Close encounters of the classified kind - <AUTHOR> http://www.thespacereview.com/article/3277/1 <comment><USER2> Very interesting.

If I recall the details correctly, there have been observations recently of another NRO satellite in a geostationary orbit above the middle east and west Asia, that apparently can maneuver and reposition itself.

And if I'm still not mistaken (may have been a different satellite) it was confirmed that this satellite had extraordinarily high communications bandwidth and was speculated to be used either for SIGINT or for operating UAVs.

Anyone interested in it, other classified satellites and classified things on the map in general should look up Trevor Paglen. He's a Geographer who's recently begun taking pretty spectacular shots of classified satellites.

<comment><USER3> > it was confirmed that this satellite had extraordinarily high communications > bandwidth and was speculated to be used either for SIGINT or for operating > UAVs.

Given that the recently launched civillian satellite Viasat-2 has a bandwidth of 300Gb/s and a reported expected latency of about 25ms, its not hard to imagine that a classified satellite like this may have crazy high bandwidth and low latency, perfect for reconnaissance, SIGNINT or operating UAVs.

<comment><USER4> Not sure where you got the 25ms number from. Viasat-2 is in geostationary orbit at 35000km. The roundtrip speed of light delay alone is 240ms.

<comment><USER3> I'll try to find the source. I guess it must have been mistaken given what you said.

EDIT: Haven't found the source. I did find that the existing ViaSat-1 latency (on Exede, and actual ping times not satellite->ground latency) is 600 to 700ms, so that's roughly in line with what you said. Exede do a bunch of latency compensation where they can so people often report lower latency, but for eg online games that obviously won't work.

I also know that what I read before was specific to airplane in-flight internet, although I doubt commercial flight altitude make any difference to latency, so that's likely an irrelevant point.

</comment></comment></comment></comment><comment><USER5> A test and demo of capabilities such that Russians and Chinese notice is the most plausible explanation I'd guess. Not sure if they cared if amateurs noticed or not.

<comment><USER6> It's impossible to hide anything in leo from Russians or Chinese. They have their own radar and telescope surveillance networks. They always notice.

<comment><USER7> Stealth satellites aren't impossible given that all the tech has already been developed for Earthbound use, and unlike aircraft you only have to make the Earth-facing side stealthy.

<comment><USER8> How do you make the stealth satellite not block star light as it passive in front of them from the perspective of a ground based observer?

</comment></comment></comment></comment><comment><USER9> Anyone know what software they use to do the Vimeo video in that article? I've been wondering for a while, when I've seen videos like that...

<comment><USER10> Often either STK (expensive, but there is a free version) or CNES VTS (free)

Source: I use them both at work.

Links:

[https://www.agi.com/products/engineering- tools](https://www.agi.com/products/engineering-tools)

[https://logiciels.cnes.fr/content/vts](https://logiciels.cnes.fr/content/vts)

</comment></comment><comment><USER11> Allow me to don a shiny new cap of quality Reynolds aluminum foil and say this.

If it was meant to be observed, and if it was intentional, and if it was nearly "danger close", couldn't this suggest that USA 276 is a platform in development not just to deploy sensors for observation but perhaps to, in the future host systems for engaging and destroying satellites.

<comment><USER12> Would there be a necessity to get close to a satellite to destroy it? Some sort of rocket could be launched from quite far away without needing much fuel if it was already in a similar orbit.

<comment><USER13> No need for such a complex solution, the Chinese just launch a missile from the ground: [https://en.m.wikipedia.org/wiki/2007_Chinese_anti- satellite_...](https://en.m.wikipedia.org/wiki/2007_Chinese_anti- satellite_missile_test)

<comment><USER14> So do the Americans: [https://en.wikipedia.org/wiki/Operation_Burnt_Frost](https://en.wikipedia.org/wiki/Operation_Burnt_Frost) .

If you can get close to a satellite however, you can take photo's from up close or from arbitrary angles. Spy agencies might be very interested in this. You could conceivably also put in inside your cargo bay and bring it back to the surface for 'disassembly', though its owners would probably be unhappy about that.

<comment><USER15> You mean like they did with the space shuttle? :)

</comment></comment></comment></comment></comment><comment><USER16> Huh, I thought that orbit details of all satellites was tracked. If not, collisions probably become much more of an issue.

<comment><USER6> They are. Not everything is published. In US tracking is done by military, not NASA.

<comment><USER17> In North Dakota, at Concrete.</comment></comment></comment>


Pen testing high heels - <AUTHOR> https://imgur.com/a/c4WNF#PEc4q1x

<comment><USER2> "Computers in shoes" has a history. People might be interested in "The Newtonian Casino" / "The Eudaemonic Pie" \- the true story of a bunch of hackers built a computer in a shoe to predict where a roulette ball would land. In early 1980s.

[https://en.wikipedia.org/wiki/The_Eudaemonic_Pie](https://en.wikipedia.org/wiki/The_Eudaemonic_Pie)

<comment><AUTHOR> Thanks for that link - very interesting!

</comment></comment><comment><USER3> I would have seen her in a James Bond movie I would have thought "yeah right, IRL nobody in IT is like that".

<goes back to his all male team>

<comment><USER4> I'm in two minds about her approach. One the one hand I feel it cheapens the image of female hackers. But on the other hand I want to congratulate her for exploiting a stereotype to her advantage.

It's just a pity that the tech industry as a bias to begin with. :(

<comment><AUTHOR> Yes, it is a bit sexist. However, in reality, people are sexist and most IT or security people are male, so she could distract some of them.

Using distraction and misdirection is a useful tool, something male hackers would find harder - all the more reason to add more diversity to your pen testing team.

</comment></comment></comment><comment><USER5> Ah, this is the same LED skirt techie--I thought there was another on HN. Good on ya!

</comment><comment><USER6> HN is now officially reddit</comment>


When licenses attack - <AUTHOR> http://www.b-list.org/weblog/2009/jul/14/licensing/ <comment><USER2> _Now, suppose your application also needs to do SSL. Python has a module for that, but what happens if you use it? Well, now you're also interfacing with OpenSSL, which has a viral advertising clause in its license._

He's not the first to notice the OpenSSL license issue[1], but luckily there is a very easy solution -- the GNUTLS[2] library is available under a less poisonous license, and has Python bindings[3].

[1] [http://blog.pierlux.com/2009/05/12/pythons-hidden- poissoned-...](http://blog.pierlux.com/2009/05/12/pythons-hidden-poissoned- apple-for-gpl-applications/en/)

[2] <http://www.gnu.org/software/gnutls/>

[3] <http://pypi.python.org/pypi/python-gnutls>

</comment><comment><USER3> How coume the GPL is so anti-attribution anyway? What would be so wrong if it (GPL) had a requirement for anyone distributing code to maintain any attribution left behind by others?

So I'd have to keep a Help/About with a long list of names. Big whoop.

<comment><USER4> No doubt there's someone much more knowledgeable than me, but GPLv2 wasn't specifically anti-attribution, but anti-any-additional-requirements. GPLv3 specifically allows some limited forms of attribution.</comment></comment>


Y Combinator Abruptly Shutters YC China - <AUTHOR> https://techcrunch.com/2019/11/21/y-combinator-abruptly-shutters-yc-china/ <comment><USER2> Discussion from last week: [https://news.ycombinator.com/item?id=21597763](https://news.ycombinator.com/item?id=21597763)

</comment><comment><USER3> I'd love to assume this had something to do with government abuses and overreach that YC couldn't condone, but call me cynical, im not holding my breath.

Also, I wonder if when asian businesses consider starting up something in the US if local news write articles like this. E.g.:

"That there is no mention of the uncertain international politics and U.S.-China relations right now, nor the explosive situation in Hong Kong, or ongoing human rights issues elsewhere in the country, seems a deliberate choice to make this move seem as ordinary as possible. But those things are major questions for anyone looking to do business in [the US], and it's hard to believe none had any bearing on the decision to abruptly pack up and leave a major enterprise behind."

<comment><USER4> If that was the case, then YC should certainly think about exiting the US market as well. Due government abuses and overreach. Wars.... Always we have wars... Concentration camps for immigrants. Torture sites (EU and Asia) and people locked up with no judicial oversight (Gitmo (operated in a communist country).. Mass surveillance.

Operating out of Sweden or Switzerland would be much more desirable if they care about human rights and government brutality.

<comment><USER3> I agree. But they don't care. Nor do they care about anything happening in China. That was kinda my point. In a way i guess i'm happy they didnt claim it was for some sort of humanitarian reason like many have in the wake of the blizzard thing. They're all lying.

</comment></comment></comment><comment><USER5> The author seems to be trying to drum up controversy where there isn't really any.

</comment><comment><USER6> All businesses in China beside your neighborhood street vendors, noodle joints, corner stores, etc, are required to have a Communist Party Commissar stationed at their top management to control the company when needed.

Major companies (e.g. Huawei, BABA, BIDU) are already "Party owned" (via some complex ownership structure to hide the party behind), or in the process of being transferred to Party owned. Note: Party owned, not state owned. In China, the Party owns the State, and the army. (Can you imagine Republican (or Democrats) owned the US Army?!)

You may start out as a "no-one-cares" startup business, but once you get to certain size or they recognize you as a potential unicorn, they will coerce you to give up part or all of your ownership or insert their Commissar, because the Party cannot stand anyone beside itself to have any influence.

It is the policy of China under Xi Jinping since he gained power, and we are now seeing the effect of it.

<comment><USER7> Huawei sure, no one knows who really owns/controls them. But Baidu, Alibaba, actually have fairly transparent ownership structures, they aren't that subject to party control beyond say an American company operating a branch in China.

<comment><USER6> China would not hesitate to use your Chinese branch as a leverage to influence your business even in the US, e.g. Airlines, NBA, etc. Unless you are decoupled from China, you are not immune.

