The Hercules System/370, ESA/390, and z/Architecture Emulator - <AUTHOR> http://www.hercules-390.org/ <comment><USER3> Previously on HN:

[https://news.ycombinator.com/item?id=6094482](https://news.ycombinator.com/item?id=6094482)

Taking one of the MVS 3.8j "turnkey" distributions for a spin is a fun path down nostalgia lane, and if you can figure out how to license/acquire z/OS, z/Linux and z/VM, you can set up a pretty fun virtualized mainframe environment.

</comment><comment><USER4> IBM also has it's own version of this emulator, though obviously not free. I used to work on it, it was great fun.

[http://www-304.ibm.com/partnerworld/wps/servlet/ContentHandl...](http://www-304.ibm.com/partnerworld/wps/servlet/ContentHandler/pw_com_zpdt)

</comment><comment><USER5> Wow. There is a fortune to be made for a company to support a commercial fork of this project, as there are a tonne of corporations locked into IBM mainframes. If this z/Os emulator does it right it might just be a pathway for those corporations to move to modern systems.

<comment><USER3> A company called PSI had this idea in the early 2000s, and built a binary translation layer much faster than Hercules which ran z/OS on Itanium.

They rapidly got sued by IBM, tried to counter-sue on antitrust / unfair competition grounds, and (amusingly, when you consider the suit) ended up selling to IBM instead.

In addition to patents and the standard "thou shalt not reverse engineer" licensing clause, IBM also contractually bind their customers to run z/OS on only their hardware, although they also maintain a first-party emulator for development and test situations which don't demand a real zSeries.

I don't think Hercules would do fantastically as a commercial fork anyway - it's a great tool for play and development, but using it also basically eliminates any of the reasons to buy a mainframe in the first place - <USER2> certainly don't get lock-step / verified execution, lots of IO channels, or hot-swappable core hardware by using an emulator.

<comment><USER6> IBM apparently turned it's jaundiced legal eye towards Hercules at one point. Apparently, they decided it wasn't worth crushing them. I like to think they saw the value of something like Hercules out in the wild, but I imagine there's something less idealistic involved.

</comment></comment></comment><comment><USER7> Maintained by Tron guy! <3<3<3</comment>


7.5 years to find out how to close a file descriptor in a multithreaded process - <AUTHOR> https://twitter.com/cperciva/status/1141852451756105729 <comment><USER2> To elaborate on this: I figured out the dup2 part of the solution a long time ago, but I was stuck on "how do we make sure the descriptor we closed is the one we dup2ed and not a different one"; the obvious answer of using stat only works if you can create a sentinel file.

So really the hard part was realizing that you can use MSG_PEEK since it's guaranteed to not have side effects (and with a random cookie can be used to identify whether a descriptor is "our" socket).</comment>


Study Finds High-Fructose Corn Syrup Contains Mercury - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2009/01/26/AR2009012601831.html <comment><USER2> The US allowable limit for mercury in bottled water (and tap water) is 2000 parts per trillion. The report documents a maximum of 350 parts per trillion in Quaker Oatmeal to Go.

Omitting that data which provides context probably tells you a lot about the people who wrote the report.

<comment><USER3> You mean, the people who wrote the Washington Post article. The report clearly included the data.

The report also mentions that the EPA has a "reference dose" of mercury of 0.1 ug/kg/day for women of childbearing age and young children, which they work out to 5.5 ug/day for the average woman -- versus an estimated 28.5ug total mercury/day consumed by the average American via contaminated HFCS.

However, it's not clear how this EPA standard compares to the "US allowable limit for mercury in bottled water", which is presumably an FDA standard, or what assumptions went into these standards.

<comment><USER2> Punchline: last footnote of this post... if you lived on nothing but HFCS Coke-a-cola and all of that mercury were somehow transformed into its dangerous organic form, you would still only get 5% of your reference dose.

For those following along, the mercury report is at <http://www.healthobservatory.org/library.cfm?refid=105026>

I found the FDA/EPA limits at <http://www.state.nj.us/health/eoh/hhazweb/mercury.pdf> page 11 has the numbers.

The mercury report does not include the 2000ppt FDA limit on mercury. It contains a different limit on methymercury which is not measured in any test of this report.

Middle of page 12...

The 0.1ug/kg/day is for methylmercury. The numbers measured in the report are for mercury. They researchers admit in the next paragraph that they have no idea if the mercury in HFCS is methymercury. (Presumably there are tests which they chose not to perform.)

But look what they do with the numbers:

\- 20 samples of HFCS tested.

\- 11 have no detectable mercury (<5ppb) [1]

\- 1 sample was 570ppb

They then estimate mercury ingestion using the 570ppb outlier times the 50g USDA daily HFCS number to get 28.5ug. A scary number since it is about 5 times the limit they just showed you. Except the number these illusionists showed you in their left hand was for methylmercury limit of 3/4 scale women[2] and the number they showed you in their right was total mercury (inorganic plus organic) of full scale people, and the one in the right assumes that all the disparate sources of HFCS in a day's food happened to use the same outlier source[3].

[1] I wonder why the HFCS tests have a 5000ppT limit of detection and the foods test (page 14) have limits in the 20-100ppT range. Different tests? Something about HFCS that confounds the test? No answers.

[2] _For the "average" 55 kg American woman_ I suppose the "average 55kg woman" weighs 55kg. The average American woman however weighs 74.5kg. 55kg gives a more dramatic number though.

[3] They don't report any sort of average or distribution of the 20 samples other than the 9 of them are above the limits of detection. I suspect the average did nothing for their argument so they went with an outlier. Let's check their data...

I just finished a 257mL american Coke (the little half can) with 2.5g of HFCS (1%, yes I mixed volume and mass, but we are estimating here) in it. Their one reported test of Coke was 60ppT mercury, which if we assume it all came from the HFCS would be 6ppB mercury in the HFCS. What if the 570ppb HFCS number were real and was used for Coke? That would be 5700ppt in the food test. There is nothing within an order of magnitude in the table, and there isn't much in the way of consumable food that is more heavily sugared than American sodas. What if you got ALL of your calories by drinking 20 tiny Cokes a day and what if ALL of the mercury in the Coke was methylmercury? 50g of HFCS at 6ppb would give you 0.3ug/day, about 5% of your EPA reference dose.

<comment><USER3> Point taken. They do seem to be using worst-case numbers.

I'm curious, though, where you got the 1% number for Coke HFCS content? Elsewhere in the comments there is a link to an About.com article that says that most soft drinks contain about 10% HFCS, and I'd be surprised to see Coke among the less-sweetened drinks. I can't find other references online beyond guesses, which seem to indicate around 40g per regular can. If your estimate is off by a factor of 10, your proposed all-Coke diet would give you 50% of your EPA reference dose, which is a little more worrying.

<comment><USER2> You are right, I misread the label of the can, when I read 26g of sugars and the 9% of RDA next to it I interpreted it as 9% of the 26g, but it is 26g, 9% of the a 290g RDA.

Your 50% of EPA dose is correct, but still shouldn't be too worrying because there is no evidence presented that the mercury is in an organic form. Just that if it were, it would still be safe.

I'll go back and annotate the previous comment.

Or maybe not, the 'edit' link is gone, perhaps since it has a reply. I'll just have to hope people read far enough to find the correction.

And, just incase I sound as if I like mercury in my Coke, I don't. It seems reasonable to use mercury free alternatives (provided they don't have some other hazard). There was proposed legislation to that effect that didn't make it to law, perhaps it can make it this year. What I oppose here is terrifying the populace with puffed up science-sounding articles to achieve an ulterior motive.

<comment><USER3> Heh, yeah, the edit link disappears after two hours, regardless of whether anyone has replied.

</comment></comment></comment></comment></comment></comment><comment><USER4> Here's the actual paper: <http://www.ehjournal.net/content/pdf/1476-069x-8-2.pdf> .

They found a maximum of .57 ppm mercury in corn syrup; the allowable limit of mercury in sushi is 1 ppm.

.57 is probably high, and whatever source they found that from should be checked out; but this doesn't seem to me like reason for drastic action.

But I'm no expert! Anybody want to tell me why I'm wrong?

<comment><USER5> People generally don't eat sushi in the US as often as they consume high fructose corn syrup containing food products.

<comment><USER4> certainly true, though you must temper that with the fact that HFCS forms a very small fraction of the volume of a drink/snack, serving to dilute the potential mercury to an extraordinarily small amount per drink/snack.

