Thieves drain 2FA-protected bank accounts by abusing SS7 routing protocol - <AUTHOR> https://arstechnica.com/security/2017/05/thieves-drain-2fa-protected-bank-accounts-by-abusing-ss7-routing-protocol/ <comment><USER2> SMS is not a secure 2nd factor. It is subject to not only technical attacks such as the one in the article, but also a wide variety of social engineering attacks. Getting cell phone reps to compromise an cell phone account is apparently not hard, and has been used many times to take over online accounts.

<comment><USER3> SMS as a 2nd factor represents an engineering trade-off. Prior to its introduction, the only people who had access to 2FA were people who got $60 tokens from RSA. It blocks against certain classes of attacks, but is vulnerable to others (like malicious or insecure carriers).

Now, Apple users can use their fingerprint as a 2nd factor (e.g. for Apple Pay), but fingerprints have the unfortunate property of not being rotatable if compromised.

And there are FIDO U2F security keys, but you still need to issue $18-$50 tokens to each user, and you need host application support.

<comment><USER4> > _fingerprints have the unfortunate property of not being rotatable if > compromised_

Coworker has a wonderful term for this. He calls fingertips "amputationware". It really drives the point home.

But there is another very good reason to avoid fingerprints auth methods. The scanners are by design doing some level of fuzzy matching, so if/when[0] someone finds a way to generate an input that reproduces the signal pattern from the reader well enough, it can be fooled. (Yep, done already.)

My personal take on fingerprint authentication is that they are not passwords. They are usernames.

0: [http://engineering.nyu.edu/press-releases/2017/04/10/so- you-...](http://engineering.nyu.edu/press-releases/2017/04/10/so-you-think- you-can-secure-your-mobile-phone-fingerprint)

<comment><USER5> Fingerprints can certainly be "amputationware" if you refuse to give up your passcode and your threat model has a credible threat of amputations.

For most people, having their unlocked phone snatched out of their hands on the street[0] is a far more credible threat and somehow we don't have everyone saying you shouldn't unlock your phone outside.

[0] [https://www.theverge.com/2016/12/2/13819288/uk-police- encryp...](https://www.theverge.com/2016/12/2/13819288/uk-police-encryption- mugging-seized-phone-scotland-yard)

</comment></comment></comment></comment><comment><USER6> Banks here in the UK use your chip & pin based card as a second factor (or rather, as the two factors - the chip you have, the pin you know) - they give you a little card reader that can use the card and pin to provide a 2FA token for logging in or sign requests to send money.

It's a much better system. Of course, some banks don't use it to it's full potential - many use it only for signing money transfers, but it's still pretty good. The readers are also cheap and standardised, so you can use any one of them for any account, which is useful.

<comment><USER7> I have always been curious, do those devices work on linux?

<comment><USER8> they don't attach to the PC at all they are a simple standalone device you put your card into

they look like this: [http://l7.alamy.com/zooms/04452dfd35964790b44ee6514745de5c/n...](http://l7.alamy.com/zooms/04452dfd35964790b44ee6514745de5c/nationwide- building-society-digital-banking-card-reader-with-visa-byep9y.jpg)

to transfer money you enter your PIN, then the target account number and amount to transfer, and it gives you a code you type into the browser

</comment></comment></comment><comment><USER9> Last July, NIST called out SMS 2FA as insecure

[https://www.schneier.com/blog/archives/2016/08/nist_is_no_lo...](https://www.schneier.com/blog/archives/2016/08/nist_is_no_long.html)

Second comment: _SMS should have been removed long time ago considering the SS7 problems. Better to use a secure token._

Is the bank taking responsibility and covering the loss for their customers?

<comment><USER10> > Is the bank taking responsibility and covering the loss for their customers?

I think they should be required to. Although, isn't it possible that the sum of withdrawn amounts could be so large that the bank simply can't cover the loss, thus making it insolvent?

<comment><USER11> Haha there should be a rule about double-checking transfers that could break the bank.

</comment></comment></comment><comment><USER12> The problem with SS7 is that trust is assumed. Mobile carriers that have roaming agreements will have either a direct link or via a hub. So what happened here was the network of the foreign roaming partner was used to redirect the SMS traffic on the victims carriers. Would not be surprised if it was an inside job.

With ss7 you can do fun things like query the last location update/logged in base station for a mobile phone, due to roaming carrier x can query for customers on carrier y in another country. If you link up to one of the roaming hubs you can pretty much get the location of anyone with a mobile phone. Feature phones included.

<comment><USER13> @baybal2 you are shadowbanned. Only people with "showdead" on csn see your comments. You should probably make a new account.

<comment><USER14> I am fully aware of that. My hope is to have HN people remove my ban.

</comment></comment></comment><comment><USER15> The headline makes it sound as if abusing SS7 was all they needed to do but in fact they had to have the other factor as well so it really is not quite as scary as it at first appears. It also seems from the article that the thieves were able to log in to the accounts with just a password and only needed the SMS to sign transactions.

It's different here in Norway; the banks require two factor authentication to log in as well as signing transactions.

I don't claim it's perfect but at least no one can log in unless they control both factors.

<comment><USER10> > It also seems from the article that the thieves were able to log in to the > accounts with just a password and only needed the SMS to sign transactions.

This "feature" was enabled by default for my Danish online bank as well. I've since disabled it.

</comment></comment><comment><USER16> Phreaking, the cutting edge way to commit computer fraud in 2017.

Who would have guessed?

<comment><USER17> Now where did I put that whistle? I thought it was right next to my red box?

</comment></comment><comment><USER18> I'm still a little irked that Google constantly reminds me to add a phone number as a backup for my email account. I already have google push login, OTP, as well as backup codes.

This proves that the phone can be more a liability in the face of much better technology.

</comment><comment><USER19> Here's a guide for how to set up SMS-free two-factor authentication on your Gmail account. It will cost you $18; if that's a hardship, contact me.

[https://techsolidarity.org/resources/security_key_gmail.htm](https://techsolidarity.org/resources/security_key_gmail.htm)

<comment><USER20> You dont even need to buy a $18 hardware token. You can use a software TOTP token (ie. google authenticator)

<comment><USER3> So long as you never switch or factory reset phones, because Google Authenticator, by design, never reveals the private keys. (I've locked myself out of accounts because I broke my phone and had to get a new one.)

Also, do you really trust your Android phone with your TOTP private key? How do you know there isn't malware running on it as root?

<comment><USER21> Google Authenticator provides a list of backup codes that you can print and put in your wallet, or store as a secure note (e.g. in 1Password): [https://support.google.com/accounts/answer/1187538?hl=en](https://support.google.com/accounts/answer/1187538?hl=en)

<comment><USER22> Google provides backup codes, not Google Authenticator. Each service you add to your Authenticator keychain will have its own backup codes, if any.

<comment><USER21> Yes, thanks for the clarification.

</comment></comment></comment></comment></comment></comment><comment><USER23> Namecheap only supports SMS 2FA. The have been suggesting they will support Authenticator for years now [https://blog.namecheap.com/two-factor- authentication/](https://blog.namecheap.com/two-factor-authentication/)

Pretty unacceptable considering how important domain control is.

<comment><USER24> +1. You find horror stories even on HN in the past how reckless Namecheap is.

I personally had my domains on hold frozen without traffic being routed to my servers when my ex-gf chat with them gave my username (no password) and claimed it is her account because obviously she knew my full name and address where I live. While they didn't give her access to my account they sure froze my domain for about 5 days until everything got solved.

Not long after I moved to NameSilo.

<comment><USER25> Holy _crap_! I'll keep that in mind next time my registrations are up. This combined with their unwillingness to make proper 2FA a priority (a tweet told me they were 'setting up the infrastructure' 3 months ago) is a strong signal to look elsewhere.

</comment></comment></comment><comment><USER26> Isn't this the old "SMS is not 2FA, stop calling it that" argument?

<comment><USER27> Yep. Everyone has been saying SMS is _not_ a secure channel for forever now, and this is only one of _many_ possible attacks that can be used to trivially bypass SMS based auth. It's sad but true that in general banks have some of the weakest security on the internet, most online games do a better job protecting user accounts from unauthorized access.

<comment><USER28> The banks didn't get the memo from NIST and if anything they are getting worse - they are actually ramping up their use of callback and SMS authentication. Last month I had several apps force an SMS authentication because I hand't logged in since paying bills the prior month. One app disabled Touch ID and forced an SMS auth before I could log in again. One bank locked me out of my account entirely because you can't log in or contact custom service without receiving an SMS code (no voice option), but their system refuses to send SMS to my number.

It would be great if the banks supported TOTP and U2F keys (or if they managed passwords correctly and didn't limit the length or force absurd character recipes).

I once applied for a job at a top 3 bank's IT security area and on the way to the interview room I noticed that every single desk had a well worn copy of Computer Security For Dummies. I think that may be the root cause of all banking security problems right there.

<comment><USER29> > One bank locked me out of my account entirely because you can't log in or > contact custom service without receiving an SMS code (no voice option), but > their system refuses to send SMS to my number.

