India blocking climate talks: Warsaw, Bangkok, and Kyoto negotiations - <AUTHOR> http://www.slate.com/articles/health_and_science/energy_around_the_world/2013/11/india_blocking_climate_talks_warsaw_bangkok_and_kyoto_negotiations.single.html <comment><USER2> Logically speaking for India to reduce its total emissions one of two things should happen: a huge number of people in India should die or Indians should consume almost nothing (everything else being equal.)

I don't understand how anyone can fault India for its current stance given that the state we are in was caused by the developed countries. The only way anyone can fault India is by asserting that an Indian life is worth less than a life in a developed country.

[http://en.wikipedia.org/wiki/List_of_countries_by_greenhouse...](http://en.wikipedia.org/wiki/List_of_countries_by_greenhouse_gas_emissions_per_capita)

[http://en.wikipedia.org/wiki/List_of_countries_by_carbon_dio...](http://en.wikipedia.org/wiki/List_of_countries_by_carbon_dioxide_emissions_per_capita)

This is like moving into a new house and being forced to pay for the damage caused by the old tenants. And the old tenants are forcing you to pay for the damage while they live across the street in a brand new house constructed by stealing from the old place.

<comment><USER3> India has also been given opportunities never available to western countries during their period of industrialization, such as access to a wide variety of medicine and technology. I would just like it to be clear that India is in a different situation than what many others were at comparable levels of development.

<comment><USER4> India was also colonized.

You aren't being unbiased when you point out medicine and technology, but not colonialism.

<comment><USER5> So was Ireland, were not doing too bad now, thank you

<comment><USER6> And for anyone who discounts the affects of English dominion over Ireland, look up the history of the Irish Potato Famine, during which _England continued exports of grain and beef from Ireland to England._ This was while _one million_ people died of starvation, and a million more emigrated (most to the US and Canada), a fifth to a quarter of the island's population. A classic case of distribution inequity. The implications in terms of home rule and ongoing political strife between Ireland and England persist to the present time.

[https://en.wikipedia.org/wiki/Great_Famine_(Ireland)](https://en.wikipedia.org/wiki/Great_Famine_\(Ireland\))

Similar circumstances accompanied the Holodomor -- the Ukranian famine (then part of the USSR) from 1932-1933 in which 2.4-7.5 million people died, _again_ while food was being _exported_ to support the Russian SSR.

[https://en.wikipedia.org/wiki/The_Ukrainian_famine](https://en.wikipedia.org/wiki/The_Ukrainian_famine)

The point: history is rife with inequities. Addressing the problems we face _now_ is going to have to involve setting those aside. I've speculated that it might be literacy (allowing records of the inequities to be preserved) which has a certain relationship with perpetrating the memory of such injustices (though it's also been pointed out that ignorant societies can be mobilized by demagogues).

In the instant case, I think it's fair for India to call for concessions by industrialized nations, but it's ultimately self-defeating to pursue a "growth" policy which will be anything but.

<comment><USER4> The general point "history is rife with inequities" is not going to mean anything to any developing nation. "History is rife with inequities" only means something to rich westerners.

You are not going to get India on board by claiming Ireland had it just as bad. India's GDP per capita is $1500. Ireland's is $45000. That's a factor of 30.

China is going to think the same way. They are going to see any bluster from western countries about emissions as thinly veiled attacks on their ability to industrialize. That's a perfectly reasonable opinion.

<comment><USER6> _" history is rife with inequities" is not going to mean anything to any developing nation._

There are plenty of developing nations with their own histories of conflict. India and Pakistan come to mind. Much of Africa. Much of SE Asia and (take your pick) Japan and/or China (I'm omitting the colonial cases of Britain, France, the Netherlands, and the US here).

So: you're wearing LDC blinders. And my broader point is _we need to get over this._ Not _ignore_ it, but get _over_ it.

<comment><USER4> Just to be clear, we're talking in the context of emissions.

In the context of emissions, it's perfectly reasonable for a developing country to say "Well, we were just colonized, so we're not really keen on reducing our competitiveness to fix a problem you created" to a western country. "History is rife with inequities", will not _mean anything_ to them.

And if you want to fix the problem of emissions, you need to understand that, instead of just saying "Well these developing countries are sure being jerks by blocking talks!"

What is an LDC blinder, btw?

<comment><USER6> LDC: less-developed country. Blinder: inability to see (or acknowledge) an issue. It's a case of being so vested in an un/underpriviledged mindset that you justify or dismiss harmful actions on your own part.

Blocking talks (and I'll have to give the article / broader story a closer read to see how accurate that is) is a dick move, plain and simple. _Making an alternate proposal_ (and I'd be more than happy to consider normalizing CO2 emissions per capita as an alternative) would work for me.

When a significant aspect of the Slate article dealt _not with CO2 emissions but with HFCs_ \-- hydroflourocarbons, used as refrigerants and themselves potent and long-lived greenhouse gases -- it becomes rather more difficult to pull the carbon / colonization card. Which is just what India are doing here.

You've gone on the attack against several people in this thread, largely on the "India was oppressed" card. Not to put too fine a point on it: that's not productive. If you want to introduce that fact into your debate, I'd suggest finding an alternative argument.

<comment><USER4> Seeming reasonable to people this thread is not a priority for India. Neither is seeming reasonable to western countries. India wants to industrialize, and they will do it any way they can.

If you care about emissions, you need to understand that. Saying that they are making dick moves for making perfect reasonable, rational decisions given their position will not be compelling to them.

<comment><USER6> Wanting something alone won't make it so.

Mind: the industrialized Western nations need to learn this as well.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> The problem with these talks are that from a developing country's perspective it looks like developed nations used cheap energy to get ahead. Now they want to curb usage of cheap energy in developing nations because:

1\. Suddenly, they're affected by climate change, or claim to be.

2\. It's just a ploy to increase energy costs for developing nations and keep them behind.

This may or may not be true but with this kind of perception, such talks will never go through. Also, there are choking levels of pollution in New Delhi [1] and Beijing. The cities are _really_ uncomfortable, and there is a growing body of research to show that air pollution is carcinogenic. [2]

These countries would do well to curb pollution and use clean energy just in the interest of public health. Unfortunately, public health is very low on the agenda.

New Delhi is on the brink of ecological collapse (or maybe beyond that depending on the definition). There is no clean air, clean water, or clean soil. There are no numbers to indicate how many pollution related deaths occur in India annually or what kind of productivity is lost. Frankly, no one cares either. Until someone is personally effected (in a drastic way, like NO2 poisoning and dropping dead..) there will be no change. A very large percentage of children in New Delhi are diagnosed with asthma. [1]

Climate change is a far cry from getting discussed if domestic air pollution isn't a cause for concern.

Source: I am Indian and spend a lot of time there quite often.

[1] - [http://bkpk.me/cigarettes-arent-that-bad-after- all/](http://bkpk.me/cigarettes-arent-that-bad-after-all/)

[2] - [http://edition.cnn.com/2013/10/17/health/geneva-air- pollutio...](http://edition.cnn.com/2013/10/17/health/geneva-air-pollution- carcinogenic-who/)

<comment><USER8> Yeah. Bang on. That is how it is. Climb the ladder and then throw it away so that others can't get to where you are.

That fact of the matter is that every economy goes through this cycle (of growing up). Child labor, poor health-care, now pollution and soon patents.

While not being pertinent to this discussion, the country with the greatest patent lobbying bodies is also the country that committed the greatest IPR violations. More here: [http://www.youtube.com/watch?v=jQZJ5Jl41nk](http://www.youtube.com/watch?v=jQZJ5Jl41nk)

<comment><USER9> It's not a perfect cycle. LA's terrible smog was not a result of _not caring_ , it was a result of the catalytic converter _not existing_.

Guess what, the catalytic converter exists now.

<comment><USER10> Was the smog was there before LA started pumping out pollution?

</comment></comment></comment></comment><comment><USER11> There is something almost colonialist about the way the arguments on the Indian side are never given (although their motives are discussed in depth).

Last time I checked, both China and India argued that global emissions limits should be done on a per-capita basis, and that therefore China and India should not be obligated to reduce their emissions.

While there are arguments to be made against this claim (e.g. should China and India be rewarded for their large populations?), it would be nice to see these arguments being addressed directly, rather than assuming that non-Westerners are only ever driven by base politics.

<comment><USER12> Maybe this is realpolitik, but how about assuming everybody is only driven by base politics.

Or how about anybody who isn't rich enough to have at least savings sufficient for 6 months without any income (which is probably 98% of the planet) is only ever driven by short-term politics.

</comment></comment><comment><USER13> A counter argument - [http://swaminomics.org/a-climate-summit-that-matters- little/](http://swaminomics.org/a-climate-summit-that-matters-little/)

From the perspective of India or for that matter any developing nation aspiring to free its people from the shackles of poverty the above argument is commonsensical (sic) while the Slate article is condescending and biased in favour of developed countries.

Excerpts from the above article -

 _Copenhagen hardly matters. If it doesn't produce an agreement, it clearly won't matter. But even if it yields an agreement, that will matter very little.

Why? Because reducing carbon emissions by 80% from the 1990 levels – the target for 2050 for rich countries – depends on technological breakthroughs, not political pledges at Copenhagen.

...