<comment><USER5> Look at soft drinks. High fructose corn syrup is usually number 1 or number 2.

<comment><USER4> About.com[1] says a soda contains 23 grams of HFCS, and a there are about 226 grams of soda in an 8-oz can[2], so HFCS makes up about 10% of a soda (wow!).

From the worst of the tested sources, in this survey, a soda could contain .06ppm mercury, more than an order of magnitude smaller than what the government considers dangerous in seafood.

It's interesting to read about Jeremy Pivens' mercury toxicity[3]. In order to reach a point where it affected his ability to live life normally, he had to eat sushi twice a day, every day. Furthermore, his doctors said that a few months of treatment would solve his problem.

It seems likely to me that the amount of HFCS you'd need to eat in the very unlikely worst case to get actual mercury poisoning is going to give you diabetes before the mercury affects you.

Which is not to say that we shouldn't stop allowing people to sell mercury laden HFCS! If 9/20 studied samples contain no mercury, they all should, it's clearly a public health problem. What I mean to say is just that this is likely only to be a serious problem for a very few very heavy HFCS consumers, if any, and that people shouldn't take it to mean "I can't eat HFCS because I'll get mercury in me", because they probably won't get clinical amounts of mercury.

There's plenty of good reasons to avoid HFCS, I advocate that to everyone, but I don't think that the fear of the mercury found by this study is one of them.

[1] [http://www.answers.com/topic/high-fructose-corn- syrup-1#cite...](http://www.answers.com/topic/high-fructose-corn- syrup-1#cite_note-31)

[2] [http://wiki.answers.com/Q/How_much_does_a_can_of_soda_pop_we...](http://wiki.answers.com/Q/How_much_does_a_can_of_soda_pop_weight)

[3] [http://www.webmd.com/news/20081218/jeremy-pivens-high- mercur...](http://www.webmd.com/news/20081218/jeremy-pivens-high-mercury- count)

</comment></comment></comment></comment></comment><comment><USER6> <http://www.ens-newswire.com/ens/dec2005/2005-12-14-01.asp>

"emissions from power plants in 10 states - Alabama, Illinois, Indiana, Kentucky, Michigan, North Carolina, Ohio, Pennsylvania, Texas and West Virginia - represent almost 60 percent of U.S. mercury emissions from coal- fired power plants"

And what do we find in IL, IN, KY, MI, OH, and PA?

Though, to be fair, coal isn't responsible for the majority of mercury emissions, see:

<http://www.tva.gov/environment/air/ontheair/merc_emis.htm>

<http://www.epa.gov/mercury/reportover.htm>

<comment><USER3> The papers, however, were specifically looking for mercury that was "lost" during the creation of caustic soda, at plants that literally use tons of mercury for this purpose. That is, the mercury is being added when the HFCS is made, not when the corn is grown. (One paper indicates that the four plants responsible are in GA, TN, OH, and WV.)

Switching to a better caustic soda process should eliminate the detectable mercury, regardless of the proximity to coal plants. And some food producers are doing so; as one of the papers points out: "No mercury was detected in the majority of beverages tested."

<comment><USER6> Ah, I see.

<http://en.wikipedia.org/wiki/Sodium_hydroxide#Manufacture>

Wikipedia claims "the membrane cell process is economically the most viable", which does not use mercury.

Also, as shown in my previous links, chloralkali plants (which make caustic soda) pollute a significant amount of mercury (needlessly, in my opinion).

</comment></comment></comment><comment><USER7> Yet another reason why I'm glad I'm allergic to corn. Yet another reason to be fed up with the Corn Cartel's push to have everything under the sun made from corn.

<comment><USER8> HFCS exists ONLY because of US government policy. The US sugar program drives up the price of sugar by limiting domestic supplies and imports. As as result it is profitable to mill corn into sweetener, and U.S. food makers use it as a substitute everywhere possible (mostly liquids) as it is slightly cheaper than sugar.

Soda outside the US,for example, still uses traditional sugar.

As a result, the corn growers are a vociferous lobby in support of the sugar program.

<comment><USER9> Yes when I travel to the US I notice the taste immediately in soft drinks (and consequently stop drinking them all together, which is probably not a bad thing for me !). HFCS seems to have all the "sweet" hit without any flavour for it, quite horrible once you have had the alternative.

<comment><USER10> I'm not much of a Coke connoisseur, but some of my friends also think that imported Coke (from Mexico... Mexicoke!) tastes better.

<comment><USER9> I love it - but I try to only have 1 can every few days at most - but only cause here in .au its sugar !

If it was readily available I would drink it all the time (which would be quite bad for me).

</comment></comment></comment></comment></comment><comment><USER11> "In the first study, researchers found detectable levels of mercury in nine of 20 samples of commercial HFCS."

Debatable and harmful can be widely separated. Without any real numbers I am going to assume that this is a tiny amount of contamination and hardly meaningful.

PS: I might be an environmentalist, but I hate bad science reporting.

<comment><USER12> Mercury accumulates in the body, and the body has ways of _slowly_ flushing it out.

The problem is that even if one dose is below harmful level, 10 doses might not be.

Or 100, what ever the dose is.

Because corn syrup is in almost everything it's hard to know just how much mercury you're ingesting.

<comment><USER13> "Because corn syrup is in almost everything it's hard to know just how much mercury you're ingesting."

I think that's Retric's point, and if it's not his, I'll certainly claim it. There's a little bit of everything in everything (thanks, entropy!). This article does nothing absolutely nothing to _inform_ us as to whether this is actually worth thinking about.

The information content of this article is zero. Without more information it's not even worth your time to think about. (Trying to find more information might be worthwhile, and based on the other HN-posters who actually did that, I find myself fairly unconcerned about this putative threat.)

</comment></comment></comment><comment><USER5> All my food-conscious friends in northern California are going to love this study. I live in Sonoma county and it seems like everyone I meet chooses not to consume some food product. The most common denominator is high fructose corn syrup.

I avoid high fructose corn syrup myself for two reasons. Partly, it's because I'd rather pay for the sugar tariff than send more money to the corn lobby. The other part is that after stopping my consumption of soft drinks for other reasons, I find that foods and drinks that contain high fructose corn syrup are too sweet.

</comment><comment><USER8> This is huge. The autism community has long suspected that mercury is a driver, yet eliminating it from childhood vaccines hasn't lowered the rate. Could HFCS-borne mercury be the cause? HFCS was introduced into the food supply in the mid to late 1980s, and autism cases have grown 15-fold since then. (I believe HFCS is also the major driver of the parabolic growth in diabetes during the same period.)

<comment><USER14> _"This is huge"_

no it isn't: <http://news.ycombinator.com/item?id=452906>

_"The US allowable limit for mercury in bottled water (and tap water) is 2000 parts per trillion. The report documents a maximum of 350 parts per trillion in Quaker Oatmeal to Go.

Omitting that data which provides context probably tells you a lot about the people who wrote the report."_

</comment></comment><comment><USER15> _The good news is that mercury-free HFCS ingredients exist. Food companies just need a good push to only use those ingredients_

The good news is that arsenic-free dogshit exists. Dogs just need a good diet of arsenic-free dog food.</comment>


Mailvelope – OpenPGP Encryption for Webmail - <AUTHOR> https://www.mailvelope.com/ <comment><USER2> I really wish I wouldn't have to store the private key together with a browser extension I don't trust (no offense to the author(s)).

It would be amazing if Windows, Mac and Linux all would support some sort of "safe" gpg/pgp storage. I don't remember if I'm making this up, but i believe the OS X keyring can do this. There really should be no reason why every application should roll their own storage and interaction of the private key.

<comment><USER3> I do not see more reasons to trust the OSX Keyring, than to trust a browser extension.

<comment><USER4> Do you not trust the OSX Keyring because of apple? Or outside attackers?

If it is apple you don't trust in this regard, keychain is the least of your problems.

If it is outside attackers. At least they should need physical access to the machine to crack it, right? (If you don't back up that specific keychain to iCloud)

<comment><USER3> Both, actually. I Think encryption should involve specialized hardware, such as a smart card. That way, it would NEVER ever be exposed to a network.

<comment><USER5> In order to be used, it has to be exposed to the network.

<comment><USER3> not really. You could imagine a smart card with a software (the smart card itself runs the software)that would take bytes[] as an input and would output the encrypted bytes. The only 'network' communication would be between the card and the computer, and the computer would be unable to access the private key stored on the card.

<comment><USER6> Losing one of those things would not be fun.