I have this problem with one of my credit card issuers (not the two I mentioned elsewhere in this thread) and they're going to lose me as a customer as a result. I can't log into any online banking without receiving a phone call or SMS and I'm prompted to enter a number at which I can receive such a thing. The problem is, I am entering the number that I _know_ the bank has but entering that number--or any other number I own--is met with "hmm, it doesn't look like that number belongs to you." Of course it doesn't considering my mobile phone service is paid for through my LLC and this is a personal credit card account.

When I tried calling them, I'm told that, again, I need to verify myself with an SMS and, no, the number I have used for a decade is not sufficient.

At least they've now returned to mailing me paper statements. Once I've verified that my last automatic payment has moved away from them as of next month, the card gets canceled. If I can't cancel by phone, I'll cancel by mail. If I can't cancel by mail, I'll just leave it in a drawer and watch my mail for any new statements until the card is canceled for inactivity.

</comment></comment></comment></comment><comment><USER30> The Sueddeutsche article claims that German customers were affected too. Most German banks I know of support TAN-generators[1] which are completely unhackable by any known methods. Insert your card, scan the barcode on your screen, confirm the target IBAN and amount, and you get a unique TAN that is calculated from your transaction parameters.

[1] [https://www.amazon.de/ReinerSCT-Tanjack-chipTAN-SmartTAN- Tan...](https://www.amazon.de/ReinerSCT-Tanjack-chipTAN-SmartTAN- Tangenerator/dp/B00QUVVA3O)

<comment><USER31> Yeah, here in the US you just tell the company billing you your account number and hope they don't abuse or leak it.

</comment></comment><comment><USER32> My bank's 2FA literally comes on a piece of paper. A set of numbered codes, and the banking app/site tells me which code to use for any given transfer.

<comment><USER33> Yea, I have the same from two different banks. For me this seems to be the obvious 2FA solution, but comments here are mostly about elaborate technical approaches. Is there something I'm missing?

<comment><USER32> I was really surprised, and the first time I came across this. I gave it some thought, and concluded I am more comfortable with this solution over anything technical.

</comment></comment></comment><comment><USER34> When I asked (via Twitter) if my credit union would provide a secure 2FA option, they told me:

> We're always on the lookout of how we can keep our members' accounts secure. > Right now, the Mobile Texts are FFIEC compliant.

<comment><USER35> As long as that means your funds are insured and will be replaced after they're stolen via SMS phreaking, I suppose that's not the worst answer they could have given you. Though I wonder how long it would take to get the replacement funds...

<comment><USER34> I wonder how you would prove that that a given transaction was fraudulent, and how much of a hassle that would be? And of course, that's assuming someone notices the transaction. If it was small enough, it could probably go unnoticed.

</comment></comment></comment><comment><USER36> _In August, Lieu called on the FCC to fix the SS7 flaws that make such attacks possible. It could take years to fully secure the system given the size of the global network and the number of telecoms that use it._

One of the newly discovered great sins of the early 21st century, is to disseminate insecure code. Before the public became widely aware of chemical pollution, I'm sure many polluters thought themselves innocent and environmentalists as pernicious busybodies.

</comment><comment><USER37> Another feather in the cap for a dedicated 2FA solution such as Google Authenticator etc. that doesn't use SMS?

Though having replaced two phones since using that solution - it can be a pain to have to re-set it up with each provider every time. I can see that if someone is prone to losing their phone, it will become a major issue.

I think the problem is that all the companies whom I use 2FA for have totally different methodologies for re-setting it up on a new device. Whilst some have an automated way of verifying my identity and resetting the new device almost instantly, I have had a couple that needed talking to a human support rep (inconvenient, but understandable) and one company that needed another employee in the company to do a full 2FA verification themselves, and then talk to a company support rep on my behalf to verify my request to reset my 2FA settings! (WTF).

Thus, each time I replace my phone, I find myself actually culling the number of services where I use 2FA purely because it was too much of a pain to go through the reset process, and it was actually easier to drop 2FA with them altogether (or in one case actually drop the service altogether).

<comment><USER38> There are some more friendly options than Google Authenticator if it's a hassle to keep setting up over and over.

I keep my 2FA in 1Password, and it works pretty well. I can access the codes from the desktop app without getting out my phone, or from my phone or tablet if I'm mobile.

The only scary issue is that all that information is encrypted in Dropbox. And I use 2FA on Dropbox! Hello cyclic dependencies! As a result, Dropbox is the only 2FA that I don't store in 1Password.

</comment></comment><comment><USER39> So SS7 is like BGP where you can just announce your number/IP block?

<comment><USER14> You can announce "this IMEI roams through me," to the original carrier. Some operators have some safeguards to prevent a locally active IMEI to be roamed, sometimes it is possible to have traffic routed both ways if they don't.

</comment></comment><comment><USER40> Edit: I had an idea for an improved sms 2fa, but comments gave persuasive reasons why google authenticator was better. Thanks for the comments!

Idea basically is a 3FA system where bank sends you a one-time 6-digit number. You then have to translate that number using a user-seeded cryptographic hash function. This secret function is your third factor which translates the received SMS code into the value you'll input at login.

Analysis: Security would increase; but ease-of-use would decrease, especially in regards to how a user would reset their password if they lose both their password and their program that calculates the cryptographic hash.

<comment><USER41> 2FA is already a hassle for users. Now you want to make them do math too? This is not a solution. Just don't use SMS at all. Google Authenticator is a better solution than yours.

<comment><USER40> You make a good point about ease-of-use. I agree a phone app is much easier to use with a smartphone. However, people with flip phones couldn't install such an app. You might then argue the demographic with flip phones would either use an RSA device or not have 2FA enabled at all - which seems like a valid point.

Security-wise, having a secret user math function seems more secure than the Google app. I can give reasons why if needed.

</comment></comment></comment><comment><USER42> Phreaking in 2017, interesting. The golden age of phreaking ended with SS7. SS5 was very insecure, people could just emit tones in certain frequencies and pull off tricks like calling for free. Maybe this is the beginning of a new era.

I think major websites should stop using SMS and ask for just an authenticator app or secure keys. SMS should be regarded as a bad security practice.

</comment><comment><USER43> This is really scary... can banks please start using something like Google Authenticator? I was assuming that 2FA over SMS was the most secure thing ever...apparently that's not the case.

<comment><USER44> Nah, it's not the case [0] and hasn't really ever been. It's only now, due to its ubiquity with banking and other high-value sites that the incentives are there to abuse it.

As an aside, as someone who spends time between multiple different countries, SMS 2fa is a real pain to deal with.

0: [https://www.wired.com/2016/06/hey-stop-using-texts-two- facto...](https://www.wired.com/2016/06/hey-stop-using-texts-two-factor- authentication/)

</comment></comment><comment><USER45> This sounds a lot like attacks on the CAN buses within car systems. We can no longer afford to have zero-authentication, zero-authorization networks _anywhere_.

</comment><comment><USER46> Where and how do these people get access to the PSTN?

<comment><USER47> Well, the article explained that in this instance, it was via a foreign run telco.

So, essentially, to get in you just need to find the weakest telco connected to the main SS7 network and own them, and use their infra as a staging point.

</comment></comment><comment><USER48> It would be nice to have a WhatsApp API that could be use for 2FA, banks probably already have your number.

<comment><USER34> I would much prefer something with end to end crypto like Signal. Of course, that creates problems with key rotation, but perhaps that could trigger additional validation of some sort.

<comment><USER49> There already exists a much better solution for 2FA - the OATH protocol's TOTP and HOTP. It uses a local token to hash a counter or the current time with no need for anyone else to have your current token or communicate it directly in any means. These are already popularly implemented in Google Authenticator and Authy.

</comment></comment></comment><comment><USER50> These days what is a good way to authenticate people AND prevent them from making millions of accounts?

</comment><comment><USER34> Is there a good technical explanation of how SS7 works, technical docs, etc?

<comment><USER51> The article links to the Wikipedia page, which is a good starting point.

> Signalling System No. 7 (SS7) is a set of telephony signaling protocols > developed in 1975, which is used to set up and tear down most of the world's > public switched telephone network (PSTN) telephone calls. It also performs > number translation, local number portability, prepaid billing, Short Message > Service (SMS), and other mass market services.

[https://en.wikipedia.org/wiki/Signalling_System_No._7](https://en.wikipedia.org/wiki/Signalling_System_No._7)</comment></comment>


Reports Coming in of Big IBM Layoffs Underway in the U.S. - <AUTHOR> http://spectrum.ieee.org/view-from-the-valley/computing/it/reports-coming-in-of-mass-us-layoffs-underway-today-at-ibm <comment><USER2> During the dot-com bust of the early 2000s, I was working at a super-market. One of the guys stocking shelves was a software engineer laid off by a large company after 40 years. The management at Winn Dixie put him stacking boxes in the freezer section...since they knew he needed the money and wouldn't quit.

