Other sites now get more visibility. So what? If BB kept their 'visibility' in the search index, every search result they show up in is taking space from a different site that might have shown up instead. Why are they owed anything from google? Google changes their algorithms, and there's more content to compete with too.

If we make some sort of assumption that google's algorithms get modified or perhaps simply adapt to the audience's searches, perhaps... there's less appetite for Breitbart content and ideas across google's user base, and them ranking lower _years down the road_ isn't some grand left-wing conspiracy, but a company serving the needs and desires of its users?

<comment><AUTHOR> I see where you're coming from. In my opinion the search engine shouldn't take a stance when it comes to politics, though. They claimed they only step in when it's illegal content or copyright, but I haven't seen any evidence of them removing left-leaning sites in this fashion.

I can't prove that what Google did specifically targeted Breitbart but if it was just changes to the algo then we should have seen other popular sites with similarly dramatic drops in visibility. I'd love to see other examples if they do exist

<comment><USER4> If a search engine should not take a stance, then who also should not? Publishers? (Incl. YouTube, which takes some big stances.) Libraries? Social media? Governments?!

Everything is political in some form after all.

</comment></comment></comment><comment><USER13> Withdraw unto yourself and your immediate/close community.

<comment><USER4> Sure, and then when they are wrong you go down with the ship, oblivious.

<comment><USER13> Hmmm... Btw that was a joke to showcase the universality of trade-offs. And the idea that you do you and with that comes the responsibility to bear the consequences. Anyway be well.

</comment></comment></comment><comment><USER14> this is some pretty enlightened centrist content</comment>


Using Flywheel Batteries to Charge Electric Vehicles in Ten Minutes - <AUTHOR> https://www.calcalistech.com/ctech/articles/0,7340,L-3738031,00.html <comment><USER3> Former flywheel energy storage startup engineer here.

The economics of flywheels for this kind of application versus just using another battery tend to rest on the purported "unlimited cycle life" of the flywheel system compared to, say, Li-ion batteries that have a very well documented finite cycle capacity that degrades even further when doing sub- optimal cycling. To a lesser extent you can also bank on lower parasitic loads during standby as the environmental requirements for a flywheel aren't as stringent as batteries that need to be either heated or cooled almost all the time in many climates.

The problem is that, by and large, "unlimited cycles" is not true. You still have huge, very high speed bearings. Motors that require routine electrical testing and can fail. And now all this stuff is sitting below ground under a massive concrete lid for containment so it's not as easy to do maintenance on compared with a similarly-sized battery system. You also need uninterruptible power supply to maintain safety and control systems when grid power is unavailable since you've still gotten a huge spinning mass that you can't slow down without somewhere to send the energy (it's possible to use braking resistors, but it's another cost).

Batteries also benefit from massive economics of scale (both on the actual cells and the power electronics) that are getting better with time and driving costs down, while flywheels have been "1 year from commercialization" for the last 25 years.

I remain skeptical of the commercial benefits vs. increasingly commoditized and readily available battery systems.

<comment><USER4> Power utility engineer here. I keep imagining a giant flywheel located at every substation- could be very useful for load balancing, voltage regulation, even frequency control. I guess what I mean is, a large spinning mass could potentially have other benefits than just storage, right? Any research into substation application at that startup?

<comment><USER5> I was recently reading about power factor correction and found out that "synchronous condensers", basically just large synchronous motors with no load, are sometimes used at utility scale for PFC and frequency stabilisation. Eg, here: [http://www.think-grid.org/synchronous-condensers-better- grid...](http://www.think-grid.org/synchronous-condensers-better-grid- stability)

Since it seems like the main source of stability in that system is the inertia in the rotor, would it be fair to describe it as a kind of flywheel? I didn't see anything about connecting an actual wheel to such a system, but it seems like it would be the same thing with more inertia, right?

<comment><USER3> Where "flywheels" in common parlance differ from synchronous condensers is that condensers run at zero torque - so they provide no active power to the system. They provide reactive power, which is needed to regulate and maintain the stability of the power system, but not active power which is used to match generation and demand or shift load. There's no actual source of energy being fed into a synchronous condenser. In a flywheel, you're drawing energy from the grid to spin up a really big mass and then storing it in rotational inertia so you can output it later very quickly. Flywheels can provide reactive power too, through their DC/AC power converters, but since you don't actually need any rotating mass to do that (recall, reactive power requires no torque), you can use a STATCOM - which is functionally like a synchronous condenser just without any moving parts.

