iMessage for Android - <AUTHOR> https://play.google.com/store/apps/details?id=com.huluwa.imessage <comment><USER2> I believe that this application actually does connect to Apple's servers from the phone, but it doesn't then interpret the protocol on the device. Instead, it ferries the data to the third-party developer's server, parses everything remotely, figures out what to do with the data, and sends everything back to the client decoded along with responses to send back to Apple.

Doing it this way means that Apple can't just block them by IP address, it avoids them having to distribute their "secret sauce" (understanding the iMessage protocol is clearly very valuable), and it potentially allows them to use actual Apple code on their servers (in case they haven't spent the time to fully break the fairplay obfuscation that Apple is using for some of their keys).

Here's what I'm seeing: every time I send it a message, I get a packet from Apple, and then immediately the app sends a packet of almost exactly the same size to 188.8.131.52 (which is listed in this application's APK as "ServerIp"). It then gets back two packets from the Chinese server, the first of which I'm presuming is the decoded result and the second packet being a response to send Apple (as immediately a packet is sent back to Apple with about the same size).

Additionally, if you read the reviews of this application, the author is making some very weird responses to people with login issues: he's asking for their Apple ID, as apparently that's enough for him to debug their issue. That shouldn't be possible if the application is just directly talking to Apple the entire time.

[edit: The more I stare at this, the more confident I am in this analysis; specifically, the packets that are "about" and "almost exactly" the same size are very deterministic: the packets to/from Apple are precisely 7 bytes larger than the corresponding packets to/from the Chinese server.]

[edit: It also occurred to me to verify the other direction: in fact, if you go to send a message, first the client sends something to the developer's server, which then returns a packet which, along with again the exactly 7 extra bytes, is sent to Apple's server.]

<comment><USER3> Not that this needs pointing out, but this also means the mysterious Chinese server also gets to read all your iMessages. This is some kind of quasi-MITM, and for that alone Apple would be in the right to block this kind of thing from ever working.

<comment><USER4> Why is it any worse than only Apple server reading all you messages? You trust one third party with proven track record of spying on its customers, but somehow you are upset that someone else also has access to you messages, thought that someone didn't (yet) do anything wrong with them.

If you are American, you don't have to fear from Chinese espionage, and US agencies already have your data. If you are European, it's more or less the same. If you are from China, well, at least you can prove that you are not doing anything behind the government back ;)

<comment><USER3> People know who Apple is. Apple has a reputation. Sure they're compromised by NSA, but every communications medium in the world is compromised by NSA.

I don't know who's running this server in China. But unless it's the NSA, you're much worse off using this app than native iMessage, because now in addition to NSA seeing everything, so does this guy--who has no reputation at risk. Adding more eavesdroppers makes communications additively less secure.

How exactly do I have nothing to fear from the Chinese? At least the NSA is unlikely to have any real interest in communications between Americans in America because it's outside their mission, which is not true for Chinese or Russian intelligence.

<comment><USER5> > Sure they're compromised by NSA, but every communications medium in the > world is compromised by NSA.

I do not think that this statement is accurate. The NSA has specifically targeted the largest players.

Also: "encryption works. Properly implemented strong crypto systems are reliable" \- Edward Snowden.

<comment><USER6> Yes but you _do_ have to sacrifice quite a bit to be outside of the NSA's realm of observability. Is iMessage securely encrypted? Wasn't the DEA caught red-handed with a false memo claiming they couldn't MITM iMessage communication?

<comment><USER5> > Yes but you do have to sacrifice quite a bit to be outside of the NSA's > realm of observability.

Very true. That's a consequence of the largest players in winner-take-all markets being targeted.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This remembers me how an interoperability fiasco iMessage is. Just for the interoperability issue many iOS users are slowly switching to Whatsapp: you start using it to message your Android buddies at first, then eventually you want to just use a single app... the limiting factor for iMessage to be dismissed completely by some user is the fact that there is no way to message iPad users from Whatsapp, something they should fix IMHO.

<comment><USER8> The most humorous thing I've seen about iMessage is how it's automatically opt in, with no opt-out should you lose your device or switch to a new (Android) phone.

Our head of IT switched from iPhone and got a new Android phone. Suddenly he found that none of this Apple-using friends were messaging him anymore.

Actually they were, but Apple re-routed their SMSes through iMessage to a dead Apple-account. Without telling anyone about it.

Until he discovered what happened (due to a very angry and ignored-feeling Apple-using wife), he just assumed SMS was broken on Android.

iMessage really shows Apple at its core: So utterly self-centered that it's unable to comprehend that it even _needs_ a interoperability story with the rest of the world.

<comment><USER9> You're kidding right? It's _trivial_ to turn off iMessage; it's _one_ toggle switch in the settings.

On top of that I've had friends switch away from iPhone to Android; iOS switched to using SMS not but a day later (and I know at least _some_ of them didn't turn it off manually because their iPhone was broken).

<comment><USER8> _it 's one toggle switch in the settings._

If you know it needs to be done. If you still have the device.

According to our head of IT, he said if you _didn 't_ (as most people don't) it gets a whole lot worse.

<comment><USER10> He's wrong. I just swapping my iPhone5 for a MotoX a couple weeks ago. iMessage was definitely a pain since I left the (SIM-less) iPhone on at home and my wife's messages went there since it was on the WiFi.

Turn the old phone off and problem solved.

iMessage specifically confirms delivery. That's why you occasionally get the "Send as SMS" prompt if it can't go through for whatever reason.

If there's no device actively logged into iMessage, no attempt is made to send through iMessage. You don't have to "deactivate" anything.

That said, when iOS7 came out, and I logged back into my iPad, and my wife on her iPad Mini, and her iPhone 5, iMessage reenabled on all of them with my phone number.

So that was a bit inconvenient.

That obviously wouldn't happen if you had reset and sold the device.

If you sold the device without a reset you have a lot more to worry about than iMessage I think. Though a password change to your Apple ID, or managing the associated phone numbers there should address the issue.

BTW, SMS on Android... wow. That's probably the shittiest thing about switching. It's hard to appreciate how unreliable, low quality and all around bad SMS/MMS is if you've been using iMessage for a few years.

Messages get split up over 140 characters. You can't forward vCards. MMS take forever and you're lucky if you even get half the messages in a timely fashion in-sequence. It's really truly awful.

<comment><USER11> I haven't used straight SMS for many years now. I use Google Voice. But before I started using Google Voice, I used to use Handcent SMS which does all of that. Check it out if you are interested - [https://play.google.com/store/apps/details?id=com.handcent.n...](https://play.google.com/store/apps/details?id=com.handcent.nextsms)

<comment><USER10> Thanks. I really want to keep my (10 year old) number. Transferring it to Google Voice sounds a little scary. Is that unfounded? Is it really pretty seamless? I want to cancel my contract and go to a prepaid plan anyways. Which is apparently too difficult for AT&T to do over the phone without risk of losing my number. :-/

So... I could go get a GoPhone plan with a new number. Transfer my existing number to Google Voice. When the transfer is complete my old plan will be cancelled, I can swap in the GoPhone SIM, add it's number to Google Voice as a forwarding number, and I've got it all done with improved text/group- messaging? Does that sound about right?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> This is actually talking directly to the iMessage service. It's hitting [https://service.ess.apple.com:443](https://service.ess.apple.com:443) (and [https://service2.ess.apple.com:443](https://service2.ess.apple.com:443) when authenticating) and not being proxied through any third-party servers. That being said, it does look like the app reports basic analytics but nothing sensitive.

This is truly impressive!

<comment><USER13> That's crazy. The protocol for iMessage is so complicated that I gave up very quickly after getting IP banned many, many times, it's an incredibly sensitive service to things like this. At the time I just wanted to be able to check if an email address was iMessage-supported, but it required piles of signatures and other authorisation.

It will get banned on Apple's end so quickly, but not before it's used to send mountains of spam.

<comment><USER14> Haha, same here. Instead I wrote an app that uses the iMessage Mac client to insert a mail address into the to: field and check whether it supports iMessage. And then I use pixelbuffer data to figure out whether the mail address has the correct iMessage supported color in the ui. Works great, but is a bit slow.

<comment><USER15> Haha, that's a great hack for checking if an email is an iMessage account. Can you gist the code :)

</comment></comment></comment></comment><comment><USER16> At first, when I read the post's title, I thought _Apple_ had created iMessage for Android and put it up on the Play store. Now, that would be a _really_ big deal because that would mean that Apple _finally_ gets that communication is between people and not one family of computers. The current Apple attitude to communication and sharing (like PhotoStream) is akin to a telco saying you can only call other users on their network, or Google saying you can only send and receive emails from other gmail users. Apple finally getting communication would be a really big deal.

I saw, to my great disappointment, that the program was not Apple's.

</comment><comment><USER17> Somewhat unrelated -- SMS seriously needs to die.

Any phone carrier call center employee can check your inbox, supposedly that's an audited procedure but having worked in a call center I would tell you that I'd believe that nobody's watching anything. Just like email, SMS is a poor protocol/medium that has been contorted to doing way more than anyone ever intended originally.

But there is definitely a need for a commodity, cross-platform secure messaging protocol that can be implemented by anyone. It hardly seems like there's anyone incentivized to do that though -- why would Apple, for example, want to ferry traffic to/from non Apple phones. And why would they want to step aside and let someone else replace their seamless, secure-ish messaging experience with something else? None of the other messaging apps can achieve the level of integration with the rest of the phone that iMessage can.

