Fake femme fatale dupes IT guys at US government agency - <AUTHOR> http://nakedsecurity.sophos.com/2013/11/03/fake-femme-fatale-dupes-it-guys-at-us-government-agency/ <comment><USER3> There was a comment in the story that I think is misleading - <USER2> women can open locked doors in the male-dominated IT industry._ Attractive women can do that in _any_ industry, it doesn't need to be male dominated. Men are stupid that way (if we weren't stupid that way birth rates would probably be 1/100th of what they are now), you only need a handful of men to have a good probability of finding at least one who is thinking with more than one brain.

<comment><USER4> > (if we weren't stupid that way birth rates would probably be 1/100th of what > they are now)

uh, no. very attractive women don't have kids with the legions of dorks that give them unearned help throughout their life. in any industry.

women aren't stupid. they're actually very smart.

<comment><USER3> Your assumption does not follow from what I wrote, in fact it is practically the reverse since my point was that _any_ industry is vulnerable.

It isn't just "dorks" who give even marginally attractive women special treatment - there are very few categories of men who don't (primarily gay men). Try this experiment out in real life - any time you see a man helping a female stranger with _anything_ consider if he would do the same for a male stranger. The number of times a straight guy will go out of his way for another man who isn't a friend is practically zero.

 _women aren 't stupid. they're actually very smart._

The idea that women deliberately take advantage of "dorks" sounds vaguely bitter and misogynistic.

<comment><USER4> > there are very few categories of men who don't.

yeah, exactly. those are the guys who are getting with the attractive women.

specifically, high value men who don't give handouts.

also, dorks isn't exclusive to IT. every industry has dorks.

<comment><USER5> Oh, you're a "PUA". Good luck with that.

<comment><USER4> i'm not really sure what you're referring to, but i'm talking about pretty basic human psychology.

</comment></comment></comment></comment></comment></comment><comment><USER6> In the outlined scenario there is some basement-dwelling-geek tricked into giving away the keys to the castle by some allegedly mega-fit-babe who is outside the company. This is not the only scenario where this can go horribly wrong.

A few years ago I worked at some company where the computers were well and truly locked down. No facebook, no YouTuBe, no nothing. If it could not be accessed on Internet Explorer 6 for the strict purposes of getting the job done then you was not having it.

However, a charming young lady in some admin department was able to work her charms on the IT department. Somehow it became imperative that, unique in the company, she was able to access all the tedious sites of the internets. It only took a week or two before her computer was well and truly soiled with viruses, e-coli, everything. She did her own 'social engineering' to wreck her computer, however, someone on the outside, had they known that her computer was the weak one, could have social engineered her to install whatever.

Times have moved on since IE6. Nowadays everyone has a smartphone in their pocket and they can do whatever they need to do on that. We also now know that computers are vulnerable. People understand this, they did not back then (IE6 days).

So maybe it is time for offices where confidential stuff gets done to tighten up the firewalls, block the websites and make the office internet access a bit more locked down, with no need to pander to people who 'need' Facebook access at work. Reasons can be provided as to why this has to be and people can be encouraged to use their gadgets for anything social-network-y.

<comment><USER7> I read the article as saying that she worked at the secure (target) agency, hence the fake profile was for someone that already worked at the agency. It was just using a photo of the waitress.

So there's some assumption on the part of the employees that she is already employed by the company, and hence she's been vetted somehow. That would also explain the job offers since other companies would want to poach employees.

Though my take away from this is that there are a lot of men that think that niceness at work is a way into a hot girl's pants.

<comment><USER8> >a lot of men that think that niceness at work is a way into a hot girl's pants.

I am tempted to ask, if niceness isn't, what is?

<comment><USER9> Being an awesome enough human being that it happens the other way around.

<comment><USER8> I dont get it. isn't being nice part of the whole "be awesome" thing. I mean why are males being discouraged from being nice and helpful? O.o i mean i understand it's extremely wrong to be nice for the sole purpose of getting into someone's pants (and equally wrong for people to take advantage of people for being nice to them), but why discourage being nice as a whole? i thought we all went thru HS and college and learned to recognize people who take advantage of our niceness. Just avoid them, and be nice to everyone else

<comment><USER7> Do you think in the article that the men in the target agency were just being nice? If that were the case then the fake male profile the security company created would have received as much help, job offers, and other attention as the female, but clearly that was not the case.

Women, especially attractive women, can easily distinguish genuine niceness and this get-in-your-pants niceness, and while they will take advantage of it all (it would be foolish and stupid not to), they will not sleep with such people.

</comment></comment></comment></comment></comment></comment><comment><USER10> As someone who has worked in the security field the desire to want to help people is still overwhelming. I love PenTests and have had successful ones run on me even when I was vigilant and in the testers faces.

The key reason why I think most confidence penetrations work is because in most cases the "system" doesn't work smoothly enough to not have usability issues. So when you know of credible people who are vetted but are still not "in the system" that becomes an instance of the "system" not working.

Then, inevitably in the few boundary cases where it doesn't work, you get to the point that you know how it will break and will wave over anyone in that specific sitution. If someone knows of these specific "breaks" then by definition they will exploit those knowing that it is a common issue.

If however you stick to the "I don't care what you say, you aren't in the system" then you are now "the inflexible security nazi." Security really is an ethos and it takes only a few pinpricks to make it crumble.

</comment><comment><USER11> If clicking one link leads to your company losing all of its intellectual property, then you have a technology problem. Lazy security "professionals" who can't design good solutions are far too quick to blame users.

<comment><USER12> What kind of security mitigation do you propose?

<comment><USER13> Well, disabling Java applets in everyone's web browsers would probably be a good start.

<comment><USER14> This was a zero day in the jvm. It could very well have been a zero day in the browser or the OS, if someone was determined enough. I'm not sure the problem can be solved purely with technology.

<comment><USER15> No, it was not.

>Visitors were prompted to execute a signed Java applet that in turn launched an attack that enabled the team to use privilege escalation exploits and thereby gain administrative rights.

This was purely a social engineering attack. Even if their JVMs were all fully up to date, they would have fallen victim to it. Assuming this test was done recently, they would have to get through this prompt: [http://www.mendoweb.be/blog/wp- content/uploads/2013/04/self-...](http://www.mendoweb.be/blog/wp- content/uploads/2013/04/self-signed-updated.jpg)

If this test was done a while ago, they would still have to go through a similar prompt, though it didn't have the scary red letters back then.

This is pure user ignorance in this case, especially considering this was supposedly an organization that deals with computer security.

That being said, however, any good organization should be monitoring things like Java applets accessed by employees, and they should receive alerts upon events like "EXE or binary type file downloaded by a Java applet" (though this kind of signature can possibly be bypassed if the pentesters were smart).

I work for a medium-sized company, and we would've caught something like this fairly quickly, even if the user did get infected. We check a list of all Java applets loaded by users every 12 hours. And we have various rules in place to look for malicious applet behavior, in addition to our regular screening.

Disabling Java applets is the safest solution, but unfortunately many enterprise applications still run as Java applets or JNLPs.

<comment><USER16> _but unfortunately many enterprise applications still run as Java applets or JNLPs._

It's not unfortunate that applets or JNLP are used, it's unfortunate that Oracle have a pretty spotty track-record with JVM security lately. But applets and JNLP are actually pretty cool and useful technology, in and of themselves. I just wish Oracle would get their act together...

</comment></comment></comment></comment></comment></comment><comment><USER17> > How do you solve a problem like overly friendly, helpful employees?

> ... training employees to: Question suspicious behavior and report it to the > human relations department.

> Refrain from sharing work-related details on social networks.

> Not use work devices for personal activities.

This reminds me of something Cory Doctorow[1] said regarding the NSA. Paraphrasing: the more locked-down an organization becomes, the more ineffective it becomes. When you can't trust your employees to the point that it becomes actual institutional _policy_ to _discourage_ information-sharing (communication), you are guaranteed to be dysfunctional.

There is a parallel, of course, regarding the red tape surrounding procurement for large government projects in order to mitigate corruption.

Addressing symptoms, not causes, is the theme.

\---

[1] correction, Julian Assange: "the more secretive or unjust an organization is, the more leaks induce fear and paranoia in its leadership and planning coterie". Which isn't precisely applicable to my comments above, so I guess that's my own conjecture.

<comment><USER18> AFAIK, that was Julian Assange.

<comment><USER17> I was hoping someone would correct; thank you.

</comment></comment></comment><comment><USER19> It's interesting that the fake female profile received multiple job offers, while the male one did not. Doesn't this contradict the popular opinion that tech giants discriminate against women when hiring?

<comment><USER20> I doubt it's actual job offers. More like recruiter spam. But even if it was true, I doubt the enthusiasm towards offering a job to a woman they've never and know little to nothing about could be considered positive. Hitting on job candidates isn't good for women's perception of the tech industry.

But if it was recruiters? I work in tech and get spammed by recruiters all the time. I don't really think it counts for a lot, since I didn't get any until I was already in tech.

<comment><USER19> If the male candidate got several job offers and the female got none, would you consider this evidence of gender discrimination? Bayes' Law says you cannot rationally hold both beliefs simultaneously.

<comment><USER20> I am suggesting that it is either evidence of discrimination (men hitting on women) or evidence of nothing (recruiter spam). I'm not sure what you think I'm saying.

And it's hard to think in terms of Bayes' Law when this is anecdotal anyway.