</comment></comment></comment></comment><comment><USER6> The article isn't very clear.

The car still has a battery, this goes in the stationary charging system. It's used to increase the current when charging electric batteries. Most electric batteries can accept much more current than commercial electricity drops can provide. This system stores the current in stationary flywheels and then discharges it quickly when a car pulls up and plugs in.

So this provides something like a Tesla super charger, without having to call up the power company to rewire your gas station. They call it a "Kinetic Battery". In the video below, the CEO makes the claim that flywheels are much better for this because you can get many more discharge/charge cycles out of flywheels than with chemical batteries.

You can imagine that rewiring electric infrastructure all over the country would be quite a bit more expensive than just plugging in their system. You could also imagine a solar powered system (off the grid even) slowly being charged and then recharging a car in 10 minutes.

Cool idea!

Interview with CEO [https://www.youtube.com/watch?v=YxRfPtYmTDE](https://www.youtube.com/watch?v=YxRfPtYmTDE)

<comment><USER7> Is it conceivable that the same type of battery could be used in cars as well, or would the capacity/falloff/external forces be too limiting?

<comment><USER8> Gyroscopic forces are a big problem as is trying to get enough mass.

<comment><USER7> I could see it being used as a "quick-charge" portion of the capacity. i.e. you have a full-sized battery, but also a small flywheel so that if you're really in a pinch you can rapidly charge enough to get somewhere without waiting for an hour. It'd be like having a small SSD paired with a large HDD.

<comment><USER9> You'd get better results using the same weight for more batteries.

</comment></comment></comment></comment></comment><comment><USER10> Safety concerns raised... since the maximum amount of power the flywheel can be expected to store is a known quantity, and the amount of kinetic energy that can be stopped by concrete or metal shielding is a known quantity, it's just a matter of burying the flywheel underground, with enough concrete/metal around it (particularly above it) to prevent shrapnel from penetrating to the surface. Easy peasy. It's just a cost problem.

We keep those levels of potential energy in underground gas tanks at every gas station, and no one freaks out about _that_.

edit: For perspective, a typical gas station has 12,000 to 24,000 gallons of gasoline storage underground. A gallon of gas is about 120 megajoules of potential energy. So there are _billions_ of joules sitting there - much more than these flywheels. Of course, without air, gasoline isn't dangerous. But a 90% empty tank has a lot of air in it, a lot of potential boom.

<comment><USER11> NO, an empty gas tank has a lot of gasoline vapors mixed in that air - <USER2> concentration is high enough that the vapors will not burn. One of the advantages of gasoline is it will only burn in a fairly narrow window of concentration (IIRC 5-30%, but since I don't feel like looking it up you will have to if you care)

<comment><USER10> Still, if containment is violated somehow, it's a LOT of power for fire/explosion. These flywheels are much smaller, by comparison.

The tank of gas in a car probably has over 400kwh of energy. How much will these flywheels contain, considering a full charge for an electric car is on the order of 100kwh (electric cars are more efficient than internal combustion)? The energy of two or three tanks of gasoline is enough to get several charges out before needing to spin up the flywheel again.

<comment><USER12> But a nearly "empty" flywheel is a lot less dangerous than a "full" one. While a full gas tank, even if cracked open and lit on fire, would probably burn, not explode.

I imagine seeing a flywheel leap out of the ground and short through the foundations of a skyscraper...

<comment><USER10> That gets back to my original point, though - we know from the start the maximum power of the flywheel. Putting enough reinforced concrete above it to keep it from penetrating in case of catastrophic failure is a straight-up engineering problem.

</comment></comment></comment></comment></comment><comment><USER13> Boy, flywheel batteries. At the Ford Museum (in Ann Arbor I think?) they have some of the earliest versions of these, for steam generators I believe. Maybe 30 feet in diameter, must weigh a couple tons at least? The idea of one spinning even at 20 or 30 RPM was a scary demonstration of potential energy. If it got loose it seemed like it would blast through the wall and roll halfway across the country. But they were beautiful, well made, and instructive.

