Self-Compassion Works Better Than Self-Esteem - <AUTHOR> https://www.theatlantic.com/health/archive/2016/05/why-self-compassion-works-better-than-self-esteem/481473/?single_page=true <comment><USER3> As my psychotherapist put it yesterday: people that seek self-esteem in an unhealthy way are vampires. "You have to become your own bloodsource" she said.

When you seek self-esteem in an unhealthy way, you do things to get approval/validation from others. You'll suck some blood from girls who like you, suck some blood from jobs you apply for that want you, tell friends about all the high-end interviews you have and the cool things you're doing. But after you've gotten what you need from the girls, the jobs, the friends, you realize you never really wanted any of them. And that you wasted your time in the process when you should seek what YOUR OWN PATH is. Self- compassion/kindness is when you become your own sustainable bloodsource of self-esteem and it is critical for your survival and success.

<comment><USER4> No disrespect intended, but this is so American someone should use it as an academic linguistics example of culture-specific communication!

(eg. psychotherapy, negative third party social group stereotyping, pop culture references, second person framing of self-help advice as casual banter, capitalia, shameless and fundamentally American reformation of compassion in an ego-linked context...)

<comment><USER5> Don't forget referring to adult women as girls!

<comment><USER6> And kudos to you for using "women" instead of "female".

<comment><USER7> This is confusing me. What is the current PC way to address the non-male gender?

<comment><USER8> That's a very heterogeneous group you are addressing. Why are you grouping by a binary gender? What is it you think individuals in this group have in common?

<comment><USER9> The key (reproducing_organ) only has 2 (or 3) values. If you want a composite key (reproducing_organ, sexual_preference, sexual_identification), you would get (at most) 3 * 3 * 2 (?) possible values. If you want to expand that key to include X because PC reasons, I'm not listening anymore.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> There was an article about procrastination that really stuck with me and it argued something similar: One of the reasons we put off work is because we don't look at our "future selfs" as the same person or even as someone you feel sorry for. Basically, we think "I don't give a damn, let my future self deal with the consequences!". By thinking of your future self compassionately, you can much better motivate your current self to do work you'll depend on being finished at a later date.

This might sound weird but I try this sometimes. "Thanks, past self, for having done this on time, now I can enjoy the weekend because I'm done with this tedious work!" You don't have to literally talk to yourself or anything, but it's IMO a healthy state of mind. It's also the only way I've found to directly tackle the underlying problem of procrastination instead of just telling yourself to "not be lazy, stupid!".

<comment><USER11> > we don't look at our "future selfs" as the same person

I often think of this geeky comic when the subject comes up: [http://existentialcomics.com/comic/13](http://existentialcomics.com/comic/13)

<comment><USER12> hilarious comic, new to me, thanks for the link! :)

</comment></comment></comment><comment><USER13> I fundamentally agree with the basic insight of this essay, but I'd like to add that we should strive to be those friends to each other so we don't need to "auto-sympathize" to such a degree. If the people that you value don't value you for how hot your girlfriend is, or how much money you make, then you won't feel the compulsion to build yourself up that way--to such a degree. Of course, the pervading culture still makes it difficult to ignore those sirens.

And of course, social media plays a huge role in this reduction of the complexity of emotional life to more superficial things, to what can fit in a camera lens or a blurb.

The kind of self-esteem that people have, I imagine, must be like malnourished populations that are also obese. They don't have any lack of social interaction quantitatively, but they're still emotionally/spiritually hungry.

<comment><USER14> We only spend so much time with our friends, while we talk to ourselves all the time, mostly in very unfriendly manner. This self talk is the basis of Default Mode Network and you can start to notice it after a couple days of total silence. Great friends are great, obviously, but we also need to internalise them.

<comment><USER15> "This self talk is the basis of Default Mode Network"

That idea interest me. Can you elaborate it? Maybe some link? Thanks.

<comment><USER14> Please look up Judson Brewer and Gary Weber (sorry for brevity, I'm on the go).