<comment><USER7> Not quite the same thing, but I have a little (physical) keypad that HSBC provided to generate codes to sign in online. It's small, and flimsy, and my almost-2-year-old is fascinated with it -- when she manages to get her hands on it, she presses buttons and talks on it like it's a tiny phone... it's adorable, but one of these days it's going to decide she has "failed" my passcode too many times and it'll brick itself.

And when I'm spending a month or two in Asia, for example, I have no illusions that I could possibly get another mailed to me, if it broke or was lost.

These are great in terms of security, and should be an option for people who need it, but shouldn't be obligatory (I wouldn't use this for my bank if I had a better option).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I've been using this. It's pretty good but - like all PGP implementations - it's really hard to use _casually_.

You really need to make an effort to ensure you've got the right keys, that you can remember your password, that you know how to generate a keypair and which part of it you upload to the app.

But, once done, it works pretty well. The main downsides for me were....

\- Doesn't encrypt the subject line. You don't want to say "Top Secret Docs" in there, sure, but it does make looking through mail pretty hard. Which leads to...

\- No search. I pretty much rely on search to find emails. I just hadn't anticipated how much of a drag it would be to only search via sender.

<comment><USER9> Same and /second. I'd add that I've trouble encrypting emails with attachments, as Javascript encryption performance in web-based email in a browser that's being abused with lots of other tabs open is not always so reliable. Surprise surprise.

The Stanford Javascript Crypto Library whitepaper provides probably the best performance baseline for all of Javascript crypto [1], and the best they can do is roughly 10x faster than the next fastest JS crypto implementation, but still over 40x slower than native crypto.

[1]:[http://crypto.stanford.edu/sjcl/](http://crypto.stanford.edu/sjcl/)

</comment></comment><comment><USER10> Google is developing a PGP extension too

[https://code.google.com/p/end-to-end/](https://code.google.com/p/end-to-end/)

and Yahoo plans to use that code to fork his own

[https://twitter.com/bcrypt/status/497444399715192832](https://twitter.com/bcrypt/status/497444399715192832)

<comment><USER11> Another thing to point out, the Google developers respect the difficulty in securely implementing a Chrome extension that performs encryption. They are going through an extensive period of public review, and they're asking people to not build and deploy as a Chrome extension until after it's been thoroughly vetted.

In contrast, the Mailvelope guys seem to have just flung something over the wall with little regard to the actual security of their implementation. Seems irresponsible at best.

</comment></comment><comment><USER12> Correct me if I'm wrong, but you're encrypting the message _after_ you type in into the webmail client but before you send it? We all know that GMail constantly saves auto-drafts to server-side as you type. If your GMail is being monitored by a government (and we should assume that it is), this type of encryption client isn't going to do much for you. You'd be better off typing it in a text editor and encrypting that and pasting in.

<comment><USER13> Never mind all the other obvious problems that could occur at any stage. The webmail server could change a single setting and record every keystroke. An intelligence agency could push an updated version of the extension which records keystrokes or quietly caches plaintext. A browser update could detect the extension and start recording everything.

Any time you try to make encryption simple and easy for a mass audience you still have to educate the user about risks. Most solutions are not bulletproof enough to keep out intelligence agencies.

<comment><USER14> With a chrome plugin, a window can be created with the running page does not have access to. I'm pretty sure that is what this plugin is using

</comment></comment></comment><comment><USER15> This may be a noob question, but how would you send securely to multiple recipients?

<comment><USER16> PGP uses the pubkey to encrypt a randomly generated symmetric key, because it's much faster to asymmetrically decrypt a small key and then symmetrically decrypt the entire message. For multiple recipients, this symmetric key is simply encrypted once for each recipient pubkey.

<comment><USER15> Thank you, and to Anderkent. It seems pretty obvious now when you think about it.

</comment></comment></comment><comment><USER17> Only useful if it supports tokens such as the openpgp smartcard to store the private key. Otherwise its just security theatre.

Try gpgtools with a openpgp smartcard. Its easily the most user friendly experience going for token based PGP, and supports 4096 bit RSA keys.

</comment><comment><USER18> The "postcard -> unencrypted email as letter-in-envelope -> encrypted email" seems to be a very good analogy for explaining the need for encryption to laypeople.

The technicals are trickier (and outside my scope of expertise), but the "why do I need to use this" answer is one of the trickiest and most important questions to answer for any security application.

</comment><comment><USER19> Mailvelope is awesome - been around for a while, works as well as it should but isn't really solving many problems inherent in PGP.. Guess everyone saw this article: [http://blog.cryptographyengineering.com/2014/08/whats- matter...](http://blog.cryptographyengineering.com/2014/08/whats-matter-with- pgp.html)

</comment><comment><USER20> last release was in April and it doesn't look like anything newsworthy happened since then

<comment><AUTHOR> Firefox version was released 13 days ago:

[https://github.com/toberndo/mailvelope/releases/tag/v0.10.0b...](https://github.com/toberndo/mailvelope/releases/tag/v0.10.0b1)

<comment><USER21> I'm on the most recent firefox version after previously building it myself. It's not bad; I find it to be better than messing around with enigmail. I wonder what the pros/cons are to this as opposed to Mailpile, which I haven't used yet.

<comment><USER22> Well for one, Mailpile is a local client. Mailvelope can be updated/accessed by the developer at any time.

<comment><USER23> "local client" and "updated/accessed by the developer at any time" are not mutually exclusive: the most common example is Chrome, and AFAIK applications on Android can be updated at the developer's will (I'd guess it's the same for iOs and WP, too).

The model we have for traditional PCs is actually a remnant of the disconnected era in which applications were first conceived: manual update when the user knows they have a connection.

<comment><USER24> For iOS and Android at least, automatic and relatively transparent updates are a user-preference, so you can't as a developer _force_ users to update, although I'm sure most have automatic updates enabled. You could I suppose version your API calls and disable all but the newest version from working, provided you have a server component, but that's about it I think.

<comment><USER22> On Android it's off by default, and you can easily enable/disable it. On Chrome it's on by default, and I don't even know how to disable that (I assume it's somewhere in flags, which is of course terrible UX for something like this)

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Someone in this thread made a very good point - it is hard (I'd say impossible) to create usable, mainstream E-mail encryption system based on PGP and derivatives. PGP and Web Of Trust models have fundamental limitations that prevented any meaningful adoption during the years since it was invented.

It is possible to do better with NameCoin, which promises and somewhat delivered a solution to key management and practically working robust PKI.

There is another E-mail encryption Chrome extension, called SecureDolphin ([http://www.securedolphin.com](http://www.securedolphin.com)) that uses NameCoin for public key delivery. Check it out in the Crome Store ([https://chrome.google.com/webstore/detail/securedolphin/nefm...](https://chrome.google.com/webstore/detail/securedolphin/nefmgfdecbbhneankolhhlmfodelmoad)) if anyone is interested.

</comment><comment><USER26> I am still waiting for a proper browser based mail client that will let me read email from a variety of IMAP servers, rather than email 'clients' that are actually not clients, but just interfaces to a particular email service.

<comment><USER27> What is the advantage of "browser based" in this case? It sounds like you're asking for a mail client that's not tied to a particular mail provider's website, and that's what native clients have provided ever since IMAP was developed.

<comment><USER28> I think the difference is a browser extension would be portable (and work on locked-down thin clients such as chromebooks where "native" clients are "browser based").

Relatedly, I really, really, wish ChromeOS would support smartcards but reading the frustration of the government/military types that have been begging for this feature for years with no real interest by Google is very disappointing. I really like the form factor of YubiKey Neo that simply hangs on your keychain and just sticks into a USB port to become a smartcard. We're also never going to have gpg-agent on ChromeOS so smartcards is pretty much the only way to keep the private keys off the machine.

</comment></comment></comment><comment><USER29> It's a nice effort, but effectively no easier than simply composing my message in nodepad/emacs/vi, PGP encrypting it, and pasting that into gmail. And that's far too difficult for 95% of the email using public.

</comment><comment><USER30> Years ago I would've loved this, but I'm just too productive with a native mobile app. I may only be in this app 20% of the time, but I wouldn't trade that 20% for encryption.

<comment><USER31> Native apps already have good support for encryption in general. The default Mail app in OS X has a button for it, for example. The only thing new here is bringing it to the big webmail clients via browser add-ons.

<comment><USER32> buro9 mentioned native _mobile_ apps. Does e.g. iOS Mail have similar support?

<comment><USER33> Mail on both OSX and iOS have native support for S/MIME, which I've been using daily for many years. You can use it to sign and/or encrypt emails.