</comment></comment></comment></comment><comment><USER21> Missed a shot at a golden headline: "Fake femme fatale fools feds"

</comment><comment><USER22> So the head of IT sec uses unpatched browser, un-updated Java and allows applets from sites he sees first time in his life? Well, good enough for government work, I guess.

<comment><USER14> I thought that article said they used a zero day jvm bug, but your point stands: why would you execute something unknown, especially from a greeting card site? (Then again, it's a honey pot... I'm not sure I would be thinking straight in that situation either.)

<comment><USER22> They used zero-days perviously, but not this time, according to the article:

The agency's name was not revealed, but Lakhani said it was a very secure one that specializes in offensive cybersecurity and protecting secrets and for which they had to use zero-day attacks in previous tests in order to bypass its strong defenses.

It implies this time they didn't have to because christmas card from cure facebook profile was enough.

Thinking straight should not be required, that's why policies are around. If the policy is "no Java on work browsers, ever, for any reason" and "updates are installed same week they are released by vendor", the chance for somebody opening Christmas card from cute girl and getting national security compromised would be much lower.

</comment></comment></comment><comment><USER23> The real security fail here is letting company devices run java applets.

</comment><comment><USER24> _Here 's how popular Emily Williams proved within just 24 hours of her birth:

        She had 60 Facebook connections.
        She garnered 55 LinkedIn connections with employees from
        the targeted organization and its contractors.
        She had three job offers from other companies.

_

The 3x job offers seems a bit rich...wtf

<comment><USER25> A related anecdote: I've got both my long-term jobs because of my feminine sounding, unusual name. They've decided a female on staff would be a change of pace, then I guess my interviews were good enough to change their minds.

</comment></comment><comment><USER5> I like it, proper old-skool James Bond-esque spy antics, none of this modern NSA nonsense.

<comment><USER26> I have to agree. Sounds actually quite a lot of fun to sit around and think about outsmarting human behavior. Almost like a professional troll-baiting service.

<comment><USER27> And then you get to use the 5$ wrench. ;)

[http://xkcd.com/538/](http://xkcd.com/538/)

</comment></comment></comment><comment><USER28> For what it's worth, if she duped them, she wasn't a fake femme fatale. She was a real one.

<comment><USER29> Did you read the story? The pen test team created a completely fake female profile and used it to hack their target.

<comment><USER30> I think he was being ironical on the meaning of the French word "fatale": fatal. Doesn't really matter anyway :)

<comment><USER31> I suppose it's because the wording is ambiguous, and we must interpret which precedence on the adjectives is correct:

      (fake (femme fatale))
      vs
      ((fake femme) fatale)  ;; preferred

</comment></comment></comment></comment><comment><USER32> I offer this discussion two movie/TV quotes:

"Silly little planet. Anyone could take over the place with the right set of mammary glands."

"I always thought the opposable thumb was... overrated"

I don't think much more needs to be said.

<comment><USER8> Spot on with the first one! Though i don't get the second's relevance...

</comment></comment><comment><USER33> There was a similar story a few years ago (2010). The "Robin Sage" profile was constructed as a honeypot across a number of social networks. Ultimately, the problem was the originators couldn't spoof the MIT alumni network:

[http://www.computerworld.com/s/article/9179507/Fake_i_femme_...](http://www.computerworld.com/s/article/9179507/Fake_i_femme_fatale_i_shows_social_network_risks)

[http://en.wikipedia.org/wiki/Robin_Sage](http://en.wikipedia.org/wiki/Robin_Sage)

<comment><USER34> That was mentioned in the article.

</comment></comment><comment><USER35> > _People are trusting and want to help others. How do you solve a problem > like overly friendly, helpful employees?_

Ah, I'm so glad I don't work in security. In the library field, you seldom hear people say "Our employees are decent human beings. How can we fix this?" with a straight face.

</comment><comment><USER8> So my take is, the industry is heavily male dominated, and thus that becomes a vulnerability. So we need to counter this. How do we do this? Get more Hot chicks recruited!! If there's enough of them to be commonplace, this wouldn't be a problem right?

</comment><comment><USER36> Isolate activities in virtual machines. Ideally use something like Qubes OS. At the very least, fire up Virtualbox. My password safe runs in my Virtualbox host OS. Nothing else unnecessary runs there. I do my browsing and daily work in various virtual machines.

<comment><USER36> (Not ideal/feasible for every employee, but if you do have important access/credentials... at least they aren't getting those by owning your browser in a throwaway VM)

</comment></comment><comment><USER37> Well that Java exploit wouldn't work on me because I have Java uninstalled and disabled on all my computers.

That's not to say I an confident I wouldn't screw up in some other way, but Java should not be on the computers of anybody who cares about security.

</comment><comment><USER38> That sounds like a duplicate of what Jordan Harbenger did: [http://www.securitytube.net/video/5825](http://www.securitytube.net/video/5825)

</comment><comment><USER39> Yeah, compare a java vulnerability with a sexy chick, that's totally it.

If the trick worked, it was because java had vulnerabilities and because they were male, so how should it be fixed ?

DUH

</comment><comment><USER40> 10 year experience at age 28 is maybe unusual but not unheard-of. I'm 27 and I have 13 years professional programming experience.

<comment><USER41> how do you define "professional programming experience"?

<comment><USER42> I guess, getting paid for a programming job, and doing so vast majority (or all) of the time can be considered as _professional programming_

<comment><USER5> It would depend on what degree she claimed to have. You could be working full- time and cruise Psychology or Geography, good luck doing that and Mech Eng.

</comment></comment></comment></comment><comment><USER43> Seriously, I get a kick out of weekend HN. Not that there's anything wrong with that.</comment>


Tesla hires MacBook Air designer for senior engineering role - <AUTHOR> http://arstechnica.com/cars/2017/01/telsa-hires-macbook-air-designer-for-senior-engineering-role/ <comment><AUTHOR> Are these moves due to the "scaling back" of the rumored Apple automotive efforts?</comment>


Bayesian Financial Models - <AUTHOR> http://toddmoses.com/articles/read/bayesian_financial_models <comment><USER2> Although the title is "Bayesian financial models", this article describes no Bayesian financial models. It gives an example of Bayes' theorem in action (the usual medical "probability of false positive" one), and then gives another toy example in which the events we're looking at are labelled "happy/sad market sentiment" and "stock price increase/decrease" \-- and that's it.

I guess this is part of a series on probability or quantitative analysis or something[1], and there will be more contentful stuff later in the series, but I don't see how anyone's going to learn very much from this one.

[1] Looking at other articles on the site, it looks like they're all about quantitative analysis. They all have rather the same character as this one: they introduce some notion (binary options, "Greeks" (first partial derivatives of derivative price w.r.t. various things), etc.), they state some definitions and maybe give a toy example or a couple of formulae, and then they stop.

I assume the _toddmoses_ who posted the link to HN is also the Todd Moses who wrote the article. Todd, if you're reading this, would you like to say a few words about the intended future direction of your articles? Is the idea that they will form a kind of informal course on the elements of quantitative analysis? Will they be getting "deeper" than the ones so far, or are you intending that they will all be basically giving some definitions and a few words of explanation?

</comment><comment><USER3> I am troubled by the mammogram analysis. These sorts of health care examples (mammograms, AIDs testing, etc.) are often used to explain Baysian statistics and obviously make an interesting point. But as someone below points out, these tools are meant to be used in situations where we have incomplete information. We have direct experimental evidence of the accuracy of a positive mammogram in predicting cancer, and the accuracy is far, far higher than 7.8% From direct studies of patients who get positives, it looks like about 80% of them actually have breast cancer. See, for exmaple, [http://www.cancerresearchuk.org/health- professional/cancer-s...](http://www.cancerresearchuk.org/health- professional/cancer-statistics/statistics-by-cancer-type/breast- cancer/screening#heading-Two)

It may be that the author of this article simply go mixed up -- he reports than 1% of the population that 80% of the women who have cancer get positive mammograms, while from what I can see, evidence actually shows that 80% of the women who have positive mammograms have cancer. So the problem with the example might just be a matter of garbage in garbage out.

Mammograms, incidentally, are still controversial, especially doing them on an annual basis, because if you,for example, do a test with 20% false positives 10 times, you're pretty likely to get a false positive in at least one. But that probability is still not 92.2%, which is what the article suggests is the false positive rate for a single mammogram.

But it's disturbing to see statisticians flippantly saying things like, only 7.8% of positive mammograms represent actual cancer, when evidence shows, 80% of positive mammograms represent actual cancer. Survival rates for breast cancer have gone up and most everyone agrees early detection of cancer plays a role. I certainly hope that any woman who reads this article recognizes that, if she has a positive mammogram, the changes are much, much higher than 7.8% that she has cancer.

I've seen the same arguments made about AIDS tests. Why is it that statisticians like to use examples of life threatening illnesses and present a Baysian model that vastly underestimates the effectiveness of tests that could be crucial in saving lives?

<comment><USER4> On the other hand this paper: [http://www.ncbi.nlm.nih.gov/pubmed/21249649](http://www.ncbi.nlm.nih.gov/pubmed/21249649) suggests that for every correct treatment there are 10 mistreatments and 200 initial misdiagnoses.

How could the numbers differ so much from study to study?

