Ask HN: Is Product Management a safer bet in 2017? - <AUTHOR> AI is moving fast and coding will soon be handled by machines. We, the developers, will lose our jobs. Most of us are pushing features, fixing bugs, etc. Things that don't involve creativity, decision making or business knowledge.
I have a feeling that Product Management will be the next big thing moving forward. Call me crazy - but it seems like a perfect candidate for software "development". All you need is to come up with a set of features and an MVP in mind, then the machines will build it for you.
What do you think? Should we make the switch now? <comment><USER2> I don't mean for this comment to come off as condescending but if you think that all a PM does is "come up with features and an MVP" and have people build it, then I think you ought to really go talk to multiple PMs to get their perspective on what their job entails.

Coming up with features is just one of the 100s of different items a PM will do on a daily basis.

<comment><AUTHOR> Of course... listing all the PM tasks is not the point here. I'm referring to tasks that are in direct relationship with coding. If we get rid of the coding step then the closest thing is the PM. Which is the point I'm trying to make here.

I sure know about the vision, strategy, blablabla... that's why I think it's the best bet, because those skills will be harder to replace compared to programming languages.

</comment></comment><comment><USER3> I think AI is not going to replace programmers for decades to come: [https://codewithoutrules.com/2017/02/19/ai-replace- programme...](https://codewithoutrules.com/2017/02/19/ai-replace-programmers/)

</comment><comment><USER4> > Should we make the switch now?

You can, but until I see evidence that "We, the developers, will lose our jobs" any time soon, I'm going to continue doing what makes me happy, and that's coding.

</comment><comment><USER5> The fact is that no one knows how close or how far we are from true general intelligence.

A human will be needed until that happens.

After that point, how our society will change is anyone's guess.

</comment><comment><USER6> sounds like you are working an assembly line. you should certainly switch jobs, but for different reasons.

<comment><AUTHOR> Sounds like you've never heard about Agile/Scrum and the software lifecycle. Developers are resources, they get allocated on a set of tasks. Have you ever heard of velocity? It's the number of tasks a group of developers can complete in one single iteration. It's called productivity. Welcome to the modern world my friend, it is indeed a factory out there and I don't know where you work but it might be outdated. You should google about the Software lifecycle. It's good to know if you're in the software business.

<comment><USER7> > Welcome to the modern world my friend, it is indeed a factory out there and > I don't know where you work but it might be outdated.

The Manifesto for Agile Software Development turned 10 years old... in 2011.

<comment><AUTHOR> Sure, the first car was invented in 1807. Ford was created in 1903. The upcoming Ford GT (limited production) became one of the most wanted car in history last year.

You need to understand the difference between creation, industrialization and adoption.</comment></comment></comment></comment>


Ask HN: Can we trust Equifax data? - <AUTHOR> If hackers had access to the Equifax data one could assume they also had the ability to change data.<p>Can we trust any of their data? <comment><USER2> Depends on what it is. For the data they sell to marketers, you couldn't trust it to begin with. Try asking them (or frankly any other player in the space) about their data accuracy and they'll send you a white paper full of more bullshit than you've ever seen in one place. As for the credit history data, who knows...</comment>


Can hacking be ethical? - <AUTHOR> http://timesofindia.indiatimes.com/tech/enterprise-it/security/Can-hacking-be-ethical/articleshow/13097346.cms

<comment><USER2> Yes it can. Next question.</comment>


Ask HN: How much would you pay for useful news? - <AUTHOR> After this Presidential Campaign, thinking about the media lately.  I don't like them.  Too much noise, nothing useful for me.  I then thought about how much I paid for this experience.  $0.
Sure, maybe a $1 or two from my cable bill but for the most part, I paid nothing and the quality was what worth exactly what I paid.
Thought about all the work needed to create useful news.  We're talking about staff of thousands of people.  And if you want good people, you need to pay them good salaries.  None of these free labor stuff but real money to hire real people where this is their full time profession.
How much would you guys pay for useful news per day?  What is the worth of useful information to you?  To me, if I paid $10 a day and the news helped gain $20 a day of value, it would definitely be worth it.  That's about $300/mo for news.  But that's just me.
Is there a viable business here?  Are there others who think this way other then people who trade stocks? <comment><USER2> For a typical person, there are no useful news on most days. A personalised, aperiodic list of relevant news would be interesting.

</comment><comment><USER3> Zero unless you write some analysis that is worth reading.

Honestly... There isn't much worth reading out there beyond platitudes and... the occasional insightful blog post. For the latter, sign me up for whatever. For everything else, I honestly couldn't care less if anything or anyone is earning money. Journalism has killed itself long ago with abysmal analysis or opinion masquerading as news. The whole profession deserves to go extinct.

</comment><comment><USER4> I do pay for news. It works out to a couple of USD per day I would guess.

It's not very efficient, I'm paying for a lot of stuff that I'm not interested in to get a small amount of news that I am interested in. It's probably value for money though as I do appreciate what I read and it's less than the price of a coffee.

I would possibly be interested in a curation service as long as I was in control of the curation and it had access to both free and paid articles. The problem I would envisage is that, for it to be worth oto $10 a day to me, I'd need it to cover most of my news requirements i.e. a digest of the sort of news that newspapers have, expert opinion of current political affairs in G4 from multiple political viewpoints, and topical journal articles in the academic subjects I'm interested in. Plus the musings of selected columnists.

To make it work, for me, it'd presumably need to do deals with a lot of publishers who wouldn't necessarily be particularly happy with the idea. Maybe if the bottom falls out of advertising for free news (highly likely) then it'd be more attractive.

I doubt I'd be interested in a yet another generator of "original" general news. Sure if it had a lot of high quality journalists who were out to inform rather than push an agenda and had interests that happened to largely coincide with mine. Not going to hold my breath though.

</comment><comment><USER5> You're defining "useful information" like everyone shares the same idea on what is "useful".

</comment><comment><USER6> I guess you don't remember the times when your grandparents used to buy the daily paper. The quality of the news wasn't any better than it is today.

Paying does not help fix the news because, 1. the market actually forces the news publishers to become biased, 2. a sponsor can easily match any income from paying customers and provide stability of income on top.

I think the public broadcasting model is the best one can do as far as an unbiased news source, because at the very least, the bias will not be permanently leaning towards one direction. It tends to change with administration.

But really, how much is "general news", news worth to an individual? I would say very, very little. I don't remember of any particular instance where I read something that actually prompted me to take any kind of action.

</comment><comment><USER7> _To me, if I paid $10 a day and the news helped gain $20 a day of value, it would definitely be worth it._

It is incredibly difficult to quantify something in this way. Most people are not going to be very aware of the actual dollar value of the information they are exposed to routinely.

 _Is there a viable business here?_

I don't think tossing out a question like this is going to lead to a viable business. There may be a viable business in good information. But I don't think this methodology really leads to it.

</comment><comment><USER8> 6 USD/month for full subscription to iPad/web version of the NYTimes.

I'd rather pay 5 and get an additional 10% discount to pay once a year. But hey, we're getting there :-)

</comment><comment><USER9> To be honest?

Not much. Maybe not anything at all really.

That's because as much as I'd like a decent news service with well written, interesting pieces about current events (and no tracking, annoying ads, overt political biases, etc), I know that the internet has enough free content that I could find some of those of things on other sites and social media services (and can mix and match them for a decent overview). And it'll stay that way unless the amount of content online drops by something like 90%.

<comment><USER5> While you'll always have a hard time getting away from political bias, you should check out [http://www.newyorker.com/](http://www.newyorker.com/) and [https://theintercept.com/](https://theintercept.com/)

Which I find both to have minimal ads and well written interesting articles about current events.

</comment></comment><comment><USER10> I do not pay for useful news, but for companies, something to handle all the updates to rules and notices regarding regulations is something many pay for.

Take the financial industry, there is a different set of regulations for each exchange and jurisdiction. To keep up with all the changes is daunting. There are a few providers in this space that charge like $30k a year to handle just the RSS feeds from these regulators.

</comment><comment> King-Aaron News? Nothing.

In depth analysis, free of government editing/native advertising/propaganda, and a clear focus on preserving fact over fiction? Yeah, I'd pay for that. However since I haven't seen this demonstrated before, the answer is still nothing.

</comment><comment><USER11> I wouldn't pay for daily news, which is usually reasonably binary.

I would pay 10-20 a month for a site that had high quality in depth analysis and articles, though. Something like a paid version of longform.org. The articles wouldn't have to be tied to current events at all.

</comment><comment><USER12> Never. Overall quality is way too low and even the high quality news isn't worth paying for. I'll just read the free shit instead.

</comment><comment><USER13> It used to be called "newspaper". People used to pay for it if you can imagine :P</comment>


Making a virtual machine in Google Sheets - <AUTHOR> https://briansteffens.github.io/2017/07/03/google-sheets-virtual-machine.html <comment><USER2> This may sound silly, but I don't think I've actually seen a more elegant functional visualization of how computers work at that level. I could see this being used as an educational aid to introduce students to the key concepts.

<comment><USER3> If you like this you might also like the games "Human Resource Machine" and "TIS-100", which both give a similarly visual insight into how computers work.

<comment><USER4> Links below. Worth noting that both of these are included in the Steam Summer Sale which ends in a couple hours.

[http://store.steampowered.com/app/375820/Human_Resource_Mach...](http://store.steampowered.com/app/375820/Human_Resource_Machine/)

[http://store.steampowered.com/app/370360/TIS100/](http://store.steampowered.com/app/370360/TIS100/)

<comment><USER5> HRM looks fun. Bought it. TIS100 notsomuch to me. I can see the appeal for some thou.

<comment><USER6> I'd only recommend HRM for people who haven't touched assembly before. For those that have, it is a bit of a waste of time and not very challenging...I kept hoping the problems would be harder, and maybe something that you wouldn't do in an introductory college course.

TIS and Shenzhen I/O on the other hand have unique challenges and are well worth your time investment for help thinking outside of the box. Many different ways to solve the problems, unlike HRM where there is basically one obvious speed and one obvious size solution.