EDIT: actually this is an excellent resource for the HN crowd, 100% BS free. It explains DMN and much more: [https://www.coursera.org/learn/science-of- meditation](https://www.coursera.org/learn/science-of-meditation)

</comment></comment></comment></comment><comment><USER16> Friendship and community work better than both. I was actually in the middle of finding evidence to post, but its so numerous it really isn't necessary. Form good _unconditional_ friendships and your happiness will exceed to new heights.

How do you form good unconditional friendships you ask? Hey, I didn't say I had all of the answers. One thing I might add is that, at least in my experience, a bad friendship is actually worse than being alone (though one might hesitate to call it a friendship to begin with), so tread carefully.

<comment><USER17> > Form good unconditional friendships and your happiness will exceed to new > heights.

I think human relationships come with conditions. If there is not some reciprocation of affection, support, time, kindness, etc, then what you have is not a positive relationship, usually for either side, though they may not see it. I think we see good relationships as "unconditional" because the reciprocation comes easily and without calculation, but there are still conditions.

<comment><USER18> Sure, sort-of. I can't kill my best friend's wife and expect to maintain his friendship. So that's a condition.

It's unconditional when it doesn't feel like there are conditions, and when your friend doesn't require anything extra of you beyond the things you do.

If you just want to argue some petty semantics, then your point stands.

<comment><USER19> Unconditional friendship is shit.

Your friends who are unconditional friends are not good friends. If you value your temporary happiness over personal growth, and friends who will help you become a better person, then you are chasing a false sense of self worth. Do you really want to feel artificially good about yourself by surrounding yourself with `yes men`?

Sometimes your friends will make you feel bad, and that's okay. Sometimes you should feel bad.

<comment><USER18> When my friends make me feel bad, they're still my friends. (Speaking for myself)

</comment></comment></comment></comment></comment><comment><USER20> Whether it's self compassion, self confidence, self esteem or some combination of them, what needs to be supported is a sense of agency. That sense that if one really needs to make a change or pursue an opportunity, that they have the wherewithal to do so.

Wherewithal might be 'on my own' or with assistance or guidance from others. It might require creativity or just persistence. But without it, we feel helpless, hopeless and ultimately dependent and depressed.

How can people who lack a sense of agency develop it in a healthy way?

<comment><USER21> The principal at my kid's high school called it "Self Advocacy". Kids need to have the mentality that they are in control of their lives, they are expected to stand up for themselves, and they need to seek help or speak out when they need something or see a problem.

She was pretty harsh on helicopter parenting, and she did a good job setting expectations with parents, teachers and staff that the students really are becoming young adults in high school and they need to be given respect and responsibility.

Her speech was pretty impressive, and I doubt my explanation is doing it justice, but it was the first I'd heard the term and it really struck a chord with me.

<comment><USER11> > The principal at my kid's high school called it "Self Advocacy".

Reminds me of a book "When I Say No I feel Guilty", which suggests assertively stating what you desire to others -- even if it's "Because that's what I want and I don't have a good reason" \-- as opposed to trying to struggling to frame everything in terms of "Because That's How The World Works".

</comment></comment></comment><comment><USER22> Albert Ellis (founder of Rational Emotive Behavioral Therapy) railed against the concept of self-esteem most of his career. He remarked that you should rate your actions, not yourself as a person. This seems even more significant when you realize how important failure is to mastery:

> Striving, by its nature, often results in setbacks, and setbacks are often > what provide the essential information needed to adjust strategies to > achieve mastery. (from the book on learning Make It Stick)

The self serves as a useful model for behavior, but it changes so much based on context. A universal self-esteem makes no sense when you accept the fact that a human being cannot ever exist in isolation (I always exist in relation to my environment).

<comment><USER23> Once upon a time I came to the conclusion that self-esteem was the worst invention in history.

</comment></comment><comment><USER24> Heh. My problem is that I am so damaged that when I become friends or find girls that care for me unconditionally, I devalue that relationship because it feels un-earned.