Keys are stored in the keychain. S/MIME uses a CA-based system for authentication, so the pro is that you don't even need to do key management (it is sufficient that one user sends you a signed message - and you use the CAs to validate the signature), and the key is automatically imported into the keychain. The con of the CA-based system are the same of SSL/TLS.

The only non-user-friendly pass is acquiring the certificate, which is as hard as getting a server SSL certificate; not complicated for an IT professional, but impossible for a casual user (plus, you have to pay them, unless you use StartSSL). Once the certificates are installed, the whole experience is mostly dumb-user proof.

For enterprises, OSX & iOS supports pulling the certificate from a specific ActiveDomain/LDAP record, so that you can automatically send encrypted mails to anybody in the company, even if you haven't communicated to them before; moreover, they support deployment through configuration profiles, so that it gets auto-installed and auto-configured for the end user.

</comment></comment></comment></comment><comment><USER34> Its mildly frustrating that I have to click a link to know whether it's something I would have wanted to click or not.

Why not, "Mailvelope - OpenPGP encryption for webmail"?

<comment><USER31> Even if you put a good title the HN mods tend to strip it to be more bland anyway. I'd much rather they just allow duplicate story submissions with different titles and let the crowd pick the best title with voting. They aren't doing a good job with staff enforced titles.

<comment><USER35> They make it match the title of the destination page, and that's where the problem is. The destination page should have a better name.

<comment><USER7> Another item for the endless startup checklist -- "is my landing page title informative enough to serve as an HN link?"

<comment><USER36> Which is really just a more specific form of "Does my landing page actually tell newcomers what's actually going on here?"

<comment><USER37> Except the title is barely visible in most browsers these days, where it has to fit in a tab.</comment></comment></comment></comment></comment></comment>


Minimal Vagrant Box for Ubuntu 16.04 for VirtualBox and VMware - <AUTHOR> https://atlas.hashicorp.com/geerlingguy/boxes/ubuntu1604/ <comment><AUTHOR> And for those interested, here's the Packer build configuration I used to build the box: [https://github.com/geerlingguy/packer- ubuntu-1604](https://github.com/geerlingguy/packer-ubuntu-1604)

All my boxes are available on [http://files.midwesternmac.com/](http://files.midwesternmac.com/)

</comment><comment><USER2> Thank you for this. The official ubuntu box is broken with Virtualbox when running on my pc, this one works.

<comment><AUTHOR> No problem! I noticed most of the major box distributors' boxes are still broken, so I thought I'd try to get mine working ASAP even with the current bugs in Vagrant.</comment></comment>


Epic Games vs. Apple – the legal issues - <AUTHOR> https://www.gamesindustry.biz/articles/2020-09-02-epic-games-versus-apple-the-legal-issues <comment><AUTHOR> This is first good analysis of Epic vs. Apple, worth reading what they are actually fighting about.</comment>


The future of business journalism: Pay for Play? - <AUTHOR> http://www.skrenta.com/2009/11/the_future_of_business_journal.html

<comment><USER2> Publicist work by another name. Appalling, but refreshingly direct in its cynicism.</comment>


Gmail is safe, as long as you avoid falling for phishing scams - <AUTHOR> http://googleonlinesecurity.blogspot.com/2008/11/gmail-security-and-recent-phishing.html

<comment><AUTHOR> The followup to <http://news.ycombinator.com/item?id=372699>, which incorrectly claimed that Gmail was open to cross-site attacks.

</comment><comment><USER2> While Google have an interest in talking about the message that Gmail is secure, from a security perspective it's kind of naive to say "Gmail is secure".

All web mail (or any other system) is just a step away from the next exploit. The difference in my mind between web mail and regular mail is there another dangerous attack vector (XSS) which is only fixable by a single vendor.

The standard mail servers companies use are often vetted patched from many sources and can be hidden behind some pretty well tested encryption protocols.

Trusting mission critical things like domain name registrations to web mail seems like an unacceptably big risk to me. While XSS wasn't the issue this time, it clearly has been in the past.

<comment><USER3> _Trusting mission critical things like domain name registrations to web mail seems like an unacceptably big risk to me._

What?

</comment></comment><comment><USER4> "We did have a Gmail CSRF bug reported to us in September 2007 that we fixed worldwide within 24 hours of private disclosure of the bug details."

What about bugs that aren't disclosed?

<comment><USER3> What about them? :)

</comment></comment><comment><USER5> What about a user on stumbleupon ... stumbling onto a nefarious website?

The community would curtail such a site after awhile, but those prior may have been hacked.</comment>


AI can be sexist and racist – it's time to make it fair - <AUTHOR> https://www.nature.com/articles/d41586-018-05707-8 <comment><USER2> What if, to some extent, it's simply reflecting objective truth? Reality isn't concerned with being inoffensive. Obviously any system that actively discriminates against intrinsic traits shouldn't be put into production, but if we have to game a system to make it agree with us, there's some intellectual dishonesty involved.</comment>


My resolution: A new programming language each week - <AUTHOR> http://cdawson.net/blog/2014/01/03/a-resolution-in-52-parts/

<comment><USER2> Can't learn anything meaningful in a week.

You could learn respins on the same old, same old, over and over, but nothing substantial.

Example: Haskell.

Even Lisp takes awhile to become appreciable in a fundamental way and learning Lisp is facile compared to Haskell absent some sort of background in mathematics.</comment>


High beta fusion reactor - <AUTHOR> https://en.wikipedia.org/wiki/High_beta_fusion_reactor

<comment><AUTHOR> Garnered a positive response from Larry Page after being presented at Google X: [https://plus.google.com/+LarryPage/posts/QVyCe3UhEGC](https://plus.google.com/+LarryPage/posts/QVyCe3UhEGC)</comment>


Programming in R makes serious statistics serious fun  - <AUTHOR> http://greg.weebly.com/1/post/2008/10/programming-in-r-makes-serious-statistics-serious-fun.html

<comment><USER2> R is becoming huge in the bioinformatics world (I used it a lot for my own research), but I wouldn't go so far as to compare it to a general-purpose language like ECMAScript (and yes, ECMAScript is general-purpose when compared to R/SPlus). R is a good domain-specific language -- it has a great library of statistical methods for analysis and modeling -- but it's dog slow, a huge memory hog (i.e. forget large datasets), and has I/O facilities that are only a bit more advanced than what you get in FORTRAN 77.

My general research workflow was to do all of my custom logic in a faster, smaller language (i.e. Perl, C++), then to dump tab-delimited files that I could load into R for summary analysis and graphing. I would also sometimes prototype my code in R (if it involved tricky matrix math or statistical models), then re-write everything in a more capable language when it came time to work with real data.

That said, R has its strengths -- the graphics language is _really_ powerful, once you take the time to learn it. Kind of like a functional interface to postscript...</comment>


From $100 MIT handcrank laptops to a $25 Raspberry Pi - <AUTHOR> http://www.stradagest.com/2012/01/02/look-how-far-tech-has-come-from-100-mit-handcrank-laptops-to-25-raspberry-pi/

<comment><USER2> I think comparing the Raspberry Pi to the original OLPC concepts is rather misguided. The OLPC is a computer that can be used immediately. It's turnkey. It has a display, and input devices, and comes in a case.

The Raspberry Pi reminds me more of the Heathkits my father used to buy, but we're talking more of the radio kits as opposed to the 25" television sets. It's a computer, yes, but it's not the entire puzzle -- it's just a piece. If you build a radio, you want more than just sound -- you want something to easily change the frequency, more usable controls, a case, and a power supply that's a bit more manageable. The OLPC gives you all of that as part of the kit (and in the case of the OLPC, preassembled), whereas with the Raspberry Pi you've got to piece together the rest of the system. There's nothing wrong with that, but it does limit its accessibility if you're trying to get kids to program. Sure, there's something to be learned buy gathering up all the components, but it's limited, as it's not much more than plugging in some cables with standardized connectors.

The Pi may have more horsepower, but it's basically just an engine. Don't get me wrong, it's a great idea, but there's quite a bit more involved so someone can really explore what the hardware is capable of when compared to the OLPC.

<comment><USER3> It might be a better platform to get kids to program. It's probably easy to get it connected to a big TV, and it's cheap enough to mess around with.

But you're right to say that the price comparison is pretty meaningless.

</comment></comment><comment><USER4> Raspberry Pi is the bees knees because it's near-hypeless. They get it, they know that they can make it. There are no silly 3D illustrations of it doing magical things, and they refused pre-orders because they had enough financing to make them. And, heck, they have lots of people with real uses for the thing who will order it.

