Some of the Best HTML5 Games from 2013 - <AUTHOR> http://gamasutra.com/blogs/AustinHallock/20140108/208242/10_of_the_Best_HTML5_Games_from_2013.php

<comment><USER2> Besides Polycraft, these are all very standard, flash type games. As WebGL continues to expand, we'll see more and more impressive games in the browser. We've spent almost 2 years building a full MMORPG using nothing but HTML5 canvas and node.js in an isometric world: [http://casinorpg.com](http://casinorpg.com).

</comment><comment><USER3> My fave this year is definitely Atomic Brawl: [http://atomicbrawl.com/](http://atomicbrawl.com/) \-- it's a collectible card game played on a game-board, so it's kind of a cross between chess and Magic The Gathering.

I spend way too much time playing it :) Hit me up for a game if you want to try it.

<comment><USER4> The gameplay seems entertaining, but the humor is insufferable

</comment></comment><comment><USER5> [http://tagpro.koalabeast.com](http://tagpro.koalabeast.com)

Seriously one of the best online webgame communities [1] I have ever been a part of. Full of mods [2] and sporting it's own competitive league [3], tagpro is in active development and is close to being fully open source [4].

It's capture the flag in it's essence, with deep strategy enhanced by individual skill. Once you "get it," you'll be hooked.

[1] [http://tagpro.reddit.com](http://tagpro.reddit.com)

[2] [http://www.reddit.com/r/TagPro/wiki/index#wiki_modding_the_g...](http://www.reddit.com/r/TagPro/wiki/index#wiki_modding_the_game)

[3] [http://www.reddit.com/r/TagPro/wiki/mltp](http://www.reddit.com/r/TagPro/wiki/mltp)

[4] [http://www.reddit.com/r/TagPro/comments/1mfjo3/community_inv...](http://www.reddit.com/r/TagPro/comments/1mfjo3/community_involvement_at_a_whole_new_level_open/)

<comment><USER6> Just began to play, very addicting.

<comment><USER7> A nitpick - _addictive_ is the adjective you're searching for.

If the word "addicting" exists at all, which is debatable, it would be a transitive verb - eg. _the pimp 's strategy is addicting girls to heroin, then exploiting them_

</comment></comment></comment><comment><USER8> I am surprised RuneScape isn't on the list. [https://www.runescape.com/game?html5=1](https://www.runescape.com/game?html5=1)

Absolutely amazing (the client). They released the client last year and its pretty cool what they can do with the technology, I am pretty certain that they are one of the few games that was fully ported that wasn't an indie game. Not only did they make the new client in HTML5, but it actually offers more features than the original java client (at least from what I heard, haven't played in years) If any HTML5 game of 2013 should get the award, it honestly should be this.

<comment><AUTHOR> Doh! Overlooked that, but you're right that it deserves to be on the list. Knew I'd forget about something big ;)

</comment></comment><comment><USER9> Funny they mention Zynga... Remember Words With Friends? If you found a particular URL, going through x.facebook.com to play it, you got access to a HTML5 touch enabled version of it, with full cross platform play. I was using that to play it against my girlfriend at the time, on my Nokia N9(!) in 2011. It was all done with divs and funky JavaScript, and was amazingly solid.

Also, I'm really looking forward to Day[9]'s WebGL real time strategy game, I forget the name of it, but the technology is mind blowing. The difference between web code and native graphics is shrinking rapidly.

<comment><USER10> I think you are referring to Artillery [https://artillery.com/](https://artillery.com/)

Apart from the game its also going to be a complete development environment, very excited for it!

<comment><USER9> Thats the one! It's seriously impressive, I can't wait to play with it

</comment></comment></comment><comment><USER11> > The game is desktop-only, and it probably could have been done with Flash, > but the web was the main reason this game had success. It feels very much > like a website, because it is… it's able to have solid integration of > various user interface elements in a website format rather than a typical > game menu. More importantly, because of the nature of the web and links, > this game spread like hot cakes through social media and news outlets.

What does that even mean? Is this non-nonsensical to others, or am I missing something? And it is a bomberman clone?

<comment><AUTHOR> It's a massively multiplayer bombmerman, so a clone with a lot of cool stuff added to it. My writing tends to have a lot of fluff, so sorry for the extra bulk :)

The point I was trying to make is Bombermine is somewhat of a mix between a website and a game, and it works well for it.

</comment></comment><comment><USER12> [http://mienfield.com/](http://mienfield.com/)

massively multiplayer online mine-sweeping.

</comment><comment><USER13> Would be nice to see my game on a list ;)

[http://sudokuisland.com](http://sudokuisland.com)

<comment><USER14> I wish there was a better way to switch between pencil marks and writing final answers. I put up with multiple clicks on my phone because I only have one finger, but I have a keyboard and a mouse with two buttons -- maybe holding spacebar would toggle, or right-clicking or something.

<comment><USER13> That's a fair critique. I wasn't sure to allow additional controls because that would involve overriding browser actions, which may bother others and be inconsistent, and also is unintuitive. Definitely a more involved HTML5 game would require it, but I anticipated a casual level of players who only a few would be long term repeats.

</comment></comment></comment><comment><USER4> Bombermine is one of the best games I've played in 2013 on any platform. Well made, fun gameplay, the monetization strategy isn't great, but it's not terrible either.

</comment><comment><USER15> Looks like the Zynga app is using Kik for distribution: [http://cards.kik.com/](http://cards.kik.com/)

</comment><comment><USER16> Nice to see a Ludum Dare entry on the list!</comment>


The User Interface Sounds of the Roku - <AUTHOR> http://beyondthebeep.tumblr.com/post/42855661543/the-rokus-ui-sounds

<comment><USER2> It was a skunkworks project from Netflix, not Amazon.</comment>


Google has rolled out a new algorithm update? - <AUTHOR> https://www.accuranker.com/grump/ <comment> the-dude Noticed odd ranking changes as well.

<comment><AUTHOR> What sector are you in? Does it look like a huge fluctuation your end?

<comment> the-dude Half way page 1 to page 3/4

<comment><AUTHOR> Wow, that's a drastic move. What sector and which country?</comment></comment></comment></comment>


Stop Taking Car Buying Advice from Professional Millionaires - <AUTHOR> https://jalopnik.com/stop-taking-car-buying-advice-from-professional-million-1832966618 <comment><USER2> Huh!

 _Tom is a contributing writer for Jalopnik and runs AutomatchConsulting.com. He saves people money and takes the hassle out of buying or leasing a car._

Amazingly this company deals only with new car buyers. No hidden agenda there!

</comment><comment><USER3> All mass market cars lose value once they are driven out of the dealership. Thinking that a new car will be a better deal in ANY case is delusional.

There is the New car high that one gets when one buys a new car so to some people that's worth the premium of a new car but don't try to make a case for a new car being a better deal when it comes to price alone.

</comment><comment><USER4> >Buying a $40,000 car, for instance, he says, would require a year's worth of work if you're earning $20 per hour after taxes and working 200 hours annually.

I understand how he can claim to make that much money,last time I worked 200 hours at $20 dollars net I was _strangely_ paid US$ 4,000 (and NOT $40,000)

</comment><comment><USER5> Nice native advertising and nice try.</comment>


New Project: ZGC – "Z Garbage Collector" for Java - <AUTHOR> http://mail.openjdk.java.net/pipermail/announce/2017-October/000237.html <comment><USER2> > A core design principle/choice in ZGC is the use of load barriers in > combination with colored object pointers (i.e. colored oops). [...] In > addition to an object address, a colored object pointer contains information > used by the load barrier to determine if some action needs to be taken > before allowing a Java thread to use the pointer.

This looks furiously like an incremental improvement of Shenandoah's model [1]; Hurray for more teams exploiting this new way of doing things. Cache lines are getting bigger, we can definitely afford memory management metadata.

The difference here seems to be that they intend to explore different uses of this metadata:

> this could be used to track heap access patterns to guide GC relocation > decisions to move rarely used objects to "cold storage".