<comment><USER7> On the contrary, I teach x86 assembly to advanced audiences and I still haven't solved some of the harder optimization problems there. It was so much fun!

<comment><USER6> Maybe I gave up on the game too early. The difficulty was not ramping up fast enough for me. I might take your advice and reinstall it and continue where I left off.

<comment><USER8> I thought HRM had a very odd skill curve, started out very easy and then got difficult quickly. I think overall it's too hard for somebody who isn't a programmer, and there aren't enough hard problems for a programmer. And once the problems got hard, it seemed more like work and less like fun. And a lot of it seemed like busy work since there were so few instructions.

<comment><USER6> Excellent point...I think that is what was happening...I must have gotten to the "hard" zone as you describe, and simply got bored of work, but wasn't _challenged_ (which is what I want from a game).

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This reminds me of my work at a big corp.

The admins didn't allow my team too much software, especially no compiler or something, but(!) they allowed MS Office.

So what happened was, that we started to program everything we need in VBA, with Word, Excel or Access as base, depending on the needs.

<comment><USER10> This is the case at a lot of places.

I know of global banks where billions of $ gets moved about by updating Excel spreadsheets.

<comment><USER11> I did this when I worked at JPM Chase in 2008; not as developer but as an analyst on treasury side. I executed $B daily of margin trades through an Excel macro.

Not very sophisticated. Each row in the spreadsheet was a trade. The loop would just send commands to a 1970s-era mainframe terminal application. Everything had to be executed in order, just like a human using the keyboard to enter the trades manually. The trades required several calculations, and you'd have to enter the results in terminal screen to execute the trade. Other analysts had been doing those calculations one by one on a calculator next to their mouse. The efficiency being, they didn't need to switch between apps on their PC.

This macro only existed because I built it. They didn't like it much, they wanted me to do it manually. I said OK and kept using the macro anyway. I quit after ~6 months out of boredom.

<comment><USER12> This is frightening. Couldn't you have easily made a huge error?

<comment><USER9> probably, but doing the same thing over and over again manually is even more error prone.

<comment><USER13> Sure - but I am guessing a few errors here and there would have much less impact than a single programming mistake. Not that I think this is the right way, but I do understand where they come from.

<comment><USER11> Human error was much more common. But they did have another tool for reconciling trades that was better. It was web based and auto reconciled most things that were obvious matches. I don't recall why, but they were not too concerned with mistakes so long as we could fix them by the end of business. I think it was because that's when clients would see something was off on their statement/account. There was never a concern of losing money. I wish I could remember why, but this is my cumulative experience in banking industry and I quickly forgot everything I learned.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Oh, man. This is a VM in JS ("Google Script") with a UI in Google Sheets.

If I had more time I'd post a VM in Google Sheets formulas only.

Anyone want to take it up?

Edit: hold my beer (see my reply below)

<comment><USER14> This popped into my mind

[https://www.youtube.com/watch?v=uNjxe8ShM-8](https://www.youtube.com/watch?v=uNjxe8ShM-8)

<comment><USER15> People have done some absolutely crazy things with Excel as well. To some people its like an OS.

<comment><USER16> Wasn't there a flight simulator or a Doom a decade ago?

<comment><USER17> Excel 97 had a sort of flight simulator. Excel 2000 had a car game. Earlier versions had other little easter eggs, but I think that Microsoft cracked down on them after Excel 2000.

<comment><USER18> Turns out the federal government to which Microsoft sells wondered, "if they're sneaking in flight simulators and dungeons, what else are they sneaking in?" That's the version I was told, anyway.

That, and Easter eggs are another attack vector. How much of a security audit do you think _those_ get?

</comment></comment></comment></comment></comment></comment><comment><USER19> This reminds me of a "game" that a friend and I made in Excel.

The game was, roughly, a text-based adventure game. Each row in the sheet represented a "room", columns across gave names to the directions you could go and the target rooms, a description of the room, etc. I think there were other columns to mark whether the room represented the end of the game too. The UI was a bunch of buttons and cells on another tab that were manipulated by VBA code.

The game was never very good, but we ended up creating quite a lot within that limited framework.

<comment><USER20> VBA is less limited than people like the believe. When I was bored in one college lesson I was playing around with calling Win32 APIs inside a Word 97 macro. I was able to call winsock and write a simple chat application.

<comment><USER19> VBA is actually a pretty amazing language.

Even without diving into the Win32 APIs, there is an absolutely amazing amount of stuff that gets exposed via COM and, as a result, is easily accessible from VBA.

Of course, the biggest downside to all this power is that people actually used it. This is how you end up with businesses that live and die by gigantic and virtually impenetrable Excel workbooks.

</comment></comment></comment><comment><USER21> Absolutely incredible. So when am I going to be able to play Doom on Sheets?

<comment><USER22> wait for Bellard to release docslinux

<comment><USER23> A cell per frame-buffer pixel...

</comment></comment></comment><comment><USER24> Ha, good one. I implemented levenshtein distance in Apps Script the other day to help some poor colleagues who were doing manual data cleaning tasks.

<comment><USER22> Amazing, I did avoid hell to collegues by implementing some form of counter in VBA. My most prized coding contribution. 8 lines that evaporated hell (filtering 1000 rows in Excel to find duplicates) into fun.

<comment><USER24> This is how I started as well. But we had too many typos so I had to find something a little bit 'smarter'.

Next thing on my list is to implement tf–idf to help with free text categorisation.

<comment><USER25> Sounds great! Feel free to adapt this to your usecase, if useful: [https://github.com/yesbabyyes/tfidf](https://github.com/yesbabyyes/tfidf)

</comment></comment></comment></comment><comment><USER26> I didn't know about App Scripts. This is very cool not just because it is a relatively clean visualization of a CPU but also because (on a personal level) it showed me what App Scripts can do.

Now if only it displayed the register values in hex or binary. As an education aid in college I found it easier to visualize what was actually happening in one of those bases. Another useful feature for debuggers is to highlight the values that changed in the last step. Sometimes even highlighting the exact bit if displaying in binary. I'm not sure how doable that is in Google Sheets though.

Edit: it's also a nice attention to detail that the stack shares the same heap as instructions. It might have been an easy out to put the stack in it's own column.

<comment><USER27> >Now if only it displayed the register values in hex or binary.

I assume that's as easy as adding a few more cells with =DEC2HEX(A2) or whatever.

</comment></comment><comment><USER28> I can't see the code without edit access? I go to Tools -> Script Editor, click, and it does nothing. No error even. (Happens in both Firefox and Chrome.)

<comment><USER29> That's weird. You should be able to copy the document and then view the source in your copy.

<comment><USER30> Thanks, making a copy works. But it should show you an error like "You need permissions to edit this document" or something.

</comment></comment></comment><comment><USER31> I came in to learn how to run Windows XP in Google sheet.

Not exactly disappointed though.

<comment><USER32> Can it run Crysis though?

<comment><USER33> Doom hasn't been ported yet. Have achievable goals man!

<comment><USER34> First Doom, then Google Sheets on Google Sheets and then Crysis!

</comment></comment></comment></comment><comment><USER35> Fun read, it reminded me of a Computing Science assignment I remember to this day - prof had us build a Russian compiler that worked with trits (0,1,2) instead of bits. A tool like this would have made traversing and visualizing it a lot easier.

</comment><comment><USER36> And I thought that [http://www.deepexcel.net/](http://www.deepexcel.net/) (Deep Spreadsheets with ExcelNet) was mind-blowing...

</comment><comment><USER37> I had this idea one time to use MySQL triggers to create a bunch of XOR gates and then use those as a basis for a CPU. Then eventually I could run Linux on that and rung MySQL on top of it.

</comment><comment><USER38> Now all we need is a higher-level language that compiles to Sheets VM. How hard would it be to write a C-like for this?

<comment><USER7> Not that hard. Allow me to recommend NAND2Tetris, one of the best courses I've ever tried, that has a great practical lesson on exactly that.

</comment></comment><comment><USER39> From the "use the right tool for the job" department :D

</comment><comment><USER40> I remember of a Blackjack game implemented in SuperCalc 3 using only circular referencing and IF() as "programming" loopholes

</comment><comment><USER41> Cloud vaping The next big step in free hosting: Milking public available turing complete services for free computation power.

<comment><USER42> I have a pretty big app that uses Sheets for free storage, apps script for processing and HtmlService to expose an json api endpoints and to serve the UI. I'm pretty happy with it. Totally free app.

<comment><USER43> Haha I did the same thing to build huge scrapers.

</comment></comment></comment><comment><USER44> So cool! Useless, but cool :)

<comment><USER45> Wut? It's a really nice illustration of how a computer works. Have you clicked the link?

</comment></comment><comment><USER46> So much awesomeness!

</comment><comment><USER47> Awesome!!!</comment>


Ask HN: If you had to pay ~5$ per month for an online service, what would it be? - <AUTHOR>

I'm not really fishing for startup ideas, but I'd like to get a sense of consumer pain points that are severe enough that people will pay moderate sums of money for.
Good Examples:
File sharing / hosting / management: Github, Dropbox, Flickr
Dating / Networking / Communication: Skype, LinkedIn, Match.com, OKCupid
Tasks / Todo / Personal Search: Evernote, Basecamp
Others: Eyefi, Wakemate
Basically I'd love to hear answers that are like "Oh, I'd LOVE IT if someone fixes X --I'd totally pay 5 bucks for it!" <comment><USER2> I'd pay $5/month for somewhere I could direct my cron email to which would (a) store everything for future reference, and (b) intelligently compare them from day to day and forward me the emails where something significant changed.

The hard part is (b), of course -- you'd need to figure out things like "the number in the 'up X days' line changes each day, so that's not worth flagging as important".

<comment><USER3> Huh, I could make this for free as a side project. Hmmmm..

<comment><USER4> Dude just said he'd pay $5 a month for it. Where's your business sense boy?!