Something that comes un-earned to me has no value.

This extends to my relationship with myself. I'm hard on others so it only makes sense that I'm hard on myself.

This is what happens when your parents get divorced and you're raised by a shitty step mom. Not that my own mother was that great to begin with (cheated on my dad etc.)

<comment><USER25> The good thing is that you have self-awareness about it, so you can identify when your mind or emotions are basically playing tricks on you to make you feel that way. Everyone has their quirks, and there are lots of people whose experiences growing up cause all sorts of emotional reactions that don't always map to reality, but as long as you're aware of it and understand it you can manage it and gradually recover from it (speaking as someone who had a ridiculously alienating childhood and absorbed all the baggage that comes from that when becoming an adult).

<comment><USER24> For sure man, appreciate the words. I've been working on this with a therapist for a long time, it's only now starting to make sense or I am only now starting to internalize it.

Stuff is hard.

</comment></comment></comment><comment><USER14> What always blows me away is when people who've been watching their minds most of their lives and lived through the most amazing insights we can imagine, witnessing directly how the mind creates the world, how self is an illusion etc. (what neuroscientists can only state from intellectual perspective) tend to say: compassion is the highest form of wisdom.

Kristin Neff, the author of the research in TFA, brought these terms directly from her buddhist experiences AFAIK. Karuna and Meta (compassion and kindness) are very important mind "algorithms" in the Buddhist framework that apart from social and behavioral effects also have quite significant cognitive function. It allows to see things so much clearer, when you understand how complex and interdependent the reality is and how little control over reality we all are.

It's especially telling when you look at the natural progression of these mind states that one is encouraged to develop: Compassion -> Kindndess -> Symphatetic Joy (appreciating wellbeing of others) -> Equanimity.

</comment><comment><USER26> Reading this stuff is always eye opening for me. but actually making it a part of your thinking and perspective is a whole other ball of wax. Often, I end up just forgetting entirely as the days pass - not the content, because I can often recite that upon demand. But the actual adoption of it into ones own mindset.

Very often, I've found myself going "oh yeah, i'm trying to do that!". Along with several other things as well. this is largely what drove me to build my project to adopt such changes in perspective ([http://willyoudidyou.com](http://willyoudidyou.com)).

And in addition to yourself, it's good to show compassion to others. But it's definitely easier to do this for others once you have done it for yourself.

<comment><USER27> For this, start small. My mindset on this sort of thing changed largely by taking up a sport (I'm a capable athlete, but not stellar). I screwed up a lot. Instead of beating myself up about it, I looked at each "failure" (by some metric, varied by sport) as an opportunity to learn. It's exactly what I'd tell a friend or child in that situation. Pick yourself up, brush off the dirt, examine what went wrong, try again. Ask others for help and feedback, it may be embarrassing at first, but it's better than making a fool of myself every time by doing it wrong or poorly.

Failure is an option, because we aren't perfect. We will fail, and how we carry on afterwards is the part that matters. Developing this attitude in one area will carry over to others. Professionally, I had a terrible habit of thinking (impostor syndrome) that I should know what I was doing, wouldn't ask for help, suffered from analysis paralysis, etc. This personal growth helped me out tremendously there.

<comment><USER26> wow, great advice for where I am right now, trying to launch a service. Lots of emotional ups/downs, opportunity for failure - which can, in the right light, be seen as an opportunity to grow. Asking for help from others... definitely something I am working on, and have gotten better about.

I find a lot of my hesitations disappear when it comes to my project. Shyness just isn't an option. You have to keep pushing it no matter what if you want it to be something. This has had some interesting side effects for me - <USER2> another, much stronger and resilient side of me come out to make my project a reality.

But yeah, baby steps are everything. Otherwise I just get overwhelmed or discouraged - but small wins can turn into bigger ones, and failure is certainly an option!

Thanks for the comment.