I always wondered if a relocating GC could have a subtle way of building cache-friendly layouts. I'm speculating here, but if I'm not mistaken current copying GCs traverse the heap breadth-first; and reuse this in the copying. This new approach could lead to options for going depth first at select points; For example in a JPA graph of objects, in some patterns lots of fields are never used. There is something to do here.

[1] [https://wiki.openjdk.java.net/display/shenandoah/Main](https://wiki.openjdk.java.net/display/shenandoah/Main)

</comment><comment><USER3> The use of read barriers are exactly the same technique that Azul does with Zing, it's "pauseless" GC.

This allows for concurrent heap compaction, at the cost of throughput.

Azul used to sell commercial "java machines", with hardware support for the barriers.

</comment><comment><USER4> What does the Z stand for? Zettabytes?

If GC pause times do not increase with the heap- or live-set size, it could handle such large heaps.

</comment><comment><USER5> Wow! Multi-terabyte heaps? That sounds like way to much stuff in memory. When would you need multiple terabytes in RAM? I mean come on... What kind of application even needs that. Though I do admit that javascript needs this kind of GC implementation because the hangs JS causes are a real pain.

<comment><USER6> Run Apache Spark on the box with 256+ GB of RAM. The GC stalls by 60 or more seconds are quite typical for heavy queries. I hope new GC will bring improvements.

<comment><USER7> For Spark/etc I only care about throughput. It can stall all it wants. Exception (possibly) being spark streaming.</comment></comment></comment>


How much is time wrong around the world? (2014) - <AUTHOR> https://blog.poormansmath.net/how-much-is-time-wrong-around-the-world/ <comment><USER2> As an evening person, personally I find it more optimal if it stays light until later in the evening, and less light is wasted on morning times like 7am

But now that I think about it, maybe moving time like that also moves around when other people will be awake/asleep. So what actually defines an evening person?

-a relationship between when it's light and when it's dark?

-a relationship between when other people are awake and asleep and schedules like typical working hours (a desire to be awake after others went to bed, as opposed to a desire to be awake before others get up in the morning)

-a relationship to the 24 numbers assigned to certain times of the day?

I'm an evening person but especially in winter would like more light in the evening. So I guess what I really prioritize is being awake after other went asleep, instead of when it's light/dark, even if it makes me miss out on some light that I would like to see. Or maybe my biological clock thinks differently than what my mind wants...

<comment><USER3> From what I have experienced, some people have a strong cognitive bias towards the numbers on a clock, for example, needing to look at a clock in bed to decide if they are still tired. (or worse getting up happy and awake to be devastated to learn it is early morning after a few minutes)

People tend to identify themselves as a certain way, and those ideas have a strong impact on behaviors and desires. Of course it's silly to link how tired you feel to a clock, but it happens!

If you'd like more light towards the end of your day wake up earlier! (and sleep earlier) Try to realize that when you feel you want to be awake and asleep might have a lot more to do with an image of yourself you have attached to instead of any biological cause.

<comment><USER4>
      needing to look at a clock in bed to decide if they are still tired

You make a great point here and it almost reminds me of addict behavior. I would be curious to see which pathways are illuminated in the brain with regards to 'checking the time' during resting hours.

<comment><USER5> To work well, should be "addicted" to our routine, shouldn't we? As in, follow it almost every day.

<comment><USER3> There is probably a lot of philosophy/linguistics/neuroscience to do, but there is a difference between habit and addiction. Addiction seems like a toxic shortcut to get what you want out of life, even if the "addiction" is to a benign behavior like sleep schedule.

</comment></comment></comment></comment></comment><comment><USER6> What is going on with Argentina? It straddles what would be UTC-4 and UTC-5, so one would expect it to be in one of those time zones, or to be a two time zone country using both of those, but it is actually in UTC-3 (which is why it is all deep red in the map).

According to Wikipedia [1]:

> The first official standardization took place on 25 September 1894. The > official time switched between UTC−4 and UTC−3 from 1920 to 1969, and then > between UTC−3 and UTC−2 from 1974 to 1993. [...] On 7 March 1993, it was > fixed at UTC−3, called Argentina Time.

I can sort of see UTC-3 if they felt it was important to be in the same time zone as Brazil...but I can't even come up with a guess as to how UTC-2 was ever an option.

[1] [https://en.wikipedia.org/wiki/Time_in_Argentina](https://en.wikipedia.org/wiki/Time_in_Argentina)

<comment><USER7> I suspect it's their preference for daylight in the winter. Which currently in Buenos Aires is about 8:00 AM to 6:00 PM.

Worth noting that the provinces have the option of following DST but choose not to.

</comment></comment><comment><USER8> It's interesting that while, as the author notes, the map seems to skew red overall, with more places opting for a late time zone, the few deep green areas there are are among the most heavily populated regions in the world - the northeast US, Japan, central Indonesia, coastal Brazil, Southern California. This is a typical issue with geographic visualizations. I'd be interested to see a population histogram for how many people are on late solar time vs early.

</comment><comment><USER9> I'm mildly surprised this discussion hasn't brought up the artificiality of daylight savings time, summer time, and whatever other names it might be called by around the world. Certainly the concept is prevalent enough.

Leaving aside the arguments about saving energy (I am not knowledgeable enough to speak to that in any event), daylight savings time seems to be an enormous confusion factor, especially since (as one example) Europe and North America have different start and end dates.

On one level it seems that DST is a way of patching a system that is fundamentally flawed, hence some of the very interesting suggestions in these discussions about alternative methods of timekeeping. But changing such an entrenched and widespread standard might be next to impossible.

<comment><USER10> > I'm mildly surprised this discussion hasn't brought up the artificiality of > daylight savings time

I'm reminded of the Hitchhiker's Guide to the Galaxy: "Time is an illusion. Lunchtime doubly so."

Time zones are artificial too, but the benefits of coordination outweigh the advantages of sticking to a perfect solar noon.

The thing DST does pretty well is keep sunrise to within an hour of 7:00am (plus or minus, depending on location) year round. Without DST, sunrise varies by 3 hours in the US.

> daylight savings time seems to be an enormous confusion factor

It certainly requires people to adjust, two days a year. There is certainly some small amount of effort related to publishing calendars and having a few people forget, I suppose. At least, that used to be common before smartphones and the internet. It seems to be fading over time.

But what is the enormous confusion are you referring to?

It seems like these days, since nearly all clocks and phones are digital and net-connected, we _could_ , if we wanted, have a continuously adjusting schedule. That wouldn't reduce confusion, but it's no longer crazy either.

<comment><USER11> I think that the referred confusion is the difference in applying the DST between Europe and US:

 _Start and end dates vary with location and year. Since 1996, European Summer Time has been observed from the last Sunday in March to the last Sunday in October; previously the rules were not uniform across the European Union. Starting in 2007, most of the United States and Canada observe DST from the second Sunday in March to the first Sunday in November, almost two-thirds of the year._

The problem is that if you're European (like me) and have recurring weekly meetings with US based coworkers the meetings will be shifted by an hour until the other party shifts the clock.

</comment></comment></comment><comment><USER12> This sort of thing is always interesting to me. I love how by using the analemma and the equation of time you can figure out the times of sunrise/sunset anywhere on the planet for any time of the year [1].

Another interesting thing to read about is the problem of longitude, it's amazing how clever we've had to be to solve such problems in practice. In Florence there is a Galileo museum which showcases some of his ideas on how to compute longitude, namely by using the orbits of Jupiter's moons as a sort of universal clock to make the calculation possible.

[1] [https://en.wikipedia.org/wiki/Analemma#Times_of_sunrise_and_...](https://en.wikipedia.org/wiki/Analemma#Times_of_sunrise_and_sunset)

</comment><comment><USER13> Is it really desireable to have the apogee of the sun be 12:00? Maybe yes maybe no: I don't know.

Most businesses work ~3 hours in the morning and ~5 in the afternoon.

From a thermal perspective, there's an inertia and an accumulation effect so the hottest part of the day is around 5PM, not noon. There may be times when we want to maximise whatever heat available, or conversely avoid as much heat as possible.

But in the end, I think it evens out as the culture will simply adjust to what works best for most people, and not really care about lining up to neat numbers.