In the Kyoto treaty on climate change, 37 rich countries pledged to reduce their carbon emissions to 5% below their 1990 level. But most actually increased their emissions. These very treaty-breakers now propose another treaty!

...

Despite climate uncertainties, it makes sense to mitigate emissions as insurance against a disaster that may never happen. Treaties are often signed to provide mutual insurance against political and economic risks. But if the insurance premium becomes costly enough to threaten economic distress, governments will abandon the treaties (a la Maastricht). No government will create a recession today to avoid a future disaster that may not happen anyway.

The lesson for Indian strategy at Copenhagen is clear. India should talk tough and not worry about being called a deal-breaker. When a deal's value is so uncertain, it matters little whether it's broken or not. India should keep its commitments light, and be ready to jump ship if others do. Never assume that others will actually implement climate pledges._

</comment><comment><USER14> If CO2 emissions are truly an existential threat to the world's population then, aside from other obvious steps, the wealthy countries of the world should be subsidizing the adoption of carbon neutral energy sources in the developing world. Asking the poor to forgo stepping up into affluence is too much to ask and immoral in the extreme.

</comment><comment> s-topper Looking at these data:

[http://en.wikipedia.org/wiki/List_of_countries_by_carbon_dio...](http://en.wikipedia.org/wiki/List_of_countries_by_carbon_dioxide_emissions_per_capita)

[http://www.wolframalpha.com/input/?i=USA+total+primary+energ...](http://www.wolframalpha.com/input/?i=USA+total+primary+energy+consumption+vs.+GDP)

[http://www.wolframalpha.com/input/?i=USA+vs+India+coal+consu...](http://www.wolframalpha.com/input/?i=USA+vs+India+coal+consumption)

USA should make do with one gas-guzzling truck less per person, instead of bullshitting their pseudo-intellectual "green" preaching on India and China.

</comment><comment><USER15> _" Tiny" per-person carbon footprint compared to the west. _ 3rd highest.

And India is the problem?

</comment><comment><USER16> Lets leave aside everything else. One Indian's per capita emission should be exactly equal to one American's per capita emission. Isn't that justice?

The world's per capita emission in 2010 was 3 times that of India. US emits 10 times more than us on a per capita basis. It befuddles me. HN please explain how India is in the wrong here?

</comment><comment><USER6> The dilemma: the GDP growth of China and India are almost wholly accounted for by increasing energy consumption, as I've detailed on G+:

[https://plus.google.com/104092656004159577193/posts/LyQx8fcv...](https://plus.google.com/104092656004159577193/posts/LyQx8fcvYBG)

You can see the relationship between GDP and energy via Wolfram+Alpha:

China: [http://www.wolframalpha.com/input/?i=china+total+primary+ene...](http://www.wolframalpha.com/input/?i=china+total+primary+energy+consumption+vs.+GDP)

India: [http://www.wolframalpha.com/input/?i=india+total+primary+ene...](http://www.wolframalpha.com/input/?i=india+total+primary+energy+consumption+vs.+GDP)

That said: the entire planet's got a bit of a problem, and the truth is that growing the economies of China and India through yet _more_ increased fossil fuel consumption (much of both nation's energy comes from the worst possible source: coal), will have tremendously bad consequences.

Another factor is that the promise of economic growth has long stood in for efforts to produce greater equity -- with a growing pie, a promise of a better future can be made to all. When the pie stops growing (or even slows markedly) that relief valve is no longer available. Worse, the dynamics of various systems and institutions, _including liberal democratic ones_ (but also "free market" systems) appear to behave pathologically under resource constraint circumstances (not that non-democratic ones behave better in all cases). It's a rather sticky problem (and for the record: I happen to like many of the features of democratic and liberal institutions).</comment>


2014: The Year Extortion Went Mainstream - <AUTHOR> http://krebsonsecurity.com/2014/06/2014-the-year-extortion-went-mainstream/

<comment><USER2> A few thoughts that stand out:

1\. If this turns out to be widespread, this could generate a huge amount of negative publicity for Bitcoin. As Krebs pointed out in the article, this type of attack is specifically enabled because of Bitcoin -- you can't (easily) send an extortionist untraceable money through other means. If a politician hears about this, a reliable knee-jerk reaction could be: "Look at the evil this Bitcoin is enabling! Targeting poor hardworking small-business owners. Join me to ban this terrible thing and help protect our small-business owners!" That's a pretty easy sell for a politician and hard for people to object to ("Think of the children!")

2\. The notice is so blatantly outrageous that I wonder if this isn't a ploy by some anti-Bitcoin party to acheive 1) above. Even the original protection racketeers had some ever-so-slight veil -- "No, no, see, we're your new partners. We're here to protect your business. You pay us, and we protect you. Wouldn't it be a shame if you didn't..."

This is just as in-your-face as it can possibly be. Seems odd.

<comment><USER3> Whatever the reason, this will just raise the proportion of transactions on the Bitcoin network that are related to criminal activity. It won't take much more for governments to start treating any and all BTC exchanges as facilitating money laundering and other crimes, and shut them down. Without the exchanges, Bitcoin in its current state is dead.

</comment></comment><comment><USER4> And let 2014- become the time that baseless anonymous reports lose any and all credibility, whether it be to Yelp or an authority figure.

<comment><USER2> That would be wonderful - but we have a long way to go before Yelp loses credibility (for better or for worse). For some reason, lots of people trust them. They shouldn't, but they do.

<comment><USER5> Well, I don't like how Yelp does business, and I've heard some horror stories about how Yelp reviews have crippled smaller businesses, but I don't know of any good alternatives, and the service has directed me to a passable restaurant every time I've used it.

Until Yelp's sort-of-extortionist practices start affecting its users and someone makes an alternative, it's going to be hard to affect their user base.

</comment></comment></comment><comment><USER6> Is someone able to mirror this post or paste it in the comments? The website is blocked by my ISP (etisalat)

</comment><comment><USER7> This is actually good news for Bitcoin. It's showing strong signs of mainstream adoption.</comment>


Reports of Gunman Outside [US] Capitol, lockdown in effect - <AUTHOR> http://www.nytimes.com/news/fiscal-crisis/2013/10/03/reports-of-shooter-outside-capitol/

<comment><USER2> Prediction #1: There will be more of a push for gun control.

Prediction #2: Conspiracy theorists will say that this was a false flag operation to increase gun control all along.

</comment><comment><USER3> more here: [http://www.washingtonpost.com/blogs/liveblog- live/liveblog/s...](http://www.washingtonpost.com/blogs/liveblog- live/liveblog/shots-fired-at-capitol/?hpid=z1)</comment>


Segfault Episode 2: Computer Vision with Professor Bharath Hariharan - <AUTHOR> https://honestyisbest.com/segfault/2020/Jul/17/computer-vision/ <comment><AUTHOR> Hi folks, I'm the host of Segfault, which is a podcast about computer science research. In this episode, Cornell Professor and former Facebook AI Researcher Bharath Hariharan joins me to discuss what got him into Computer Vision, how the transition to deep learning has changed the way CV research is conducted, and the still-massive gap between human perception and what machines can do.

Happy to answer any questions about the stuff we talked about, and would appreciate any feedback you might have.

FYI, in addition to the audio, there's a complete transcript available on the page as well.</comment>


Ask HN: Recommend a Good Sci-Fi Book - <AUTHOR> I've recently read:<p>-  The Gods Themselves, Asimov: The second story is brilliant. The other two are meh.<p>-  Neuromancer, Gibson: So disappointing I couldn't finish it. Is there a better cyberpunk book out there?<p>-  Ready Player One, Cline: Loved the book, loved the movie.<p>-  Slaughterhouse-Five, Vonnegut: Not a pure Sci-Fi book, but loved it nonetheless. <comment><USER2> CJ Cherryh, Cyteen (and then the rest of the Merchanter universe).

Iain M Banks, Player of Games (and then everything else)

For cyberpunk, Neuromancer and the sprawl trilogy have not aged terribly well. I still like them, but they're from a certain context.

Try Greg Egan's Permutation City; Bruce Sterling's Heavy Weather, Islands in the Net, or Holy Fire.

Lauren Beukes, Zoo City.

There are so, so many ... ;-)

</comment><comment><USER3> Blindsight, Peter Watts [[https://en.m.wikipedia.org/wiki/Blindsight_(Watts_novel)](https://en.m.wikipedia.org/wiki/Blindsight_\(Watts_novel\))]. Avaliable free in a number of formats from his website: [https://rifters.com/real/Blindsight.htm](https://rifters.com/real/Blindsight.htm)

</comment><comment><USER4> Vernor Vinge: A Deepness in the Sky and A Fire Upon the Deep.

Iain M. Banks: Consider Phlebas (and then spend the following months reading all the rest of the Culture series)

<comment><USER2> If you're familiar with Usenet, A Fire Upon the Deep has extra good moments.

</comment></comment><comment><USER5> [http://www.wikiwand.com/en/Roadside_Picnic](http://www.wikiwand.com/en/Roadside_Picnic)

</comment><comment><USER6> "Story of Your Life" By Ted Chiang (source for the movie "Arrival")

</comment><comment><USER7> "Schild's Ladder" by Greg Egan Really, anything by him is good but Schild's Ladder is the best.

