Silent Circle's warrant canary is out of date - <AUTHOR> https://canary.silentcircle.com/ <comment><USER2> First off I have no standing here, and I am nobody. I am a customer of Silent Circle though. (or so I claim)

I am sure that StavrosK is well known by the community and it is my fault that I dont know his connection with SilentCircle. His profile points to stavros at stochastic dot io.

But more importantly HackerNews is not a very secure platform.

We have no real way of knowing StavrosK is StavrosK, or if ThinkBeat is the same ThinkBeat as last week. Using Hackernews or any social media as a platform to "override" a warrant canary is ill advised. In fact I think it makes matters worse.

Properly signed messages through the announced channel is the way to go.

<comment><USER3> Yep, this is definitely true. The only way to get this resolved is to update the canary. I can prove I work there, but it's irrelevant.

I also want to note that I didn't try to override anything, dang helpfully tried to temporarily hide this post to avoid causing a panic while we get this resolved, but that doesn't change the fact that this is still a problem we need to resolve.

<comment><USER4> I think this needs an additional safeguard, such as the destruction of the private key associated by the messages and a defined 'grace period' (defined up front, not after the fact) in case of a missed update as well as a very good procedure to update _and_ check that the update has indeed been made.

<comment><USER3> What sort of grace period do you mean? For which?

<comment><USER4> Missed updates, which is what this thread is all about. So say you define up front that you're going to update your canary once weekly but that you reserve the right not to update it for up to three weeks before you consider the canary to be in a state where you can't revive it. This adds a bit of leeway in case someone sleeps in and because you define it up front you can let your users determine if they are comfortable with the period specified as 'uncertain'. Any time beyond that grace period and you're definitely compromised, any time between the normal interval and the grace period and you're in 'degraded' mode and as long as you are within the normal interval you're good.

Personally I think the grace time should be much smaller than your normal update period for the system to continue to work without appearing incompetent after all if you can't be bothered to update the canary you probably should not be trusted with critical data. It's not as if it is a large amount of work and it's not as if checking whether it is done or not is a large amount of work either. In fact, the update should be manual but the check could easily be automated and a 'canary out of date' text message could easily be sent to all the people working for companies such as silent circle if they take their job seriously.

<comment><USER5> I build a grace-period into the warrant canary that I publish by a very simple method: I issue each canary early. Each canary has a stated expiration date that is either the 15th or the last of the month (the lazy man's bimonthly), but the scheduled reminder to update it goes out the 13th and third-to-last day. Usually I take care of it immediately, so a new canary is issued e.g. the 13th that expires the 31st.

So, I essentially have a built-in grace period of two days before the canary expires, and users know that a canary issued on the 13th or 14th is also fine. I really don't see any downside to this method except for the fact that it extends the effective interval between canaries up to two days (the same as a two-day grace period would, but with less reduction in confidence). And in my application that interval varies based on the length of the month anyway, so you can see that I'm not particularly concerned about the length of the interval so long as there is a clearly defined date after which users should worry.

<comment><USER4> That's clever! And elegant too, no added uncertainty.

</comment></comment></comment></comment></comment></comment></comment><comment><USER2> Ok, so from a conspiracy perspective:

Lets say there was a good reason for the canary not being updated.

I the FBI or whichever law enforcement agency was involved in the process noticed that updates were missing, (or saw it because it was pointed out on a well trafficked website)

Could the law enforcement agency then compel the employees to post a note that it was just a mistake and it will be rectified soon? And then have them update it?

Since not updating it when asked would equal disclosing that the event had taken place, which under certain laws might be illegal?

This hurts my head.

<comment><USER6> Or, since Silent Circle partakes of extremely misleading marketing and claims you can make encrypted calls all over the world, LE can just go tap the VoIP providers they use. Legally, or, since almost all VoIP is unencrypted, just by tapping Ethernet. Seriously, go read the press release for the BlackPhone and tell me you'd trust their CEO at _all_. Even Mr Zimmerman admits the entire business relies on LE not coming into their office with guns.

<comment><USER3> What? Where is this claimed? As far as I know, all claims are that OCA calls are encrypted _to the server_.

It sounds like you're confusing the PSTN calling offering with the Silent Phone service itself, which is encrypted peer to peer.

<comment><USER6> [http://www.prnewswire.com/news-releases/silent-circle- expand...](http://www.prnewswire.com/news-releases/silent-circle-expands- encrypted-services-with-global-out-circle-calling-266542861.html)

"enables Silent Circle members to make and receive encrypted, private voice calls through the company's Silent Phone service to non-Silent Circle subscribers in 79 total countries"

The PR goes on and in about how "disruptive" this is, even though it's much more expensive than Skype, and about as secure.

It's highly misleading. The PR obviously wants people to buy this product for security and encryption, but it can't deliver. It's about as good as using SIP+TLS/SRTP, Skype, or a VPN. Yet given the high cost (12 cents a minute) plus the marketing, it makes users believe they're getting actual encrypted calls. You guys should clearly state in the marketing and in-app that the call gets a first hop encrypted, then dumped unencrypted out to the Internet/PSTN (which nowadays are rather intermingled, sometimes when least expected).

Other stuff like "100% dedicated network – no sharing or leasing" sounds like it's probably untrue, or uses a special value of 100%. Either way, such statements should be backed with clarification.

Finally, there was a PR with Mike Janke, linked here on HN about a year ago. I can't seem to find it now, but he says a bunch of misleading/false things while writing off competition and makes SC come off rather slimy. Y'all shouldn't let him talk for the company as it makes the engineers look bad. (Not to mention the whole thing about Blackphone - a closed source fork of Android with a few 3rd party apps, no mention of the baseband processor issue, yet billed as some amazing breakthrough and it's own OS.)

SC should lower the hype and be transparent about things. Overall, I get the distinct impression it's a marketing joint bankrolled by a non technical founder, who hired some good names and provided a commercial vehicle for zRTP. Which by itself is fine, but the execution feels more marketing than technical.

PS, if you're using FreeSwitch, then I gotta ask: where are all the CVEs? Are you fixing them privately, publicly without announcement, or are you using FS without a security audit? (The only reason I mention this is SC often seems a major sponsor of ClueCon.) If not FS, what is your VoIP platform, and in what language is it written?

</comment></comment></comment></comment><comment><USER7> Is a warrant canary even legal? If it isn't, what's the point of having them?

From [http://en.wikipedia.org/wiki/Warrant_canary](http://en.wikipedia.org/wiki/Warrant_canary)

 _The US security researcher Moxie Marlinspike states that "every lawyer we've spoken to has confirmed that [a warrant canary] would not work" for the TextSecure server._

Direct link: [https://github.com/WhisperSystems/whispersystems.org/issues/...](https://github.com/WhisperSystems/whispersystems.org/issues/34#issuecomment-49910725)

<comment><USER8> The main worry for TextSecure is that Google upon receiving a NSL will send you a targeted update for the TS client and GAPPS framework that sends all your msgs to a three letter agency before being encrypted and sent as usual. So Google would need a canary for the play store

<comment><USER9> Except for the fact that Google does not have the signing keys that are used for the TextSecure binaries. They cannot silently distribute a binary that has been tampered with. This distributed trust system is one of Android's strengths:

[https://developer.android.com/tools/publishing/app- signing.h...](https://developer.android.com/tools/publishing/app-signing.html)

<comment><USER10> To clarify, so Google _can_ distribute a binary that has been tampered with, but it'd be trivial to prove that they had in fact done that?

<comment><USER9> That's correct. Android will warn you if the signatures don't match too. Even if we're in the full-on conspiracy theory territory of Google disabling that core security feature, impersonating a third-party developer, and dropping a binary onto a single user's phone, they still couldn't fake the signature.

<comment><USER4> They could simply disable the warning. It's android giving the warning, _not_ the app.

</comment></comment></comment></comment></comment></comment><comment><USER11> Reading this canary has me worried, it doesn't actually say that "no warrants have been served, nor have any searches or seizures taken place", it only says that a declaration stating that will be provided.