Maybe he deserved to get fired, maybe he didn't. The lesson to me that has been reinforced over my career in the tech sector is: don't ever expect a company to value you more than the next quarters earnings reports.

<comment><USER3> And learn how to job search. There's surely a better job that guy could have found.

<comment><USER4> I think you're forgetting what the early 2000's were like for software developers.

<comment><USER5> Had a friend that literally had no money for food in this time (2002, actually).

<comment><USER6> I entered the job market in 2002, it was absolutely brutal. It took a REALLY lucky set of circumstances to come together for me to find a job. That one job was it too. I was in Dallas while my wife was in PhD school and I had two interviews in 6 months.

</comment></comment></comment></comment></comment><comment><USER7> Meanwhile, IBM's CEO Ginny Rometty not only pocketed a salary of $1.6M in 2015, but also took a bonus of $4.6M. Not bad for 16 straight quarters of shrinking sales, evaporating profits and a falling stock price.

[http://www.latimes.com/business/hiltzik/la-fi-mh-ibm-s- ceo-w...](http://www.latimes.com/business/hiltzik/la-fi-mh-ibm-s-ceo-writes-a- new-chapter-20160129-column.html)

<comment><USER8> That doesn't sound like all that much for the CEO of an IBM-sized company.

<comment><USER9> 17.9 million total compensation for 2014, 19.9 for 2015

[http://www.businessinsider.com/ibm-ceo-ginni-rometty- gets-a-...](http://www.businessinsider.com/ibm-ceo-ginni-rometty-gets-a- raise-2015-1)

<comment><USER10> Only? Poor CEO.

</comment></comment></comment></comment><comment><USER11> Here's what I don't get... If you have any options at all, why stay at a company with sub-par technology that abuses their workers? They've been stuck in low 3 Glassdoor [0] range for a while. It's layoff after layoff as they slowly dismantle the company. Why stay? Geographic limitations? Narrow skillsets?

[0] [https://www.glassdoor.com/Reviews/IBM- Reviews-E354.htm#trend...](https://www.glassdoor.com/Reviews/IBM- Reviews-E354.htm#trends-overallRating)

<comment><USER12> Among other factors mentioned: employer-specific skillsets.

Technology jobs are _very_ highly specialised. And I'm not just speaking of computer tech.

I'm old enough to have seen several generations of obsoleted "gold tickets". Nuclear Engineering, future destroyed March 28, 1979. Freeway engineers, the freeway protests of the 1960s/1970s. Big Three auto manufacturers, dream destroyed with the first oil embargo, and sudden onslaught of more fuel efficient, less expensive, and _better quality_ imports from Japan and Germany. Petroleum engineers, dream destroyed as the oil market collapsed in the 1980s. Aerospace engineers, dream destroyed with the fall of the Soviet Union and redundancies in the military-industrial complex throughout NATO powers.

Travel agents, newspaper journalists, and Perl hackers are only more recent victims of the same levels of specialisation.

It's not that these people are _dumb_ , many were brilliant. But they're also laden with a _tremendous_ amount of arcane knowledge, that, unfortunately, _gets in the way_ of learning new skills.

It's been painfully obvious for a long time that, individual success stories notwithstanding, retraining and "reskilling" typically does very little to alleviate this.

Yes, _future_ generations get trained into new skills, some of which may still be germaine 4-8 years after they've completed schooling. But my observation is that job and skill cycles are iterating faster.

So that's a part of it.

Yes, there are other dimensions. Obligations, family ties, social ties, fears, the fact that the most mobile _do_ jump ship first, and more.

But really, it's quite crushing. You may not understand it now, but you almost certainly will, eventually.

<comment><USER13> Regarding skill sets. I have only been in software 12 years or so, but I noticed a type of tech 'gamble'. Basically, when you decided to learn something in tech you are basically gambling that the tech will last. In 2007 many faced a simple decision: AS3 or iOS. Supposed you chose AS3. Then, worked on it from 2009-2012, quite profitably. Currently the AS3 job outlook is horrific, and all that knowledge is a waste. Now, iOS people are skilled, wanted and are taking lead roles. (Oh yeah, now you are old). Want to learn GO? Be careful.

<comment><USER11> In up markets it's easy to say, "I'm a mobile developer" but in a down market, only iOS will do. You're right there are gambles.

I see 4 ways to mitigate this:

1 - Live somewhere that has many companies or be prepared to move.

2 - Keep in contact periodically with everyone who respects your work. (Don't make the "Hey it's been 5 years" call one where you're asking for a favor)

3 - Always keep learning.

4 - Communicate in your customer's language. If you are strictly an ActionScript expert, you are very narrowly pegged if you haven't learned iOS on the side. But if the buyers of technology view you as "A mobile expert who makes brands come alive across many devices" then you can survive technology switches.

4.5 - Help others before you need help.

In the grand scheme it's still better to be a laid off technology worker than a laid off steelworker. I still feel their pain though - it sucks to lose your job, especially if family is involved.

<comment><USER12> There's a professor, Economics at Harvard IIRC, who points out some telling characteristics of cities in this regard. Those with large numbers of smaller firms are _far_ more creative in the long run than those with small numbers of large ones. Specific contrast were NYC and its garment district vs. the large industrial cities of Pittsburgh (steel) and Detroit (autos). Ironically, it's the cities which most successfully employ division of labour and assembly-line techniques which are penalised most harshly.

Link in a sec....

Benjamin Chintz came up with the theory. Edward Glaeser is the lecturer.

[https://plus.google.com/104092656004159577193/posts/3uGHCweF...](https://plus.google.com/104092656004159577193/posts/3uGHCweFxEy)

[http://fixyt.com/watch?v=r3Mvz-Mg2_A](http://fixyt.com/watch?v=r3Mvz-Mg2_A)

</comment></comment></comment></comment></comment><comment><USER14> That is a good sign. It means the ship is slowly turning around. It sucks for the employees being laid off, no doubt. However they have to do this. There is no other way. They bet big on support and services in early 2000s. So they have lots of those employees. Could they all start to learn new things adapt to the new environment, yeah, some will but not everyone will.

Heck, if they didn't lay off people, they'd still have punch-card machine cleaners and even cheese slicer designers (they used to sell those way back in the day).

<comment><USER15> See, these types of comments are (again) why people have negative opinions towards silicon valley types.

You may be right, but a good sign for whom, exactly? For the people who lost their jobs? For shareholders? For fans of IBM the company?

Sure, yes, I agree that IBM probably has to shed people in order to stay competitive. However, it's not the fault of the people who are being affected by this, as by and large _they_ were not responsible for IBM's decision to get more and more into support and services.

(an aside: it's not clear those are the people being affected, I'm just responding to the parent comment)

Instead, I would say a better discussion is: why is it that when IBM made a bet that did not play out, that they have cut people's severance benefits signifcantly? Why is it that we treat this as a necessary evil, instead of something to be disappointed about? Why are we not holding IBM up to be responsible for the well-being of their workers?

I'm not arguing that this isn't something that IBM should have done. I _am_ arguing that we shouldn't talk about layoffs as a "good sign", and I think we should try to keep in mind the lives of the people affected.

<comment><USER16> Executive pay doesn't seem to follow the high-risk-high-reward scenario; they keep the "high reward" but see apparently none of the "high risk".

A much more balanced system would be something like, for each executive:

\- Your base pay is $51 million.

\- If you FAIL at your task, YOU OWE THE COMPANY $50 million.

\- If you succeed, you receive an extra $20 million. If you choose to split $15 million of this reward with employees in terms of stock however, your portion of the stock will be doubled.

That would put some skin in the game. And if a failing executive is forking over most of his millions back to the company, they could probably avoid quite a few layoffs. And if the executive doesn't fail and has a direct incentive to share success with employees, the workers would be even _more_ loyal to the cause.

<comment><USER17> _\- If you FAIL at your task, YOU OWE THE COMPANY $50 million._

No sane person would take a CEO job with that type of compensation clause. While the CEO bears responsibility, the world doesn't make it easy.

1\. Today's stock market doesn't reward long-term disruptive thinking that isn't guaranteed to be a sure bet. Heck, and there are no sure bets anyway. The stock market rewards profits here and now that also extrapolate to good future profit trends. Why screw up a good thing to grab something unproven? That's why BlackBerry's stock was so high as the iPhone was coming out. CEOs are indirectly pressured to not take risks. If they do and they fail, they deserve to pay a huge penalty? Exactly what could Blockbuster have done with all of its investments into real estate and retail employees to win against the Internet? There is no scenario where they could have won without decimating everything the company used to do.

2\. Black swan events are extremely unpredictable precisely because * nobody* sees them coming. If I ran an ice harvesting business, how could I have predicted the invention of freon? Once I learned about freon, how should I have responded with all of my investments made into labour and equipment for sawing ice out of frozen lakes? There aren't many situations where a win is easy if an entire industry gets destroyed because of some black swan event.