</comment><comment><USER8> Neal Stephenson - Snow Crash

</comment><comment><USER9> _The Moon is a Harsh Mistress_

</comment><comment><USER10> Neal Stephenson: Cryptonomicon

<comment><USER2> For me, Snow Crash was awesome, but like early Gibson, it's lost a little with the passage of time.

His middle-period work did nothing for me at all. Just overdone, to my taste.

I haven't read anything after the Baroque Cycle put me off.

<comment><USER10> I enjoyed the Baroque Cycle, but at the end was left with little sense of resolution. I have enjoyed Anathem since.</comment></comment></comment>


Restoring Bletchley Park: birthplace of modern computing - <AUTHOR> http://googleblog.blogspot.com/2011/08/restoring-bletchley-park-birthplace-of.html

<comment><USER2> I've been to Bletchley Park about 3 times now. It is staggeringly amazing what went on there, when you think of the effort those people went through and their contribution to the war. It must have been incredibly painful to let people die rather than run the risk of the Germans knowing that the codes were broken.

If you ever come to the UK from abroad, you can get a train from Euston Station (zone 1 on the underground) to Milton Keynes and from there head to Bletchley Park. It's well worth a day trip for the serious geek/hacker type.

<comment><USER3> I just did this about a month ago, and it couldn't be easier to get from London to Bletchley Park, it's literally right up the road from the Milton Keynes train station, maybe a two minute walk.

Getting to Down House (Darwin's House) from London, on the other hand, while totally worthwhile... what a hassle!

<comment><USER4> I think you mean the Bletchley rail station - MK Central is some miles away.

<comment><USER3> Yep, sorry about that, it was the MK line, stopped at Bletchley :).

</comment></comment></comment></comment><comment><USER5> They deserve credit along with a number of other sites. (The Manhattan Project is one.)

<comment><USER6> I'm not trying to be snarky, but I did not know the Manhattan Project used (non-human) computers in any significant way. None of the documentaries/specials I've seen have mentioned any use.

Would you care to enlighten me?

<comment><USER5> They used IBM machines with punch cards to do (what were then) large numbers of automated computations.

[http://en.wikipedia.org/wiki/History_of_IBM#1939-1945:_World...](http://en.wikipedia.org/wiki/History_of_IBM#1939-1945:_World_War_II)

Feynman often used to rib Danny Hillis about Computer Science being a fluff field, since he'd already done all that stuff using primitive machines back in the 40's.

<comment><USER6> Thanks for that.</comment></comment></comment></comment>


Tim O'Reilly: the golden age of the programmer is over - <AUTHOR> https://www.infoworld.com/article/3564824/the-unwavering-optimism-of-tim-oreilly.html <comment><USER2> I agree with his assessment that technical literacy is a must have in today's world. I didn't understand his argument that the programmer's golden age is over?</comment>


Uncovering 2017's Largest Malvertising Operation - <AUTHOR> https://blog.confiant.com/uncovering-2017s-largest-malvertising-operation-b84cd38d6b85 <comment><USER2> This article helped me understand the junk/spoofing emails I get. Emails that say things like "You have 2 messages from Fedex" etc. When I looked into them a while ago, the simple javascript redirect was easy to figure out (they all concatenate numbers from an array onto a string and redirect to a string). The redirect is always to a php file, often embedded using bad wordpress installs. The php then does more redirects. At first, I was able to get to the redirect, but lately my crude manual attempt fails as explained by the article: the redirect code goes to pains to filter out "researchers" from genuine spam targets. I think there are two classes of victims, though. Ordinary users like me are the obvious ones, but I think that the many shady business that are presumably paying these malvertising agencies are unlikely to be getting much value for their bucks. Too bad the article doesn't have any information on the revenue return of a malvertising campaign.

</comment><comment><USER3> >These criminals are hijacking programmatic advertising and giving publishers a bad name. >Our sole focus is on helping advertising platforms and publishers rid the world of malware.

Getting rid of malware is good, but giving web advertising a bad name also sounds good. Advertising/Propaganda or whatever all act to try and manipulate people's behaviour. The term 'Mind Virus' comes to mind.

</comment><comment><USER4> I am amazed at how structured the operation was. Is there any estimate as to how profitable a campaign on this scale (or any scale for that matter, I do not know where money enters into the equation)?

<comment><USER5> Author here, we don't know their profit, but we estimate that they've spent about $220,000 through 2017, which is fairly cheap if you want to blast 1 billion malverts across the interwebs.

<comment><USER6> Ad spent estimate seems to be very low. Most players operating out of Russia often spend 10-20K a day, so 200K is just 10 days worth of adspend. But such guys often have 10-20 people working for them on <$1-2K monthly wage. (For Russia/Eastern Europe or heck South Asia it's quite good) ROI on such campaigns can be anywhere between 150-600% or even more.

</comment></comment></comment><comment><USER7> Fig. 11 of this analysis links the operation to an address in Kiev. Given the level of sophistication described, it seems likely that this was done by (or at least with the support of) an intelligence agency; I would bet on this having been a project of the FSB.

<comment><USER8> That's still a big assumption without additional evidence. Most web cybercrime also comes from Eastern Europe,.</comment></comment>


Video: Evolving wind turbine blades - <AUTHOR> http://www.youtube.com/watch?v=YZUNRmwoijw

<comment><USER2> When I submitted this[0] nearly two years ago, the only comment was:

        It looks like it gets stuck in a local maximum.[1]

... which seems to ignore the fact that the evolved version seems to produce more power than the industry standard solution.

I find this a fascinating study, but haven't found any follow-up over the intervening years.

[0] [https://news.ycombinator.com/item?id=2995298](https://news.ycombinator.com/item?id=2995298)

[1] It looks like it gets stuck in a local maximum.</comment>


Pentagon Sends Weapons to Fake Federal Agency - <AUTHOR> http://libertyviral.com/pentagon-sends-weapons-to-fake-federal-agency/ <comment><USER2> Kind of makes one wonder if they'd have ever figured out on their own they did that.

</comment><comment><USER3> Not surprising that such a screw up happened but what was surprising was that they received excess military equipment in less than a week. I did not think any government office did anything in such a short timeframe.

<comment><AUTHOR> <sarcasm>One wonders if Amazon Prime is now sub-contracts weapons fulfillment and delivery for US government.</sarcasm>

<comment><USER3> Unfortunately I am not being sarcastic. I spent many years in executive service in the state government. Several of those years as the state liaison to the federal government. I have never seen anything that was very simple get done in one week.

This is the primary reason I left public service. This move entirely too slowly.</comment></comment></comment>


Amazon ECS Management APIs Down - <AUTHOR> We've been experiencing a high number of timeouts and internal server errors when communicating with ECS services in the US West (Oregon) region. Our instances and load balancers are still operational, but we're currently unable to make changes to ECS infrastructure.<p>Specifically, ECS-related CLI commands are returning errors and the ECS Clusters dashboard is failing to load in the web console. Anyone else noticing this? <comment><AUTHOR> Still seeing the errors an hour later here. The AWS Status dashboard has finally been updated to show the issue, so it sounds like they're looking into it now.

Edit: Resolved now</comment>


HP keylogger - <AUTHOR> https://zwclose.github.io/HP-keylogger/ <comment><USER2> It's a debug log. On its own, this driver doesn't do anything malicious. A malicious piece of software could exploit it, but there's no evidence that any did. Even if it got flipped on accidentally, it would merely log information and not transmit it anywhere.

<comment><USER3> _Even if it got flipped on accidentally, it would merely log information and not transmit it anywhere._

Indeed, this is pretty benign compared to the "feature" in Windows 10 which _does_ log and send that information if you enable it... and I believe this _is_ enabled by default:

[https://images.techhive.com/images/article/2015/08/0904-win1...](https://images.techhive.com/images/article/2015/08/0904-win10-general-100609115-orig.jpg)

I really wish the "security" people would stop "crying wolf" constantly with things like this.

<comment><USER4> I dunno, I didn't get a sense of urgency or crying wolf from the blog post. it was interesting information and a good read but I don't see verbiage leaning towards these "security" people you are criticizing. to me it read as something he was curious about and ended up inquiring to the manufacturer who confirmed some details. keylogger is a pretty scary word, but is that not what is happening, despite it being benign to other software's behavior?

I personally appreciate the post, because i like to be _aware_ of what could be potentially recorded or transmitted on machines i use. It doesn't have to "be worse than windows10" to be useful info to some users, and we certainly shouldn't expect all security-minded blog posts to be breaking news to be taken seriously.

Context aside i find it fun to watch things unravel or peer into how other people work!

<comment><USER2> I liked it too, myself. Personally I didn't find it over the top, but the title could've been more descriptive. It is technically a keylogger but keeping it vague just makes people assume it's malicious, when the code in question is obviously not, on its own.

</comment></comment></comment></comment><comment><USER5> Is having optional debug trace that can be activated only with admin rights really a bad thing security-wise ? Maybe when combined with other bug/features ?

<comment><USER6> One less to have to write if you want to do evil. HP -oh nice, just have to enable their builtin keylogger.

<comment><USER3> If you have admin access, you could install whatever keylogger you want, so IMHO this is a moot point.

<comment><USER7> External keylogger will likely be detected by antivirus sowtware and HP drivers are probably whitelisted.

</comment></comment></comment></comment><comment><USER8> SynTP.sys is signed by Synaptics on my Thinkpad. Why is this HP-specific?