Compare this to rsync's ([http://www.rsync.net/resources/notices/canary.txt](http://www.rsync.net/resources/notices/canary.txt)), which this seems to have been based off of. It explicitly states "No warrants have ever been served to rsync.net, or rsync.net principals or employees. No searches or seizures of any kind have ever been performed on rsync.net assets, including:..."

<comment><USER3> You're right, it looks like the wording is a bit unclear. I'll talk to the guys to see if we can get it updated, thanks.

</comment></comment><comment><USER12> Maybe they were indeed slapped with an NSL. What a nice christmas present, huh!?

If they failed their own canary - how could you believe them in terms of their warant canaray setup ever again? Not so much at all, I'd say.

<comment><USER3> The entire purpose of a canary is to get manually updated. Automating it would defeat the purpose. If the person (or people, but you'd want to keep them as few as possible) was sick, unavailable, etc, it obviously wouldn't get updated.

A canary also fails open by design. There's no way for the canary to fail on the side of getting your data compromised. If we forget to update it, you should just be more cautious, until we update it again (if we do).

<comment><USER12> Of course it needs to be manually. Fail open? A warrant canary system setup for the sole purpose of telling the whole world (and the clients, of course) that they were hit by not posting "a declaration that, up to that point, no warrants have been served, nor have any searches or seizures taken place".

Can there really be a fail-open or fail-safe here?

Edit: "not posting" fixed.

<comment><USER3> Yes, forgetting to update the canary = safe. If you had a system that signed stuff until you stopped it, it would fail unsafe, i.e. it would keep telling people they're safe when they weren't.

<comment><USER12> You realize, that forgetting to update the canaray gives the same message as "we were hit by a big fucking NSL, don't trust us and our software and systems ever again as their security has been compromised."?

From the outside, there is just no way of knowing that it was just a forgotten update or if it was a strong message.

<comment><USER3> Hey, I'm not any happier about this than you are. I'm just saying that at least it doesn't lull users into a false sense of security, which would have been disastrous.

<comment><USER12> What's your threshold to "disastrous" in terms of a missing warrant canary then? 3 weeks? 1 month? 2 months? longer?

<comment><USER3> _Not_ missing the canary when you were served an NSL.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> So it looks now, that the canary got updated. No other information given, at least not within the canary itself.

[https://canary.silentcircle.com/](https://canary.silentcircle.com/)

</comment><comment><USER3> [DELETED, wait for an official company response or canary update]

<comment><USER4> That's pointless. It's like allowing an alarm to ring without cause. Next time it rings the canary won't be trusted until you personally vouch for the fact that it wasn't an accident, and if that's the new channel the canary has lost its value.

False alarms are lethal for something as important as this.

Sorry...

<comment><USER13> "That's pointless. It's like allowing an alarm to ring without cause. Next time it rings the canary won't be trusted until you personally vouch for the fact that it wasn't an accident, and if that's the new channel the canary has lost its value."

That's not really true.

The canary is only "dead" and that channel is only useless until a new one is published. Unless the operator of the canary has decreed _in advance_ that a particular time period elapsed should be considered "dead" regardless of future updates, then the canary is alive and well as soon as a new update comes out.

Here's the thing - a warrant canary is, by definition, a manual process. It should never be automated. A human has to resign and republish (or they are doing it wrong). And this means that sometimes they get published late.

In the 9 years that we (rsync.net) have been publishing our canary, we've probably missed our normal Monday morning publish 10 or 15 times. But as soon as we publish, with the affirmative canary and it's signature and language, etc., it's alive and well again.

Obviously this changes if someone is months late with an update.

<comment><USER12> "Obviously this changes if someone is months late with an update."

That's what I was asking before - what is a reasonable timeslot for being "late"? Is it "months" or "weeks" or the <deltaManualUpdateT+1d> of canary x? In this case, SC was almost 3 times their weekly update rate late (December 5th to December 25th).

<comment><USER13> When we have been late, it's been 8-12 hours.

Once it gets to weeks, I think something else is going on.

</comment></comment></comment></comment></comment><comment><USER14> Does the US Patriot Act even apply to them anymore? They moved to Switzerland this year. Still, they should probably look into doing the same kind of thing for Swiss laws.

[https://blog.silentcircle.com/our-move-to- switzerland/](https://blog.silentcircle.com/our-move-to-switzerland/)

If the warrant canary is out of date, though, I wonder if they moved to Switzerland _because_ the US government tried to get to them, and it wasn't just a forward-thinking action.

<comment><USER15> As long as you have a single server in the US, the Patriot Act applies to that server and its administrators, regardless of where they are located.

<comment><USER16> Even if there are no servers in the US, are any of the principals or employees US citizens? If so, then they're as immune as they have the resources to fight off an assertion by the USG that they're not.

Think of Microsoft's current fight over giving up email from one of their Irish servers. Microsoft has the resources to fight this off, and that's the only reason they're still fighting and not complying. Someone small would have to fold or go to jail.

If you're small, it doesn't matter if the law is on your side if the USG overwhelms you before the question even gets a hearing.

</comment></comment></comment><comment><USER17> The purpose of the canary is to provide the issuer with a way of saying "I am no longer trustworthy". Since the canary has not been updated, nothing that can be said in favor of Silent Circle should be trusted. When the canary is again updated, it will be Silent Circle saying "I can be trusted again" (subject to the limitations about coercion as described in the canary message).

For now, do not trust that Silent Circle has not been compromised despite anything you may read in this thread. When the canary is updated, then you may return to the state that you had before: you can speculate that they are being coerced into lying about the canary, or that they are trustworthy. That choice is an has always been yours to make.

<comment><USER4> I disagree that the state post a future update of the canary is equal to the state before it failed. New canary, same as the old does not apply, the alarm has rung, it can't be 'un-rung'.

<comment><USER5> The warrant canary is not an alarm that an NSL/etc has been served precisely because NSLs do not allow for any such alarm to be raised. The canary is an assertion that this event has not happened up to a certain date, and so one issued at any point whatsoever is as valid (up to its issue date) as any other.

It's not practical to release new canaries constantly, so there is always an interrim period between one and the next where it is unclear if the situation has changed. A due date/release schedule is a guideline to users for that interrim period. Last canary within one normal scheduled interval? Everything is normal. Last canary longer back? Now we must worry that the situation has changed, because if it hadn't the canary should have been updated.

The release schedule is only that, though, a guideline for deciding during the period since issuance. It changes nothing about the fundamental nature of the canary as a claim up to the specified date. A new canary, early, on time, or late, makes the exact same assertion as each of the older canaries. It being late just prevents user confidence about the state of the service in the time period between 'expiration' and new issuance, the new issuance brings back this confidence.

Releasing a canary late is a sin because it creates a time period in which the state of the service is in question, and frequent/lengthy/otherwise egregious incidents should reduce user trust in a service. That time period ends when a new canary is issued, though, as the protection of the canary is once again in place.

But perhaps I simply misunderstand your ideas. Could you explain what you mean by a means other than analogy (which is honestly not particularly useful here, as the nature of signed text is different than the nature of birds)? Or a better question, if a new canary is issued, but late, then what is the actual scenario that users are not protected against?

<comment><USER4> That depends on how late 'late' is. A bit late, maybe. Weeks late: indefensible. That leaves room for creative interpretations such as deals being struck and compromised identity.

We need a canary monitor service or something to that effect, I imagine of the alarm wasn't raised here then this situation could have gone on for much longer still. Makes you wonder what the value of the canary is if nobody is actively monitoring it.

</comment></comment></comment></comment><comment><USER18> I hadn't heard of Silent Circle before so I looked at their offerings. Is it any different than what you get from TextSecure and RedPhone for free?

</comment><comment><USER19> It seems to me that a warrant canary being updated after public notice is the _most_ definitive proof we have that Silent Circle hasn't been served with an NSL.

If the NSL had the ability to force an update, the canary would have been updated before anyone noticed it was a problem. If the NSL didn't have the ability to force an update, the canary would still remain un-updated.