That said, it's an interesting way to store energy and I hope it can be deployed safely and beneficially.

<comment><USER14> The spinning wheel has kinetic energy, not potential energy, right?

<comment><USER15> It's kinetic energy if you consider rotation around the center of the flywheel (I * omega^2/2), but only potential energy to move around and destroy stuff (m * v^2/2). If you let the flywheel loose, it becomes just a wheel and it's not potential energy anymore. :-)

</comment></comment></comment><comment><USER16> I remember a fly wheel battery concept from the early 90's. Spin light weight tiny flywheels on magnetic bearings in a near vacuum and take advantage of the fact that energy storage is linear with mass, but the square of velocity. Put the flywheels in opposing directions and spin them really fast. If I remember correctly, there still was a bit of a safety problem: my understanding was if one of the tiny flywheels fell off the magnetic bearing it would rip through 9 feet of steel. Not great for a battery in a vehicle. However I don't see why you can't tune the amount of energy you decide to store, and the amount of safety barriers to handle catastrophic failure.

Makes me wonder if there is anyway to do something akin to a MEMS flywheel.

</comment><comment><USER17> I'm assuming what they're doing here (they don't really say) is using a flywheel in the equipment in the charging station to charge a "regular" electric car -- a car that stores the electricity in batteries. And the flywheel is used because the environments they want to deploy these charging stations have lower quality electric grids, "where upgrading the grid for fast electric vehicle charging can be prohibitively expensive".

They even say they can "...charge a battery in ten minutes..." This sounds great! But I'm not sure what cars they'd be charging. Can, for example, you charge a Tesla that fast? I assume not, or Tesla would be charging them that quickly. ([https://www.tesla.com/supercharger](https://www.tesla.com/supercharger) says it takes 30 minutes)

So I'm assuming that they're charging cars with smaller batteries. It sounds interesting, but not as good as my initial reading ("you can charge your car way faster") made me think.

<comment><USER18> Maybe, but there is another charging standard that's starting to be rolled out that provides up to 350kW with a water-cooled cable. [https://arstechnica.com/cars/2018/04/electrify-america- will-...](https://arstechnica.com/cars/2018/04/electrify-america-will- deploy-2000-350kw-fast-chargers-by-the-end-of-2019/) That would take 17 minutes to charge even a 100kWh Tesla battery (if you could maintain that rate of charge the whole time, which battery packs generally can't).

Edit: fixed units

<comment><USER19> No, Musk explicitly said that future superchargers for the cars won't be 350kw. [https://electrek.co/2018/05/03/tesla- supercharger-v3-charge-...](https://electrek.co/2018/05/03/tesla- supercharger-v3-charge-rate-porsche-faster-charging/amp/)

<comment><USER18> Ok, but I'm addressing zck's comment "I assume not, or Tesla would be charging them that quickly."

</comment></comment></comment></comment><comment><USER20> It takes about 1 Mega Joule of energy to bring 2500kg car to a stop from 60 mph. The model s with a 100kwh battery can store 360MJ and weights about 2500kg with passengers.

Is it wrong that I get uncomfortable with the idea of a spinning mass able to charge a model s that fits within the artists rendering of the charging station?

<comment> gene-h Yes, because a flywheel is a very efficient device for producing flying shrapnel. It's already storing kinetic energy, it's simply a matter of letting all that kinetic energy loose. Energy storage flywheels have injured people in the past and even led to some flywheel energy storage startups going out of business[0]. However, with proper safety standards we can prevent many disasters. [0][http://www.sandiegouniontribune.com/business/sdut-quantum- en...](http://www.sandiegouniontribune.com/business/sdut-quantum-energy- folded-explosion-poway-2016jul28-story.html)

<comment><USER21> Would putting a vertical axis flywheel in a deep basement containment be a good start? Cap with rebar & concrete, or steel like a liquid storage tank - depends on wheel material and failure modes?

<comment><USER22> By the time you're considering building a concrete bunker, it's clearly better to give up on flywheels and stick with chemical batteries. A bunker will cost a lot more to construct than a few Powerwalls.

<comment><USER23> Just one Powerwall costs more than the cost of burying an underground gas tank, and you'd need 10 of them to store enough power to charge one Tesla 100 kWh car. That's $35,000 in batteries alone without the cost of installing them. $35,000 is much more than it would cost to put down an underground concrete foundation to drop a flywheel into. House-size basement foundations can cost 1/8th that.