<comment><USER3> I think you're misreading that study. It compares the number of women estimated to have their life prolonged because of a mammogram, to the number of women estimated to have been treated unnecessarily because of a mammogram. The issue with whether mammograms prolong life is different than the issue of whether mammograms accurately predict cancer. Depending what research you look at, other approaches are sometimes seen as just as effective as mammograms. This is very controversial right now among people who do cancer treatment.

The point is, however, the article you cite does not say for every correct treatment there are 10 unneeded treatments; it suggests that for every life saved there may be 10 unneeded treatments. The summary doesn't say what they mean by a life saved. Mammograms find a certain number of cancers. Other diagnostic techniques also find a certain number of cancers. These sets overlap. It may be that the authors consider the number of lives saved by mammograms to be the delta between cancers detected/treated due to mammograms and due to other diagnostic techniques. This seems to me to be a valid issue, but it has nothing to do with how accurate mammograms are in detecting actual cancers, which seems to be 80%. (So, for example, what if other diagnostic techniques have a 70% chance of detecting cancer -- this might lead to the 10 unneeded treatments per one life saved statistic)

The issue I have with the article posted above is that it claims the probability of a woman having cancer after a positive mammogram is 7.8% when actual results show this to be 80%.

I did contact a statistics site that had a similar statement about AIDS tests and their response was, Baysian statistics are correct and they saw no problem with telling people that a positive AIDS test only indicated a very low chance of having AIDS.

</comment></comment></comment><comment><USER5> The analogy incorrectly compares a binary outcome (cancer / no cancer) with a continuous variable (stock price returns, which may have skewed magnitudes depending on upside or downside). So while it is nominally correct about the formula for "stocks up" or "stocks down", it does not help for an actual trading situation where "stocks down" could have a negative return mean much larger than the corresponding positive mean return of "stocks up", for example.

<comment><USER6> then somebody should tell those guys who create the binomial options pricing model (and by extension, black-scholes) how flawed their approach is! =P

[https://en.wikipedia.org/wiki/Binomial_options_pricing_model](https://en.wikipedia.org/wiki/Binomial_options_pricing_model)

seriously though, the example is just a model, and a simple one at that. it's certainly useful to call out where and how the model breaks down, but it's also useful to understand the conditions under which a model performs well. like most models, this one is not designed for black swan events (to which you allude).

also, the author acknowledges your point at the end: "...it is only part of a financial modeling solution" and "one needs ... to learn more through careful experimentation and study". you'd need to include some information about the magnitude of losses and gains, to be sure. i do like that he used a relatable example like sentiment analysis though.

<comment><USER7> Black-Scholes is pretty flawed in assuming normal distributions, which financial markets don't show. Following power laws or Omega metrics can be informative. The more, the merrier.

</comment></comment></comment><comment><USER8> Shouldn't P(increase | happy) = P(increase) P(happy | increase) / P(increase) be P(increase | happy) = P(increase) P(happy | increase) / P(happy)?

Also I am not getting why he cannot simply compute 950/1000 = 95%? How does Bayes rule help us in his example? What am I missing?

</comment><comment><AUTHOR> Thank you for your feedback. Yes there will be more articles coming on the subject. This was just an intro to gauge interest before diving deeper.

</comment><comment><USER9> I really wanted to read this but for some reason it doesn't resize for mobile unfortunately. I'll have to bookmark it. It may also possibly be my phone which is not on its best legs.</comment>


Faster – A key-value store for large state management - <AUTHOR> https://www.microsoft.com/en-us/research/blog/microsoft-unveils-faster-key-value-store-large-state-management/ <comment><USER2> Does anyone remember MS Velocity / AppFabric Cache? No. Because it was crap and they canned it suddenly.

Really, if they are still supporting this in 3 years and it materialises into the promises I will take a look again.

I will never immediately adopt an MSFT platform component.

<comment><USER3> This is getting down-voted, but there's some truth here.

I didn't adopt .NET Core until v2, and happy I waited. Much stronger support from MSFT now, and a much more stable framework.

<comment><USER4> Insane performance on the most recent techempower benchmarks (usual proviso of all bencharks are meaningless etc etc.) they've caught Go with fasthttp already on one of them.

<comment><USER5> Not sure if it's good or bad, fast http is made by one guy and it's not official, aspcore is done by MS and dozen of engineers work on it.

<comment><USER6> ASP.NET Core is a full-stack web framework and has about 100x more features and support. fasthttp is quick but it doesn't even implement the http spec completely.

</comment></comment></comment></comment></comment><comment><USER7> > To support failure recovery, FASTER incorporates a recovery strategy that > can bring the system back to a recent consistent state at low cost

I'm at least intrigued, but this part is slightly worrying. "Recent consistent state" is unfortunately not "last good state", which would make it a non- starter for certain use cases.

<comment><USER8> > "Recent consistent state" is unfortunately not "last good state", which > would make it a non-starter for certain use cases.

Is the issue "recent" or "consistent"? "Consistent" seems like a good metric for "good", so perhaps "how recent" is a problem you foresee?

<comment><USER7> The issue is "recent", yes. I'm curious about "how recent".

</comment></comment></comment><comment><USER9> I wonder if this is a kinda of paper that is meant to be used under the hood of key/value in existing data bases vs a brand new data base?

<comment><USER10> Yes, the article mentions that its siblings includes RocksDB. There are already outsized (north of 5TB) embedded databases geared towards high-IOPS storage (ie: NVMe) and this project serves to establish C#/.NET Core as a platform to build similarly-specced analytics products.

</comment></comment><comment><USER11> >First, we use a 50 : 50 Zipf workload, and plot throughput vs.RocksDB in Fig. 10. As expected, Faster slows down with limited memory because of increased random reads from SSD, but quickly reaches in-memory performance levels once the entire dataset fits in memory.

I dont mean to offend the authors in anyways. But can someone from facebook rocksDb team reproduce their results on rocksDB ? I am curious as to , why throughput remains constant, even though memory is increased from 5 -> 40GB.

</comment><comment><USER12> Cool, implemented in C#.

</comment><comment><USER13> What a unfortunate name. Good luck finding information when you need help with it.

<comment><USER14> So true, I hate when google does this too, what's wrong with using original names?

Not that this coulda been helped, but I spent like 2 hours yesterday trying to find info on the -filter param in powershell took me a very long time to find anything useful, and I still don't have the official doc on it.

<comment><USER15> Were you searching for things like "powershell -filter"? That would exclude every result containing "filter" [1]

[1] [https://support.google.com/websearch/answer/2466433?hl=en](https://support.google.com/websearch/answer/2466433?hl=en)

</comment></comment></comment><comment><USER16> github or it doesn't exist

</comment><comment><USER17> What happens when Faster deadlocks? It starves.

</comment><comment><USER18> I want to play with it. Waiting for them to put the source on github. Too soon? ;)

<comment><USER19> Considering Microsoft is (and has been for some time) one of Github's most prolific users, I'd say if it's going to be open sourced, we should expect it soon.</comment></comment>


Global warming on Mars? - <AUTHOR> http://www.realclimate.org/index.php/archives/2005/10/global-warming-on-mars/ <comment><USER2> No. [http://www.skepticalscience.com/global-warming-on- mars.htm](http://www.skepticalscience.com/global-warming-on-mars.htm)

Or, it's been 10 years since that article was written - where's the newer evidence?</comment>


Ask HN: Financial data and rounding - <AUTHOR> I made a proposal to a client on how they should store and work with finaicnal data that has the potential to involve minute fractions of a dollar. (e.g. Pay contractor B 13.31% of the $55.53 billed)
I proposed that they keep financial values in as accurate a form as possible (to the ten-thousandths, because they use the T-SQL smallmoney type), use bankers' rounding and round at the last possible moment.
This proposal was rejected and I was told that they wanted to round to the hundredth, use "round half up" rounding and perform the rounding before any calculations were performed with the financial data.
I feel that their decisions are wrong, but they are adamant and this edict came from their financial department.
Am I worrying too much, or does it seem like this is a large potential problem? <comment><USER2> Personally if all of my forecasting, AP and AR are in a hundredths-based system, I'd keep the data stored that way. There will never be a time in which they will cut a check or do forecasting in anything less than hundredths so why worry about storing to the ten-thousandths?

I'm a T-SQL guy myself and many folks do not use SMALLMONEY or MONEY datatypes because they allow thousandths/ten-thousandths. Instead we use DECIMAL so that we can force storage of only hundredths.</comment>


Janesville – A Story About the Rest of America - <AUTHOR> https://steveblank.com/2018/02/02/janesville-a-story-about-the-rest-of-america/ <comment><USER2> The most interesting part of this is the author's fifth point:

        a critical insight that I almost missed, because it was
        buried in Appendix 2, (and a real surprise to me) was that,
        "laid-off workers who went back to school were less likely
        to have a job after they retrained than those who did not
        go to school." Wow. Talk about burying the lead.

(strange that he too is burying the lead)

This seems like the most depressing part of the entire article - you have people who go back to school/training, possibly get in debt in the process, and come out worse for it.</comment>


Major IE8 flaw makes 'safe' sites unsafe - <AUTHOR> http://www.theregister.co.uk/2009/11/20/internet_explorer_security_flaw/

<comment><USER2> _"We needed to find a way to make the filtering automatic and painless and thus provide maximum benefit to users," he wrote. "In summary, the XSS Filter will prove its worth by raising the bar and mitigating the types of XSS most commonly found across the web today, by default;, for users of Internet Explorer 8."_

This XSS filter has to be one of the most braindead far-reaching decisions since the invention of magic_quotes in PHP.