</comment><comment><USER20> "As of Thu Dec 25 19:07:56 2014 UTC, here are the current headlines"

So it's up again?

<comment><USER21> Yeah, my guess is that someone at the site saw this and realized that they need to update it.

That or they were forced to by law enforcement due to all of the attention this was getting. Turns out warrant canaries are mostly useless.

<comment><USER22> Based on a critical reading of the 'Thu Dec 25 19:07:56 2014 UTC' update I'd say it has served its purpose and delivered its only message as loudly and clearly (or absently and morbidly, as the analogy may go) as it can.

ps anyone got a link to any previous canary update, or even a copy of the public key?

pps the update I read (including signature) had sha1sum 790b9817923137c68bd0a818456f2b47ff25719f

</comment></comment></comment><comment><USER23> Does that mean they've been served a warrant?

<comment><USER24> Either that or they forgot to update it.

<comment><USER3> [DELETED, wait for an official company response]

<comment><USER12> Well, some folks obviously watched out "for not updating it" during the last couple of weeks.

From far away, the warrant canary served its purpose well.

<comment><USER3> Yeah, I agree. I think we update it every Friday (it's another team that does it), but I wonder why we missed the last two. Maybe there's just stuff I don't know about.

</comment></comment></comment></comment></comment><comment><USER25> Good catch :)

</comment><comment><USER12> That canary sits in direct reach of a LE (Law enforcement) of the US.

$> whois 126.96.36.199

[http://myip.ms/view/ip_addresses/3352914432/22.214.171.124_19...](http://myip.ms/view/ip_addresses/3352914432/126.96.36.199_18.104.22.168)

Edit: Typo law enforcement.

<comment><USER3> I'm not sure what a LAE is, but the server doesn't matter much, since we sign the file itself.

</comment></comment><comment><USER26> As long as it's a false alarm, we'll demote this story.

Edit: Ok, we restored it with a question mark. That's a more balanced way to handle these; I just forgot about it.

Edit 2: Now that I think about it, there's no need for a question mark on a factual statement. Sorry—I'm a little distracted right now! (We can change "is" to "was" if they update it, but someone will have to let us know.)

I'm going to detach this subthread now so it can go to the bottom as off- topic.

<comment><USER27> I'm pretty tired of sensationalist NSA stories here on HN, as well, but I think you're really wrong here.

First of all, it is a factual post, nothing sensationalist.

Second, it is obviously on topic (warrant canaries and their failure modes have been discussed here several times, and usually very civilly).

Third, just because "some guy" tells you "hey, everything is fine" doesn't make it true. You just declared that you're satisfied with the explanation, which I can understand, but demoting the story means that you don't believe that someone can rationally think otherwise. That's unfair, IMO.

Fourth, if you're posting a warrant canary and fail to update it, you deserve the suspicion and discussion. That's kind of the whole point. So: working as designed. :-)

<comment><USER12> Yes - dang, plesae put that discussion back up where it belongs.</comment></comment></comment>


Making $300k in SanFrancisco can still mean you're living paychk 2 paychk - <AUTHOR> https://m.sfgate.com/bayarea/article/middle-class-budget-San-Francisco-300-000-13741570.php <comment><AUTHOR> [https://www.financialsamurai.com/living-a-middle-class- lifes...](https://www.financialsamurai.com/living-a-middle-class-lifestyle- on-300000-year-expensive-city/)

[..]Who Makes $300,000 A Year?

Before we look at the income statement, I'd like to go through a list of various workers who will eventually make ~$300,000 on their own or in household income if they find someone who also works.

* A Bay Area Rapid Transit janitor made $234,000 + $36,000 in benefits in 2016

* A Bay Area Rapid Transit elevator technician made $235,814 + $48,429 in benefits in 2016

* Starting salaries for 22 year old employees at Facebook, Google, and Apple range from ($80,000 – $120,000) + ($10,000 – $50,000) in annual equity grants.

* 30 year old first year Associate in banking earns $150,000 in base salary + ($0 – $120,000) in bonus

* A 26 year old Airbnb employee shared he got a $250,000 total compensation package back in 2015

* A 26 year old first year law associate at a firm like Cravath make $180,000 base + $20,000 sign on bonus. By the end of their 6th year they are making over $300,000

* A 29 year old Director of Marketing at a startup makes between $120,000 – $180,000

* A personal finance blogger with 500,000 pageviews earns between $150,000 – $600,000

* A 42 year old college professor at Berkeley makes $235,000 on average and $279,000 at Columbia and NYU

* The average specialist doctor finishing his or her fellowship at 32 makes $300,000. The average salary for a primary care physician is $200,000

* A 26 year old middle school teacher making $55,000 a year plus her $250,000 a year VP of Marketing wife

* A 56 year old high school athletic director making $100,000 a year plus his $200,000 a year management consultant husband

* Thousands of employees at tech IPO companies like Uber, Lyft, Airbnb, Palantir, Pinterest, Slack and more once their RSUs are included [..]</comment>


Slow and steady LOSES the race - seriously. - <AUTHOR> http://kanebennett.wordpress.com/2011/01/07/slow-and-steady-loses-the-race/

<comment><USER2> Completely agree.

And the tortoise and hare has been misinterpreted for generations. It isn't slow and steady wins the race, it is perseverance wins.

</comment><comment><AUTHOR> What are your thoughts? :)</comment>


Ask HN: Anyone getting a mild shock from the chassis of their 2018 MacBook Pro? - <AUTHOR> I purchased one of the latest MacBook Pros online in November 2018, and noticed a strange problem with it.  When it is plugged in to a wall socket, whenever I touch or run my finger along any of the metal casing/chassis, I can feel a slight electrical charge tingling my fingers.  It is a bit like those toy prank guns etc. that send a little jolt up your hand when you press the trigger, or what you get when you touch one of those electric fly swats - only a lot milder.
The problem goes completely away when it is running on battery.  As I don't know anyone else who has one locally, I can't verify it by checking someone else's MBP. I also live thousands of miles from an Apple Store and cannot go in to get it checked.
Is this a common thing with the new MBPs, or do I have a faulty unit (or faulty power pack)? <comment><USER2> They've been like that for years, not just the newest ones. It's a grounding thing - if you can use the three prong plug instead of the two prong, it should be better.

</comment><comment><USER3> I have also experienced this from time to time, IIRC, with PC laptops as well. FWIW I live in Sweden.

Edit: This article on Super User has some more info: [https://superuser.com/questions/1103456/laptop-surface- vibra...](https://superuser.com/questions/1103456/laptop-surface-vibrating- because-of-ungrounded-adapter)

</comment><comment><USER4> I used to get this from my 2013 MBP when I used it without the extension cord (which at least in Australia is earthed). For some reason the extensionless plug didn't have a connection to the power supply's earth. It was a bit disconcerting, but never caused me an actual problem.

</comment><comment><USER5> Also depends - in which country you are using it. If you are using this in India/240V this has been there for ages.

</comment><comment><USER6> There's probably a fault in your power adapter. You should replace it before it really zaps you.</comment>


How Criminals Steal $37B a Year from America's Elderly - <AUTHOR> https://www.bloomberg.com/news/features/2018-05-03/america-s-elderly-are-losing-37-billion-a-year-to-fraud <comment><USER2> I caught my grandfather's caretaker, along with my aunt and uncle (who had POA), stealing more than half his net worth. This began after a stroke left him cognitively impaired with 24/7 care. I did a complete financial audit and there were some minimal phone scam payments, but by far the bulk of the financial exploitation came from the caretaker and family members. He was left so financially ruined that I had to move him out of his home at age 89.

I ended up petitioning for guardianship and won. This was a painful and long process but it was ultimately the only logical choice.

Part of the problem is the secretive nature of finances. My aunt and uncle did most of their theft by putting undue influence on my grandfather to get him to sign things and then claim he was the one making all of the decisions. This undue influence included threatening him that they would abandon him if he didn't do what they wanted. The court overwhelmingly showed his incapacity which made these lies obvious.