</comment><comment><USER9> Keyboard driver had debugging code in it.

</comment><comment><USER10> Don't use computers for anything you want to keep private.

<comment><USER11> Or rather, proprietary software and hardware.

<comment><USER12> Why would non-proprietary software and hardware not be insecure?

<comment><USER11> Because typically you can't get away with sneaking code like `void keylogger() {` into freely available code. Even if hidden well, it will be discovered sooner or later with enough eyes. The only insecurities "allowed" by open- source code are accidents, and these can be discovered much quicker than accidents included in proprietary code.

<comment><USER12> In practice the situation is a little different though [https://archive.fosdem.org/2017/schedule/event/linux_desktop...](https://archive.fosdem.org/2017/schedule/event/linux_desktop_versus_windows10/attachments/slides/1730/export/events/attachments/linux_desktop_versus_windows10/slides/1730/fosdem_linux_desktop_security.pdf)

Perhaps you've heard of the disaster known as X?

It's pretty clear that 'security' has never been a concern for Linux desktop developers, what software would you choose to run on your open source hardware instead of linux?

Here are a plenty of exploit mitigations that simply do not exist for Linux, [https://www.blackhat.com/docs/us-16/materials/us-16-Weston-W...](https://www.blackhat.com/docs/us-16/materials/us-16-Weston- Windows-10-Mitigation-Improvements.pdf)

</comment></comment></comment></comment></comment><comment><USER13> Yet another one? There was already this one in the audio driver earlier this year... [https://news.ycombinator.com/item?id=14314795](https://news.ycombinator.com/item?id=14314795) Makes you wonder who this is for.

</comment><comment><USER14> That is why we need opensource hardware.

<comment><USER15> Or open source drivers

<comment><USER14> Proprietary hardware can have a hardware backdoors.

<comment><USER16> Yes, and even those can be detected, triaged, and then summarily killed. Even those with heavy crypto and intentional hiding schemes.

I'm speaking of Intel's management engine. Hacked.

I'm also speaking of Apple's secure enclave processor. Hacked and unencrypted.

Yeah, it'll by you some time. But when the target's nice and fat and juicy, well do I have a story for you...

</comment></comment></comment></comment><comment><USER17> If HP was able to release a patch to remove keylogger is a very short amount of time, does that mean that they already know about the keylogger being in the production code and had a patch ready just in-case it was detected?

<comment><USER18> I don't see a disclosure timeline on there, so "quick" is a relative term.

Perhaps they just recognised that it could explode into a Superfish sized PR problem and went to fire off some angry calls to Synaptics for not surrounding their debug prints with ifdef.

I wonder if the old driver was WHQL-certified as well... (Although I'm under the impression that just needs to pass the SDV)</comment></comment>


Stanford's Mechanical Engineering department's Product Realization Laboratory - <AUTHOR> http://www.stanforddaily.com/2011/01/07/building-it-bigger-design-comes-to-life-at-the-prl/

<comment><USER2> If you are in Los Angeles, there are several affordable machine shops here. I'll be taking the Venice Machine Shop class starting next Monday (<http://venicemachine.com/>). For only $55, you get 6 hours of machine shop access for 3 months! El Camino College has a more modern machine shop with all sorts of cool prototyping machines but the classes are on weekday mornings (<http://southbaymachine.com/>). Machine shops in other parts of our fair & sprawling region are listed here: <http://venicemachine.com/expandedinfo/machineshopclasses.htm>

There are also Fab Labs around the world: <http://fab.cba.mit.edu/about/labs/>

<comment><USER3> Anything like this in Boston that people know about?

<comment><USER2> It appears there is an Open Access Fab Lab at the South End Technology Center in Boston (<http://www.tech-center-enlightentcity.tv/>)

MIT students have access to several shops such as the Edgerton Center Shop: <http://web.mit.edu/Edgerton/www/Shop.html>. Others are described here: [http://www.mitadmissions.org/topics/learning/libraries_facil...](http://www.mitadmissions.org/topics/learning/libraries_facilities_computing/machine_shops_part_2.shtml)

</comment></comment></comment><comment><USER4> "Engineers and designers are much more powerful if they have built things."</comment>


What's New in the Updated App Store License Agreement and New Review Guidelines - <AUTHOR> http://daringfireball.net/2010/09/app_store_guidelines

<comment><USER2> > We will reject Apps for any content or behavior that we believe is over the > line. What line, you ask? Well, as a Supreme Court Justice once said, "I'll > know it when I see it". And we think that you will also know it when you > cross it.

The proper quote, from Justice Potter Stevens, was:

> I shall not today attempt further to define the kinds of material I > understand to be embraced within that shorthand description; and perhaps I > could never succeed in intelligibly doing so. But __I know it when I see it > __, and the motion picture involved in this case is not that.

How do I know? Because by wild coincidence, I quote it on the first page of a free book I wrote (<http://cs.gmu.edu/~sean/book/metaheuristics/>).

</comment><comment><USER3> On April:

 _"My opinion is that iPhone users will be well-served by this rule. The App Store is not lacking for quantity of titles."_ (He's talking about 3.1.1)

[http://daringfireball.net/2010/04/why_apple_changed_section_...](http://daringfireball.net/2010/04/why_apple_changed_section_331)

Today, he doesn't comment on 3.1.1 but says _"The existence of this document is a very welcome change"_ regarding the rules document. I'd like to see some comments on 3.1.1 as well.

</comment><comment><USER4> So is an iPhone scripting environment now allowed?

<comment><USER5> Yes. For more commentary, see <http://news.ycombinator.com/item?id=1675131>

</comment></comment><comment><USER6> >This is a living document, and new apps presenting new questions may result in new rules at any time. Perhaps your app will trigger this.

In other words - you (still) can't use this list to see if your app will be accepted. Only whether it will be rejected with certainty.

This isn't unexpected, but as long as apple works hard to make this the only way to install your apps, it is still unacceptable.

<comment><USER7> I disagree with that, and I was very solidly on the other side when they had their previous set of rules.

The list given here shows 'intent'. Now you can go and interpret it to the letter as if it is a kind of legal document, but that's not the right way to approach this, just as it isn't very clever to try to live by the letter of the law but to ignore the spirit of it.

Apple has clearly set a bunch of rules here that indicate what is the desired way you should develop your app and how you interpret these rules is up to you. If you're going to do your best to squeak by the guidelines they're warning you up front that they may amend the guidelines and ban your app anyway, just in case you decide to go 'legal' on them.

Is's a perfectly reasonable thing for them to do.

I'm surprised at the magnitude of this about-face, anybody with a clear conscience can take this list, self-validate their app and have a very good idea of whether or not it is going to pass.

No doubt there will be smart asses that will try to abuse the fact that the list is now published to find loopholes and Apple has pre-emptively closed those.

All (or as far as I can see it) of the dealbreakers are gone and I would imagine they're gone for good.

<comment><USER8> I think DF was right in its analysis: These changes are likely coming straight from Jobs. Perhaps it was Apple Legal dictating the rules and it just didn't seem "human" enough. Perhaps Jobs wanted to unify the left and right hand to know what both were doing. Maybe they're scared of the Probe.

Apple is showing here that it is one of the biggest small companies around. The wording in the App store review guidelines reads like something out of an up-and-coming Webapp startup run by a 20-something ne'er-do-well.

It's clear that Apple wants to get back to its "Designed by Apple in California" jeans and mock-turtleneck 'tude. The draconian rules and BS were antithetical to that. Hey, maybe the gyrating silhouettes will make their comeback to replace disembodied hands in their commercials.

<comment><USER9> Agreed, I'm very impressed with the changes to both the content and tone. For me the annual charge to run my own code on my own hardware and the prohibition on non-appstore distribution are still dealbreakers, but this will undoubtedly keep many developers around who otherwise would have jumped ship. It will also allow more apps to be ported to and from iOS, which is beneficial for everyone.

<comment><USER10> Hey, don't knock the annual charge. If we have garbage in the App Store right now, imagine the crap we'd see if Apple removed that particular bozo filter.

Still, it would not be out of line for a developer account to permit the creation of only developer certificates/provisioning profiles, limited to five devices a year or something, to suit personal noodling not destined for the App Store.</comment></comment></comment></comment></comment>


The abc conjecture, explained as a game - <AUTHOR> http://bit-player.org/2012/the-abc-game/?utm_src=HN2 <comment><AUTHOR> The current discussion[0] about the abc conjecture has a number of confused questions over what it's saying. This is a link to a presentation I found useful to say what the conjecture is about.

[0] <http://news.ycombinator.com/item?id=4502856>

</comment><comment><USER2> I may have misunderstood something, but I believe it is simple to prove that R cannot equal c.

Because c is relatively prime to both a and b, there exists some prime p which b is divisible by and c is not. Because b is divisible by p, R=rad(a,b,c) is also divisible by p. Since R is divisible by p and c is not, R!=c.