It just smacks of marketing-driven technical incompetence. How could anyone at Microsoft think this could do anything but make the situation worse? As if XSS were somehow distinguishable from legit scripts. As if most sites have great XSS protection and just need a little help with the edge cases. I just came up with a brilliant idea to prevent buffer overrun exploits as well: a C compiler that doesn't allow indexes past 1000. Developers shouldn't be using those high indexes anyway, and they're just an accident waiting to happen.

Thanks for expanding the XSS vulnerability footprint Microsoft, browser parsing wasn't opaque enough yet. Now we can enjoy another decade of IE- induced headaches.

<comment><USER3> "This XSS filter has to be one of the most braindead far-reaching decisions since the invention of magic_quotes in PHP."

So, I'm guessing you're also against the XSS filter Firefox is adding, and NoScript, and any other attempt to automatically mitigate XSS attacks? All those are also "marketing-driven technical incompetence" right?

This bug in IE8's XSS filter is a bad one, and its much worse that they've known about it and not fixed it. That doesn't mean its categorically a bad idea.

<comment><USER4> NoScript is pretty braindead. It's like refusing to eat anything incase you get food poisoning. There's far better ways to protect yourself.

<comment><AUTHOR> "Better ways..." such as using IE8?

The key thing about NoScript is that it is far easier to allow a common subset of safe actions rather than to deny every possible malicious action.

Consider why people like using sudo on *nix.

</comment></comment></comment></comment><comment><USER5> Can anyone explain how the browser can make a site unsafe? I thought rule #1 was "don't trust the client".

<comment><USER2> XSS is not about the server trusting the client, it's the other way around. XSS exploits the trust that a user has of a website. It is the site's responsibility to prevent XSS by preventing any user from injecting executable code into the HTML, because if they can do that on a public page then they can write code that sends the private credentials of all users who visit that page anywhere they want.

Preventing XSS is tricky because of the inability to sandbox user-generated content. Everything in a page has the same security level. This means if you allow user generated content you need to be aware of _all_ the ways that _all_ the browsers can trigger code execution. There are numerous tags, attributes, CSS selectors, and url protocols that can trigger executable javascript code, and on top of that there are layers of internal translation in the browser and parsed content such as HTML entities, escaped unicode and other internal browser transformations.

So what Microsoft has done, is to attempt to magically determine–without any context–what code patterns look like they were probably submitted by a malicious party, and then perform some opaque transformation to "prevent" the vulnerability. In the process they will undoubtedly break legitimate code, and make the job of preventing XSS more difficult because there is yet another transformation that one browser does differently from the rest.

To answer your question, what IE8 has apparently been found to do is translate some non-executable code form into something that is executable, thus rendering something that previously would have been a safe sanitization method across all known browsers into something that is exploitable in the latest version of IE. Sure it's unintentional, but the whole approach is braindead.

If Microsoft wants to further the state of web security they need to pursue a real security model such as real sandboxing of HTML documents, since all it takes is one obfuscated hack in IE8 magic security model to render it useless and more difficult to secure since some percentage of people will never upgrade.</comment></comment>


$35 Raspberry Pi 4 announced with 4K support and up to 4GB of RAM - <AUTHOR> https://www.theverge.com/circuitbreaker/2019/6/24/18715211/raspberry-pi-4-release-date-news-features-4gb-ram-dual-dual-hdmi-gigabit-ethernet <comment><USER2> I hate this marketing style. For $35 you get 1GB of ram, not up to 4. Apple has been doing this nonsense as well.

</comment><comment><USER3> Cool. More power for the dollar on throw away projects. It's a minor nit but I'd still like to see them add a real time clock.

<comment><USER4> Several companies provide a rtc in modular form. Most people don't need one since they enable ntp by default. And people who do just pony up the $5 or whatever, and plug one in.

<comment><USER3> Yup, yup! That's why I labeled it minor; my only complaint is it eats up valuable real-estate and can preclude using a hat. I have a cluster hat for the Pi I like to use that connects 4 pi Zeros to the pi over USB and the Pi video panel. Whether or not they use all the pins I believe they block all the pins, so it's an inconvenience.

<comment><USER4> I have the clusterHAT as well. You gotta admit it is one of the cooler rpi devices out there. It's a Big Mac sized super computer, even if it isn't truly practical; it is way cheaper than any other super computer out there, so the pi's reputation as an educational platform is accentuated.

I'm looking forward to transplanting it onto a Pi4, since it is more likely able to run the types of simulations I run, and the separation of network stacks will make it really hum. So much cheaper (and forgiving) than renting cloud instances too early on.

</comment></comment></comment></comment><comment><USER5> That is pretty impressive specs for a computer that cheap. I might get one to setup a pihole.

</comment><comment><USER6> finally decent gigabit and USB C power.</comment>


Apply HN: AllThingsMine.com – Access to your product information anywhere - <AUTHOR> https://www.allthingsmine.com/
Allows you to Manage all the things that you purchase. Add your purchased items and the App provides access to all its images, specifications, manuals, user guides, warranties, videos, reviews etc. Its easy to add products via scanning the UPC barcode, or from the product URL or lookup of our database. Connect with your friends and discover/share new purchases and discuss it with them. Be notified of recalls, 30 day reminder, price drops within the window
We are adding helpful features such as manufacturer support information (phone number/URL)  retailer specific return policy, price tracking for wishlist items, and new categories as well. <comment><USER2> This sounds like a cool idea. Which aspects of product ownership are you focused on first?

Also, have you considered working with related startups in the space? Two that come to mind are: Warranty Ninja [1] (automatic warranty registration of the products you buy), and Slice [2] (discount tracking and recall alerts).

1: [https://angel.co/warranty-ninja-1](https://angel.co/warranty-ninja-1)

2: [https://angel.co/slice-1](https://angel.co/slice-1)

<comment><AUTHOR> Thank you for the feedback. We have not approached any of the others yet. Slice has been around for a long time. They are strong on delivery tracking and email based parsing of receipts. Will checkout Warranty Ninja. We were planning to add parsing of receipts, but were worried about email security. Thinking of alternatives to address it.

</comment></comment><comment><USER3> First thought: your site gives a first impression of a shopping site with the scrolling devices across the top. But I don't think that is your intention.

Second thought: The site has three "primary" things: manage, share, discover. But none of these things appeal to me as stated. I think arriving at the site via a link should present the one primary use case that's most likely to hook me (probably "discover"? but then you're like a shopping site, so maybe "manage").

I'm concerned about "share"; people seem to be getting allergic to the word.

Beneath the fold, the first use case for "manage" is knowing when my warranties expire. I don't find this particularly compelling; I don't think I've ever (or maybe only once?) wondered whether a device I had was under warranty. Curious why you present that as the primary thing you can manage.

<comment><AUTHOR> Thanks for your feedback. We started out with automating warranty and added many more features.

Will definitely reorient the message to convey the primary message which is "Manage". "Discover" comes into play once the community of friends are on board.

As part of "Manage", will explain its aspects, namely converging all of the product information at one place.

Once again, thanks for your suggestions.</comment></comment>


$27M fund wants artificial intelligence with a conscience - <AUTHOR> http://www.nextgov.com/emerging-tech/2017/01/27m-fund-wants-artificial-intelligence-conscience/134474/ <comment><AUTHOR> Knight Foundation announcement:

[http://www.knightfoundation.org/press/releases/knight- founda...](http://www.knightfoundation.org/press/releases/knight-foundation- omidyar-network-and-linkedin-founder-reid-hoffman-create-27-million-fund-to- research-artificial-intelligence-for-the-public-interest)</comment>


Show HN: Programming language for the masses. What does it look like? - <AUTHOR> http://starsrc.org

<comment><AUTHOR> Programming is such a powerful and important tool. I believe it needs to be in the hands of the regular people.

To enable masses to program, today, there are two approaches. One is to teach people to use existing programming languages, the other is to create drawing tools, so that people can draw a program, instead of writing one. Both approaches face difficulties taking off.

It is not by accident. For the first approach, all existing programming languages are too difficult for the average to learn and use. The second approach is appropriate for the beginners to learn programming concepts. Once the beginner learns the basics and wants to build something more complex, the drawing approach does not scale effectively.

Therefore, programming for the masses requires a programming language for the masses. Star Script is created to meet the challenge. Try it out and share your thoughts!</comment>


Show HN: An alternative RSS reader and search engine for news and content - <AUTHOR> https://newsandrumors.com/ <comment><AUTHOR> Developer here .. I am excited to announce the beta launch of NEWS and RUMORS .. [https://newsandrumors.com/](https://newsandrumors.com/)

I have been solo developing NEWS and RUMORS for the last year with the goal of improving and simplifying content discovery and providing a way for lesser known bloggers and content publishers to reach a much larger audience.

There is so much great content on the internet that gets lost or never found because the search engines, news readers and news aggregators all feature and focus on the same high traffic sources, many of which write articles based on content from the same professional newswires and press releases.

I want to give readers a lot more control over the content they consume and the format of how it is presented.

To do this I developed a high performance search engine using a very clean and highly customizable low-bandwidth user interface for searching and displaying content acquired through an extensive modular-designed indexing system.