<comment><USER8> Same goes for the US. US will use branches of foreign companies to leverage its rules.

</comment></comment></comment></comment><comment><USER9> Funny enough, I was thinking about this last week and noticed that they hadn't said anything at all about YC China in a long time. I had figured that they'd quietly abandoned the effort, walking it back the same way that the media is letting Mike Bloomberg walk back his presidential campaign.

People jumped all over them when they announced it. I think every city and town in the world has been asking for YC to come and when they refuse everybody in countries where there is rule of law, private property, etc. and then endorse communism that was a problem.

For instance in most countries if we have a labor union somewhere or regulate something it seems we are not liberal enough so capitalists will invest elsewhere. China doesn't pretend to have free markets at all but billionaires want to invest there.

It is nice seeing people who were up in arms about Trump's abortive "Muslim ban" are waking up to issues of ChiComs vs Hong Kong, Tibet, Uyghurs, etc.

In the meantime it is a source of extreme stress on western democracies that we're told we will lose investment if we are not neoliberal but then see that investment go to a place that doesn't believe in any rights for anyone whatsoever.

</comment><comment><USER10> People should be more concerned about the possibility of a future war with China.

There needs to be some kind of political and cultural integration. If not, resource and territorial contention as well as worldview differences may come to a head and be resolved through violence.

These are extremely difficult problems and a very dangerous potential outcome of we fail. We should be making dramatic efforts towards integration.

One idea: the lunar mission should be prioritized and be led by a joint China/US team.

</comment><comment><USER11> The article is looking for gossip where none exists. If the guy leading the charge into China is stepping down, that's entirely sufficient to drop it.

If it's not a well-established and ongoing concern, a bus factor of one is wholly plausible.

[https://en.m.wikipedia.org/wiki/Bus_factor](https://en.m.wikipedia.org/wiki/Bus_factor)

<comment><USER12> The the question arises why did he (Sam Altman) step down?

<comment><USER13> Cause it's a 14 hour flight each way.</comment></comment></comment>


Why is ssh insecure by default?  [AllowTcpForwarding] - <AUTHOR> http://kitenet.net/~joey/blog/entry/ssh_port_forwarding/

<comment><USER2> I don't think it's a bug to assume that ssh is normally used with shell accounts. If you can run a shell on the server, you can open TCP ports. Sure, you could argue that defaults should be set to the most security-paranoid values, but that's really not common practice in any project. Yes, the sysadmin should go through the SSH config file, and not just use the defaults that come with the sshd.

<comment><USER3> I've set up authpf for a couple of clients that want remote access to internal systems without exposing those systems to the outside.

So, in that particular example, ssh port forwarding by default is not desired behavior, because the user isn't granted a full shell for authpf. However, they're considered "trusted" users, so it's not a security problem from a practical standpoint.

However, if I were running a similar service, but more broadly, for "untrusted" users ... then it would be a problem.

While someone might argue then that as a sysadmin I should examine the default settings and modify them according to the needs at hand -- and I would agree -- I could also argue the reverse: that argument is equally valid for disabling ssh port forwarding by default.

In the end, as with most defaults for security-sensitive systems, it should come down to expected behavior. That is, someone who needs ssh port forwarding will know they need it, and can go looking for that particular knob to turn. However, someone who _doesn't_ know about ssh port forwarding should not be expected to go looking for it and disable it in order to not get caught by surprise later on.

It should be disabled by default.

</comment></comment><comment><USER4> Github appears to handle this correctly

        $ ssh -L 1234:irc.perl.org:6667 email@example.com -N
        channel 2: open failed: administratively prohibited: open failed
        ^C

But anyway, this is not a huge deal. It is only available to vetted users (those with git/cvs/whatever accounts), and that "Unauthorized use is prohibited" banners that show up when you log in should cover the server admin's ass when someone does something illegal. It is no more "a threat" than an open wireless access point.

<comment><USER5> What's the point of declaring "this is not a huge deal"? This, like an open wireless access point, _can be_ very huge deal depending on the network/organization in question.

Moreover, a "vetted" user is any user that has acquired a vetted user's SSH keys or password. With individuals regularly SSH'ing from remote, compromised machines, this happens all surprisingly often.

<comment><USER4> All I'm saying is that the world is not coming to an end. Yeah, people can send spam or something. So keep it turned off. But the sky is not falling.

<comment><USER5> _All I'm saying is that the world is not coming to an end._

I never realized the issue existed when I've used command-limited SSH, and I should know better. The OpenBSD developers and administrators should _really_ know better.

I'm actually embarrassed that I didn't recognize the issue, and I'm glad someone noted it publicly so I won't repeat the mistake.

 _Yeah, people can send spam or something._

[http://openbsd.org:8080/pub/OpenBSD/OpenSSH/openssh-5.2.tar....](http://openbsd.org:8080/pub/OpenBSD/OpenSSH/openssh-5.2.tar.gz)

Are the contents of that URL trustable?

What about bypassing firewall restrictions?

 _So keep it turned off. But the sky is not falling._

Who said it was?

<comment><USER6> You can do a lot more than that with CVS access. CVS is not secure. If you have write access to the ADMIN directory you can run arbitrary programs via CVS.

And if you have no write access, then what is the point of running it via ssh anyway? BTW giving someone write access to CVS without also access to ADMIN is a lot harder than it looks.

Running restricted account via SSH is not very common, while shell account via SSH is, so in that light the default is correct. It is really really hard to properly secure a restricted access account. So if you are going to do it, it's your job to do it properly.

</comment></comment></comment></comment></comment><comment><USER7> Allowing TCP forwarding by default is not "insecure." The author of the article states that the SSH manual's justification for leaving it enabled by default is not valid because, "have you ever tried to install a forwarder on some random shell account?" Well, doing so would be trivially easy.

<comment><USER8> You read the article.. but apparently only one throwaway line and not the actual meat. Good try tho.

<comment><USER9> You are somewhat right here, it should probably be disabled by default, but I believe you're misinterpreting what the docs say.

      AllowTcpForwarding
            Specifies whether TCP forwarding is permitted.
            The default is "yes".  Note that disabling TCP
            forwarding does not improve security unless users
            are also denied shell access, as they can always
            install their own forwarders.

Basically this says, disabling TCP forwarding doesn't add any real security UNLESS your users don't have shell access. This is not a throwaway statment because many SSH accounts do not have shell access. For example, my Rsync.net backup account allows me to access it over ssh, but I can only run predetermined commands, that are deemed safe by the sysadmin (ls, cp, mv, etc, AND in a jail). So in this case disabling it WOULD add security, since I don't have real shell access. Also, it is quite easy to install a tcp forwarder as long as you have some access to any real language interpreter.

At my university, they throttled speeds for the residential network, so I compiled a simple java socks proxy and ran it on one of their servers that I had student access to, which allowed me to bypass the speed restriction. Hell, if you wanted to, you could cook something up with bash and netcat. To summarize, this is a great feature to have, and also one I use often. At most, it should be disabled by default, but in most cases it won't matter since people who can use it usually have shells too.

And really, this is what sysadmins get paid to do!

</comment></comment></comment><comment><USER10> For some definition of "insecure", when you happen to use OpenSSH for a relatively uncommon use-case, with the end result of disabling functionality which is useful for many legitimate users in the common use-case.

</comment><comment><USER11> Does anyone have a link for a guide on how to set up sshd in the most secure fashion? (i.e. the contents of the sshd_config file)

</comment><comment><USER12> This article reminds me of typical Linux tutorials in China, often there's a post on some Web-based forum, type command X, type command Y, and your server is up. In one particular thread on how to setup vsftpd, someone replied 'my server ftp.xyz.com is working fine', I tried SSH to ftp.xyz.com with the _ftp_ account and it works. I don't know how many other Linux step-by-step tutorials are flawed that way.

> And if the reader is in China -- hey, this is a great way to get around the > Great Firewall ...

Yeah there's lot of ssh scanner going on in China

</comment><comment><USER13> SSH port forwarding is used EXTENSIVELY in enterprises to provide mutually authenticated secure tunnels for services that either don't do SSL, or don't do it correctly. Smart security teams won't allow SSH or SFTP through their perimeters because of things like this, but default disabling port forwarding would probably break more things than it would fix.

The real issue here is that people are casual about giving SSH accounts (limited or otherwise) to strangers. That's a mistake.

<comment><USER14> What'd be useful is a mode of sshd designed specifically for limited-access cases like CVS.

</comment></comment><comment><USER15> SFTP/SCP and other applications that use SSH for transport encryption work by invoking commands once they have a shell on a remote machine. (A user can be given a shell that limits the commands they can execute to only those needed for such services.)

The problem occurs when an admin does not know what the daemon they are running on their machine does. The article is placing blame on the SSH daemon maintainers for making it easy to run their daemon in a way that exposes features that the admin would not want to knowingly expose.

So blame could be placed on: * the admins who unintentional leave their machines using such configurations * the developers of services which function over SSH, for using a design that makes it easy for an admin to unintentionally use such configurations. * the developers of the SSH daemon for not designing their software to prevent misconfiguration when it is used to encrypt the communication of other services

[excuse me if I sound hostile, I've had a fairly bad day]

<comment><USER15> Looking at various docs, I'm not certain that SFTP functions in the same way as SCP/etc. [have to look at this in more depth at another time]

</comment></comment><comment><USER16> I would suspect most typical systems do not have ssh authenticated users users who can not get to a login shell. If you are making accounts like this I think you should have a firm enough grasp on systems administration to avoid this problem.

</comment><comment><USER17> This article is silly. You can't grab low ports without root. This setting does nothing because users have privileges to grab high ports anyway. For example, they can write simple scripts to listen instead of using SSH for it.

On the other hand, SSH forwarding is extremely useful and serves as a nice alternative to VPN when you need it.

<comment><USER18> Maybe you didn't read carefully enough. Users _who don't have shell access_ probably should not be able to proxy traffic through the server, but OpenSSH allows it by default.