</comment></comment></comment><comment><USER5> A secure dashboard for my websites or projects where I can see data pulled from Google Analytics/Mixpanel, sales, domain expiry alerts, pingdom uptime, server load, monitoring stats etc. To quickly check all these things requires a significant chunk of time when really my intention is just to "glance" at them to make sure everything is still ticking over.

Eventually I will build and self-host something like this but its a significant development investment for an internal tool.

I would pay $5 a month for this.

<comment><USER6> You should check out Geckoboard. It is pretty much exactly what you described. It is also free, so you can spend that $5 on an extra coffee every month :)

</comment></comment><comment><USER7> Oh, I'd LOVE IT if someone make another drop.io with the file expiry option or single file sharing --I'd totally pay 5 bucks for it!

Oh, I'd LOVE IT if someone give a localized version of twitter, and tell me what is trending, what's hot, etc. --I'd totally pay 5 bucks for it!

<comment><USER8> <http://www.letscrate.com/>

</comment></comment><comment><USER9> A blog alert that would, via email give me a way to email my comments to blog topics I am interested.

So say I am interested in Entrepenuership, NYC Pizza, Van Gogh Paintings. I'd get a nice digest in my mail of that days blogs with a way of commenting on them without leaving my Gmail.

</comment><comment><USER10> DropBox. I wish there was a middle ground between the free and $20 a month option.

</comment><comment><USER11> A good long-form news service.

Because I hate poorly formatted overly-long articles surrounded by awful offensive Flash ads.

<comment><USER8> <http://longreads.com/> \+ <http://www.instapaper.com>

</comment></comment><comment><USER4> I'd pay $5 a month for this site. Definitely.

<comment><USER8> It just occurred to me charging $5 a month may be a good way to control HN addiction... unless we end up with an addiction which also costs money.

</comment></comment><comment><USER12> \- send me a weekly email with a few cool events / venues going on in my city (think private thrillist)

</comment><comment><USER13> Thought for a few minutes and I honestly can't think of anything lacking. Surprising.

</comment><comment><USER14> A youtube that doesn't take videos down for copyright violations.

<comment><USER3> If you were looking for copyrighted music material, there's Zune Pass. Unlimited music for $15 a month. (<http://www.zune.net/en- US/products/zunepass/default.htm>)</comment></comment>


Can a virtual bot help people to really meet? - <AUTHOR> https://www.facebook.com/Meet-By-Pin-2005857149632387/ <comment><AUTHOR> Bot connecting users by geolocation and mutual interests.</comment>


Show HN: Chrome Extension to Filter HN Stories by Keyword - <AUTHOR> https://github.com/ShamariFeaster/chrome-extension-hn-filter <comment><AUTHOR> Dev Here:

I made this because I'm tired of seeing political flame-stories on here and I hate flagging them or, even worse, going in the threads to complain about them.

With this extension you can make a comma-separated list of words that when matched within a headline, the link is removed from the page before you ever see it.

You can check the console to see what stories are being removed. It's open source so feel free to fork, customize, contribute or whatever.

It can be used to filter anything, so if you can't stand to see another "JavaScript" or "Python" story, you can block those too.

<comment><USER2> Good idea, thanks for making it!

> _It 's open source so feel free to fork, customize, contribute or whatever._

Could you add a license to the repo then?

<comment><AUTHOR> added a GPL. thanks for reminding me.

</comment></comment></comment><comment><USER3> I thought about making something like this to filter out Apple stories actually. I use Firefox, might try and load this as a web extension.

<comment><USER4> Loaded, but didnt show the icon in the bar.

<comment><USER2> it uses an API that doesn't exist in Firefox to only trigger on news.ycombinator.com

<comment><AUTHOR> if you don't mind, could you add that as an issue to the repo. I already have a contributor so maybe someone could pitch in and make it proper cross platform.

</comment></comment></comment></comment><comment><USER5> Rad! You might be able to save a little time/logic by updating the JavaScript from ES3. Instead of:

      if(thisText.indexOf(thisWord) > -1)

You can just do:

      if ( thisText.includes(thisWord) )

Likewise...

      for(let i = 0; i < entries.length; i++){

Can be replaced with:

      entries.forEach(function(entry, index){

Chrome supports both the relevant parts of ES6 and ES5 out of the box.

<comment><AUTHOR> thanks for the suggestions. I tend to avoid forEach because of the memory overhead (adds function calls where not really necessary). I guess I'm old school, but never got around to using includes. It's been on my radar for a while. I've always tried to write code that is as portable as possible, even though now, with evergreen browsers in the lead, it doesn't really matter as much.

<comment><USER5> Yeah, .forEach() is a new scope. But the better readability is worth the minor performance impact for everything but the most performance-intensive code.

<comment><USER6> It's that kind of thinking that gets us really slow software.

<comment><USER5> "premature optimization is the root of all evil" \- Don Knuth

Also old-style for loops in JS fall victim to the last entry effect since people often use them to set up event handlers and wonder why they don't work.

</comment></comment></comment></comment></comment><comment><USER7> I'd love to see an extension like this for Twitter.

<comment><USER8> And Facebook!

<comment><USER7> Or an extension that understands how to parse many different news sites and can filter out stories on all of them. Add one keyword (pick your own example ;) and see _no_ headlines containing that keyword on any news site. It wouldn't be that hard, though it would reinforce one's own news bubble.

<comment><AUTHOR> I actually thought about something similar last night. Have a project that had a plugable DOM parser so people could build plug ins for various sites.

</comment></comment></comment></comment><comment><USER9> I would like to make an extension which sorts the stories based upon numbers of comments. How do I start? I have been working as a backend developer and completely agnostic about this stuff. TIA.

<comment><AUTHOR> If you check the code, contentScript.js:28 that line removes the meta data line, which contains the number of comments. One could easily parse the comment line and use it to rearrange the some, as opposed to deleting it. Fork the code and give it a try!

</comment></comment><comment><USER10> Did it work for you? Filtering by title keywords only seems to be rather hard, especially for political stuff, which often uses rather non-descriptive headlines.

Example: "New CIA Chief to Gladly Spy on Americans, Even If Using Info Hacked by Russians" looks like opinionism that I could pretty well live without, but it doesn't contain any keywords I would blacklist.

For technical stuff it's probably a lot easier (just name the language/framework/etc).

<comment><AUTHOR> Yeah, I ran into something similar. I had "president" on my list and it blocked a story on the president of a company. It's kind of trial and error. That's why I find it useful to see what stories are blocked so you can get a sense for how well your filter is working.

</comment></comment><comment><USER11> Great, now I can de-Trump my feed.

</comment><comment><AUTHOR> Version < 0.4 have a bug that filters comments containing words on naughty list. 0.4 has been pushed to webstore but it will take a minute to propagate. If you want fixed version now, pull it from github.

Although filtering out comments could be a feature and not a bug, amiright?</comment>


Bill – by Ben Horowitz - <AUTHOR> https://medium.com/@bhorowitz/bill-d9151e6f7538#.wh71inz2l <comment><USER2> The first time I met Bill Campbell was at Ben Horowitz's home in Atherton. I had no idea who he was. So we got into a conversation and eventually a debate. For more than 2 hours, we went back and forth on things like who sucked more, Duke football or Columbia football. All I knew at that point was that this dude went to Columbia and I went to Duke. So here I was joking and arguing with this good old fellow, innocently.

So when lunch was served, someone (a young aspiring guy who was among many trying to get talk time with Ben Horowitz) came to me and told me that 'if I knew who that old guy I was yelling at was I would be embarrassed by my actions'. I didn't take it to heart but I decided to tone it down a little.

After lunch, Bill came back for me, ready for more. I was now reluctant to engage. Sensing the drop in intensity, he said , "Why are you not arguing anymore? Did someone come and tell you who I am and now you figure we can't go at it?" I told him yes. He told me to relax and stand my ground in the argument. He went and grabbed a couple of beers, punched me playfully and and told me to have a cold one and get back at it. We talked and talked and talked, great conversationist that guy.

Then we played a volleyball game a little later, unsurprisingly, I was his first pick. Afterwards, he personally introduced me to Ben Horowitz and invited him to our conversation. Now it was two against one. Ben eventually told me that Bill had actually been the coach for the Columbia team and had a forgettable record. haha, I pinned him on that one.

We eventually parted ways sometime after dinner. He gave me his details and surprisingly he is the one who followed up with me first. Since that day, he was a mentor to me, occasionally checking in on me and telling me whenever he was in town so we could link up. He has had an influence on many of the projects I have worked on and jobs I took up.

Rest in peace Bill, you were a rare breed. I owe a lot of what I have become to you. You have left a void that will be difficult to fill.

<comment><USER3> It's like the word mensch was created for him.

</comment></comment><comment><USER4> This should remind everyone to thank those that have helped you throughout your life...because too late comes too fast.

By coincidence I had a similar thing happen just this last week. I spoke with a business friend who has always helped me along...not with money directly...but with advice and connections. I called him up after not talking for a few months to find out he had a stroke and nearly died. He is doing surprisingly well given the circumstances but it got me to thinking. The next day I called him up for no other reason but to let him know how much I appreciated the support and kind gestures...he was one of the first to see the drive and motivation I have and he has done everything he could to introduce me to the right people.

In this life you don't always get a chance to say thanks in a true, heartfelt way. I made sure to do that. If you have someone like this in your life...please call them today and let them know how they helped you.

In this world haters are everywhere...but it is truly rare to find someone who is selfless and motivational.

Here is a song to listen to while you think about it [https://youtu.be/PdZb2inh4YM](https://youtu.be/PdZb2inh4YM)

<comment><USER5> As Ben Horowitz would have quoted "People never get the flowers while they can still smell 'em"

<comment><USER4> Yes...but it doesn't have to be that way. I personally am going to make an effort to not only show that I appreciate it...but also do my best to pass on the kindness to others that need it.

Right now there is someone struggling that needs some kind words too.

</comment></comment></comment><comment><USER6> About 7 years ago, I'd read about Bill Campbell's reputation as a tech coach and mentor. I cold emailed him a pitch deck for a startup I was working on, and asked if he could help. He actually took the time to politely decline, which I thought was quite nice for someone in his position.