There will be a lot more that NEWS and RUMORS will offer as I continue its development, but it is a fully functional and beneficial service right now that I hope many people will enjoy!

## OVERVIEW

NEWS and RUMORS provides fast and simple access to a large amount of diverse content from a wide variety of sources while focusing on user privacy.

I created NEWS and RUMORS because I wanted a news and content search engine that does not show me advertisements as search results, does not track everything I do, does not only show content from high traffic sites, and lets me decide what content I want and do not want to see and how I want to see it.

 __The "Popular" search results (default home page) currently contains a variety of hand-picked sources because there is not enough traffic yet to generate an accurate list, but that will change once more people start using the site.

## FEATURES

\- Discover great content from sites other services ignore

\- Search, read and save your favorite sites, topics and searches

\- Fast and low bandwidth web interface

\- Personalize search results

\- Multiple site theme options and search layout options

\- Passwordless login only requires email

\- No user tracking with focus on user privacy

\- Read what you want, when you want, how you want

## SCREENSHOTS

\- Light Theme: [https://i.imgur.com/q2yn3tp.png](https://i.imgur.com/q2yn3tp.png)

\- Dark Theme: [https://i.imgur.com/1gkwFtb.png](https://i.imgur.com/1gkwFtb.png)

## QUICK SEARCH DOCS

\- limit search results by domain = @domain.com

\- limit search results by topic = #topic

\- limit search results by feed = .domain-com-blog

\- limit search results by exact word = _word

\- limit search results by string = string

NOTE: You can combine the above search methods to create more complex searches.

## DIRECT URL EXAMPLES

You can quickly read many sites by simply adding their domains using this URL format ..

\- [https://newsandrumors.com/s/github.blog](https://newsandrumors.com/s/github.blog)

\- [https://newsandrumors.com/s/bbc.com](https://newsandrumors.com/s/bbc.com)

\- [https://newsandrumors.com/s/wired.com](https://newsandrumors.com/s/wired.com)

\- [https://newsandrumors.com/s/npr.org](https://newsandrumors.com/s/npr.org)

\- [https://newsandrumors.com/s/wsj.com](https://newsandrumors.com/s/wsj.com)

You can quickly view results for any topic using this URL format ..

\- [https://newsandrumors.com/development](https://newsandrumors.com/development)

\- [https://newsandrumors.com/creative](https://newsandrumors.com/creative)

\- [https://newsandrumors.com/react](https://newsandrumors.com/react)

\- [https://newsandrumors.com/python](https://newsandrumors.com/python)

\- [https://newsandrumors.com/marketing](https://newsandrumors.com/marketing)

\- [https://newsandrumors.com/saas](https://newsandrumors.com/saas)

\- [https://newsandrumors.com/fortnitegame](https://newsandrumors.com/fortnitegame)

Be sure to login to gain greater access to NEWS and RUMORS features!

I am building NEWS and RUMORS for people like us.

You can help me make it better by sharing your comments, suggestions and criticisms!

<comment><USER2> I was looking at the payed options and it shows a one-time upgrade key, but it requires me to enter payment information before providing any info on it such as the price or defining what the one-time upgrade entails.

<comment><AUTHOR> That is an oversight definitely. The payment flow requires we collect the payment method before the "checkout" page, but it should definitely show all prices prior to the payment method step. I will work on changing that.

Thank you for pointing that out!

</comment></comment></comment><comment><USER3> Congratulations on the launch. Site looks nice and fast as well.

Just some comments.

1\. At the moment you are forced to login if you want to change site theme or font size. It would be nice if you could without logging in. I am fine it with the settings persisting as long as I don't clear the cookies.

2\. Are there any plans to support prefers-color-scheme so you don't have to manually set the color to dark?

3\. Also, the links to news article aren't direct. Goes via [https://newsandrumors.com/nar/go/<random-id- here>](https://newsandrumors.com/nar/go/<random-id-here>). Is it possible to opt out of this?

<comment><AUTHOR> Thank you!

1) Are you sure you cannot change the font and and site theme without logging in? I just tested it and it works fine for me in private and incognito modes.

I purposely designed it so a lot of the settings are available via the quick action bar for non-logged in users.

If you have no-script active or have disabled javascript, then the only option would be to login to change them via the Settings page.

Otherwise, you should be able to toggle those easily via the quick action bar above the search results.

2) Definitely. I probably should have already done that.

3) I am still thinking on this. My plan was to soon remove it for upgraded accounts. There is no user-specific tracking, but by anonymously tracking clicks in general it helps with ranking and generating "popular" search results order.

<comment><USER4> To track clicks without redirects and JavaScript use the 'ping' attribute: [https://www.w3schools.com/tags/att_a_ping.asp](https://www.w3schools.com/tags/att_a_ping.asp)

<comment><USER5> Didn't know about that. Does not look like it has Safari or IE support

</comment></comment></comment></comment><comment><USER6> Wow this site is very well done. The amount of filters on the search page is insane. Also love the look and fast loading. Clearly a lot of hard work must have been put to make this. Congrats on the launch and I wish you all the best.

P.S. Just out of curiosity, what's the business model for this site?

<comment><AUTHOR> Thank you!

The site supports user subscriptions for advance reader and searching functionality, so my hope at least for now is that people will use the free version and at some point want higher limits or more functionality and then upgrade.

I have a lot more planned for it long term (everyone always says that, but it is true) such as an API service, but for now, I am focused on improving the reader service and adding more sites to the index.

</comment></comment><comment><USER7> A search that delivers results containing my search term and nothing else is pure genius. It's a wonder major search engines never thought of it.

<comment><AUTHOR> It is really surprising and somewhat irritating that it is not more common.

<comment><USER8> No results found is actively optimized against, which raises recall and reduces precision of search results Via synonyms, stop words, etc. the priority of a search engine is to deliver you results because those are actionable even if not fully relevant.

<comment><AUTHOR> I agree and I like that meta search engines offer fuzzy search matching, because sometimes you know what you want but are not quite sure of the best keywords to use to find it.

I just wish more search engines offered an option or default setting where search results would only include exact matches.

</comment></comment></comment></comment><comment><USER9> Amazing! Just a tip, set the <html lang> attribute or browsers will try to auto-detect the language ( [https://developer.mozilla.org/en- US/docs/Web/HTML/Global_att...](https://developer.mozilla.org/en- US/docs/Web/HTML/Global_attributes/lang) ). At the moment, Chrome is saying it's in portuguese and translating it by default.

<comment><AUTHOR> Thank you for the suggestion! I am familiar with the lang attribute but did not think to use it. It should be live now.

</comment></comment><comment><USER10> Congrats on the launch! Looks very clean.

There is an unexpected behavior if I search "New York NY". The search box just shows "New York" on the results page. Is that deliberate?

Example: [https://newsandrumors.com/?q=new+york+ny](https://newsandrumors.com/?q=new+york+ny)

<comment><AUTHOR> Yes, that's because I limit search keywords/terms to 3 or more characters each right now.

Try #newyork for the state or #newyorknewyork for NYC and of course you can add any keywords you want to it after that.

</comment></comment><comment><USER11> Congratulations! It's been a while since I got excited for a news application, yet what you've built is very intriguing and makes me want to learn even more. I really like how the app feels fast, loads well, and the search is fast. Will keep an eye on it!

<comment><AUTHOR> Thank you for the kind words! I have always loved news readers and aggregators, but many of them seem to follow the same approach. I wanted something different for myself and it just kept evolving.

</comment></comment><comment><USER12> I don't like the idea of spending time on a site where I'm reading rumors but this is very nicely done indeed. Looks good on the mobile as well, though images take up more space than they should.

<comment><AUTHOR> Thank you! I will admit that I really wanted to go with a shorter brandable name, and I am still considering it, but for now I think the name fits.

I am planning to tweak the mobile/responsive styles on some layouts to make them a little easier to read.

Some of the search layouts will show differently on mobile screens so maybe toggle between them to see if you like one of those better.

</comment></comment><comment><USER12> This is good looking. But, is this just a River of News scrolling, or do you keep track of "read" items to get them out of the way?

<comment><AUTHOR> That is an area that I need to improve. With a high focus on privacy, it makes it hard to track what users read without creating a user tracking system and that is something I really want to avoid doing.

The thread links use the CSS :visited selector to show the links in a different color to help identify the links you have previously clicked without the site knowing that information itself.

There is a history function for logged in members, but for user privacy it can be limited or disabled by the user via the Settings page and is also auto- purged periodically.

At the very least the site needs to show content that has been added since your last visit and that is something I plan to implement soon.

<comment><USER13> Have you looked into cuckoo filters?

[https://en.m.wikipedia.org/wiki/Cuckoo_filter](https://en.m.wikipedia.org/wiki/Cuckoo_filter)

<comment><AUTHOR> The problem is not really the methodology or implementation but the perception caused by it. If you can tell a user "we know you read this" then that implies you are tracking what they read which is something I try to avoid.

I plan to work on a solution, but if I do, users will be able to opt-in or opt-out depending on the implementation.

</comment></comment></comment></comment><comment><USER14> Hi, I have some accessibility related requests regarding the design. Are you opened to suggestions?

<comment><AUTHOR> Absolutely! I know the main color themes have contrast issues with accessibility. My plan is to create a high contrast theme to help with that.

That said, any other suggestions would definitely be appreciated.