<comment><USER14> Interesting... the hottest part of the day in what I've experienced, in terms of thermal accumulation, is around 1-3pm. But I've usually lived on the coast or within 100km of it; the sea works as a huge normaliser for intraday temperature.

When several thousand kilometers inland for the first time, the hot days and cold nights were stark, despite the average temperature being about the same.

Do you live significantly away from a very large body of water?

<comment><USER15> It's also latitude dependent. The amount of sunlight you get at 4:30pm also depends on time of year and time zone, etc.

</comment></comment></comment><comment><USER16> That was a great read, thanks!

Made me wonder what other thing our civilization could consider starting back from scratch to adjust to our modern ways of living.

For example, do we really need time to be set as this 365.25d/24h/60m/60s system? We could have something more convenient/modern/metric?

Same for days of the week and daylight saving time.

I know it would be absolutely impractical and costly, but I like to entertain the idea of adopting a better system.

<comment> martin-adams Well, it's hard to change the number of solar days it takes to go around the sun one full revolution. Anything different and we'd see the seasons shift.

As for number of hours in a day. 24 is very divisible which is better than say 10. You can divide it into 1, 2, 3, 4, 6, 8, 12, 24 without fractions.

As for 60 minutes and 60 seconds, these again are very divisible: 1, 2, 3, 4, 5, 6, 10, 12, 15, 20, 30, and 60.

The more interesting question, should we have chosen base 12 instead of base 10. It would of course be harder to count using your fingers.

<comment><USER17> > It would of course be harder to count using your fingers.

No necessarily. 4 fingers * 3 knuckles per finger make 12, so you can count in base-12 using only 1 hand. I think the Sumerians (?) used that * 5 fingers on the other hand to count in base-60, resulting in our base-60 time system.

</comment></comment></comment><comment><USER18> This shows how much staying with UTC time or adopt the International Atomic Time (TAI) is a false problem. As time references changed because of the telegraph and railways, computers will make us change from UTC to TAI. The question is when.

</comment><comment><USER19> Very tangential, but it's pretty annoying how so many articles on the internet unnecessarily make things bold.

</comment><comment><USER20> Having lived in Japan and China (shanghai) which are both wrong in the opposite way of Spain and lived in France and Spain, I find that living in the red zones is really much more comfortable and a lovely way to live.

</comment><comment><USER21> There will be 45 suggestions to change how we track time in this thread.

<comment><USER3> My suggestion is people try to put much more distance between themselves and time.

<comment><USER22> > _" We can solve any problem by introducing an extra level of indirection."_

[https://en.wikipedia.org/wiki/Fundamental_theorem_of_softwar...](https://en.wikipedia.org/wiki/Fundamental_theorem_of_software_engineering)

</comment></comment></comment><comment><USER23> > 2014

So add four years to all values, I presume.</comment>


How real US economy collapse is? - <AUTHOR> I see a lot of articles and interviews from economists who are constantly repeating that the US collapse is inevitably coming in the next years. So the question is pretty simple, what is your thought about all this hype? <comment><USER2> I'm taking your use of "collapse" too literally, probably. I do expect a decline and possible deflation.

Several troubling indicators exist: \- US employment rates are only now on par with pre-2008 crisis levels \- Current new job creation tends to be in low- income employment \- Margin debt in equities has been touching historic highs \- Household debt, particularly among new graduates, is also at or approaching historic highs \- Oil and other commodities prices are falling, representing declining demand for goods created with such resources \- Political risk is rising and US capacity to deal with it effectively is, in my estimation, limited

Taken alone, these are all concerning indicators. Taken together, they have prompted economists and, recently, the IMF to issue strong warnings about exposure to equities and the upcoming US economic climate.

However, I wouldn't say this constitutes a near-term "collapse". The US will likely go into recession, or stagnate for the coming two or three years. Much of the growth in the past six years has been on the back of Federal Reserve management, so when the support ends, the economic cycle will continue a downward course. This in turn will make it cheaper to resume manufacturing in the US, compared to other countries, and production of a number of new technologies and components being developed now (solar energy, semiconductors, autonomous vehicles) may grow in the US, leading to wider growth and recovery. US infrastructure is also due for a makeover, so programs investing in the restoration of roads and bridges will also lead to improved employment and growth.

Of course, several of these factors require government action, rather than trust in market actors, so it's really a matter of personal politics whether you expect collapse, decline, or growth. Still, as I pointed out, the indicators are difficult to ignore. I personally pulled a lot of cash out of equities and decided to build a cash base to insulate me from a stock market correction and provide liquidity for either buying after a correction, or investing in real estate. Or maybe I'll be able to get a boat on the cheap... always wanted a boat. All of this is to say, you can't predict the future, but I'm expecting a decline and I've created options for myself to deal with what I expect.

</comment><comment><USER3> (1) Check whether the economist peddling this view incidentally has a lot of gold he needs to unload, or is running a shop or fund for gold.

(2) Check whether the economist peddling this view incidentally is funded by the Russian government (e.g. works for RT) or a similar entity interested in pushing up US treasury yields.

(3) Check whether the economist peddling this view has been repeating the call for a collapse bi-weekly since the Carter administration. A clock is right twice a day after all.

<comment><USER4> (4) Check whether the economist peddling this view describes themselves as an Austrian or a follower of praxeology. Those are the "Creation Science" of economics: Faith-based and with no successes to their name. They even deny the role of evidence in economic theory, because if evidence is flawed and sometimes biased it should (apparently) be discarded entirely.

<comment><USER5> I don't know if I'd be _that_ hard on the Austrians.

<comment><USER4> Seeing a sibling comment: Yes. I meant Austrian School economists. I'm sure economists who happen to live in or work in or be from Austria are just as competent, on average, as economists from anywhere else. I never really anticipated that anyone would misinterpret that.

</comment></comment></comment></comment><comment><USER6> Confirmation Bias Overload from Forbes...23 Charts Prove That Stocks Are Heading For A Devastating Crash

[http://www.forbes.com/sites/jessecolombo/2014/07/01/these-23...](http://www.forbes.com/sites/jessecolombo/2014/07/01/these-23-charts- prove-that-stocks-are-heading-for-a-devastating-crash/)

</comment><comment><USER7> pertly short but it quiet off .will be having big decline in job.s car house. those 3 plus some small tech bubbles. plus are us wary monger trying go to syrea ny nip lie he been trying work up noting that plus some ethic probems with sheech and veiws of some event like how some conopery kown some wastin realy live to fund warlord prop them a big bogy man sadly in cases as I seen over yr i don't personaly care for the Birgs banks ecmoicaly can't be ingoerd in realy. to ware big amto infsine an hit as end restal but bobbles be pushed . that wa i'm personaly saying out risky assist right now. one housing go back down my think about buy but the buyrs probemly won't thare for long bit of time.

<comment><USER8> Wow, this is gibberish</comment></comment>


The Forgotten Black Pioneers Who Settled the Midwest - <AUTHOR> https://www.atlasobscura.com/articles/black-pioneers-in-the-midwest <comment><USER2> Sounds like a topic for a best selling book!</comment>


Are Swiss banks buying Bitcoins? - <AUTHOR> Hey HN!
I've been talking to some people here in Switzerland and they say that banks will begin to trade with Bitcoins.
For me this sounds great, as Bitcoin would become an "accepted" or "proper" currency and we (as a company) could accept it safely for selling our hosting.
I am wondering if anyone else heard about this? <comment><USER2> Perhaps you heard about the blockchain technology banks want to implement for doing transactions between eachoter, sort of a replacement to SWIFT.

[https://en.wikipedia.org/wiki/R3_%28company%29](https://en.wikipedia.org/wiki/R3_%28company%29)

If this is the case, this is not bitcoin, but a derived tech that the banks are thinking about using.

<comment><USER3> actually, there is already a Swiss bank that wants to do just bitcoin in the process of getting licensed [http://www.zerohedge.com/news/2015-05-27/switzerland-open- bi...](http://www.zerohedge.com/news/2015-05-27/switzerland-open-bitcoin-bank- crypto-fort-knox-relocates-zurich)

</comment></comment><comment><USER4> Swiss banks are notorious for conservatism, not bleeding edge tech. Perhaps Bitcoin's time truly had passed. :)</comment>


Toptal suit against co-founder dismissed - <AUTHOR> https://www.pacermonitor.com/public/case/29530665/TOPTAL,_LLC_v_BENESCHOTT <comment><USER2> The title originally was "Toptal sues co-founder $NAME for fraud". Since the case was dismissed, I've updated the title.