The mere facts that iMessage is a) so good (integrated so well into the OS by way of unfair advantage) and b) closed, are probably sufficient to make sure that there won't ever be a common, secure messaging platform. It couldn't penetrate far enough into the iOS user base even if every Android user installed it.

<comment><USER18> I agree. But, the carriers love charging for text messaging bundles, so I can't imagine them pushing for something else, unless its equally as bad like MMS. So we are left with this crappy state of fragmented and proprietary messaging systems.

We even have standard messaging protocols (XMPP), so it is not a technical hurdle. Merely there is no business opportunity to commoditize messaging, so it hasn't happened.

</comment></comment><comment><USER19> The prejudice here is amazing. Has no one here ever made a free app? Has anyone heard of Linux? Is it possible that out of all the people in China, at least one talented developer just thought that this would be a fun project that they could contribute?

I still don't recommend allowing your conversation to be MITM'd, but the assertions that China = steal your password and charge your CC are a bit crazy. Propaganda works I see!

<comment><USER20> No.

 _but the assertions that China = steal your password and charge your CC are a bit crazy._

The assertion that sending the password for an account tied to your credit card to a completely unknown recipient is a bad idea... is not crazy in the least. And has nothing to do with it being in China.

</comment></comment><comment><USER21> This is going to get shut down _so fast_ from Apple, which is kind of sad given the amount of work that must have gone into this!

<comment><USER22> Not necessarily. There is many Airplay apps that are working for ages. Maybe they have to rename their app.

<comment><USER23> If Apple wants it gone they have a legal staff that can make life hell for the app author. My guess is the 'iMessage' name and icon design are enough for a takedown order.

<comment><USER11> In China? Good luck with that.

</comment></comment></comment></comment><comment><USER24> Does this mean someone actually RE'd the entire iMessage cryptographic protocol. I know of several people who have wanted to analyze it.

If so, if they or someone could put up the source or even a protocol spec, that would be amazing.

<comment><USER25> I'm sure someone will download the APK and decompile it. Hopefully the source hasn't been obfuscated.

<comment><USER26> It looks a bit obfuscated, but there might be some useful finds. I'm going through it and looking for hardcoded strings that might not be in the resource files.

I posted the APKTool output on Github for anyone that wants a quick look - [https://github.com/mdp/iMessageChatDecompile](https://github.com/mdp/iMessageChatDecompile)

<comment><USER27> if someone can reverse-engineered the protocol,then it is not very much difficult to reverse-engineered the obfuscated apk.

</comment></comment></comment></comment><comment><USER28> Sounds great, but I'm still worried because this App might hijack the Apple ID and password. If I remember it correctly, Apple does not publish their Apple ID API outside of iOS SDK.

<comment><USER29> They don't even publish the Apple ID API inside the iOS SDK. There is no way to directly use Apple ID as a form of identification. Only 2nd-hand ways, like GameCenter, and iCloud.

<comment><USER28> That's what I meant, through Game Center and iCloud.

</comment></comment></comment><comment> matthew-wegner As a hackintosh user, I hope the blast radius on Apple's response doesn't kill iMessage here too...

</comment><comment><USER30> Has anybody else here forgotten you're passing on your Apple ID and password here in cleartext? There's a lot of information you can grab with that, and let's just assume that this guy also puts an app out for IOS-- and buys it with your account.

Seriously? Not to mention all the data that can be mined from your associated messages. And for argument's sake, since, again the passwords are in cleartext, let's just say that a small percentage of users also use the same email and password for their Facebook or their Gmail (or whatever else email they have) -- let's just brute force some bank accounts, send a forgot password request, then scour their facebook for the security question. Nightmare scenario, but considering you're passing some random guy in china all this information, not entirely infeasible.

</comment><comment><USER31> Funny how a small app like that can destroy all the hopes a multi-billion dollar company like Blackberry put in their _stay relevant by rolling out BB Messenger to iOS and Android_ plan.

Assuming Apple doesn't kill it of course... There are some good reasons why Apple shouldn't kill it (network effect work both ways) but who knows what they will do.

<comment><USER32> Apple can just pull this off Google Play and then also reject BB Messenger from iTunes App Store. Boom. Victory through lawyering with no technical work whatsoever. Two competitors down.

<comment><USER33> How could Apple convince Google to pull this from the Play Store?

<comment><USER34> C&D because of trademark infringement.

<comment><USER32> Yes. Also because the computer crime laws are vague about unauthorized access and Google isn't interested in subjecting itself to test cases.

</comment></comment></comment></comment></comment><comment><USER35> Is this actually running on Apple's iMessage protocol or is it just duplicating/imitating it? That is to say, if you 'iMessage' to an Apple device, does it come up as an iMessage on that device?

<comment><AUTHOR> It did when I tried with my roommate. He even sent me a picture.

</comment></comment><comment><USER36> hi everybody,i am android message developer.

<comment><USER37> Hi, thanks for joining! Some questions:

1) It appears that the iMessage responses received from Apple's servers are forwarded as-is to a remote server for decoding and decryption. Is this correct? If so, why isn't this process performed in the application itself?

2) Now that you've clearly reverse-engineered the iMessage protocol, will you be publishing it so that others can benefit from interoperability? If not, why not?

</comment></comment><comment><USER38> Fellow Americans, take your snakeskin boots off your redwood desk, adjust the brim of your stetson hat, and shift the piece of grass you are chewing to the other side of your mouth; what I'm about to say is important:

Classifying and stereotyping (even in a passive-agressive sense) is a relic of the past you need to get over.

</comment><comment><USER39> I don't dare to try an app like this!

Good work on reverse engineering the protocol though.

</comment><comment><USER40> Direct link to the APK since it was taken down from play store: [http://www.huluwa.org/imessage/download/platfrom/android/iMe...](http://www.huluwa.org/imessage/download/platfrom/android/iMessage_1.2.3.apk)

<comment><USER41> Any idea why it was taken down?

</comment></comment><comment><USER42> It would definitely seem less shady if the dev didn't copy iOS UI and icons. Still I downloaded it and hope to test it.

</comment><comment><USER43> Regardless of whether it'll disappear from the Play store quickly or not this is kinda cool. Hopefully it means there'll be a FOSS implementation of this at some point and we can get other Linuxy stuff talking to iDevices.

(If there already is one I'd love to be pointed at it, I've done some searching previously trying to get a nice solution for getting scripts at home communicating with me - I eventually settled on using push notifications with Prowl [http://www.prowlapp.com/](http://www.prowlapp.com/))

</comment><comment><USER44> This is really awesome. They should release the method, although obviously there is some value in their not doing so. I'm sure Apple will change the iMessage endpoint to kill this, but that's a cat-and-mouse game they'll lose with the dev community in the long run. If this is a true reverse engineering of the iMessage protocol, this will be very hard to shut down.

</comment><comment><USER45> I would love to know how they pulled this off.

<comment><USER46> Presumably it's Java. Disassembly is quite easy and can even produce quite readable source.

<comment><USER47> Obfuscated code, auto-downloads APKs, presumably to 'self update' but no one is sure.

Use it with a demo account.

</comment></comment></comment><comment><USER48> Sadly this will probably be shut down by morning since it didn't come from Apple. What Apple should, but won't do, is buy it and release it for free themselves. But then Apple would have to admit that there just might be another AppStore in the universe and their reality distortion field might show a small dent.

<comment><USER49> Remember this is Play Store not App Store. Apple can not pull anything out of the Play Store.

What they can do is to shut off the backend because they probably don't have rights to use it anyway.

<comment><USER50> They don't need to pull anything, just have their lawyers tell Google's lawyers that their iMessage trademark is being infringed. Gone.

</comment></comment></comment><comment><USER51> I'm afraid to install this. Does it actually work or is it another common fake app found on the Play store?

<comment><AUTHOR> It's working for me. Sending and receiving messages and pictures. Receiving them faster then Messages for Mac is even!

<comment><USER49> Does it actually register as an iMessage? I wonder how they pulled it off.

</comment></comment></comment><comment><USER52> Before of all, using of the trademark _iMessage_ is enough to get lawsuit from Apple lawyers.

Also, it's sure that they are intentionally copying Apple's copyrighted material.

</comment><comment><USER53> Anyone manage to sign into the app? I just get 'Password or Apple ID error' with a Chinese 'OK' button

<comment><USER53> the app only supports passwords up to 16 characters in length and mine was ... a lot longer.

<comment><USER54> Is 16 characters exactly the length of a whole block of AES 128 input?

</comment></comment></comment><comment> cupcake-unicorn I'm not familiar enough with Apple products, iOS, iMessage, etc. to understand why this is such an impressive feat. Can someone fill me in on why this is so amazing? It's a closed protocol I guess, but if this guy could pull this together under the radar like this how hasn't it been done before?

<comment><USER55> Amazing because the iMessage protocol is surprisingly complicated and seemed to be almost unintelligible to anyone outside of Apple:

[http://imfreedom.org/wiki/IMessage](http://imfreedom.org/wiki/IMessage)

</comment></comment><comment><USER56> This is blowing up all over the internet right now.. It is pretty amazing that there is an app like this which works, but it is even more surprising that this has been around for a bit, and it flew relatively under the radar.