<comment><USER14> I'm blind, so can't comment on the color scheme. However, screen readers depend on semantic elements like headings, list items, and so on to navigate the page. Currently the search results are not organized as any such entity, but are a few links that are related visually. The graphics are not marked as such, lack alt text, and an example how one of them reads is:

"9c064f09d669c4a7ec0da2bb54c16a…"

Setting aria-hidden might be the easiest way to deal with this particular issue.

"Popular" and "newest" are not marked as control elements like buttons, combo box, or a radio button so they look just like plain text to my screen reader. It is experience that suggests that hitting enter on them will produce any result.

The search button is not labeled and it reads just as "button". What you call a quick bar (a guess) is a line of buttons represented as links but with no text inside them and no apparent function.

PS: Great idea for the site btw. I'm bitching so much only because it seems as something that I might use and wish to have as comfortable as possible.

<comment><AUTHOR> I really do appreciate the suggestions.

I have worked really hard to provide as many options as possible for people, but it is hard to anticipate everything people will want or need from it until they use it and tell you so feedback like yours helps.

I have added everything you wrote to my notes from this thread so I will see what I can do to improve them for you.

<comment><USER14> appreciated :)

</comment></comment></comment></comment></comment><comment><USER15> I like the design. I'm curious about the technologies you used, do you have details anywhere?

<comment><AUTHOR> I have not posted those details yet as the network security voice in my head screams, "DON'T DO IT!"

That said, I will probably post something on the site soon as I always find it interesting to see how other sites are built.

</comment></comment><comment><USER16> Kudos! Very well done. Kept me engaged in the site and found some great things to read.

Nice job!

<comment><AUTHOR> Great to hear! Thank you!

</comment></comment><comment><USER17> This is actually a really nice site, and I think I'm going to be replacing my Google News tab with it.

Really great work!

<comment><AUTHOR> Awesome! Thank you!

</comment></comment><comment><USER18> Remove foxnews, and I would use this.

<comment><AUTHOR> Upgraded accounts gain access to a global filter that can filter unwanted sources from search results.

Non-upgraded accounts can include one exclusion source in searches as well by adding ..

      -@domain.com

<comment><USER18> No thanks

</comment></comment></comment><comment><USER19> Is the solution to "content diversity" problem (right wingers current fake issue) flooding readers with more trash and low quality content? Isn't this what Facebook's for?

<comment><AUTHOR> My intention behind content diversity is not based on political interests, but rather a desire to offer a greater level of exposure for lesser known content and blog sites.

By "diversity" I mean that a developer who writes good articles on python whose blog only gets a few users a day will be treated the same as content from high traffic sites.

Unlike other news services that either have political leanings or are beholden to their advertisers, I want to provide an independent service where people can decide for themselves what they read or do not read.

<comment><USER19> The sun, daily mail, Fox News are "lesser known"? Not to mention tons of other stuff I'm too afraid to even checkout. Low quality and fake news is not diversity.

<comment><AUTHOR> No, of course not, but if I only included lesser known content in the reader and search engine then few people would use it since they would have to look elsewhere to find content from the major news sources.

Major news sources will always get more overall exposure simply through quantity because they publish so many articles every single day. However, low traffic sites and blogs will get their content promoted at or near the top of the search results when it is indexed in the same manner that the high traffic sites do.

I understand there are sites you dislike which is why I added an Upgrade global filter feature where you can block sites, topics, keywords, etc. that you do not want to see. Other Upgraded users can do the same when they do not want to see content they dislike as well.

<comment><USER19> Promoting low traffic sites that actually publish content that's worth while finding out about is admirable. But if your front page is an "open sewage" of the worst of USA and UK tabloids, I don't think anyone who's interested in quality content would bother to register or upgrade.

<comment><AUTHOR> I posted it in the beta notes on the site, but forgot to add it to my comments here.

The Popular search results are currently supplemented by a variety of hand- picked source feeds because the site is new and there is not yet enough traffic history to generate an accurate list of popular content, but that will change once more people start using the site.

Of course people will not be happy with some of the sites selected if the target site has a political bias that they disagree with, but it is only temporary until traffic starts to grow more on the site.

I already have it built into the engine to ignore the supplemental sources once the activity level hits a certain level.

That said, it will still come down to the users. If a lot of users are viewing specific content, it will likely find its way to the home page.

On a side note, you can change your default home page via the Settings page to avoid the popular search results.</comment></comment></comment></comment></comment></comment>


Debunking Google's log anonymisation propaganda - <AUTHOR> http://news.cnet.com/8301-13739_3-10038963-46.html

<comment><USER2> I didn't realize how little Google does to anonymity the data. What is the point of dropping 1/4 of the IP address if you are tracking my identity permanently across all IP addresses via cookies? I really feel like they've been misleading me this whole time about what they are doing. Not cool.</comment>


Sexual-Harassment Claims Against a 'She-E.O.' - <AUTHOR> http://nymag.com/thecut/2017/03/thinx-employee-accuses-miki-agrawal-of-sexual-harassment.html <comment><USER2> I enjoyed that article. Seems to me like power and instability can be just as corrupting for women in feminist oriented business as it can be for men, which shouldn't be too surprising.

A while ago I read a profile of a porn company (pornhub, maybe?) and was struck by how boring their jobs seemed. Same HR structure as everyone else with the sole exception that these folks tend to see a lot of nakedness as part of their day to day. Seems like Thinx confused non judgemental policies and a focus on positivity with invasion of peoples privacy.</comment>


Researcher Develops Cocaine Vaccine - <AUTHOR> http://singularityhub.com/2011/07/24/researcher-makes-a-career-developing-cocaine-vaccine-but-pharmaceutical-companies-won%e2%80%99t-produce-it/

<comment><USER2> This is an opinion piece that doesn't even look at the science. The ClinicalTrials.gov entry they link to as their source only lists one peer- reviewed study, and its conclusion is this (<http://www.ncbi.nlm.nih.gov/pubmed/19805702>):

      Attaining high (>or=43 microg/mL) IgG anticocaine antibody
      levels was associated with significantly reduced cocaine
      use, but only 38% of the vaccinated subjects attained
      these IgG levels and they had only 2 months of adequate
      cocaine blockade

That's not a stellar success. More importantly, if the Phase I trial revealed that some addicts had up to 5x the level of cocaine in their systems _that's a big deal!_

Cocaine doesn't just do damage to your brain. It can trigger heart attacks and death by causing the blood vessels that feed your heart to spasm and reduce blood flow. If a person under 40 walks into the ER and complains of chest pain, one of the first questions any competent doc will ask is whether they have recently used cocaine.

Apparently, they didn't see increased mortality in the small sample of people they studied -- but that doesn't mean it wouldn't kill significant numbers of people when deployed across a sizeable population.

So in summary, we have a vaccine that's immunologically ineffective on the majority of recipients, which doesn't eliminate their cocaine use (just reduces it, p=0.048), and which can cause some users to boost their cocaine ingestion to very dangerous levels, and thereby quite possibly increasing cardiac morbidity and mortality (which the vaccine producer may be found liable for).

Why aren't pharma companies lining up to produce this remarkable invention? It must be a conspiracy!!!

Edit: Fixed formatting of quote.

<comment><USER3> I would really hope the pharma company couldn't be held liable. It's not like increased cocaine usage is a side-effect. It's a voluntary response to the drug's stated purpose. Of course you never know if common sense will actually be applied in such a case.

<comment><USER4> Its not so much a matter of it causing legal problems directly, as much as the press getting wind and starting in investigation that causes people to demand that their elected officals Do Something. Remember a while back when those anti-depressants were found to be associated with increased suicide risk? I was surprised that there was an outcry since " _A dangerous time in depression occurs when a patient is coming out of the deepest part of the experience. At that point, they can mobilize their newly acquired energy to take their own life._ "[1] But, I never saw anything about that aspect in the news coverage.

[1][http://emedicine.medscape.com/article/288598-overview#aw2aab...](http://emedicine.medscape.com/article/288598-overview#aw2aab6b3)

</comment></comment></comment><comment><USER5> I instantly (and incorrectly) assumed that this was some conspiracy theory- laden story about how big pharma doesn't want to stop cocaine use and the war on drugs is too profitable and etc. etc. etc., but thankfully I was wrong. Here's the key line from the story:

      the dilemma is clear: What would happen if the media got
      wind that inoculated drug users were buying even more coke
      than before. It would be a public relations nightmare for
      any business.

So that's it - and it makes sense. Vaccine makes cocaine less effective, so people buy more (in the short term) to try and get the same high, until they finally realize that doesn't work and give up using it. Long term good, short term PR nightmare.

<comment><USER6> Yep I agree, the problem is this vaccine cures the drug effects but not the addiction or desire for drugs.

<comment><USER7> I think the best case for this vaccine is a therapy with vaccine and a supporting group or counsel, and this is made more for people trying to give up the habit (dependency) or for people not to start.

</comment></comment></comment><comment><USER8> I guess once you are hooked the vaccine can be challenging and lead to overdose.

But if you take this before getting hooked, it can just register in your mind that coke isn't fun and there is no high.

It's like my relationship with cigerettes. First few times I took it I was really nervous I would get hooked. Ultimately I found little joy from smoking. So I'm not much of a smoker but I'll average 5-10/cigarettes a month from social situations. My rule is that I can never buy cigs or smoke them at my will since it will mean I'm lusting for it. On the other hand if a friend offers one occasionally, I can smoke it.