<comment><AUTHOR> The comments on the article make it clear that c!=R using reasoning effectively the same as yours, but yes, nice proof.</comment></comment>


Microsoft releases patch for CVE-2014-4114 (Windows OLE packager vulnerability) - <AUTHOR> https://technet.microsoft.com/library/security/ms14-060

<comment><AUTHOR> "This security update is rated Important for all supported releases of Microsoft Windows excluding Windows Server 2003".</comment>


Ask HN: Review my website www.intelligentcredentials.com - <AUTHOR>

Please provide feedback on my web based cv/résumé builder at http://www.intelligentcredentials.com<p>Let me know of any improvements or issues with the site. thanks <comment><USER2> Sounds like a great idea. There is a broken image on your front page. I see links to several social networking sites, but they are of different sizes even though they are right next to each other. Awkward. There should also be the ability to get the resume in word and pdf format... these are the most common formats that a recruiter and managers look at. Especially Word.

Do you give custom urls/sub-domains to people?

<http://barackobama.intelligentcredentials.com>

The name seems kind of stuck up. I think I would roll my eyes at someone who gave me their resume on a site called "intelligentcredentials". Possibly, build a network of domain names and allow people to choose the one they like. Shorter and simpler the better.

<http://barackobama.ires.com/> for example.

Can I just copy and paste from a word document into that form and preserve all of my formatting?

Instead of having the form broken out seperate from the resume, have the fields be inside the final format of the resume. That way I can edit it in place.

Lastly, hire a designer. They will clean it up and make it looks really snazzy. nice work, I can tell it took a lot to make it this far and good luck with the rest!

<comment><AUTHOR> Thanks for the feedback, some really useful points to note.

Do you mean to print to word and pdf format? That should be straight forward (minus the videos/images/slideshows of course).

In terms of the name, you'll be surprised how many variations of web cv/resume domain names are already taken lol.

<comment><USER3> Then try thinking outside the box a bit, something like card.ly did for their online business cards site could work.

</comment></comment></comment><comment><USER3> You seem to have a broken image (actually it's an empty img tag) on your landing page. It also looks a bit oddly formatted at least on my Mac w/FF 3.5.

You might want to consider adding your site to my new startup, launchly, for additional feedback. It's free - <http://www.launchly.com>

<comment><USER4> Agreed, I like the idea and it's something I might use but the sample resume for Obama...it could definitely use some polish. Maybe you could work with a graphic designer on this?

As for the front page, the layout is kind of odd. Having the forms flush-left is a little odd, can you perhaps try putting the explanatory text to the left and the forms to the right?

Also please conisder re-visiting your login forms, as the text is not wrapping correctly in Firefox 3.5 on Mac...perhaps put it in the upper-right hand corner.</comment></comment>


Judge.me - A Private Small Claims Internet Court - <AUTHOR> http://www.judge.me/ <comment><USER3> Fascinating concept that potentially can work: private arbitration is a matter of contract, there is nothing in law limiting the ability of parties to agree to be legally bound by a determination reached by a private party (i.e., arbitrator) with whom they contract to make such a decision, and the law provides well-established enforcement mechanisms by which arbitration awards can, if necessary, be taken to court and converted into judgments without too much fuss.

Judge.me also seems like it has taken a credible first cut at a form of execution that is at least workable. It has avoided the very thorny choice of law issues that can arise where the contracting parties are in different locations by essentially having the parties agree up front to be legally bound by what amounts to a free-floating form of law to be applied by the arbitrator regardless of what technical choice of law issues would normally prescribe. It has avoided the problems that can arise with discovery procedures in arbitration by limiting the whole arbitral process to a 1-day to 3-day exchange of evidence by email exclusively. It has also kept processing costs low by reserving for itself the right to choose and assign the arbitrator, by drawing its arbitrators from an established pool as contractors, and by dispensing with the need for witnesses, transcripts, rules of evidence, and all other technical aspects of judicial hearings (again, the parties agree up front to these limitations and that is why they can be legally bound by them even though they are highly unusual by court standards).

What all this means is that this is an innovative way to extend technology to dispute resolution but it will, of course, only appeal to those who can abide by the limitations. To me, this means that the system may lend itself well to small-dollar disputes but not to anything involving complex facts or larger claims. The absence of live testimony and the absence of discovery are particularly limiting in this context - if you can't find out too much about what the adverse party is going to claim and if you can't get your hands on evidence he holds to rebut it, you may be severely prejudiced. At some point not too far up the dollar scale, this likely becomes too risky (this would depend on the individual facts of a case). Beyond this, arbitration generally does not fit too well into non-monetary claims and judge.me would not be an exception to this. Still, for small-dollar cases, it would seem to be an interesting alternative to the small claims court systems in place throughout the U.S. and elsewhere.

The big challenge here will be to see how technology can be used to allow the service to overcome some of the limitations noted above while still keeping it streamlined and cost-effective. I am not sure this can be done but this is an interesting first step and there clearly would be a huge demand for cost- effective handling of claims at a higher level. It will be fascinating to see how this develops.

<comment><USER4> "the law provides well-established enforcement mechanisms by which arbitration awards can, if necessary, be taken to court and converted into judgments without too much fuss."

What I heard from another entrepreneur in this space (there are several competitors) is that small claims court is effectively not legally binding in most jurisdictions, because very few judges are going to issue a bench warrant or seize your house even if you blatantly don't pay the judgment against you. So even if there is a contract here, it doesn't seem like this would be any different unless there is enough money at stake that it's ultimately no longer under the small claims umbrella if the contract gets violated.

/Not a lawyer

<comment><USER5> If people on the losing side of a small claims decision are willing to ignore it, why would they be any more likely to abide by the result of a judge.me decision?

(edit: re-reading what you wrote, I think that is your point)

<comment><USER6> Couple ideas:

Judge.me should have a public list of shamed people who haven't paid their bills. If it gets big enough this might be relevant, people might look at judge.me to see if a person they do business with is reputable. Or maybe it could somehow be reported to the credit bureaus.

Another one is if Judge.me holds the potential payments in escrow before the judgement takes place.

<comment><USER7> User profiles are indeed the long term goal. This would result in a pure private law instead of the hybrid model we have now where we still need government courts for enforcement.

<comment><USER8> Just so you know - your 'How it works' page contains a large number of phrases that you presumably intended to mark [as links] bu which aren't links. Looks a bit odd.

<comment><USER7> Yes, I still have to write the [content pages] for those.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> This seems like it was put together with a lot of care and thought, so I don't want to be a downer, but - I have some serious philosophical issues with the way this service is currently being presented. Arbitration is not judgement; and an arbitrator is not a court, not even a small-claims court.

I mean: I think it's great that Judge.me is totally upfront about all the other details in their service, and they seem to be on the level as far as their legitimacy according to the New York Convention. What's more, this is really a very useful service - hiring a high-priced lawyer (international law is not a common specialty) for international arbitration over a small $1500 freelance gig seems silly and wasteful.

Still - though I have some faith in the value of this product, and I even feel as though it's relatively reliable and would likely work in most cases for its clients, I sense that there are some problems lurking behind the service simply because of how it represents itself. What I'm envisioning is a situation where the company finds itself a party to some legal action; my feeling is that, no matter where you are in the world, actual judges themselves have very little sympathy or goodwill toward companies that represent themselves as courts.

Again, sorry to be so negative about this; these are just my own feelings about it.

<comment><USER7> I appreciate your feedback Koeselitz.

The "Small Claims Court on the Internet" marketing line is only used on the homepage, the actual information, arbitration clause, case filing and arbitration agreement make it very clear that we offer international ex aequo et bono arbitration.

The subtitle also clearly states "alternative to court".

</comment></comment><comment><USER10> 2 Interesting things:

From the arbitration agreement:

 _Services performed by Judge.me are governed by the laws of the State of Hong Kong. Purchasing the services of Judge.me or any reliance on any condition, representation, warranty or implied warranty (none of which are stated and all being expressly disclaimed) signifies an agreement to submit to the personal and subject matter jurisdiction of the courts situated in Hong Kong. Participants waive any and all rights to challenge venue or to remove the action to any other court._

Hong Kong?

Also, what happens if judge.me goes out of business? How will parties who enter into a contract with the judge.me arbitration clause resolve conflicts?

<comment><USER11> Is there such a thing as a State of Hong Kong?

<comment><USER12> Does it matter? Hong Kong has a judicial system with a long track record.

<comment><USER11> It's confusing to have legal agreements that refer to non-existent entities. What would you think of a contract governed by the laws of the Kingdom of California?

</comment></comment></comment></comment><comment><USER13> Just so you know ahead of time: no company you do business with that has actual counsel is going to accept an arbitration clause affirming an agreement to use "judge.me" as its arbitrator.

Still, potentially useful for ad hoc arrangements between smaller firms.

<comment><AUTHOR> Sure, nor will they accept bitcoins as payement. Now. That's just the status of all ideas when they are born.

<comment><USER13> You know, you're right. I was imprecise. Let me restate:

Just so you know ahead of time: no company you do business with that has actual counsel is going to accept an arbitration clause affirming an agreement to use _any_ specific arbitrator you've chosen; in all likelihood, most real companies will flatly refuse mandatory binding arbitration.

<comment><USER14> > _in all likelihood, most real companies will flatly refuse mandatory binding > arbitration_

That's not correct, Thomas. All kinds of big and small companies include mandatory binding arbitration provisions in B2B and especially B2C contracts.

(In B2C contracts, a big part of the appeal of an arbitration provision is that the U.S. Supreme Court recently said, in _AT &T Mobility v. Concepcion_ [1], that B2C contracts can essentially eliminate consumer class-action lawsuits by requiring individual arbitrations and jumping through a few minor hoops.)