<comment><USER17> But you have to set that sort of user account up specially, at which time you can disable tcp forwarding. What he wants to change is the sshd default.

<comment><USER14> I agree with the poster.

There are two situations:

1) Nonshell use only -- you want port forwarding turned off. Unless you're using the machine as a proxy, it's just waiting to be used as part of a larger hack scheme.

2) Shell use only -- Normal logging in and shell use doesn't necessitate port forwarding. The only time it is generally useful is for forwarding X11 back to the client, but frankly that's not nearly as useful as it was 10 years ago. If you've got an X install on your server, and an X server on your client, then you're in a sufficiently-select subset of the user population to have to turn on one config option in sshd_config.

In either case, I think it should be turned off by default.

</comment></comment></comment></comment><comment><USER19> Idiot. Wait for Theo to comment on this one. It's surely be a laugh.

<comment><USER8> So, Theo was told around 1999 that the OpenBSD cvs server allowed port forwarding. And then told again, in 2002, by someone else, in a message sent to bugtraq ([http://marc.info/?l=bugtraq&m=109413637313484&w=2](http://marc.info/?l=bugtraq&m=109413637313484&w=2)), about the same problem, and apparently fixed it at that time. And yet in 2009 at least 3 of the OpenBSD cvs servers once _again_ have the same problem.

I assume you're not calling me the idiot? -- Joey Hess

<comment><USER20> _And then told again, in 2002, by someone else, in a message sent to bugtraq, about the same problem, and apparently fixed it at that time._

that bugtraq message says "OpenBSD cvs servers", as in, the anoncvs mirrors that are setup by volunteers, many of whom are not openbsd developers. we don't control any of those servers. an email was sent out to all of the mirror maintainers years ago telling them that they should probably disable the forwarding if they didn't know it was on.

 _And yet in 2009 at least 3 of the OpenBSD cvs servers once again have the same problem._

the list of mirrors is updated constantly (<http://www.openbsd.org/cgi- bin/cvsweb/www/build/mirrors.dat>). old mirrors drop off, new ones come on. if new ones are allowing tcp forwarding for anoncvs and they aren't aware of it, email them. clearly it bothers you more than it bothers any of us.</comment></comment></comment>


Often neglected skills new and junior web developers should learn? - <AUTHOR> Obviously learning to program is only one part of the equation when learning to become a Web Developer.<p>What are some skills, concepts, tools, etc that often seem neglected and should be learned by new/junior developers to help them in the early parts of their career? <comment><USER2> 1) How to communicate with people. Master that and the world is your oyster, minimize/ignore it and you're setting yourself up for a lifetime of subpar results and hand wringing.

2) cli tools (make/awk/sed/etc, getting just a base proficiency pays huge dividends in time savings over a career)

3) excel. Nearly all things business start and end with a spreadsheet, be able to at least stumble through one and understand the information it contains and the functions being applied.

<comment><USER3> I'm going to second communication skills. Soft skills can be much more important than hard skills for getting a job, keeping a job, and moving up.

</comment></comment><comment><USER4> Speaking as a junior dev who recently became a mid-level dev (although I still have some junior tendencies to iron out), learning how to solve problems is something that held me back.

When I was given tasks I would worry about the code itself and the stuff I didn't know instead of trying to clearly understand the problem and come up with different solutions.

</comment><comment><USER5> Its essential in my opinion , for junior web developers to familiarize themselves with the excellent resources and forums existing on the web easily searchable via few keystrokes on google. In addition to just visiting these websites just to search for solutions, they should also try and contribute , to understand that software development requires a highly collaborative environment to solve some of the most complex problems out there. This applies to both online and offline, where crowd sourcing a problem enables us to look at it from different perspectives and get to the most optimal solutions. These skills , they need to start teaching in colleges.</comment>


Warrantless cell phone search gets a green light in California - <AUTHOR> http://arstechnica.com/tech-policy/news/2011/01/warrantless-cell-phone-search-gets-a-green-light-in-california.ars <comment><USER2> The police do not require a warrant to search your immediate person (also your bags and your car) incident to an arrest.

They can't search you _without_ arresting you, and they can't arrest you for literally no reason and have that stand (and, apparently, they generally won't arrest you for no reason if you don't provoke them while being detained _and_ sound like you know enough to tell a lawyer what's happened). "Arrest" has a very specific meaning and is a big deal.

This guy got arrested, apparently during a hand-to-hand drug sale to an informant. He was screwed no matter what.

There are grey areas at play here, but if your phone has no security and they can literally just push a button to see your text messages, I'm not even remotely surprised that what they find there is admissable as evidence. They had the contents of your pockets and your bag. If you had "4 for 80" written in a piece of paper (and, damn, X is expensive!) in a notebook in your bag, that would _clearly_ be admissable after an arrest. Why is your phone different?

If you don't want this to happen to you, PIN-lock your phone. They'll ask you for the PIN. You'll refuse. They'll get a warrant almost instantly, and then you won't be able to refuse anymore. So, also, if you don't want this to happen to you, _don't get arrested._

This headline is extremely misleading. The police in California cannot simply dragnet cellphones. They have to arrest you first.

<comment><USER3> _If you don't want this to happen to you, PIN-lock your phone. They'll ask you for the PIN. You'll refuse. They'll get a warrant almost instantly, and then you won't be able to refuse anymore._

I was under the impression that in the US you can't be compelled to disclose your password or encryption key, even with a warrant.

<http://en.wikipedia.org/wiki/Key_disclosure_law>

<comment><USER2> It looks like you're totally right to point this out, but the situation is not "you have the right to refuse to disclose a key"; its, "you may or may not also be charged with obstruction if you refuse a warrant that demands a key, and the case law isn't settled".

Since we're talking about PINs here, by the way, this is a moot point; presumably any major LEO can contract out "recover data on PIN-protected phone".

<comment><USER4> Having worked for a computer forensic software company I can tell you that these days they most likely don't have to contract it out even... It's cheap enough that a lot of departments have people on staff who can recover data easily from all kinds of devices.

<comment><USER5> If you use the SIM cards SMS storage (on a GSM phone) it's not that trivial to obtain the PIN. However, it's very likely that your mobile provider is able to gain access to the card (e.g., by using the PUK code to reset your PIN code).

Other means would be to use an application such as TextSecure (for Android) that uses public key encryption to immediately enrypt all incoming SMS and that requires a password to unlock the private key needed to decrypt the SMS.

In the long-term what I'm waiting for is some open-source Android fork that provides full-root encryption using LUKS. This should suffice in preventing others from reading your messages.

</comment></comment></comment></comment></comment><comment><USER6> I wonder how this would fare if the device had been secured with a PIN or some other password. Are we now back around to a situation similar to the warrantless searches US Customs and Border Patrol can do when crossing a border?

Edited to add: I just perused the decision linked to in the article[1] and it doesn't appear that the court addressed that issue. The majority's decision does make reference to a "locked footlocker" that was opened without a warrant, and that the US Supreme Court ruled that the search was invalid because it was "distant from the arrest." It doesn't seem to address breaking open the lock.

1 - <http://www.courtinfo.ca.gov/opinions/documents/S166600.PDF>

<comment><USER2> No. If you had read the article carefully, you'd find that the person who had been searched had already been arrested (and with very strong PC). Every ACLU- style "Know Your Rights" video makes this distinction clear: it is _not_ like at the US border, where you can be searched for no reason; there are very specific cases where you can and can't refuse searches.

Unlike --- I might add --- large stretches of Europe, where police have far stronger rights to search personal property.

<comment><USER6> I understand that the person had been arrested and was in custody. The question I have is whether or not the police could have demanded the password from his phone if one existed, and what consequences would result from his refusal to provide it. The reference to CBP's searches is that there is some question as to whether or not someone must provide the password to a secured device during an otherwise-legal search.

<comment><USER5> I was under the impression that there is no law in the US that requires me to surrender my password. Has there been any court decisions requiring people to surrender passwords?

<comment><USER7> No, there haven't been. There is always unencrypted evidence, so nobody really cares.

</comment></comment></comment></comment></comment><comment><USER8> This seems quite dangerous, as we push more and more data into the cloud and use cell phones as the a way to access it. Does this mean when you are arrested, they can read all your emails, get your bank information, amazon shopping history, etc as long as the access is on your phone? If you have a laptop can they do the same thing?

<comment><USER2> There's going to be an interesting Supreme Court case when the police bother to recover a Gmail session cookie from someone's phone or laptop and use it to dive into their email. My guess is the Gmail account owner will win, because when you seize my housekey during an arrest, you do not get to search my house.

The reason this hasn't happened already, though, is that the police aren't generally trawling through the Gmail accounts of drug suspects. They have more drug suspects on eyewitness and hand-to-hands than they can deal with; read _Cop in the Hood_ for examples of state prosecutors refusing to pursue cases because drugs seized from suspects "could, for all the apprehending officer knew, have been an Oreo cookie".

This is mostly just a fun topic to chatter about.

</comment></comment><comment><USER9> Can they compel you to give your phone's password? Otherwise, when in Cali I'm just going to use a password to lock my iPhone

<comment><USER2> Password locking your iPhone is not a forensically secure technique. A better idea would be to keep anything incriminating off it, and (obviously) not to get arrested.

<comment><USER10> I know that the iPhones are notoriously bad at securing data when the device is on, but what about the remote wipe option? It's my understanding that 3GS and 4 phones have encrypted HDDs, with the remote wipe clearing the keys. I'm no expert, but wouldn't that be equivalent to any other disk encryption technique (which, to my knowledge, is practically unbreakable if keys are unavailable)?

<comment><USER11> If they power it off, using the same exploits as the iPhone jailbreaks (and using forensic tools by Jonathan Zdziarski; <http://twitter.com/JZDZIARSKI>) they can easily recover the data.