<comment><USER5> OLPC == hype, true. But it's not like OLPC took pre orders either.

</comment></comment><comment><USER6> Perhaps a better competing use for a $25 Raspberry Pi is Apple's Airport Express ($99 retail).

I would love to make every one of my USB peripherals be decoupled from my computer. Printer, scanner, external hard drive, etc.

All you'd need to do is a $10 USB Wifi dongle, slap it into an enclosure, and resell it for $75 as a more customizable Airport Express. Bonus points if it prints from and scans into my Dropbox or Google Docs.

</comment><comment><USER5> OLPC Tried to make a $100 /computer/ (laptop, and got pretty close (~$185). And Raspberry is making a $25 development board. I applaud Raspberry Pi and their intentions. But putting all of the necessary devices to make this also a /computer/ will probably cost at least $100.

Without contrasting $25 and $100 pricepoints, what else is the author trying to say?

</comment><comment><USER7> OLPC has a display, a battery, and (AFAIR) a radio to communicate with other OLPCs in the area.</comment>


Ask HN: Would you take a pay cut in exchange for a 4-hour work week? - <AUTHOR>

<comment><USER2> Assuming that you're referring to working x% of full-time for x% of the money, then yes. I could easily live off $300 per week, but even minimal wage gives me NZ$500 per week. A well-paying job should give me about $1000 per week. Under those conditions, I'd choose a 12-hour work week in an instant.

However, you refer to a 4-hour work week. That's not a lot of time. _Assuming_ that I'll still make at least $300 dollars per week, then yes. Any less, probably not. I still have to eat.

</comment><comment><USER3> Can you elaborate on this question? Are you asking whether people who work 40 hours per week would take a 90% pay cut to work 90% fewer hours, or are you asking a different question?

<comment><AUTHOR> Too late, can't edit. I actually meant 4-day work week - 32 hours.

</comment></comment><comment><USER4> I think the real underlying question is about time-money tradeoff.

As for a 4-hour work week, there's a sense in which a work week that is too short will bore you to death. I would take a pay cut in exchange for, say, 30 or 20 hour work week, but 4 hours a week seems extreme. Plus, if you are doing something you enjoy, "work week" doesnt have the same meaning as a traditional 9-5 job.

</comment><comment><USER5> Assuming you are talking about the Tim Ferris 4 hour workweek (<http://www.fourhourworkweek.com/>) then yes, but that's not really the problem. The problem is the unreliability of the pay when you work for yourself.

</comment><comment><USER6> 4 hrs off less a day != not productive.

Surely certain tasks can be optimized better through automation, processes, technology, etc. It's almost like tell me to work for minimum wage.

</comment><comment><USER7> I think that I'd just work on other (potentially/hopefully) revenue generating things in the remaining 36-96 working hours, so it's hard to see how it applies...

</comment><comment><USER8> If the pay cut is proportional, I definitely would. Would give me more time to work on my ideas.

</comment><comment><USER9> It depends on the percentage of the pay cut?</comment>


Ask HN: Working Remotely but as a Foreigner - <AUTHOR> There are tons of threads on HN talking about remote work, but it seems most of the time it's assumed that the company you work for is either in the same country you are living or has your same nationality.
I'm about to graduate from college and I'm thinking on attempting to work remotely in the US being a foreigner.
I'd like to know If anyone has experience working for a US company while being a foreigner (non US-Citizen).
In particular:
1) Can you work as an employee? I assume you can't because you don't have a SSN and therefore you can't be put on payroll by your employer. My guess that while you could have an employee relationship, you would actually be legally working as a contractor. Is this correct?
2) How do international contracts work? If you sign a contract with a foreign company, how do you ensure the contract is respected when no country has jurisdiction over the other? (or does it?)
3) Are there any taxes you need to pay in the US additional to the ones you pay in your home country?
4) How do you get paid? Do you use just a regular Wire Transfer or something else (Payoneer, Transferwise, etc)? Do/Should you open a US Bank account? Do/Should you open a business bank account?
5) How was your experience finding a job, getting "hired" and working there?
Cheers. <comment><USER2> 1) Not without a visa that permits employment. You can contract with US companies but you can't work while physically in the US.

2\. Cost of enforcing a contract will normal far surpass the amount involved, jurisdiction across national borders won't matter unless you're a multinational corporation. Don't put yourself in a position where your customer can owe you a lot of money. Bill by small short-term deliverables, or by hours worked, no less frequently than monthly.

3\. The US only taxes citizens, permanent residents, and holders of visas that permit work in the US. As a non-citizen working remotely from abroad you aren't subject to US income taxes.

4\. Transferwise, Square, PayPal, wire. Some foreign banks have US branches that take deposits. You probably can't open a US Bank account from abroad. You don't need a business bank account but some people find it useful to separate personal expenses.

5\. I'm a US citizen working remotely so I don't know personally. I have friends who aren't US citizens working remotely for US companies. If you offer something of value you can probably find customers.

</comment><comment><USER3> 1\. You cannot be a W-4 employee because you have no legal right to work in the US. You can do work on a contract basis. If you are working outside the US, you have no US-source income and only owe based on the laws of your country of residence. You shouldn't get a 1099, but you might.

2\. Parties to a contract will perform as long as they are happy. You can specify a governing law and international arbitration in case of disputes.

3\. No.

4\. Wire transfer to foreign bank. Most domestic US companies will balk at anything that's not an ACH transfer. Companies that do business internationally know how to find the wire desk at the bank.

5\. If you are a US citizen or permanent resident, the above doesn't apply. Along with Liberia and Myanmar, the US is one of only three nations that tax its citizens' worldwide income regardless of residence.</comment>


Y Combinator-backed Coinbase now selling over $1M Bitcoin per month - <AUTHOR> http://venturebeat.com/2013/02/08/coinbase-bitcoin/

<comment><AUTHOR> Coinbase has a simple API for enabling payments on a web site, as well as linking bank accounts for bitcoin exchange.

<https://coinbase.com/docs/merchant_tools/payment_buttons>

</comment><comment><USER2> Previous discussion: <http://news.ycombinator.com/item?id=5188620></comment>


Finland is scrapping plans to extend its basic income project - <AUTHOR> http://www.businessinsider.com/finland-to-end-basic-income-experiment-2018-4 <comment><USER2> I can't see how it's theoretically possible to do a small scale experiment with UBI. If not everyone gets it, you can't see the big impact on the economy (what happens with supply/demand/inflation). And if it's with a short horizon, then people still have to _plan_ for life after the UBI experiment.

You can't give up the career you are going to need to make a living in 2 years time, just because you get paid a small sum per month for 2 years.

So I can't see how experiments are worthwhile unless you actually go in head first. UBI should be announced as universal and forever, or it isn't "proper" UBI, and doesn't show the effects of UBI.

This is also the reason why no one tries it.

<comment><USER3> I am very skeptical of claims that outcomes are discontinuous in policy space. Going one step in direction A should give you information about going further in that same direction, at least on some scale of change. Clearly the people running the experiment agreed, because they designed it with the intent to get that information.

<comment><USER4> > Going one step in direction A should give you information about going > further in that same direction

So eating healthy for 1 day/week will change your blood results and tell you that a year of it will make you lose 50 pounds?

So going to 1 day of college will make you measure differently on a test that checks critical thinking?

Different things take different amount of time to see results. I could see behaving very differently between

* This is a very temporary 1 year test of UBI *

vs

* You have a social safety net of UBI for your entire life, and can count on the income no matter what happens _

<comment><USER5> It's more that shorter experiments might tell you whether there are deep downsides even in the short-term. Not great information, not full information, but information; even if it's just a one-way test.

<comment><USER6> It's not that they are completely useless it's that they cannot test the actual affects on the economy.

If you have a small scale UBI even if it's on say a scale of a whole town it's still not enough to evaluate the economic impact because the supply/demand economy isn't that localized.

We have other experiments that have shown to have a negative effect for example rent allowance in the UK which essentially set the lower limit for rent as no one rents below what the council would pay, this has increased rent prices even in places where there was no negative change in the supply and demand.

</comment></comment></comment></comment></comment><comment><USER7> 「The initial plan was for the experiment to be expanded in early 2018 to include workers as well as non-workers early in 2018, but that did not happen – to the disappointment of researchers at Kela. Without workers in the project, researchers are unable to study whether basic income would allow people to make new career moves, or enter training or education.」

And this is the paragraph I went looking for.