</comment></comment></comment><comment><USER28> I think it's a question of balance, depending on how strong a position you are.

If you are in a position of weakness, feeling sorry for yourself, recovering from something you are judging yourself on - then you absolutely should start with self-compassion, being kind to yourself.

To continue in this mode would ultimately hit your ambition and drive, so if you are in a bit of a stronger position mentally, a higher gear, then boosting your self-esteem is more important.

<comment><USER29> I guess being self compassionate when you are doing great does not bring a big benefit, but neither does it hurt. However as the article mentions, it's hard to have self esteem when you are not doing that great.

As a PhD student I have this imposter syndrome feeling whenever I hit a wall. Being self compassionate and realising that almost every PhD student hits one or more walls during their PhD has helped me to cope with this.

<comment><USER30> Loving-kindness while one is doing helps one see through complacency and turning into an asshole. It also naturally start bridging into loving-kindnes for others.

</comment></comment></comment><comment><USER14> It's interesting that both building high self-esteem and negative self talk (2 directions, same dimension) seem to be the basic activity of Default Mode Network - the mode of the brain activated during mindless mind-wandering. Usually people spend most of their lives in this state. The amazing part is that there's strong positive corelation between the DMN activation level and how miserable we feel. Judson Brewer has done lot of great research on this. Most meditation techniques go directly against DMN and sometimes result in turning it off for good (look up eg. Gary Weber - [https://youtu.be/QeNmydIk8Yo](https://youtu.be/QeNmydIk8Yo)) .

</comment><comment><USER31> Most boys think of themselves as attractive and this is stable?

Is this statement true for most of you?

I was a fat kid (and fat young adult) and always thought I was unattractive. Even though it may not have affected me as much as it would had I been a girl, it remains prominent in my self image

<comment><USER32> In my experience, mostly no. But that could have been painted by the fact that I, too, was the fat kid for most of my youth. Despite that, I found that I could sometimes buddy up with a more attractive guy with either a better physique or social skills. I was a loser, but I could do that because I naturally treat everyone the same. Anyway, even attractive young men seem to view themselves as lesser creatures whose esteem would be improved by obtaining an attractive female. True, that often boosts one's esteem, but there's little self-love in that picture. Of course some guys do have a level of independent self esteem, but it is surprising how many attractive men don't think highly of themselves.

As far as stability, I think it has to do a lot with your physical and mental health. I noticed that most of the guys I knew who were out of shape and had basement dweller habits tended to stick with self-hating tendencies. And some people who didn't have key periods in their life, like having a mate or living on their own, have stayed that way after about age 26.

</comment></comment><comment><USER33> I find the terminology a little muddy in this article, as I would not characterise the "narcissistic" behaviours described therein, and the expected rewards, as having anything to do with self-esteem. In my book, self-esteem is inherently intrinsic; appreciating the unconditional value that you, those around you, and every living creature on Earth possesses.

This talk given by Irish comedian Blindboy Boatclub (of Rubberbandits fame) describes the concept as simply, succinctly, and beautifully as I have ever heard.

[https://www.youtube.com/watch?v=Zz82P0WqUh4](https://www.youtube.com/watch?v=Zz82P0WqUh4)

</comment><comment><USER34> There seem to be various definitions around. Even though a Psychology professor is cited, already at the beginning self-esteem and self-confidence are treated similarly. I really like the following definition of self-esteem: the feeling of (a) being in control of your basic needs and (b) deserving to feel good. This also solves the paradox stated, it just means that you should maintain a certain self-worth.

If your self-worth is too low, you may be used by other people. If it's over the top, you may act arrogant. So yeah...

Self-confidence is more like the

</comment><comment><USER35> Well, this article brings a very insightful perspective into view. It's not often you come across content that might profoundly affect your world views!

Also, at the opposite end of the spectrum here is a reference to a show called 'Black Mirror' with an episode which is about the need to constantly be seeking other peoples approval (for self-esteem boosting):

[http://www.imdb.com/title/tt5497778/](http://www.imdb.com/title/tt5497778/)

I highly recommend watching this, very sobering.