His response...

>> Michael,

>> Thanks for the message. You seem to have a working idea... but I cannot help you with this.

>> I am totally swamped with current companies and simply do not have the time to work with another.

>> Sincerely, >> Bill

<comment><USER7> That's really classy. Even if he had an assistant read your email and send that, he still had to care enough to set that all up.

</comment></comment><comment><USER8> A wonderful example of what to look for in a mentor, advisor, and friend.

There are a lot of uninspiring people in VC. Every founder knows it, but we can't openly talk about it because the leverage is usually not in our favor.

But Bill Campbell is what you should be interviewing for. Ask Ben what valuation he would have taken instead of having Bill on his side. There is no number. He is literally priceless.

What a tremendous loss.

</comment><comment><USER9> This is one of those times when Silicon Valley needs to step aside its rhetoric. In this case, Bill wasn't a mentor or a VC - he was a friend and confidant. And Ben's pain isn't from losing a mentor or a business parent - it's from losing a friend. This isn't a conversation about valuations, board positions, or startup tactics. It's a conversation about the loss of a great man.

My warmest wishes go out to the Horiwitz and the Campbell families.

</comment><comment><USER10> Lovely obit - like the best doctors, the best mentors address every aspect of your life: not just your work business, but also your family 'business' and your spiritual well-being.

We read a lot recently about the achievements of Andy Grove and Bill Campbell (both champions of Ben), but the key is that every one of us can mentor and help anyone else. The key is listening and empathizing, taking time and accepting. You don't need to operate a VC fund to do it, you just can be a nice human being who listens, understands and feels.

<comment><USER11> And also reaching out proactively as a potential mentor, since people younger than us often are sheepish about reaching out to us.

</comment></comment><comment><USER12> One thing this should remind us all is that there is a finite, very small set, of people who had an inordinate effect on our life, whichever path we happened to take.

For me, it was that teacher who asked me to open a box because we got a "computer" and nobody knew what to do with it, or the teacher who drove me to my town's college when I told him I did not have money to pay for it, and then helped me file financial aid forms, all in the very last day of registration. You have your own.

One day, you won't be able to call them.

Call them.

</comment><comment><USER13> A touching and well written article. I've been hearing about Bill Campbell for over thirty years and I am sad that I never got the chance to know him.

They say the true measure of a man is the number of friends that he has when he dies. By that measure Bill Campbell is one of the richest men to ever live in Silicon Valley.

</comment><comment><USER14> Having read The Hard Thing About Hard Things I felt how much love Ben felt for Bill just from the words on the pages.

<comment> squeaky-clean Came here to write basically this. Ben spoke really highly of Bill in his book, mostly about how good of a person and friend he was, not because of his business skills (which Bill obviously had as well). I remember the section where he describes meeting Bill, and how though he had any impressive history of success, the achievement which impressed Ben most was one Bill's companies that by most definitions "failed" yet every employee spoke of it as one of the greatest places to have worked in their lives.

I felt sad seeing the title, but my heart definitely sank reading the final sentence of the post....

<comment><USER11> >the achievement which impressed Ben most was one Bill's companies that by most definitions "failed" yet every employee spoke of it as one of the greatest places to have worked in their lives.

For those who are curious, the name of the company was Go.

</comment></comment></comment><comment><USER15> I think the truly sad thing about dying is that you become an archetype and no longer a real human being. It makes me think of Dr Seuss and all those terrible racist cartoons he used to draw. You dont hear about that do you? It's because he's no longer Theodore Geisel, but rather just some myth we all remember.

I'm sure otherwise well meaning people are doing pretty much the same thing to Bill Campbell right now. It's not just his body that is dead, but pretty soon the entirety of his existence.

<comment><USER16> Every famous person is an archetype, even when they are alive. For example most people think about Linus as a genius who created Linux rather than the guy who use childish insults on mailing lists. They arent any less human, it's just that the first thing people try to forget about someone after they pass away is the bad things.

And is not as dramatic as you think, I found all the "racist pics" he drawn fairly easy on the internet. So I'm fairly certain anyone who actually wants to look up "the human behind the myth" will be able to do so.

And is actually very easy to prove we don't forget the human behind the myths, at least within our historical sources, for example is widely known that Issaac Newton puked on his first and only kiss and died virgin. You think this helps the myth? Certainly not, is just a glimpse into his personality.

</comment></comment><comment><USER17> I just finished reading Ben's book "The Hard Thing About Hard Things" and his admiration for Bill was immense in the book. I was thinking as I was reading the book that it is hard to find someone like Bill to confide in. shocked to read this. RIP Bill.

</comment><comment><USER18> If even for one day, if we all try to be a little like Bill, the world would be a better place.

How do you try? Try to understand and share the feelings of another.

</comment><comment><USER19> Inspirational and really touching. To have someone like that in your life is amazing; to try and be that person is not a bad idea either :)

</comment><comment><USER20> What a wonderful, touching obituary. Thank you, Ben.

When you've finished with your life and you can look back and see all the lives you've touched this way, you've done it right.

</comment><comment><USER21> this was a lovely piece of writing, and quite touching.

</comment><comment><USER22> :( !!!</comment>


Microsoft's 'teen girl' AI turns into a Hitler-loving sex robot within 24 hours - <AUTHOR> http://www.telegraph.co.uk/technology/2016/03/24/microsofts-teen-girl-ai-turns-into-a-hitler-loving-sex-robot-wit/ <comment><USER2> That this happened on Twitter is not at all surprising. Learning directly from humans seems a very unwise approach for AI.

</comment><comment><USER3> Tay what???</comment>


Gourami: An intentionally small, lightweight ActivityPub microblogging service - <AUTHOR> https://dev.gourami.social/ <comment><USER2> Design-wise it looks cluttered af even for a thing that is supposed to be intentionally light. How am I supposed to differentiate users in such setup? Looks like hell to me.

The idea is interesting, though, and I like that it's written in Rust as well.

<comment><USER3> Having a "brutalist" aesthetic is called out in its README as part of the design philosophy.

Brutalist is a bit of an acquired taste. There are at least a couple different schools of brutalism (this one seems to line up with more of a 90s web aesthetic), but I like to think of it as a kind of intentional ugliness that allows designers to emphasize practicality. You're there to participate in the content, not the pretty boxes around the content. (I dunno if I'm explaining it well or not.)

<comment><USER4> I feel like just a few margins would still keep it "brutalist" (e.g. using HN as a reference, which is often labeled as an example) and improve it a bunch.

<comment><USER2> yeah, i think that is a good example. HN is really simplistic, yet it feels far from bloated. it just clicks

</comment></comment></comment></comment><comment><USER4> Github repo: [https://github.com/alexwennerberg/gourami](https://github.com/alexwennerberg/gourami)

</comment><comment><USER5> Small?

It's like 10+ files and some of them are hundreds of lines of dense, ugly rust.

I'm not sure that quite qualifies as small. It's a very neat idea, and I think the fediverse needs instances with lighter footprints. This particular implementation needs a cleanup.</comment>


Which programming language should you learn first? - <AUTHOR> https://medium.freecodecamp.org/what-programming-language-should-i-learn-first-%CA%87d%C4%B1%C9%B9%C9%94s%C9%90%CA%8C%C9%90%C9%BE-%C9%B9%C7%9D%CA%8Dsu%C9%90-19a33b0a467d <comment><USER2> One that lets you solve an actual problem you have with as little friction as possible.

<comment><USER3> So, clisp or clojure?</comment></comment>


Ask HN: Breaking out of a career silo - <AUTHOR>

I got my first job as a .Net programmer doing line of business applications. Nine years later, I have been doing this ever since (at different jobs).
I would like to make a switch to something else (different language, different type of application, different type of organization, something non Microsoft related) but feel I am stuck in a silo career wise.
While I have acquired experience with other languages (ie: Ruby) and tools on my own or on small open-source projects and on personal projects, specific job postings require strong skills simultaneously in many frameworks or tools I do not have experience with.
I recently applied to one such job and got a rejection email before even getting an interview.
I have a job, a family with kids and a house so my time is limited.
There seems to be many options I could pursue; open source contributions, personal projects, online training, professional certifications, bootcamps, hackathons, blog, freelancing work and so on.
I was wondering what is my best bet?
What would be the best path for me to make this switch career-wise? <comment><USER2> I'm in the same boat, more or less, so I can't give advice that I know works, because I'm still in the transition period. What i'm doing is:

\- Learning linux ...because every other language I want to learn is not on the .NET stack, and pretty much every interesting job requires linux knowledge.

\- Learning other languages I have a todo list of languages I want to try. There are a few I know I will want to go deeper into, which include Scala and Clojure, but for now I have a list of every popular (non-C#) language that i want at least minimal exposure to.

My todo list consists of concrete tasks like "Ruby hello world", "Scala hello world", "Angular hello world". Just knock these things out and then once I have basic exposure to a broad array of languages and tech stacks, I'll decide which I want to focus on, and start adding more concrete tasks to my todo list. This might include contriving a side project that is simple, but more involved than a simple hello world, and then building it out in one or two or three of the languages/stacks. At this point you'll have to start thinking about what direction you want to go, what kind of development you want to focus on. You might want to freelance as a Wordpress or Drupal dev, so you might decide to dive into PHP, or you might want to specialize in distributed systems, so you might focus your experimentations/hello worlds on more back end type stuff.

\- Getting better at front-end development. This is the area people like you and me can use as a bridge to transitioning over to non-.NET tech. Assuming you are working in web apps with .NET, you can start to focus on the front end, which means getting really good at HTML, CSS, and javascript, and learning front-end frameworks like bootstrap/foundation, SASS/LESS, and angular/ember. You can do that while still doing .NET on the server side. You can also start working in front end build technologies like grunt or gulp into existing or new .NET projects, to handle front end optimizations, and bundling/minification, image optimizations, etc. This also builds your javascript knowledge, and knowing angular seems like a really marketable skill these days. This in combo with learning linux is enough to get you to a point where you are able to get front-end dev jobs that have nothing at all to do with .NET.