To make matters worse, there were over a dozen amendments to my grandfathers estate documents within a 2 year period. You'd think there would be a lawyer that says no to these things, but it turned out my grandfahter's lawyer was later found complicit. He was disbarred because he got caught stealing money from several of his elderly clients.

And my grandfather's financial advisor knew about all the abuse as well, but did not do anything about it. He claimed he was alerting the POA (my uncle) about it all along, but he wasn't able to do anything else.

When I reported it to the police they did open up an investigation, but they put it on the backburner. Why? Because elder abuse is not well understood by law enforcement. When the culprits are the victims family members, it is just not taken as seriously.

The bottom line is that elder abuse is a complex problem. It isn't one that can be solved with technology alone. It will take a combination of technology, the law, and awareness. Even then, it will be difficult to solve.

</comment><comment><USER3> This is a reason why we must fight against too much of our data being put online, by accident or by design. My parents complain of getting these calls where the callers give details which are often quite accurate, and then fish for really confidential information. Vendors like Google being tied to everything from flight booking to wedding receptions has led to this situation. It makes harvesting of information pretty trivial.

</comment><comment><USER4> I feel like fraud is America's fastest growing sector, and that frightens me a lot. The burden of proof is far too much on the consumer, and even what should be slam dunk cases are not investigated. A coworker bought an expensive camera from Japan. The seller sent him tracking info and serial number. He was excited for days for it to arrive, and when it did he got an empty box. A few days later, an e-bay listing for the same, rare model of camera showed up in the area. He called the number, got a call back, and caller ID matched a dude who matched the name of his delivery driver and was listed on Facebook as a working for the company. Should be a slam dunk, right? Police were thoroughly uninterested in a $1500 item that was incredibly obvious. Insurance simply paid out.

I've had my credit card stolen twice times, including one that was clearly part of the target hack , though wasn't obvious at the time - at the time, it was simply a fraudulent charge that my bank caught despite being made at my local target (which itself gives me pause, because how did they know it wasn't me?) That happened in the right time range. Most people I know have had it happen to them. Quite frankly, I've known several unclassy people who have engaged in such behavior - they pretty much bragged about it, and so I stopped hanging with groups that would allow them to join (and then laughed when reading Facebook posts from former friends that they were dealing with said fraud)

<comment><USER5> In conversations about scams, a lot of people blame the victim or say something like, "well just don't be a sucker", or claim to take a very naturalistic view where we're all dogs just trying to become top dog. I've thought about this, and I think a big part of it is that the people who say that believe themselves to be decent people but ultimately want to leave open the option of acting scummy themselves in the future (because it makes your life easier) or perhaps have acted scummy in the past, or currently, and they want to avoid cognitive dissonance. You can't admit that it's wrong and keep doing it without thinking you're a crappy person.

So be very wary of people who show a hesitance to empathize with victims.

On another note, our government and society as a whole just doesn't give a damn about victim-assisted fraud. There are cases where billions of dollars have been stollen from pensioners and it is obvious who is responsible (often an open secret) but nothing is ever done. If you want to make money being a terrible person just commit victim-assisted fraud and spread each crime across multiple jurisdictions.

<comment><USER6> I can see a few other aspects behind this. First is "I learned it by watching you" \- people become fiscally successful without merit through scumbaggery which promotes a cynical view that ethics are for keeping suckers in line.

Second is a "don't feed the trolls" thing. By falling for it they actively make the problem worse even for people who are savvy. If nobody fell for spam and scams they would go out of business.

Finally the classic victim blaming for mental security, just world and such. I won't be scammed because I'm not a moron. I won't suffer police brutality because I'm not a criminal.

</comment></comment></comment><comment><USER7> If you think you get a lot of junk/scam phone calls, get back to me after you turn 60. My parents' volume of junk calls has pretty much increased by 50% year on year, every year after they retired. It's never-ending. I was shocked when I went home for Thanksgiving to visit. They get these calls every 30 minutes or more! And the scammers are getting even smarter and bolder. One ploy they have is they pose as a family member who's in trouble or needs a loan right away. Or the scary "IRS is gonna call the cops" one. Or the standard "I'm from your credit card" or "you won a sweepstakes!"

Sit down and have the talk with them. Even if you think they're cynical enough or that they (currently) have the mental wherewithal to not fall for this crap, sit them down and give them the briefing.

The FCC and phone carriers have proven for decades that they don't give a single shit. They're not willing to solve it. This needs to be solved by elder education, and as [most of us here are] younger people, I think we have a moral duty to make sure that education happens.

<comment><USER8> Is there any reason to not encourage them to use a cellphone configured to only accept calls from a whitelist of numbers?

<comment><USER9> Sure, many people want to leave the door open for distant relatives/friends to phone them if needed.

My parents are immigrants and would about once a year get a phone call from some person I had never heard of from back home, usually when a friend of the family died back in the motherland.

Your proposal would prevent such calls from succeeding.

<comment><USER10> how is a distant relative going to find anyone's cellphone number? That makes absolute no sense, since cellphone numbers aren't posted in a public directory that distant relatives might honestly peruse.

<comment><USER9> I'm talking about elderly people, from the era of land-lines and phone books. They want to be maximally reachable at the numbers dispersed long ago. They're often very lonely and it only gets worse as all their peers fade away, the last thing they want is to obstruct any potential genuine contact.

To suggest they setup a whitelists where only their active set of connections may reach them demonstrates a profound lack of understanding and empathy for the elderly.

Furthermore, it's important to keep in mind elderly immigrants are usually even more stuck in the past, having grown up in nations lagging in most ways behind the USA. When I visit where my parents came from, it's like visiting a museum.

How they get the numbers is obvious, I don't think you've made any attempt to think about this. They tap into the friends network, people search through their phone books and give out numbers. It's how things used to be.

<comment><USER11> > To suggest they setup a whitelists where only their active set of > connections may reach them demonstrates a profound lack of understanding and > empathy for the elderly.

Maybe you let everything go to voicemail. Or if they're too far gone for that, you route it to _your_ voicemail. And just pass along what's legitimate.

</comment></comment></comment></comment></comment></comment><comment><USER12> My father lost $10K from a phone scammer. The scammer dug up personal details from various public records and weaved it into a plausible scenario. Dad thought he was saving his nephew from being framed for drunk driving by a crooked small-town cop. They even got nephew's voice impression correct, or at least good-enough. His mental facilities for judgement & scrutiny were waning.

It appears they dug up minor details on various elderly and cold-call bunches of them. If a call receiver shows curiosity, they hang up, collect more personal details, and call back days later with a more complete scenario. Thus, I don't think they actually practiced voice impressions, but use shere mass fishing/phishing to see who bites, and then focus on the biters. They leverage coincidence via mass trials.

<comment><USER13> Hey, tabtab. I have a friend at a national news organization working on a story about robocalls and looking to interview people who've been affected by them. Your story is shocking. Do you have an email address I could pass to him?

<comment><USER12> Unfortunately, my dad's mental state and eyes have degraded so much that he cannot use email anymore. Is a phone interview okay? I can ask him if he wants to talk about it. He had been too embarrassed to talk about it before, but time may have changed that.

It is indeed a crazy story. The scammers told him if he went to police or tried to contact the direct family of the nephew, it would blow the entire cover of the fix-by-bribery get-out-of-jail method. He was instructed to go to Target to buy gift cards. Later, Target was uncooperative in providing details, such as security camera coverage of those cashing in the gift cards on the other "side". The cards are numbered such that I'm sure they have logs and/or accounting records of when and where they were cashed in. They could have used that to narrow down which security camera footage to review. Maybe investigating Target gift-card scams is an avenue for you. Target confessed is had happened to others.

<comment><USER13> I'm sorry to hear that.

I don't want to speak for my friend, but I would assume a phone call would be fine. Do you have an email in which he could contact you?

</comment></comment></comment></comment><comment><USER14> T-Mobile sometimes sends me a caller ID of "SCAM CALL". Got that for the "This is the IRS" scammer.

Useful trick: don't answer by saying "Hello". Predictive dialers listen for that to distinguish humans from answering machines and voicemail. If they don't hear "Hello", they hang up quickly.