3\. All of the above goes double when the new CEO is supposed to lead a turnaround. They negotiate their parachutes first so that they can focus 100% of their energy on saving the company instead of worrying about themselves. It's why on airplanes they explain to you to put your own oxygen mask on first and then help others. You can't help others if you yourself are in trouble. Not to mention, turnarounds are not fun. They're also paid for stress and the need to make often uncomfortable decisions where they must play the villain.

<comment><USER4> > No sane person would take a CEO job with that type of compensation clause. > While the CEO bears responsibility, the world doesn't make it easy.

Wait, what? $51M salary, if I fail I give back $50M? I pocket at least $1M risk-free. Sign me up. That's more than most people make total throughout their entire lives.

<comment><USER17> Well, first, guess let's assume that's after-tax money. If that's before-tax, you end up losing money. Secondly, let's be honest. That's not really a $51M base salary. That's a $1M base salary with a $50M signing bonus that you can't spend. Because if it goes south and you need to pay the $50M back, you better not have spent it buying some nice house and other stuff. What sane person would risk the chance of going bankrupt to pay back a salary after they received the money? The smart decision is to just not touch the money until the clause is up. So put into perspective, it's not a $51M base salary at all.

Besides that, the issue is that these decisions aren't made in a vacuum, and the rewards are too short-term to make it really viable. The CEO will consider the offer and compare it to other opportunities out there. Free agents always have options if they're that good. It happens in sports, and it happens in business. So you have candidates comparing options, and those options drive up the price. If the price is driven up because options exist, any sane person would be a fool to not take the best price if the opportunity also fits right. "Sorry, your offer is the best offer, but I'm going to turn it down because this other company wants me to give back 98% of my salary if I fail. That's more my cup of tea." I don't deny there can be non-monetary factors that may be more important than money in these decisions. But I'm talking about an all- else-equal decision. Especially when it's a turnaround situation. Nobody wants a turnaround job unless they enjoy pain. The money is to compensate for that pain. Nortel had a really tough time finding its last couple of CEOs. In Canada, it was known as the CEO job that nobody wanted. How do you attract someone for that kind of job unless you guarantee them nice money?

Finally, the market does reward for the short-term. When IBM made the big switch to go all-in into services with the purchase of PwC Consulting, mass global hiring for labour-intensive work, and so on, they opened up a huge profit tap. Palmisano was hugely rewarded for growing this decade-long windfall. He parachuted into retirement with a very nice package. Never mind that the strategy worked for only a decade and created a big mess of financial misallocation that his successor would need to clean up. Should he have been able to predict that IT was changing and that this huge IT services workforce that he had hired would turn into a huge albatross that Rometty would need to slay in order to ensure IBM remains a relevant company? Maybe. Is it fair that Rometty is left dealing with the albatross while Palmisano is happily and richly retired? Yeah, Rometty was part of executing that services strategy as a senior executive before she became CEO (in fact, she was apparently the one responsible for integrating the PwC acquisition), but the question stands. Under the proposed scheme, why is Palmisano rewarded and Rometty not? Rometty is dealing with the fallout of a changing industry overshadowing what made perfect sense to Palmisano at the time. They were hit by technological trends that they didn't predict well.

Compensation is a complex subject, especially at the executive level.

<comment><USER4> That's a lot of words, but at the end of the day, if you offer me $1 million a year regardless of whether I succeed or fail, I'll be your CEO. IBM, please hit me up on LinkedIn. I'll save you a bundle.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I worked for IBM during the 80s at the height of IBM's power. It was the golden ticket. 400,000 employees and everyone was convinced it was going to hit $100B market cap. When I quit to form my own business, my 2nd line manager said "Why would anyone want to quit IBM?". Long time ago.

<comment><USER3> Crazy -- they could have almost been as big as Uber!

<comment><USER19> well, inflation.

<comment><USER20> Just for the record this would work out to about $220B in modern money.

</comment></comment></comment></comment><comment><USER21> There have been a couple folks on Facebook reporting that the H1-B folks they trained are staying while they are let go (ala Disney et al).

<comment><USER22> This is probably heresy. No one talks about the H-1B worker who got laid off - it is only about the ones who stay. Not sure if everyone in this thread is aware but if an H-1B worker is laid off, he/she gets only 30 days to find a new job. If he is not able to land a new gig within 30 days, they have to leave US for good. So I will not judge here based on a couple of FB comments.

<comment><USER23> There is actually no grace period. They can be legally picked up and put in deportation proceeding the minute they're fired and they start accruing illegal presence immediately.

<comment><USER24> What percentage of people that can be legally picked up get picked up?

<comment><USER25> They don't pick you up. You have to leave. However the company has to pay for your expenses.

But the USCIS generally approves petitions to change from one employer to the next if the gap between jobs is short. 30 days is acceptable

<comment><USER26> Does the new employer have to get a new H1-B from the lottery?

<comment><USER27> No, the H1B goes with the employee. They/you have to apply for a H1B transfer.

<comment><USER25> But the previous employer has to approve the transfert.

<comment><USER27> Absolutely not. The previous employer has no role at all and does not even have to know it happened - you could apply for a H1b transfer, get it approved, decide you don't want the new job and continue working for your old employer without them ever knowing you had looked around. Everyone I know has had the transfer completed before giving notice at the old job so that if it somehow is denied (eg new employer does not have a job that qualifies for a H1b), the current employer doesn't have to know you wanted to leave.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> I was at IBM from 1999 until my layoff in 2002. It was the 9th layoff for our group (Websphere). These layoffs suck and the stress nearly killed me. Back then the layoffs occurred after the dot com bubble burst. Lately I've been hearing lots of rumors from investors of wide spread belief of a tech bubble about to pop again. I'm guessing IBM is aware of this speculation and trying to be ahead of the game this go round.

They hate to see their stock price drop and I'm very glad I'm not in a situation like that anymore.

<comment><USER29> I can't believe they did this kind of thing in 1999 - 2002 for WebSphere. That is the era where Enterprise Java, XML, and SOAP took off and App Server was selling pretty hot.

Having said that, the 1999/2000 dotcom bust is different than if it was to happen today. In 1999/2000, open source wasn't as mature/diverse/strong as today so companies will buy commercial technology provided by SUN, Microsoft, IBM, Oracle.

These days, majority of the VC backed companies are using FOSS software with minimum Oracle/Microsoft software (probably the ERP/Finance/HR modules).

<comment><USER30> 2002 was really bad for any tech spending..

</comment></comment></comment><comment><USER25> It's interesting considering that IBM and IBM India filled 836[1] and 5420[2] LCAs for H-1B workers this year already. They are probably still hiring but are getting completely away from some aspect of the business.

[1] [http://data.jobsintech.io/companies/ibm- corporation](http://data.jobsintech.io/companies/ibm-corporation)

[2] [http://data.jobsintech.io/companies/ibm-india-private- limite...](http://data.jobsintech.io/companies/ibm-india-private-limited)

</comment><comment><USER31> That is awful. I wonder how much of this is cursed by the bet everything on IBM Watson strategy that I have read about. Are they laying off non-Watson staff?

<comment><USER32> It's the consequence of their bet everything on services approach while the global economy stalls out. Simultaneously they gutted the technology side of their company and vastly under-invested in R&D/innovation, instead choosing to focus on financial engineering to fake earnings per share growth.

They should have been at the forefront of cloud services, with a business as large as what AWS is. Instead, they spent their resources on buying back stock and lying to investors about the future. Their financial engineering was so good, they even snookered Warren Buffett, likely ultimately costing his shareholders billions in losses.

<comment><USER33> The stock market doesn't reward investing in R&D because you can't benefit from it in three months.

<comment><USER34> I see people repeat this but it's not true. The stock market heavily rewards investing in R&D if investors think the research is going somewhere. Biotech companies are a good example.

<comment><USER35> Tesla is another. Their expected future value is based almost exclusively on R&D, and the stock is massively overvalued in comparison to other manufacturers.

</comment></comment></comment></comment></comment><comment><USER36> IBM layoff rumors have been around for awhile:

[http://www.cringely.com/2015/01/26/ibm-right- gadfly/](http://www.cringely.com/2015/01/26/ibm-right-gadfly/)

I'm not sure what to make of this one.

<comment><USER37> I'm unsure on the actual sizing but that wasn't exactly a rumor, that's when I was laid off. This was after a furlough and narrowly avoiding another layoff less than a year into my employment.

Needless to say I'm glad I'm gone, even if it wasn't my choice.

<comment><USER38> How easy was it to find something new if you don't mind me asking?

</comment></comment></comment><comment><USER39> IBM borrowed a ton of money to buy back its stock to boost share prices. With interest rates set to go up, their interest payments will go up as well and they don't have a runaway hit product to makeup for interest and principal payments.