[1] <http://en.wikipedia.org/wiki/AT%26T_Mobility_v._Concepcion>; see also [http://scholar.google.com/scholar_case?case=1708881634152670...](http://scholar.google.com/scholar_case?case=17088816341526709934)

<comment><USER13> I don't mean to dispute that B2B contracts often include arbitration clauses (though obviously I did just that; sorry). Clearly they do. I'm disputing that an (e.g.) freelancer has a chance in hell of getting arbitration into a real company's master agreement that didn't already include arbitration.

You're the expert: what do you think the odds are here? My experience is limited to watching the redlines ping-pong over simple choice of state law in our own contracts.

I think this is a cool idea for a business, by the way.

<comment><USER14> If I were representing the "real company" Thomas mentions, I would absolutely recommend that my client consider a suitably-designed arbitration provision for a freelance designer agreement.

Not least, I'd welcome the chance to put disputes into an informal, comparatively-inexpensive forum, where the risk of a runaway jury deciding the case mainly out of sympathy for the freelancer is essentially eliminated.

I would almost certainly object, though, to the _ex aequo et bono_ standard that judge.me proclaims --- that standard, in essence, gives the arbitrator _carte blanche_ to do whatever seems good in his or her eyes, regardless what the contract or the law says. That, coupled with the extremely-limited right of appeal of arbitration decisions, could definitely be a show-stopper.

For those interested, as part of the materials for a law-school course I teach, I've posted an extensively-annotated model arbitration provision [1].

[Disclosure: My wife is a full-time labor- and employment arbitrator.]

[1] [http://www.techlawnotes.com/docs/Common- Draft-2012-02-15.pdf...](http://www.techlawnotes.com/docs/Common- Draft-2012-02-15.pdf#page=170)

<comment><USER7> Your concern is exactly why public arbitrator profiles are my number one priority now. Arbitrator reputation should overcome the randomness concern.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Founder did an AMA on reddit some time ago [http://www.reddit.com/r/Anarcho_Capitalism/comments/t7eil/i_...](http://www.reddit.com/r/Anarcho_Capitalism/comments/t7eil/i_am_the_ancap_founder_of_judgeme_ask_me_anything/)

<comment><USER6> I see, so this isn't just an idea that applies to anarcho-capitalists, it's made by one.

</comment></comment><comment><USER7> I am the founder of judge.me - thanks for discussing my service here and I will respond to some of the concerns posted here.

By the way, I am planning to apply to the next batch of Ycombinator.

<comment><USER16> This is a great concept and looks like a classic disruptive innovation play. With the kinds of (large) contracts that I help with, it won't be an option yet, but I look forward to seeing something like this becoming a far more compelling option than the current arbitration offerings.

<comment><USER7> It is exactly as you describe, we start with targeting the underserved low-end market and will work our way up from there. Hope to become a compelling service for your needs soon.

</comment></comment></comment><comment><USER17> Australia has recently enacted laws to limit the effect of unfair contracts on consumers [1]. It comes in to play in "take it or leave it" situations, where the consumer has no power to negotiate. How would judge.me's standard contract clause sit with this? Could a consumer argue that they have been unfairly forced to sign away their right to have their day in court?

[1] [http://www.asic.gov.au/asic/asic.nsf/byHeadline/Unfair- contr...](http://www.asic.gov.au/asic/asic.nsf/byHeadline/Unfair-contract- terms-law?opendocument)

</comment><comment><USER18> I love how they take Bitcoin.

The video was nice, it explained why I would want to use the service, but it didn't explain how it works. Who's doing the judging? How is fairness ensured? How long does it take to get a judgement?

<comment><USER13> One of an effectively anonymous panel of arbitrators certified by the "Chartered Institute of Arbitrators" (a UK group). It isn't clear what level of certification is required (CIArb has several levels), or, for that matter, what the CIArb's own requirements for obtaining any of their certificates are.

<comment><USER7> The next version of my site will include public arbitrator profiles.

Some of my arbitrators:

1\. Stephan Kinsella, former Duane Morris partner, www.stephankinsella.com

2\. Patrick Tinsley, co-editor with Mr. Kinsella of The Digest of the Commercial Laws of the World

3\. Jacob Huebert, Porter Wright Morris & Arthur in Columbus, Ohio + author 'Libertarianism Today'

<comment><USER13> If it was me (and it isn't, so grain of salt) I'd bump the stuff about arbitrator qualifications to the top of the site, or maybe even include it in the value proposition: I like the idea of selling binding arbitration as an "Internet small claims court", but you might also consider some kind of spin on "Internet access to legal and ADR professionals".

Also: wow would I kill the Bitcoin stuff. Topple pillars of western capitalism one at a time. :)

<comment><USER19> On the other hand, I think the rapidly growing bitcoin economy probably really needs something like this.

<comment><USER20> Yes but this has no need for the bitcoin economy.

<comment><USER19> Huh?

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Item 3 of the FAQ [1] implies that there's not a separate arbitrator fee on top of the $299 filing fee, and the arbitration agreement [2] mentions nothing about an arbitrator fee.

So my question is: What _qualified_ arbitrator would be willing to:

* review the documents submitted by the parties;

* conduct a hearing (via Skype or G+ Hangout?); and

* explain in writing the reasons for his/her award, as required by the "Timeline" section of the arbitration agreement [2];

 _all for an absolute maximum of US$299 per case?_

[1] <http://www.judge.me/online_arbitration#process>

[2] <http://www.judge.me/arbitration_agreement>

<comment><USER21> Agree. By comparison a single panelist UDRP for a domain name is $1500 ($1300 a little less at adrforum.com)

<http://www.wipo.int/amc/en/domains/guide/index.html#b3>

</comment></comment><comment><USER22> Before Survivor entered Reality Television into the collective unconscious, there was already a predecessor: Judge Judy. Judge Judy was precisely the sort of arbiter that judge.me aspires to be -- including the somewhat-misleading terminology about "courts" and "judges", even though the arbiter is not strictly bound by local laws but rather by the arbiter's whims -- also they probably excluded the $150 cost to bring the lawsuit, since they instead sold ads. Actually, if you told the reality TV folk about Judge Judy nowadays they would probably ask the audience to text in votes which would determine the ruling, and the "judge" would mostly be a mediator and host who would decide what evidence was "admissible" for the public's consumption or so.

Judge.me might in these respects be a difficult sell. If it is ideologically anarcho-capitalist, then that provides robustness against corruption: but it also means that your 'judges' might simply say "yes there is this nuance in your country's law, but I don't like it and it seems too complicated, so I'm just going to ignore it." There doesn't seem to be an appeals process if this happens. So the lawyers of large corporations might be very hesitant to turn over their contracts to something so seemingly whimsical. I don't know. I am not sure that this acts to further anarcho-capitalist idealism, but it will probably work for its purpose as long as that idealism exists in the first place.

<comment><USER7> 1\. Yes I am an anarcho-capitalist and this is the reason I started the company.

2\. Judge Judy is indeed arbitration, where parties waive their right for privacy in return for a free arbitration.

3\. Ancapistan would fundamentally be a Kritarchy (rule of judges), so arbitrator reputation is crucial and case law can develop from that. Also, even "ex aequo et bono" arbitration simply means applying contract law in practice.

</comment></comment><comment><USER23> Ok. You won. I'm scared.

I have been wondering why there is not organization that makes it easy in 2012 to have a company that operates across several countries. I thought that simply creating a legal framework was taking some time but that finally legislators would manage to get there, they are just lagging behind.

But this... I don't want this. I don't want a private justice, I don't want "arbitration" to become the norm in the way conflicts are handled in the global village. No, this must not happen, this is the root of too many dystopian visions.

Arbitration : this artificial "court" decides arbitrarily who is right and once this is done, the initial dispute is still there. If the "loser" does not accept the arbitration, you still have to go to court. It solves nothing.

You know what is the next step ? A private police to enforce the decision of the arbitration court. You would sign in the initial agreement all the necessary authorizations for that. It would work. It would be legal. And even if illegal, an army of lawyers would delay several years the application of the real law.

I don't want that.

<comment><USER7> Our arbitral awards are binding in 146 countries because they comply with the 1958 Convention of New York. For private commercial disputes, governments have given up their jurisdictional monopoly a long time ago and I disagree with you that this is a bad thing.

<comment><USER23> Ok. Say I have a client that does not want to pay me. I live in France, the client is in Japan. Contract signed under the Japanese law. Let's supposed we had chosen you for arbitration. I win the arbitration but the client refuses to comply. What happens ?

<comment><USER7> You buy an Affidavit of Arbitration from us (costs $35) and than ask the a court in any jurisdiction where the losing party has assets to recognize and enforce your award.

Most jurisdictions will add the cost of court recognition to the amount of assets to be seized.

<http://www.judge.me/online_arbitration#enforcement>

<comment><USER23> Ok, so instead of just going to court, I have to do arbitration first, and then go to court. Sorry, I don't see what your added value is.

<comment><USER7> 1\. Recognition of arbitral award is much faster.

2\. Awards can be recognized in 146 countries.

3\. In 96% of the cases recognition is not even needed, the losing party pays up.

<comment><USER23> 1\. Sure, it is much faster than getting a court involved but I think that in most case where you intervene, an agreement would have been reached without going to court either.