<comment><USER15> If you answer and stay silent, all of these calls hang up at 11 seconds without fail.

I'm curious what happens after 11 seconds?

</comment></comment><comment><USER16> My mom is not even elderly and already falls for a bunch of crap. It wouldn't matter if I educated her on this subject 10 times, she'd fall for the first scam right after the conversation. Some people are just so gullible that they can't be helped. I know the HN audience here would like to find a quick fix such as phones that only allow calls from certain people or let elder answer only identifiable ring tones from family, but none of these would help people like my mom. I think the only effective solution would be swift enforcement, monitoring and severe prison time, readily enforced without mercy. Criminals need to get in in their head that if this is behavior they want to engage in, they will pay with their life.

<comment><USER17> most of these scammers are outside of the reach of us law enforcement, or pseudonymous

<comment><USER18> Usually they still have someone that picks up the money. I.e. a "friend" of the supposed nephew that is calling for help.

<comment><USER19> > Usually they still have someone that picks up the money

Yeah, somewhere in $foreign_country...

<comment><USER18> No, I meant where the elderly person lives. Those scams usually don't run over WesternUnion or so.

</comment></comment></comment></comment></comment><comment><USER20> While educating the elderly can help in the short term, I feel like this shows structural problems such as personal data protection and phone carriers' unwillingness to fix these sort of issues.

I'm not saying phone fraud is non-existing in my home country of Belgium, but I've never received a single scam call, nor do I know of anyone who did, so the size of the issue in the US is surprising to me.

I do remember getting a lot more spam calls while living in Spain for a while, so it seems very linked to countries' law enforcement and carrier cooperation.

</comment><comment><USER21> Our house phone has a built in option to only ring if the incoming number is on a white list. Our number had formerly belonged to someone who owed many debts. We've had it in place for 4 years and nothing bad has happened because of it. Not that I've noticed anyway.

<comment><USER22> I would pay a decent sum of money to configure my iPhone to only accept an easily maintained whitelist of phone numbers... (I know you can hack something together with DND etc, but it's a PITA)

</comment></comment><comment><USER23> One defender you may find useful. At least, the recordings are very entertaining:

The Jolly Roger Telephone Company

[https://jollyrogertelephone.com/](https://jollyrogertelephone.com/)

</comment><comment><USER24> Well, maybe since more than 5 years ago, I have read thousands of reports, warnings, and complaints filed by people about scam calls on the internet and TV, like social media, sites like [http://whycall.me](http://whycall.me), etc. It's sad to know that there are still many people fall victim to these fraudsters now. We need to keep informing people about these scams, especially our family, so that they won't become one of the victims.

</comment><comment><USER25> I had to fend off calls like this a lot when living with my mom. I estimate most calls made are scams. It is sad the government doesn't care about quality in communications.

<comment><USER26> It's a byproduct of one very important regulation. Phone companies are required to connect calls they receive, ie they can't block calls coming into their network from other exchanges. This is a pretty important anti-monopoly rule because it prevents big companies like AT&T from freezing out small competitors like the early VOIP players or from trying to squeeze out each other by degrading service for calls not originating in their network. An unfortunate side effect is they are somewhat limited in their ability to block or filter calls and to enforce caller ID. All it takes is one cooperative operator for a spammer to bypass any protections put in place among the large carriers.

There was a neat reply all episode about someone abusing this connection requirement to make money just by sending out calls to 1-800 numbers, keeping people on the line and getting a cut from the originating exchange.

[https://www.gimletmedia.com/reply-all/104-case-phantom- calle...](https://www.gimletmedia.com/reply-all/104-case-phantom-caller)

<comment><USER25> A phone number rating system could be developed where if they get negged enough the number just comes in as "spam call" instead of the next town near you.

<comment><USER26> That already exists for Android but it only fixes those not doing CID spoofing. I get a lot of calls marked as spam but it won't and hasn't fixed the problem of spoofed caller ID numbers though which are those calls that match the first 6 digits of your phone number. Those they just constantly rotate and change to match the number they're calling at the moment. I've had a few people call me and even my work desk number after some cid spoofer has used those numbers.

</comment></comment></comment></comment><comment><USER27> In Fiji we have a Financial Intelligence Unit (FIU). Banks, money transfer companies (think Western Union, MoneyGram, etc), and other financial service providers are required to report suspicious transactions to the FIU.

Short of handing a scammer a bag of cash, there's no way to transfer/receive money anonymously.

While a scammer can do damage, any significant amount would trigger an investigation and be blocked.

It sounds like the US is still the wild west when it comes to this sort of financial shenanigan.

</comment><comment><USER28> I'm sorry to say this but my faith in this species is quite limited at this point. The nature of this species seems to be extremely primitive. How can we be so collectively intelligent yet such behavior is so pervasive and widespread?

</comment><comment><USER29> I think a large proportion of the elderly need to be under some degree of supervision, especially in their interactions with the outside world. Ideally their relatives would assume the role of guardians, and failing that, some organization that specializes in providing this kind of oversight.</comment>


Facebook could face extra $5bn tax bill after IRS investigation - <AUTHOR> https://www.theguardian.com/technology/2016/jul/29/facebook-us-tax-investigation-irs-ireland <comment><USER2> So skip seven appointments to discuss your multibillion tax bill with the IRS, and Obama will still come share the stage with you at a conference. Good to know.

</comment><comment><USER3> Good. Well, it would be good if we used our taxes for good things. I guess Uncle Sam just got a shitload of new bombs.

<comment><USER4> That's a silly comment. Taxes are inevitable and they have to come from somewhere. If powerful shops like AAPL, FB, and GOOG can cheat on their taxes, someone else who does not have the wherewithal to "cheat" on their taxes (e.g. the upper middle class) must be overtaxed. It's the upper middle class that's getting screwed, after all unlike the poor they have the money to pay for the bombs you mentioned but no access to the tax dodging strategies large companies and the super rich have.</comment></comment>


Ask HN: Is it hard/bad to apply for jobs in cities you don't live in? - <AUTHOR>

Hi friends,
I'm sure the question sounds a bit silly, but I'm considering a move from east coast to west. I've read a bit of advice about "targeting" places I'd like to work, narrowing my search down and being aggressive on those places.
However, being that I still live in the east, I don't want the employer to see my resume and be turned off by my how far I am. Or in the event that I get a phone interview - have such a big time delay before I can even meet face to face for an interview. These things seem like job-killers; imo the face to face is crucial, and the more time you delay it, the less likely you'll be to get that job.
I would ultimately prefer to move cities first and then pound the pavement for work - but I know this can be a bad idea because its a crappy economy and nobody wants be burning their savings in an expensive west coast city. I'm typically looking for business development job, around $50k (my first "real" job?). I have a degree in business and lots of experience with my own startup projects.
So what do you think? 1) Move first, ask questions later. 2)Try to setup job from afar, move when safe and secure (if at all). <comment><USER2> Do an 'exploratory move'. Find a short-term sublet on craigslist, 'move' there, post your resume as though you're there. Stay a month or two, get job nibbles etc. If the response is good enough or whatever, extend. Otherwise, move on.

This isn't fanciful advice; I do it. So far I've been lucky (about finding short-term sublets). Note that it takes a couple / few days at a motel to find the sublet.

</comment><comment><USER3> I've tried both. I've found better success with #1.

This isn't substantiated, but my thinking is: \- hr/recruiters notice if you've made a move \- people see it as a sign of commitment if you've made a move \- you're more likely to find a job the easy way: networking with likeminded people \- you're more likely to avoid bad pursuits (ie, the "good on paper company")

The economy isn't bad for talented people. Believe in yourself, show employers why they need you, and get on with your first job already.

You've got a world to get out there and conquer.

Best of luck, -m

</comment><comment><USER4> For the past few months, I've been going through this exact process, moving from NYC to Boulder. The in-person interview requirements are the biggest challenge. A few companies are willing to fly you out, some not. Many will ask you to get back in touch once you move.