My two cents. I'd be really interested to hear from other developers who have successfully made this kind of transition. I have no idea if what I'm planning will actually work.

</comment><comment><USER3> I spent 12 years at Microsoft, working on .NET technologies, half of it as a manager, but still very technically involved in design and coding. Last year, I left Microsoft and joined a much smaller SaaS company, built on non- Microsoft technologies. I am a manager here as well, but I made the switch to get exposure to these technologies and I have actually been in the code quite a bit. My current company looks for raw smarts while hiring and so the Microsoft background doesn't matter, even for the engineers. In fact there are a bunch of ex-Microsoft engineers across the engineering org. Unless you are applying for a role that requires very specific expertise, most companies shouldn't care that you don't have experience with a specific language or framework.

I am hiring right now on my teams! Let me know if you are interested and we can figure out offline if there's a mutual fit.

</comment><comment><USER4> I find side projects to be very helpful when attempting to learn a new framework or language. Start small and slowly build up the complexity as you move on.

It will be difficult at first, but fellow developer and Stack Overflow are your friends. It also adds an extra layer of enhancement if the open source the project, as it allows others to review your code and improve it, allowing you to contribute something to the community while learning at the same time.

You should also check out open source projects written in the language you're interested in. I find that CMS source code covers a huge amount of tips and tricks I find helpful when starting a new language.

Edit:

Also, [http://selfmaderenegade.net/minimum-viable- skillset](http://selfmaderenegade.net/minimum-viable-skillset) was just posted.

<comment><AUTHOR> Thanks!

As for the link, I hadn't checked back the new submissions. I'll go over it.

</comment></comment><comment><USER5> Regardless of how much of the checklist in a job ad you can check off, if you believe you can do the job then apply. Incorporate any feedback into your next application. Repeat until done. If you can spare an hour to two once in awhile, go to local tech meetups, hopefully in the area you'd like to transition to, but go anyway.</comment>


Billionaire yachts held hostage by cyberthieves - <AUTHOR> https://www.theguardian.com/world/2017/may/05/cybercrime-billionaires-superyacht-owners-hacking <comment><AUTHOR> Internet of Things security vulnerabilities? Start with the most valuable Things!</comment>


Webpgr: Build infinite websites. Swipeable, Linkable and SEOptimized. - <AUTHOR> http://webpgr.com

<comment><USER2> And then I get a "Would you like to translate this page?" pop-in from chrome, and the scrolling seems to suffer.

<comment><AUTHOR> not sure what happens if you let it translate, though (-; And we are working on the scrolling. Which platform are you on? mobile or desktop?

<comment><USER2> Windows 7 64 bit, Chrome Version 35.0.1916.153</comment></comment></comment>


The QWERTY Truth - <AUTHOR> https://daily.jstor.org/the-qwerty-truth/ <comment><USER2> I'm very concerned with the possibility that we often end up with technology standards that are worse than the alternatives, and I think I have my own examples that have worked out this way.

I just want to point out that there's also a paper trying to rebut Paul David's account:

[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1069950](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1069950)</comment>


Heartbleed disclosure timeline: who knew what and when - <AUTHOR> http://www.smh.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140414-zqurk.html <comment><USER3> I still like how these timelines are all about the big tech companies and not about governments, services and banks etc. These are arguably where some of the biggest risk targets are actually at (see today's post about Canada government's Revenue Services (tax agency) loosing people's info to heartbleed).

We probably need a stronger web security system people can be on. Also some of the blame falls to the big companies, banks, telcos etc themselves, I mean who wants to report security flaws to Telcos in a world where they then turn around and instead of giving you a $15k bounty, send you to jail like Weeve. And ok that's not the best comparison because he went well beyond discovering and did exploit as well. But none the less, some of the big corporate world need to clue in and get more friendly with tech rather than hostile, because right now they don't have a very good reputation and so then tech leaves them out in the cold. Did anyone think about notifying telcos and banks much? or just other big tech companies.

<comment><USER4> A report suggested that the NSA already knew about the Heartbleed bug 2 years ago and took advantage ([http://www.bloomberg.com/news/2014-04-11/nsa-said-to- have-us...](http://www.bloomberg.com/news/2014-04-11/nsa-said-to-have-used- heartbleed-bug-exposing-consumers.html))

This suggests that first the NSA discovered it, then Neel Mehta, and finally Codenomicon. As other commenters have rightly suggested, the government, or at least an agency there of, uses information asymmetry as a weapon of intelligence on its users (aka citizens). In the case of private corporations, they have a more contractual duty to their users to ensure that these bugs are patched so that those with malevolent intentions can't harm their users.

In my opinion, a bug that has been discovered but not shared is just as bad as a weaponized biological agent. Each rely on secrecy to exploit a group that is unaware.

<comment><USER5> That article contains exactly 0 facts. It is complete FUD. The only evidence they have that the NSA knew about it is an unquoted statement that "two people familiar with the matter said".

I am not saying it's impossible the NSA knew. But people throwing around that article as evidence is absolutely laughable.

</comment></comment></comment><comment><USER6> Has anyone asked how two security researches supposedly found the same exact bug (that's been in the code for 2+ years) within days of each other? How likely is that?

<comment><USER7> It happens routinely. Allow me to illustrate: on a pentest a couple years ago, Vitaly McLain from our Chicago team found that if you accidentally slipped a NUL into a header that nginx reverse-proxied, nginx would short-copy (it used strncpy) and reveal server memory. We reported to our client, and in the time it took for them to OK our upstream report --- a matter of hours --- someone else reported the same bug.

What's funny about that is that the nginx bug is functionally identical to Heartbleed (modulo that it only worked on nginx).

<comment><USER8> > It happens routinely.

I think that still leaves open the question of how likely it is, or perhaps the question is better phrased as whether it is due to chance or not.

It is extremely unlikely to be due to chance in this case. It was out for years, but discovered independently within days of each other.

One possibility is that it was discovered independently many times, but we only find out about it after someone actually goes public. At that point, those finding it earlier either never wanted to mention publicly that they found it (or they already would have), or even if they want to, they would be admitting to finding it earlier but not disclosing, so they'd look bad.

That leaves others finding it slightly after the group that goes public - <USER2> enough that it wasn't public yet, so they have evidence that they actually did find it independently. That would lead to exactly the result we see here, in fact. But this does imply that there were, very likely, multiple other groups that found this earlier but never went public.

The only other option is that it wasn't random, but some event led to both discoveries. Perhaps a hint was around, a new method of finding vulnerabilities, or anything at all that could nudge people's minds in that direction. That option is much less worrying, but very hard to prove.

<comment><USER7> I think if you reread my comment closely, you'll see that it describes a scenario that is _spookily_ similar to Heartbleed: same impact, same latent bug (presumably in the code for many years, maybe even longer than TLS heartbeats), and co-discovery not in a matter of days but _hours_.

Sorry, there's probably nothing interesting happening here, except for coincidence.

<comment><USER8> Yes, it is spookily similar, I agree 100% (I did read it carefully ;)

What I disagree with is that one event happening means that another event very similar to it is likely in a statistical sense.

Of course, it is an argument that supports that to _some_ extent. But it is fairly weak support, when on the other hand statistics strongly imply the opposite.

<comment><USER9> > What I disagree with is that one event happening means that another event > very similar to it is likely in a statistical sense.

Why? It makes perfect sense to me that, when one type of vulnerability is discovered, many more of same type will be discovered very soon thereafter. You have to consider that vulnerability discoveries don't happen in a vacuum. There's a near-infinite number of attack routes that one could investigate, but _which_ one you're looking at now is a product of the environment you operate in.

For example, let's say you're investigating a web server. Then, some security researcher demonstrates a flaw in an image codec where even using "safe" memory copy functions in C leads to a vulnerability if tainted values are passed in for the size parameters. You think, "Hmm...I'm not decoding images, but web servers do copy memory. I should check to see if any memory copy operations are using tainted values." Bam! You discover Heartbleed...but do you honestly think you'd be the only researcher working on web servers that saw the image codec demo and made that connection? Unlikely.

<comment><USER8> Certainly, yes - that would mean that this is not a coincidence.

I'm not arguing this is a coincidence. Just that if it was totally random, it would be very unlikely. So the plausible possibilities are (1) what you suggested, some common cause, or (2) that the discovery happened randomly multiple times but was only disclosed once.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> "CloudFlare later boasts on its blog about how they were able to protect their clients before many others." I wonder if some companies will boast to potential new customers regarding their relationships with vendors that will offer them advanced patches on critical issues such as heartbleed. Kudos to their opportunistic marketing team, but I hope this trend does not continue.

<comment><USER7> While I don't care so much who got notified first (any given embargo timeline is going to frustrate large numbers of HN people; if that's a problem for you, start finding bugs or post a bounty), I find several things not to like in Cloudflare's marketing. Near as I can tell, Cloudflare is the origin of the notion that TLS private keys weren't going to be in the heap near packet data, a supposition they jumped to for no reason I can discern.

They didn't find the bug. They benefited from a heads-up on the bug. Then they promoted a mistaken assumption about the bug, along with a gamified challenge site that was in fact a poor vehicle for investigating nginx+OpenSSL (how about, for instance, any decent debugger instead?).

Meanwhile, ops teams at big companies were in heated debates with security about whether keys needed to roll.

There are good people working at Cloudflare and I'm not part of any outrage battalion. I'm just not a fan of how they handled this particular incident.

<comment><USER11> Neel Mehta tweeted that private keys wouldn't be in the heap near packet data on April 8th:

[https://twitter.com/neelmehta/status/453625474879471616](https://twitter.com/neelmehta/status/453625474879471616)

<comment><USER7> I think I'm fine giving the guy who found the bug a pass for his 140 character suggestion.

I'm not looking to collect pelts. I just think there was a better way to address the question of private key exposure than "The Cloudflare Challenge". In the future, maybe we can address serious questions with engineering instead of marketing stunts; how about the "let's all work to instrument OpenSSL" challenge?