</comment></comment></comment></comment></comment><comment><USER24> I gotta say, flywheels are rad. They have all kinds of cool applications including moving satelites, [https://en.wikipedia.org/wiki/Reaction_wheel](https://en.wikipedia.org/wiki/Reaction_wheel).

<comment><USER25> For example, some wind tunnels are powered using flywheels (c.f. high enthalpy wind tunnel F4 from ONERA in France is using a 15 tons flywheel to get the necessary power).

</comment></comment><comment><USER26> Let me channel my inner Thunderf00t here.

A Tesla Model S has about 85 kilowatt-hours of energy in its batteries at full charge.

\- [https://en.wikipedia.org/wiki/Tesla_Model_S#Battery](https://en.wikipedia.org/wiki/Tesla_Model_S#Battery)

That is 85 * 60 * 60 * 1000 = 306 megajoules or 3.06 * 10 ^ 8 joules.

According to Atomic Rockets' Boom Table, This is slightly less than a 54kg high explosive Iowa battleship main gun shell.

\- [http://www.projectrho.com/public_html/rocket/usefultables.ph...](http://www.projectrho.com/public_html/rocket/usefultables.php#id --The_Boom_Table)

\- [https://en.wikipedia.org/wiki/Iowa- class_battleship](https://en.wikipedia.org/wiki/Iowa-class_battleship)

This matters because with a battery, it's Very Hard(tm) to get the energy to discharge at a high enough rate to cause catastrophic effects, like for example why Mike Tyson can punch with ~1600 Joules (uncited, popularly referenced), about the same as a 5.56mmx45mm round fired from an M16/AR- pattern rifle. Because the Joules are distributed over space (bigger cross section) and time (slower impact), Mike Tyson's punch doesn't immediately shred your tissue and bones.

However, it's Very Easy(tm) to get a flywheel to have a tiny mechanical failure that causes the entire thing to release all its kinetic energy rapidly. Additionally, there's no conversion penalty with the flywheel. So the battery under catastrophe can and generally does shed its energy relatively slowly as rapidly-dissipating heat (see videos of cell phone batteries on fire), whereas a rotating wheel that just fell of its drive shaft is... markedly different.

Conclusion: Even if the flywheel only holds enough energy for a single charge, it would have to be buried far underground and still might create a crater in the gas station asphalt it sits underneath when (not if) mechanical failures happen.

Therefore, this is dumb and won't happen. Please help me understand where I'm wrong :)

<comment><USER27> You're severely underestimating the ability of concrete to stop shrapnel. And unlike a bomb exploding there's no expanding gas to contain.

[https://www.youtube.com/watch?v=RZjhxuhTmGk](https://www.youtube.com/watch?v=RZjhxuhTmGk)

20 metric tons at 800km/h is 500 megajoules, and the concrete shrugs it off like nothing.

</comment></comment><comment><USER28> This is half of something. Charging a car battery in 10 minutes dumps a crap- ton of heat and risks damaging the cells, lowering the useful life of the battery substantially.

</comment><comment><USER29> This is a pretty neat idea, I do worry about the 'one and done' problem where the spinning flywheel charges a car and then then needs an hour to get up to speed again (more if its just using solar power). That means you either need a lot of flywheels to service cars.

It is also an amazing amount of energy to be holding in the box next to the car (if you can believe the artist's conception in the article). I would be much happier if they put the flywheel horizontal in a vault under the charging station, that way if a bearing failed the wheel wouldn't go careening off into the next county mowing things down.

This problem needs to be solved for electric trucks as well.

<comment><USER30> A Russian hydroelectric turbine (not too different from a flywheel) stored horizontally in a "vault" (a dam) killed 75 people. [https://en.wikipedia.org/wiki/2009_Sayano%E2%80%93Shushenska...](https://en.wikipedia.org/wiki/2009_Sayano%E2%80%93Shushenskaya_power_station_accident)

<comment><USER31> I remember following that amazing accident. But as I recall, the turbine _jumped up out_ of its vault, and that's what started the whole failure.