I suggest making it clear that you're definitely moving once you have an offer. Employers are reluctant to commit to someone that isn't committed to them (i.e. their office, their city).

So ultimately, I would suggest doing multiple phone interviews with multiple companies. Get the process as far along as possible. Then once you have several asking for in-person interviews, but not willing to fly you out, make the move.

</comment><comment><USER5> Check out: www.manager-tools.com/2010/01/how-transfer-between-states- industries-part-1 - 2010-09-24

This is the best podcast for tech/management types. These guys provide actionable, concrete steps one can take to become a better manager, person and employee. Their sister podcast, career tools, is full of amazing advice as well.

Requires free registration. Worth it's weight in bits...

</comment><comment><USER6> Just explain your situation. That's what cover letters are for. Or in this day and age, the body of your email.

They'll either say:

1) Why don't you try again when you're out here.

2) We'll fly you out for an interview, but relocation costs will be all you.

3) We have a relocation policy.

</comment><comment><USER7> Just tell them you are willing to relocate. Hiring an employee is a big investment, if the business is too short-sighted to pay a few thousand dollars to recruit the best possible people for their several hundred thousand dollar investment then you probably don't want to work there.

<comment><AUTHOR> I understand the principle behind your opinion.

But fact is, there are probably dozens of not hundreds of people probably applying for the same jobs. I can see them being inundated by requests, and simply passing me over because they can interview several (equally qualified?) people immediately rather than drag it out with someone who has to relocate for the job.

Am I being realistic or just pessimistic?

<comment><USER8> As the recruiter for a medium-size mobile agency, I definitely would not pass on a great candidate that wasn't local — in fact, we frequently post on local job boards in other cities. However, you have to immediately make it obvious to me that you're a kick-ass candidate. I more likely to bring in a local candidate for an interview (which gives them a bit of a leg up), even if they aren't immediately an obvious great candidate.

That said, it's much easier to network and get in touch with the right people if you're in town.

If you really want to make yourself available, being very upfront that you're willing to cover relocation expenses goes a long way.

</comment></comment></comment><comment><USER9> If you're moving to San Francisco or Silicon Valley for a tech job then this isn't even a question. There is so much talent out here that a company would be insane to pay the extra costs of looking outside the local talent pool.

<comment><USER10> I disagree. I moved here from Indiana for a job. The company flew me over here for the interview and also paid for relocation when I moved here. Same situation for all my friends. We are new college grads, so the situation might be different.

</comment></comment><comment><USER11> Pick up a copy of "Wishcraft" and a copy of "What color is your parachute?" Work their "programs" (for lack of a better word). Use a goal oriented mental framework rather than a timeline oriented mental framework -- ie don't set dates, set milestones for what needs to be accomplished to get there from here.

I am also looking towards leaving the East Coast. I am not job hunting. One of my goals is to make my online stuff profitable enough to support me and my sons (with their assistance -- they aren't actually children). The main thing I am working on here lately is figuring out what milestones I need to hit to get there from here. That approach has turned out to be very reliable in the past for other "impossible" challenges.

Good luck with this.</comment>


Preventing Crime With Tech: The Newark Experiment - <AUTHOR> http://www.techcrunch.com/2008/08/02/preventing-crime-with-tech-the-newark-experiment/ <comment><USER2> I'd be interested in hearing what the ACLU says about it in their own words; the transcript made it sound like they were much more accepting than I would expect

<comment><USER3> The ACLU'S weird about that sort of stuff, inasmuch as they seem to mostly object to indiscriminate surveillance. I work for a company that does "smart" surveillance, which allows for both improved cross-referencing of footage and a finer grained control over who can see what. Depending which side of the coin is being discussed, they'll either demonize or canonize us, without ever acknowledging that they've had different stances in the past.

All in all, I think they don't have a clearly defined stance on any of this. A lot of camera installations in cities are surprisingly ineffective (too many feeds to monitor in real time, usually at absurdly low frame rates because there's not enough disk space to hold onto high quality video), and I think this makes them low priority targets as far as the ACLU is concerned. It will be interesting to see what they do once the technology really comes of age and a few operators can actually correlate footage from a city-wide installation.

</comment></comment><comment><USER4> is techcrhunch diversifying?</comment>


Why do most programming languages use commas in argument lists? - <AUTHOR>

Does anyone know the answer to this? I've been looking at these things for over thirty years, and it just occurred to me to ask this question. Note that argument tokens are (almost) always either composed of contiguous dark space or enclosed in matching delimiters (i.e., ", ', (). [], etc.)
Here are some possible answers, and problems I see with each:
-- They help separate arguments in argument lists.
==> Not for me. Apparently not for Lisp, Arc,
Scheme, and Clojure people either. In parameter lists that allow types as well as parameter names, commas make sense, as they help separate the groups. But in argument lists (and parameter lists without types) they just add noise, IMHO.
-- All the languages do it, therefore it's expected, and therefore, well, all the languages do it.
==> Lisp, Scheme, and Clojure don't, though Clojure treats them as whitespace and lets you put them where you want.
-- Math books have been doing this for ages, so it's a natural follow-on.
==> This makes some sense, but it really only shifts the problem around. Why do they do it?
This isn't the most earthshaking issue, but commas in arg lists are noisy. <comment><USER2> Because we do it in regular language as well ?

It says "there is more coming, I'm not finished yet".

In COBOL you even use the '.' to indicate end-of-section, just like in written language.

The trouble with that is that on a line printer those '.'s really don't stand out very much and if you forget one you're toast :)

<comment><AUTHOR> Interesting answer, and goes to my suspicion that "this is the way we've always done it" is part of the answer. But see the comments above.

 _The trouble with that is that on a line printer those '.'s really don't stand out very much and if you forget one you're toast_

That's not the half of it. Many years ago the US launched a satellite, part of whose control was done by a Fortran program. Well, one of the developers used a single period in a loop header where he should have had a comma. Unfortunately, in Fortran that was syntactically valid. Problem was, it was hard on the printer he used to see the difference. So the satellite and a bunch of US taxpayer money took a trip to the center of the sun. Ouch.

</comment></comment><comment><USER3> About math books:

because in math space can mean multiply: f(ax - 1 b - 3 c y z) is not as clear as f(ax - 1, b - 3 c, y, z).

<comment><AUTHOR> Good point. People sometimes use expressions with operators as arguments.

My take now is that, because comments are required for cases such as the above, they require them everywhere. What should happen is that they be optional.

Also, it just occurred to me that, while Lisp et al. don't use commas, they do use parentheses to bracket subexpressions, so they don't have a problem with the issue you just cited.

</comment></comment><comment><USER4> In handwritten mathematics the end of one expression and the start of the next is not always obvious. Putting the comma is almost a requirement.

Remember also that the original ForTran language definitions didn't bother with spaces because it was hard to tell from the handwritten code (from which it was transcribed) whether there were spaces or not.

</comment><comment><USER5> If your only category distinctions lie between Lisp and non-Lisp languages, then yeah, pretty much all languages do it. The real question is if you consider another symbol to be more appropiate. Since the comma correlates well to the purpose in question in natural languages, it's the most obvious choice.

</comment><comment><USER6> This is more of a rant against non-Lisp style than a question.

</comment><comment><USER7> Tcl doesn't.</comment>


Is an Apple more form than function?  - <AUTHOR> http://news.cnet.com/8301-13924_3-10212505-64.html?part=rss&subj=news&tag=2547-1_3-0-20 <comment><USER2> Lessee... Why buy a Mini when it's underpowered compared to and more expensive than a Chevy? Why buy steak when hamburger is more lean and costs less per pound? This game can be played ad infinitum.

I use Linux at work because I prefer an environment I'm familiar with and it lets me do what I want more quickly. I prefer a Mac at home because I find them easier to use than Windows machines and they come with software I like using. The fact that they can appear unix-like as well is a plus. I use Windows because I have to.

The danger with marketing on price (negative) vs. features (positive) is they're risking people carrying things to extremes. If they succeed in making the OS irrelevant, why buy a Windows machine at all vs. Linux?

