Quest Diagnostics says nearly 12M patients may have had data breached - <AUTHOR> https://www.cnbc.com/2019/06/03/quest-diagnostics-says-nearly-12-million-patients-may-have-had-data-breached.html <comment><USER2> The breach came from American Medical Collection Agency, a debt collector that Quest uses. It's a sad statement on the state of American healthcare that 11.9 million people can't afford to pay their lab bills.

<comment><USER3> I had a small lab bill for my daughter (right after she was born) sent to collections because the address they had on file was for a location my daughter had never lived at. My wife and I had moved 2 years prior, and somehow the lab used our old address which they got from ???.

Reason #283942 that our medical system is horrendously broken in the US.

<comment><USER4> Three kids, pretty sure each one had something related to the birth or pregnancy care end up in collections. We could pay it all no problem and the things that went to collections were usually tiny, medical billing's just completely fucked up.

You get low-hundreds (not an exaggeration) different documents, handed to you and via mail over the course of a year (9ish months + a few after, ends up close to a year), some of which are bills and some of which look like bills but say "this is not a bill" (so... why'd you send it?) and some of which are from your insurance referencing other things and blah blah blah, then you get a few that are clearly a screwup and you call the provider and they're all "LOL no your insurance got it it's fine, ignore that bill" (!?!?! seriously, dafuq, how many people just pay it and do you give them their money back unless they ask?) and of course one of those pieces of paper is gonna slip through the cracks.

Insurances companies get a lot of shit, but the whole medical billing complex is rotten, top to bottom.

</comment></comment></comment><comment><USER5> Great. Yet another one. Can't even just get simple lab diagnostics anymore without having your SSN/CC number harvested... let's all look on in disbelief while these people barely get slapped on the wrist!

Just a reminder to everyone to keep passwords rotated, and to monitor your credit/bank account...

<comment><USER6> How many more decades of such data breaches is it going to take for organizations to start realizing that SSN's are not a good way to authenticate or identify people (a purpose they were never meant for), and that most people's SSN's have already been compromised?

<comment><USER7> There are very few common identity factors available for these companies. I'd almost be willing to have the US Govt develop a "medical ID number" specifically for this purpose.

<comment><USER8> It would have the same issues as SSN though: a number that once it leaks lets someone else have too much knowledge/power over you.

<comment><USER9> But that is THE FUNDAMENTAL problem. No one should be able to impersonate you and open up credit cards in your name simply by knowing your Name, Address, DOB, and SSN. Just as no one should be able to purchase things using your credit card account by knowing your name, credit card number, and expiration date (all of which are printed on the card, which you give to people for B&M purchases). The system is fundamentally broken, and that fact gets ignored by all the focus on "data breaches". At a minimum, we need to move to multifactor authentication and one time use "credit card numbers" generated at the time of the transaction.

<comment><USER10> > one time use "credit card numbers" generated at the time of the transaction

PayPal used to have that feature but got rid of it for some reason.

<comment><USER11> Google Pay still offers this. I have a virtual card number that is given to merchants instead of my real CC number. I don't know if this is a feature for all of Google Pay or requires special integration with my particular CC/bank.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Imagine the call fraud now. Hello Mrs Jones I'm calling about the labs you had done last month, CBC, cardiac panel etc., with Dr Bob. I was alerted to make the call because your values are out of normal range and there are critical things I need to review with you. Before we get in to the details I need to first confirm your identity.

—- Or — Your insurance only covered part of the blood labs on the 12th. To release the results to you doctor I need to secure payment today for 189.74.

</comment><comment><USER13> Name + ICD diagnosis, what a wonderful leak for blackmailers wordwide! (/s)

Seriously, these two pieces of data that are innocent alone, when taken separately (HIV, chlamydia, cancer...) should _NEVER_ have been linked together, _ESPECIALLY_ when given to a third party, _EVEN MORE_ stored together.

I pray it will result in many lawsuits with hefty punitive damages, and that as a consequence private data will be considered a liability to be deleted as early as possible (just like corporate email in many companies)

<comment><USER14> Good catch. Reading between the lines I took this to mean that lab information was not leaked:

> The system contained sensitive data, including credit card numbers, bank > account information, medical information and Social Security numbers, Quest > said. Lab results were not provided to AMCA and were not exposed in the > breach. AMCA thinks 11.9 million Quest patients were affected as of May 31, > 2019, Quest said.

But it only says _lab results_ were not leaked with the extremely generic label of _medical information_ as being leaked. I wonder if "medical information" includes lab codes or what exactly it consists of?

<comment><USER13> Medical information is likely to be ICD codes for the active diagnosis, and antecedents (history) for this patient.

This is worse than full text medical information because everything is already coded, so you can make some simple algorithms to find crunchy details with a very high specificity.

</comment></comment></comment><comment><USER15> In the past I've done software for healthcare, happened to learn for the privacy conscious:

You can order anonymous labs for yourself through various online lab resellers. At the lab, you don't need ID, just the order. You will get lab results; you will not get a diagnosis.

For instance, and not a recommendation:

FAQ: [https://www.health-tests-direct.com/frequently-asked- questio...](https://www.health-tests-direct.com/frequently-asked-questions)

 _Q: How can I keep my "true" identity from HTD, and the clinic, and the lab?_

 _A: Easy -- Don't give us your phone number or credit card info. Then mail us a money order (a money order does not require your name or signature) for the total amount due for the blood draw and lab analysis. We will e-mail the lab paperwork to you when the money order arrives and email the lab results to you the same day we receive those 2-3 days later. If you want, you can even set up a temporary (and free) "alias" e-mail address at Yahoo! (e.g.,"YourAliasName"@yahoo.com) for the purpose of our email communications with you..._

 _There are two more things we hope that you will feel more comfortable knowing: First, 99.99% of the blood draw centers we send you to will NOT ask for your photo I.D. when you go in for your blood test. And, in the very-very rare event that one should they do so, don't feel obligated to show it to them. Instead, leave the PSC and immediately call us. We will find you another PSC! Or, keep in mind, that your lab tests results are NEVER sent to or shared with the clinic or its personnel that does your blood draw. Only YOU get your lab results, and NOBODY else. So, if you are asked, and you DO decide to show them your drivers license or other ID, rest assured that they will NEVER see or know the result of your test(s) anyway!_

See also: [https://www.walkinlab.com/help- contents#privacy](https://www.walkinlab.com/help-contents#privacy)

 _Q - Can I do anonymous testing?_

 _A - Yes, an order can be placed anonymously. The First Name field must start with an alpha or numeric character and the Last Name must be an alpha character. Your correct date of birth and gender are required._

Both of these work with LabCorp and Quest Diagnostics, DuckDuckGo can help you find more.

</comment><comment><USER16> Hey, maybe we shouldn't centralize huge amounts of sensitive information?

<comment><USER7> The US Govt wants to federalize this, think about how much worse it could've been.

<comment><USER17> The government is far from perfect but private corporations have not exactly proven to be great stewards of data privacy or fiscal responsibility.

<comment><USER7> Yeah, that OPM hack was greaaaaaaat....

</comment></comment></comment></comment><comment><USER18> Nobody should be allowed to hold this amount of sensitive information about customers without paying a large bond to hold that information. It's clear that these companies will not minimize their data collection since storage is practically infinite, so make it cost them so they have an actual reason to care.

</comment><comment><USER19> Is this a HIPAA violation?

<comment><USER7> Its a breach, so yeah. That said it'll probably get covered by insurance...

<comment><USER20> If it is a HIPPA violation the fines are deliberately per instance - eg 12 million * (the fine), and I can't recall whether hippa considers each piece of data a separate violation.

But I think to be a HIPPA violation it would need to have information about what tests are involved - eg just a monetary debt and knowing it came from a lab might be argued as not being a violation?

That said until there are mandatory per-person-per-data-leaked fines, coupled with liability for misuse of that data, companies are just going to continue leaking because they "compensate" people by giving them "free" credit monitoring.

That last bit is great because it only resolves financial service harm, and offloads actually preventing fraud to the victims of these companies.

</comment></comment></comment><comment><USER21> I tried dealing with Quest recently and gave up. They don't answer their phone or do and hang up. The more I see these breeches, the more it seems like it mostly comes down to someone either implicitly or explicitly making the decision that the costs of customer service (which includes data privacy) aren't worth it.

</comment><comment><USER22> Quest is one of leading providers of employment and pre-employment drug testing. Their "customers" do not have much choice to avoid them. They are often not "patients" in need of medical care. The tests are often paid for by interested parties like employers. Now I have to assume that because of a drug test required for my background checks, my identity was compromised yet again.

Which politician can make ID data breaches financially ruinous and their concealment criminal?

</comment><comment><USER23> We send a few thousand life insurance applicants per year to Quest. Quest is the 800 pound gorilla for insurance exam lab work. It's unfortunate, but alternatives are likely less secure and we'll continue using Quest.

</comment><comment><USER24> Nice, just went there today. Good job Quest!

</comment><comment><USER25> Curious - who are are the possible "third party forensics firms" that would investigate this?</comment>


Show HN: Playlistor – Convert Apple Music Playlists to Spotify - <AUTHOR> https://playlist.raymondakornor.xyz/ <comment><USER2> This really works!! nice job man!!

You should make it look more appealing. let me know If you need help.

Also, the links brake in spotify description. Maybe something that you should work on.

<comment><AUTHOR> Thanks for the feedback. Not quite good at design so I try to keep it simple. I do need some help on that front. How do i reach out ? You can reach me at firstname.lastname@example.com</comment></comment>


Sikuli (automated GUI testing tool) releases v. 1.0 RC1 - <AUTHOR> http://www.sikuli.org/

<comment><USER2> It seems Sikuli was inspired by iMacros:

<http://wiki.imacros.net/File:Image-recognition-plugin.png>

<http://wiki.imacros.net/Image_Recognition>

<comment><USER3> Sikuli has been around for a year or so, but that a side iMacros looks like it is clunky and difficult to use. Where as Sikuli is Python and awesome.