I just tried it out myself, and my boss who uses an iPhone is in total shock.

</comment><comment><USER57> Has Apple already striked ? "We're sorry, the requested URL was not found on this server."

</comment><comment><USER58> Here's a tin-foil-hat needing random theory of the day: Apple gave keys (and protocol) to decode iMessages to PRC Government, in return for being allowed to sell iPhones in China. Somehow they leaked, and now someone in China is offering this service.

(adjusts tin-foil lined colander on head)

</comment><comment><USER59> Even though the technical achievement is really impressive, the iOS6 design just looks out of place. It simply does not look right, it's a shame that implementing an iOS service led them to implement an iOS design, I would rather prefer a well integrated Android experience.

</comment><comment><USER60> So, the magic of some Chinese companies which been used to send advertisement finally be public. Will there be more iMessage advertisements after this? Maybe it is time for Apple to change their iMessage protocol.

</comment><comment> k-mcgrady This will surely be pulled very quickly. For a start it's using the name iMessage. Secondly this is a big selling point for iDevices. Apple gets no benefit from it being available on other platforms.

</comment><comment><USER61> Does this screw up the ordering of messages just like iMessages? Does it make you apart of the same conversation multiple times, so that when you send a message, you get your own reply?

</comment><comment><USER62> Insane. They even have a way to create an Apple ID in the app!

</comment><comment><USER63> I hope the protocol specs leak soon... would be nice to write a Windows Phone client that can do iMessage; kik messenger sucks and whatsapp is buggy :-/

</comment><comment><USER64> just tested it with my account, and it works! even sending and receiving images works... very impressive :) let's see how long will it work :)

</comment><comment><USER65> This explained all the iMessage spam…

</comment><comment><USER66> They're dev website is unavailable which makes me question the stability of this... HA

</comment><comment><USER67> Looks like someone inside the Blackberry deal, trying to demonstrate how irrelevant BBM is.

</comment><comment><USER68> I'm on Android and I think the last thing I want to install is an iSomething.

</comment><comment><USER69> Now all they have to do to get people to use it is create a QR code for it ;)

</comment><comment><USER70> Noooo, what if the Chinese server is hacked by someone.

</comment><comment><USER71> already got pulled.

</comment><comment><USER72> How has this been up for 10 days?

</comment><comment><USER73> One less reason to buy an iDevice, at least until Apple issues the inevitable takedown, Cease-and-Desist, iSueYou, etc.

</comment><comment><USER74> Can confirm that it works here.

</comment><comment><USER75> Look at them one star ratings.

</comment><comment><USER76> can someone post a mirror, looks like it has already been taken down.

<comment><USER77> [http://www.huluwa.org/imessage/download.html](http://www.huluwa.org/imessage/download.html)

</comment></comment><comment><USER78> at what point does Apple deploy their lawyers

</comment><comment><USER79> First screenshot. Cancle.

</comment><comment><USER80> It is such a shame and pity that it comes from China. It killed all of the buzz for me in an instant. I have nothing against Chinese people, but an app that has done something never done before with Chinglish in it - nope.

<comment><USER81> Those can be easily fixed with a translator.

<comment><USER82> It's not the use of the characters per se, it's the fact that this app came from a country with a history of state-sponsored hacking and censorship.

<comment><USER83> Heard of NSA? You bias stereotype peeps.

<comment><USER80> Oh god... Where do you hide a tree? In the woods.

Everybody is talking about high level conspiracies regarding NSA, overseas intelligence agencies and whatsoever.

But the real concern should be about simply getting scammed! Of course our(end user) data is not safe, it was not _designed_ from the very start to be so. I have no problem with NSA and Apple reading my messages because I am sure that they won't use the credit card linked to my account without my consent.

This... thing is a bit different. It is run by a third party provider somewhere outside of European and American jurisdictions. My concern is that if this app was created by Europeans or Americans, I would trust it my password and account, because I would have a tiny fraction of luck in case my account gets compromised and I loose money. There would be a possibility of an investigation, a court and a punishment. This, my friends, is a bit different scenario. If people get their accounts compromised and money gets stolen, Apple is not going to do a thing about it for two simple reasons: 1) Who wants to argue with China? What is the chance of even finding the physical location of the server all the data gets relayed back to? 2) Apple never authorised the use of third party apps.

This is my concern about China, nothing else. I would love to use this app for my every day needs, I would even pay for it! But the chance of my account being _stolen_ with no possible outcome positive for me just rustles my jimmies.

<comment><USER84> > My concern is that if this app was created by Europeans or Americans, I > would trust it my password and account, because I would have a tiny fraction > of luck in case my account gets compromised and I loose money. There would > be a possibility of an investigation, a court and a punishment

There's also the _possibility_ of an investigation, court case and punishment in China.

And I wager the chances of you getting any money back in either case is about the same.</comment></comment></comment></comment></comment></comment>


How to Pick a Quack: Data - <AUTHOR> https://www.overcomingbias.com/2020/08/how-to-pick-a-quack.html <comment><USER2> Healthcare and law have additional complexities. Both professions have legally protected secrecy, for the sake of the patient/client. Both also have heavy licensing and qualification hurdles. On top of that they have heavy liability burdens in case of mistakes. In medicine for example, review sites like Yelp are a constant source of frustration as healthcare providers have no way of replying or defending themselves against defamation due to HIPPA (there are many cases when prescription drug addicts would threaten and give bad reviews if they don't get the drugs they want). There is public data on case outcomes, as well as on particularly bad incidents, but that likely also varies wildly by discipline. A doctor willing to take on the toughest cases when others wouldn't may be punished by those metrics, and still to better by their patient, if they pull doomed people from the brink. If I could have a wishlist dataset it would be for number of particular cases of each surgery or illness a doctor has treated and how many successfully. With Surgeons, especially, those who get the highest volume of cases in a specific discipline are usually the best, and those who do only a handful of a complex procedure per year are likely a danger to the patient. Each discipline likely needs a specialized data filter.

</comment><comment><USER3> Outcomes are not great for many off these things because they often have poor availability, particularly in quantities that are sufficient to signal quality.

Sure, when a lawyer wins a high profile case, they get more clients, but one case isn't exactly great evidence of quality.</comment>


Syria from Space - <AUTHOR> http://www.bbc.co.uk/news/resources/idt-sh/syria_from_space_english <comment><USER2> Excellently made article in terms of web tech. It's media-heavy but loads progressively and fast, _the employed effects support and enhance the content_ , resizing the browser works well even in the middle of effects, it looks nice in general and is very readable - great work bbc team who made this.

<comment><USER3> The 2011/2017 before/after images are striking, mostly because they use scrolling to show the before/after effect. I've never seen that before, and it gives a lot of control over the viewing experience compared to dragging a handlebar.

I wish it were a bit easier to tell which parts of the image are showing bombed areas, since it's difficult to tell whether the diffs are due to explosions or natural changes over time.

</comment></comment><comment><USER4> When plenty of hereditary monarchies are given a hall pass, I cannot fathom why anyone thought cracking open this one might have been a good idea.

I've tried to mull over whatever calculus might have been at play, when a room full of people drew up quiet plans to rip this country apart, and I don't see the motivation.

A generation from now, nothing will be normal in these imploded countries, but kings and princes elsewhere will thrive with no elections at all, I'm sure.

<comment><USER5> On a geopolitical level it makes sense.

[http://www.businessinsider.com/stratfor-george-friedman- pred...](http://www.businessinsider.com/stratfor-george-friedman-predictions- for-the-future-2016-2)

George Friedman: "Well what are our geopolitical objectives? First, that North America be peaceful, prosperous, dominated by the United States. Second, that no nation be able to approach the United States militarily ... Those are the goals. It's very simple. We achieve that by making certain that all conflict takes place in the Eastern Hemisphere so we don't have conflict here."

It's survival of the fittest countries by stirring up stuff in other countries.

</comment></comment><comment><USER6> The United States dropped over 12,000 bombs in Syria last year. I'm ashamed for my country that profits from perpetuating killing and destruction.

<comment><USER7> Source?

<comment><USER6> [https://airwars.org](https://airwars.org)

</comment></comment></comment><comment><USER8> Another interesting remote-sensing analysis would be to look at NDVI ([https://en.wikipedia.org/wiki/Normalized_Difference_Vegetati...](https://en.wikipedia.org/wiki/Normalized_Difference_Vegetation_Index)) - there was already a terrible drought leading up to the conflict, but this war must have also taken a significant toll on the country's agricultural output.

</comment><comment><USER9> I _still_ don't understand why the US won't fight IS together with Russia and Assad. I though it was well known by now that the FSA and IS are difficult to take apart, they are basically mercenaries fighting for whoever has money. When IS got oil wells (and the means to make money off of them by secretly selling to Erdogan) the FSA, at least partly, became IS. Assad has been saying since the beginning that the FSA are animals, and some of them were barbecuing heads at some point.

</comment><comment><USER10> Civil wars are just so vicious. The medical effects of this conflict will linger on for decades, and most of the good doctors have left the country.

<comment><USER11> Not only doctors, engineers as well.

</comment></comment><comment><USER12> The view from space doesn't quite do the destruction on the ground justice. Also from the BBC [1]. I hope the perpetrators of this atrocity are identified and brought to swift justice.