As a software company, they're supposed to be commoditizing the complementary product - hardware. Not the reverse...</comment>


HN 2.0 2.0 - <AUTHOR> http://www.zeaun.com/web-apps/hacker-news-2.0-2.0.html

<comment><USER2> Claiming to be HackerNews 2.0 seems dishonest, being that you're not the original author of hackernews. Which is probably why they banned your feed, imagine hacker news calling itself Slashdot 2.0 or digg being reddit 2.0.

It seems like a nice site, but it could probably do with re-branding.

<comment><AUTHOR> That's why I kept the terms YCombinator and Hacker News out of the domain name. I felt that HN2 got the point across. As I pointed out in the blog post, HN2.co is my way of paying homage to a great resource by adding additional functionality.

Thanks for looking, and thanks for your feedback.

<comment><USER3> Props for shipping. But how are you adding functionality? It's really not that hard to click links.

Tangent: all this 'redesign HN' stuff is misguided. HN is brilliantly designed. It's sparse, it's not pretty, but it would be hard to improve the design from a UX point of view. Good design is about thought, not about shininess.

<comment><AUTHOR> Good points. The main goal was to make a site that let the visitor consume great content from HN, but without accumulating the clutter of multiple windows and tabs, and without the hassle of hitting the back button over and over to go back to HN after reading an article.

For future functionality I would like to add the ability to post links to the original stories to social networks right from the UI, to mark certain stories as "watched" and to receive either push notifications or AJAX-refreshed notifications when a story you are "watching" gets a new comment or when you get a reply to a comment you have posted.

<comment><USER4> But collecting tabs is how the web works. You follow article after article, until all the questions are closed, marked for later reading, or you run out of time.

Oh, and removing the comments? Dude!

If you wanted to improve HN, make the comments and linked site accessible at once, so people don't have to jump from one to the other.

<comment><AUTHOR> I hear you. I plan to add the comments. I just didn't have time to do so this weekend. I expect to have them there within the next few days.

If you have any suggestions for how best to place them without adding clutter, I'd be grateful.

Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER5> I'm sorry, but this is just not for me. I like to have a lot of screen space. The HN sidebar kills it. Also I have a horrible habit of just middle-clicking all links I am interested. The list of open tabs grows fast, but that way I can track everything that I'm working on and/or reading.

</comment><comment><USER6> I suggest you try and create your own brand, rather than trying to stand on the backs of the people that have worked so hard to make this site what it is over at ycombinator.

Hell, it just seems cheeky. And badly done.

Change the name, change the color scheme and maybe revamp the design... then you might have a good project.

<comment><AUTHOR> Thanks. I've got my hands full with other projects at the moment. This was a fun weekend project that I will revisit from time to time to add features to, but it is not intended to be a new news site, as such. It's just a different UI for reading stories from HN, just like the many other HN redesign posts that show up here every few weeks. I hope some enjoy it and find it useful.

Thanks for taking the time to look and comment.

</comment></comment><comment><USER7> Why don't these people fix something that's broken? I.e. do something to Gmail or Google Reader.

</comment><comment><USER8> Seems to require JavaScript. I'm sure this was a fun project, but regular HN suits my needs.

<comment><AUTHOR> It does. Quite a bit of it actually. Thanks for trying it out and please do check back later. Based on the feedback I get from the HN community I'd like to add a lot more functionality down the road without adding clutter to the UI.

</comment></comment><comment><USER9> Disingenuous to call it HN, as you do not appear to be Paul Graham or any of the YC team.

<comment><AUTHOR> I'm not, nor do I claim to be. I'm a fan who wanted a different interface and decided to share it with the community. Thanks for looking.

<comment><USER9> _I'm not,_ \- if you mean you are not calling it HN, the title is HN 2.0.

As far as your site, perhaps being a minimalist, I prefer the current site design, as it serves my needs nicely.

</comment></comment></comment><comment><USER10> This is the second post I've seen of late with someone trying to redesign or change the face of HN.

Has nobody thought to just create an awesome userscript/style?

</comment><comment><USER11> Sites that frame bust like nytimes and stackoverflow will break this somewhat. I like the idea though.

<comment><USER12> They can mostly be handled, as I discovered when creating a Chrome plug-in with a similar interface: [https://chrome.google.com/webstore/detail/beoobakjmicjpifdpc...](https://chrome.google.com/webstore/detail/beoobakjmicjpifdpcbfdgifhimhpnen)

It's sites like github, which use X-Frame-Options, that can't be displayed in a iframe.

</comment></comment><comment><USER13> HN 2001 - An iFrame Odyssey</comment>


How Rich People Spend Their Time - <AUTHOR> http://www.washingtonpost.com/wp-dyn/content/article/2008/06/22/AR2008062201859.html <comment><USER2> The major flaw with this article/study is that it defines wealth in terms of income rather than net worth. It would be interesting to see how much time high-income/low-net worth people spend their time in comparison to low- income/high net-worth, and high-income/high net worth. It may also be further intersting to see if there is a correlation between spending less time doing things you enjoy, and how much of the income is earned (as distinguished from passive income, such as royalties and dividends).

</comment><comment><USER3> _His fever is nearly 102! Thats dangerous right? Should I take him in? If I do there is no way we'll make rent, and probably not the car payment either. Maybe if I just give him extra Tylenol, it will break by morning. Dammit, how much is too much?..._

The extra happiness that comes from being wealthy does not come from more leisure.

<comment> daniel-cussen So true.

Being rich means you can give your kids:

a better education better healthcare, and a backup plan if they become disabled, among others.

All this without having to depend on the state.

There are some very compelling reasons to be rich.

<comment><USER4> I guess you missed this article claiming that couples w/o children are happier than those with. Which could imply; not having kids means working less and having more leisure time?

<http://news.ycombinator.com/item?id=231236>

But surely isn't the point in having kids is make them productive adults who can fend for themselves and not have to rely on their parents wealth?

</comment></comment></comment><comment><USER5> This didn't match my own experience. I spent the last few years being poor, and I felt like I had to be working all the time. If I wasn't doing something that could potentially bring money in, I felt guilty. Recently, I moved to the DC area and got a salaried job. Even though I've had a 4 hour (total) commute each day, I actually feel like I have more free time and am more relaxed than I did when I was making one third to one fourth as much, mostly because I'm not freaked out about money at all times.

That's probably much of the reason that people report being happier: if you've made less than 10K so far in 2008, and don't know when your next check will come in, or from whom, your life is going to be pretty stressful. If you have a steady >50K job, any monetary problems are pretty optional.

</comment><comment><USER6> I believe another flaw of this article is that $100,000 is considered wealthy. My family's household income is above this but my dad provides for a family of 6, children. Of course he spends most of his time working.

I'd like to see a study done on people either who have a high net worth (like qaexl said) of say over $1,000,000 not including their primary residence. Then we could see what they do with the money they already have. Either that or people who have an income of over $250,000.

The issue with the study is that there are a ton of middle class people making over $100,000, but not many who can build it up, compared with the relatively few people with much higher actual net worths. The problem is that these two categories get counted together, and those barely breaking 6 figures vastly outweigh the others.

The other thing to consider is that those who are significantly well off may tend to enjoy pushing themselves (which is how they got their in the first place). PG doesn't have to do YCombinator. I'm sure Viaweb set him up for life. He probably just enjoys the industry and prefers to spend his time productively, just like many other wealthy people.

<comment><USER2> Going off topic for a bit, my major financial goal has always been financial independence, as defined by having enough passive income to exceed my monthly expenses. Or put in another way, income from rents, leases, royalties, dividends ... subscription fees from web apps ... etc. stuff I don't have to trade time for pays for all of my expenses. Now, whether that means I have extra money to purchase luxuries is a different set of metrics. However, at that stage, I have _time_ to pursue things, whether they are life-long passions, or a startup, or investing full-time.