</comment><comment><USER9> "What would happen if the media got wind that inoculated drug users were buying even more coke than before. It would be a public relations nightmare for any business."

not to mention a public health nightmare! cocaine has effects on more than the brain.

also, their study is pretty sketchy: <http://www.ncbi.nlm.nih.gov/pubmed/19805702>

why are there so many individual differences? why does it work on some people but not others? shouldn't a vaccines effect be pretty standardized?

also, why after 20 weeks are the placebo and high-ig concentrations equal in terms of cocaine-free urine samples?

with questions like these, it seems pretty obvious why no one wants to roll into stage III with this in its current form. it's shitty to hear when it's your life's work but ... it sounds like it needs more work.

<comment><USER10> _shouldn't a vaccines effect be pretty standardized?_

No! Evolution guarantees that the immune system is not standardized.

</comment></comment><comment><USER11> If nobody will manufacture it then it is time to start a startup. Even with the potential PR problems of patients going broke buying more cocaine at first, they will probably be able to find investors. Remember that the google founders at first tried to sell their search engine. Nobody would buy so they had to start google.

They could probably even put the patients in a rehab facility to prevent them from buying more cocaine. Also, this problem should be the first thing that should mentioned to anybody that is listening to prevent the media of acting like they just broke the news on "the evils of using this vaccine that the manufactures were trying to hide" (you know how sensationalist they are) If they do that then news organizations will probably not be able to make a big deal about it.

<comment><USER4> Startups as we normally think of them don't really work when you have to spend tens or hundreds of millions of dollars to get your drug past FDA approval before you can start making money.

</comment></comment><comment><USER12> If the vaccine works, the big question is: who will buy it? The biggest market that I'd see is addicts who commit crimes and are required to have the treatment as part of a court ordered program. How big is that market? Pharma isn't about to spend millions on a phase III trial for a fairly small market.

If they really want to see their vaccine approved for use, maybe they should start their own company to produce it. If there is enough of a need for the vaccine, the should be able to find funding (VC or grants).

Now, I could really see their nicotine vaccine doing very well, since there are lots of people who would voluntarily take a vaccine to stop smoking.

<comment><USER13> People don't seem to get how awesome this is. Sell it to parents. You can guarantee (for some period of time likely) that your children have an artificial tolerance for drug use w/o any ill effects.

The only implication I would want to think about more is what happens next. If all or most high schoolers had been inoculated against hard drug use, does that just mean that people would buy larger quantities? Would the market simply adjust? Would more new designer drugs enter as alternatives?

<comment><USER14> People would just shift to other drugs.

This concept is nothing new; an analogous drug that provides tolerance for heroin already exists. But heroin addicts who are forced to take methadone (as opposed to those who take it to assuage withdrawal symptoms) typically just turn to other drugs.

This drug would be useless for parents - it shouldn't be used to try and force someone else not to use cocaine, since they'll just turn to other drugs. Its only potential use case is the current drug user who wishes to stop but is afraid of the withdrawal period.

<comment><USER15> Citation needed.

This is the first time that I've heard the claim that giving someone methadone actively causes them to go to substitutes.

</comment></comment></comment></comment><comment><USER16> Might not an effective approach be the _opposite_ of this vaccine? Rather than trying to down-modulate the effects of (addictive substance here), if you instead up-modulate undesirable effects, then even a small dose would have less pleasure than before. Disulfiram (Antabuse) seems to be mentioned a lot in this thread, and that intuitively seems like a saner approach than "make it so they need more to get the same high".

</comment><comment><USER17> I have little formal knowledge in the area, but wouldn't a cocaine vaccine ruin any medical potential for that class of drug?

<comment><USER18> That was my first concern. Cocaine is one of the oldest anesthetics, and still used in some limited circumstances. But there are a lot of derivative drugs, e.g novocaine that nearly ever dentist uses, which are basically cocaine without the dopamine high. Would this vaccine change novocaine's effectiveness in the patient?

<comment><USER19> It would be fairly easy to determine whether the antibodies bind to commonly used drugs that are derivatives of cocaine (this is basically what ELISA testing is for, and computer simulations would give you a general idea of whether it would bind or not). I would assume that this sort of testing would have been done prior to it being tested on humans, or at the very least would be done before it enters into common usage.

</comment></comment></comment><comment><USER20> Discussions of "big pharma" aside, this seems like a classic case of treating symptoms and not causes. If you consider that the cases likely to present for vaccination are the more serious ones, you're going to be preventing people from taking one drug. If they have a serious need they will just take a different drug. Inoculate them against all the common drugs and they'll start mixing household chemicals and then you have a dramatically worse situation (google for the effects of 'krokodil' if you have a strong stomach). It would probably be better to help these addicts work through their problems so they don't need drugs. Leaving them unable to fill a need through conventional means just forces them down unconventional paths.

Why do we have such an obviously backwards approach to drug abuse? :(

<comment><USER10> _Why do we have such an obviously backwards approach to drug abuse? :(_

Because the intelligentsia have been taken over by a religion that says people are born pure and can be punished back into virtue if they get contaminated. Growing up in quiet high-IQ enclaves, their personal history is that unpleasant consequences teach better behavior. It is outside their life experience that there could be people who are too stupid to see logic, too distracted to notice lessons, too impulsive to act on logic, or too neglected in early childhood to develop susceptibility to social influences.

</comment></comment><comment><USER21> As patents start to run out on some of the most profitable drugs, big pharma is looking for a new business models and new drugs. In addition to the cocaine vaccine, there are reports that they are working on a vaccine for alzheimer's.

What I also find new about the Cocaine Vaccine is that traditionally vaccines are composed of biological agents that mimic or resemble a decease-causing microorganism. Cocaine addition and alzheimer's are not caused by a microorganism which would indicate that big pharma are cooping the word 'vaccine' for a new class of drugs.

<comment><USER22> Did you read the article? "Vaccine" is the appropriate word - the idea is to bind cocaine to inert cholera to make the immune system produce antibodies. It doesn't cure the addiction, it just makes cocaine ineffective.

</comment></comment><comment><USER15> It would be wonderful if they could produce an alcohol vaccine.

I then would like to see a law mandating its use for all people who who have a DUI.

Unfortunately the quantities of the active drug in your system when you abuse alcohol is orders of magnitude higher than for nicotine or cocaine. So it could well be that your body's immune system simply gets overwhelmed. (That or there could be real health consequences from the immune reaction.)

But it would be nice if it existed.

<comment><USER23> > _I then would like to see a law mandating its use for all people who who > have a DUI._

The problem is that such vaccine wouldn't only work when you are in a vehicle or prevent you from making other stupid decisions. This really wouldn't address the root cause and would be a pretty egregious violation of an individual's freedom of thought.

The idea of the state having authority to permanately biologically alter an individual to control his or her behavior is a throwback to the time of lobotomies, which even the Soviet Union banned in the 1950s.

<comment><USER24> "Even the Soviet Union" is a bit misleading, though I understand where you're coming from. The USSR banned lobotomies in 1950, while in the USA it was banned... never (though some states individually did). In fact the USSR was the first major country to ban lobotomies. Lobotomies legally happen even today in the USA, though there's no longer the epidemic of wanton misuse.

I just say this because it's easy to get into the rut where anything the Soviet Union did was bad and everything the USA did was good. There's no reason per se to expect Soviet doctors to be particularly evil compared to American ones. Which isn't to justify the many many evil things the Soviet state did perpetrate.</comment></comment></comment>


Ask HN: If you created a language, what aspects of other ones would it have? - <AUTHOR> <comment><USER2> A higher layer to the primitives. While still providing options to the lower layers.

For example, having multiple layers to the concurrency primitives. Something like goroutines but allowing the programmer to create native threads.

Also, I like how golang has these neat functions to connect to services as opposed to the way most other languages (like c/python/etc.) do them by creating sockets. Perhaps this would be something that would be part of the standard library and not the language?

This is all coming from an average developer with no experience in creating a language.

</comment><comment><USER3> I would like to have very explicit typing.

I'm not sure, that any language has this, but i would also like to add (optional) units to a language... The python package "pint" is an example of a pretty nice implementation: [https://pint.readthedocs.io/en/0.9/](https://pint.readthedocs.io/en/0.9/)

Like pseudo code:

int i=1;

i.unit = Unit.KG;</comment>


KDE ships version 4.8.5 of Plasma Workspaces, Applications and Platform - <AUTHOR> http://kde.org/announcements/announce-4.8.5.php

<comment><USER2> Note that 4.9 was already released on August 1st: <http://www.kde.org/announcements/4.9/>

I.e. this is mostly noteworthy because it's a maintenance release for the previous major release series that is done after the new major release series has begun. This is not unheard of, but relatively rare for KDE.</comment>


What's Wrong with Tech Folks Who Attack the Tech Media. and What's Wrong with T - <AUTHOR> https://hunterwalk.com/2020/02/15/whats-wrong-with-tech-folks-who-attack-the-tech-media-and-whats-wrong-with-tech-media-today/ <comment><USER2> Now this is something that has been in my mind for some while now. I actually think this lack of understanding goes far beyond these two groups.

There is a lack of understanding, but also trust between citizens and the media, citizens and the tech space. And we also see the same with our legislators too.