<comment><USER12> My issue with the Cloudflare Challenge can be summed up in: no matter what the results are, it will give people a diminished impression of the bug's actual impact. I can't fathom any way in which the Cloudflare Challenge was beneficial to the security of their customers (or anyone else, for that matter), which should be the goal of bounties; not to simply be a PR move.

<comment><USER7> My problem is that if you're trying to figure out how key material is distributed throughout heap memory, asking people to answer that question about an unknown private key through heartbleed "peeks" is about the most obtuse possible way to find out.

</comment></comment></comment></comment></comment></comment><comment><USER13> > Facebook say after the disclosure: "We added protections for Facebook's > implementation of OpenSSL before this issue was publicly disclosed, and > we're continuing to monitor the situation closely."

I wonder if Facebook found and fixed the bug locally beforehand? Makes me think of all the OSS libraries we use, without bothering to do much more in the way of static-analysis, etc besides simply making sure they compile.

</comment><comment><USER14> How did Facebook get prior word but not Instagram?

I worry that Amazon wasn't given prior notice according to the timeline.

<comment><USER15> Amazon Web Services was explicitly listed in the group of companies at the bottom that did not get notification.

<comment><USER16> It was a day after disclosure our ELBs were patched.

</comment></comment></comment><comment><USER17> How does it happen that after being in the wild for two years the bug was independently found by two different security researchers at roughly the same time? I'm not trying to suggest a conspiracy or anything, just genuinely curious how that works!

<comment><USER18> Perhaps they read the same article or attended the same talk, and something in the article or talk triggered a similar thought process.

<comment><USER19> The Apple "goto fail", which affected TLS, and the GnuTLS bugs were widely published just a couple of weeks earlier.

</comment></comment></comment><comment><USER4> Clearly the need has presented itself for a tool/infrastructure that can safely transmit a security flaw to the necessary parties without there being some arbitrary pecking order as this situation has revealed. With torrents, those who exploit something can quickly share usernames/passwords with the world with little repercussion. The same effectiveness, speed, and risk should also be associated with those who are trying to fix things.

</comment><comment><USER20> I wonder instead of notifying to select few parties with an embargo, if it would have been a better handled by releasing an encrypted sources with documentation containing the url to high availability server containing keys that serves only after pre-defined point in time. And documentation on integrity verification, accessment of the source changes and implications on other softwares using openssl.

<comment><USER7> How would that not just be an overcomplicated way to do exactly what the reporters of this bug did anyways?

<comment><USER21> I think the idea is that everyone would get the info at the exact same instant. It also allows everyone to be "at their computer" ready to implement the fix.

It would mitigate the possibility of it leaking and getting exploited by someone.

<comment><USER22> That's foolish, and doesn't take into account how software updates are actually rolled out in the real world.

Many vendors will not just simply compile a new version of a library from upstream source and just throw it on their machines. They depend on a tested release from their distribution maintainer, or something along those lines.

Also many vendors aren't prepared to do a simple upgrade: some may have customization they need to forward-port and test. Or perhaps they'd prefer to backport the fix to their older version.

So basically, your "everyone gets info at once" means that blackhats can get the information and exploit it almost immediately, while the good guys scramble to -- much more slowly -- patch their systems.

</comment></comment></comment></comment><comment><USER23> I wonder how one should proceed (if not working for any of this big tech companies) when one discover as critical bug as heartbleed?

<comment><USER24> It's only fair to publicly disclose immediately. You can't possibly alert every trustworthy company on earth.

Now, if you want a bug bounty, you have to file a report and wait a certain amount of time before you are allowed to disclose.

<comment><USER25> You don't want to disclose it before releasing a patch.

</comment></comment></comment><comment><USER26> I doubt if the NSA did know about this bug. Because if they did they would have put the economy at a huge risk.

<comment><USER27> How has all the other outed operations not put the economy at huge risk?

<comment><USER26> Because most companies don't care enough. A lot of companies are still hosting in the US.

But hackers overtaking banking for example might be a real risk.

</comment></comment></comment><comment><USER28> There are many hackers who do not reveal their exploits.

This is an overly optimistic account of who knew what when.

And, how can we protect? Patch? Yes, that's necessary, but not sufficient. We have so many other protocols we rely on that are fragile & intercepted. Self- censorship sucks, and can't possible protect everything either. What to do?

<comment><USER29> This is not claiming to be a complete list of who knew what when. It is only a list of confirmed cases.

<comment><USER28> Really? If there are caveats or disclaimers, they are very well hidden.

For most people reading this actual article, I think they will come away with the impression that it's a complete account.

<comment><USER30> Was the article changed since you read it? The first three paragraphs make it clear that this is an attempted reconstruction of events and clarifications/corrections/ are requested.

>Ever since the "Heartbleed" flaw in encryption protocol OpenSSL was made public on April 7 in the US there have been various questions about who knew what and when.

>Fairfax Media has spoken to various people and groups involved and has compiled the below timeline.

>If you have further information or corrections - especially information about what occurred prior to March 21 at Google - please email the author: firstname.lastname@example.com. Click here for his PGP key.

<comment><USER28> Sorry, that just still looks like glossing it over.

I mean, when the NSA & other actors do NOT submit their data to this guy, they can say, it's complete now?

It just stinks to me like it's complacency. Just change your passwords & patch, & then don't worry, share everything again, it's private. In 2014, I don't think we're safe & private anymore at all. I can take the downvotes. I don't like it either.</comment></comment></comment></comment></comment>


Ask HN: Why would I want to pay with my phone? - <AUTHOR> Dear mobile payment pitchers of HN,
Why would I want to pay for anything with my phone, rather than a card or cash? Please enlighten me.
Specifically,
(1) How is this more convenient than using my card or cash? I don't buy the argument that carrying a wallet is an inconvenience. A card takes virtually no space.
(2) Why would I want to trust my smartphone, which has a battery life of about a day, with the ability to pay for something in a critical situation. My card and cash does not run out of battery. Furthermore, I have had three different smart phones die on me permanently in the last two years. I don't want to be stuck somewhere and not be able to afford a taxi because my phone is dead.
(3) Why would I trust information about my purchases with a company like Google. They already know most things about me, but how does it benefit me to also give my purchase data over to them? So they can ad retarget me more easily? Fuck that. What's next, my vital signs uploaded to Facebook in real time?
Thanks. <comment><USER2> I'm in the payment space, so I have a few thoughts on this. 1\. Payment through mobile wallets prevents employees and corporations you're paying from actually getting access to your card number. This removes the risk of fraud and theft by employees skimming numbers from your card and from corporate DB breaches

2\. I am absent minded and often accidentally leave the house without my wallet and this allows me to still pay for things

3\. Phones might die if you drop them or the battery dies, but I'm a lot more attached to my phone because I use it several times an hour. I'm a lot more aware of it and am able to make sure that it's charged and available. Occasions of it breaking only occur at most once every year or two.

4\. By using my mobile payment app, I have a clear view of my current balances in one place without having to open banking apps or websites and allows me to view my current financial profile without having to log in anywhere.

5\. With cards, the company I do business with is able to build purchase data profiles on me and sell the data onto other parties without my control. With Apple, I know it's just about their 0.15% processing fee without data mining. With google, I know it's just for Google's internal analytics and not being sold onto data brokers for sale to potentially hundreds of purchase analytics companies.

<comment><USER3> #2 is a big one for me. As a father of two kids under 4, I can't tell you how disappointing it is to take the time to load them into the car take them to the grocery store, only to realize that I've forgotten my wallet while I'm standing in the produce section.

This happened to me about a month ago, but unfortunately my local grocer didn't accept NFC payments, so I had to leave.

<comment><USER4> I leave the house with 4 things. They go in different places.

Wallet, front left pocket.

Phone, front right pocket.

Keys, back right pocket.

Knife, clipped to front right pocket.

I pat my pockets anytime I'm leaving the house or the car to be sure I have everything. When I'm missing one I feel...strange.

<comment><USER5> Same here (different pockets, minus the knife, plus a space pen and notepad). I pat my pockets just about every time I stand up. Saved myself quite a lot of hassle by getting into this habit.

<comment><USER4> I couldn't do without the knife, I use it nearly every day for something. Opening a package, peeling an orange, etc.

What's weird is when I'm not wearing jeans or pants/shorts with pockets--say a bathing suit. I keep stuff in my hands, then--but I feel really paranoid and I keep checking and rechecking to make sure I still have my wallet/phone.

When I break this habit, I end up doing things like locking my keys in my car.

</comment></comment></comment></comment></comment><comment><USER6> I've paid with Apple Pay, and it feels much more pleasant in comparison.

Cash: Get out wallet, count out cash, get change that I'll probably lose anyway. I _hate_ small denominations.

Card: Get out wallet, put card in machine, wait 10 seconds for authorization (I'm in Switzerland - their terminals take longer), sign receipt. I _hate_ signing.

Apple Pay: See prompt on phone, which I'm already holding, with price and card info. Press thumb to button. Wait 1 second. Done. And I _like_ thumb presses.

Not only does it save half the time on every purchase, but it obeys my arbitrarily finicky preferences on how I would like to pay. But you know what? Even if it seems like such a tiny detail, many people share those preferences, and the difference is more than enough to tip the scales of habit for those who do.

<comment><USER7> It is now about 4 years that I signed a payment receipt last time. In Europe. What card was you using? Even the AmEx cards have a chip now.

<comment><USER8> In the US I still have to sign things daily. Even the cafeteria where I work (Well under $10 for every purchase). Fast food you don't have to sign (or at least you don't have to sign under some limit which I've never hit) but every store I go to I have to sign (more and more on digital signing pads).

</comment></comment></comment><comment><USER9> I can pay for parking here in Edinburgh using the RingGo app - which is _incredibly_ convenient, means I don't have to hunt for change - which I rarely have as I mostly pay for everything else with a card.

I love the way it reminds you if your paid for parking period expires and gives you the option of extending by paying more - all without having to return to my car.

Edit: I also don't pay for parking very often - which means I'm even less likely to have change on me or in my car.