</comment><comment><USER40> Sort of relevant. Paul Graham tweet on IBM patent trolling: [https://twitter.com/paulg/status/705416252563419136](https://twitter.com/paulg/status/705416252563419136)

<comment><USER41> IBM and Microsoft were instrumental in stopping the abolishing of business method patents - and surprise surprise, now they use them to patent troll other companies:

[https://www.washingtonpost.com/news/the- switch/wp/2013/11/20...](https://www.washingtonpost.com/news/the- switch/wp/2013/11/20/software-patent-reform-just-died-in-the-house-thanks-to- ibm-and-microsoft/)

</comment></comment><comment><USER3> Anyone know how this affects their Watson division? They have a new SF office and they've been recruiting pretty heavily in the Bay Area.

<comment><USER42> Watson is a growth play. I would expect it to be the last group affected.

<comment><USER3> What do you base that on?

<comment><USER42> IBM's commitment to growing Cloud, Analytics, Mobile, Social, and Security (CAMMS). Investment into Watson branding and advertising. Maybe the feeling that I want to feel secure since I am in Watson group.

<comment><USER3> >Maybe the feeling that I want to feel secure since I am in Watson group.

Interesting, didn't realize! Very cool But that might not be a good reason to believe Watson is immune; reality doesn't work like that :-p

</comment></comment></comment></comment></comment><comment><USER43> No one ever got fired for choosing IBM, but apparently working for them is a different experience.

Seriously though, IBM is a dinosaur of a company that is quickly losing its merits. They cater to "old" large enterprises. They charge big licensing fees, and huge consulting rates.

Young "enterprises" that embrace open source software are finding it competitive advantage. We don't have to wait for IBM to fit us into their dev schedule (hint, we'll never make it in) because we can modify the product to do what we need.... and we don't have to keep paying for the privileged to use it every year.

If you think of IT as a cost center, you probably are an IBM customer, if you think of IT as a competitive advantage you're probably avoiding IBM...

</comment><comment><USER44> As technology gets better, it also gets cheaper. Probably exponentially so.

That's why we're going to see this trend accelerate within the industry during the next couple of years - layoffs, bankruptcies, etc.

There's just too much really really good technology out there.

A lot of the problems that tech people were hired to solve years ago, have now been solved by the improved software/hardware.

So it would be a good idea to start working on a really narrow skill set, which is something about human beings, before the AI takes over what'll be left of today's tech jobs.

</comment><comment><USER45> Does this mean it'd be waste of time to write up my "let me tell you about my favorite database" story as part of an application for a job at compose.io ? (serious question)

<comment><USER46> I just submitted mine. The job looks attractive for a techie who likes writing. Mind you, I'm not _entirely_ sure I like the idea of big blue sitting there in the background, metastasizing its woes everywhere.

</comment></comment><comment><USER47> I saw some reports that a lot of those affected are ones who've been there for a long time (= older workers), along with comments along the lines of "last year I'd have gotten 25 weeks severance - now I'm going to get 4."

Makes you wonder whether any of those folks will now decide that the reduced severance payment isn't worth giving up the opportunity to sue.

</comment><comment><USER48> Well more talent for the rest of us :) Stream is pretty close to the IBM offices and we're hiring in Boulder, CO: angel.co/stream

</comment><comment><USER49> or u can change your environment parameters and simply move to a country where the USD is 4-10x. Then u will have the extra bandwith of time to work / study on the next big idea/framework/rev stream. ive done this 10yrs ago. went from a cog ina a wheel at Aol to a serial entreprenuer. stay flexible.

<comment><USER50> That assumes a cash surplus for the individual. Where did you move?

</comment></comment><comment><USER51> IBM has a fortune of so many old technology they built and acquired over the years. However, these money making recipes are also the dead weight of IBM and stopping IBM from actually making a change. IBM at this point is already too big to fail, so IMO there is no other way but to spin off IBM into multiple companies.

</comment><comment><USER52> It seems untrue if an IBM spokesperson denied it. It would look really bad if their official spokesperson denied it and then the next day had to say the opposite.

<comment><USER53> Didn't that happen with Marissa Mayer's accidental leak and cover-up of the Yahoo layoffs a week early not too long ago?

[http://www.breitbart.com/tech/2016/01/19/marissa-mayer- taunt...](http://www.breitbart.com/tech/2016/01/19/marissa-mayer-taunts-her- employees/)

</comment></comment><comment><USER54> Sad to see one of the giants slowly dieing that you grew up with.... Hard to change the direction of a major company

</comment><comment><USER55> What I don't get is why anyone would accept an offer from them.

</comment><comment><USER56> What a dastardly fellow! How dare the elected officer run his company as he sees fit

WHY ALL THE DOWNVOTES!!?!?!?!

<comment><USER57> She.

<comment><USER56> Damn English and its lack of gender non-specific pronouns!

Seriously, though... what is the implication that I am missing? What is the point of bringing up the CEO's pay? Should it be government mandated, is that what you all believe?

<comment><USER58> Singular "they" is gender-neutral and grammatically correct, I don't know why more people don't use it.

<comment><USER59> People probably don't use it because at every English school in non English- speaking countries, they teach you that "they" is for plural only. I had personally never heard until recently that "they" could be singular too. It also really sounds weird to a French like me.

<comment><USER60> They also taught that "they" is plural in American schools up until the last decade or so.

I remember getting points off of papers for misusing "they" in a singular context.

So it sounds weird to me too. We were always taught that "he" is a gender- neutral singular as needed.

<comment><USER61> When were you taught to use "he" as a gender neutral pronoun on English? I've never heard anyone in an educational position advocate that.

I was taught to use the horribly awkward "he or she" (his or hers, etc) or alternatively to restructure to actually refer to plural. e.g. Instead of "A software engineer should test his code" use "Software engineers should test their code".

I'm glad the "neutral they" is catching on.</comment></comment></comment></comment></comment></comment></comment>


Earth from space, captured by a digital camera tied to a balloon - <AUTHOR> http://www.dailymail.co.uk/sciencetech/article-1260323/British-aerospace-enthusiast-takes-NASA-style-photographs-using-helium-balloon-pocket-camera.html

<comment><USER2> I used to work with a couple of guys who got HAM licenses specifically to build one of these. I think their design involved remotely releasing the camera, rather than waiting for the balloon to burst, but the broad strokes are the same. Unfortunately, the project ended up being all talk, but it made for some fantastic geeking over lunch.</comment>


Show HN: My TV show Chrome extension now works as a web app too - <AUTHOR> http://DuckieTV.github.io/DuckieTV/

<comment><USER2> Trakt syncing would be great for this. [http://trakt.tv/api- docs](http://trakt.tv/api-docs) :)</comment>


Xiaomi Mi4 review: China's iPhone killer is unoriginal but amazing - <AUTHOR> http://arstechnica.com/gadgets/2014/08/xiaomi-mi4-review-chinas-iphone-killer-is-unoriginal-but-amazing/#image-6

<comment><USER2> I believe that it's enough if it's amazing. Most people hardly care about authenticity, unless the company makes authenticity look cool.</comment>


Ask HN: InnoDb vs MyISAM? - <AUTHOR>

I'm a newcomer here so I apologize if this topic has been beaten to death and then some; any useful links would be appreciated. I've been using MyISAM for a while but now have seen the light of InnoDB. I've read a little that it's slow and doesn't play well with third party technology just because it's newer. I'm just wondering if there are any drawbacks to InnoDB encountered firsthand in the trenches (for your basic, run-of-the-mill applications) before I decide to switch to this engine.
The prospect of transactions make me drool feverishly for InnoDB. I hope I'm not alone.
Thanks. <comment><USER2> Usually you want to default to InnoDB unless you know for sure that the table's usage pattern fits MyISAM's strengths. Those include read-only tables, read-infrequently tables (like configuration data), and logging tables, where you're appending a bunch of rows at once and rarely (if ever) need to mutate existing data.

If you want full-text search, you're usually better off with something like Solr/Lucene or Google Custom Search Engines than MyISAM's built-in full text indexing.

The problem with MyISAM is that if you ever get significant write-load, the table-level locking will kill you. InnoDB uses row-level locking, which scales much better under heavy writes. Writes are far more likely to be a bottleneck than reads, so the faster read speed of MyISAM is rarely a boon in practice.

</comment><comment><USER3> [http://www.google.com.au/search?hl=en&source=hp&q=in...](http://www.google.com.au/search?hl=en&source=hp&q=innodb+vs+MyISAM&btnG=Google+Search)

In a nutshell, it depends on what you are using the database for, you may even consider something outside of a relational database if you don't need SQL and relational structure to your data. The biggest difference is the lack of granular transactions (MyISAM). This will kill your application if you have concurrent writes to a MyISAM table.

We have clients who mix MyISAM and innodb, in their case, they need to store lots of data but want it as small as possible, but still able to be accessed via SQL queries. So it is MyISAM for all tables which are read only and Innodb for the current data which needs concurrency for updates.

<comment><AUTHOR> Thanks. I do a lot of inserts and updates, so yeah, I'm really feeling the burn right now.

</comment></comment><comment><USER4> If you need to do fulltext searches, MyISAM is your only choice. If you switch to InnoDB, you might have to split some tables and rewrite some code to use both engines.