[1] [http://www.bbc.com/news/world-middle- east-38396747](http://www.bbc.com/news/world-middle-east-38396747)

<comment><USER13> If the government is overthrown the Alawites will probably vanish from the middle-east. There's a saying "Christians to Beirut, the Alawites to the grave" [0].

[0] [https://en.m.wikipedia.org/wiki/Sectarianism_and_minorities_...](https://en.m.wikipedia.org/wiki/Sectarianism_and_minorities_in_the_Syrian_Civil_War)

</comment></comment><comment><USER14> I don't suppose anyone knows which particular NASA dataset the BBC is likely to have taken those images from? I'd love to find one that has high spatial and temporal resolution.

I had a look at the linked article at the bottom ([https://www.nasa.gov/feature/goddard/2017/new-night- lights-m...](https://www.nasa.gov/feature/goddard/2017/new-night-lights-maps- open-up-possible-real-time-applications)) but looking at the linked layer in WorldView, it's nothing like as high resolution.

</comment><comment><USER15> No mention of drought in the article. Would it make sense that the drought in the middle east is the single biggest contributor to the instability there?

</comment><comment><USER7> People argue that US should help Syria? Why? Doesn't US have their own problems? Why spend more money on other countries problems if they aren't helping you back?

I think all US should do is not interfere at all. That means no weapon exports to Syria as well.

I'm with Trump on this. We are not the world's police. Last time Hillary and Co helped, more damage was done.</comment>


Digital Strategy for the Library of Congress - <AUTHOR> https://www.loc.gov/digital-strategy <comment><USER2> this sounds like a very bad idea, yes if it could be kept secure in fidelity, good but left open to manipulation editing and censorship bad very bad! i view LOC as the pulse and collective memory of our nation. The LOC is one of the many checks and balances that make it possible for the people to recognize and deal with an unjust government or sociopathic president that managed to trick itself into office. why would the physical library be kept in existence if everyone accesses remotely by browser? why would the public require physical access if they have an online reading room. How would the public know they are reading from the LOC and not some heavily manipulated proxy?

<comment><USER3> > why would the public require physical access if they have an online reading > room.

Respectfully, I really disagree with this line of thought:

* Having digital facsimiles of your collection makes it more accessible and more available

* More people knowing about your collection means more foot traffic

* Some things about a collection can't be discovered from a digitized copy; having a record of the digitized copy encourages researchers to come in and see the real deal

* Maybe scholarship doesn't have to happen IRL? See Colson Whitehead's The Underground Railroad: a fantastic novel that was researched primarily online [0]

0\. [https://newsandfeatures.uncg.edu/grant-expand-digital- librar...](https://newsandfeatures.uncg.edu/grant-expand-digital-library- american-slavery/)

</comment></comment><comment><USER4> Can they start my fixing their craptastic new logo? Hard to be excited moving forward for a org that cant even get basic typesetting right. 'LIBRARY Library of Congress' looks absolutely terrible.

<comment><USER5> Don't expect this done anytime soon with the furlough</comment></comment>


Feedback on Professional Development Curriculum - <AUTHOR> https://docs.google.com/document/d/1pxtoA-qP98fiF-mJimfRNjAaQn76nKG4AkItEYQfoLA/edit?usp=sharing <comment><AUTHOR> For my thesis, I am creating a Professional Development class to train teachers to teach Computer Science. The class teaches coding skills as well as CS pedagogical strategies. I am looking for feedback from CS teachers. Participation should not take longer than half an hour. Thank you so much in advance for your help!</comment>


How Long Is Long Enough? Minimum Password Lengths by the World's Top Sites - <AUTHOR> https://www.troyhunt.com/how-long-is-long-enough-minimum-password-lengths-by-the-worlds-top-sites/ <comment><USER2> I like Jeff Atwood's writing on the topic:

[https://blog.codinghorror.com/your-password-is-too-damn- shor...](https://blog.codinghorror.com/your-password-is-too-damn-short/)

[https://blog.codinghorror.com/password-rules-are- bullshit/](https://blog.codinghorror.com/password-rules-are-bullshit/)

</comment><comment><USER3> About two years ago, I wrote a little function to calculate the complexity of a password based on the usage of character classes. My goal was to not force people into adding '123!' to their password just to use all character classes, but instead allow pure character passwords with an equivalent complexity. That way the user can choose if wants to use an 8 character password with upper case, lower case and numbers or a much longer password with lower case letters only (or something in between).

The function is far from perfect as it was just the first implementation of that idea and never run in production. But I think as a base for a discussion it should be good enough.

      function passwordComplexEnough($password){
      	$chars=0;
      	if(preg_match('/\p{Lu}+/', $password) === 1){ // letter upper case
      		$chars+=26;
      	}
      	if(preg_match('/\p{Ll}+/', $password) === 1){ // letter lower case
      		$chars+=26;
      	}
      	if(preg_match('/\p{Nd}+/', $password) === 1){ // decimal digit number
      		$chars+=10;
      	}
      	if(preg_match('/\p{S}+/', $password) === 1){ // symbol
      		// seems pessimistic but reasonable
      		$chars+=10;
      	}
      	$len = mb_strlen($password);
      	$complexity = pow($chars, $len);

      	// 62^8 (62 chars and length 8 as minimum complexity)
      	return ($complexity >= 218340105584896);
      }

What do you think of this approach?

<comment><USER4> I think it might be useful as a hint but if you're trying to enforce good passwords it falls short like every other scheme. For instance if I'm not mistaken "PasswordPassword" would be accepted by your function.

I always think there are two ways to look at the password issue:

\- It's the user's responsibility and you live it up to them not to use something stupidly weak if they value their accounts (at best you can hint them that the password is weak, but if they want to use "qwerty1234" you let them). This is the approach I expect from websites like HN, reddit, and the like.

\- You want to protect the user and yourself, maybe because you're a website handling money transactions or you're a corporate website and you want to make sure every user has a decent password to access the company's resources etc... In this case the only satisfactory solution is to enforce strong 2FA and if that's really not an option then generate the password for the user. Otherwise they'll always figure out a way to reuse their passwords, generate a weak passwords that passes the predicate etc...

Because in the end, while I'm sure most people would agree that "oothe*Nah2phao0t" is a very strong password, what good is it if I reuse it across a large variety of websites? What about phishing and social engineering? I'm going to go out on a limb and guess that there probably are more Facebook account hacked because of password reuse and phishing websites than people blindly guessing passwords.

<comment><USER5> Apparently one of the more common passwords are "Password2018" (or 2017, 2016 etc, depending on current year). Nice and long, mixes three character classes. Not very secure...

</comment></comment></comment><comment><USER6> This article is hilarious!

"Every single minimum password length is an even number!" You JUST mentioned that Wikipedia requires 1 character.

"There's no 5 or 7 or 9, just nice, round, symmetrically even numbers." What do you mean by round numbers? Obviously not 10, 20, etc. So do you mean that the minimum lengths should have decimal points?

All jokes aside the article of course does make some good points

<comment><USER7> I think what he meant is that Wikipedia does not have an explicit requirement. The password has to exist as a string so there's an implicit 1 character requirement, but there exists no explicit requirement.

</comment></comment><comment><USER8> I'd like to see maximum lengths too, there may be some unwelcome surprises.

The worst password length I've seen recently is Skybet in the UK. It only allows digits 0-9 and has a maximum length of 5.

<comment><USER9> The best ones are pages where the register dialog only allows a max length, silently truncates it and then the login dialog allows every length. And then you start to search why the password you generated ten seconds ago doesn't work anymore. So much fun .. not.

<comment><USER10> This bothers me to no end. Generate a new password, everything seems fine. A week later when I want to login again, suddenly the password doesn't work. After resetting the password and changing it again, I notice the little "max 12 characters length" message but it doesn't warn you, just silently truncates.

So nowadays, when I change my passwords, I have to make sure I don't hit the length limit, and after changing the password, confirm that it really changed to what I want to. In the few cases where it doesn't, I need to go through the entire dance to reset my password again...

</comment></comment></comment><comment><USER11> One more for the list of moronic password rules I experienced: no character repeated more than twice. If you have a password long enough, or a hex/base64 of a 128bit key (which I assume is safe enough!) you are most likely going to hit that limit, which does nothing to help security.

<comment><USER12> It's not just "most likely", you're guaranteed to have duplicate characters in anything longer than 16 digits.

<comment><USER13> Successive. I.e., not substring can be a triple character.

<comment><USER14> I've stumbled upon a nonsuccessive requirement, which meant that passphrases are out, since some characters invevitably repeat.

</comment></comment></comment></comment><comment><USER15> Last Summer I had to create an account with HMRC in the UK. The password requirement was a minimum of 8 characters, a maximum of 12 characters, at least one letter and number, and no special characters! Quite how they came up with this set of rules has confused me ever since.

<comment><USER16> I've met several (official or less of it) instances where my default 32 character passwords are not accepted. Usually the limit is 12, 16 or even 10. My guess is it is stored as a string in a database as a fixed length char field or legacy from the time it was stored that way. Surprisingly many webshops have a 16 char limit, suggesting they use the same backend. My bank used to have 12, but now it is at least over 32 combined with some form of 2FA.

I've seen one instance where the password was "hashed" client side and the length thus didn't really matter, the implementation was lacking but they made an effort at least.

<comment><USER17> > My guess is it is stored as a string in a database as a fixed length char > field

This is exactly why I treat sites that have password length restrictions with extreme caution, preferring to stay away altogether 99% of the time.