Before the boot-up ROM used on the iPhone was exploited, though, this was much more difficult (if not impossible).</comment></comment></comment></comment>


2018 Desktop Linux Platform Issues - <AUTHOR> https://media.ccc.de/v/ASG2018-174-2018_desktop_linux_platform_issues <comment><USER2> Honestly, the Linux desktop war has been won by Debian/Ubuntu. I know of no casual Linux desktop user who's not on Ubuntu, or a Debian version that's sufficiently close.

Packaging for Ubuntu first and having a tarball that any other use can play around with to get running is fine for most commercial software's needs. Chances are if you're running Slackware, Gentoo, Nix, or other non-mainstream Linux distros you'd be hard pressed to use commercial software anyway.

</comment><comment><USER3> I'm sympathetic but it's tilting at windmills. These are the exact same things people were arguing about 20 years ago- if only everyone in the desktop Linux world would all agree to standardize on a bunch more high-level common things (package managers, desktop environments, etc.), then some form of desktop Linux would become a juggernaut that would steamroll Windows and take over the world.

Arguably Android has achieved the role of Windows in the mobile world, but not because the Linux community collectively all agreed to standardize on it. The fact that it's Linux under the hood is almost incidental to its success. I don't think that's the kind of victory he wants though. 20 years ago there was a sense that desktop Linux would just magically converge, eventually, to effectively a single platform. But there's never been a critical mass of support for any one distro or desktop that caused all competition to wither away.

There may absolutely still someday be a popular form of desktop Linux that can go head to head with the big players in terms of market share, but if so I don't think it will be referred to as "Linux", and most users won't even know that they're using a Linux/GNU/etc. system. Maybe ChromeOS can get there, who knows. But that's likely not what he wants either, he wants what so many people thought was inevitable 20 years ago. I would never dissuade anyone from trying to make that a reality, but I personally lost hope many years ago.

<comment><AUTHOR> > There may absolutely still someday be a popular form of desktop Linux that > can go head to head with the big players in terms of market share, but if so > I don't think it will be referred to as "Linux"

I agree. The Linux Desktop community has proven over several decades that it is simply not up to the task of doing what needs to be done to put together a good Desktop OS. If the Linux kernel starts being a serious contender on Desktops it will be because someone has completely replaced the userspace that currently sits above it and given it a new name to differentiate it from all the problems of the Linux Desktop. I thought google might do this with Android, but it seems that they aren't really interested. Even their recent additions to ChromeOS seem to be only targeted towards enabling web dev workflows.

<comment><USER4> Android is all about their version of Java, the NDK is there only as helping hand for implementing native methods, importing code from other platforms, audio and 3D graphics.

Brillo was supposed to be Android with userspace C++ for IoT, until it got rebooted as Android Things, having features that regular Android still lacks, like userspace drivers in Java[0].

Which is understandable from the point of view of security, but also shows how the actual kernel is mostly an implementation detail for the large majority of app developers.

[0] - Actually Treble allows them as well, but in a different way.

</comment></comment></comment><comment><USER5> Short version and my own rant (IMO)

Desktop application developer should write their software for ONE _Common Linux Desktop_ (abstraction).

This would defines all rules on how fundamental things must be done and includes _everything_ concerning desktop applications.

The developer must not care about Gnome, KDE, Ubuntu, Xfce, .deb, flatpack, Snap or whatever, because this is insane and beyond stupid.

1\. Desktop environments, Frameworks like Qt and Gtk and Distributions need to support the ONE set of Linux desktop rules.

2\. Developers and their applications can rely on these rules only.

Until this happens we are caught in a infinite while loop.

while (1) { if (haveOneLinuxDesktopApi()) break; }

There's are already kind of that mindset given by Freedesktop.org, this work really needs to be embraced and supported more to bring relevant parties together before they decide to write yet another package format.

I think the main problem is not a technical one but that developers of desktop environments, package managing and frameworks for some reason don't reach out to each other and work on ONE common ground for the desktop.

Look at Snap and Flatpack, why on earth don't they work together for one solution and instead punish users and application developers again and again.

The current situation is a nightmare for users and application developers. There is not a single desktop application which benefits from this mess.

<comment><USER6> Only a philistine is looking at a robust interesting marketplace of ideas and bemoan the degree of choice which has never been a "nightmare" in any meaningful way to users.

It seems likely that the ultimate solution to making it easy to distribute proprietary/complex to package software on linux will end up being Flatpak because its pushed by but not owned by Redhat.

Regarding Snap Canonical wants to own the marketplace so that ultimately they can monetize this. Its a single market not a way of distributing software like apt. Since only Ubuntu will ever support it shockingly planet earth will ignore it and like most Ubuntu specific technology it will die on the vine. See upstart, mir, Unity for reference.

</comment></comment><comment><USER7> What is needed is a "dictator", like Linus is for the Kernel, or Apple is for macOS, Google (to a lesser degree, but still) for Android.

This need to be someone that truly cares about a desktop experience, and backwards compability, like Linus cares for the ABI for Linux.

The only people doing anything remotely like this is Elementary, but it is very far from reaching any kind of critical mass. Also that its perceived as macOS clone hurts it.

I think if this ever happens it will be a company doing this, and it won't contain any kind of Qt, GTK, GNOME, KDE. Perhaps one of the big ones that currently lack a desktop platform. Lets hope is is free software.

<comment><USER8> Wasn't Mark Shuttleworth fulfilling this role for Ubuntu as the Benevolent Dictator For Life?

Ubuntu made great strides towards mainstream usability on the Linux desktop.

I think the GNOME project has a strong focus on design, with its Human Interface Guidelines going back many years.

<comment><USER4> Like Red-Hat before it, Canonical has given up the idea that GNU/Linux desktops would ever be profitable and like everyone else turned into the server and IoT space.

<comment><USER8> Fair point.

I think the market doesn't have room for another desktop OS beyond niche uses.

As in, why would a mainstream user go with Linux over MacOS or Windows?

Same deal with Android and iOS. Insufficient room or need for #3.

Also, apps/software. Devs don't want to support 3 OSs. Users don't want to switch to an OS missing software.

If Microsoft couldn't do it with Windows phone, I don't see why anyone else could.

(Although, I just recalled, Chromebooks exist, found a niche (education, grandparents) and found a monetization method (vampiring on user's privacy.))

Makes me wonder if Ubuntu could do a ChromeOS-like strategy. But without the data-sucking.

<comment><AUTHOR> > As in, why would a mainstream user go with Linux over MacOS or Windows?

How are you defining "mainstream"? Because in the context of the Linux Desktop, my experience is that people always define it to mean "someone who is exactly uninterested or stupid enough to win me this argument". Resist the urge to target some nebulous "mainstream" user because you'll just end up with another internet kiosk.

What should be being targeted are the kinds of people who use desktop computers for work and hobbies and actually like computers. Some will claim that that's what Linux Desktop does, but the evidence says otherwise. If you aren't a webdev or OSS zealot, chances are you aren't using Linux Desktop. Personal computing is a hobby I grew up with since the 80s and I don't use the Linux Desktop. There are people who've been in personal computing since before that who are outspoken critics of the Linux Desktop.

<comment><USER8> I think I get what you're saying.

Wouldn't a computer enthusiast be happy and comfortable with desktop Linux though? It's still hackable as you like and you can install a more.... I mean a less simplified desktop environment.

(I assume by "targeting the mainstream" you mean simplification of the UI, mostly)

I don't like any OS that oversimplifies, such as by removing advanced options (why not put them on another screen?) But I am a strong supporter of proper usability, including in Linux - just that things should be intuitive and simple at first glance, and aesthetically pleasing. As in I don't want the Linux UIs of ~2000 to return.

<comment><AUTHOR> I think you're confusing "simple" and "easy".

I'm a personal computing enthusiast and have been ever since I was hacking away on an old (even at the time) IBM XT in my bedroom as a school kid. I can use Linux Desktop just fine, I manage Linux servers as part of my day job, hell, I was once president of a LUG. Frankly I think the Linux Desktop is even worse for people like me than it is for the "mainstream" user, because the way Linux is duct-taped together from disparately developed components makes it difficult to reason about how it works, and modifying it in any meaningful way can often mean hours buried in documentation that may or may not be up to date (or correct, or even applying to your distro), or possibly even writing some C.

I could go on for hours about how Linux Desktop's "design" philosophy is in direct opposition to simplicity. It isn't about removing advanced options, or making things aesthetically pleasing, it's about having a system that functions in obvious ways, with few surprises and as little magic as possible, where the abstractions are shallow and consistent. Linux Desktop, though, is a hodgepodge at best and at worst a paper-thin wrapper attempting to hide a Rube Goldberg machine made of garbage.

<comment><USER8> Interesting take.

I agree about consistency and intuitiveness.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I think the Linux desktop works just fine. At times of shrinking desktop usage, the goal should be to preserve what great apps we have (Inkscape, Krita, GIMP, LO, FF, Thunderbird, and hundreds of others), rather than to come up with new grand unified package managers and GUI frameworks that only serve to put additional burden on actual developers of said F/OSS software. It's not that the alternatives are free of problems either. Have you recently used Windows 10? It's total spyware crap and only useful for gaming. What about Apple's laughably limited, and increasingly failing hardware? I think Ubuntu comes as close to a mainstream desktop Linux as it gets. And if you're concerned about becoming dependent on a single vendor, you can switch to Debian, or merge Ubuntu packages into Debian, or use Devuan, etc.

<comment><USER10> Overall, all of them are fine desktop environments.

But the thing is, if you're making a large application, for Gnome for example, then you can't by default be confident that your application can work very well on other desktop environments like KDE or XFCE.

I think this is what the speaker have meant: Linux Desktops moves many responsibilities on to you (You need to test your app against for each desktop environment for example). And sometime, that many responsibilities can be troublesome (burden, to say the least).