Edit: we've also replaced references to that person's name with "[redacted]" below. The reason is that HN threads tend to rank highly in search results. We don't want a situation where Googling some individual's name will forever lead people to an old thread like this, where they won't find important relevant information that, e.g., the case was later dismissed.

Generally we find out about these things because individuals (or, less optimally, their lawyers) email us and ask for threads to be deleted. We tell them that we don't delete entire threads because that would be unfair to the commenters who participated, but that there are usually other things we can do to help resolve legitimate privacy concerns while preserving the rest of the thread. This case was an example of that.

</comment><comment><USER3> Just read through the whole thing (don't know why) - here is the synopsis:

It doesn't really talk about any ownership issues regarding the CEO - it's basically saying that [redacted] (an early employee) embezzled/mis-used money and when fired, started claiming he owned part of the company or was entitled to compensation.

According to the thing - [redacted] was hired a COO as an early employee with no equity, they claim he was unhappy, and that he embezzled a bunch of money by paying his girlfriend, getting bonuses, and misusing the company credit card (some of this he repaid). But once they found out, they fired him, and he started claiming he owned equity and/or was owed severance.

They want the money back, him made to shut up, and possibly drawn-and- quartered.

So it doesn't look like this is much broader than that .. again - according to the doc.

<comment><USER4> Throwaway for obvious reasons. I was at a startup in the valley where they got one of the cofounders to work for sweat equity for over a year then got him deported to his home country to remove him from the picture (was reliant on employer sponsored visa. They 'accidentaly on purpose' didn't turn up to his immigration meeting). He managed to dodge this by enrolling on some bullshit PhD to get back into the country but then they screwed him with trumped up claims of embezzling company funds. All I would say is, don't jump to any conclusions with your interpretation of this case.

<comment><USER5> Co-founders definitely do horrible things just to retain equity for themselves.

Another true story: A team co-founded a company together. They all agreed to be co-founders and split the equity as fairly as possible.

Co-founder X was put in charge of legal, since noone else wanted to do it. Unbeknownst to the others, X allocated a small pool of shares for everyone except for X, taking the vast majority of the company for himself.

When everyone received their share agreement, they did the division against the "total shares" listed in the agreement. Everyone's percentages came out as expected, since they falsely believed the "total shares" represented the total shares in the company -- rather than in the pool.

To illustrate this, X owned over 83% of the company, while the next highest co-founder Y (the CTO) vested < 0.33%/year. Amazingly, X and Y had both agreed to take identical pay (below living) and make identical sacrifices, i.e. quitting their jobs to go full-time together.

Y left after a year, having found out months prior and given X time to resolve it in (misplaced) good faith. X managed to get VC investment only a few months later -- by not mentioning that the company's CTO had quit only a few months earlier.

When the VCs found out about Y, X then informed Y he was never the CTO but a "freelancer" \-- even though Y had joined with the intention of being CTO, performed all CTO duties, and was called the CTO by everyone involved. The other co-founders were informed to write they were retroactively "Founding Members" rather than "co-founders."

Of course, if the co-founders are experienced about business it would be difficult to pull this off. For example, you should insist on seeing the cap table even if you believe you know the percentages.

However, this happened to intelligent co-founders right out of college, who even had a parent's lawyer friend look over the contracts.

<comment><USER6> > who even had a parent's lawyer friend look over the contracts.

That lawyer needs to be sued for malpractice. This is their _job_.

<comment><USER7> > _That lawyer needs to be sued for malpractice. This is their job._

Why do you think that? Perhaps you parsed "parent's lawyer friend" as "parent's lawyer"?

The former is likely doing a favor and would not be paid the full sticker price when rendering such a service since the transaction is not truly at arm's length. The latter is more likely to be sued for malpractice since you would be paying the full sticker price.

<comment><USER8> How much you paid would have no bearing. If you paid $1 but officially engaged any lawyer, friend or not, they would be fully liable for malpractice.

</comment></comment></comment></comment></comment></comment><comment><USER9> It's curious that Toptal is structured as a single member LLC. That would make it difficult/impossible for a VC to invest. And, while they claim they raised a round from a16z, it's not listed on a16z's full list of investments:

[https://a16z.com/investments/](https://a16z.com/investments/)

That would support the notion that Du Val promised to convert and issue stock to other parties and never did.

<comment><USER10> Strange that it's not on the website there. I don't know if the investment really happened either, but there are a couple links on a16z which seem to suggest they did invest in TopTal. Some articles reference a seed round.

(these links are all empty apart from a logo and a date ranging from 2013 to 2016)

[https://a16z.com/toptal-2/](https://a16z.com/toptal-2/)

[https://a16z.com/toptal-logo-3/](https://a16z.com/toptal-logo-3/)

[https://a16z.com/toptal-logo/](https://a16z.com/toptal-logo/)

[https://a16z.com/toptal/](https://a16z.com/toptal/)

<comment><USER11> Looks like it shows up on their seeds page in some older snapshots: [https://web.archive.org/web/20150810161359/http://a16z.com/s...](https://web.archive.org/web/20150810161359/http://a16z.com/seeds)

</comment></comment></comment><comment><USER12> Ah yeah Toptal. I did an interview thing with them 3 or 4 years ago. I don't remember the details, except that it was online, moderated, timed, three python algorithm challenges. I nailed the first two and went overtime on the third, and was told I could "try again in six months." I remember it being an unpleasant experience.

<comment><USER13> And at the end they would offer you 20 or maybe just maybe 30 USD/hour maximum. And with hour they do mean billable hour.

</comment></comment><comment><USER14> So someone explain this. The amount seem to be in the low 100k area? Why bother suing?

Du Val has hoarded all this stock, apparently it has worked, you can argue the ethics of it, but he seems to have pulled it off. Why not just write off this relatively small amount for a company with $200m revenue? Why draw attention to yourself and your company?

Is it an ego thing?

<comment><USER3> Looks like it was more than that (plus he's now trying to claim he owns a part of the company and/or entitled to $2MM.. again, according to the doc)

"[redacted]'s at-will employment was terminated for the reasons herein explained, and [redacted] left Toptal's employ unjustly enriched, and with amounts owed by him to Toptal in the form of unpaid loan amounts, unreimbursed credit card charges of a purely personal nature, and restitution for amounts caused to be embezzled and diverted to his girlfriend and for an unapproved, self-awarded bonus, totaling at least $629,850.46."

<comment><USER14> Thanks. I just read first the few pages, thought it was lower.

If the COO just kept quiet, I think it would have been worth it to forget even $630k, but I guess could say it also sends a message.

I don't think most people on HN knew about the interesting events related to ownership of Toptal, so good for us the suit happened.

</comment></comment></comment><comment><USER15> Seems like the other way around: [https://www.theinformation.com/go/4146dbb37f](https://www.theinformation.com/go/4146dbb37f)

<comment><USER16> That theinformation.com article alleges that Toptal CEO Taso Du Val has all the stock, despite that employees and investors, including Andreessen Horowitz, expected to get stock.

Since our industry has become the 1980s Wall Street of ethics, not much behavior surprises me anymore, but a successful startup allegedly backstabbing a prominent VC does.

<comment><USER17> You'd be surprised how many "darlings" of our industry screwed their best people when the promises were due (even written ones) and plans changed.

<comment><USER18> What's interesting is that usually people get screwed because the founders/execs raise too much money. Here, they didn't raise enough.