IIRC, the speed of a water-powered generator is regulated by the load on it. Take that load away, it spins faster and faster (think that's what happened to the other generators). So that one guy had to climb up to the top of the dam to close the gate.

<comment><USER30> About the "faster and faster" remark, turbines will only get to about double their nominal speed without load (called runaway).

</comment></comment></comment></comment><comment><USER32> Charging a car in ten minutes is great.

But what will really make you rich is finding a way to charge a set of AA batteries in ten seconds.

<comment><USER33> You'd need a new sort of AA battery; rechargeable nickel chemistries are a bit finicky and they are usually not charged faster than 1C, similar to the rate of lithium chemistries. It is also bad for NiMH batteries to charge them constantly at those voltages; typical recommendations are to avoid "steady- state" charging them at rates faster than 1/40 - 1/20C [1]

[1]: [http://batteryuniversity.com/learn/article/charging_nickel_m...](http://batteryuniversity.com/learn/article/charging_nickel_metal_hydride)

Lithium-hybrid supercapacitors are often rated for 10C charge/discharge without the low cycle limits or volatility of lithium batteries, but they are a young technology and it looks like commercial options are currently very expensive with capacities in the 1-10mAh range @ 2.3-2.8V.

</comment></comment><comment><USER34> Check out activepower. They've been in the flywheel biz for awhile for data center power.

But they've been struggling for a viable business last 10yrs.

Area required and noise are big issues.

<comment><USER35> Dumb question: couldn't a vacuum chamber and magnetic bearings overcome those issues?

<comment><USER36> Active Power's UPS systems do use magnetic bearings:

      Immediately after the output is transferred from bypass to
      the power stage, the flywheel field is excited which also
      provides magnetic lift to unload the flywheel bearings.

Source: [http://www.activepower.com/en- US/documents/3801/wp108-operat...](http://www.activepower.com/en- US/documents/3801/wp108-operationups)

</comment></comment></comment><comment><USER37> I seem to recall that the new class of carriers being built use flywheels to store up the energy used to drive the catapult.

</comment><comment><USER7> I'd never heard of flywheel batteries. They're steampunk as hell.

</comment><comment><USER38> seeing the diagram - I wonder what the replacement period is for the solar panels. Also the service costs for the panels relative to batteries.

</comment><comment><USER39> Fly wheels are not new. I wonder why they haven't caught on (seeming like a pretty good way of stationary energy storage), but using one for an EV charger doesn't seem very innovative.

<comment><USER10> It may not be a huge innovation, but it's an interesting potential business model. And as an investor, I'd be looking at financial potential, not "innovation".

</comment></comment><comment><USER40> This could be a cool low cost option. Imaging if a solar panel could spin up a fly wheel which you could then pull power from at night. Cheaper than regular or expensive lithium batteries, and "unlimited" assuming motors don't wear out. I'd love to see something like this to help power my home. Or maybe have it run on the grid at night during free power times and then pull from during the day.

<comment><USER41> > Cheaper than regular

FES is currently as expensive or more expensive than battery, and while it could go down faster than batteries that's unlikely considering how old FES tech is.

If you want to store lots of power in a flywheel, you need big flywheels spinning very fast without spinning out of control and blowing themselves up (because then all the power they stored remains kinetic but stops being contained).

They've got plenty of advantages over battery (inert materials, less affected by temperature variations, potentially infinite lifespan for magnetic bearings in vacuum-sealed enclosures) but safe large-scale flywheels are not _cheap_.

Neither Beacon Power nor Amber Kinetics provide any pricing information on their pages, despite specs in the same range as battery storage: a Powerwall 2 is 13.5kWh/5kW, an Amber Kinetics M32 is 32kWh/8kW. The M32 is also ~4.5 tons.

The M32 _does_ have the advantage of an estimated 30 years lifespan, and no health danger outside of the rather immediate effects of a containment breach,</comment></comment>


Apple releases Xcode6-Beta6 - <AUTHOR> https://developer.apple.com/devcenter/ios/index.action

<comment><USER2> I can't seem to find it. Beta 5 still listed below.

[https://developer.apple.com/swift/resources/](https://developer.apple.com/swift/resources/)

UPDATE: Turns out it was a bad build and so it was pulled.

[https://devforums.apple.com/message/1025094#1025094](https://devforums.apple.com/message/1025094#1025094)</comment>