<comment><USER8> Yeah, the other thing that is weird when you read the article is that it _wasn 't UBI_ at all. It only went to people from a set that was unemployed. This "trial" just removed all bureaucracy and removed restrictions on side jobs, etc.

I'm not sure what you could learn from this experiment. The things a lot of people want to know is can UBI provide a safety net for the poor and allow people to quit a toxic job without fear. It will be interesting to see if any of the 2K participants used this income/time to retrain or receive education.

<comment><USER7> Yup that's my point exactly - it's just less restrictive unemployment benefits. As you said the really interesting stuff from UBI is people quitting shitty jobs (or, working part time at shitty jobs instead of 60 hours a week) and doing something else with their lives.

</comment></comment></comment><comment><USER9> Studying a UBI pilot with an end date is not studying UBI at all: It is instead studying a misnamed temporary cash payment. By the nature of pilots, the cohort's behavior cannot reliably change to depend on UBI's long term existence. No study yet has guaranteed a cohort money forever, and even if it did it would be difficult for a pilot to study the long term effects, some of which may be generations out. What pilot can tell us answers to questions like: "What is it like for kids to grow up with parents who have _never_ worked?"[1]

Universal Basic Income projects also tend to fail hard at the Universal part. It's hard to study how _society_ would change if you are not piloting something that is intended to affect all of society.

For the Finland study, the cohort doesn't even scratch the "U", and somewhat contradicts itself:

> During the experiment, a total of 2,000 _unemployed persons_ between 25 and > 58 years of age will receive a monthly payment of €560, _unconditionally and > without means testing._ The experiment will run for two years.

(quoting from: [http://www.kela.fi/web/en/experimental-study-on-a- universal-...](http://www.kela.fi/web/en/experimental-study-on-a-universal- basic-income))

I've written my own long list of objections to UBI, here: [https://firstname.lastname@example.com/after-universal-basic- incom...](https://firstname.lastname@example.com/after-universal-basic-income-the- flood-217db9889c07)

I think it's an important problem, but I'm totally flabbergasted at how much simplistic thinking the proponents are willing to gloss over.

<comment>

[1] There answer is SSDI but don't look at it if you want to sleep at night. [https://web.archive.org/web/20130420171159/http://thelastpsy...](https://web.archive.org/web/20130420171159/http://thelastpsychiatrist.com/2013/04/the_terrible_awful_truth_about_5.html)

<comment><USER10> Your footnoted link was good reading. Disturbing but good. Thanks for posting it.

</comment></comment></comment><comment><USER11> These experiments confuse me. Haven't we already seen the result of UBI? Pensions, states that issue money (from state oil income etc), allowances, annuities?

The world doesn't come to an end; the people don't all become listless and stop contributing. The currency doesn't inflate uncontrollably; prices don't change at all. The cost of living is unchanged (because economics doesn't work that way).

All the FUD produced over this is astonishing. I admit, I had questions to begin with as well. But it takes only a little reading and thinking to get over it.

<comment><USER12> > the people don't all become listless and stop contributing

Well, in the US two groups that do get state distributions - residents of Alaska and those on Native American reservations - do have disproportionate rates of substance abuse (mainly alcohol).

As far as seniors who get pensions, what is your definition of "contributing"? In many cases they are eligible for those pensions only once they declare themselves retired.

<comment><USER13> > residents of Alaska

Probably a bad example to bring up.

The Alaska fund distributions amount to roughly ~$1.5k a year. Not quite the same as a pension or UBI. I'll probably get egg on my face for saying this, but I highly doubt anyone in Alaska lives solely on fund distributions.

Further, as noted [1], the "dividend had no effect on employment, and increased part-time work by 1.8 percentage points (17 percent)... our results suggest that a universal and permanent cash transfer does not significantly decrease aggregate employment."

1: [http://www.nber.org/papers/w24312.pdf](http://www.nber.org/papers/w24312.pdf)

<comment><USER14> One of my intern friends a few years ago was from Alaska. He said all that money practically goes towards heating because it gets so freaking cold in the winter.

</comment></comment></comment></comment><comment><USER15> There are two problems with universal basic income:

1/ Many people think UBI is a great idea but everybody imagines something else. This makes discussing UBI very difficult.

2/ Regardless of what version of UBI you personally support, it is probably not a good idea to give money to those who don't need it. Sooner or later people will realize that what they really want is tax/benefit reform, not universal basic income.

REAL NUMBERS HERE -> Check out this process flow diagram: [https://www.lucidchart.com/documents/view/87d3102c-5b89-4001...](https://www.lucidchart.com/documents/view/87d3102c-5b89-4001-9929-346873d19571#)

<comment><USER16> >2/ Regardless of what version of UBI you personally support, it is probably not a good idea to give money to those who don't need it.

Wrong. The system doesn't work if you don't give people to money who don't need it: the administrative requirements of assessing who and who doesn't need it, and then policing all this, is just too high. This is the reason UBI was invented in the first place!

It's very simple: you give the same money to everyone, even if they're a billionaire. To make up for this, you raise the taxes a commensurate amount on the people who don't need it (and more for the really rich people, because the idea is wealth redistribution). So someone making $100k, for instance, obviously doesn't need a handout, so you raise their taxes that same amount so they're paying back in taxes what they're getting from the UBI, and netting zero. It's much easier to do this than to have thousands of government workers auditing everyone to make sure they aren't "cheating" by receiving money they're not qualified for, which is what we do with current welfare schemes.

>Sooner or later people will realize that what they really want is tax/benefit reform

No, tax reform doesn't do anything to reduce the administrative burden of current welfare systems. UBI does. Less money you pay out for unnecessary government office workers is more money you can end up giving to people in need, and society will be better off with those government workers finding more productive professions which might actually generate more wealth and taxable income, instead of just being a drain on taxpayers.

<comment><USER15> Thank you for proving my point. And now look at the numbers in my diagram, the administrative costs are negligible compared to the cost of giving money to those who don't need it.

<comment><USER17> You're missing a section on the bottom of your chart.

Who will pay for UBI? -- income tax. Raise the per capita income rate an average of £12,000, (£15,000 pounds minus the ~3,000 in savings you calculated earlier).

No net impact on the average taxpayer, little impact on the rich and massive impact on the poor.

<comment><USER15> I did the calculation for UK 2015-2016:

There are about 31 million taxpayers in the UK. The basic income tax rate of 20% for income up to £42k/year generates 33% of the income tax revenue. Let's agree that these are not the rich people we want to tax. (88,7% of Britons earn less than £50k/year.)

The higher (40%) and additional (45%) tax rates generate the rest 67% or £117 billion of the £174 billion income tax revenue.

In order to raise additional £472 billion, we would have to increase the higher and additional tax rates to approximately 211%.

As you can see, taxing the "rich" cannot raise enough money to give everyone unconditional poverty line minimum income.

Source: [https://www.gov.uk/government/statistics/income-tax- liabilit...](https://www.gov.uk/government/statistics/income-tax-liabilities- by-income-range), [https://www.gov.uk/income-tax- rates](https://www.gov.uk/income-tax-rates)

<comment><USER17> "Let's agree that these are not the rich people we want to tax."

I definitely do not agree. BI is only viable if the average taxpayer sees no or very little net benefit from BI. So the average taxpayer would pay £15k extra in taxes if they receive £15k in BI. And £42k is above average (but not a lot, the medium income is £21k, but only a little more than half of adults are taxpayers)

<comment><USER15> The average taxpayer with income between £20k and £30k pays on average £2630 tax, some 10.7%. If you hand him over £15k and them tax him on average additional £15k then his tax rate must be around 44%. This will be extremely demotivational. A hard-working person will have barely more than absolute freeloader and if he tries to work extra hard you will take half of his reward.

<comment><USER17> No, he will have almost twice as much money as the freeloader.

More importantly, if both him & the freeloader are spending £15k on rent & food, then the freeloader has £0k of disposable income and the worker has infinitely more disposable income.

Another way of looking at it is that average taxpayer with UBI has an income of between £35k and £45k and has a marginal rate not much different from what people making £45k are paying right now. People making £45k aren't currently significantly demotivated by taxes, are they?

<comment><USER15> You are contradicting yourself.

"the average taxpayer would pay £15k extra in taxes if they receive £15k in BI"

vs

"Another way of looking at it is that average taxpayer with UBI has an income of between £35k and £45k".