</comment></comment><comment><USER4> The IDE installs and runs in whatever system language you have activated in Windows - with no option to change it other than java command line parameters.

That's quite a shitty user experience for many people right from the start.

</comment><comment><USER5> What's new: <http://www.sikuli.org/sikuli-x.shtml></comment>


Bumble CEO's vision to build the female internet - <AUTHOR> https://www.fastcompany.com/90396193/inside-bumble-ceo-whitney-wolfe-herds-mission-to-build-the-female-internet <comment><USER2> Anecdotal, but I've ran and been a part of a lot of different product teams. Of all the experiences and diversity that can shape the product I'd have to say gender would have never made the list.</comment>


Cheerleading with an agenda: how the press covers science - <AUTHOR> http://www.3ammagazine.com/3am/cheerleading-agenda-press-covers-science/ <comment><USER2> This reflects my experience in academia so much better than my rants over beers and BBQ ever have.

I had no idea, but should have suspected, that Bernays was behind it all.

</comment><comment><USER3> Thanks for this post. The description of the attempt to treat scientific knowledge as a commodity reminds me of a quote I like by Dr. Ray Peat:

"Knowledge isn't a commodity, especially not a fungible commodity, as the medical business sees it. Consciousness and culture are part of the life process. It is exactly the commoditization of medical knowledge that makes it dangerous, and generally stupid. Doctors buy their knowledge and then resell it over and over; it's valuable as a commodity, so its value has to be protected by the equivalent of a copyright, the system of laws establishing the profession. Without its special status, its worthlessness would be quickly demonsrated..." \-- Ray Peat, PhD.

</comment><comment><USER4> I'm inclined to agree with the article, but it's a bit of a ramble. I wish it explored what motivates of journalists to become cheerleeders. I can take guesses, but those guesses are just speculation:

guess 1: Publishers want to cultivate relations with big institutions that are the sources of their stories.

guess 2: Individual journalists enjoy the prestige of being associated with big-name institutes.

Are either of the above correct? Are there other possibilities.

<comment><USER5> #1 reminds me a bit of what my uncle has said of his radio advertising work. Where he works far harder than needed for the first couple of runs, so that in the future similar work with the client is just a simple phone call(in either direction depending).

A two salaried people working at different companies love setting up such working relationships. Especially when a lot of public facing jobs can earn large bonuses, or at least be at home with work almost writing itself.

</comment></comment><comment><USER6> Weird article. Author seems less concerned that academics and journalists may have _an_ agenda and more that it's the _wrong_ agenda.

</comment><comment><USER7> _In 1894, science fiction writer, journalist and eugenics proponent H.G. Wells, ..._

Mention of eugenics contributed nothing to the article, other than to create an emotional atmosphere.

<comment><USER8> The subsequent dig was weird too:

>If the public didn't care about science, then there would not only be "the danger of supplies being cut off," but also the danger of the public endorsing inquiries "of doubtful value" (ironic, given Wells' enthusiasm for eugenics).

Eugenics is a legitimate scientific inquiry. The real irony is that this author's distaste for eugenics is likely an example of "supplies being cut off" from the field due to emotional, not scientific, reasons.

<comment><USER9> Science can be wrong, and should be able to reverse its stance with nothing lost but funds and time. Eugenics is a field of finality, beeing wrong there is final. Thus eugenics is not a science. You can not undo, the damage you do.</comment></comment></comment>


Very cruel marketing scam from Ziptask.com - <AUTHOR> https://www.reddit.com/r/freelance/comments/46xyv6/ziptaskcom_marketing_scam/ <comment><USER2> Cruel is a bit of a stretch. Perhaps clever seen from another perspective. Maybe they should pivot to botting and drop the lame app.

</comment><comment><USER3> what was cruel was trying to read that email thread.</comment>


Do DevOps tools really exist? - <AUTHOR> https://www.scriptrock.com/blog/devops-tools-exist/ <comment><USER2> I agree that it's harder than it should be. I think are some great tools, but they're not easy for most organizations to integrate unless there is a really big push to make it happen.

I've been playing around with Blueprint [1] because I like the idea of being able to dip a toe in without plunging in the deepend with Chef/Puppet.

[1] <http://devstructure.com/blueprint/>

<comment><USER3> We're massive fans of Blueprint. Richard et al did an amazing job with it. Anything that lowers the friction for use of Chef and Puppet is a great thing. We're looking forward to working more closely with the Blueprint guys with what we're doing as they are definitely fellow travellers in the fight to make the best tools easier to use :)

</comment></comment><comment><USER3> Hey, nice to see someone cares enough to post and comment on my blog.

BryantD, if you work in a place where testers review Puppet manifests that's awesome. It's fair to say I was generalising. I believe that the tools should be doing more to encourage it.

<comment><USER4> "I believe that the tools should be doing more to encourage it."

Can you provide an example of what that means? E.G. What should Jenkins be doing differently to encourage sysadmins to use it? What should Puppet be doing differently to encourage developers to use it?

<comment><USER3> What we want to see in "DevOps" tools is collaboration and visibility baked in. A tester in an Enterprise is unlikely to start writing Puppet manifests. If they could contribute notes and requirements to one though, perhaps even in a format that could be converted into a manifests then that would be a very powerful thing.

</comment></comment></comment><comment><USER5> "Are testers reviewing Puppet manifests?"

Yes.

"Do sysadmins typically contribute to Jenkins projects?"

Yes.

Tools are what you make of 'em, man.

</comment><comment><USER6> How about dev ops service providers? It seems like service companies with dev ops expertise are either website builders or hosting providers. The former is not interested unless they are building a new site (DevOps and upward in the stack). The later is not interested unless they are hosting everything (DevOps and downward in the stack).

</comment><comment><USER7> Best part: "Whilst the benefits of this specialisation have been understood since Adam Smith profiled the original Pinterest[asterisk] we still need to acknowledge their impact on collaboration."

[asterisk] Featured Pin Factory in the Division of Labour (it was a hot startup, sweeping the 1776 Crunchies)

<comment><USER3> Stoked someone noticed :)</comment></comment>


HTML 5 canvas graphics library - <AUTHOR> http://www.exsprite.com/

<comment><USER2> I'm always glad to see more canvas libraries, but the performance of this one is pretty horrendous. I'm writing a comprehensive canvas diagramming library that is now up to 70K lines and its no where near this slow.

In case the author reads these comments I'll mention a few I see at first glance:

They are doing things like setting the font every on single draw unnecessarily (which takes a surprising amount of time, performance-wise). Actually they are resetting nearly all of the canvas state by hand on each draw, which can just as easily be done in the much faster way by doing "canvas.width = canvas.width". But even that they shouldn't do if they can avoid it.

Similarly the author should not set the globalCompositeOperation all the time unless he or she really needs to.

I'm sure there are a lot of other low-hanging fruit that can be fixed. I'll try send the author an email later tonight. I hope they keep at it.

<comment><USER3> I'm also kind of sick of seeing stuff done with canvases that could probably be done as efficiently or more efficiently without. (It would be particularly cool for someone to implement a library that abstracted out the back-end, so you could run in DHTML4 or excanvas or a real canvas.)

<comment><USER4> limejs does that, but it uses google closure

<comment><USER5> I've seriously thought about surgically removing Closure from limejs. It uses a lot of Closure classes (i.e. Vector2) so it wouldn't be clean, but improving the build process would be worth it.

</comment></comment></comment></comment><comment><USER6> How does the performance of this compare to other libraries like PaperJS (<http://paperjs.org>) or EaselJS (<http://easeljs.com>) or ProcessingJS (<http://processingjs.org/> though I understand Processing doesn't really have a display list)?

<comment><USER7> From my experience EaselJS is pretty fast. You gotta be aware of the demos on Firefox, because it gets pretty slow due to multipe error messages unless you set the following flag:

        DisplayObject.suppressCrossDomainErrors = true

</comment></comment><comment><USER8> I made something similar a ways back (a little rough, but some fun features like defining sprites using ASCII characters):

<https://github.com/mcantelon/grout>

Here's a game I made with it:

<http://mikecantelon.com/demo/demo_blood_funnel.html>

</comment><comment><USER7> Interesting. But I wonder why I'd use this instead of EaselJS: <http://easeljs.com/>.

<comment><USER9> well, Grant's a joker that ripped off plenty of my ideas and code; but it's not horrible if you have to use somethin.

</comment></comment><comment><USER10> This is great, it's similar to Flash's display list. I actually think a display list should be part of the canvas spec. There's really no reason to have a bunch of competing display list libs and it could be optimized if it was part of the browser.

</comment><comment><USER11> Cool...other than the parts that need click or keyboard input, all the demos seem to work, more or less, on my iPhone 4S (Canvas Creatures is pretty sluggish, though) and Kindle Fire (both Canvas Creatures and Snake are sluggish there, and Canvas Creatures looks a little weird, like the maybe the alpha channel isn't quite working. This may be a limitation of the Kindle display or browser; I haven't had it long enough to judge).

How about adding support for touch events and gestures? :-)

</comment><comment><USER12> Something like this with an alternative WebGL renderer would be cool! It can make it a lot faster - see a blog post I wrote on it: [http://www.scirra.com/blog/58/html5-2d-gaming-performance- an...](http://www.scirra.com/blog/58/html5-2d-gaming-performance-analysis)

</comment><comment> daniel-warner-x I miss Flash. I know it had big issues but this stuff makes for some hard livin'.

</comment><comment><USER9> Okay. I wrote StrikeDisplay.blogspot.com which does what this is trying to do. I haven't had much time to work on it for awhile, but I try to keep an eye on developments in this area.

I reviewed the code. I think it's a good effort and it's on the right track, as far as developing a seamless parent/child display chain coupled with event chain for the kind of things we take for granted in Flash. It gets some things right; like apparently re-scoping mouse events with target and currentTarget, which is good if you're expecting methods listening for the events to be scoped in some other way than window or document.