That's why your typical middle-class earning $100,000 or more have difficulty building up the net-worth; that income is earned income, it is taxed much higher than passive income, and there's not enough time. I find it ridiculous to go for a 2 hour commute -- that is 4 hours each day, 5 days a week, or 20 hours. 20 hours of time spent in a car -- that's a part time job. A part time job you spend money, waste time and get nothing. (Even if you like driving, do you _really_ enjoy driving during rush hour?) It gets worse when both couples in the family work, as now you're adding in greater expenses for working (a second car, clothes, lunches, and so forth). But the wage earners of families commute because they want their kids in good, suburban schools. Without time, there are very few investment vehicles available.

Contrast that with someone who have income-generating assets (high net worth -- primary residence is _not_ an income-generating asset, and neither is the car, the SUV, or the boat) that meets/exceed expenses. If you don't want to stop working, you can keep working. Until your boss pisses you off, or you're asked to do something unethical. You don't have to commute unless you want to. If you want to go into real-estate as a landlord, you can focus on that without having to worry about meeting the next month's living expenses. If you want to do a software startup, you don't have to worry as much as burn rate -- just start coding. This appears to reinforce the cliche, "it takes money to make money", but it isn't. As mentioned in the previous paragraph, having money but little time means you're not going to be able to build up your net- worth.

And if you're pursuing a life-long passion, it doesn't matter if it is "active" leisure or "passive" leisure. It doesn't matter if it is stressful or not. The basic living expenses are covered. The lower parts of Maslow's heirarchy of needs are covered. The fact is, you're pursuing a dream. That's wealth to my eyes. That's liberty and pursuit of happiness, right there.

<comment><USER7> _it is taxed much higher than passive income_

Could you elaborate on this a little bit? The passive/active divide is a little fuzzy to me, especially since you apparently include "subscription fees from web apps" in the "passive" category. It seems to me that such fees will either be taxed as ordinary income (if they're coming into a pass-through entity such as an S-corp or some LLCs) or 'double-taxed', first at a corporate rate, and then at a 2nd personal rate when you transfer them from the company to yourself. (The combined effective tax rate generally seems higher than the pass-through rate.)

I can see the lower effective rate being justified a couple of ways: considering the effects of FICA/Medicare taxes, restricting consideration to cap gains (e.g. appreciation in publicly-traded stocks) or tax-free securities, etc. But I'd be interested in where you draw the line between "earned" and "passive" income, and how you conclude that "passive" is taxed at a "much" lower rate.

<comment><USER2> Hmm, I put my foot in my mouth on this one.

"Passive income" for me is defined in terms of how much time I have to spend for the income. If I have to spend a lot of time, that's active income.

My statement, "it is taxed much higher than passive income" is a broad generalization, something I shouldn't have written. I put in the internet subscription fee in there because I don't have to trade time for it, and I assumed it would flow through a sensible business entity. If so, legitimate business expenses are deducted before they hit the personal tax returns.

Going to a job and taking a salary on a W-2, the costs for earning the salary includes a car (usually car payments), automobile insurance, car maintenaince, fuel, toll fees (if applicable), parking fees (if applicable), lunches, daycare (sometimes), business-appropriate attire, grooming supplies, etc. Few employers will reimburse an employee for those expenses, so all of that it is coming out of pocket, money _after_ earned income taxes.

In contrast, the costs for obtaining the internet subscription fees includes server hosting, development equipment, office supplies, books, sometimes travel/commute ... and just to make sure this isn't merely a rosy picture -- accounting fees, legal fees, state fees, state taxes, county taxes, health care, amortized office furniture, office leases ... you get the idea. A number of these expenses can be paid straight out of the income generated from internet subscription fees. You're taxed on what's left over, meaning that your _personal_ income from the business is lower, you're taxed on a lower tax-bracket than you otherwise would have, even though you can do a lot more with the money. As a disclaimer, I'm not describing or encouraging a "tax shelter"; it isn't sensible to sacrifice profits just to be able to cut the amount of taxes you have to pay.

You're right about the corporate double-tax. If you're not actively involved in the corporation, then a dividend is not bad considering the time spend in it, even if it is double-taxed. I'm sure you're also aware that if the corporation compensates you through a W-2, say as a director or as a consultant, then there isn't a double-tax. You just have to spend more time.

So to conclude this, I shouldn't have said that earned income is taxed much higher than passive income. Instead, I should've said that bigger chunks of your earned income gets taken away than from your passive income. But my guess is that you already know this. The important thing about passive income is the time you free up, not the taxes you may or may not save.

</comment></comment></comment></comment><comment><USER8> I wonder why they are publishing this now (well, last Monday). I read about this paper in an Economics class about two years ago. Naturally, the paper itself is a lot more interesting than the news blurb.

"Would You Be Happier If You Were Richer?" [<http://www.princeton.edu/~ceps/workingpapers/125krueger.pdf>]

</comment><comment><USER9> Interesting. I guess the article is sort of just saying that the rich people were already working hard, which is what GOT them rich in the first place? People who aren't rich stay not rich because they sit around all day watching TV.

<comment><USER10> I think it depends on how the person got rich.. working their asses off, or making it big after a hot music single, etc. Not that musicians don't work a lot, but there are some songs where I wonder how that crap ever got on the radio.

<comment><USER11> I think the average income of people _trying_ to make it big on one hot single puts them firmly in the <$20K category.

The rich people I know work incredibly hard when they have to.

</comment></comment></comment><comment><USER12> I'd be more interested in knowing how the _really_ rich spend their time. Not the $100K+ folks -- a group which is mostly composed of plain ol' hard-working types with good jobs, but the people who are rich enough to retire but young enough to work.

There's plenty of anecdotal evidence about these folks, but I'd be interested to hear the statistics.

Gee, people who make under $20K a year spend a lot of time watching TV? Who'd have thunk it?

</comment><comment><USER13> So people basically see rich people as doing what they themselves would do if they had lots more income appear magically.

Yeah, so, turns out that's not how it happens. And yet, that would seem to be the cause of many popular misunderstandings of wealth and the rich.

</comment><comment><USER10> "Money can buy almost everything, and the things that it can't buy are free anyway."

Once said by an interesting Danish millionaire.

</comment><comment><USER14> _Money doesn't buy happiness; it just helps you arrive in style._ \- Tony Robbins

Once you eliminate low outlying cases (people who can't afford the basics), I have witnessed little correlation between money and happiness. I know lots of people of ordinary means who are thrilled with life and are a pleasure to be with. OTOH, I dread spending time with many people I know that do have more money than most. They seem like they've lost focus on what really is important. (I don't want to hear you complain about people who work for you and I certainly don't care who you're suing; did you call your mother today?)

Just my experience. I suspect others have witnessed the same.

<comment><USER15> Your quote reminded me of this goodie:

"Money can't buy happiness, but neither can poverty" - Leo Rosten

<comment><USER16> "Work doesn't necessarily make you happy, but it may give you the money to do the things that make you happy" - from HS valedictory address by a smart kid who I knew when he was wee tall

</comment></comment></comment><comment><USER17> When you are rich, you can delegate. You can have people organize for you, cook for you, clean for you, do errands for you, etc. You get to decide what you spend your time on.

</comment><comment><USER16> True wealth is how long you can live and maintain your preferred lifestyle...without working (e.g. having a job vs multiple streams of income)

</comment><comment><USER18> "Dear George: Remember- No Man is a Failure who has Friends", writes Clarence.

</comment><comment><USER19> $100k/year isn't really "rich", and most people in this category are going to be middle-class, so this doesn't really establish much about how "the rich" spend their time.

Also, the amount of time that someone spends in "compulsory" activity does not necessarily indicate poor fortune. A good job is infinitely more rewarding and fun than watching TV. People are happiest when they're busy, but have a great deal of autonomy in what they are busy with and how they do it.

I'm not one of "the rich", but I live in New York and can offer my perspective on their lifestyles. I've noticed that sons and daughters of wealth tend to be shiftless, unhappy people. They lack discipline on account of never having had to learn it, and the absence of structure characteristic of their lives, as well as those of most of the underemployed <$20k people, leads them to low- utility activities (goofy hipster parties for the trust-fund kids, TV for the poor) and a collapsed sense of purpose.</comment>