Today a taxpayer with median income £21k takes home £19k net. After your reform, he will take home the same £19k net (remember: pay £15k extra in taxes if they receive £15k in BI). Except hew will now be way below the median and making only £4k more than the now ubiquitous dude Lebowski type.

<comment><USER17> The average taxpayer is well above £21k -- that's the median income, which includes the 40% not paying taxes and of course median is well below average due to tail effects.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> A more accurate title might be: Finland declines to extend its experiment with basic income.

</comment><comment><USER19> Reading the comments, I'm getting the feeling of "No True UBI". Every UBI-ish attempt that has been mentioned so far, someone says, "But that's not _real_ UBI, because..."

We may need some more precise definitions. UBI-1 is some precisely-defined thing, UBI-2 is some other precisely-defined thing, and so on. Then we can say, well, Saudi Arabia did and still does UBI-4, and it has had these effects. Then we can look at various experiments and start learning something about whether UBI is workable, and if so, _what kind_ of UBI it needs to be.

</comment><comment><USER20> Instead of giving out money, why not give out the basic necessities directly? A free home, free utilities, free food, a basic vehicle, free clothes, free healthcare? If you're happy with these things you're set, if you want more you work for it and acquire money.

Seems like this would accomplish the same goals of UBI, but with less risks and impact on the economy, and at some point you can benefit from economies of scale to provide these things at even lower cost. People would not need the financial discipline and restraint that comes with managing a basic income.

<comment><USER21> Often times when I've seen this discussed, the reasoning behind straight cash vs just necessities, it often has to do with overhead. If you just give people money, its easier to administer, everyone in the program gets the same cash, theres no inventory to administer, theres nothing to check. The other thing often discussed in the same manner is help that has certain "morality" clauses, such as welfare or help, but only if the poor person makes certain decisions. As far as total impact, you can do more by just giving money, and not spending any of it policing behavior.

<comment><USER20> To me this is just throwing money at a poverty problem and hoping it will fix itself.

It will never work, UBI will inevitably raise prices of things so people will need more basic income to get what they want. That means having to either give out more UBI or have the program become irrelevant because it doesn't keep up with standards of living.

A free house though is a free house. It does not become any less of a houses just because more people have houses. And you don't have to give out more house to each person over time.

It seems to me that we need better systems for administration of free goods. These are problems we can solve, permanently.

<comment><USER22> > A free house though is a free house. It does not become any less of a houses > just because more people have houses.

What about houses that are damaged or destroyed? Will your "trivial" system repair or replace them? What if the occupant is responsible for the damage or destruction? What if this is the second or third such free home they've destroyed?

And how will people move? Can they move? Can people trade homes? Can they still buy and sell them? If a person sells their home will your system give them another one for free?

<comment><USER20> Why do you think a free home must come with some restrictions? It's very simple. It's yours, _free and clear_.

Do whatever you want with it, even destroy it. But you're not getting another one. And if it's damaged you need to repair it. Buy insurance if you can. If you can't deal with it get a free condo or apartment instead not a SFH. If theres a big natural disaster and your home is affected apply for aid or perhaps a new home for these special cases.

</comment></comment></comment></comment></comment><comment><USER23> With UBI people say you are not discouraged from working because everyone gets the money no matter how much money they make. But where does that money come from?

Once you earn enough surely they will be taxing you more than you receive per month, otherwise the system would not work.

<comment><USER24> I have really only read comments on UBI so I might be extremely wrong, but I believe the idea is that as we move toward a more "automated" life, the "1%" can make enough to pay for the 99% to have UBI. And since everyone gets the same baseline, even monumentally high tax rates would be tolerable.

This is basically a way of redistributing wealth with the added side benefit that you can quit your job without fear of losing everything in your life.

<comment><USER25> >you can quit your job without fear of losing everything in your life

That sounds like an American problem more than anything else

<comment><USER24> It's a problem everywhere, but many places have some kind of safety-net working to prevent it.

The idea of UBI (at least in theory) is to make that safety-net universal, remove the barriers to use it, lower the overhead cost of administering a system like it.

Remove the need for applications to benefit from it, remove the wasteful "taxing unemployment income" that happens currently (at least in the US), remove the stigma attached to having it.

</comment></comment></comment></comment><comment><AUTHOR> This is the inconvenient truth: UBI is a horrible idea, it will turn the majority of the population into drunks and drug addicts, watching TV and doing nothing all day...

If you want to be free in life and not to worry about money, you have to work hard first to get your FY money, this is the only way you will appreciate them and the freedom they provide...

</comment><comment><USER26> Well it will be interesting to see if they do publish any findings. I do agree it would have been beneficial to see what would happen if workers were added to the mix. The question some like myself would like to see is, did any of the initial participants gain employment and leave the program? What did they do differently while provided with UBI they did not do before. I would also like to see if they will be followed to determine the negative and positive effects on them after it being discontinued.

my issue with the UBI fascination is that too many automatically assume there won't be work in a highly automated world or that costs of living won't decrease sufficiently as well. where it ends up is still unknown

<comment><USER27> My issue with it is that we aren't even at a point where UBI is viable. Yes, we have lots of automation but we still have many times more jobs still not automated. The experiment isn't going to show accurate results.

But I agree with you - there will still be work available in an automated society.

<comment><USER28> UBI doesn't need automation at all; the big question is if society is more productive with it or with traditional welfare. That's why experiments are needed.

</comment></comment></comment><comment><USER29> Doesn't UBI have the potential to cause inflation (demand and cost-push)? Is this a valid enough concern to search for an alternate solution to UBI?

</comment><comment><USER5> So now, Finland has told every citizen "If we ever seriously start UBI, or any further experiment make sure you behave like you don't have UBI, 'cause soon enough, you probably won't."

</comment><comment><USER30> The article is a bit misleading since AFAIC there are no agreed plans yet on the next steps. The title implies that the project is totally cancelled, but all of the major political parties in Finland are proposing their own solutions for replacing it. Because of upcoming elections, this is a fairly hot topic.

</comment><comment><USER31> I don't see a top level comment mentioning this, but what if UBI just doesn't work? That's certainly possible - that it works seems to be taken as a given, and evidence _against_ that seems to be dismissed frequently in this thread.

A lot of things that work seem like they shouldn't (flight, capitalism) even after a lot of consideration - similarly, a lot of things that don't work seem like they should (Mendelian genetics). Maybe this unfortunately just doesn't work?

</comment><comment><USER32> I wish the article said something about why it's declining to extend the experiment.

<comment><USER33> The article does say this:

> But in December last year, the Finnish parliament passed a bill that is > taking the country's welfare system in quite the opposite direction. The new > 'activation model' law requires jobseekers to work a minimum of 18 hours for > three months - if you don't manage to find such a job, you lose some of your > benefits. And Finance Minister Petteri Orpo already has plans for a new > project once the basic income pilot concludes in December 2018.

In short, the current political climate doesn't support it.

IIRC there's also been some discussion whether the experiment has been in violation of equality guarantees of our constitution, as it treats a randomly selected group different from others.

</comment></comment><comment><USER34> Things you need to live: food, dwelling, energy, transportation, healthcare. (And necessary for a thriving economy/government: trade skills, education, military)

Self-sustaining would be very plausible on extremely modest amounts of income if the government subsidized the dwelling, energy, transportation, and healthcare. It may be unnecessary for large portions of a nation to work if people produced their own goods and services (most of which could be done by individuals, not even necessitating cooperative work except for a few difficult tasks).

What occurred to me, though, is that this would never work in a traditional society because the government would be responsible for too much of people's lives. So as an alternative, a split model may work, where people can choose between a competitive libertarian model and a cooperative socialist model. You either work hard to earn a living that you fully control, or you sit back and let someone provide you with your requirements, and the model you choose determines what things like your taxes or labor go towards.

This may be an incredibly stupid and shortsighted idea, but I would love the opportunity to live in a commune subsidized by the government - with the choice to leave for a different model if it sucked.

<comment><USER35> I would call food, dwelling, healthcare, communication(internet) the four basic necessities. So why not providing these for free and for the rest, just tax other sources of income by a fixed rate depending on how much is needed to provide the free ones?

<comment><USER34> For the first two, humans are pretty capable of providing for these themselves. Having the government provide it alone is a single point of failure, and simply adds cost and complexity where it isn't necessary.

Healthcare is definitely something which could benefit from subsidy, considering how advancements in it often require large coordination of R&D, manufacturing, schools/practice, etc. Communication is just not necessary at all to live.