<comment><USER5> Note that the full-text modes only support prefix searching. For postfix you could either reverse the field your looking for (redundant data in your table), or use something like sphinx; which nowadays has great integration with MySQL.</comment></comment>


Ask HN: 36 years old, should I get a CS degree? - <AUTHOR> I'm 36, I've been working in tech for 6 years now and I'm doing ok for myself. I'm genuinely passionate about computer science and I'm thinking about getting a degree. The main reason I want to do this  is for the knowledge - I'm having a hard time picking up everything I want on my own (data structures / algorithms / compilers / etc). I've learned about these things, but not to the level of completion I'd like. Also, I'm wondering if it will help my career at this stage. I'm "senior" level at my company and I'm the most competent developer on my team. Any thoughts? Finally, I wouldn't mind recommendations for any good online CS programs that are credible / worth checking out. <comment><USER2> I went back to university (I'm in Europe, where tuition is affordable) at age 35, after working for 12 years in IT in several roles. I did it because I felt I missed the theoretical foundations to progress further than what I had learned by myself. The advantage of getting a degree is that you have a more or less coherent program to follow, with potentially things you wouldn't care to learn by yourself. I had courses on, amongst others, Operating Systems, Machine learning, networking foundations, logic, software engineering, programming paradigms, algorithms and computational complexity and more. I wouldn't have learnt all this by myself.

I did it out of personal interest, I enjoyed it, and it was totally worth it, even though it was exhausting combining it with my (downsized) freelance activities. After that I went bask to my professional activities thinking it didn't have impact on my career after all. But one year later I got a proposal to do some research at the university with a professor of which I had followed a course. And now, I'm working at a spin-off of that university. In dramatically change my career path, even though it wasn't the goal.

Personally, it was the thing to do and I have no regret. But that depends of course on your situation, motivation, interest, opportunities, expectations. I hope you make the right choice!

<comment><AUTHOR> Thanks for sharing your story

</comment></comment><comment><USER3> If you're already established I'd say it's probably not worth it. Learn the things you want to learn through MOOC's. The real value in a degree is in getting the first job (not including connections you might get through higher- end universities)- if you've already reached that point it likely isn't worth the investment.</comment>


Skype: We Have Not Been Banned in China - <AUTHOR> http://mashable.com/2010/12/30/china-skype-ban/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Mashable+%28Mashable%29&utm_content=Google+Feedfetcher <comment><USER2> I live in China and use Skype often: Skype-to-skype calls work no problem, but Skype-to-phone calls are indeed blocked. Skype-to-phone calls work on the first second or so, and then the call sounds like "scrambled" (for a lack of better word to describe), very noisy so you cannot hear the other side. I make Skype-to-phone calls using a VPN, which works just fine.

You can make Skype-to-phone calls with Tom-Skype (the Chinese Skype partner), but you need to buy credits through their system.

</comment><comment> steve-howard If the People's Daily is an official government newspaper, how is the ban "rumored"?

</comment><comment><USER3> In case anyone was wondering, Ebay's partnership with Tom-Skype is simply to give the Chinese government a back door through Skype's security. If you are using Skype in China, DO NOT use Tom-Skype. Find a way to get the real thing.

An old blog post of mine:

[http://blog.stacktrace.com/2008/10/02/chinese-monitor-tom- sk...](http://blog.stacktrace.com/2008/10/02/chinese-monitor-tom-skype-chat/)</comment>


When 9 Trillion dollars from Fed Reserve goes missing what can we do about it? - <AUTHOR> http://thechangelog.com/post/2596290871/opengovernment-empower-individuals-and-organizations

<comment><USER2> For starters, it didn't go missing and for the most part wasn't spent or even actually exist. Loan guarantees and overnight loans are a whole different ball game. If provide a $1B overnight loan for you 10 times, I haven't spent $10B dollars. Same if I had guaranteed $100B. Save for a default, I haven't spent anything (actually I made money). The reason why the Fed didn't announce which banks were in trouble is stunningly obvious, which is why outside of internet conspiracy circles this video isn't big news.

<comment><USER3> As I understand, when the fed increases a bank's lending window, it is not actually giving more money to the bank. It is akin to increasing the credit limit of the bank. If the bank actually does borrow up to the increased limit, it pays interest on that loan.

<comment><USER2> That jives with what I've read as well. Also a number is incremented in the database, no currency is actually printed. So when it's returned no currency has to be taken out of supply.

For whatever reason, overnight loans are standard which grossly inflates totals over a period of time (I think it's just conspiracy theorists that use totals like that as they count on people not knowing it's an overnight loan that has been returned). A billion dollars a night for a year is $365B. It doesn't take long at all with a handful of large accounts before you hit $9T.

</comment></comment></comment><comment><USER4> Wipe up our worthless tears because we gave these idiots way too much power in the first place.

</comment><comment><USER5> I've never understood 'gone missing'. Wherever the money was last is where is it right? These are numbers, not poofs of air.

</comment><comment><USER6> Someone knows where the money went it just wasn't the woman in that video. She oversees the lending to the regional reserve banks who loan out money. There is no possible way she could know who that money goes to.

</comment><comment><USER7> OpenGovernment is a great idea and I wish the team building it all of the best. OpenGovernment will be the only competitor so far to a startup I've been working on the past 3 years: <http://www.openpoll.us>. It's exciting to see other people prove your idea is a good one. That being said, I think a release of OpenGovernment with only 5 states is a little premature.(I'm waiting to have all states complete before releasing my MVP.) I am very interested in seeing what they come up with.

<comment><USER8> If the site can provide value to people interested in the 5 launch states, why is it premature for them to release a beta?

<comment><USER7> If you heard of a website launch with partial data without your state, how often would you go back to check if your state was added? My opinion is that users would initially see the site, and not visit again for a few months. You have a larger target-able market by waiting.

The truth is they have a lot more than 5 states in github. They could have probably gotten away with launching 20 or 25 states.

</comment></comment></comment><comment><USER9> CDN Cache: [http://thechangelog.com/post/2596290871/opengovernment- empow...](http://thechangelog.com/post/2596290871/opengovernment-empower- individuals-and-organizations?coral-no-serve)

I was thinking of hacking something like this for the UK legislature. Guess this goes on The List.

<comment><USER10> you might be interested in the underlying scraper project we run @ <http://openstates.sunlightlabs.com> \- this is the first step to getting all of the data so it can be used by OpenGovernment and other sites

<comment><USER9> Thanks. I have to warn you though, The List is pretty long.

</comment></comment></comment><comment><USER11> Vote for Ron Paul?

</comment><comment><USER12> Flagged as hysterical BS.

</comment><comment><USER13> Well, what did you expect would happen? It's the same buddies sitting at the Fed, the SEC, Goldman Sachs. There's no real oversight. Why wouldn't they abuse it? There's a ton of money to be stolen, and nobody is watching.

<comment><AUTHOR> Exactly. All the more reason that the efforts of Participatory Politics Foundation and Sunlight Foundation with OpenGovernment are needed. Even better, it's open source, so we can all dig in and do our part to help better prevent this madness from happening right under our noses.

We also plan to have them on a future podcast episode. Maybe later this month or early next after they launch the beta.

</comment></comment><comment><USER14> Create a currency that cant be stolen/diluted without breaking 1024 bit encryption and a password. Entities like the federal reserve can just print money out of thin air, diluting my past hard work.

It shouldn't be too hard to create a system of person to person wealth transfer utilizing thumb drives and laptops that exchange receipts of units of human labor that can't be diluted by simply making more human labor receipts.

Of course, whoever champions this kind of thing will disappear in the night along with their family. Imagine working a days labor, and being able to redeem that 100 years later in full. Something like this would have to begin operation after a complete revolution, and would have to earn a place next to the right to free speech. The basic right of encryption in data and currency.

<comment><USER15> First, An ordinary thumb drive wouldn't enough for such a system. Encryption doesn't telepathy. You copy data from Bob. You and Bob show up at the bank with the same data. What is the bank supposed to do? Encryption-based money systems require either a smart card or a central repository.

But even more, just assume that a "wealth transfer system" could be created by a bunch of random individuals who create N unduplicable units of value. Why should I accept particular units of value. I'd be better off doing the same thing myself - then it would be _mine_.

I think the lack of understanding of money-dynamics in these schemes comes from people reacting morally to it rather than rationally.

<comment><USER14> You say it can't be done!

1\. Create 100 trillion units of wealth in some kind of software system, generate keys with a strong algorithm.

2\. Completely destroy the private key, give everyone the public key. So everyone can find out if a key is one of "the original" wealth units, and not one created after the fact by nefarious entities.

3\. Give everybody in the world, equally, these 100 trillion units.

4\. Let them exchange them for goods and services. If you want more of them, you have to acquire it from someone who has them.

<comment><USER15> A. _If a "unit of wealth" is just a number, why can't I give ten identical copies of this number to ten people?_ The way encrypted exchange has been envisioned and really how it has to work is that the values are kept on smartcards and smartcard's possessors don't know all the information on the card and can't change that information at will. But a smartcard system is clearly far from the "utopia" you envision.