</comment></comment></comment></comment><comment><USER19> There is an outstanding case by [redacted] in Collier County Florida, case number: 11-2019-CA-002689-0001-XX

Here's the pdf: [https://uploadfiles.io/791hz3tg](https://uploadfiles.io/791hz3tg)

If the link doesn't work, you can access it:

Go to [https://cms.collierclerk.com/cmsweb](https://cms.collierclerk.com/cmsweb) Click Case Search In "Case Number" input "11-2019-CA-002689-0001-XX" (no quotes) Click Search Click Dockets Click the paperclip next to Docket Num 2

</comment><comment><USER18> Link to the full complaint: [https://gofile.io/?c=dnaTwk](https://gofile.io/?c=dnaTwk)

<comment><USER20> Directly to the PDF: [https://srv- file6.gofile.io/download/dnaTwk/Toptal%20v.%20Be...](https://srv- file6.gofile.io/download/dnaTwk/Toptal%20v.%20Beneschott%20Complaint.pdf)

</comment></comment><comment><USER21> [redacted] sued Toptal for 100M, case number 11-2019-CA-002689-0001-XX in Collier County.

My other post was shadowbanned, here's the pdf: [https://uploadfiles.io/791hz3tg](https://uploadfiles.io/791hz3tg)

</comment><comment><USER22> Can anyone provide a link to full complaint? Pacermonitor is not free and only shows the preview of the 1st page.

<comment><USER18> I'll be happy to download it but don't know where to host it. Suggestions?

<comment><USER23> Install the recap extension which posts it publicly on courtlistener.

</comment></comment></comment><comment><USER24> Looks like something you don't want to touch with a ten foot pole as an employee or an investor (or user for that matter). Avoid vexatious litigants.

</comment><comment><USER25> TLDR; Toptal started small and took a little funding early on, but now has over $100mm in annual revenue and got there mostly through organic growth rather than follow on investment rounds.

The company seems to be wholly owned by one of the co-founders. The other co- founder, who was in college when the company started, doesn't have an equity stake at all. Presumably he had a salary from day 1. There seems to be some sort of agreement that if the company restructures, he _might_ get equity at some point, but this isn't necessarily going to happen.

Founder 2 (no equity) is accused of defrauding the company by misusing funds and hiring his girlfriend at an above market rate. The language of the complaint indicates that he's upset about not having an equity stake.

</comment><comment><USER26> Toptal is a massive ADA violator for those with ADHD screened out by competition programming style interviews, but are great programmers under routine conditions.

<comment><USER27> Doesn't that apply to every company that does technical interviews? What about people with anxiety disorders? Any interview at all is discrimination.

<comment><USER28> > What about people with anxiety disorders?

What kind of accommodations would suit these individuals?

<comment><USER29> Relatively small but not too small take home project plus live code review and discussion of approaches they took in the project.

<comment><USER28> When I used to be a manager who did hiring, I was always open to accommodating the candidates needs. Like instead of whiteboard, using paper or laptop. So far nobody asked for take-home projects. A few times people asked for a second chance and I'd agree to it.

</comment></comment></comment></comment></comment><comment><USER30> > 65\. Also after the termination of [redacted]'s at-will employment, again to > extract even more money from Toptal and continue to unjustly enrich himself > at Toptal's expense, [redacted] has also made baseless and unfounded claims, > that he is entitled to $2 million in severance, the monetary equivalent of a > two-month leave of absence, and a $40,000 bonus.

Dude was getting paid $!,000,000 a month? Damn.

<comment><USER3> No :) (i read it that way too at first)

It's $2MM + 2mo + 40k

<comment><USER30> Ah - thanks for the clarification :)

<comment><USER31> I'm a lawyer, and it made me do a double take too.

</comment></comment></comment></comment><comment><USER32> There is another lawsuit involving TopTal in Collier County (where [redacted] lives):

[https://www.filebin.ca/4rhKFRhk9bk9/11-2019-CA-002689-0001-X...](https://www.filebin.ca/4rhKFRhk9bk9/11-2019-CA-002689-0001-XX.pdf)

</comment><comment><USER33> Another story of non-executives being screwed over stock - we've seen claw backs, revaluation, reweighting, etc

Seriously people need to stop accepting anything other than actual, real shares, that aren't any kind of lesser grade/b class shares. Guaranteeing investor payback over employee payback.

Employee's, especially early ones, are taking more risk than the VCs and should be compensated at a higher rate. If investor repayment is higher priority in funding rounds/buyout employee investment should be paid back before purely cash investors.

The end.

<comment><USER34> The reality is that you need to be able to trust the founders and board members you work with. A corporation's board typically has the authority to issue new shares (thus diluting existing shareholders), so even having unrestricted common stock or even preferred stock does not guarantee that you will always own a certain % of a company's outstanding shares.

Between all the preferred share terms, warrants, options, contingent earn- outs, etc, there's a million ways to engineer the divvying-up of proceeds in a sale.

Ultimately, it comes down to whether you trust your leaders to hold to the spirit of their agreement with you.

All that said... it would be really interesting to see a corporation with bylaws and governance/voting structured in such a way that employee ownership and payout %s could be maintained within certain guaranteed bands. It would severely limit that corporation's flexibility, and might lead it to have a higher risk of failure in bad funding market environments... but it could become a big draw for high-value employees who strongly prefer equity certainty over cash comp and company autonomy.

<comment><USER35> This is 100% true. You need mechanisms that validate and verify that trust (real stock or standard options, documented legal contracts, etc..) AND you need to have the personal trust in the board/founders in the first place.

Even with both there's risk beyond just market risk, but at least you've done what you can to minimize it.

</comment></comment></comment><comment><USER36> Courtlistener has the full docket without a paywall: [https://www.courtlistener.com/docket/16048273/toptal-llc- v-b...](https://www.courtlistener.com/docket/16048273/toptal-llc-v- beneschott/)</comment>


Python's Hidden Regular Expression Gems (2015) - <AUTHOR> http://lucumr.pocoo.org/2015/11/18/pythons-hidden-re-gems/ <comment><USER2> > (Have a look at what dir() returns on a regex pattern object).

      Python 2.7.13 (default, Dec 20 2016, 16:00:28)
      [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)] on darwin
      Type "help", "copyright", "credits" or "license" for more information.
      >>> import re; dir(re.compile(''))
      ['__class__', '__copy__', '__deepcopy__', '__delattr__',
       '__doc__', '__format__', '__getattribute__', '__hash__',
       '__init__', '__new__', '__reduce__', '__reduce_ex__',
       '__repr__', '__setattr__', '__sizeof__', '__str__',
       '__subclasshook__', 'findall', 'finditer', 'flags',
       'groupindex', 'groups', 'match', 'pattern', 'scanner',
       'search', 'split', 'sub', 'subn']

Looks OK to me. What am I missing?

<comment><USER3> That was apparently fixed in Python 2.7:

[https://github.com/python/cpython/commit/6116d4a1d1ecd6e9b94...](https://github.com/python/cpython/commit/6116d4a1d1ecd6e9b94cfaa524b9b7cd5a6b5447)

[http://bugs.python.org/issue12099](http://bugs.python.org/issue12099)

But that commit pre-dates the blog post by many years, so maybe Armin was referring to something else, or maybe he hadn't realized it had been fixed?

</comment></comment><comment><USER4> Couple relevant links. "regex"[1] is an upward-compatible "re" replacement with better performance and many added features including fuzzy matching.

Second, the tokenizer technique of stacked expressions described in the OP is also documented in the Python re module doc[2], at least conceptually.

[1] [https://pypi.python.org/pypi/regex/2017.04.29](https://pypi.python.org/pypi/regex/2017.04.29) [2] [https://docs.python.org/3.5/library/re.html#writing-a- tokeni...](https://docs.python.org/3.5/library/re.html#writing-a-tokenizer)

</comment><comment><USER5> Previous HN discussion here:

[https://news.ycombinator.com/item?id=10600520](https://news.ycombinator.com/item?id=10600520)

</comment><comment><USER6> This is super neat! But... why is it undocumented? Is there a reason it's kept a "secret"?

<comment><USER7> Surely it would have been way more useful to contribute the missing documentation rather than write the article. Maybe that's harder to do than it sounds.

</comment></comment><comment><USER8> 2015.

"Ignoring Python 3.." that's getting harder and harder to do these days.

<comment><USER9> I'm rather the opposite: I ignore anything ignoring Python 3. That's the only version of Python I can bother touching these days.