The two issues I see with this library are serious deficiencies in performance -- which could be improved upon, of course, although some of the architecture requiring redraws on every frame is just inefficient as has been pointed out -- and also issues with the way bounding boxes are implemented and how collision/rollover checks are implemented. First of all, it useless to have rollovers always based on rectangles, especially if there aren't careful z-ordering methods. Secondly, having an inner and outer bounding box is a very slow method for traversing the redraws and checking events (so are a lot of other bb methods in canvas. everything's slower in canvas than in Flash). The closer to native browser bone you can cut on this, the better; my solution to click collision checks in StrikeDisplay was to implement a hidden canvas on top of the visible one, that duplicated everything drawn in white, everything else in black, and check the pixel color value of that canvas when the mouse clicked or went over anything inside a bounding box. This turned out to be a hell of a lot faster.

I'm happy to see these kinds of libs come out, because if we do have to give up all the comforts of flash or unity or javafx to develop in this nightmare DOM with nothing but a raw canvas, the sooner we can bridge the gap between visual-oriented coders and everyone else, the better for everybody. This one needs work, but I'd rather see something along these lines than most of the other stuff I've seen come out that's DOM-centric rather than based on a display chain.</comment>


Twitter for the web is down - <AUTHOR> http://thenextweb.com/twitter/2015/09/14/twitter-for-the-web-is-down/ <comment><USER2> Twitter App also not working on OSX 10.8 from Germany

</comment><comment><USER3> seems to be back up again now, it was down for like 10min for me

<comment><USER4> Still down for me :(</comment></comment>


I made a Halo 5 Web UI - <AUTHOR> http://successbreak.net/halo/

<comment><AUTHOR> I'm trying to develop my skills in UI and web development, would be nice to hear your thoughts.

</comment><comment><USER2> Looks great. I doubt Halo 5 will ever come out for PC though!

<comment><AUTHOR> One can only hope!</comment></comment>


Ask HN: Why there is no "Who is Hiring" thread this month? - <AUTHOR> <comment><USER2> I suspect there will be one tomorrow, as September 1st was a Sunday and September 2nd (today) was a US holiday.

<comment><USER3> I was wondering the same and probably it is related with the 2nd being a US holiday as you pointed out. Thanks for the info!</comment></comment>


How We Made a Smooth Content Creation Experience on Android - <AUTHOR> https://medium.com/tech-quizlet/how-we-made-a-super-smooth-content-creation-experience-on-android-ac919a19b7db#.8qo38kvpw <comment><USER2> It is surprising to say the least to see a new app, especially one focusing on actions like swipe to dismiss choose to use ListView instead of RecyclerView.</comment>


Follow-up on "Linux server monitoring tools" - <AUTHOR> http://aarvik.dk/linux-monitoring-tools-suggestions-from-hacker-news/ <comment><USER2> From the description of linux-dash:

> It is easily extensible from its architecture which just calls the php > exec() function and sends it to an ajax request.

I presume the network police have already revoked somebody's license to run a server, yeah?

<comment><AUTHOR> I also believe that exec() is not dangerous if you use it right, and if your www-data/apache-user do not got any sudo rights to risk someone to take advantage of your machine. This have been proved from various sources, if i know right. I understand it can be a security hole if you let the user write anything, but this is eg. not the case with Linux-dash.

<comment><USER3> local shell is as good as root as far as I'm concerned.

especially if that machine is single purpose, which most of mine are.

</comment></comment></comment><comment><USER4> Widening the net a bit but since you added network-connected monitoring, check out sensu. It's backward-compatible with nagios plugins and handles cloud systems very well (no need to restart the server every time a host is being added/removed). It's also capable of extracting system metrics and forward them to graphite/... . Really great tool.

And just for metrics, collectd is great too.

<comment><AUTHOR> Nice zimbatm, i will definitely take a look at those :-) Sounds great with Nagios + cloud systems integration.

</comment></comment><comment><USER5> I use [https://github.com/bpowers/psm](https://github.com/bpowers/psm) every day at this point. Simple, fast and filterable memory reporting. disclaimer: I also wrote it.

<comment><USER6> I am using PSM quite frequently too. Thanks for the library.

</comment></comment><comment><USER7> Is there a nice open-source solution for monitoring multiple servers? I don't want a separate http daemon on every one of them, just so I can log in there occasionally. It would be most helpful to have a separate server, which will collect data and logs from all of my other machines, through a lightweight network interface. SMS/E-mail notifications and a tray app for Mac won't hurt either.

There is always AWS, but for my side projects, I prefer cheaper VPS.

<comment><USER8> More than you can shake a stick at.

For graphing: Munin, Cacti, Graphite, and ganglia are the normal options. Graphite is the most powerful of these. It doesn't do any actual monitoring though. Munin is the simplest to implement.

For general monitoring and alerting: Nagios (and its clones: Shinken, Icinga, and Naemon) is the standard. There's also newer projects like reconnoiter (which suffers from awful documentation, but looks like it could be really nice), and Sensu (who's got quite a bit more documentation than reconnoiter, and looks like it could be quite good). A reasonable number of people use Zabbix as well - the main benefit of this seems to be a nice GUI for management (but I've never used it, so take my comment with a pinch of salt). Graphs (and almost anything you want) can generally be added to nagios and clones if you're willing to do a little work. Reconnoiter seems to have graphs out of the box. I don't know about zabbix or sensu.

There's more tools that you can use for log monitoring - I think that's a whole separate area, but if you're interested, ping me and I can point you in the direction of the right tools :-)

</comment></comment><comment><USER9> I'm writing a ruby script to gather statistics from a Raspberry Pi. All the projects I've seen so far rely on Perl/Python/PHP scripts which are executing shell commands to extract informations every X minutes.

I wonder, isn't there some sort of API to access in Unix-based systems data like CPU usage, memory usage, etc in a more natural way?

<comment><USER10> Why, yes, there is.

Go run strace on ps or top and see what they call.

I'll save you some time: it turns out to be stat() and open() on things in /proc.

</comment></comment><comment><USER11> i know this is much easier to use, and arguably looks much better. but maybe for more serious use maybe consider using munin [1] or cacti? [2]

[1] [http://munin-monitoring.org/](http://munin-monitoring.org/)

[2] [http://cacti.net/screenshots.php?page=1](http://cacti.net/screenshots.php?page=1)

</comment><comment><USER12> We have plans to add (free) server monitoring to App Enlight. I would be more than delighted for you guys to comment here:

[https://github.com/AppEnlight/main/issues/29](https://github.com/AppEnlight/main/issues/29)

and tell us what you would like to see.

</comment><comment><USER13> Can Linux-Dash provide with a history of CPU load , memory etc or does it only provide the current stats ?

<comment><AUTHOR> Only current data. It is a very simple tool. If you clone it to your Web server it should work already, if you want to test it.</comment></comment>


Critiques of the DHS and FBI's Grizzly Steppe Report - <AUTHOR> http://www.robertmlee.org/critiques-of-the-dhsfbis-grizzly-steppe-report/ <comment><USER2> This is theatre. Were Congress to expand tort law to mandate standards and consequences similar to products liability regulations for other products, then the attack surface available to state and non-state actors would meaningfully shrink.

If there is one thing the plaintiff's lawyers excel at, it is inflicting extensive expenses and pain on parties who negligently or fraudulently create, fund creation, or use products that injure property or person; thereby creating effective incentives to harden products.

You will know the USGOV is serious about INFOSEC when they stop issuing reports and start legislating, regulating and enforcing meaningful standards, as they already do for automobiles, drugs, machinery, etc.

<comment><USER3> > Were Congress to expand tort law to mandate standards and consequences > similar to products liability regulations for other products, then the > attack surface available to state and non-state actors would meaningfully > shrink.

The problem is the organization sizes are the opposite of what works for products liability. It's not Joe Homeowner buying an appliance from Sears or GE, it's an insurance company or government contractor getting software from an individual or a company with nine employees.

You can't use that to force improvements from small entities because they barely even have lawyers to tell them what they have to do, and nobody will actually sue them if they have no money anyway.

What you need isn't for the software vendor to be liable, it's for the company holding all the customer data to be liable to those customers. Then those companies will start caring about actual security instead of "compliance" and figuring out how to pass the buck, and software vendors will still have to make secure software because nobody will buy anything else anymore.

It also forces companies to start treating huge databases as the security liability that they are. And it conveniently applies to the _large_ tech companies that are also data warehousing companies like Yahoo or LinkedIn/Microsoft.

<comment><USER4> "it's an insurance company or government contractor getting software from an individual or a company with nine employees."

The good news is high-assurance systems have been built with smaller teams than that. We also have cases like Bernstein's where one person builds all kinds of stuff with provably better security using a bit of brains and methods that work. We also have tools like SPARK for static systems and Rust/Eiffel for larger ones that can easily eliminate entire classes of attack. Ada & SPARK have been around decades. Eiffel over a decade. Hardly anyone in security-critical space using them.

Most of what you see is easily prevented. Even with small teams. They just don't care or try. A baseline stopping code injection or insecure configurations would knock out a _ton_ of problems. The next thing that would happen, as did with DO-178B regulation & TCSEC, would be reusable components and consulting services designed to meet the standard where the cost & limited expertise is spread among many customers.

It could be done. Even for smaller players to a large degree.

"What you need isn't for the software vendor to be liable, it's for the company holding all the customer data to be liable to those customers."

Doesn't solve the DDOS problem which can also be used for extortion, interfering with government operations, etc. My approach targeting root cause handles that, too.

<comment><USER3> Oh absolutely, it isn't that small teams can't create secure software, it's that product liability isn't the way to do it. Because when the lawyers come for the bad coders they just turn their pockets inside out and then go back to writing bad code, while all the HMOs carry on using OpenSSL and vulnerable XML parsers.