</comment></comment></comment><comment><USER18> [https://www.troyhunt.com/content/images/2018/02/Pornhub.png](https://www.troyhunt.com/content/images/2018/02/Pornhub.png)

I wonder how many pornhub passwords are just ++++++

<comment><USER19> Or just password assuming they don't ban that one. Edit: I see now what you did there...

</comment></comment><comment><USER20> _" Oh, and if you do happen to find a site with an odd number for the minimum length, leave a comment below because I'm kinda curious now"_

Not a "web site", but Microsoft does recommend a minimum of 7 characters for Windows 10 logins, and it's the default for domain policy, so that's pretty common.

[https://docs.microsoft.com/en-us/windows/device- security/sec...](https://docs.microsoft.com/en-us/windows/device- security/security-policy-settings/minimum-password-length)

<comment><USER21> There is a historical reason why Microsoft choose 7 characters.

LAN Manager required a password up to 14 characters. It would then split the password into two 7 character parts and hash each independently. So there was no additional security offered by the algorithm for passwords over 7 characters. Today, LAN Manager passwords offer little protection as complete random tables are easily available.

[https://en.wikipedia.org/wiki/LAN_Manager](https://en.wikipedia.org/wiki/LAN_Manager)

</comment></comment><comment><USER22> Minimum password length is really only a protection against brute force attacks. And if the site in question has good protections against that (i.e rate limiting login attempts) or requires 2FA then password length could be relatively short.

Of course if the database is breached, then those protections go out the window and it comes down to the hashing algorithm used and its resistance to brute force attacks.

I think generally it will depend on the threat model of the site in question and what protections are in place.

<comment><USER5> This is the reasoning behind 4 digit pins for cards: after three wrong attempts the atm will swallow the card (which gives an average (1/10000)+(1/9999)+(1/9998) = 0.03% chance of guessing a random pin for a single card. But chances are obviously much higher if you want to guess the pin on a single card out of a batch of 10 000, or if users can pick their own pins).

</comment></comment><comment><USER23> See also: [https://github.com/dropbox/zxcvbn](https://github.com/dropbox/zxcvbn)

(I'm not connected or affiliated with Dropbox or this project.)

</comment><comment><USER24> On the subject of passwords, is it cool if I link you guys to my command line passphrase generator utility?

It's fast, secure and open source.

[https://crates.io/crates/pgen](https://crates.io/crates/pgen)

<comment><USER25> I did something very similar but had the thought that making the passphrase be based on an existing word would make a good balance between security and ease of remembering without a password manager.

Of course it isn't as strong as a purely random passphrase but hopefully it would be strong enough and still better than choosing your own password

[https://github.com/jlmcgraw/mnemonic_passphrase](https://github.com/jlmcgraw/mnemonic_passphrase)

</comment></comment><comment><USER23> Surprised to not see Apple on that list: 8 or more characters, upper and lowercase letters, at least one number.

Another even number. Interesting.

Edit: typo.

<comment><USER26> And your MacBook password can't be the same as your iCloud password which is annoying as hell

<comment><USER23> You're partially right – it can't be the same when you're adding/setting up the account for the first time, but when you're in and things have settled down you can switch it and have it the same.

Source: me, installing a bunch of High Sierra desktops late last year.

</comment></comment></comment><comment><USER27> It's shocking that they are so low. I don't go below 12, and think 16 is about right.

</comment><comment><USER28> Why can't these websites let me choose a password on my own risk? Sometimes I don't care if my account will be hacked or whatever, I just want to have a simple password. But no, they want me to create a super difficult and impossible to memorize password for my account at barbie.com.

<comment><USER29> Because (two off the top of my head) if your account is compromised in some cases it may allow misuse of the provider's resources, or even be used to attack third parties.

</comment></comment><comment><USER30> I've found DropBox's zxcvbn system to be ideal. Instead of requiring passwords to fit a set of arcane rules, it requires passwords to meet a threshold of entropy.

Is there a reason this isn't more widespread?

[https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic- pass...](https://blogs.dropbox.com/tech/2012/04/zxcvbn-realistic-password- strength-estimation/)</comment>


Ask HN: Is there a way to browse YC companies, live ones at least? - <AUTHOR> The name, and a sentence or two explaining what they do.  Live ones preferred, but it would also be interesting to see what's been tried.  Preferably all on one webpage, for simplicity.<p>Alternatively, is there any other simple way to browse them? <comment><USER2> [https://www.ycombinator.com/companies/](https://www.ycombinator.com/companies/)

something like this?

<comment><USER3> Also: [https://yclist.com](https://yclist.com)

And by googling: [https://www.ycdb.co](https://www.ycdb.co), [https://newyclist.com](https://newyclist.com)

<comment><USER4> [https://www.ycdb.co](https://www.ycdb.co) is missing at least 1 company (Lob)

source: I work at Lob and we're a YC S13 company

</comment></comment></comment><comment><USER5> The ability to invest in YC companies unlocks at 5000 points. Just keep making great comments on Hacker News and submitting good links.

<comment><USER6> Poe's law? Elaborate please.

<comment><USER5> For some reason I read the title as "Is there a way to invest in YC companies?" It must be my jetlag.

</comment></comment></comment><comment><USER7> The other answers you got are good ones. Tangential I know, but out of curiosity, what is your use case?

<comment><AUTHOR> Curiosity, and wondering if I'd stumble upon something useful (to me or to someone I know), and wondering if 'make money' eclipses 'social-good'. But also apprehension, about misuse cases.</comment></comment>


Seven Inches, Four Months, A Number One Sales Target: How Asus Built The Nexus 7 - <AUTHOR> http://www.forbes.com/sites/danielnyegriffiths/2012/08/06/seven-inches-four-months-a-number-one-sales-target-how-asus-built-the-nexus-7/

<comment><USER2> That is a title that wouldn't make it through my spam filter.</comment>


What reddit taught me about startups: "because it's your damn job" - <AUTHOR> http://reddit.blogspot.com/2007/10/what-reddit-taught-me-about-startups.html

<comment><USER2> I find that co-founders affect motivation in a particularly in a good way because while they _do_ keep you moving when you feel glum, there's no pressure to accept _them_ as the reason you get up every day, as is the case with working purely for money / an investor somewhere / a boss. It's like the pressure of not wanting to let your co-founder down affects you from the inside out, because you are constantly reminded of your shared fate. They're always there to keep you on your toes, but they don't become a force for extrinsic motivation (which can easily cause stress and deflation instead of adding energy to your inner drive).

</comment><comment><USER3> I wonder how many startup founders regret being acquired early.

Not implying reddit was acquired early, just more of a general question. I'm talking more about the Flickr's of the startup world.

<comment><USER4> Heh-- I got acquired early (and left after my contractual obligation) and have a long list of bookmarked blog posts detailing frustrated founders who have been gobbled up. I certainly would ask some different questions and set some different expectations if I'm ever acquired again.

</comment></comment><comment><USER5> Another bit of data pointing at having a cofounder as being critical.

</comment><comment><USER6> Great post. Same sentiments here.

The motivational poster he cites is hilarious: [http://images.despair.com/products/demotivators/motivation.j...](http://images.despair.com/products/demotivators/motivation.jpg)

<comment><USER7> I have two despair posters in my office:

<http://despair.com/despair.html>

<http://despair.com/gettowork.html>

I also had the despair calendar in '06, but not '07 because they took out the funny trivia. :-/

</comment></comment><comment><USER8> I believe once you have been bought out, you should try to leave as early as possible. The people who bought you want you to code not think, they will do the thinking from now on. I couldn't stand that proposition, would rather train a few coders on the system and take my money and figure out what I am going to do next.

</comment><comment><USER9> <http://nymag.com/news/features/38951/>

Topical, eh?

</comment><comment><USER10> you probably don't bond with people in any other job or activity the same way as you do in a startup.

</comment><comment><USER11> Something there got me thinking... how much do guys at a startup actually sleep? Four hours?

<comment><USER3> You can sleep 4 hours each night if you take naps throughout the day.

Not only does this increase your total awake hours, it also improves concentration and acuteness.

If you are interested in studying sleep effectiveness, try to pick up a copy of _Why We Nap_ by Claudio Stampi

<comment><USER12> We tried this and failed miserably. [http://reddit.blogspot.com/2005/10/polyphasic-sleep- groggy-j...](http://reddit.blogspot.com/2005/10/polyphasic-sleep-groggy- journey-toward.html)

My hat goes off to you for making it work. /impressed

<comment><USER3> Interesting, and cool you tried it (sounds like Uberman if it was Steve Pavlina).

If you feel inclined to try again feel free to email me, I might be able to offer some help.. You can compromise with an Everyman polyphasic schedule..</comment></comment></comment></comment>


Does placing a 'no valuables inside' sign in a car window deter break-ins? - <AUTHOR> http://www.sfgate.com/bayarea/article/No-valuables-sign-car-break-san-francisco-window-12288571.php <comment><USER2> TL;DR - some people on reddit say maybe?</comment>


"Naks" Time to make personal chefs affordable and convinient - <AUTHOR> http://naks.us/ <comment><USER2> I wonder what tier of income this service is intended for. It seems that those wealthy enough to warrant a personal chef would have a private one on retainer, and most others would elect to eat out at an upscale restaurant than hire a personal chef.