B. Assuming the impossibility that an encypted number would be enough, What "algorithm" could prove you've the destroyed the private key anyway?

C. Why couldn't someone else do the same thing and so why should we work with Bob's system when Mary's seems just as appealing? If Bob is German and Mary is French, it's logical to expect the German's to go with Bob's system and the French to go with Mary's. If human beings suddenly became massively more cooperative than they are today, a system of this sort might conceivably be organized - but in that case why bother since any money inherently adverserial. If everyone in the world is cooperating, they can just organize society in that fashion. If not, we'll muddle along with our current currency system as we muddle along with everything else.

D. An economy with only a fixed amount of value units actually doesn't work that well. Think about it. There is more and more valuable stuff produced each day for a larger and larger population. So with a fixed amount of value units, those units become more valuable each day. That is call "deflation". It creates a _disincentive_ to buy stuff since your money will buy more tomorrow. That tends to cripple economic activity in the infamous "deflationary spiral". And, yes, the Gold standard did have this problem. The economy was not well served in the days when people actually carried gold (bank deposits representing are something different).

\-- So yes indeed, seven ways from Sunday it can't be done and probably shouldn't be done. What could be done is returning to the gold standard but that still shouldn't be done (and certainly won't be done since it would require the acquiescence of the world's governments who stand to lose by it, not that many people would win from it).

</comment></comment></comment></comment><comment><USER16> Reminds me of that scene at the end of the Bourne Identity where they're at the hearing and question Treadstone, write it off as a loss, and move on.

</comment><comment><USER17> ... wait for Keynesians and Krugmanites to tell us that this is good for the economy?

</comment><comment><USER18> As much as I would love for OpenGovernment to succeed. You guys have got NO chance, your just standard average Joes. You could be the President's son and it still wouldn't make a difference. There are so many layers of corruption, collusion, old boys networks and John McCain's that you will never change how the government works.

Not to mention that the Federal reserve is a completely different beast. You would literally have to physically destroy the government before you have any chance of change.

<comment><USER19> If everyone thought the way you do, we'd still be paying taxes to the King.

<comment><USER18> Errr. I don't really see how your point is relevant. I guess you thought I meant "I didn't want change", or that "there's no point in trying because it will never happen".

What I actually said, and perhaps I should have been clearer was: there is not a single thing any group of people (we), any size, no matter of what "civillian" importance you are can do to change a single thing about how your government operates, or how it regulates its money supply.

Least of all, an online community of any type, _especially_ one thats campaigning for data. I know this is going to read like I'm a dick, but I'm not. I just know there is one thing I am certain of: the world if fu __ __* corrupt. AWFULLY so.

If the government official in the video, who was hired by Obama to oversee the fed, _doesn't_ have access to the data, and won't answer that/those questions - then who does? Nobody within the organisation we call "the government".

Moreso, if they do have the data and they just aren't sharing it, then its double bull __ __because that in my book, is a bit hooky.

Edit: so I suppose my conclusion is, given that the government either doesn't have, or isn't sharing the data. How are you peaceful protestors going to get this data out of them? Assuming of course if the government doesn't have the data your battling a faceless, nameless, infinitely wealthy enemy. Or that if its the government, well, they have an army.

So now, you can see why I think a campaign for data is borderline ridiculous. But very commendable given I'm not doing a single thing to change things. That goes without saying.

Edit 2: It all comes down to incentives, and I would be surprised if anybody could fathom and incentive that would make them hand over all the money, all the power, all the land and all the fun in the world. Which is this campaigns ultimate aim, through uncovering bad behaviour in the data. Unless of course you have a jar of flying powder, or eternal life juice.

<comment><USER18> Very relevant: [http://crushingbastards.org/blog/2011/01/04/i-am-a-us-air- fo...](http://crushingbastards.org/blog/2011/01/04/i-am-a-us-air-force- intelligence-veteran-of-the-war-in-afghanistan-and-i-support-wikileaks/)</comment></comment></comment></comment>


How Capicola Became Gabagool – The Italian New Jersey Accent, Explained - <AUTHOR> http://www.atlasobscura.com/articles/how-capicola-became-gabagool-the-italian-new-jersey-accent-explained <comment><USER2> I'm an Italian living in Italy. AFAIK the article is correct about the history of languages here.

I never heard about capicola. I googled for it and discovered that it's called capocollo here, a word I heard but can't identify. It's more commonly known as coppa which is what I've been calling it all my life. It's good :-)

Coppa is a cup (the one you win at competitions) but it's also used with other words to denote something being above something else (southern Italy usage and I'm from the north). And that's probably how it relates to capocollo, which is a part of the animal around the neck.

You can glimpse the Italian Wikipedia page about it [https://it.m.wikipedia.org/wiki/Coppa_(salume)](https://it.m.wikipedia.org/wiki/Coppa_\(salume\))

</comment><comment><USER3> Italian living in Finland here. I second the theories presented in this article. I'm also recognising in my family the progressive mingling of Italian words with the totally unrelated structures of the weird ugro-finnish language.

>For whatever reason, foods and curse words linger longer in a disrupted language. My take on this is that very private situations (family dinners, arguments) create a humorous or angry context that stimulates and reinforces the use of this words. Regarding mashups: I can mention the italian polpetta (meatball) becoming "polpettat" (singular) and "polpetteja" (plural)

</comment><comment><USER4> There are a couple of things that are not very precise in the article. First of all the history of modern Italian is not quite right: standard Italian actually comes more from the dialects of the center, especially Tuscan and there is literature in standard Italian that far predates the unification of Italy (for example the 14th century Petrarca is still perfectly intelligible by contemporary high school students.

The other thing that is overly simplified is that taxes from the wealthier north are really not the cause (or at least not the single cause) of the emigration from the south. Many regions were really poor and not yet industrialized at the turn of the century and not only in the south (Friuli in the northeast was also very poor). I think the main cause of emigration is really lack of employment opportunities and the destinations of these emigrants have been many: there are huge Italian communities in Argentina, Brazil, Germany and Belgium for example.

<comment><USER5> "During unification, the northern Italian powers decided that having a country that speaks about a dozen different languages would pose a bit of a challenge to their efforts, so they picked one and called it "Standard Italian" and made everyone learn it. _The one that they picked was Tuscan_ , and they probably picked it because it was the language of Dante, the most famous Italian writer."

The article was specifically about how the New Jersey Italian American accent came to be, so including details about Southern Italian emigration to South America and the rest of Europe probably wasn't necessary.

<comment><USER4> But also:

"But this gets weird, because most Italian-Americans can trace their immigrant ancestors back to that time between 1861 and World War I, when the vast majority of "Italians," such as Italy even existed at the time, wouldn't have spoken the same language at all, and hardly any of them would be speaking the northern Italian dialect that would eventually become Standard Italian."

</comment></comment></comment><comment> r-w I would guess that the lingering of food and curse words is maintained by memory formation caused by sense association.</comment>


Ask HN: Tools for Managing Secret in Production Scale? - <AUTHOR> Hi all,
I'm looking for centralized tools for managing secrets for my engineering team right now. Is there any recommended tools from your experience using them in production?
For example like Vault (Hashicorp product).
Thanks <comment><USER2> My company uses AWS and started before Parameter Store and Secrets Manager and we try to not run our own infrastructure where possible because we are very small and don't have a big ops team.

We simply store our secrets in a KMS-encrypted file in S3. When containers start up, they have a bootstrap script that deserializes it and fills it with the appropriate variables.

At some point though I think we will look at Parameter Store and Secrets Manager. If I were starting this company again, that's where I'd look first.

Many will suggest Vault, which I hear is a fine product. However, it's one more thing that can fail, and this is a pretty big thing because if you can't access passwords and security tokens, most systems will totally stop working. If you are using a public cloud environment, I would look at tools native to that environment that are managed for you.

</comment><comment><USER3> Not affiliated to the below company. I came across it a few days back. Have not used it either. Just passing it on hoping it will help.

[https://www.envkey.com/](https://www.envkey.com/) helps manage your team's secrets and configuration.

<comment><USER4> Founder of EnvKey here - thanks for the mention!

EnvKey takes a minimalistic and developer-friendly approach to managing configuration and secrets. It keeps secrets safe while also making it extremely easy to make them available wherever you need them, edit them, and grant/revoke access.

With EnvKey, you can just set a single environment variable (ENVKEY=...) and have any dev machine or server fully configured in seconds. It's a lot simpler and (imho) more pleasant to work with than alternatives.

I'm happy to answer questions about it here if anyone has them!

<comment><AUTHOR> But maybe will be good if you can provide the difference between envkey and vault or some similar stuff like AWS Parameter Store? Especially in reliability side

</comment></comment></comment><comment><USER5> I think you just answered your own question. As a bonus Red Hat just released a Vault operator so that you can run it on Kubernetes with minimal hassle.