Edit2: If somebody allows me to contribute to leaving presents for colleagues through an app then I could go pretty much cash free!

<comment><USER10> Regarding Edit2: Splitwise[0] is an app my friends recently introduced me to. We tend to get together in groups of 6+ and then go someplace for a weekend. This app made our most recent such trip very easy to split costs on.

[0][https://www.splitwise.com/](https://www.splitwise.com/)

</comment></comment><comment><USER11> Why would you want to listen to mp3s on your phone? Sansa Clip takes almost no room and its battery lasts longer.

Multiple personal items have already converged in your phone: notbook, calendar, Rolodex, flashlight, Game Boy, camera... This is just another one.

Each may not be much of an improvement on its own, but taken together it really is. People value this convenience so much that they will routinely accept lower quality of the parts (see the camera).

As for more direct benefits, it will probably be easier to manage. I use my bank's app a lot as it is.

<comment><USER12> I think the OP's point is that the phone is never going to _replace_ cash/cards because going without an mp3 player or notebook during a night out or work day is NBD, but surviving without any access to money can make things very unpleasant. Also, I'll always need a wallet for ID, insurance info, etc. What's one more piece of plastic?

So it makes sense I wouldn't want to carry around a phone + an mp3 player. But if I'm carrying around cash/cards everywhere anyways, the phone needs to have an actual substantive benefit over paying with plastic. That advantage has to overcome the perception of privacy violations and the cost of changing personal habits.

* The days of the average consumer not caring about privacy are, I think and hope, coming quickly to an end. I doubt anyone will give up gmail out of privacy concerns, but any time there's discussion of adopting a new consumer product, average Joe off the street will probably cite privacy as one concern. I don't think the "novelty factor" is enough to win over the average consumer's data these days.

<comment><USER11> If you're very concerned then cash or physical card for redundancy may make sense. But that's also true of a map for example, yet doesn't hurt adoption of Google Maps.

And is paying for things really that crucial on a daily basis? I can only think of minor inconveniences like having to go home before getting groceries after work. Although that's probably a matter of lifestyle and location.

<comment><USER13> Well, my card doesn't need a battery but works just like mobile payments (take out, press against reader, done) whereas google maps has many advantages over a paper map (i can find exactly where I am, search for things & get traffic updates).

<comment><USER11> Phone payment app can also feature improvements over a card, like knowing and showing your balance, helping you track spending, prompting you to use discount coupons... whatever the provider can come up with.

</comment></comment></comment></comment></comment><comment><USER14> I've had my card replaced three times in the last two years due to data breaches (Target, Home Depot, undisclosed). Every time I've had to re-setup all of my subscriptions. If there was no number/cvv/exp date to steal, there'd be no fraud without them having my phone.

<comment><USER15> And why would cell phone payments not be subject to the same problem if they were as widespread as credit card payments/

<comment><USER16> ApplePay uses one time transactions. Even if it's intercepted, you can't reuse the information.

<comment><USER15> So then the problem of having to change the information for any recurring payments you have is obviated by a total inability to set up recurring payments? I suppose that's one solution.

<comment><USER17> Nope. Recurring payments can use the same token, but that token is not a card number that can be presented to another merchant if stolen. Also, if a vendor is breached, only the tokens need be invalidated.

</comment></comment></comment></comment></comment><comment><USER18> There's an old adage: Cash is King

Whether they were referring to the debits and credits found in bank accounts or the actual fiat paper I'm not sure, but holding cash in actual paper (granted you have a stable government) is in some way a deprivation of total control and regulation of your life.

The corptocracy is very much similar to government in that they will willingly hand over data to save their own asses (I don't need proof on this one, cause it's common knowledge now) and also willingly exploit you through said data to increase profits.

In some countries people will simply flat out refuse to use even credit cards, simply cause they distrust their governments, which I think is a rational move.

Cash also makes life easier for your mom and pop store who can't jump the same tax loopholes as GooAppFace with their Irish-double-Dutch-cayman-filter accounting-foo and end up paying a big portion of corporate tax through the central (regulated and monitored) banking cartel.

At the end of the day, those who use it, trust it and it adds some utility to their lives.

For those who don't, their is only utility to be lost, which is why they stay away (and which is probably why I think it equates to most of the world who stays away).

</comment><comment><USER19> I don't like the loss of privacy with phone payments, but otherwise, it might be a good option to have available. With credit cards, I never give out any personal information, such as my phone number or zip code. With a phone, you don't really know what is leaking out, at least I don't. That being said, I would probably use it in a bind.

I like cash when possible. Convenience (other than making sure you have it with you) and privacy are great. Security is a concern, but with most people carrying credit cards it's gotten better. Everyone assumes that no one carries a lot of cash any more, so thieves are less likely to be aware that you are a lucrative target if you look prosperous. If you lose it, you have to physically track it down to get it back, so that's a bad part. I don't like to lose things, so I've never lost any significant amount of cash yet.

</comment><comment><USER20> I find myself asking this question. I've found it entertaining to play with. But unreliable even in the few stores that support it. And I don't want Google to have more of my info. (And they just bought out Softcard, removing that option as well.)

</comment><comment><USER17> The convenience argument is hard to make with reason - to some extent, you have to try it and see if it makes a difference for you personally. For me, it has changed my shopping behavior at Whole Foods from rare, carefully planned visits, to more frequent visits to pick up smaller numbers of items.

The reduction in overhead for picking up just a bag of coffee and taking it to the express checkout feels pretty dramatic, even though it might not be that much shorter in wall clock time.

Battery life seems like a genuine concern. I have an iPhone 6+ which easily lasts me all day, but I could see this being an issue on phones with less battery capacity. I will be curious to see whether the apple watch can still do payments in it's reserve power mode.

As to trusting Google - that's a personal choice. It clearly doesn't benefit you for them to have your purchase data, and I wouldn't use a Google owned payment service for that reason, however there are a lot of people who experience Google as being able to provide better search or Google Now cards based on knowing more about them, so would be happy to give them more information.

</comment><comment><USER21> I was working on my own payment startup idea a few years ago - and paying by phone was a surprisingly huge marketing bullet for most people. Paying by phone was a necessary side effect of the real business (crypto based, privacy protective, a few other things)...

...but what really got people interested was the paying by phone part.

Had I had a real brain, I would have pivoted (or at least held my nose) and worked on something "Square" or "Stripe" like, to get customers and money and traction, then added my secret sauce once I was already in the market.

Why was this so compelling? Because most people leave the house with 1) their phone, 2) their keys, 3) everything else.

If they forget 2, they go back for it right away.

They can be in line at Starbucks or the grocery store or wherever before they realize they forgot 3. If they can pay by phone, they're good.

Thems of us here on HN who wallet-pocket, key-pocket, etc., are in the minority. We are in the minority for most things. That's why so many of us have a problem connecting with broader markets, let alone mass markets, at least until we realize how to recognize and understand what the majority are doing.

</comment><comment><USER22> Slightly OT, but some here might be interested in a minimal wallet. I use something like this:

[http://toolsandtoys.net/wp-content/uploads/2013/02/cinch- min...](http://toolsandtoys.net/wp-content/uploads/2013/02/cinch-minimalist- wallet.jpg)

I don't carry cash, just cards. This is much, much smaller than a wallet. Completely removes the pain of carrying one around.

<comment><USER23> There's also secrid, they are RFID proof and in metal, nice protection for the cards. [http://www.secrid.nl/en/](http://www.secrid.nl/en/)

</comment></comment><comment><USER24> I'm just going to address your three points with my personal opinions.

1\. From a convenience perspective, it is easier for me to manage payments from my phone. That's less space being used in my pocket, and less physical operations that need to be completed for me to pay for something. Yes, an individual card does not take up much space, but I rarely carry just my debit card in my wallet.

2\. The battery life of my phone is decent enough for me to not worry all that much. I recently switched from iPhone 4 to Droid Turbo and find myself only needing to charge every two days. Also, I use a car charger while I commute if I'm streaming podcast or music, so for the most part I'm not concerned with my battery.

3\. Unless you buy things with bitcoin or the like, someone is collecting and analysing your data. I think Google does a better job at security than POS readers and vendors. I've already had to replace my card after home depot and target breaches.

</comment><comment><USER25> Honestly now that I've moved to a cash based society I don't even miss my debit card.

With the debit card paying meant fiddling with an often broken terminal. If my card got rejected I could be waiting in line at wal-mart going through credit cards. Even the simple act of having a card rejected (wrong pin, nothing on a prepaid, or etc) was embarrassing.

The only embarrassing story I have after going cash only was the time I forgot my _entire_ wallet. I just handed the basket to the clerk and ran home. The only big concern here is I'm legally required to carry my alien registration card.

Without a credit card I have no worries of identify theft from highjacked terminals. Plus unlike Canada you can hand over a 100 dollar bill and no one bats an eyelash.

I always have coin for vending machines. And cash-on-delivery is still a thing here.

Everything has just been nicer with cash.

</comment><comment><USER26> 1) Well, if you don't buy it then I don't know what to tell you. But I am constantly forgetting my wallet and cards, while I rarely if ever forget my phone. Tim Hortons app has been my only option to pay for lunch more than a couple times.

2) Nobody (or at least hardly anyone) is advocating eliminating hard currency or credit cards. Phone payment is just another option. Why do you see this as an either/or situation?

3) Google is not the only player in this game, and even then I don't think I share your concerns. Ad targeting based on purchase history has been a thing for many years at this point, and it's never been an issue for me. If it was though, I would just switch to Apple's solution.

</comment><comment><USER27> The trouble with payments is that end users don't see a problem with the current system.

Vendors hate the system because they'd like to pay less in fees.

Banks like it the way it is but they know they'll need to innovate in some way to stay on top.

As for Apple, it is one more way to differentiate their products. Note that they are working with and not against the banks on this one.

And the media? If they had made 1% as much noise about google wallet, which isn't too different from apple pay there would be an entirely different conversation. These are the people who get excited about every android game 'console' you can play candy crush on but censor the PlayStation vita which has real games.