>Make sure you have all the necessary ingredients.

Requiring ingredients to be on hand also limits how far a personal chef can even elevate the meal.

Edit: A lack of any media presence (social media accounts all created in the last week), spelling errors throughout the launch site lead me to believe this is someone's personal project masquerading as a legitimate business</comment>


Battered Yahoo Admits It Overplayed Hand; Open To New Microsoft Talks - <AUTHOR> http://www.alleyinsider.com/2008/5/battered_yahoo_caves_admits_it_overplayed_hand_now_open_to_new_microsoft_talks <comment><USER2> I applaude Yahoo for not selling to Microsoft.

Yahoo is a legend and runs a couple of interesting websites and keeps doing new stuff here and there. I like that. I want that to continue. I dont want them to be swallowd by a company that I dont like.

And about the money... its only money. Do we all HAVE TO bow down to the dollar and each and every day go the path of the most money? No. I dont. Im free. And everyone who says Jerry HAS TO because he is the CEO of a public traded company has simply been proven wrong. How cool is that? I dont want a predictable world where everything is based on pennies. Lets celebrate some rebellion ;-)

<comment><USER3> Actually, if you're the CEO of a publicly traded company, you are required by law to act in shareholders' financial interest. That's the price of getting access to the public equity market.

<comment><USER4> ...and why, in hindsight, it would have been a very good idea to have voting and non-voting shares.

</comment></comment></comment><comment><USER5> Glad I closed my (relatively small) short position today then. I really didn't see MS doing a hostile takeover. There were just too many poison pills for them to swallow, and it was clear from the beginning that Yang and the board were on an ego trip. They were nuts not to sign immediately.

Reality is setting in. Which makes me think maybe it's time to go long. What do you all think?

<comment><USER6> Depends on whether Yahoo is ready to grovel to get Microsoft back to the table. After all the cheap shots they've taken, I can't blame Microsoft for wanting to wash their hands of the whole thing and move on.

Edited to add: on further review, groveling is certainly overstating the case. But if Yahoo is willing to reach out and make it look like this can be a real partnership both sides are actually interested in, it will be a lot more doable.

The whole thing where they've been trying to make Microsoft look bad and act like they want nothing to do for the deal hasn't benefited anyone.

<comment><USER5> I don't think that's the case though. It's just part of the game. Their rationale for wanting Yahoo in the beginning probably has not changed. They just realized that going hostile wasn't really an option.

It really wasn't either. Hostile takeovers happen rarely in tech because it's really easy to create effective poison pills. I only shorted because Yahoo seemed so obstinate. They've had a bucket of cold water tossed on their heads now and are gasping for breath.

</comment></comment></comment><comment><USER7> Anyone else think there's too many MSFT-YHOO soap opera stories here?

When it's done, I'm sure there will be some 'negotiation hack' lessons. In the meantime, this is noise -- leaks, rumors, transient stock ticks. More appropriate for 'Daytrader News' than 'Hacker News'.

<comment><USER8> This story has 34 upvotes and 22 comments. Someone is interested.

Sometimes, the biggest noise is the complaining about what is noise.

<comment><USER7> Sure, some people are interested. But even they may, with further consideration, wish they hadn't upvoted, commented-on or otherwise spent so much time following minutiae of the MSFT-YHOO negotiating process.

Since there are no downvotes, we don't know if >>34 people are tired of such headline-news-ticker-like microstories. But the real question shouldn't be raw vote totals, but what people want this site to be.

TechCrunch floods the zone with morning, afternoon, night updates on MSFT- YHOO, as do many other sites. And yet any one tactic or reversal in the middle of this multi-month negotiation isn't likely to have any lessons for hackers/startuppers/those-selling-their-companies-to-GYM-etc.

My comments are made in the hope that next time, some of those 34 upvotes decide to pass, so the next frivolous "Yang writes letter" or "Balmer drops new hint in internal email" story doesn't shoot to #1 in an hour or two.

</comment></comment></comment><comment><USER9> The title of this submission makes me sad. Business sense aside, I really prefer to live my life under the happy assumption that there are still companies out there that can go to-to-toe with MS and not blink.

<comment><USER10> There are such companies: cf. [http://bits.blogs.nytimes.com/2008/05/05/how- googles-checkbo...](http://bits.blogs.nytimes.com/2008/05/05/how-googles- checkbook-stymied-microsoft/index.html)

</comment></comment><comment><USER11> This is like watching no-limit holdem .. but better!

</comment><comment><USER2> I still dont understand, how the this transaction would look like technically.

Say, Yahoo agrees to sell itself to MS. Then where would MS send the money to, and how would the shareholders get that money?

<comment><USER12> Yahoo shares would be converted to MS shares + cash.

</comment></comment><comment><USER13> Ouch.

</comment><comment><USER14> I guess this is part of 'business' that I'll never understand. Why on Earth is it that Yahoo would have to bow down to MS? If you're thinking of the shareholders, wouldn't you be concerned about what MS is going to do to Yahoo (destroy it)? Is it only a (small) gain in share price that matters? Long-term potential be damned?

<comment><USER6> After years of underperforming, the shareholders saw a chance to take a stock that was selling for under $20 not that long ago and turn it into $33 or $34 a share. If you're scoring at home, that's a 65% or better increase in the value of their investment. And for options holders, there's a good chance that the price change is the difference between the options being underwater (i.e. worthless) and being worth quite a bit.

If that were your retirement fund or your stock options in your employer, wouldn't _you_ want that money? And if you were a professional investor, wouldn't you be downright berzerk at all that money being thrown away?

Computer geeks like to go around badmouthing Microsoft all the time, but taking that attitude as a CEO or board member of a public company makes you unprofessional and irresponsible. To shareholders, Microsoft's money spends just like everyone else's.

Yahoo has underperformed for years. Sure, it has long-term potential. But investors have little reason to think the current management will realize this potential any better than the last couple of regimes. Meanwhile, as much as geeks love to hate Microsoft, they have decades of experience in producing enormous profits, and there's no particular reason to think that buying Yahoo will change that.

This isn't just short term vs. long term. This is realizing a return on investment vs. watching that return slip through your fingers. And investors are pissed.

<comment><USER15> Here's the thing: if institutional investors truly believed that Yahoo was overplaying a weak hand, they could have sold their holdings at $28/share (or more).

These guys were gambling for a few bucks per share, just as much as Jerry Yang and the Yahoo board.

<comment><USER3> They couldn't liquidate hundreds of millions of shares at that price. The more they tried to sell off, the lower the price would go. In the acquisition, all of the shares would be bought at that price.

<comment><USER15> Doesn't matter. If the institutional investors were so brilliantly prescient as to anticipate the failed negotiations, they could have easily profited from the knowledge. They didn't need to liquidate. Hell...simply making a public statement on the deal would have put immense pressure on Yahoo's board to sell. Where were they last week?

Point is, this stuff is largely crocodile tears. These guys weren't long because they thought Yahoo would be bought out, they were long because they saw value in the investment. Complaining now that Yahoo's negotiation strategy was somehow "irresponsible", is either massive hindsight bias, or part of some more complicated scheme....</comment></comment></comment></comment></comment>


Self-solving Rubik's Cube - <AUTHOR> https://media.dmm-make.com/item/4462/ <comment><USER2> But is it actually "solving" itself? Or just recording the scramble and playing it back in reverse order? I realize it's an artificial distinction, but if the cube is tracking its state and then running a solve algorithm, that's more interesting (to me) than if it's just popping a stack.

Either way, it's extremely cool.

<comment><USER3> That does not really matter I think. The cool part is that they very able to build a cube that looks similar like Rubik's but has electronics and motors embedded that are able to turn it.

Solving the cube with a computer is a solved problem for a long time and there are myriads of algorithms. Granted the solutions are not perfect (i.e. using the minimum number of steps needed which is always <= 20), but mostly come close (~25 steps).

<comment><USER4> I think it has psychological significance.

It's one thing to have an object that violates expectations by taking action that an outwardly similar object does not. It's a surprise move that turns the tables on the person interacting with the object. (You could almost view it as a threat or a power dynamic thing.)

Having those actions be as intelligent as possible raises this surprise to another level. If I fiddled with it for 5 minutes and it put it back in 30 seconds, I'd feel even more like I just got owned by the object.

</comment></comment></comment><comment><USER5> Very cool and impressive.

Next step: a solving algorithm that minimizes maximum net horizontal displacement from the starting position, to avoid falling off the table.

(the demonstration video has the cube almost fall off the table. A human had to interfere to push it away from the edge)

<comment><USER6> Or replace the table with a bowl.

<comment><USER5> This solves the problem, but wipes 95% of the value of the device as a portable party trick.

<comment><USER7> Because there are no bowls at parties?

<comment><USER8> No party has ever had a bowl, however, it may be possible to research opportunities for introducing them in the future.

</comment></comment></comment></comment></comment><comment><USER9> Seems to me you could make a pretty neat commercial product out of that. Add some LEDs to each surface, plus a speaker and you could have a Rubik's cube that tutors you on how to solve it.

<comment><USER10> In my limited rubik's experience, solving (on an amateur level) is really mostly about memorizing moves and I'm not sure you'd really learn those moves very well just seeing it happen in front of you without explanation.

<comment><USER9> Hence the speaker and LEDs.