2\. That just means that you found 146 countries where a breach of contract is illegal.

3\. How do you measure the 96% ? I am doubtful of such a high statistic. Do you provide legal help if going to court is necessary to enforce the arbitration ? With such a high rate of success, it would be profitable for you and be really helpful.

My basic claim is that your service is indeed cheap but is logically probably worth little more than what you charge. Going into court is much more expensive and I doubt that you really can avoid such an event.

<comment><USER7> 1\. I fail to see how using an arbitration clause in your contracts results in only disputes that would be resolved without court.

2\. It means 146 countries have signed the 1958 New York convention.

3\. The 96% is a CIArb statistic.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> One step closer to anarcho-capitalism! Much love and respect Peter-Jan! This is an amazing service that many have been hoping for.

Ping me if you have UX needs.

</comment><comment><USER25> I don't know how well advised saying "No legal mumbo jumbo" then immediately using the latin phrase "ex aequo et bono" is.

<comment><USER7> Ha, good point. Ex aequo et bono is the legal mumbo jumbo term to say no legal mumbo jumbo :)

<comment><USER26> Yeah, but what does it _mean_?

<comment><USER7> It translates as "based on fairness and equity", i.e. the arbitrator applies equity principles (contract law) instead of a specific local law.

</comment></comment></comment></comment><comment><USER27> So, the site makes it easy to seek a binding decision against someone that's enforcable anywhere. If I'm the potential plaintiff that's great! But if I'm the potential defendant, I just say no to the request. I want it to be inconvenient to bring a binding decision. I at least make the P go through the pain of seeking out a physical arbitrator. In the status quo - no decision - <USER2> win.

<comment><USER7> You are right. Agreeing to use an arbitration service such as judge.me is much easier pre-dispute (arbitration clause) than post-dispute (submission to arbitrate, i.e. just case filing and hoping the responder accepts the case).

</comment></comment><comment><USER28> Great to see somebody from Startup Chile! Congrats on the launch Peter :-)

</comment><comment><USER29> While I find this business extremely fascinating, I find their Careers page even more interesting. <http://www.judge.me/careers>

Particularly: "Every 6 months, the entire team votes on hire / fire for each team member." - You've just been voted off the island!

<comment><USER30> Maybe you could get a binding arbitration clause in your employment agreement. Though I don't know who you could suggest as arbiter...

</comment></comment><comment><USER31> It's a good idea in theory, but I don't see it being realistic in many cases where your legally under-represented plaintiff would be able to win. First you have to get the other party into arbitration. At this point they have already breached their agreement, so even if it is a clause in a contract, who says they are going to participate? You would need considerable leverage to compel them to spend the $149 to end the dispute. And then assuming you do win, what compels them to honor the judgement? I did read the FAQs, but if I have to go to a court to effect a lien or seizure, why did I spend $149 on arbitration when I could have spent $50 to file in court in the first place?

<comment><USER13> Because actually prevailing in court will cost more than $50, whereas prevailing in a legal claim for the award of a binding arbitration is very inexpensive; in reality, most bona fide disputants in arbitration can be expected to simply pay.

<comment><USER31> The filing cost does vary between jurisdictions, but about $50 to file, another $20-30 depending on how you serve the defendant, and since there are no attorneys in small claims, that about covers it. the time spent in court could be considered a wash compared to the time spent collecting and sending evidence for arbitration. The point being, my expectation in the first place was that the client would honor the agreement, so expecting them to honor a judgement is a little hard for me to believe. Why take the roundabout path when I can go straight to court? I guess based on my own experience I don't feel this service covers the typical dispute worthy or arbitration/legal action. A civil end to a dispute can only be accomplished by two civil parties working it out.

</comment></comment></comment><comment><USER32> I think this is a great idea. Sounds really solid and thought out. The design isn't exactly amazing, but it's ok. I'd suggest hiring a designer (or me) for a little cash to help straighten a few things out.

<comment><USER33> Also I'm not sure I'd trust a legally binding service to a .me domain..

</comment></comment><comment><USER34> Design appears to be inspired by stripe.com

<comment><USER7> That is correct.

</comment></comment><comment><USER35> I had just about given up on a slightly similar idea I had been working on briefly called <http://www.TinyCourt.com>. Much more downmarket than yours, using mechanical turk to provide verdicts on petty squabbles with family, friends, co-workers, etc., almost more as an entertainment product than actual arbitration. The enthusiasm for this idea in the comments makes me think I might have been about to give up too early.

</comment><comment><USER36> That's funny, I actually stumbled upon this recently.

Interesting concept, would be cool if it caught on! Suffers from a chicken-egg problem, though.

<comment><USER7> We only did 3 cases last month, so yes I agree with you. The arbitrator side is going great, we just need more case load.

<comment><USER13> Do you have a "model case" that you think fits in your sweet spot?

Have you thought about brainstorming through a specific set of model cases: for instance, construction contracting (apparently an arbitration mainstay), or web design, or stuff like that, and then building a "product" around each of those cases so you can tune your marketing and built industry-specific social proof?

<comment><USER7> I think software development and design disputes might be a sweet spot: Small value contracts (most below $100K), often international, parties often dispute project delivery and payment.

<comment><USER37> I think there is a statutory requirement for an arbitration clause in UK construction contracts.

<comment><USER7> Yes, construction and real estate in general is a major area for arbitration.

</comment></comment></comment></comment></comment></comment><comment><USER38> The point of getting a lawyer (1) and later going to court (2):

(1) At some point in a conflict it's not the technical expertise anymore which one may get with a lawyer—no, it's that there's is somebody who is not emotionally involved, who doesn't fear to loose, finally someone whose mind is at 100%, who is fully aware and who has no emotions like fear, hate and lack of self-control which could impair negotiations in court.

That's the main reason one should get a lawyer: those who are involved in a case cannot perform as good as the not involved lawyer. And latter is important because the court shall get a truthfully and entire picture in order to reach a fair verdict which is in your very best interest.

With Judge.me, it's strongly recommended to get a lawyer or another not involved third party who is in favor with me anyway and this person would just say, 'hey I don't know Judge.me, even worse I don't know the people there and I do not know their history of cases and how their decision making process is. I cannot prepare you carefully as I could do if we went to a normal court and thus, I cannot tell if you gonna win. So, I'd suggest to go to a normal court (2)"

</comment><comment><USER39> I clicked on this because there was a post on HN just the other day about _judg.me_ [1] and I assumed this was a follow-up. Interesting that this is entirely unrelated, but so close in the URL.

[1]: <http://news.ycombinator.com/item?id=4012478>

</comment><comment><USER40> I'm not sure about the logo. It's a set of tipped scales. On one hand I suppose you're showing how you'll weigh it up and measure the cases, but it can also imply your unbalanced and unfair from the start.

</comment><comment><USER41> My biggest problem with this is that "fairness" isn't objective and impartial, which is in contrast to the intent of U.S. law. Fairness is a function of one's life experiences, which may differ between arbitrators and subsequently shift the balance of equity between claimants. This issue compounds when multicultural parties are adversaries in arbitration. Plus, arbitration provisions are themselves subject to the selected forum's laws of contract construction. This means that a court could throw out the entire contract. Oh right, and then there's the issue of judgment enforcement: once your arbitration is decided, you'd still need a court to enforce the judgment.

<comment><USER13> Courts generally enforce arbitration clauses even when they're consumer-facing and one-size-fits-all. You'd still have to go to court to enforce the claim if one party didn't pay it, but you probably wouldn't have to re-argue the case; the courts apparently just verify that any procedural agreements were upheld and then accept the arbitration decision.

From reading up on pitfalls of arbitration clauses, it seems the opposite problem is stickier: arbitration is by design not subject to legal appeal, and attempts to carve out rights of legal appeal in arbitration clauses have failed in court.

<comment><USER41> I'm referring to some problem that renders specific provisions of a contract unenforceable. In some jurisdictions, absent a severability clause, the entire contract could be thrown out, meaning that judge.me would no longer have consent of the parties to arbitrate the dispute.

But I agree: arbitration vs. litigation is typically an "either or" scenario; you don't get the best of both worlds.

</comment></comment></comment><comment><USER42> Do you perform arbitration "in accordance with the commercial arbitration rules of the American Arbitration Association"?

<comment><USER7> No, we offer ex aequo et bono arbitration based on the Lex Mercatoria, the merchant law that developer in the middle ages. Basically contract law as known in common law systems.

</comment></comment><comment> jack-r-abbit Interesting idea. Good luck to you and the business.

But why are so many [things] in the [How it works] page [wrapped] with [brackets]?

<comment><USER7> Because I still need to write the [content pages] for that.

</comment></comment><comment><USER43> Who says the free market can't provide law and order!

</comment><comment><USER44> Modria is the leader in this space.</comment>


GitHub experiencing a large DDoS attack - <AUTHOR> https://status.github.com/?date=8-15-2013

<comment><USER2> I do not understand why GitHub get attacked so often - honestly it's not like they are doing anything wrong, they are a fabulous service and the go-to place for most (if not all) developers for all sorts of projects, be it open source or in an enterprise/corporate context.

<comment><USER3> Didn't you just answer your question? It is the "go-to" place for most developers.

<comment><USER4> That doesn't really answer his question. Why would somebody want to inconvenience developers?