> Doesn't solve the DDOS problem which can also be used for extortion, > interfering with government operations, etc. My approach targeting root > cause handles that, too.

Can you be more specific about your DDOS solution?

<comment><USER4> "Can you be more specific about your DDOS solution?"

The root cause is 0-days in software or bad configuration of mass-market products in most cases. The former can be detected automatically by many tools. The latter can, given the flaws I've seen so far, be spotted in 5 minute review by an amateur consultant. Mandating such things in a regulation or expecting them as "reasonable, professional standard" during a lawsuit would be a start. Prevents many DDOS bots as a side-effect.

My main solution to DDOS mitigation in the interim & part of long-term package is here:

[https://news.ycombinator.com/item?id=13266108](https://news.ycombinator.com/item?id=13266108)

</comment></comment></comment></comment></comment><comment><USER5> Throwaway because I work in a related field.

This is a public service announcement: if you haven't seen enough information to prove to you, independent of the claims of the White House, CIA & FBI, that Russia was behind this, you should file a Freedom of Information Act Request for sufficient evidence to independently reach that conclusion. Citizens of the US in particular should do this to hold their government accountable -- we can not let it be accepted that because POTUS says something, and maybe has confirmation from "anonymous sources" within the CIA & FBI (e.g. as reported by the NYTimes[1]), that it must be true.

Muckrock[2] makes it dirt-simple to file a FOIA request. Hold the government accountable -- they work for us.

1: [http://www.nytimes.com/2016/12/09/us/obama-russia- election-h...](http://www.nytimes.com/2016/12/09/us/obama-russia-election- hack.html?_r=1) 2: [https://www.muckrock.com](https://www.muckrock.com)

<comment><USER6> While there's no harm in filing additional FOIA requests, let's also add some deductive reasoning to the mix. Is this consistent with Russia's actions in other countries and contexts (as well as their own)? Yes. [http://warontherocks.com/2016/11/trolling-for-trump-how- russ...](http://warontherocks.com/2016/11/trolling-for-trump-how-russia-is- trying-to-destroy-our-democracy/)

Have individuals close to the Kremlin strongly implied they had a role in this and have senior Russian officials stated clearly that they had contact with the Trump campaign during the election? Yes. [http://www.haaretz.com/world- news/u-s-election-2016/1.752386](http://www.haaretz.com/world-news/u-s- election-2016/1.752386)

Did Russia even object today on the grounds that the allegations about their role were false? On the contrary, they were practically doing a victory lap.

There are plenty of debates still very worth having about whether the actions taken today are appropriate, whether a hostile stance towards Russia is merited, etc. But I've seen enough to convince me that Russia was engaged in an information operations campaign to cast doubt about the U.S. election and help Trump on the margins.

<comment><USER5> Russia has denied involvement with this incident in the past[1].

I would encourage considering applying the same standard that we would apply to a trial by jury. Simply indicating that someone is a repeat offender, and would have reason to commit an offense again, does not itself meet a standard of evidence of actually committing that offense.

1: [http://www.politico.com/story/2016/12/kremlin-denies- putin-d...](http://www.politico.com/story/2016/12/kremlin-denies-putin-dnc- hacks-232686)

</comment></comment></comment><comment><USER7> > But why is this so bad? Because it does not follow the intent laid out by > the White House and confuses readers to think that this report is about > attribution and not the intended purpose of helping network defenders.

Looking at the comments in yesterdays' thread[1], this is absolutely true - many, many people posted some variation of "What? There's no evidence proving Russian involvement in here at all!"

1\. [https://news.ycombinator.com/item?id=13279600](https://news.ycombinator.com/item?id=13279600)

<comment><USER8> That's right, I was one of those confused people. I assumed this would be the WH presenting what evidence they have.

Sooo... still no public evidence that Russia leaked the DNC and Podesta's e-mails?

<comment><USER9> Read the original CloudStrike report. Not the government report but the private security firm report. The government report is really just a restatement of that report. You don't track hackers for a decade to suddenly be wrong because of a governments political stance.

<comment><USER8> No idea why you're bringing politics into this. All I said was no evidence has been made public by the government.

<comment><USER10> > All I said was no evidence has been made public by the government

Except that's _explicitly_ not what you said. You said:

>still no public evidence that Russia leaked the DNC and Podesta's e-mails?

Your original claim was that there was _no public evidence_. When that claim was challenged, you pretended your claim was about what evidence was provided by the government.

<comment><USER8> Sorry, my intention wasn't to move the goalposts, I actually misspoke the second time. Obviously I don't care where the evidence comes from. I did mean "no public evidence" and then the parent made it political, somehow.

I did read the RPT-APT28 report by FireEye on APT28 (all fifty-something pages, surprise!). It did convince me that APT28 has political motivations. What's the connection between that and DNC/Podesta? I don't know, because there's no public evidence on that (that I know of).

</comment></comment></comment></comment></comment></comment><comment><USER11> Still lacking any evidence that voting machines were hacked or any part of the electoral process was hijacked. The worst damage? Emails related to the actual rigging of the Democrat Party primaries and the collusion of the media with the Democrat party. Its very hard for me to believe that a state actor is behind such seemingly altruistic actions. Voters saw the worst of Trump and Clinton and choose the lessor of two evils. Wikileaks and "the Russians" simply provided a level playing field.

<comment><USER12> How on earth did a leak of DNC emails, but no corresponding RNC leak, help people figure out the lesser of two evils or provide a level playing field?

Seems obvious that leaks assisting the pro-Putin candidate were not altruistic.

<comment><USER3> Assuming Clinton had those dirty secrets and Trump had nothing equivalent, that's what a level playing field looks like.

If you want to assume there were also some dirty Trump secrets that didn't come out then it seems like the only way to "level the playing field" would be for e.g. Venezuela to hack the Republicans and air their dirty laundry too.

And people are running around saying how terrible this is and asking "what if everybody did this?" But it seems like the answer to that question is, then people would know more relevant information about their political candidates. Or politicians would get better at computer security. Which of those is supposed to be bad?

<comment><USER13> > Assuming Clinton had those dirty secrets and Trump had nothing equivalent

Those are two rather incredulous assumptions considering that:

\- Clinton released all of her tax returns, whereas Trump didn't release any

\- The Clinton Foundation has been audited by at least three well respected, independent, organizations (garnering top ratings from all), whereas we know comparatively little about the Trump Foundation (or whatever it's called), yet it's admitted within the last six months to several inappropriate expenditures or donations, and is likely being investigated for more

\- Trump sits atop a network of literally hundreds (if not thousands) of "independent" corporations designed solely to evade disclosure, liability, taxes or some combination thereof

</comment></comment></comment></comment><comment><USER14> So it was just spearfishing, the poor man's hacking technique.

The techniques that NSA and MI6 use are far more advanced. Taking advantage of the networking equipment and injecting traffic.

<comment><USER15> > So it was just spearfishing, the poor man's hacking technique.

Just because someone walked in through an unlocked window does not make them any less an effective burglar.

</comment></comment><comment><USER16> The white house and the document itself never list attribution as the goal. Robert M Lee seems to think because it refers to the attackers as Russia, it is confusing readers. The summary at the beginning makes it clear to me that the document is presupposing the attacker is Russia as to be consistent with all future public reports.

I don't think this is the best written report, but his conjecture around completely leaving out attribution if it doesn't include evidence seems rooted in playing to the lowest common denominator (ie poor media coverage of what this report entails)

<comment><USER17> The timing of the release of this document, at the same time as the announcement of sanctions on Russia for the hacking, can't be overlooked.

It's quite reasonable to assume the release of this report was intended to create the impression of evidence for attribution, even if it actually contains no such thing. Otherwise why not release it on any other day to avoid confusion? It looks to me like the confusion was quite intentional.

<comment><USER16> White House stated pretty clearly why the Grizzly Steppe report went out: "to better help network defenders in the United States and abroad identify, detect, and disrupt Russia's global campaign of malicious cyber activities."

[https://www.whitehouse.gov/the-press- office/2016/12/29/fact-...](https://www.whitehouse.gov/the-press- office/2016/12/29/fact-sheet-actions-response-russian-malicious-cyber- activity-and)

Attribution is sexy and the media likes to talk about it. I don't believe the confusion was intentional. The White House is pretty bad at PR and 'never ascribe to malice that which can be explained by incompetence'

<comment><USER18> > The White House is pretty bad at PR

They have a press secretary whose job is, literally, to manage the media. I'm honestly not sure if your post was intended as satire.

The meat of the report might as well have been copy pasted from OWASP. So if it's not to provide political cover for the yet-to-be-proven claims that Russia did it, they didn't get the message out.

</comment></comment></comment></comment><comment><USER19> I agree with the assessment. While parts of this official communication were well written and intentioned, it feels like others weren't.

> at least in a vendor report you usually only get 1 page of marketing instead > of 8

That was also my reaction when I scrolled down past page 4-5. It almost feels like they could have split this particular report into:

1)public-and-media-facing high level technical overview

2)actionable intelligence information for defenders

With 3) being the attribution and evidence coming at some point down the road.

</comment><comment><USER20> Seems to me that the DNC had really sloppy security and that many groups could have compromised their servers. If the government has proof that Russian actors did so, they do not appear to have any proof that the info was used maliciously.

The whole report, and media coverage, and statements by public officials are so confused and confusing that they are useless in regards to security.

I have to compare this to the FDA's HIPAA regulations which mostly are just instructions on how to correctly secure servers and applications. However, I wish that HIPAA did not have these regs in it because they are susceptible to falling out of date.

Rather, I think the public would be better served by an official security standard that can be updated weekly with new advice and requirements. Then an org like the FDA can have one regulation covering security that says something like "all systems must be secured according to Federal Infosec Guidelines level B3 or higher". The specifics of what B3 might mean and higher levels of securing servers and apps, can be in a single document that would, I am sure, become a core part of the curriculum for developers and system administrators.