<comment><USER6> "But the thing is, if you're making a large application, for Gnome for example, then you can't by default be confident that your application can work very well on other desktop environments like KDE or XFCE."

This just isn't true. There are literally 40 different graphical environments available that can run X applications. If your target desktop has the required libraries for your app to work OR you have packaged them with your app it will work regardless of users desktop.

</comment></comment></comment><comment><USER11> My feeling is that we need to define a fixed point like an API at the interface of software developers and desktop designers.

The fixed point would allow developpers to develop apps that would compile and run on any desktops, and desktop or distribution designers need liberty degree to explore, innovate and evolve.

POSIX did this for the unix commands and system function API, and it was a success. It isn't perfect, but it provided a fixed point. Windows has Win32, etc.

<comment><USER4> There is a UNIX standard for GUIs, that "beautiful" Motif thing, which naturally is not something that consumers would like to deal with.

[http://www.opengroup.org/standards/unix](http://www.opengroup.org/standards/unix)

<comment><USER11> That's not an API. The goal is to let desktop developper inovate by keeping backward compatibility with desktop applications.

</comment></comment></comment><comment><USER12> I'm not sure I understand what he's getting at. What does it mean to run "on top of" vs "in"? What's the problem in saying, "To run our app you need to have libraries X, Y, and Z installed"? Is it a big deal to pick a font rendering library and tell users they need it installed to run your app?

<comment><USER4> It is when those users technical level is thinking that the browser logo is a synonym to turning Internet on, and call helpdesk when it isn't shown on the desktop.

<comment><USER12> The subset of people who need the help desk to "find the internet", but also install their own software is pretty small, and if that's the target audience then the software developer should know that and install the prereqs automatically - either bundled with the app (best option) or by bootstrapping of the OS's built-in package manager (apt, emerge, etc.).

People are generally more tech savvy than ever before, and we're past the point where developers needs to degrade the experience for everybody to target a small group of completely clueless end users.

<comment><USER4> That point of view is what makes regular consumers flock to Apple, Google and Microsoft platforms instead of GNU/Linux.

<comment><USER12> To be clear, I'm not trying to sell Linux, and I don't care whether people use it or not. In fact, if gaining users means dumbing things down then I'm happy they go elsewhere - it's probably best for everybody.

I was specifically curious what the presenter meant between "run in" vs "run on top of". I've used Windows, OSX, and Linux, and I don't understand what he's getting at. Software runs "on top of" Linux just as much as it does on top of OSX and Windows.

</comment></comment></comment></comment></comment><comment><USER13> [https://www.youtube.com/watch?v=SQ8OXf7o6UA](https://www.youtube.com/watch?v=SQ8OXf7o6UA)

<comment><USER14> Thanks for the direct link. The questions started at around 20 minutes which were valuable for the quality of the talk.

</comment></comment><comment><USER15> The way I see this going:

      1. Android is the popular mobile planform on Linux
      2. Fuchsia will be the popular desktop platform on Linux

Personally I would like to see other prominent options to both of these. We will likely end up in a situation like (1) for desktop as well if we wait until there is a large user base of (2) then decide that we need something less centrally controlled.

<comment><USER16> Fuchsia uses its own kernel called Zircon (previously Magenta).

</comment></comment><comment><USER17> Not sure I entirely get what the problem is. I am happy with my distributions NOT including stuff I don't want. I develop on Linux and maintain servers. I do not want anything unnecessary on those machines by default because it makes some developers life easier because he doesn't need to read the doc or search a nebulous error message to get dependencies anymore?

</comment><comment><USER18> Reads like a rant.

Linux software is backwards compatible if packaged for that purpose.

<comment><USER19> Yeah, it does read like a rant, but I think the suggestions are valuable. I've been using Linux since the first release of Slackware back in 1994, I believe. For a number of years, I developed desktop applications for Linux for some of the companies I worked at, but it was always a pain to support multiple distros and multiple versions of the same distro. I got tired of the effort after a while and moved to doing web-only programming. Then, in 2010, I gave up on Linux as a desktop environment altogether, simply because the user experience was so much better on macOS (OS X at the time).

I think having a standard that all distros adhered to that provided a common, universal baseline that developers could depend upon would go a long way toward increasing developer productivity, interest, and desktop usability.

<comment><USER18> We have a reasonable standard, Xorg.

Everything else you can package along with your application as a library. Steam does this farely well and manages to work on every distro I have tried, even when they officially support(iirc) just Ubuntu.

<comment><USER20> As a user with a HiDPI laptop that needs to connect to non-HiDPI external monitors, Xorg is not reasonable. macOS is way ahead.

<comment><USER18> When is the last time you have tried this?

I use KDE with Arch Linux on a 2015 retina mbp and often give talks on projectors that are 800x600. Everything works.</comment></comment></comment></comment></comment>


The State Pension Funding Gap - <AUTHOR> http://www.pewtrusts.org/en/research-and-analysis/issue-briefs/2018/04/the-state-pension-funding-gap-2016 <comment><USER2> Reading about municipal finance makes the freewheeling world of VC look positively conservative. E.g. there's this concept of a "13th check," at the end of the year in many poorly run cities. Basically, and surplus growth in the city's retirement funds were distributed to pensioners as a sort of annual bonus, rather than left in the general account to help make up for eventual shortfalls.

[http://www.mlive.com/news/detroit/index.ssf/2013/10/10_thing...](http://www.mlive.com/news/detroit/index.ssf/2013/10/10_things_to_know_about_detroi.html)

There's a serious moral hazard for politicians. It's easy to give constituents services today at the expense of benefits in the future, when they'll be out of office. I wonder if a law that clawed back these government official's pensions if they were found to break from good accounting practices, would be a deterrent?

<comment><USER3> I find this new wave of going after people's pensions to be super unseemly. All of this information has been public for decades, if you view the voter as "the board", there's culpability in not managing politicians and allowing this situation to spiral.

If we are going to be adults, these pensions are contractual and need to be paid out. It's not a responsible behavior to use retirement plans as weapons at the 11th hour.

<comment><USER4> > If we are going to be adults, these pensions are contractual and need to be > paid out

If we're going to be adults, we're also going to recognize that many of us were _not_ adults when these contracts were drawn up and signed. Many of us were never even born, and some of those who were of the right age opposed them to some degree or another.

Maybe we should recognize, in a truly adult fashion, that the mistakes of previous generations should not be passed on to the current generation. Maybe adults should recognize the math just doesn't add up.

> It's not a responsible behavior to use retirement plans as weapons at the > 11th hour.

It's not a responsible behavior to over promise pensions and bankrupt dozens of states either. Nor, in the pursuit of fulfilling those reckless promises, is it responsible to bankrupt future generations.

<comment><USER5> > _If we 're going to be adults, we're also going to recognize that many of us > were not adults when these contracts were drawn up and signed._

So are you okay with a future generation repudiating their contracts and obligations with you when you reach retirement age? After all, all of us are someday going to part of a "previous generation" and none of are so perfect that our generation has made no mistakes.

Why do so many people behave as if aging is something that only happens to other people?

<comment><USER6> That's why defined contributions in individual accounts make sense. The promise is made good on a paycheck-by-paycheck basis instead of decades in the future. And the amount contributed has to make financial sense now, which eliminates the risk of inability to pay.

There are solutions that provide the benefits of retirement without pitting young against old.

</comment></comment></comment></comment></comment><comment><USER7> In Kentucky, the situation is dire. KY's pension system is ranked as the worst in the nation across several metrics and agencies. The pension system was written into our constitution as an "inviolable contract" with state employees. [0]

Our current governor is the first to attempt to do anything about it in decades, and is being blasted by unions, the press, and the public for it. He's most likely destroyed any chance of re-election by pushing hard for reform. He also hasn't done a great job of building consensus, to be fair.

The NEA/KEA especially has vehemently disagreed with _any_ proposed reform. Teachers have walked out today in protest of a bill that _did not affect_ any current state employees.

It boggles my mind that people respond to this topic so irrationally. It's like a patient arguing with their doctor over a diagnosis of cancer.

[0] - [https://www.courier- journal.com/story/news/politics/2017/08/...](https://www.courier- journal.com/story/news/politics/2017/08/24/kentucky-pension-crisis-question- answers/549085001/)

<comment><USER8> The problem with Kentucky and many other states is that the politicans raided the pension fund during good times to fund government operation, and then acts surprised when it's facing a huge shortfall. So it's disingenuous to paint this as greedy teachers and public servants when it was grossly mismanaged on the state politician side. However that seems to be a certain faction's goal.

In addition, Kentucky teachers have worked under the assumption of getting a pension because the state never extended social security to them. They worked with lower wages and no future social security with the promise of pension would be there for them, sometimes as their only retirement income. How can you go back and threaten this pension when teachers took these low paying jobs under that assumption?

[https://www.bondbuyer.com/news/bevin-citing-pension- pressure...](https://www.bondbuyer.com/news/bevin-citing-pension-pressure- proposes-budget-that-cuts-70-programs)

[https://www.courier- journal.com/story/news/education/2018/03...](https://www.courier- journal.com/story/news/education/2018/03/20/kentucky-teachers-pension-reform- social-security/438031002/)

<comment><USER7> Yes, I totally agree that the _problem_ does not come from teachers. The problem comes from decades of shortsightedness of lawmakers.

I only mentioned teachers because of their response, which is largely irrational. No ones benefits are being taken, the state is just ending a program that is unsustainable.

The private sector did this decades ago.

What happens if the state government goes bankrupt? That is not outside the realm of possibility with the current crisis.

<comment><USER9> If what the parent above you said is true and teachers are not on social security then the reform of pensions does indeed harm them.