</comment></comment></comment><comment><USER11> Fitting the hardware in the cube is the innovation

<comment><USER12> I find it strange that people here are fixated with the solving software part. What's really cool to me in the project is the mechanical solution; fitting all the motors, axles, MCU, sensors and battery inside a customized cube.

<comment><USER13> Exactly this!

The solving algorithm is no big deal at this point. Experienced cubers can solve them in under 10 seconds. There are machines that can solve them in < 1s. [1] Again, the innovation there is the accuracy and precision of the machinery involved.

[1] [https://www.youtube.com/watch?v=nt00QzKuNVY](https://www.youtube.com/watch?v=nt00QzKuNVY)

</comment></comment></comment><comment><USER14> There are so many cool mods you could make with this, you could have it change to a particular pattern when idle or scramble again once you solve it!

<comment> _-__--- I like the rescramble idea. You could maybe go one step further by varying the difficulty of the rescrambling - I'm not sure if there's an established distance metric between rc states (something like a levenshtein distance, "minimum-number-of-changes-needed"), but the program could shuffle the cube out to some threshold on that metric to get easy, medium, hard, etc.

<comment><USER15> I'm assuming that this cube could not be handled as a normal cube. The gearing would give it an odd feel, like moving a servo by hand, and giving too much torque would probably wear teeth.

To make it feel "normal", you could "assist" the user with the motors, but I'm guessing speed would be severely limited compared to a normal cube.

<comment><USER16> Just make the faces buttons and have the button press signal a rotation.

</comment></comment></comment></comment><comment><USER17> I tried making a self-solving rubik's cube in 2013 as part of a school project [1]. It didn't quite work and I gave up.

[1] [https://daniel.lawrence.lu/engineering/cube/](https://daniel.lawrence.lu/engineering/cube/)

</comment><comment><USER18> Are there awards for this sort of thing? If not, there should be. Such marvelous engineering and craftsmanship skills need to be recognized for the benefit of the individual and to inspire others.

</comment><comment><USER19> So it moves while self-solving. If the movement is regular, how about an effort to solve associated 'maze puzzles' with scrambles? It would be neat to see solutions with isomorphic paths.

</comment><comment><USER20> Suddenly realizing how magicians do their Rubiks Cube tricks, they put them in a bag and the cubes solve themselves..

<comment><USER21> Maybe, maybe not. Substitution tricks are surely pre-industrial.

This does bring Clarke's third law to mind, though.

</comment></comment><comment><USER22> This is totally charming! Seems like it would benefit from having a clutch so you can disengage the servos while scrambling or attempting to solve by hand.

</comment><comment><USER23> See also: Self rolling dice

[https://m.youtube.com/watch?v=urd8neVMt4Q](https://m.youtube.com/watch?v=urd8neVMt4Q)

</comment><comment><USER24> Similar, but more elaborated concept:

[https://www.kickstarter.com/projects/1928372437/gocube- the-c...](https://www.kickstarter.com/projects/1928372437/gocube-the-classic- puzzle-reinvented)

<comment><USER3> Wow, how did they get 850k?

They have like 2 things, a cube that measures its configuration and some matchmaking platform where you can cube against others.

If one wants to learn how to solve the cube using instructions (although I think finding it out on your own is a nice exercise), there are 1000s on the internet and even apps that use your phone's camera to give specific instructions.

On the other hand if you want to do speed-cubing (that's actually a thing) it is impossible to avoid cheating over the internet (granted that's also true for chess and other games that have been solved using computers).

The linked project however is really cool - completely useless, but extremely nice. Kudos to the maker.

</comment></comment><comment><USER25> The innards look like Borg technology. Very cool.

</comment><comment><USER26> There are some CAD pics in that page. I find it curious that the cad pics merge together the mechanical parts, the wires, and the electronics.

Can anyone tell which CAD software they're using just by looking at the screenshots?

<comment><USER27> Just a stab, but it could be PTC Creo using wiring looms.

Example image of wiring an assembly in Creo:

[http://www.arbortext.com/-/media/Images/CAD/PTC-Creo-PCX--- 1...](http://www.arbortext.com/-/media/Images/CAD/PTC-Creo-PCX--- 1.png?h=173&w=298&hash=04BFF746B2457DF0D9FD4AAD478BE92D9A124023&la=de-DE)

I am not aware of the interface method Creo uses for wiring or resolving connections, it could be purely graphical with no resolving at all. If so I would assume that the electronics/pcbs you can see in the original article are likely just 3D STEP models exported from the ECAD package into Creo.

Sadly, the market does not currently (to my knowledge) present engineers with one single software solution for ecad->mcad>wiring>assembly>release, instead relying on various software packages, licenses and extensions on these with each user (company) forging their own local workarounds to bridge or replace specific steps of the process.

</comment></comment><comment><USER28> The number of solve moves appears to be 4x the number of shuffle moves (?)

<comment><USER29> Nice observation. I count 15 vs 65.

Most algorithm to solve the cube use some family of predefined blocks of moves. Each block of moves does something simple but interesting, like swapping two edges, or rotating two corners, without changing the rest of the cube. So you can start building one face and then slowly extend the solved part until all the cube is solved.

This is easy to memorize and to use, because all the decisions to use a block of moves are "greedy", you just fix another edge or you fix another corner, one by one.

The problem is that this approach doesn't provide the shorter solution. It's funny to make tree or four moves and then watch someone else use a few hundreds of moves to solve the cube.

</comment></comment><comment><USER30> The videos are incredibly satisfying. I wonder... if you try the old trick of flipping a single edge piece does it give up immediately or attempt the impossible forever?

<comment><USER31> I bet it has absolutely no idea what the colors on the stickers are. It's probably just keeping track of how the cubelets have been permuted from some initial state, and then figuring out how to get back to that state.

So, if you flip a single edge or corner piece, it'll just solve itself into a state where every cubelet is in the correct position, but that edge or corner piece is rotated.

<comment><USER30> Yes, it may need to be flipped in software as well as in hardware.

<comment><USER31> If the software allows for modeling that kind of thing.

There's two ways you could model a piece's orientation in the code: Either relative to its initial state, or relative to some external/objective reference point. The latter would allow you to say, "The initial state looks like the traditional solved state except that this one piece is flipped." Otherwise, though, it wouldn't really be useful, and I'm pretty sure that it would make both the math and the programming more complicated, so I'd assume (or at least hope) that that's not how it's being done.

</comment></comment></comment></comment><comment><USER32> Kids these days. Next they'll have bowling balls you can steer with your phone.

<comment><USER33> That's an awesome idea.

There's a lot of room in a bowling ball so I think it should be possible.

Let's put a camera in the finger holes (no idea if there is a "right" name for them, sorry) and make the ball steer itself.

After that works, start to reduce the hardware size and go for golf balls and the big money ;)

</comment></comment><comment><USER34> The shortest implementation of solving algorithm is a stack of taken moves while shuffling which just should be reversed one by one.

<comment><USER35> Unless you scramble the cube using more than 20 moves. [http://www.cube20.org/](http://www.cube20.org/)

<comment><USER36> The comment you're replying to mentioned the shortest implementation, as in the size of the program written to solve the problem.

I believe you're talking about the the optimal shortest path to the solution, which while true, relevant and interesting, isn't contrary to the point.

</comment></comment></comment><comment><USER37> Probably a silly idea, but I wonder if the cube will maintain zero net entropy through this self-solving process.

<comment><USER38> Frictionless motors must be pretty expensive.

</comment></comment><comment><USER39> This was my first idea for my senior project in 2012! Didn't do it, but glad someone finally did.

</comment><comment><USER40> How does the microcontroller know the state of the cube?

</comment><comment><USER41> _Useless_ Rubik's Cube

</comment><comment><USER42> QUALITY tutorial... I just did one and am not sure I explained as concisely

</comment><comment><USER43> That's so cool! When I was figuring out how to solve it myself (took a year of tinkering to come up with an algorithm) the first big revelation is that the centres always stay fixed relative to one another.

<comment><USER44> Sounds like you're ready for a Rubik's Revenge (4x4x4)!

</comment></comment><comment><USER45> Solving the original Rubik Cube (Ideal branded, obviously) was an impressive feat 35 or so years ago when the craze was in full swing. I would say this cube is a little bit late to the party. But wouldn't it have been fantastic if your cube could have gone into 'teaching mode' or 'hints mode' where an automated cube could just nudge you on to be able to finish the puzzle without a) popping the squares out or b) clumsily picking off stickers and re-applying them, thinking nobody would notice.

Also had this cube been a retail best seller a decade ago then I think Edward Snowden would have had to have chosen another toy to hide his SD cards in.

Nonetheless, Christmas is coming up, I hope Santa has one of these for me...</comment>


Six Metrics Every Business Should Track - <AUTHOR> http://themetricsystem.rjmetrics.com/2010/10/04/six-metrics-every-business-should-track/ Details on six metrics that are related to customer retention and loyalty <comment><USER2> Some quite valuable info in this article. I can definitely see how it is in the best interest of concerned entrepreneurs to put every ounce of their weight into studying these metrics, inch by inch.</comment>


Adobe's New HTML5 Video Player Widget, It's Kind Of A Big Deal - <AUTHOR> http://techcrunch.com/2010/10/21/adobes-new-html5-video-player-widget-its-kind-of-a-big-deal/

<comment><USER2> So I know there is a whole HTML 5 vs Flash thing that's going on, but the truth is that HTML 5 can be a good thing for Adobe they make nothing on flash installs they make a lot on good authoring tools. Focusing on authoring tools for canvas and SVG as opposed to the flash plugin can be just as lucrative as Flash.