Moaning and whining about water under the bridge is a waste of energy and of public funds. This is a fixable problem if only someone in leadership is willing to act. Not grandstand or apportion blame, but act to improve infosecurity for everyone.

A well drafted set of infosec guidelines by industry experts along with a process for keeping it up to date will have incredible multiplier effects throughout industry as well as government, because it makes it much easier for management to order that things be secured, and it makes it much easier to get a consultant to validate that the guidelines have been correctly implemented.

<comment><USER21> Such federal standards have existed for decades now. Have you heard of the NIST Special Publication 800 series? They are quite comprehensive, although prohibitively complex for smaller agencies to implement stand-alone.

</comment></comment><comment><USER22> Has Scheiner written anything on this report?

I will say this; the Podesta emails revealed a lot about the internal politics of the DNC. Why are we not treating this type of leak with the same level of respect as the Ellsberg leaks? Or for that matter, the Snowden leaks? Who is really controlling the narrative here?

<comment><USER23> What was the public interest in his lobster recipe? Or creating a paranoid frenzy that got shots fired at a Pizza place?

Randomly dumping personal emails isn't the same as Ellsberg and Snowden working with reporters to blow the whistle on specific transgressions in war and mass surveillance.

Interesting article exploring this issue of exercising discretion and developing new ethics in the age of leaks: [http://www.nytimes.com/2016/11/05/opinion/what-were- missing-...](http://www.nytimes.com/2016/11/05/opinion/what-were-missing- while-we-obsess-over-john-podestas-email.html)

<comment><USER22> Obviously the pizzagate stuff is stupid and unfounded. It does a great disservice to people that were victims of real sexual abuse.

But can't you see the vast amount of corruption? The DNC rigged the primary for one candidate. We need to hold our political parties accountable for their actions.

<comment><USER24> They preferred a candidate, but 'rigging' implies fraudulently manipulating the votes, which didn't happen.

I'd like to see the RNC's emails now. What kind of dirt do the republicans have? Is it not being released because it's being used to blackmail them?

<comment><USER25> Rigging doesn't specifically mean manipulating votes. It means taking what is presumably an open and fair contest and taking some actions to ensure it isn't.

The big things that came out of the leaks for me is the explicit and cosy relationship with specific members of the media who were instructed to produce and disseminate certain messaging against Bernie Sanders.

They also asked those "media resources" to prop up Trump, Cruz and Carson because they naively believed that Trump would be a push-over, for example.</comment></comment></comment></comment></comment>


Scareware launched from tech blog - <AUTHOR> http://news.bbc.co.uk/2/hi/technology/8328399.stm <comment><USER2>
      > Blaming the fact that staff used Linux operating systems
      > on their production machines for "not noticing sooner",
      > it advised concerned users to load some up-to-date
      > antivirus software and "make sure your system is clean".

So running a secure/safe/immune system is a liability, because you may not notice problems that users, who run less secure/safe/immune systems, will have.

Hmm. Interesting observation. Good job I run three or four "typical" insecure setups on which to test things before deployment.</comment>


Making Electronics Just Got 25% More Expensive in the US - <AUTHOR> https://hackaday.com/2018/06/15/making-electronics-just-got-25-more-expensive-in-the-us/ <comment><USER2> After all these years I was just about to try using macrofab and getting electronics produced in the US for the first time. I guess that doesn't make sense now.

I thought this was all about encouraging US manufacturing jobs?

</comment><comment><USER3> This is a bit sensationalized. Cost for many parts will increase by 25%, but there's more to 'making electronics' than a pile of parts.

<comment><USER4> Correct, but the BOM has direct impact on costs incurred.

</comment></comment><comment><USER5> The 25% tariff is just for China, or? Do manufacturers in countries like Japan or Germany exist?

<comment><USER4> If you're doing anything involving electronics at mass market consumer cost/scale it is extremely likely to be manufactured in China.</comment></comment>


Associations of Thought: On Jane Austen - <AUTHOR> https://hudsonreview.com/2018/01/associations-of-thought/#.Ws9Y1ujOW00 <comment><USER2> interesting to find this on Hacker News - nice post!</comment>


"Keep Moving": Marissa Mayer's First Memo to Yahoos - <AUTHOR> http://allthingsd.com/20120719/yes-keep-moving-marissa-mayers-first-memo-to-yahoos-natch/

<comment><USER2> It is fun to see this memo, but it does not tell me anything useful. I will be looking for three key things that will determine a lot about how Marissa's tenure will go.

1\. When she starts actually changing things, what changes will she make? The importance of this is obvious?

2\. Who is going to follow her from Google? Sure, she's not allowed to solicit, but people are allowed to solicit her. Good execs usually have a core follow them to a new position, and this core is essential to any possibility of success. (For an extreme and unlikely example, if Jeff Dean were to follow her, I'd buy Yahoo stock immediately, even if I had to borrow money to do it.)

3\. What will motherhood take out of her? Like a lot of high-powered women, she appears to think of motherhood as being something she can limit and compartmentalize. Judging from the experience of other new parents that I have known, and my memories of my own children, she's in for a shock. What will the impact be? (She may or may not succeed in hiding it.)

<comment><USER3> > "Please come by my office in building D on the third floor and say hello."

I'd add another (possibly minor) item to your list, which is 'What actually happens if an employee goes to her office in building D on the third floor to say hello?'

Might sound trite but if someone makes this offer and those who take it up get rebuffed then I'd say it's not a good signal. Sure, she's crazy busy but she didn't have to make the offer and anyone who turns up obviously cares to some extent.

</comment></comment><comment><USER4> Is nobody here working at a public company? These memos all look the same. They mean exactly nothing and people really do not care about them. Want a free template, here you go:

Dear $EMPLOYESS_OF_COMPANY,

$COMPANY is close to my heart because, because, because.

You people are the most important asset. Talent. Innovation. Amazing. Don't drop the ball. Bla bla bla. Need time to figure out what to do next.

Thank you $FORMER_CEO.

Talk to me.

$NEW_CEO

<comment><USER5> > You people are the most important asset. [Except I will become the highest > paid one by an obscene multiple order of magnitude.] Talent. Innovation. > Amazing. Don't drop the ball. Bla bla bla. Need time to figure out what to > do next.

added something to the template

</comment></comment><comment><USER6> An idea for companies sending out "do not forward" memos:

Have specific words in the memo (eg: first adjective in paragraph #1, verb in paragraph #2 and adjective in sentence #5) and use combinations of randomly selected words (or punctuation) to create a "signature" for each recipient. Would be easy enough to do automatically. For example employee #1 gets "This move is great for the company..." and employee #2 gets "This move is brilliant for the company..."

Although I guess if you need to do such a thing you have bigger problems and if employees know such a thing is done then they'll obfuscate their own memos when sharing.

<comment><USER7> I think it's better to make even more subtle changes like replacing some normal spaces with non-breaking spaces, or using digraphs in some words and not in others.

<comment><USER8> That sounds easier to mechanically revert, though.

</comment></comment></comment><comment><AUTHOR> Wow, I'm impressed she invited anybody to stop by her office anytime to meet her and share ideas. Pretty cool.

<comment><USER9> Based on Google's culture (or what I have heard about it), I don't think this is surprising.

It also lets her get introduced to the people at Yahoo! who have ideas, those that are still passionate about the company, and those that will make a difference.

<comment><USER10> The only reason this isn't surprising is that every new executive in the history of business has proclaimed an open door policy. Email would be far more efficient to deliver and review ideas on their merits. Open door is more about gauging the political climate and finding out who will be a follower from the get-go, who is star struck, etc.

<comment><USER11> And then they go on to put secretaries in the room in front of the open door to stop people from going through the doorway.

I once happened to walk past the open door to the office of the Director of the CIA. I briefly considered walking in to say, "Hi," but then I thought better of it.

</comment></comment></comment></comment><comment><USER12> I'd love to see her take that cash and talent and completely throw the company through a renaissance. Yeah, fire all those people like everyone else is saying. Now run the company like a start-up. A start-up that has 2.5B and is profitable on projects on cruise-control.

Google is getting love and attention for the ambitious ideas it has about the future, yet it's still focusing resources on G+. Yahoo! has an opportunity to focus entirely on it's own ambitious visions.

</comment><comment><USER10> What will be interesting is to see if yahoo now becomes more google-like and the two companies try to compete to be the most relevant. Google is very cult like in it's image of corporatey perfectionism and superiority. What is going to happen if Yahoo actually turns it around and builds the same image? Would tech be big enough for two Google sized corporate egos?

<comment><USER13> Have you ever seen a CEO who brought significant change in a major company. Allright, Steve Jobs, maybe, but he was a funder in the first place so it doesnt really count.

And even if it did, let me break it for you. She is not Steve Jobs.

</comment></comment><comment><USER13> Typical Corporate bullshit. Harly surprising for a first memo, but seeing Yahoo and 'bold innovation ' in the very same sentence made me laugh. She has no clue about Yahoo or what?

</comment><comment><USER14> Reading this memo, she seems more like a manager instead of a leader. Nothing inspiring, just orders. Also, very awkwardly written.

</comment><comment><USER15> With the exception of whistleblowing it is wrong to publish internal communications that were clearly meant to stay internal.

How would Kara feel if her email was compromised and someone decided to choose which emails should be made public for no other reason than voyeurism and pageviews?

HN shouldn't even allow the links.

<comment><USER16> It's a journalist's job to get the internal story, even if that requires exploiting various forms of petite disloyalty. Also, a rah-rah message this generic was written with the expectation it would be leaked.

And, Swisher as a journalist would likely expect (and perhaps even respect) if her own correspondents leaked her own emails, if and when it could advance a story of industrywide interest. Journalists aren't especially thin-skinned, naive, or hypocritical about such things.

<comment><USER17> Interestingly, Swisher's spouse is a VP at Google.