<comment><USER10> It works this way in a number of other states. Ohio teachers (perhaps only some, I'm not sure) give up their social security in order to collect from the state teacher's pension fund, regardless of whatever they've already paid into social security. Seems a little crazy, although until very recently the pension fund appeared to be doing quite well. (they just suspended a cost of living increase for the first time ever, which is not the worst thing in the world, but I certainly am curious as to why their fund's performance has been so mediocre as of late)

</comment></comment></comment></comment></comment><comment><USER11> Elected Politician: what so you want?

Union: pay raises!

Elected Municipal CFO: we can't. No more money.

Elected Politician: what about retiring 5 years earlier?

Unions: we will take that!

Elected Politician: retiring earlier costs nothing right now correct?

Municipal CFO: yes but...

Elected Politician: Fine let's give everyone 5 years earlier retirement. My successor will deal with that when I will be gone.

<comment><USER12> More like politician or candidate hires the actuarial consultant which will use the most liberal assumptions they can to make the costs appear as cheap as possible. And then not even fund to those calculations, because who is going to force them to?

<comment><USER8> Or in many states, use the surplus from pension funds to operate the government, writing an IOU they know future governments won't be able to pay.

Unsurprisingly when the shortfall comes the same politicians who borrowed will be shouting how pensions are unsustainable.

In New York, the pension fund is firewalled from the state budget and run fairly independently.

After the last recession, the pension fund made several changes in conjunction with the unions:

* Ensured the forecasted return estimates were in-line with reality (7%, which it has exceeded in the past decade)

* Introduced a new tier so new employees contribute for their whole career, with contribution rates progressively increasing as you earn more

* Introduced a limit on the final average salary that determines pension payout

* Lengthened the window of final salary calculation and introduced rules preventing large overtime variances counting towards this calculation.

Still a decent pension system if you can vest, but with reasonable expectations set. As a result, NYS is one of the best funded pensions in the country and in the upper 90s% of future funding levels.

</comment></comment></comment><comment><USER13> ...and that's after one of the longest bull markets in recorded history.[a]

[a] [http://www.finra.org/investors/5-longest-bull-markets- infogr...](http://www.finra.org/investors/5-longest-bull-markets-infographic)

<comment><USER14> This is what is so weird. The stock market is at historic highs.

[https://upload.wikimedia.org/wikipedia/commons/7/7e/S_and_P_...](https://upload.wikimedia.org/wikipedia/commons/7/7e/S_and_P_500_chart_1950_to_2016_with_averages.png)

Our housing bubble just surpassed the housing bubble of 2007.

Interest rates are at all time lows and unemployment is at all time lows.

If they are having trouble now when it's the best of times, what are they going to do when we have a recession?

</comment></comment><comment><USER15> Maybe stop guaranteeing returns on investment?

"It worked in the past" isn't financially sound decision making. It might be lucky from time to time.

<comment><USER16> Isn't "it worked in the past" pretty much the foundation of all investment advice? Based on what else can the average guy invest his 401k?

Regarding public pensions they should just adapt to reality and fund them higher. This was willful negligence for a long time.

<comment><USER15> Not when you're taking small data samples. If you look at past years of investment, you'll either have a sample size too small to be meaningful, or your start lumping years that don't reflect today's realities into the mix.

These investments are basically saying, "the market will always get 10% return", so we're going to put future tax payers on the hook for 10% returns. The average guy investing his 401k doesn't get guaranteed results at the expense of other people's work.

Even if there is a historical 10% return that holds, that's still going to produce underfunded (and overfunded) pensions based upon fluctuation in yearly returns and population dynamics (like if an unusually large number retire in a down year).

Then there is the pension spiking, and maybe even no consideration that people are paying into the pension at low rates but tend to retire at high pay rates.

<comment><USER16> As individual you can't really compensate for the update and downs of the market but a pension system with an eye on the long term could do this. Sometimes it's overfunded, sometimes underfunded but in the end it will converge to the average.

</comment></comment></comment></comment><comment><USER17> All these pensions are going to be wiped out soon in the coming run. Most funds currently assume 7% to 8% future rates of return but the ability to generate returns like that have been impossible for a long, long time now. To compensate for low returns, pension funds have dumped money into stocks, private equity funds and illiquid and very risky investments, like subprime auto loan securities and commercial real estate. Some pension funds have as much as 20% of their assets in private equity. When the stock market inevitably crashes a little, it will wipe pensions out. Then politicians will be forced to admit there's a problem, and everybody is going to immediately do a run on their pensions to try and cash them out. For anybody who doesn't know if your job offers a pension scheme and you quit before retirement, you are paid out a lump (taxable) sum. There's no way these states like CT or NY with massive unfunded liabilities can afford 20%+ of their employees trying to cash the pensions.

The International Forum of the America's holds an annual pension conference where the data on the coming run on public sector pensions can be found, such as all the risky investments to make up for poor returns. Interestingly, private sector pension schemes are fine.

<comment><USER18> I'm not surprised -- they're not at the whim of municipal politics.

</comment></comment><comment><USER19> My memory of the statistics is that the median voter does not save. The government's approach to creating reserves of wealth follows on from that naturally.

An aspect in this that I find very interesting is the realities behind the numbers which will be revealed as the situation plays out. The money is a bit of an illusion, retirees need an available reserve of wealth (be it in the form of productive land, goods, labour, rock solid infrastructure and houses with little need of maintenance) to sustain them when they can no longer produce.

Where will this wealth reserve come from? Who will have to go without? What compromises will be made?

Undoubtedly one part of any proposed solution is 'tax the rich', because there are no other wealth reserves in America, but if this is a more fundamental problem of demographics and ratios the real resources might not be available to meet peoples expectations. Somebody is in for a very rough 20 years.

</comment><comment><USER20> In Kentucky, we're going through a pension reform as we speak. Of course, the Republicans are claiming to have fixed it and the Democrats are protesting it, saying they're hanging future retirees out to dry. What no one is saying is that the hole is so deep there's no way to get out of it. If I were a state employee, I would start planning now for my pension not to be there when I retire.

<comment><USER21> As someone who works in a different state, this is why when given the option I went 401K only.

401Ks have a lot of issues, and definitely aren't superior to a pension scheme in general, but pension schemes are so poorly run and have so many corruption- like issues that at least with a 401K it is just a simple vested savings account I can move if need-be.

I guess what I am saying is, trust in traditional pensions is so low to some, getting a worse but safer alternative looks nice by comparison.

</comment></comment><comment><USER22> Original report, [http://www.pewtrusts.org/en/research-and-analysis/issue- brie...](http://www.pewtrusts.org/en/research-and-analysis/issue- briefs/2018/04/the-state-pension-funding-gap-2016)

</comment><comment><USER23> I wonder how much Illinois impacts the average...

At this stage, there is literally no way to even pay back the pension (it'd be $20k per person in the state, if we needed to pay it back today).

<comment><USER24> Yea.. Illinois is in bad shape. My father-in-law retired from Western Illinois University a little earlier than he had initially planned so that it would be before his union contract expired.

That was over a year ago - the folks left are still working without a contract. That doesn't necessarily mean they won't get any pension if they retired today, but it puts it at even more risk than it already was.

</comment></comment><comment><USER25> You think states are bad, you should check some of the city level pension issues, which I think are much larger in aggregate per state than the state pension funds.

A really good intro to the city level issues would be the Dallas police and firefighters pension (just duckduckgo it)

</comment><comment><USER26> I imagine not too many devs have the option of a pension like I do so I'll relay what was told to me about my pension. ~4.5 years ago I was told along with all the new hires in the room we would be the last generation of new hires with an option for pension. I opted not to take it as that said to me this would be the hardest to fund pension ever. Really my matching 401K and superior insurance do the trick for me even if the returns aren't high. After the '08 crash I've hedged against private stubbornly and admittedly have been pretty jealous of other benefits devs in the private sector get.....until now.

<comment><USER27> What has recently happened to curb your jealousy?

<comment><USER26> serious illness

</comment></comment></comment><comment><USER28> Pensions would work a lot better if they were independently managed and firewalled from the employer.

A family member has a state pension in one of the states known for having some of the worst of these problems.

However, their corner of state employment was smart and set up an independent pension management situation. It remains fully funded and not at risk. Well, except that the state keeps trying to break down the firewall and raid it.

However, people who instantiated it did a good job of guarding against this.

Pensions aren't "evil". And who wouldn't mind worrying less about making retirement decisions as an amateur investor on one's own, and focusing more on doing a good job and raising a family and having a happy life?

What is "evil", is structuring them without defense against expropriation of funding for other purposes. As far as I'm concern, that is "theft", plain and simple. And failing to fund them per established schedule is breach of contract. You are essentially not paying employees for work done.

Maybe given that, well defined in law and practice, organizations also wouldn't make unrealistic pension commitments in lieu of providing better immediate compensation and benefits.

In addition to all the rest, there is the aspect of the turn to 401K's and similar vehicles, that money managers saw and pushed an opportunity to grow the fees they collect.

I held off from writing it a couple of paragraphs ago, but I'll say it now. Pensions aren't a fundamental problem. Banksters and their political enablers are.

<comment><USER12> Fees to manage pension fund investments are higher than 401k fees for index funds offered by Vanguard/Schwab/Fidelity.

<comment><USER28> Those have only really caught on more recently.

And as more and more investment moves into them, they become mono-cultures vulnerable to large-scale exploitation.

I'm using some right now, but I don't count on their indefinite viability and performance.

Remember how LIBOR exposed fundamental problems and manipulation with respect to indexing and pricing?

Different aspect of finance. Nonetheless, you're pinning everything to indexes someone manages -- and to systems performance versus competition.

They do reflect a similar aspect; taking the average investor's attention away from individual purchases and sales, where most get fleeced to varying degrees.

Wherever your investments, you have to keep paying attention.

P.S. Have an upvote. I'm not disagreeing.

<comment><USER12> I agree that there is concern for large scale manipulation, but it seems like that concern is still there with actively managed investments. Especially from governments manipulating via bailouts. At least with passive index, you're only paying a few basis points.