<comment><USER10> It is official; Netcraft confirms: Python 2.7 is officially dead.

One more crippling bombshell hit the already beleaguered Python 2.7 community when josteink confirmed that he would not be bothering to touch anything older than Python 3 code.

All major surveys show that Python 2.7 has steadily declined in market share. 2.7 packages are very sick and their long term survival prospects are very dim. If legacy Python is to survive at all it will be among trolling dilettante dabblers. 2.7 continue to decay. Nothing short of a miracle could save it at this point in time. For all practical purposes, Python 2.7 is dead.

FACT: Python 2.7 is dying.

<comment><USER11> Wasn't the same said of BSD at one time?

<comment><USER10> Yes, ha, I was just taking the piss. It's an old Slashdot trope to declare things dead by Netcraft survey.

</comment></comment></comment></comment></comment><comment><USER12> > _[Python 's implementation of regular expressions is] one of the best of all > dynamic languages I would argue_

This sounds dishonest to me; it's deliberately couching the claim with a qualification ("imo") and disqualifying the 'dynamic' languages with better regex support (Perl, Ruby, JavaScript). The counter-claim is already prepared as a "No true Scotsman" argument: these other languages aren't as good because they don't have a scanner built into the regex language.

I also don't understand why the author needs to qualify the claim on dynamic/non-dynamic grounds. Can someone please help me understand?

<comment><USER13> > _This sounds dishonest to me; it 's deliberately couching the claim with a > qualification ("imo")_

He gives his opinion, so he's humble about it ("imo", i could argue, etc).

It's not some great weasel-word trick to lure people, nor it's meant as an absolute scientific conclusion. Just says what he has seen in his experience.

> _and disqualifying the 'dynamic' languages with better regex support (Perl, > Ruby, JavaScript)._

How's that dishonest? He's not disqualifying them from the comparison he makes with some trick -- he just explicitly states that Python, in his opinion, is better than them.

> _The counter-claim is already prepared as a "No true Scotsman" argument: > these other languages aren't as good because they don't have a scanner built > into the regex language._

Even if he said that, that's not how the "No true Scotsman" fallacy works.

No true Scotsman involves you adding to the necessary qualities AFTER you've made an initial argument that doesn't include the new qualities. If you spell out in advance that you consider feature X important for a good regex engine, then you might be wrong, but you're not making a No True Scotsman.

Besides, his point is not that Python has a better regex library mainly or because it has a scanner feature. The latter is just one feature of the library that he presents, not what he defines as what makes Python's lib great.

For that he merely says that it's "one of the better designed core systems from a pure API point of view".

> _I also don 't understand why the author needs to qualify the claim on > dynamic/non-dynamic grounds. Can someone please help me understand?_

Because he is interested only in or experienced only in dynamic languages and their regex libs?

Or because while he knows that there are better regex engines for non-dynamic languages, he still thinks Python has the better regex engine among the dynamic ones.

It's a casual phrase in a blog post, not some huge marketing / FUD conspiracy that needs to be explained.

<comment><USER12> Thanks for replying! I'm explicitly challenging the claim 'Python has one of the best [standard regular expression core library] of all dynamic languages'. Its regular expression support is not as good as Perl's, for features and speed. Ruby's support is roughly equivalent to Perl's, and JavaScript's is roughly the same as Python's. PHP's suffers from a clunky interface but is competitive on features+speed.

If we open the floor to all languages, clearly lex/yacc is the winner w.r.t. writing a scanner. There's little difference between Python's and Java's support, and Boost::Regex makes PHP look good in comparison.

Can you go into more detail for:

> _That 's not how the "No true Scotsman" fallacy works._

Here's how I think it would go:

1> Perl has better regex support than Python

2> Well Python has a scanner built into the standard library, and thus can't be compared to languages which do not have that feature.

1> … but writing a scanner with the standard regex support in these languages is trivial

2> Doesn't matter, it's built-in and thus those languages aren't comparable.

> _there are better regex engines for non-dynamic languages, he still thinks > Python has the better regex engine among the dynamic ones_

Why does that matter? It feels exclusionary: in this narrowly-defined group, the choice I prefer has the best features. Did they mean, "of the languages I am familiar with, I've most enjoyed using regexes in Python"? That's a far more honest claim.

> _It 's a casual phrase in a blog post, not some huge marketing / FUD > conspiracy that needs to be explained. _

Communication is done every day, everywhere. These blog posts influence peoples' opinions, and (more importantly) _influence their approach to writing_. I want more articles to be balanced, honest, and informative, not rah-rah puff pieces.

<comment><USER13> > _Here 's how I think it would go_

"A True Scotsman" might go like that, but here was no step (1). The True Scotsman is all about the extra constraints added in the transition of (1) to (2).

If one starts at 2 (no prior discussion), they can define whatever they want as essential attributes for a Scotsman. They may be wrong in what they list, but they are not making a N-T-S fallacy.

> _Why does that matter?_

Because the post is aimed (by its author) at people using dynamic languages.

If I want to do some regex work, and mostly program in dynamic languages (or have found that dynamic languages fit my project better, etc.), then I just need to see an evaluation of regex engine across dynamic languages -- I don't care where C++ or Haskell regex engines might have more features.

In other words, it's about what constraints people put in searching for a language/lib to use.

Some people place the constraint "must be in a dynamic language" higher than "must be better overall" when they search for a lib/framework (in our case, a regex engine).

> _Communication is done every day, everywhere. These blog posts influence > peoples ' opinions, and (more importantly) influence their approach to > writing. I want more articles to be balanced, honest, and informative, not > rah-rah puff pieces._

Maybe, but between marketing, hidden sponsored posts, fake news and crappy/agenda-driven "real" news, I wouldn't start from Armin's blog :-)

<comment><USER12> Oh, I meant that the counter-argument would use "No true Scotsman", not that the article did.

> _Maybe, but between marketing, hidden sponsored posts, fake news and crappy > /agenda-driven "real" news, I wouldn't start from Armin's blog :-)_

I think I can comment on this article, and that the few HN commentators here will see it, and my message will certainly reach a small audience. For those relatively larger problem, I don't have access to a suitable medium or audience and thus, even though the privation is greater, I would reach zero people.

</comment></comment></comment></comment></comment><comment><USER14> I don't have a dog in the fight, but... this reminded me of Rob Pike's suggestion to avoid regular expressions in parsing and lexing tasks. [https://commandcenter.blogspot.com/2011/08/regular- expressio...](https://commandcenter.blogspot.com/2011/08/regular-expressions- in-lexing-and.html)

</comment><comment><USER15> As of Python2.7.13 x64 there is no keyword argument "skip" in Scanner.scan method.</comment>


Ask HN: Would you learn Rails nowadays? - <AUTHOR> <comment><USER2> No. I learned Rails a year ago upon joining my first Rails-using company. My 20 years in software engineering says that Rails is the wrong pattern. Recent chats with a recruiter in the Boston area who has gotten me jobs in the past say they're having trouble finding people to fill Rails jobs. People don't want to work in Rails.

OTOH; I could be wrong. Lots of successful products have been written in Rails (including at my current employer). There's still a 3 month intensive here teaching Rails as their first platform; but the curriculum has been split to now also do node.js

</comment><comment><USER3> I work with Ruby on Rails in my day job in NYC. I see that plenty of companies are using Rails. I recently switched jobs and had a slew of interviews lined up before selecting my current place. I think the greater issue I saw was that companies were more focused on experience level than tech stack. It's pretty hard for a junior developer to land a gig, especially since the market is flooded by bootcamp grads.</comment>


The leaky corporation - are there any bullet-proof CMS-s out there?  - <AUTHOR> http://www.economist.com/node/18226961?story_id=18226961?fsrc=nlw|mgt|02-03-2011|management_thinking <comment><USER2> I am doing research on strategies to mitigate risk of data loss and would like to discuss this CMS and DLP with anyone here, anymore documentation or resources would be greatly appreciated. I have bookmarked this discussion, and I hope to collaborate, leading towards a greater understanding for all.</comment>


Show HN: DatoCMS – Headless CMS for static websites - <AUTHOR> https://www.datocms.com/?src=hnc <comment><USER2> We have been using datocms heavily at my company for a variety of projects, and have been beyond impressed by how robust and well-thought-out the platform is, and how responsive the staff are to bugs and feature requests. I spend a LOT of time evaluating headless CMS' as part of my job, and Dato is a standout option - one that I recommend as a top choice to anyone who asks, and as an inspiration when I speak with reps from other companies building headless cms'. To be clear I am not employed by or have any partnership with dato at all, just a big fan of their work : )

<comment><USER3> What are some other headless CMS products? Is that the term?