</comment></comment></comment><comment><USER18> So so much text to say absolutely nothing. But let's see how long before she starts cleaning out the house that will be the big indicator

</comment><comment><USER19> Would Kara Swisher please openly admit she has a grudge against Yahoo? And I thought HN wouldn't promote such blatantly passive-aggressive articles to the front page. I thought this is a place for intelligent, well-reasoned debate. Oh well, now I know better.

<comment><USER20> She comes across so smug and arrogant, it's uncanny. Definitely no celebration of the bold move or tough challenges here.</comment></comment>


How I Got Estonian E-Residency (and why you might want to too) - <AUTHOR> http://impossiblehq.com/estonian-eresidency/ <comment><USER2> Estonia is not all e-voting and forward-thinking, unfortunately.</comment>


Welcome - <AUTHOR> https://html5zombo.com/ <comment><USER2> Flash has had a arduous history, but its hard to argue that the Flash-era wasn't a lot of fun!</comment>


Steve Jobs and Eric Schmidt Spotted Together Again: Photos - <AUTHOR> http://www.businessinsider.com/steve-jobs-and-eric-schmidt-spotted-drinking-coffee-together-2010-3

<comment><USER2> I know this is vaguely relevant to people interested in the gathering hostilities between Google and Apple; yet I can't help but see this as tabloid material, in the style of "Brad and Angelina Spotted Together Again".</comment>


The enigmatic complexity of number theory - <AUTHOR> https://mathoverflow.net/questions/282869/the-enigmatic-complexity-of-number-theory <comment><USER2> Is there a name for the principle that the more interesting a topic is on a Stack Exchange forum, the more likely it is to be closed?

<comment><AUTHOR> And Scott Aaronson quits mathoverflow due to this "off-topic" policy:

[https://mathoverflow.net/questions/282869/the-enigmatic- comp...](https://mathoverflow.net/questions/282869/the-enigmatic-complexity- of-number-theory#comment698104_282869)

<comment><USER3> This is so sad, MathOverflow was once such a great community. Here is his comment for context:

> I regret to say I'm ending my participation in MathOverflow, for the same > reason I decided a decade ago never again to edit Wikipedia. It's hard to > express how disheartening it is to spend hours of volunteer labor explaining > stuff---in this case, in a way that at least 19 MO users apparently found > useful---only to have your work overridden by a smaller set of users, for > being (part of something larger that's) "off-topic" or whatever it is. Who > the hell has time for that? From now on, if I have math questions, I'll post > them on my own blog. Was nice being here for 6 years; thanks everyone. – > Scott Aaronson 3 hours ago

</comment></comment></comment><comment><USER4> I'd pose this as caused by the simplicity of calculating in Z as a ring. This has allowed us to experimentally find many interesting true conjectures.

Number theory is no more complicated than any other system. What differs is the ease by which we can find statements that are probably true. If the field appears more complex, that might be because we've been enticed by these probably true statements.

<comment><USER5> I'm not so sure about that. Take a look at cellular automata. It's pretty trivial to screw around with them (though not as easy as with integers, I'll grant you). Where are the theorems? There seems to be an awful lot of land, but no maps.

To a lesser extent, graph theory has this problem as well. In the ~60 years that it's been a subfield in its own right, we haven't got an awful lot of fundamental new methods. Results being proven today could be easily understood by a graph theorist from 40-50 years ago transported ahead in time, perhaps after at most the equivalent of a semester-long grad course.

<comment><USER4> Cellular automata are much harder to screw around with. Partly that is because computation by hand is a lot harder, partly because there isn't much that one can combine.

What makes the integers interesting is that addition, multiplication and exponentiation are all easy, all operate on the same numbers, and yet they behave very differently. This allows one to pose very easy questions (e.g. Can I express every prime as a sum of ...) that have no obvious solution to them.

</comment></comment></comment><comment><USER6> Yes

Number Theory is a tough nut to crack and I feel that, while mathematicians have advanced a lot, there hasn't been any "master theorem" to handle it

Factorization, one way or another, still is done with brute-force (even if it's done in the EC domain or with NFS or related algos). Same for modular logarithm

Most of the theorems still fell like digging a pool with a spoon. Fermat's last theorem was finally proven, with a lot of effort and diversions. It really seems we're missing something "basic" (but complex) about it

<comment><USER7> I'm not so sure that we're missing anything basic. The top rated answer by Scott Aaronson seems spot on to me. The natural numbers are just too powerful. As the resolution of Hilbert's tenth problem shows, we can at best hope to solve special cases of statements involving natural numbers, and the solvable cases are bound to require techniques of increasing complexity.

What would count as a "master theorem" for some field, anyway? I suppose something like Tarski's quantifier elimination of semialgebraic sets over R^n might be an example, though for actual computations the best algorithms have double exponential worst case complexity (i.e. even worse than integer factorization). Or for something even more basic, perhaps the fundamental theorem of linear algebra (along with Gaussian elimination). There's the saying that mathematics is the art of reducing any problem to linear algebra -- I suppose the hard problems in number theory are the ones that don't have a good linear algebra reformulation :-)

<comment><USER6> Yeah I read that comment and I agree with you

> What would count as a "master theorem" for some field, anyway?

I think you gave good examples, but it could be something like the discovery of Calculus, where suddenly a lot of problems became tractable. And in the end we even managed to solve (some) differential equations by solving polynomial equations.

So maybe you're right and it's linear algebra all the way down, but we're missing the weird trick to convert a factorization problem into a polynomial or something like that

</comment></comment></comment><comment><USER8> The closest thing number theory has to a Grand Unified Theory is the Langlands program. It's a huge, highly interconnected, often surprising bunch of conjectures relating number theory to geometry, algebra, and even[s] string theory -- and also something that I know next to nothing about. :)

I'll put the Wikipedia[w] intro here, and note with some happiness that Frenkel has used that exact phrase before:

> _In mathematics, the Langlands program is a web of far-reaching and > influential conjectures about connections between number theory and > geometry. Proposed by Robert Langlands (1967, 1970), it seeks to relate > Galois groups in algebraic number theory to automorphic forms and > representation theory of algebraic groups over local fields and adeles. > Widely seen as the single biggest projects in modern mathematics, Edward > Frenkel described the Langlands program as "a kind of grand unified theory > of mathematics._

Wiles' proof of the modularity theorem (and hence Fermat's Last Theorem) is a proof of a some of the Langlands conjectures "in dimension 2": one of the pinnacles of human mathematical achievement is just _an incomplete portion of_ a special case of Langlands' vision.

> Andrew Wiles' proof of modularity of semi-stable elliptic curves over > rationals can be viewed as an instance of the Langlands reciprocity > conjecture, since the main idea is to relate the Galois representations > arising from elliptic curves to modular forms. Although Wiles' results have > been substantially generalized, in many different directions, the full > Langlands conjecture for GL(2, Q) remains unproved.

To give you a little taste, here's a 10000-miles-above-the-ground view of what this says.

A modular function is a certain kind of object in complex analysis (something like calculus with complex instead of real numbers[c]).

A Galois representation starts with a Galois group, which tells us something about the large-scale structure of a number system, and extracts[p] ("represents") a small part of the information it contains: the full "absolute" Galois group is incomprehensibly complicated. Every elliptic curve gives rise to these representations.

There's no reason these things should be related: most number thought the modularity conjecture was an improbable goal. Now think about how it's just a tiny part of a much larger whole. They don't call it "fantastically bold"[n] for nothing.

\---

[w]: [https://en.wikipedia.org/wiki/Langlands_program](https://en.wikipedia.org/wiki/Langlands_program)

[s]: [https://physics.stackexchange.com/questions/4748/why-is- ther...](https://physics.stackexchange.com/questions/4748/why-is-there-a-deep- mysterious-relation-between-string-theory-and-number-theory)

[n]: [https://golem.ph.utexas.edu/category/2010/08/what_is_the_lan...](https://golem.ph.utexas.edu/category/2010/08/what_is_the_langlands_programm.html)

[p]: As I understand it, Wiles' proof only uses 2-dimensional representations.

[c]: ... but it's hard to overstate how much nicer and more uniform everything becomes!

<comment><USER9> I would also recommend the book by Edward Frenkel, "Love and Math" where he talks about his involvement in the Langland program.

Also, he has a very cool lecture on the subject here:

"What Do Fermat's Last Theorem and Electro-magnetic Duality Have in Common?" [http://online.itp.ucsb.edu/online/bblunch/frenkel/](http://online.itp.ucsb.edu/online/bblunch/frenkel/)</comment></comment>


Show HN: Watch young people present their hacks. YRS - <AUTHOR> https://www.youtube.com/watch?v=k1HEHtXM3J8

<comment><AUTHOR> This is the live stream of the finale of Young Rewired State 2014. 9-18 year olds are given a week to design and build hacks and given the chance to present these projects to a panel of judges.</comment>


Another Taxi Driver in Debt Takes His Life. That's 5 in 5 Months - <AUTHOR> https://www.nytimes.com/2018/05/27/nyregion/taxi-driver-suicide-nyc.html <comment><USER2> Who's idea was the medallion system, the city, the drivers, or both? Were taxi drivers in favor of the system when it first came out? Were they still in favor of it in the mid 2000's before Uber/Lyft?

If the answers to the last two questions are "yes", then I can't help but not have any sympathy for the plight of drivers and the expense of the medallions, especially when I read about taxi customers complaining about rude drivers, credit card machines "not working", having to wait over an hour for a taxi, etc.

The writing is on the wall. It's been on the wall for a couple years now. Taxis as we know it are a dying industry, being replaced by Uber/Lyft/etc.

And good riddance.

<comment><USER3> _And good riddance._

An incredibly callous attitude to take at what must have been a truly profound sense of anguish and despair experienced by a person known to others as their "beloved father, husband, brother, friend." (Yes, I know you're saying that mostly about the medallion system. But to the extent that that's _all_ that comes to mind when you hear about what happened -- yes, you pretty much are saying that the driver who took his life in this case, as well).

<comment><USER2> I suppose you're right. That does come off as a bit callous. Maybe I should rephrase my stance.