</comment></comment></comment></comment><comment><USER29> Why not just 'quantitative ease' the differences? We seem to have no qualms about it when it comes to burning cash on private corporate initiatives.

<comment><USER12> That is what will happen. Each US dollar will become less valuable, and the nominal debts will be satisfied. Hope you're invested in inflation resistant assets. Some of the pension recipients who don't have enough clout to force the federal government's hand will lose though.

<comment><USER30> That's an intuitive theory, but inflation doesn't really have that much to do with the quantity of money, because the value of money is almost entirely based on what you can buy with it. Price inflation happens when the aggregate demand (the sum of all the spending over a certain period) outstrips the amount of goods and services produced (or held in inventory) in the economy. Yes, adding more money can increase aggregate demand, but it is also saved or invested in productive ventures that mean more goods or services are produced.

If it was simply a fact of more money == inflation, we'd be screwed since the money supply is almost constantly growing through bank lending.

At the end of the day, all _spending_ carries inflation risk (since all spending adds to aggregate demand). This equally applies to money saved earlier, new money created in the banking system, or new money created by the Government (say, QE). It's at the time of spending that's the risk, not the time of creation.

The limits of Government money creation therefore have more to do with the productive capacity of the economy.

<comment><USER12> In an environment where income and wealth disparity is growing, and birthrates are just at replacement level or lower for those with wealth, wouldn't aggregate demand outstrip goods and services produced?

</comment></comment></comment></comment><comment><USER10> The underfunded part is sadly not unusual or unpredictable and neither are the unrealistic performance expectations. On the other hand, the poor returns some of the funds have seen in recent years is quite a surprise. How badly designed did the average portfolio have to be to only gain 1% in 2016?</comment>


"Google just killed $150M in Android develop payments" - <AUTHOR> http://venturebeat.com/2013/09/27/google-just-killed-150m-in-android-developer-payments-and-its-a-good-thing/#HVyiAr6rg6439A0b.99

<comment><AUTHOR> Here's the link to the Google Play Developer Policy

[http://play.google.com/about/developer-content- policy.html](http://play.google.com/about/developer-content-policy.html)</comment>


Wealth Management Products in China (2015) [pdf] - <AUTHOR> https://www.rba.gov.au/publications/bulletin/2015/jun/pdf/bu-0615-7.pdf <comment><USER2> This screams fraud. Banks in China offer a product which claims a guaranteed rate of return, yet the deposits are invested in securities, loans, other risky investments. So I guess its like a bond - I only read the first paragraph but would love this explained.

<comment><USER3> Question. Do they guarantee a payout (like a bond), but then they themselves assume the risk of the mix of riskier securities? Or are they claiming a guarantee but then offloading the risk onto the consumer and making a false promise?

<comment><USER4> Unrelated, but even in the US, the standard deposit insurance "guarantee" is not exactly guaranteed. If a small insured bank fails, the FDIC can absorb its losses. If a large bank collapses, they might be able to cover losses, but only if it is an isolated incident, (like Washington Mutual). However if there was ever a large run on the banks (like in 1929), they could only renumerate small a fraction of insured deposits (at most 2% in 2017).

<comment><USER5> > _if there was ever a large run on the banks (like in 1929), they could only > renumerate small a fraction of insured deposits (at most 2% in 2017)_

The FDIC (a) cannot "cram down" [1], (b) has the ability to borrow $500 billion from the U.S. Treasury [2] _and_ (c) is backed by the "full faith and credit" of the U.S. Government [3]. A decision to "renumerate small a fraction [ _sic_ ] of insured deposits" would be a political call. It's certainly not a "could only" scenario.

[1] [https://en.wikipedia.org/wiki/Cram_down](https://en.wikipedia.org/wiki/Cram_down)

[2] [https://www.fdic.gov/news/news/press/2009/pr09153.html](https://www.fdic.gov/news/news/press/2009/pr09153.html)

[3] [https://www.fdic.gov/deposit/deposits/](https://www.fdic.gov/deposit/deposits/)

<comment><USER4> (a) What alternative would they have, besides closing the banks? (b) Still only a small fraction of insured deposits. (c) Contingent on its ability to govern. How long would that last in such a scenario?

<comment><USER5> > _What alternative would they have, besides closing the banks?_

Receivership [0]. Note that if your bank closes, the FDIC still sends you your money.

> _How long would that last in such a scenario?_

The FDIC has about $7 trillion in insured deposits [1].

In the crisis, between TARP [2] and TALF [3], the federal government printed $1.5 trillion. (About $1.8 trillion in 2017 dollars [4].) Meanwhile, the Fed bought $4.5 trillion in assets through its quantitative easing programmes [5].

Adjusting for inflation, we probably saw close to $7 trillion in fiscal and monetary stimulus.

[0] [https://www.fdic.gov/about/strategic/strategic/receivership....](https://www.fdic.gov/about/strategic/strategic/receivership.html)

[1] [https://www.fdic.gov/bank/statistical/stats/2017jun/fdic.pdf](https://www.fdic.gov/bank/statistical/stats/2017jun/fdic.pdf)

[2] [https://en.m.wikipedia.org/wiki/Troubled_Asset_Relief_Progra...](https://en.m.wikipedia.org/wiki/Troubled_Asset_Relief_Program)

[3] [https://en.m.wikipedia.org/wiki/Term_Asset- Backed_Securities...](https://en.m.wikipedia.org/wiki/Term_Asset- Backed_Securities_Loan_Facility)

[4] [https://data.bls.gov/cgi- bin/cpicalc.pl?cost1=1.50&year1=200...](https://data.bls.gov/cgi- bin/cpicalc.pl?cost1=1.50&year1=200812&year2=201709)

[5] [https://en.m.wikipedia.org/wiki/Quantitative_easing](https://en.m.wikipedia.org/wiki/Quantitative_easing)

</comment></comment></comment></comment></comment></comment><comment><USER6> Anyone else not trust pdfs?

<comment><USER7> Most government websites still use PDFs to distribute information. This is also true in Canada.</comment></comment>


Heroes: The mobile marketplace where you can buy or sell any service on-demand - <AUTHOR> http://www.heroesapp.io/ <comment><USER2> Well done! I look forward to integrate my business into the Heroes app.

<comment><AUTHOR> Thank You! :)</comment></comment>


Formerly incarcerated software engineers built a no-police alternative to 911 - <AUTHOR> https://medium.com/@emergentworks/meet-the-formerly-incarcerated-software-engineers-who-built-a-no-police-alternative-to-911-5a5af163f8b2 <comment><USER2> This seems like an ad for this company without any real description about how it's supposed to work.

For example, domestic abuse calls can be the most dangerous for police, so how does not involving the police work? Who would show up to these?

How does choosing an agency help with homelessness?

In fact, what prevents the agencies getting these calls from turning around and calling the police themselves?

Maybe I'm being cynical, but I think this is not going to do anything. An app can't solve these problems, you need to staff agencies with people and train them to handle different situations. If you wanted to help, you might want to send specially trained people along with the normal police who handle certain types of situations. For example, sending someone who is an expert in mental health to many different calls so they can help identify and help handle situations with emotionally unstable people.

<comment><USER3> unless I'm missing something, it seems to be a glorified directory service. I don't know the fire department's number off the top of my head, but if I saw a fire and it was really important to me that the police not respond, I would probably just google their number rather than go through some app.

edit: I just looked at their website and now I'm really confused. the app itself directs you to just call 911 for any life-threatening emergency.

</comment></comment><comment><AUTHOR> "Being able to circumvent the police and still get your needs met is a beautiful thing." Not911 ([http://not911.nyc](http://not911.nyc)) is an app built by Emergent Works, where teams are comprised of at least 50% justice- involved software engineers.

</comment><comment><USER4> Where did the data come from, and how will they make sure it is kept up to date?

[https://openreferral.org/](https://openreferral.org/) may be of interest

</comment><comment><USER5> This seems like a great example of technology being used to address a social ill.</comment>


Google Chrome for Mac released (beta) - <AUTHOR> http://www.google.com/chrome?platform=mac&hl=en <comment><USER2> The email they sent to announce the beta (if you signed up to get it) has some interesting stats:

      Hi there,

      Thanks for signing up to hear from us regarding Google Chrome for Mac! We're excited to let you know that Google Chrome is now available in beta for Mac OS X.

      Here are a few fun facts from us on the Google Chrome for Mac team:

      -73,804 lines of Mac-specific code written
      -29 developer builds
      -1,177 Mac-specific bugs fixed
      -12 external committers and bug editors to the Google Chrome for Mac code base, 48 external code contributors
      -64 Mac Minis doing continuous builds and tests
      -8,760 cups of soft drinks and coffee consumed
      -4,380 frosted mini-wheats eaten
      Thanks for waiting and we hope you'll give Google Chrome for Mac a whirl.

      Google Chrome Team
      www.google.com/chrome

The 8.43:1 ratio of LoC to soft drinks/coffee consumed made me laugh.

<comment><USER3> two spaces

      like this.

<comment><USER4> ...but for a bullet list...

* Use a leading asterisk

* Separate the list items by a blank line (i.e. make them separate paragraphs)

\- Leading dashes work too.

</comment></comment></comment><comment><USER5> Linux too!

<http://www.google.com/chrome/intl/en/w00t.html>

<comment><USER6> A fine tribute to XKCD. Good to see Google give credit (and a direct link!) to XKCD right on the page, too.

</comment></comment><comment><USER7> If you want custom themes beyond what Google provides, I'm hawking a tool a hacked together a couple of weekends ago. It's a just-for-fun thing so the UI is pretty sparse, but it works! :)

<http://sexychrome.com>

I'm a big fan of Chrome. Favorite features include the speed, full-screen browsing, detachable tabs. Needs a robust extension for CSS inspection/manipulation, though. Built in one doesn't quite flow as well as Firebug. Decent JS console.