Transportation, energy, and education are also necessary to enable a means of production, trade, and basic self-sufficiency of living. Paying for these individually is not only less efficient, it hampers the ability of the economy to grow by limiting who has the means to contribute to it. If you can't get to work, you can't do work, and you're basically a burden on society. And having to pay for the energy needed to do things like cook your food and heat your home is just another thing which is inefficient, especially considering different parts of a country may have different access to energy resources.

I'm not well read on tax policy so I don't know the best way to fund these ventures, but it would be obvious that one group would need to be taxed heavily while the other was taxed lightly, due to the difference in the use of or contribution to subsidized resources.

</comment></comment></comment><comment><USER36> I understand the argument that, once free from work, a number of people will voluntarily choose to work as physicists or playwrights or mathematicians.

What I haven't understood, though, is why someone would choose to work as a bricklayer or spend their 20s sitting in a fluorescent office designing an industrial process to make ball-bearing lubricant 0.4% more efficient. It's that sort of menial, unglamorous labor that our society and quality of life is built on.

<comment><USER16> That's because, for some strange reason, you're confusing UBI with some idealized form of communism.

UBI is Universal Basic Income. The keyword here is "basic". If you sit on your ass and collect UBI, you should receive enough money to let you live in a crappy apartment with roommates, and get some crappy food to eat at the local crappy grocery store. Do you want to live in a crappy apartment with roommates, and not be able to afford to eat at a nice restaurant? Me neither. If you want extra luxuries, you have to work more, to make more money. That's UBI in a nutshell.

<comment><USER37> Do UBI supporters intentionally not understand supply and demand?

Who wants to work at a restaurant if they don't have to? Who will lay bricks and take out the trash if they don't have to? The idea that UBi can help people find fulfilling work leads to the question of who does the unfulfilling work.

<comment><USER16> Do UBI haters intentionally not understand wanting to have a better life?

People will work at a restaurant if they don't have to so they can afford a place without crappy roommates, or in a better part of town. It's really that simple. You work, even at a crappy job, and now you have more money than you get with the UBI alone. Is this really such a hard concept for you?

<comment><USER37> > and now you have more money than you get with the UBI alone.

And so does everyone else. Prices will reflect that.

> Is this really such a hard concept for you?

Yes, what's so hard about supply and demand? Housing costs too much? Increase supply. Healthcare costs too much? Increase supply. Education costs too much? Increase supply.

I feel like I'm taking crazy pills here. It's all really simple. If you want the price to go down increase supply. I'm not saying it's easy - but nothing else will work. Redistributing costs more energy than is gained. If you want to help those in need, increase supply.

<comment><USER16> Ok, and WTF do you do for people who can't work, or aren't in a position to get a job, or simply cannot afford things at the prices they're at? You're never going to have free housing and food. That's why we have welfare systems, and that's what UBI aims to improve.

I feel like I'm taking crazy pills here. It's all really simple. Welfare exists for a reason, even if people like you refuse to believe this.

<comment><USER37> > Ok, and WTF do you do for people who can't work, or aren't in a position to > get a job

Make jobs that increase supply, and give some of that supply to those who can't work. China is building new cities from scratch, why not do that given the scope of UBI as an initiative?</comment></comment></comment></comment></comment></comment></comment>


America's Fastest-Growing Loan Category Has Eerie Echoes of Subprime Crisis - <AUTHOR> https://www.google.com/amp/www.wsj.com/amp/articles/americas-fastest-growing-loan-category-has-eerie-echoes-of-subprime-crisis-1484060984?client=safari <comment><USER2> forwarding link to:

[http://www.wsj.com/articles/americas-fastest-growing-loan- ca...](http://www.wsj.com/articles/americas-fastest-growing-loan-category-has- eerie-echoes-of-subprime-crisis-1484060984)

Please use native links.

<comment><AUTHOR> Sorry about that! I was trying to avoid the WSJ paywall.

<comment><USER2> That's well-intentioned; IMHO a better way is to post the native link, then if you've found a successful paywall alternate, add that as a comment.

Using the native link allows searches by site.</comment></comment></comment>


How awesome ended up with Lua and not Guile – Julien Danjou [pdf] - <AUTHOR> https://julien.danjou.info/talks/How_awesome_ended_with_Lua_and_not_Guile.pdf <comment><USER2> Lua has by the far the cleanest embedding story of any scripting language. This isn't about Lua the language succeeding, but the Lua developers being low enough on the difficulty gradient to be included into another codebase.

<comment><USER3> similarly many reports say that php invaded the web because it was cheaper and easier to deploy and run, perl was way better as a language but just a tad too costly</comment></comment>


Ask HN: Why are URLs clickable in comments but not in main thread? - <AUTHOR>

I'm sure this can be changed easily. But it is not. So I guess there's a reason behind it. Also, it makes no sense for authors to post their own links in the comments. <comment><USER2> From: <http://ycombinator.com/newsfaq.html> How do I make a link in a question?

        You can't. (This is to prevent people from using this
        method as a way of submitting a link, but with their
        comments in a privileged position at the top of the
        page. If you want to submit a link with comments, just
        submit it, then add a regular comment.)

</comment><comment><USER3> If they were clickable, this would be an easy way to get around the 'link can only be submitted once' rule.</comment>


PyPy 1.7 released: widening the sweet spot - <AUTHOR> http://morepypy.blogspot.com/2011/11/pypy-17-widening-sweet-spot.html

<comment><USER2> PyPy performance is good, but the project is still not very mature. It's not quite yet ready as a drop-in replacement.

In particular, the build process is really painful (3+ hours on a high-end Xeon workstation) and quite immature.

I was particularly annoyed to discover that the build process isn't incremental -- if it fails for any reason, you get to start all over again.

The CPython extension support is also still very experimental (that is, if you have any Python extension modules written in C, be prepared for a lot of fun getting them to work).

PyPy also doesn't support anywhere near the number of OS platforms that Python does natively. It's very much a Linux, Mac, or Windows thing only. And it's heavily focused on x86 if you want to use the JIT version.

<comment><USER3> 3 hours? You're doing something wrong. I just built PyPy in 49 minutes on a $99 3 GHz Phenom II.

<comment><USER4> You probably have more RAM?

</comment></comment></comment><comment><USER5> It is hard to tell from some of the release statements when they mean a particular thing is an improvement over CPython or over previous performance by PyPy, e.g.:

> _Specialized list implementation. There is a branch that implements lists of > integers/floats/strings as compactly as array.array. This should drastically > improve performance/memory impact of some applications_

Is this improvement over CPython or over previous implementation in PyPy? There are several such comments.

<comment><USER6> Currently, PyPy is faster than CPython at pretty much anything (except when C is involved, for example, but they are working on that, too). You can see their benchmarks and comparisons at <http://speed.pypy.org/>.

What I think they mean by those statements is that this will improve performance over the previous version of PyPy - therefore - improve over CPython as well.

</comment></comment><comment><USER7> I took the plunge and switched over to pypy with version 1.6. Besides the occasional minor headache, most things work as expected and the huge speed-up makes it more than worth it.

</comment><comment><USER8> I, for one, will certainly consider switching to pypy when they have a stable, usable implementation of numpy :)

<comment><USER9> It's likely to take a while. See Travis's post: [http://technicaldiscovery.blogspot.com/2011/10/thoughts- on-p...](http://technicaldiscovery.blogspot.com/2011/10/thoughts-on-porting- numpy-to-pypy.html)

There are two main problems he sees - numpy is a moving target (as it continues to evolve), and the C-API of numpy is one of its most useful features (as lots of numpy extensions like Scipy and matplotlib may require it).

<comment><USER10> As you might know, we disagree with Travis when it comes to timelines. C API is not really useful without CPython C API and we're trying hard to make pypy interoperate with C. Look for f2pypy for an example.</comment></comment></comment>


Creating Better User Experiences on Google Play - <AUTHOR> http://android-developers.blogspot.com/2015/03/creating-better-user-experiences-on.html?m=1

<comment><USER2> See also [http://techcrunch.com/2015/03/17/app-submissions-on- google-p...](http://techcrunch.com/2015/03/17/app-submissions-on-google-play- now-reviewed-by-staff-will-include-age-based-ratings/)

"Google has been human reviewing all Google Play store apps, and no one noticed"</comment>


Chattanooga, TN Startups - <AUTHOR> http://noogastartups.com/

<comment><AUTHOR> Website contributor here. Super basic website that still needs a lot of work to showcase the city, startups, and job opportunities but it's a start. Inspired to post when I saw the Started in Seattle website trend earlier today.</comment>