I'm glad the taxi industry as we know it is dying. However, it is a bit tragic that it is ruining the livelihood of taxi drivers on its way out so badly that they're committing suicide.

But is this any different than any other industry being replaced? Certainly we have sympathy for coal miners that have lost their jobs as our chosen sources of energy shift, but should that make us appreciate the shift away from coal and its destruction of our air any less?

</comment></comment></comment><comment><USER4> Overall inequality issues include taxi drivers, gig economy, etc.. but many of those types of jobs will mostly disappear due to automation. UBI maybe unavoidable as there won't be enough un/low-skilled work to go around and people have to eat.

As an anecdote, I attended a bankruptcy proceeding at a federal court in Redding where one woman had a cancer medication pump tube going in her nose. She lost all of her savings and almost everything else due to insurance not covering expenses.. and she's Stage IV. Imagine involuntarily dying painfully and going broke _simultaneously._ This is worse than suicide because while otherwise healthy it's a choice, cancer rarely is.

The contributing factors are:

0\. The very, very rich have corrupted government to work primarily in their interests.

1\. Technology has increased productivity and eliminated need for as much human effort.

1.5. Oversupply of labor leads to low pay.

2\. People remaining in work have lost real wage gains correlatively with the decline in organized labor and rise in desperate workers both domestic and migrants, and as such, employers do nearly whatever they want to employees.

3\. Outsourcing and closure of domestic production (globalization).

It will take another Roosevelt to save capitalism with some stabilizing half- measures, or the path is marching towards decline and likely rapidly- precipitating, populist communism like Venezuela. A third option that would work, but will not be considered without some violent and nonviolent force of the people: strong, appropriate regulation, removal of wealth welfare for the rich, fixing the tax code to eliminate loopholes for the rich, non-capitalist- influenced leadership and comprehensive investment in health, wellbeing, social services, UBI and helping workers out of intolerable life situations.

<comment><USER5> >This is worse than suicide because while otherwise healthy it's a choice,

Not to argue with anything else you are saying, just this line:

This is a myth. Suicides are very rarely "otherwise healthy", but are the outcome of a mental illness, such as depression. By the same line, they are not a choice - usually they are the outcome and a symptom of a generally treatable condition.

Suicides, self-harm, attempts or ideation/fantasizing about them are not healthy, and usually aren't a choice, no more than a runny nose is a choice.

If you or someone you know exhibits these symptoms, get help.

<end PSA>

<comment><USER6> I think it is a lot more complicated than that.

I have an incurable medical condition. I am frequently incredibly miserable. I am frequently suicidal, in part because it is literally the only means to really escape the misery my body inflicts upon me.

I am pro right to die. There are circumstances under which it is cruel to act like wanting to end this situation the only way it can be ended is somehow crazy.

I am still here. I am doing all I can to pursue non-drug alternatives, for which the entire world gives me shit. That also fuels my suicidal ideation because it is such a no win, fuck you situation on so many levels.

But I wish people would not simplify this for some feel good PSA and act like wanting to die is simply evidence you are crazy. It is just not quite that cut and dried.</comment></comment></comment>


Jane's has spruced up its site - <AUTHOR> A rebranding exercise at Jane's to reflect its move out of IHS.<p>https://www.janes.com/ <comment><AUTHOR> [https://www.janes.com/](https://www.janes.com/)

Edited to add: The rebrand has decided that Jane's no longer needs the possessive. Slippery slope, methinks.</comment>


Clothes may make the man, but it's the label that really counts  - <AUTHOR> http://www.economist.com/node/18483423?story_id=18483423&fsrc=scn/tw/te/rss/pe

<comment><USER2> It is an interesting point but somewhat well known. It explains the proliferation of designer bags in China and in Japan. It is one indicator of social proof.

Though to be honest I do believe a well designed suit stands out significantly. It is very easy to tell a 5000USD suit from a 100USD suit.

</comment><comment><USER3> Used to be that those who could would wear clothes with their own monograms.

Nowadays it seems the cattle is willing to pay for the "privilege" of being branded with someone else's iron.

O tempora, o mores, etc.</comment>


Ascii.io - No nonsense asciicasting for serious hackers - <AUTHOR> http://ascii.io/

<comment><USER2> This is terrible. It needs step controls for the transport. For example, I didn't see the exact command used to start the 'Nyancat' demo, and the Cap demo is pretty fast-scrolling. If I can't rewind to catch stuff I miss, then it severely compromises the value as a teaching tool. As a matter of fact, lack of proper transport controls is a huge problem for internet video in general. Solve that and you will be covered with gold.

<comment><AUTHOR> "Seeking" feature is already in development so no worries, you will be able to rewind. Right now you can pause/resume. As for Nyan Cat demo, it was recorded with "asciiio -c 'telnet ....'" command which basically doesn't start shell but immediately runs the command you specified.

<comment><USER3> Add seeking and ability to do voice-over and this will become an extremely useful tool.</comment></comment></comment>


InkCase Plus:E Ink screen for Android phone - <AUTHOR>

InkCase Plus is an always on E Ink second screen, uses sports and fitness apps, eBook reader, Photo, get notifications from your phone. InkCase Plus is a supplementary display (Second screen) for Android smartphone; providing smartphones with flexibility and power saving functions. The main function as below. 1.  Battery Saver 2.  It is always ON 3.  Personalization
4.  Reading 5.  Sport 6.  Notification 7.  Incoming Call Alert 8.  Music Control <comment><USER2> I like it. where can I buy?</comment>


Genome-wide association analyses provides new insights into circadian rhythms - <AUTHOR> https://www.biorxiv.org/content/early/2018/04/19/303941 <comment><USER2> It's interesting to me that they chose to limit the polygenic risk score to the SNPs at the top 292 loci, rather than using all available SNPs, which has become more common. I would guess that they chose to limit their power in favor of ease of interpretation, but it would be interesting to understand why they actually made their choice.

It's also a bit surprising that being a morning person was associated with earlier age at last childbirth in women. I would have expected being a morning person to correlate with education attainment (which I don't believe they discussed) and therefore with later age at last childbirth (since education generally delays the age at which people start having children).

<comment><USER3> didn't realize this is a common method ..

the correspondence with neuroanatomy is impressive. i s'p, at that level (and i mean, likely even at the proteomic level for those that're particularly studied in that area), it could be easier to have results that can guide intuition. b/c that'd surely the useful thing about these kind of results, i imagine, off the cuff, to most people in the natural sciences: providing hints for further research on causal mechanisms and perhaps a reasonably plausible story or "hypothesis" to be fancy (like ketchup) about it

</comment></comment><comment><USER4> > the mean sleep timing of the 5% of individuals carrying the most > "morningness" alleles was 25.1 minutes earlier than the 5% carrying the > fewest

Does this mean that genetics only account for 25 minutes of difference between when "morning people" and "night owls" sleep?

<comment><AUTHOR> No, that just means the subset of genetics noisily estimated by this particular method & sample can predict those extremes (ie top 5% vs bottom 5%). They don't report the full polygenic score in the paper that I see, although they note the SNP heritability is ~10% of variance (and I assume full heritability is a lot bigger since I do recall chronotype as being highly genetic).</comment></comment>


Web Scraping and Crawling Are Perfectly Legal, Right? - <AUTHOR> https://benbernardblog.com/web-scraping-and-crawling-are-perfectly-legal-right/ <comment><USER2> I don't fully understand the tos of services clause or how that woman won a lawsuit. If that were common wouldn't I be able to put a similiar notice and start collecting payments. I would think everyone would do that causing a decline in visiting random sites.

<comment><USER3> The way it works was not immediately clear to me either.

If you go to her website: [http://profane-justice.org/profane- justice.org/](http://profane-justice.org/profane-justice.org/) (yep, you have to enter this weird URL)

At the bottom, it's stated that if you copy anything, you enter into a contract, and that for each page copied, you owe her money. This is how it works.

I don't think that such clauses are common on websites, probably because:

      1. People don't know that they can do that.
      2. People don't have the patience, energy and financial resources to sue everyone copying things from their personal websites.

So yes, you could put something like this on your website. But let's be honest, this isn't good for the "free" and "open" internet that we all want.

</comment></comment><comment><USER3> Hey thanks for posting my article to HN. Glad that you found it helpful! :)

<comment><AUTHOR> No worries. I'm into aggregation and scraping and your article had some good stuff in it. I've been scraping a site for a project of mine once every three minutes and I thought that was a bit much. Didn't realise it could be as low as once every 15 seconds.

<comment><USER3> The longer between your requests, the better.

If you generate a load greater than what a human would do, this might become problematic. A human wouldn't poke a website forever every 10-15 seconds.

The 10-15 seconds is more for web crawlers. Eventually, a crawler will run out of pages to crawl on a website, so it will stop sending requests to it.

Personally, I would stick to the 3 minutes delay. But it depends on what type of website you're scraping :)</comment></comment></comment>


How I launched flickrup.com in less than two weeks - <AUTHOR> Please Note: the point of this post is not to pitch my site, but rather to provide some of the lessons learned and hopefully spark some interesting discussion.
Flickrup allows people to submit flickr photos and vote on them.
The idea with Flickrup! was to launch a working, stable site as fast as possible. The idea I had when I started working on the site was to be as minimalist as possible in regards to design, code complexity (frontend and backend), db schema design and user authentication to name a few. I also wanted it to be ridiculously easy to submit and vote on photos. So here are some of the things I did.
frontend design:
I used a css framework (blueprint) to assist in creating a grid based layout and also utilized all the predefined styles for elements. Instead of creating my own css classes and ending up with a cluttered mess, I forced my self to use the classes defined in blueprint as often as possible.
I didn't waste time making a logo. The logo is simply a text link to the frontpage.
I didn't clutter the frontpage with flashy css based buttons and login/signup links everywhere. Instead, when someone hovers over a vote link, a css popup comes up which allows them to vote anonymously or using the flickr account.
I didn't waste time setting up a blog for the site.
backend design:
No brainer: I used a well known php framework (codeigniter) and forced myself to use as many classes and helpers they had to offer including: (pagination, session control, url helper, captcha, date helper)
I had a problem that needed some solvin' and I was greatly tempted to roll my own solution, but I searched until I found an already existing one.
Database:
I have four tables. That's it. Photos, sessions, users and votes.
Authentication:
There isn't an ugly login/signup link to be found on the frontpage and it doesn't need one. Logging in is inconspicuously placed in the flow of voting and submitting.
You don't have to sign up to use the service. You can vote and submit anonymously. It's true that you can vote for a photo as many times as you want as an anonymous user, but so what? If someone wants to spend their precious time painstakingly figuring out the captcha a dozen times to fluf their votes, who cares? <comment><USER2> I love it that "flickr" phonetically means "faggot" (flikker) in Dutch and "flickrup" means "fuck off" (flikker op).