</comment><comment><USER8> Unfortunately, it shares Firefox's sloppy page scroll performance. Bleh. Guess I'll be sticking with Safari.

<comment><USER9> and it shares safari's inability to view XML documents. What's with that...

<comment><USER10> There's an extension for that: [https://chrome.google.com/extensions/detail/gbammbheopgpmaag...](https://chrome.google.com/extensions/detail/gbammbheopgpmaagmckhpjbfgdfkpadb)

</comment></comment></comment><comment><USER11> Intel only. Looks like I'll be sticking with Stainless (<http://www.stainlessapp.com/>) -- probably would've stuck with it anyway, it's a pretty nifty little Mac browser.

<comment><USER12> V8 was i386-only for a long time, it's had x86_64 and ARM support for maybe 6 months. Android originally used Webkit's Squirrelfish, I think the Palm Pre shipped with V8 before Android did!

</comment></comment><comment><USER13> I've been using chromium for a while now and have been fairly happy with it (other than a bit of scrolling performance and some flash funnyness). Has anybody done a side by side comparison of Chromium and Google Chrome on the Mac?

The UI looks identical, functionally they look very similar, and performance seems about the same as well.

Thoughts?

<comment><USER14> Near as I can tell: all that changed was the version number from .27 to .30.

iStat Menus processor graph still goes nuts when scrolling compared to Safari. That said, Chromium/Chrome has been my default browser for about a month now.

</comment></comment><comment><USER15> Still no functioning bookmarks manager or bookmark sync. I was hoping they'd enable that in the beta release.

<comment><USER16> I'm pretty frustrated with this as well. I've been using Chromium for a while now, and I can't use this Beta because it doesn't share bookmarks, or allow me to import from Chromium, or even move/delete the existing bookmarks.

Guess I'll keep with the less stable nightlies for a while longer.

</comment></comment><comment><USER17> I like being able to move tabs between windows seamlessly with Chrome. Safari lets you detach a tab into a new window but that's about it. I don't think you can merge it with another window that already has open tabs or re-attach it. My biggest gripe, which is purely personal preference, is not having the progress bar integrated with the address bar. At least the status bar automatically disappears after a page loads. The feature that will keep me on Safari is bookmark syncing via MobileMe. It's really nice having it sync to my other Macs and iPhone.

<comment><USER18> You can move tabs between windows in Safari on OSX.

<comment><USER17> Is this new in Safari 4? I don't remember this ever working before.

</comment></comment></comment><comment><AUTHOR> The first thing I did was convert the address bar to use a Google "I'm Feeling Lucky" search so that it functions more like Firefox.

Here's how: Right click the address bar, choose "Edit Search Engines...". Click the + to add a new search engine. Choose whatever name and keyword you wish, but for URL use [http://www.google.com/search?q=%s&btnI=Im+Feeling+Lucky](http://www.google.com/search?q=%s&btnI=Im+Feeling+Lucky). Make this your default search engine. Works tolerably well.

</comment><comment><USER19> How can they call this a beta when there's NO BOOKMARK MANAGER?

<comment><USER20> I might not know what you exactly mean by a "bookmark manager", but the star to the left of the URL textbox and Ctrl+B give you bookmarks.

<comment><USER21> The Mac version doesn't have a bookmark manager. You can click the star, and it saves the bookmark (or removes the bookmark). But unlike the Windows version there isn't a dialog/window that shows all your bookmarks and lets you drag/drop/etc.

<comment><USER20> Ctrl+B (or Command+B on the Mac, I assume) opens up a bar at the top (or at least it does in the Linux version) and you can drag your bookmarks between the bar and the "other bookmarks" folder.

<comment><USER22> Yes, but there is still no bookmark manager. Try to create (on OS X) a bookmarks folder in the bookmarks bar. Proceed to add two bookmarks into that folder. Now... How do you edit/delete/rearrange the bookmarks that reside in the folder? I can't figure it out.

<comment><USER23> Here's what I did (on OS 10.6). 1) Created two bookmark folders in the bookmark bar named "NewFolder", and "OtherFolder" (right click on bar->Add Folder) 2) Added two bookmarks to NewFolder (browse to site, click star, select NewFolder in Folder drop down list) 3) Moved bookmarks from one folder to the other (browse to bookmarked page, click the star, click Edit, change the folder drop down selection, close)

This doesn't allow you to move folders around, and it's annoying that you don't have a way to manage the bookmark of a page without browsing to that page. It's not the full "Bookmark Manager", but you can manage bookmarks.

</comment></comment></comment></comment></comment></comment><comment><USER24> Does anyone know whether this has auto-update?

<comment><USER25> Not sure if this is just me, but Google autoupdate is just broken for mac. It pops up even when the program is not running and the update only works if the current user is an admin. It does not prompt for admin password like all other updates do. And there was no way to not have autoupdate. That led me uninstall all Google software a while back.

<comment><USER24> I am not referring to the general google updater that comes with the google pack. I mean the silent autoupdate that chrome for windows has.

<comment><USER26> Yes, that's been working in the dev version for a while.

</comment></comment></comment></comment><comment><USER27> I've recently switched from Ubuntu to a Mac (mainly just to learn wtf everyone says is so great), I'd been running Chromium there for ages, I'd prefer to use Chromium rather than give so much data to Google but I could find a package which will update like Chromium did on Ubuntu. Any suggestions?

<comment><USER12> Google's official Chrome builds update themselves automatically while they're running without needing to relaunch.

The Mac Developer community has standardized on Sparkle, where the app downloads an update feed from the developer's site and prompts for an automatic update/install/relaunch.

To get the Chromium on Ubuntu behavior of manually-initiated centralized automatic updates, you'd have to use a package manager and the only viable one is MacPorts, which is just not a good fit for desktop software.

</comment></comment><comment><USER28> This Beta doesn't have a bookmarks manager. Does that mean we have to wait until the next release to get it? That would be pretty bad to ship a browser with no bookmark manager.

</comment><comment><USER29> Whats with the versioning of Chrome for Mac.

"About Google Chrome" says 220.127.116.11 and AFAIK this is the only "Beta" software with a major version as high as 4.

<comment><USER19> Version parity. It's done all the time when porting to a new platform. Why would you want identical software to have different version numbers on three different platforms.

<comment><USER29> OK. makes sense. But then how come Win Chrome is already at version 4.

In other words 4 as the major version seems high considering Chrome, for any platform, is fairly new. Compare that with FF which has been for much longer and is at 3.5.x

Are they tracking Webkit or any other version?

<comment><USER30> No, just trying to compete with IE8 in an enterprise environment. At the speed they're going, they'll catch up pretty soon :)

</comment></comment></comment></comment><comment><USER31> Everyone must be downloading it all at once. 22 KB/sec download speed on a T1 connection. I would expect better of Google.

<comment><USER32> Really? My download completed in about 20 seconds. T1 lines are highly reliable, provide guaranteed bandwidth, and low-latency, but are also very slow at only 1.544mbps (on par with low-end DSL).

<comment><USER31> I might just be a local network condition, though the rest of the internet is loading at its usual speed. My Chrome download is still chugging away....

</comment></comment></comment><comment><USER33> Yea! File upload works now. Now I shouldn't need Camino any more.

</comment><comment><USER34> Don't have my mac handy.. Does it have full screen support on OS X?

<comment><USER7> Yup, although the option is grey-ed out on my machine ATM, and I couldn't tell you why...

I've used it before, though

<comment><USER34> I have yet to find a browser with full screen support on OS X - which makes me think it's an OS X limitation.. So odd.. When you have a 13 inch macbook this problem becomes readily apparent.

</comment></comment></comment><comment><USER35> This feels even faster than the developer betas. Excellent.

</comment><comment><USER36> Gmaps and Gcal aren't rendered properly. Am I the only one?

<comment><USER28> Calendar looks great for me.

</comment></comment><comment><USER37> Let me know when it gets plugin support...

<comment><USER38> It has had plugin support (at least flash) for some time now.</comment></comment>


Show HN: Move your Medium.com content to an open-source Ghost blog - <AUTHOR> https://github.com/ageitgey/medium_to_ghost <comment><USER2> Very neat. Thanks for sharing - also agree with your sentiment that it feels like content is locked up in Medium, even more so with the subscription plans.

</comment><comment><USER3> Neat. Love the work towards breaking lock-in.

You should probably actually link to the ghost website in your readme somewhere. I was mildly aware and interested in the ghost blogging platform before I saw this, but it might be confusing for people who are not and just googleing "ghost" isn't giving me very helpful results.

<comment><AUTHOR> Thanks, that's a great suggestion!

</comment></comment><comment><USER4> That's great, but why just Ghost? Why didn't you create a tool that would just extract your content from Medium and let you use it anywhere else? Now I'm just trapped on Ghost!

</comment><comment><USER5> I did this manually a few months ago - would have loved this!

</comment><comment><USER6> Nice. I just looked up Ghost to WordPress (exists) and Medium to WordPress (exists). I like Publii myself for small static sites that even my mom can use, but still like WordPress when I just want to blog.</comment>


Ask HN: We need your feedback on layerJS: UI composition and animation library - <AUTHOR> We built http://layerjs.org . It a JS library for composing an interactive web user interface out of simple static HTML frames. UI patterns like carrousels, light boxes, menus, parallax, etc. can be created with this simple universal concept. It's in an early but useable state. We'd appreciate your feedback to go on.<p>-Thomas <comment><USER2> How is that different from a jQuery content slider

<comment><AUTHOR> the slider will be very similar as in a jquery slider. The slides will be "frames" and the container in which the sliding happens is the "stage". However, with layerJS you can place "stages" and "frames" everywhere in the page and so create menus, light-boxes etc. with exactly the same pattern. With layers you can even overlap frames and trigger multiple transitions in sync. Also, as every frame transitions connects to a state change and connects to a specific url you can control everything through simple links.</comment></comment>