All around people are struggling to understand each other.</comment>


Show HN: A Simple Social Media Manager - <AUTHOR> https://www.broadcastapp.io/ <comment><AUTHOR> Hi HN, my co-founder and I have been working on a simple social media management app and we're now looking for feedback. If you use a social tool for managing accounts, auto scheduling, and analytic we'd love to get your thoughts on how we could improve or features you'd like to see. Thanks.</comment>


Rap Genius Explains Why Worse is Better - <AUTHOR> http://firstround.com/article/Rap-Genius-Explains-Why-Worse-is-Better?utm_source=Firstround.com+Library&utm_campaign=8f863e7524-The_Right_Way_to_Grant_Equity_to_Your_Employees&utm_medium=email&utm_term=0_d9bb43e05b-8f863e7524-74739229 <comment><USER2> There seems to be 2 philosophical camps in the startup world when it comes to design/execution. There's the Rap Genius approach of _make something wanted and get it out there asap even though it looks like crap_. Then there's the _we can only ship something that is beautiful design snobbery_ camp.

I guess it's obvious which one I favor. Maybe it's because I'm bad at design, but I tend to roll my eyes when someone says "Hey look at this new app, it's just like X but beautiful and well-designed"

Good job Rap Genius. I'll put this in my bookmark folder of links to show my designy friends.

</comment><comment><USER3> I'm not sure if the controversy made them MORE popular as the article suggests. Seems like they will have to slowly fight to get certain search query terms higher than AZlyrics, ones they were winning before. But perhaps the controversy helped bring the name to new people AND the site will gain back all of its traffic?

Anyhow, if the HN community is interested, they do discuss the controversy in this podcast interview (interview starts at 7:30): [https://soundcloud.com/thecombatjackshow/rap-genius- episode-...](https://soundcloud.com/thecombatjackshow/rap-genius-episode-2014)

</comment><comment><USER4> Regardless of what you may thing about their recent imbroglio with Google, these guys are doers. Nothing especially new here for hackers, but you have to love the Rap Genius guys' scrappiness.

</comment><comment><USER5> "The Secret"... really? I wonder if he really believes in that kind of thing.

(the book is on his desk in the picture)

</comment><comment><USER6> I've seen this advice all the time but somehow I wonder how did they get their first thousand visitor. Did they do something like reddit and have bots filling up the database until they got the ball rolling? I'm genuinely curious.

</comment><comment><USER7> "there are many things that are important but web hosting is not one of them"

Spoken like an ignorant developer. Uptime and scalability is just provided by the magic server pixies.

</comment><comment><USER8> "Worse is Better" is one of the slogans popular among small companies that want to stay small.

</comment><comment><USER9> More like RapTard

<comment><USER10> Making a terrible comment is one thing but why would you upvote it?

<comment><USER11> I meant to downvote it, but hit the wrong arrow. I have no doubt it'll be dead soon, though. :)</comment></comment></comment>


Apple has sold its millionth iPad in just 28 days  - <AUTHOR> http://ipadwatcher.com/2010/05/03/apple-has-sold-its-millionth-ipad-in-just-28-days/ <comment><USER2> What's interesting is that they have only sold 1.5M books, or 1.5 books per device. Amazon Kindle should be safe.

<comment><USER3> If you ever tried to actually read on an iPad you would understand why. The glossy screen means you can't read in natural light, and the backlit screen causes eye strain. For long stretches of reading, iPad can't replace books the same way the Kindle can.

Although I'm personally not surprised that books aren't that popular on iPad, but I was curious if people would overcome the above deficiencies with the form factor. Early reports seem to indicate not yet.

<comment> bjelkeman-again Having read more than two thousand screens (pages?) on an iPad in iBooks so far I don't think there is a major issue. It is highly unlikely that I would replace the iPad with a Kindle.

My camera is a lot better than my iPhone as a camera, but the best camera you have is the one you have with you. In the iPad I can carry enough of what I need with me without having to carry multiple devices.

I have not bought any books in the iBook store, as the store is not available in my region yet. But I got books from Baen Books, as well as O'Reilly, in ePUB format.

The attraction to me with the iPad is that I have a choice. An open format reader and a choice of books stores. I did buy a book from Amazon on the iPad Kindle app, but haven't started reading it yet, so time will tell.

<comment><USER4> I think it depends a lot of where you are reading. I'm sure the iPad would work fine for my commute on the subway. I'm sure I'd rather have a Kindle on the beach. (though I probably wouldn't bring either to the beach since they are going to get stolen or damaged)

<comment><USER5> I've read my iPad at the beach for hours, and I have no complaint whatsoever. It's actually superior to a book, because the pages of a book reflect too much sunlight for me to look at it comfortably.

</comment></comment></comment></comment></comment><comment><USER6> I wonder if there's more money in making apps ipad enabled now since that market isn't nearly as saturated as the iphone market. So if there's 80 million iPhone/Ipod touches out there, but 200K apps, and only 2K ipad enabled apps, it may be worth it.

And yes, I'm aware that iphone apps work on the ipad, but my friends who have ipads won't install iphone apps on their ipad because they come out looking so pixelated.

</comment><comment><USER3> I've only got one question for apple: What's next?

<comment><USER7> An ergonomic mouse.

<comment><USER8> Joking aside, the "magic mouse" is my favorite piece of apple hardware so far. It's just awesome. Best 70 bucks I have given to apple.

<comment><USER9> Seriously? It just feels uncomfortable with my limited testing. What makes it your favorite?

<comment><USER8> Yes, it is flat but that does not matter. Your entire hand does not rest on the mouse just you fingertips. I really like the action of the accelerated scrolling with the touch interface - it hardly takes any motion at all. Right click works perfectly as you would expect and the battery lasts forever. It is really nice to be able to get multi-touch on my older macs. I think there is a way to get it working with windows but I have not tried. I bring mine everywhere with me since I generally prefer a mouse to the touchpad (even on my 15" MacPro)

<comment><USER10> If your left-click finger is resting on the left side of the mouse when right clicking it registers as a left click. Back and Forward are achievable with two-finger dragging to the left and right, but what about middle clicking?

I agree that it seems pretty magic, but at the end of the day different _physical_ buttons are preferable to a single flat surface that affords everything; The mouse gives you no physical hints on how to use it.

</comment></comment></comment></comment></comment></comment><comment><USER11> The big numbers will be the ongoing revenue stream of apps and content delivered via those million devices. I think everyone will be surprised at the average monthly spend through the app store/content stores.

<comment><USER12> Apple is primarily a _hardware_ company. The present AppStore isn't a big money maker for Apple for the iPhone/iPad (look at their financial reports), I don't see why it would be that different for iPad.

<comment><USER11> On the iPad, for the first time with an Apple device, I can easily see myself spending more than the HW purchase cost on apps/content over the next 12 months. Obviously Apple only gets a % of that, but still it's not insignificant and it's a relatively high margin revenue stream. I think we'll see some surprising numbers in next years financials or the year after that.

<comment><USER13> Agreed. I also have to wonder if the report showing the app store only broke even was because of initial investments which they will not have to repeat in the future.

</comment></comment></comment></comment><comment><USER14> I Feel bad, I'm not in that million. And in my country not going to available soon.

</comment><comment><USER15> Yeah, but that's only because of willful acquisition and maintenance of a monopoly on awesome.</comment>


Show HN: Optimize cloud costs - <AUTHOR> http://cloudrobo.net <comment><USER2> Sounds interesting.

Just a note, you have a broken image on the pricing page. (download app button)</comment>


What's New in Google's Go 1.9 Language - <AUTHOR> http://www.infoworld.com/article/3201037/application-development/whats-new-in-googles-go-19-language.html <comment><USER2> We've updated the link from [https://cacm.acm.org/news/218748-whats-new-in- googles-go-1-9...](https://cacm.acm.org/news/218748-whats-new-in-googles- go-1-9-language/fulltext), which points to this.</comment>


The Branding of Frida Kahlo - <AUTHOR> https://newrepublic.com/article/153236/branding-frida-kahlo-brooklyn-museum-exhibit-review <comment><USER2> I recently killed an afternoon in Miami by visiting Calle Ocho in Little Havana and was bemused by the vast number of Kahlo portraits in the local shops and galleries, given that she was (A) Mexican, not Cuban; and (B) only stopped from enthusiastically supporting Castro's revolution by dint of dying a few years before it happened. Frida Kahlo juxtaposed with anti-Communist messaging makes for an unusual historical combination.

</comment><comment><USER3> Is it just me, or is all high art success largely about branding?

<comment><USER4> It's definitely not just you. Look at someone like Andy Warhol, Jean-Michel Basquiat, Banksy, and Damien Hirst. It's about acting a part, branding, connections, and in some ideal cases talent and originality can even play a role.

<comment><USER5> Warhol and Hirst's work were both commentaries on this. As were Christo and Jeanne-Claude's, though theirs focused a little more on the role the "self."

<comment><USER4> I mean, they're commentaries that also just happen to make them spectacularly wealthy.

</comment></comment></comment></comment><comment><USER6> I find it amusing that branding, formerly reserved for cattle, is so enthusiastically embraced by the people upon whom it is pushed.

"Oh, yes, I'd love to wear someone else's initials or sigil!"

<comment><USER7> I'm not sure when it was reserved for cattle, even if it has changed forms over the years. Of course, during some points in time, your clothing choices were limited by law - but even within that, there were brands. Usually modeled by royalty or politicians or other famous folks were wearing.</comment></comment>