</comment><comment><USER3> <http://www.flickrup.com/>

<comment><AUTHOR> thanks

</comment></comment><comment><USER4> Can you make it so that "comments made" next to the picture on the front page links to the comments on flickr? It's a little annoying to click on a picture twice and scroll down just to see the comments.

<comment><AUTHOR> done and done

<comment><AUTHOR> I get down voted because I actually implemented what he said?

<comment><USER5> Possible someone just hit the wrong arrow. Happens from time to time :\

</comment></comment></comment></comment><comment><USER6> Can you change the captcha implementation? I tried a few times and could not get it right. The text is not clear. Believe me, i'm a human :)

</comment><comment><USER7> Looks very nice. The fact that you got it up just using the standard tools rather than reinventing the wheel shows remarkable restraint for a coder (wish I could stop reinventing wheels :( ).

Must look into blueprint, CSS frameworks seem to be the way to go.

Well done

</comment><comment><USER8> Nice...i like the simple design and functionality.

But, a serious question in regards to how you implemented it. Isn't that how you would usually go about implementing something?

As in, the rule of thumb is: think of the least functionality needed to launch a first version, use a CSS framework to avoid writing your own, use a JS framework to avoid writing your own, start up with a simple design, use some kind of code framework to avoid re-implementing common functionality such as authentication and caching..., and so on....

After testing the water with that, you can start replacing stuff if needed, hiring a designer for a more fancy look and the like...

<comment><AUTHOR> Yes all those things that you mentioned are done by default. What I'm simply saying is that you have to watch out for the temptation of adding non-critical features or rolling your own solution without doing your hw first. It's easier said than done.

In regards to design, people spend a lot of time creating photoshop mockups, then modeling it with css and html. I'm just saying, if you want to get it done quickly, just skip all that and keep it minimal.

</comment></comment><comment><USER9> Very nice, concise writeup on getting the idea to the ground. I must shamefully admit, I've been quite guilty of ideating a lot of the no-nos you've talked about!

</comment><comment><USER10> Nice app. Do you use a plugin for the authentication? I also use CI for some of my projects. Its my favorite PHP framework so far.

<comment><AUTHOR> I use Pear's Flickr api library and then use the built in CI sessions library to handle login/logout.

</comment></comment><comment><USER11> Pretty cool. I'm curious, did you use the Flickr API to process the flickr url and get the thumbnail? or did you scrape it?

<comment><AUTHOR> I just exploded the link using "/", grabbed the ID of the photo and I used the flickr api to make sure that it's a valid photo_id.

</comment></comment><comment><USER12> I've been playing with CodeIgniter, thinking of using it for a small project. Did you like working with it?

<comment><AUTHOR> I love working with it and it's also relatively fast compared to the other existing php frameworks. However, I have not used any of the others, so I can't really compare it. Maybe someone else can chime in.

<comment><USER13> Kohana's a CI fork that's optimized for faster. Think Merb as a Rails fork - lots of love, but a need for something along a slightly different path.

<comment><USER12> I don't think Kohana is faster, I think it's about the same. But it's strict PHP5 OOP, and there are a few other differences.

[http://pr0digy.com/codeigniter/benchmark-static-cake- codeign...](http://pr0digy.com/codeigniter/benchmark-static-cake-codeigniter- kohana/)

</comment></comment></comment></comment><comment><USER14> Cool site. Did you spend all your time on it, or was this something you made on nights and weekends?

It looks nice.

<comment><AUTHOR> I have a full time job so just nights and weekends.

</comment></comment><comment><USER15> Couldn't your domain name be a problem in the future? I always thought trademark owners need to fight other people using their trademark in order to keep it.

So Yahoo will have to ask you to change your domain to something else, right?

</comment><comment><USER16> Love the design. Does anyone have any recommendations for a CSS framework?

<comment><AUTHOR> I do love blueprint. It made the frontend design a snap.

<comment><USER16> The mention of blueprint got me thinking about CSS frameworks and that there's probably alot of value in using one. What are its strengths? weaknesses?

<comment><AUTHOR> CSS frameworks generally do the same thing.

They reset the browsers setting, e.g., setting body, div, span's margins and padding to zero.

They setup the typography, picking a global font, setting up font-sizes, margins and padding for html elements such as h1, p, ordered and unored list, etc...

They provide a way of setting up a grid. Blueprint, by default, uses a grid chunked into 40px segments, creating 940px wide design. You then place divs inline or nested to create your design.

Blueprint also provides some extra goodies like defining styles for forms, error and success styles for divs, and some ie fixes.

</comment></comment></comment></comment><comment><USER17> nice idea, I would be in favour of a longer front-page though..as a side, I'm nearly sure someone either attempted or is about to attempt a similar site using slinkset.

<comment><AUTHOR> Any recommendations as to how many should be shown?

</comment></comment><comment><USER18> Not surprising, on the front page with majority votes: a picture of a cat. Nice application

<comment><AUTHOR> That's because it's newer and so it has a greater weight. The site is brand new so if someone submits garbage, it is very likely that it will end up on the frontpage. This problem should go away as the site grows and people start submitting more photos.

</comment></comment><comment><USER19> The work could have been done in less than 1wk if some web famework(django, ROR) were used.

<comment><AUTHOR> side note: I have a full time job and I just did this on the weekends and after work on the weekdays

</comment></comment><comment><USER20> nice writeup thanks

</comment><comment><USER21> please consider adding categories

<comment><AUTHOR> I could maybe show the top tags used? What do you think?

</comment></comment><comment><USER22> what the fuck _is_ it?

<comment><AUTHOR> flickr photos + voting</comment></comment>


Need Advice on building a product for US market - <AUTHOR> I am a co-founder at an India based hardware startup. We build routers that can bond multiple 3G and 4G connections together and give you a higher combined bandwidth output. Simply put you can insert AT&T, T-mobile, and a Verizon SIM into our device and get an aggregated output of about 20-40Mbps(depending on signal strength).
Our product currently is aimed at the B2B segment in India and other developing countries. We are exploring the possibility of building a consumer grade version specifically for the US market. Something on the lines of Karma wifi, but with multiple redundancies built in and giving a higher bandwidth output. We provide high-speed internet in last mile delivery, where there is no feasibility for wireline internet and you require high-speed internet on the go.
The device would cost less than 300 USD and will have built in battery and can accommodate 3 cellular connections. The form factor will be similar to a power bank. I am looking for advice from people who currently live in the US and who understand markets there. What is the possibility of this device selling in the US? Do you see a market there? kindly advice. Personally, never traveled outside India. So kindly share your thoughts and opinions <comment><USER2> Interesting product. The only use case I see (from an European perspective) is:

You move into a new office building with your small startup team and depending on the country and Internet provider it can take up to six weeks or even longer until you get an Internet connection (even if you just take over an existing account, it's a mess sometimes). Then your device paired with good data plans would be an awesome substitute.

However, nowadays small teams go rather into turn-key team spaces from coworking spaces where all is set. So the real need might be quite small (because there are just so many good offers). Big teams/companies usually move once the target location is fully setup, so they shouldn't need such a device.

Edit: Another thing: Since LTE you can get constant 150Mbit down and up with one SIM and device. There are already plans which offer this 150Mbit up and down and unmetered for 200 EUR/month which is a very good deal considering the specs. And you just need a normal smartphone as the hot spot. So, I wouldn't build such a device.

</comment><comment><USER3> One area where people are rolling their own solutions is live broadcasting by independent journalists.

My advice on the US market is to continue to focus on B2B because:

1\. It is a natural extension of what you are currently doing and that provides the potential for "viral" sales when users change companies or companies expand to new markets or justs because people love your product.

2\. The consumer use cases are probably few and reaching those few will be really hard because the communication channels are very noisy.

3\. A $300 price point is high for consumer networking hardware in the US.

4\. The costs are even higher because of the way consumers consume wireless service in the US. Typically, they have locked phones and a multi-year contract with a single provider. Unlike other parts of the world, consumers tend to _not_ purchase unlocked phones and consume data by purchasing SIMS.

5\. In the US, wireless data only service plans tend to be a premium product.

6\. The existing wireless infrastructure tends to support normal high bandwidth consumer use cases such as watching Netflix.

Good luck.</comment>


African Countries Forced by France to Pay Colonial Tax - <AUTHOR> http://www.siliconafrica.com/france-colonial-tax/

<comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=8876429](https://news.ycombinator.com/item?id=8876429) (67 points, 23 days ago, 41 comments)

The comments are very interesting. Read the complete discussion. I'll copy the first comment by alain94040:

> _That articles looks bogus. For instance:_

> _It's such an evil system even denounced by the European Union, but France > is not ready to move from that colonial system which puts about 500 billions > dollars from Africa to its treasury year in year out._

> _According > to[http://en.wikipedia.org/wiki/Budget_of_France](http://en.wikipedia.org/wiki/Budget_of_France), > that's pretty much equivalent to the budget of the French government. If > that number were true, France finances ought to be in better shape._</comment>