I only know of contentful which looks very similar.

<comment><AUTHOR> [http://headlesscms.org/](http://headlesscms.org/) can help :)

</comment></comment></comment><comment><USER4> This might be important for some:

It costs a monthly subscription and doesn't appear to be open source.

<comment><USER5> Yeah, this product makes no sense for me as a subscription.

Up until the $150 mark there's nothing I see that shouldn't be doable on a standard home desktop machine in a reasonable amount of time.

This would make more sense to me as an outright purchase but that model seems to be out these days.

<comment><USER6> The core model here seems to be: You as a developer prepare everything so your clients then can use the backend to post to their websites. The cost for DatoCMS is part of what you bill your customer for managing their site.

That's not so easy to support with just a desktop machine.

</comment></comment></comment><comment><USER7> I may give this a spin! I've been using Netlify-CMS for a while, but it's not nearly as full-featured, and seems to have some issues with Metalsmith sites (I've been having difficult getting uploaded files added to the repo).

<comment><USER8> I love the Netlify-CMS approach, but is still too opaque to me. I wanted to get a better understanding of what was going on in the repo, so I wrote [https://github.com/fiatjaf/coisas](https://github.com/fiatjaf/coisas)

</comment></comment><comment><USER9> This is really slick.

I think this paradigm - a CMS that builds out to static files - is really powerful. The notes about speed and scale are spot-on, nothing is reliably faster than just nginx serving flat files.

I'm working on a microblog system based on the same basic idea.

</comment><comment><USER10> Looks great. Note that the inline demo animations don't work with Mac Safari 11. I had to use Chrome to see them.

<comment><USER11> If you keep refreshing they sometimes load on Safari!

</comment></comment><comment><USER12> Check out Tipe. [https://tipe.io](https://tipe.io).</comment>


A new proof that 83 is prime (2003) [pdf] - <AUTHOR> http://cr.yp.to/talks/2003.03.23/slides.pdf <comment><USER2> Interesting post. On a related topic, does anyone else know any articles or books that made simple mathematics hard?</comment>


Senator drafting bill to criminalize Apple's refusal to aid decryption - <AUTHOR> http://arstechnica.com/tech-policy/2016/02/senator-drafting-bill-to-criminalize-apples-refusal-to-aid-decryption/ <comment> shawn-butler I think it's funny it would be illegal for Apple to comply with the order under federal law and now they want to make it illegal not to comply with it.

Kafka would be proud.

</comment><comment><USER2> What the real problem is is that the TLA agencies don't have anything to lose with this.

Is there no way to go: "All right. We'll do that. HOWEVER, if we don't find anything on this phone, we want this held up as a prime example of government overreach and we want all further attempts on this judicially banned."

If the TLA agencies had a downside to losing the case, they'd drop it in a flash.

<comment><USER3> They'll probably never agree that they didnt get anything. They'll claim they got evidence related to "suspicion to X " which could be entirely based on a conversation where someone was expressing opinions. And yes, they might also say that the information is classified!

<comment><USER4> Yeap. "Parallel construction".

</comment></comment></comment><comment><USER5> This is a positive development.

The central question in Apple's case is "what are the limits of the All Writs Act authority?" Can a court use the All Writs Act to compel any behavior that the FBI says would be helpful to an investigation?

If so, it would seem to obviate the need for legislation. No need to bother Congress--just get a warrant for any encryption back doors you want.

At least a bill submitted to Congress will follow a public, democratic process.

<comment><USER6> We'll likely see more developments like this from other large iPhone markets. It's a noble but ultimately untenable position for a manufacturer to take.

If the courts, the owner and let's suppose the majority of the people of a jurisdiction (in this case US law) legally make this request I don't see how a company can get from out of complying by saying "we made it impossible". The courts will say, fine, in the future make it possible and not complying will forfeit the right to sell such a device.

Either the US, the EU or China will make their case economically and Apple will capitulate or exit a market --and I don't see them exiting large markets.

There is also no historical precedent where the notion of privacy has meant "secret forever" so this is new territory and where it ends up will probably depend on how society values new notions of privacy versus providing legal access to information for the purposes of crime investigation. In the US, and China, people have typically sided with the state, so I don't see this changing.

<comment><USER5> > There is also no historical precedent where the notion of privacy has meant > "secret forever"

Sure there is: a private verbal conversation.

There are plenty of ways for the government to record such a conversation if they know _in advance_ that they want to do so. But if they don't know that in advance--as they did not with the San Bernadino shooters--then the only people who will ever know what was said in that conversation are the people who held it.

Historically, privacy meaning secret forever was the norm! It is only in the last few years, with text-based electronic communications, that law enforcement has come to expect retroactive access to all conversations.

It's a very dangerous concept that should require careful consideration and votes to create. Instead it got created by default because no one knew how to do info security well 10 years ago.

<comment><USER6> Historically the world was gossip and telling "secrets" people lived in close quarters so keeping secrets was generally pretty difficult. With written communication, secrets ended with the death of the recipient where upon people would read letters and such --not that with most people illiterate there would be many people writing secret things.

I don't think the courts, the electorate or congress would allow or condone wholesale warrantless access to "private messages", however, I think what will happen is people will decide discrete, lawful access for investigative purposes with oversight will be tolerated. Most people are not binary about this issue. Most people are more nuanced about the topic and most people, I believe, will decide that there are circumstances where they believe "the government" has valid reason to have access to that kind of data from specific kinds of people who conduct specific kinds of acts.

</comment></comment></comment></comment><comment><USER7> So all of Apple will go to jail? Or just the shareholders?

<comment><USER8> Legally, corporations are people so I'd assume they have some sort of secret squirrel digital prison for imaginary people. /s

<comment><USER9> No, they're not "legally people," they're "legal persons," and that was true before Citizens United.

They are capable of suing and being sued, and capable of committing crimes. Under the doctrine of respondeat superior, a corporation may be held criminally liable for the illegal acts of its directors, officers, employees, and agents.

<comment><USER10> I believe you are correct:

The legal doctrine of respondeat superior is recognized in both common law and civil law...it translates, from the Latin, as "let the master answer"...

[https://en.wikipedia.org/wiki/Respondeat_superior](https://en.wikipedia.org/wiki/Respondeat_superior)

</comment></comment></comment></comment><comment><USER11> In the hierarchy of unsubstantiveness, "announcement of an announcement" definitely comes first, but "drafting a bill" could well be second. Most proposed bills go nowhere, let alone bills that haven't been written yet.

If anything comes of this, we can discuss it then.

</comment><comment><USER12> This concept of retroactive back doors seems a new awareness.

Actual, non-retroactive, backdoors are built into a design.

The idea you can take an existing design and insert a backdoor that works retroactively really is not a backdoor but is a complete security failure and a bug in the original design.

"My design is completely secure as long as no one issues a retroactive backdoor." means the design is not secure at all.

<comment><USER13> For certain notions of secure.

Let's use the analogy of a house to describe the OS.

Most organizations may trust Apple to provide the service of updating their OS when new bugs (some security) are discovered, that is, they are comfortable giving Apple "maintenance door" access to the non-sensitive parts of their iOS device, to perform janitorial and construction services, and plugging holes in the house; and only Apple has the keys through the maintenance door.

</comment></comment><comment><USER14> Just goes to show you can't legislate morality, but a crooked politician can try to make scruples illegal.

(I so hope Bernie wins and has the DoJ investigate folks for corruption and racketeering, starting with Cheney.)

</comment><comment><USER15> Ah, the GOP.

Keep this in mind when they carry on about being the party of personal liberty.