</comment><comment><USER28> The two biggest pain points in the payments industry are convenience and security. Our most secure solution, cash, is pretty inconvenient. You need to know exactly how much you are going to spend and need to get more from an ATM or bank. Our most convenient solution is credit cards, but these have proven to be fairly insecure because one account number is linked to many transactions which can be duplicated. If paying with your phone could give you the security of cash with the convenience of a credit card it would be disruptive. Let's wait to see what happens in the mobile payment space.

</comment><comment><USER29> Apple Pay makes credit cards a little more anonymous. The retailer can't connect the dots like they can with a regular card and you don't end up with a ton of change in your pocket like with cash.

</comment><comment><USER30> 1/ I'm thinking of Apple pay now. The convenience lies in the fact that you don't have to type in your PIN / sign the transaction receipt. Also, when paying with cash you get change. Personally, I hate change. But I don't think I'll be leaving my wallet at home any time soon.

2/ Not all taxis (at least in Europe) have the possibility of paying by card. Using an app gets rid of that problem. Also, if you're using taxis in a business context, you get automatic receipts.

<comment><USER31> 1) Can't you just use a contactless card for this?

2) Are there any taxis you can pay with a phone but not a card?

<comment><USER30> 1) Sure, that works as well. But most countries don't have contactless cards, and those that do only allow smaller transactions without entering PIN (i.e. < £20).

2) There are apps like Uber and Hailo, where you automatically get billed at the end of your ride. Hailo is used by a lot of London black cabs, and most of those don't have a card reader in their cab.

Don't think there is an easy answer. If the contactless readers accept both cards + apple pay, that would be nice. Some people will prefer one over the other anyway.

I do know I have a significant amount of cards (some personal, some business), and being able to leave some of those at home is great. At the end of the day I don't really want to walk around with 10 debit/credit cards for various purposes. That's one problem Apple pay and these apps solve (to some extent).

</comment></comment></comment><comment><USER32> > (1) How is this more convenient than using my card or cash? I don't buy the > argument that carrying a wallet is an inconvenience. A card takes virtually > no space.

Even if it's not an inconvenience to you that doesn't mean it's not an inconvenience to anyone else.

I for one dislike carrying my wallet and have opted to get a phone case that can hold my cards (cc, and drivers license). I'd imagine if I was in a big city and could pay with my phone I wouldn't need those cards either.

</comment><comment><USER33> Basically, just look at how Uber changed our way to pay, and apply it to every daily situation you can imagine: Starbucks, Parking, Restaurants. At first, the Uber payment process surely didn't sound as important and convenient as it is in the real world. It also seems that in tech nowadays, every second virtually "won" in a daily task is another step towards the future. But is it ? :)

</comment><comment><USER34> Think of it as a stepping stone. Someday you'll likely be able to walk into a store, grab what you need, and walk out, all without stopping at a register to pay.

To (3), your credit card company already sells your data to advertisers. I'd be surprised if the googles of the world don't already have a feed of that information.

</comment><comment><USER35> It would be nice to need one less things(wallet), but the truth is, you still have to carry your wallet. Most places still don't accept NFC payment and even if they did, phones die. I'm not really interested in a wallet that can run out of battery power and leave me stranded.

<comment><USER36> Maybe some day our driver licenses will be tokens on our phones. Insurance cards too. And maybe the car's registration will be a token on the car's dashboard.

So when you're pulled over the cop will just scan your devices. Win win! /s

</comment></comment><comment><USER37> A lot of the reason is to do with the Cashless Effect - we pay more when we can't physically see the money.

[http://coglode.com/gems/cashless-effect](http://coglode.com/gems/cashless- effect)

A device is an even more abstract tool than a card due to it being multi- purpose.

Jerome

</comment><comment><USER38> The best payment apps are apps like Uber, where the payment is no longer visible, and the app adds some other value to the user. I agree that general payment apps that aim to simply replace cards don't have enough of a value proposition.

</comment><comment><USER15> And of course this question is exactly why none of these services have taken off.

</comment><comment><USER39> For some people #1 is a factor, one less thing to carry is a selling point.

</comment><comment><USER40> Why would you want to use a credit card over cash, or checks?

There are certain advantages. Not in all cases, but having it as an additional option may afford additional security, anonymity, and faster transactions.

</comment><comment><USER41> so we can sell you things you don't need nor want. Gotta keep the juggernaut rolling.

that or we have to remove the tiny amount of effort people already make to do things, so they can just sit and consume

#cynic

<comment><USER42> Cynical but perhaps right.

All the sales shit I see is about conversion rate. If its only a tiny step away from accidental to make a purchase then your effort to make that sale is low. Also if the value is low, impulse purchases are likely. Small purchases have little concentration on totality so you end up making lots of simple purchases effortlessly.

Result: Profit.

(don Ferengi ears when reading the line above)

</comment></comment><comment><USER8> * Tokenization (Little to no chance of fraud)

* Much faster than a card or cash

* No signing (In the US we still have to sign for nearly everything)

* One less thing to carry (I hate carrying a wallet)

</comment><comment><USER43> All of the mobile payment stuff I've seen seems to be about debiting your account.

Are there mobile payment systems that are linked with a credit card instead?

</comment><comment><USER44> Why do I need a purse? I don't want to have to carry a purse anymore.

</comment><comment><USER45> Minimize fraud with your credit card to the fullest extent.

</comment><comment><USER46> You wouldn't. It's a way for mobile networks and google/apple/MS to muscle in on the payment market, and for both them and shops to increase the amount of personal data they steal.

<comment><USER8> Yes because CC companies and stores would _never_ do that /s

Apple Pay actually makes it impossible for stores to do this and Apple has said they don't care about trying to sell/collect your data (and I trust them more than Visa).

</comment></comment><comment><USER47> Tokenization.

<comment><USER48> This is the correct answer if you live in the US. Tokenization is massively more secure than stripe and signature. As long as the phone isn't notably _less_ convenient than your card, you should want this.

</comment></comment><comment><USER49> I'm with you sbt because I just don't see any real reason for people to use this. However, I may live in a bubble because I just don't have my phone in hand all day long. I even leave the house without it occasionally! (The horror!) I also turn off wifi and mobile data when I'm done using it.

Unless every merchant accepts phone payments, I don't see how anyone could walk around with just a phone in their pocket anyway, so point #1 may be moot.

Don't worry about deciding on this too much though because I'm sure we'll all be chipped before too long and then you won't have a choice but to be tracked. At least things will be convenient though!</comment>


YARA – A pattern-matching Swiss knife for malware researchers - <AUTHOR> http://virustotal.github.io/yara/ <comment><USER2> Note, that it can be integrated with radare2[1], the reverse engineering framework and toolset. The integration will allow you to apply and generate YARA signatures from within. There are two plugins - to use radare2 from Yara[2], and Yara from radare2[3]. The second one you can install using the embedded r2 package manager: `r2pm -i yara`

[1] [https://github.com/radareorg/radare2](https://github.com/radareorg/radare2)

[2] [https://r2yara.readthedocs.io/en/latest/](https://r2yara.readthedocs.io/en/latest/)

[3] [https://github.com/radareorg/radare2-extras/tree/master/yara](https://github.com/radareorg/radare2-extras/tree/master/yara)

</comment><comment><USER3> Fun fact: XProtect on macOS uses YARA to match known malicious software. The database is at /System/Library/CoreServices/XProtect.bundle/Contents/Resources/XProtect.yara if you'd like to look at it yourself.

<comment><USER4> Yep. And YARA lives at _/ System/Library/PrivateFrameworks/yara.framework_

I had a problem a few years ago with YARA consuming all CPU time while on battery and never finishing whatever it was doing.

</comment></comment><comment><USER4> On macOS, see also:

       /System/Library/PrivateFrameworks/yara.framework

       man yara

PS: I wish VirusTotal had a high-rate, free API that could used as the basis for local endpoint scanners.

</comment><comment><USER5> Love me some Yara. It's totally the best.

</comment><comment><USER6> YARA reminds me of the venerable "file" utility, and I wonder if YARA could be used in place of it to identify non-malware files that "file" has trouble identifying.

<comment><USER7> The syntax isn't as nice as YARA's, but you can extend file's capabilities if you need by writing a custom magic file - see 'man 5 magic'.

</comment></comment><comment><USER8> YARA is amazing, anybody have some good collections of rules?

<comment><USER9> "site:github.com filetype:yar" usually yields a few good ones. It's probably easier if you're more specific as to which specific use case you have in mind.

And yes, Yara is a godsend. :)

</comment></comment><comment><USER10> How well do these tools work against code built using obfuscating compilers?

</comment><comment><USER11> YARA - Yet Another Regex App

</comment><comment><USER12> Yara is an awesome tool</comment>


Ask HN: Why is electricity so expensive in California? - <AUTHOR> I just got my latest PGE bill, and I'm paying $0.29/kwH. That's the highest rate in the continental US by more than 30%, and only $0.03 cheaper than Hawaii, where the entire grid is powered by burning imported oil. What on earth is going on here? <comment><USER2> I'm paying $0.26/kwH in MA after I caculate the bill myself. ($140 no AC) They advertise $0.15/kwh and add distribution charges. I imagine the cost of maintance has risen quite a bit, but compared to the cable or internet bill it's reasonable. A solar contractor told me you can buy warehouse, put panels on the roof and they will pay the mortgage. That's incredible I think

</comment><comment><USER3> It's going to get _worse_ if PGE succeeds in its efforts to push the costs of the 2017 fires onto ratepayers.

</comment><comment><USER4> I would assume that it has to do with the states desire to promote renewable energy. If the price of commercial electricity is too low, it would not be cost effective to use other methods. How much of your bill is taxes? I assume it gives a breakdown of costs.

</comment><comment><USER5> Distribution is covered by the per-kWh, and net-metered consumer production (mostly solar) has high adoption, which lowers the number of billed kWh across which distribution charges are spread.

</comment><comment><USER6> this is not a mystery: it's Sacramento.</comment>