<comment><USER5> \- Raising awareness of self-hosted alternatives

\- Getting people to use BB instead

\- Fake DDOS to get more companies to pay for github:enterprise

\- Preventing a system upgrade in a company which has deployment relying on github

There are lots of potential ways to use it...

</comment></comment></comment></comment><comment><USER6> Just a PSA Git is distributed, fire up a quick instance with git daemon.

git daemon --verbose --export-all --base-path=.git --reuseaddr --strict-paths .git/

<comment><USER7> >> Just a PSA Git is distributed

Can you please elaborate?

<comment><USER8> Public Service Announcement

You can have multiple remotes for your Git repositories, one of them (Github) being down should not affect your work since you can coordinate a new one with your team in the manner described above.

<comment> vhost- Yep! I usually setup a mirror at bitbucket and set my local to push to both github and bitbucket and only pull from github. It worked well when github was down and I needed a branch from a remote developer.

<comment><USER9> Nice. I didn't know you could push to multiple remotes (in the same command). Could you give me an example? Thanks!

<comment> vhost- The reply right under mine seems to be a reply to you. It has a stackoverflow link that shows you how to setup two URLs in your origin remote.

</comment></comment></comment></comment></comment></comment><comment><USER10> Can someone with experience mitigating an attack like this describe how it's done? A known set of hosts/address spaces is fine, but it's the "distributed" part I don't understand how to deal with.

<comment><USER11> We don't know anything about the attack, but in general:

1\. All of this requires that you have more bandwidth than the attacker.

2\. ACL drop everything but the ports/protocols you use on your frontend IP. For github.com that would be TCP 80 and 443. (ACLs are cheap, can be done at wire-rate on any capable edge router, so they're a good "first step." In this case it would have the bonus of dropping DNS amplification attacks which are increasingly common.)

3\. If it's a TCP SYN flood (probably from spoofed IPs) enable SYN cookies. (Of course now the bottleneck is their load balancer.)

4\. If it's an L7 attack, they'll need to identify patterns in the requests to identify and drop the traffic. For example, the attacker may be requesting a single URL only. If it's an L7 attack on a TCP service, they can also automatically add a drop rule for that source address, because at this point the client IP will have been validated (via the SYN challenge).

They may also be able to identify certain patterns in the traffic that can be ACL'd at the edge. For example, IP TTL being identical.

</comment></comment><comment><USER12> This is getting really problematic. It stops our whole team every time.

Anybody has experience with Gitlab and Gitlab CI? How's the flow compared to Github, especially for pull requests, commenting and collaboration?

<comment><USER13> This happens to our team too.

Does anyone else find it ironic that Git is a distributed version control system, yet we rushed to centralize it and base our entire workflow around GitHub?

<comment><USER14> Github is just a node. IF Github dies , people still have the full repos on their computers.That's not always the case with SVN... And most people are too lazy/dont have resources to set up a git server anyway.

<comment><USER15> Most teams that work on GitHub have none of their own workflow or infrastructure for sharing code when GH goes down.

You can probably blame those teams for that more than GitHub but people do seem to have bought into the idea that we can just jam everything up to GitHub and get it back later.

<comment><USER16> Of course from a risk-management perspective, the likelihood of a long term outage is statistically low enough to not justify the expenditure for setting up and maintaining alternative systems (other than simply having repos backed up.) It's the anti-TSA approach. The TSA spends billions and hassles everyone despite the relative rareness of air-travel attacks. But, the severity of a potential attack weighed against the expenditure has led politicians to believe that the cost is worth it.

The Heroku/AWS outages a few years back had far more of an impact, yet Heroku still (to my knowledge) relies exclusively on AWS-East, because presumably the risk-profile doesn't exceed the threshold to justify the expenditures required to mitigate the risk.

I just wish the attackers would be considerate enough to share the schedule for these attacks ahead of time, so I can plan a longer lunch. The rudeness of these attackers is unparalleled. I'm inclined to write them a strongly worded letter suggesting same.

</comment></comment></comment></comment></comment><comment><USER17> Why is this happening to them almost every day? Is someone jealous? Proving a point? If so, what point?

Surely by now, GitHub must know who's responsible and putting more in place to mitigate as much as possible before this happens. Right?

<comment><USER18> Everyday? The last attack was August 4th.

[https://status.github.com/messages](https://status.github.com/messages)

<comment><USER17> I said "almost".

<comment><USER19> You said 'almost every day'. Seems more like 'almost every week'. I'm just nitpicking though.

</comment></comment></comment></comment><comment><USER20> [http://sd.keepcalm-o-matic.co.uk/i/keep-calm-and-commit- loca...](http://sd.keepcalm-o-matic.co.uk/i/keep-calm-and-commit-locally.png)

</comment><comment><USER21> I wonder if there is a way to work with git offline, and then synchronize later? /sarcasm

</comment><comment><USER22> while git is distributed, Github managed to centralize the open source culture

</comment><comment><USER23> I ask because I have no plausible answer: What does someone stand to gain by DDoSing github?

<comment><USER14> blackmailing ? "if you dont pay we'll DDOS you" or whatever. Given all these infected Windows computers all over the world ,it's not going to stop soon. That's the Microsoft legacy.

<comment><USER24> Am I crazy in thinking that there's zero chance Github would pay a "ransom"? Seems like they'd just work with their vendors/providers and mitigate it to avoid setting that precedent (making them even more vulnerable to future attempts).

<comment><USER25> The attacker's bet is that they can apply pressure beyond the victim's ability to mitigate. If they win that bet, the victim may reach a point where paying out is preferable to the lost business they'd suffer because of the attack.

</comment></comment></comment></comment><comment><USER26> Let me get this straight, the command-line interface for googling code in a locally cloned GitHub repo is called grep?

<comment><USER27> Or "git grep".

</comment></comment><comment><USER28> What a coincidence. We actually just finished migrating all our projects over to GitLab about an hour before this outage.

I still very much love GitHub, it just ended up not scaling for us (we have a lot of repositories that seldom needs to be touched, which results in a $20 / month Linode + Backup being a much better solution)

GitLab also allows us to group repositories and gives a little bit more flexibility in regards of git server-hooks. Also, server-side branch locking! (Does anybody know how to lock branches server-side with GitHub?)

</comment><comment><USER26> Snarky comments about distributed version control aside, the bigger problem is the ecosystems which revolve around GitHub. Two which are immediately screwing my day up are Composer and Homebrew. Currently, both are totally dependent on GitHub.

</comment><comment><USER29> Github enterprise works great.

</comment><comment><USER30> What's with DDoSing GitHub? Special place in Hell...

<comment><USER31> Github.com is a profitable entity that makes a fairly large amount of money. Additionally, Github.com hosts a lot of content. Content that other people may not like. Possibilities are: 1) Extortion of some sort i.e. We want your money, or we'll DDoS you every week 2) Content i.e. Remove repositories a, b, and c with content we don't like, or we'll DDoS you every week 3) Weapons demonstration i.e. We want to show off what l33t hax0rs we are, so we'll DDoS Github.com every week

</comment></comment><comment><USER32> Let's all take a watercooler break here at HN

</comment><comment><USER33> Time to read up on `git send-email`, I suppose.

</comment><comment><USER34> 15:50 UTC: We are working to mitigate a large DDoS. We will provide an update once we have more information.

</comment><comment><USER35> You git what you pay for.

(Actually, there are long established yet less high profile alternatives with decent features and better pricing for commercial teams, like beanstalk or unfuddle or codebasehq. No hip cred, but for example supporting archived projects that you can read w/o using up your repo count license.)

<comment><USER23> This argument also works the other way. We payed less for beanstalk and got half the features. Sure it was a remote git repo, but our use case for GitHub is more than just external storage, and we were able to remove other tools that we were paying for.

<comment><USER35> We've been developing custom software for over a decade. GitHub's pricing model counts every private repo, active or not, while others let you put repos into R/W or archive mode, or don't count repos at all and only count against your storage quota.

The difference in annual cost is significant when you have 20 active independent projects, and hundreds of archived projects, not to mention all the customers needing accounts and access.

</comment></comment></comment><comment><USER36> Seems to be a recurring problem for them now.

</comment><comment><USER37> Why in hell is anyone so pissed with GitHub?

</comment><comment><USER38> Appears to be loading fine now.

</comment><comment><USER16> Just a thought, but it would be interesting if there was a DDoS attack on the github status page. Then what would we do?

<comment><USER39> find out from @github

</comment></comment><comment><USER16> Curious though -- yesterday it was the NYTimes, today github, Apple a few weeks before that. Pretty high profile stuff in my opinion.

</comment><comment><USER40> So what?

<comment><USER16> The so what is that the majority of people on HN are developers and the majority of them use Github either personally or with their teams. So a major outage is costing potentially millions of dollars in potentially lost developer time. If you calculate an average hourly of just $50 and a developer loses 20 minutes. Then that outage costs $17 x the number of affected developers. That's a pretty big loss.

I'm reading HN right now because I can't manage pull requests and do code reviews of my distributed team's code. So I'm just spinning in my chair.

That's the so-what.

<comment><USER41> You can't pull code from another node, i.e another developer? Git is distributed, if you want centralised source control use Perforce or SVN or something.

<comment><USER42> You may want to reread the comment. It's more than being able to commit and pull via the command line.</comment></comment></comment></comment>