<comment><USER3> Wouldn't that bite into the money they make off of their Flash authoring tools?

<comment><USER4> Creative Suite is decently integrated (as long as you stay consistent within the version numbers, importing older projects into newer versions has a nasty tendency to make them no longer backwards compatible unless you specifically re-save as the old version) and there are already plugins that support converting Ai (Illustration) into Canvas ([http://blogs.msdn.com/b/mswanson/archive/2010/10/12/adobe- il...](http://blogs.msdn.com/b/mswanson/archive/2010/10/12/adobe-illustrator- to-html5-canvas-plug-in-released.aspx)). From Adobe's perspective as long as they can keep a tight grip on the authoring tools market (where they actually make money) they are better off hedging their bets.

Photoshop and Illustrator are still the gold standards within the web/design community and while not loved by everyone Flash/Flex is still a very popular platform for developing rich applications. The more Adobe can do to move Flash/Flex (the authoring tools) from being tied to the actual Flash plugin, the better it is for them in the long run.

</comment></comment></comment><comment><USER5> > I wouldn't say we're reacting to HTML5. We see whatever people are using to > express themselves.

So I guess they have a Silverlight player in the works, eh?

Jabs aside, this is what they're using: [http://www.kaltura.org/project/HTML5_Video_Media_JavaScript_...](http://www.kaltura.org/project/HTML5_Video_Media_JavaScript_Library)

Should make things simpler for anyone who is bound to Adobe tools but needs to support <video>.

<comment><USER6> I've used VideoJS (which I discovered here a few weeks ago) for HTML5 <video> with Flash fallback. Works like a charm.

<http://videojs.com></comment></comment>


Fake Obama created using AI tool to make phoney speeches - <AUTHOR> http://www.bbc.com/news/av/technology-40598465/fake-obama-created-using-ai-tool-to-make-phoney-speeches <comment><USER2> 138+ points, 100+ comments:

[https://news.ycombinator.com/item?id=14786863](https://news.ycombinator.com/item?id=14786863)

Plus all these other dupes already:

[https://hn.algolia.com/?query=obama&sort=byDate&prefix&page=...](https://hn.algolia.com/?query=obama&sort=byDate&prefix&page=0&dateRange=all&type=story)</comment>


Eben Moglen: clang/LLVM built solely to undermine freedom - <AUTHOR> http://www.groklaw.net/article.php?story=20100806143457345

<comment><USER2> I usually agree with or sympathize with Moglen's views but this is just indefensible.

He's saying that Steve Jobs is "a man whose selfishness surpasses any recorded selfishness", and why? Because he opted to support a modular compiler started at the University of Illinois instead of the GCC.

The LLVM's license is free, and even classified as such by the FSF. To smear participants in a fellow free software project like this or those that fund it is beyond low.

I lost a lot of respect for Moglen after reading that.

<comment><USER3> NeXT under Jobs refused to meet their GPL obligations for their new ObjC frontend until they were threatened with legal action. I'm guessing Moglen was involved in that conflict, and it shaped his attitude about Jobs.

<comment><USER4> If that makes a person say he is "a man whose selfishness surpasses any recorded selfishness", then the speaker should either cut down on the hyperbole or have more dealing in the real world outside software.

</comment></comment></comment><comment><USER5> Clang/LLVM is built (and financed) to be _the_ real open-source competitor to GCC.

I don't see the problem here, not everything has to be GPL. I'm pretty sure the FreeBSD folks welcome the choice.

GCC is probably the main "monopoly" GNU has, so it must be scary to see that go away.

<comment><USER6> If I believed everything Stallman says he believes, I'd probably be afraid that the obsolescence of the flagship GPL products would over the long term spell the end of Free Software, and that in the long run a shift towards BSD- style software would leave us back where we were in the '90s: the best work from free software developers ends up absorbed into nonfree commercial software with no reciprocity, and so commercial software pushes free software back into the periphery.

<comment><USER4> I am not sure if it would spell the end, but it would reduce their influence. It is probably the most common GPL program included in non-GNU/Linux systems.

Truthfully, it is really a bad business decision not to send patches back to the original project. If you can get them adopted, it will save on maintenance (since everyone is maintaining your patch). It seems that companies that won't file patches back under BSD/MIT are not doing themselves any favors. Further, given the decision process at those companies, it is probably better that those patches don't get added to the mainline.

</comment></comment></comment><comment><USER6> This remark appears to be a tiny side-note in a larger "State of Free Software" keynote talk, and makes Moglen look like a crazy person. I blame the title of the HN post, not Moglen.

<comment><USER7> Moglen stated, "but Mr. Jobs is investing heavily in LLVM solely so he can stop using GCC, lest the patents somehow leak across the GPLv3 barrier, and we become able to use his claims. Nobody has ever tried before, to build a multi- platform C compiler solely in order to undermine freedom."

According to wikipedia, the LLVM is licensed using the University of Illinois/NCSA Open Source License. [http://en.wikipedia.org/wiki/University_of_Illinois/NCSA_Ope...](http://en.wikipedia.org/wiki/University_of_Illinois/NCSA_Open_Source_License)

As stated in that entry, "Source code under the NCSA license can be incorporated into proprietary products without the reciprocity requirements that copyleft free software licenses raise. The license is compatible with all versions of the GNU General Public License."

Can someone smarter than me explain how this license undermines freedom? Or how the LLVM undermines freedom despite this license? I'm having a hard time connecting the dots.

<comment><USER8> Well, it's quite simple really - the license is not GPL and there is no reciprocity requirement - that alone in the minds of some GNU fanatics, amongst which obviously Moglen is, is a crime against freedom and all that's holy.

Maybe I'm getting old, senile and cranky, but thing's didn't use to be this kooky in the open source movement, did they? I mean, there was always the political component to it, the strife for influence, the "stick it to the man" thing, but things didn't use to get this out of hand - smearing another open source project, simply because it's kicking your ass while having a more liberal license.

<comment><USER6> The FSF has always been this political. Open software has gotten _less_ political over the last 15 years.

Moglen doesn't think non-copyleft software is a crime. The evidence suggests that he thinks non-copyleft software is bad for free software in the long run, because it has the effect of enhancing non-free software along with free software.

Anybody can observe that over the long run, if most of the best work in open software is done without copyleft, copyleft-protected software will suffer; free software will have one major contributor (people writing free software), and nonfree software will have two (huge companies _and_ people writing most of the best work in free software).

It's not complicated. It's a reasonable perspective. Disagree with it all you want (and I do), but it doesn't deserve to be mocked.

</comment></comment></comment></comment><comment><USER9> This is crazy talk. Apple's decision to go with LLVM is simply a practical and pragmatic one. It is a matter of choosing the right tool for the right job.

They simply needed a better compiler infrastructure to make Xcode and other tools smarter. You can see some good results of that in Xcode4.

They saw a great opportunity in an open source project (LLVM) and jumped on it.

<comment><USER3> > You can see some good results of that in Xcode4.

No, I can't. It's proprietary and probably won't ever be ported to my platforms. This kind of crap is why I don't contribute to BSDL projects unless I'm being well paid.

</comment></comment><comment><USER10> I disagree, strongly, with the sentiment of Mr. Moglen. As a user of a BSD, I can see a few reasons for wanting a non-GPLed compiler. I also suspect that GNU feels threatened by an open source competitor after being the only real game in town for so long.

</comment><comment><AUTHOR> See remarks at 36:50 in the transcript.</comment>


The real reason for switching the phones off on an airplane - <AUTHOR> https://www.quora.com/How-serious-is-leaving-a-cell-phone-on-during-a-flight/answer/John-Haller-2?share=1 <comment><USER2> Enforcement of air travel rules is strangely inconsistent. Every person on the plane could have their phone on in their pocket without Airplane Mode and no one would know or check (and because they aren't going seat to seat demanding proof of Airplane Mode, I always figured it couldn't really be a safety issue).

Heaven forbid you don't take off your shoes at security though, what kind of monster are you?

</comment><comment><USER3> While it is true that cell phones in planes put more burden on access points, it has nothing to do with an _FAA_ regulation. Why would the FAA care about a private telephony company's equipment?

The FAA regulation was always about interference, plain and simple. The fact that it took so long to change the rule is basic regulatory sclerosis.

<comment><AUTHOR> The point of this answer is precisely that there is no FAA regulation on cellphones, which seems to be supported by this Wikipedia article: [https://en.wikipedia.org/wiki/Mobile_phones_on_aircraft](https://en.wikipedia.org/wiki/Mobile_phones_on_aircraft)

        > Contrary to popular misconception, the Federal Aviation Administration (FAA)
        > does not actually prohibit the use of personal electronic devices (including
        > cell phones) on aircraft. Paragraph (b)(5) of 14 CFR 91.21 leaves it up to the
        > airlines to determine if devices can be used in flight, allowing use of "Any
        > other portable electronic device that the operator of the aircraft has
        > determined will not cause interference with the navigation or communication
        > system of the aircraft on which it is to be used."

</comment></comment><comment><USER4> Why the difficulty in updating the regulation then? Seems like an easy fix.</comment>