<comment><USER16> Taken narrowly, there is no personal liberty at stake in this situation. Searching this phone is clearly permissible under the 4th amendment.

I guess making Apple--a huge corporation--assist is somewhat against liberty, but I wouldn't call it personal liberty. They get compensated for it.

The slippery slope argument everyone seems to be pushing doesn't quite make sense to me. How is forcing Apple to help get past security after a valid court order going to hurt third parties privacy? Nobody is asking for Apple to introduce a backdoor into their products for sale. Only to exploit a backdoor into one specific phone.

<comment><USER17> The backdoor does not currently exist. Creating it leads to a slippery slope because the FBI will not only ask Apple to unlock phones from known dead terrorists who killed multiple people, but it will cascade to suspected terrorists, and then families of suspected terrorists, and then drug dealers and drug users and then speeders and loiterers and people of the wrong color, just like every other police abuse of power.

And then if Apple gives into the FBI, it'll have to give into the UK and France and Germany and China and Russia and anywhere else they want to sell their phones. And once the capability is created and exists, it can leak, and then no one's phone is safe anymore.

That's the slippery slope.

<comment><USER16> >The backdoor does not currently exist.

This is pretty much semantics. Apple can load a modified firmware without the password. That is a backdoor.

>Creating it leads to a slippery slope because the FBI will not only ask Apple to unlock phones from known dead terrorists who killed multiple people, but it will cascade to suspected terrorists, and then families of suspected terrorists, and then drug dealers and drug users and then speeders and loiterers and people of the wrong color, just like every other police abuse of power.

The fact is that each time this tool would be used would require a federal district court to specifically order it. That eliminates the slippery slope risk. The courts would absolutely allow it for murder cases. In fact, any federal crime. But that's what is supposed to happen.

And if you really think that a district court would let the FBI search a phone because they are the wrong color (or any other blatantly illegal purpose), well that court would also force apple to help them. So it ordering this now doesn't increase the likelihood of it happening.

>And then if Apple gives into the FBI, it'll have to give into the UK and France and Germany and China and Russia and anywhere else they want to sell their phones.

I am not arguing that Apple should give the FBI the power to do it independently. The FBI isn't asking for it. And the court didn't order Apple to do that.

Apple already has the capability to do this.

<comment><USER18> That you consider it a fact that law enforcement obeys its judicial constraints undercuts any argument you might make

<comment><USER16> I'm not considering it a fact. I consider it a fact that the FBI would not physically be able to use this tactic without an explicit court order.

You don't have to trust the FBI at all.

<comment><USER18> I'm not sure what physical restraints you believe would be in place. Please explain that.

<comment><USER16> They ask apple to code the firmware so it only works on that specific iphone. And it would be signed so they cannot edit the firmware.

Finally, the FBI even said they'd agree to do this on Apple campus and then actually give the iphone to apple after they copied data off it.

There is zero chance they could reuse it.</comment></comment></comment></comment></comment></comment></comment></comment>


F.C.C. Proposes Changes in Cable Set-Top Box Market - <AUTHOR> http://www.nytimes.com/2016/01/28/technology/fcc-proposes-changes-in-set-top-box-market.html?ref=technology <comment><USER2> I don't want a better set top box. I don't want my Apple TV to work like a cable box with channels. I don't want the cable experience at all, which is why I'm not a subscriber.

This just sounds like CableCARD part 2.

<comment><USER3> Presumably it would just be an app on AppleTV. So why would you care if it was available or not?

<comment><USER2> I didn't say I cared if it's available. If this is an exciting idea to someone else then I hope it works out for them.

Back when CableCARD was a new idea, I was excited. It was the right time for such a thing to exist, but it never took off. Missed opportunity. But I think the opportunity is lost now and we'd be better served moving on to a new model, something that builds off the streaming boxes we have now (though the UX needs a lot of work, and possibly a new paradigm nobody's thought of)

<comment><USER4> I think most people would pass on cable if given the option, but I don't see them letting go of their stranglehold on the major sports in the US anytime soon. I guess if you aren't a sports fan it's probably not a big deal.

<comment><USER5> The major sports are starting to come around. The MLB spun out their streaming product (into MLBAM) and signed a deal with the NHL to stream the game broadcasts and both are actively working on renegotiating the streaming deals with their member clubs to get rid of local blackouts.

</comment></comment></comment></comment></comment><comment><USER6> By the time any decision is rendered on this, it will most likely be moot. More and more programming is migrating to streaming services; a couple years from now (this would probably take that long with the public comment period, etc.) will make cable box lock-in a thing of the past for most consumers.

</comment><comment><USER7> They are probably getting a lot of pressure from the cable companies on this. It is getting to the point where any home I visit uses Roku / Apple TV or a smart TV as their primary viewing option.

<comment><USER8> In the NYC market (and possibly others) TWC has been heavily promoting a new program which lets you get live TV via a Roku device with no cable boxes at all. They know it is coming.

</comment></comment><comment><USER9> Did STMicro got an advance notice of this proposal?

[http://www.bloomberg.com/news/articles/2016-01-27/stmicro- to...](http://www.bloomberg.com/news/articles/2016-01-27/stmicro-to- cut-1-400-jobs-close-set-top-box-unit-as-sales-wane)

</comment><comment><USER10> Is CableCARD support still required in the US? Why hasn't that been sufficient to break the cable monopoly on the set-top box?

<comment><USER11> CableCard has a lengthy / costly certification process for device manufacturers, and has always had this problem where the cable companies technically support it, but it can be pretty arduous for the average consumer to get proper support from their provider to get their devices online. The first part really thinned out the herd in terms of offerings, and the second part made sure to limit the audience of people who actually went for those devices. I rocked a windows htpc with a cablecard adapter for a while, and I'm on tivo now, but I'm not sure that would have happened if I wasn't persistent and had done a bunch of the research on my own.

<comment><USER10> Yeah I have a CableCARD in my Tivo myself and am terrified of what happens if I ever have to replace it. But this failure of CableCARD suggests FCC regulation isn't sufficient to disrupt the cable company monopoly. I wonder if this new push on set-top boxes will be any different?

<comment><USER5> Cable Card was hamstrung because the FCC left design and implementation largely in the hands of Cable Labs, which was owned and operated by a few of the larger cable companies. It was intentionally design-by-checkmark; it met every one of the FCC's rules, but was overcomplicated and hard to use. It was designed to fail.

That said, if you can get it working, it beats the pants off of any cable box. I have an HDHR box with a Cable Card in it, and I can use it both via DLNA and on my Apple TV.

</comment></comment></comment></comment><comment><USER12> CableCard, Tru2Way, and DCAS all failed. Why did that happen and why would this time be different?

<comment><USER13> I think we are far more advanced then we where. We no longer require hardware to handle this, and that many people want an open standard that can be easily implemented.</comment></comment>


US drugmaker doubled price on potential coronavirus treatment - <AUTHOR> https://www.ft.com/content/b7a21a16-6a1f-11ea-800d-da70cff6e4d3 <comment><USER2> Ironically, behind a paywall.</comment>


Tell-HN: Lessons from a hack: one-way hash, password reset tokens & session keys - <AUTHOR>

Joomla has an (as of this writing unpatched) SQL injection bug. The hackers requested a password reset, used the SQL injection to view the password reset token, and then used the token to change the password. (And once they had admin access to joomla, they had access to the filesystem and did lots more.)
Everyone (hopefully) one way hashes login passwords, but who thinks to do the same for password reset tokens? But in fact they are (short term) passwords and should be hashed.
And even if you do that, I'm sure very few will think to one-way hash session keys. But session keys are also passwords (albeit temporary ones). If someone can read your session store they can impersonate any logged in user!
So also one-way hash the session keys.
Not having SQL injections would nice of course :) But mistakes (bugs) happen, and you should have multiple layers of defense. <comment><USER2> If they could use SQL injection to view the password reset token, then almost certainly they could do the same to set a password reset hash to whatever value they wanted.

<comment><AUTHOR> At least with MySQL, it's much harder. You can only have one statement in a query. For reading you can add queries using a UNION, but I don't see any way to embed an insert in a select.</comment></comment>