[https://github.com/coreos/vault-operator](https://github.com/coreos/vault- operator)

<comment><AUTHOR> Interesting, thanks! How is your experience using that in production?

</comment></comment><comment><USER6> [https://github.com/fugue/credstash](https://github.com/fugue/credstash)

[https://aws.amazon.com/secrets-manager/](https://aws.amazon.com/secrets- manager/)

<comment><AUTHOR> Thanks! How is your experience using that in production?

<comment><USER6> Unfortunately I haven't gotten a chance to use them in Prod. We used a homegrown process at my last company and we use Vault at my current company (which I haven't even used directly yet).

I mostly like credstash because I independently arrived at the same design for securing secrets before I knew it existed. And many of my security minded friends are excited to try out the AWS service.

</comment></comment></comment><comment><USER7> CyberArk</comment>


Wall Street Aristocracy Got $1.2T in Loans - Bloomberg - <AUTHOR> http://www.bloomberg.com/news/2011-08-21/wall-street-aristocracy-got-1-2-trillion-in-fed-s-secret-loans.html <comment><USER2> It seems like a huge house of cards, scary.</comment>


Square Cashtags - <AUTHOR> https://squareup.com/news/introducing-cashtags <comment><USER2> The link at the bottom of the article links to

"[https://www.google.com/url?q=https%3A%2F%2Fcash.me&sa=D&sntz...](https://www.google.com/url?q=https%3A%2F%2Fcash.me&sa=D&sntz=1&usg=AFQjCNHzsGmChiMYODY7BtVVzX4g_E4p0w")

Does anyone know why it is done? To boost google rankings?

<comment><USER3> Every link on the page goes through Google. I have no idea if it boosts rankings or if an intern was just too lazy to copy the right URLs, but it looks pretty sketchy...

</comment></comment><comment><USER4> The idea of sending money so simple is catchy. I can't wait to use this in Europe.

<comment><USER2> Can't you simply use sepa transfers?

Compared to the US, this is so easy. Enter the account number (22 digits) at your banks site and the reciever get's the money the next day.

<comment><USER4> "get's the money the next day", many banks requires 24 hours before you can make a transfer to a new account number, and transfer time is usually 48 hours than 24.

<comment><USER5> Where in Europe are you located? I cannot recall a transfer that took longer than 24 hours.

SEPA works surprisingly well, even for an initiative started by the European Union ;)</comment></comment></comment></comment>


Deep sea squid communicate by glowing like e-readers - <AUTHOR> https://www.npr.org/2020/04/17/820707276/deep-sea-squid-communicate-by-glowing-like-e-readers <comment><USER2> Children of Ruin, by Adrian Tchaikovsky, explores the concept of squid communication. I'm about half way through, and enjoying it!

[https://www.goodreads.com/book/show/40376072-children-of- rui...](https://www.goodreads.com/book/show/40376072-children-of-ruin)

<comment><USER3> I recall an Arthur C Clarke story (can't remember if it was a short or a novel) that touched on the same idea. In the story, the squid's imaging abilities were very advanced, almost TV like.

<comment><USER4> There's quite a bit of light/color-based communication from/between "octospiders" in his Rendezvous with Rama series. Also depicted in (mediocre) computer game form!

[https://www.youtube.com/watch?v=2B5Rsy12XBY](https://www.youtube.com/watch?v=2B5Rsy12XBY)

<comment><USER5> Kind of disappointing to see someone else's drawing of the octospiders. Not very much like what i had in mind at all.

</comment></comment></comment></comment><comment><USER6> > "Right now, what blows my mind is there's probably squid talking to each > other in the deep ocean and they're probably sharing all sorts of cool > information," said Ben Burford, a graduate student at Stanford University.

Squid: it's ... uh, Linux ISOs.

<comment><USER7> Maybe they are proxying web traffic...

</comment></comment><comment><USER8> An E-reader seems like a bad analogy given they're usually reflective rather transmissive displays. Wouldn't any backlit display technology (such as most computer monitors) make for a better example?

<comment><USER9> Is that true of modern e-readers? My original Kindle was a gray background on gray text dark mess, but Kindle White uses LEDs at the screen edge directed through a light guide to come from behind the text. Not that most people don't just use the Kindle app on an OLED or LCD screen smartphone nowadays anyway. Considering e-readers unlighted at this point would be like considering handheld games unlighted because the original Gameboy wasn't.

<comment><USER10> > through a light guide to come from behind the text.

What does that even mean? The nature and the underlying physics of the light hitting the cornea of your eye doesn't change or depend on how or where the rays of light originated. I know a lot of e-reader folks try and upsell 'behind the text' but that's not how it works.

Light always has to reflect or radiate off of a surface from the front.

<comment><USER11> >Light always has to reflect or radiate off of a surface from the front.

And in the case of the Kindle, the light _reflects_ off of the pigment layer from above, rather than _radiating_ directly from a light source behind the pigment layer. GP's comment just contains what amounts to a typo. The light guide is in front of the text, not behind it.

</comment></comment></comment></comment><comment><USER12> E-readers glow like squids. _Priority_ people, sheesh.

Life is nanotech.

\- - - -

Total tangent: When that movie "Dazed and Confused" came out the character Slater looked exactly like me. I wore my hair long and had that same cap on backwards, like the exact same color and pattern. I didn't mind so much being exposed as a walking stereotype, but everybody started saying, "Hey! You look just like Slater!" and that was really annoying because, no, _Slater looks like me_ , I was here first. LOL I got a haircut and a different hat. LOL

But yeah, squids are cool.

[https://duckduckgo.com/?q=Dazed+and+Confused+Slater&atb=v110...](https://duckduckgo.com/?q=Dazed+and+Confused+Slater&atb=v110-1&ia=images&iax=images)

</comment><comment><USER13> The year is 2030.

Amazon has announced it's new consumer biotech product: the Squindle eReader, the only e-reader that works underwater and requires no battery.

In fact, it only works when kept immersed in pressurized salt water and fed a steady diet of mollusks.

</comment><comment><USER14> This is a phenomena and wonder if they are afraid of humans and the damage we are doing to the oceans with those underground cable lines..we love the internet. Those lines run under the ocean floor and studies are scarce on the impact cable lines are having on the ocean floor. Just commenting

</comment><comment><USER15> Sounds like naturally occurring case of optogenetics - "Optogenetics is a technique to introduce light-sensitive ion channels to neurons, allowing them to be switched on or off, sometimes it is also reffed to optical monitoring of neuronal activity".

</comment><comment><USER16> Makes sense that this would evolve naturally. At that depth only the groups that communicated this way could coordinate and survive

</comment><comment><USER17> I wonder how evolution worked here. How did squid decide to evolve to glowing and then using it for communication.

<comment><USER18> I'm guessing the most glowing ones could find each other and mate.

Not mating is really bad for your evolutionary prospects.

</comment></comment><comment><USER19> Is that how E-Readers communicate?

<comment><USER20> The deep sea versions, yes.</comment></comment>


Ask HN: What should I do with my domain? [NowReading.com] - <AUTHOR>

I have this domain [NowReading.com] for many years now but never got around to building anything on it. I was looking for some ideas on what I can build on it.<p>I'm good at web development and iOS development which I can use to build something. <comment><USER2> Two word domains are a dime a dozen. You should build something that would sell, and not base it on the domain name you owe.

<comment><AUTHOR> Thanks! :-)</comment></comment>


Libtlssep: A TLS library with built-in privilege separation protections - <AUTHOR> https://www.flyn.org/projects/libtlssep/

<comment><USER2> How does this compare/contrast to the privilege separation that OpenBSD is working on?

edit: I tried to port this to FreeBSD but it uses the linux-only syscall signalfd</comment>


Bright - a free collection of 148 icons - <AUTHOR> http://www.iconeden.com/icon/bright-free-stock-iconset.html

<comment><USER2> It's not a very cohesive set: the perspectives are all over the place and there are like four different visual styles being used.

Some icons are shoddy and I don't like the harsh jewel aesthetic used for a lot of them.

I wouldn't recommend using these.

<comment><USER3> I agree. It's a shame. The gesture should be applauded, but the icons really are not very useable. The Silk icon set is much better.

</comment></comment><comment><USER4> Pretty, and a worthy addition to the list for side projects and quick prototyping for things where I don't have budget yet.

For projects for actual business (your employers' or your own), I suggest investing in getting design a little more specific to the actual customers' needs than most stock free icon sets. This one, for example, would be grossly inappropriate for my non-technical customers, who are not yet up with the reflections on top of reflections Web 2.0 aesthetic. (I got my icons for them from <http://www.icons-icons.com> two years ago on sale for $25 and its probably the best $25 I ever spent in my life.)

</comment><comment><USER5> New rule of iconography: Never, ever use an icon of a guitar for anything that doesn't specifically have to do with the guitar. Guitar-fingering-tutorial app? OK, you can use the guitar icon. General music recording/composition/mixing/production app? NO GUITAR.

</comment><comment><USER6> They suck.

<comment><USER7> You should demand your money back.</comment></comment>