<comment><USER36> Yeah the anti-dote to Facebook.

</comment></comment><comment><USER37> There's an awesome book by Kamal Ravikant that relates to the idea of self- compassion: [https://www.amazon.com/Love-Yourself-Like-Your-Depends- ebook...](https://www.amazon.com/Love-Yourself-Like-Your-Depends- ebook/dp/B0086BX8UE)

</comment><comment><USER38> > try talking to yourself like you would your best friend.

So swearing at myself, basically? Strange advice.

<comment><USER39> Your best friend should probably consider looking for a new best friend :^p

<comment><USER40> Best friends are the ones with who you can have a transparent discussion. Including a reality check, which can be harsh. If they don't do it, who will ?

<comment><USER41> If you aren't self compassionate you probably have harsh criticism covered pretty well all on your own.

</comment></comment></comment></comment><comment><USER42> >There's nothing wrong with being confident.

This is obviously false, counterexamples are everywhere you look.

<comment><USER27> Being overconfident is a problem. Being confident isn't. Confidence is the (internal) certainty that you're in the right on something. Overconfidence occurs when you lack the ability to reexamine that position, and leads to ill effects (shattered ego after failure, posturing rather than persuading, inability to correct your course when in error).

When doing any task, you need to be confident that what you're doing is the correct thing to do, even if it's only an experiment and you accept that it may fail. When designing or writing a program, I _choose_ a path, and proceed confidently. When I hit a dead end (a bad design, an unsolvable problem), because I'm not _over_ confident, I'm able to reexamine my choices and correct. If I lacked sufficient confidence to begin, I'd be stuck at the design stage trying to decide between the twenty different frameworks available, analysis paralysis. Or I'd be second guessing myself at each stage and progress would be remarkably slow.

When going out on the field or into a ring for a sport, you have to be confident in each movement so that the movement is fluid, deliberate. Lack of confidence induces hesitation, and hesitation is more likely to lead to failure (by some metric). Which creates a feedback loop continuing the reduction of confidence and the increase in hesitation, resistance to progress.

<comment><USER30> I think a better way of framing confidence and overconfidence is your ability to feel impacted by other people around you. If someone has reached the point where other people's reactions, thoughts, feelings, seem to hit a kind of armor and gets ignored or shrugged off, he is acting like an asshole.

It is one thing to feel confident while at the same time, one feels the connection with other people. When someone uses the feeling of being "right" as a shield, it veers into asshole territory.

</comment></comment></comment><comment><USER43> This is why there's York and Zach in Deadly Premonition!

</comment><comment><USER44> In which a new set of overconfident, simplistic solutions harshly criticize the previous set of overconfident, simplistic solutions. If only we had known what we were doing when we unleashed the dark force of self esteem we could have stopped bullying!

I'm sure being patient and understanding with yourself (and with everyone else) is an approach to life that has a lot of benefits, but these articles are nothing more than pornography for our narcissistic idea that we have this huge power to shape who our kids are by simply embracing a new outlook from a paperback or using new words.

<comment><USER45> I'm always dismayed at how easy it is to make an armchair dismissal of research in social sciences.

<comment><USER46> if the social sciences held themselves to the standard of the hard sciences this problem couldn't exist

<comment><USER47> I feel like if social sciences held themselves to that standard we'd end up with eugenics? There's some inherit benefit to recognizing that social sciences aren't strictly 'hard-logic' sciences.

<comment><USER44> and I feel like worrying about the social consequences of the hard logic you uncover while studying social issues is a fundamentally flawed reasoning</comment></comment></comment></comment></comment>


Show HN: Creep Codex – Public figures accused of sexual assault/harassment - <AUTHOR> http://creepcodex.com <comment><USER2> Although I disagree with the premise of this site (it's too close to armchair vigilanteism for my taste), but would like to add a few tips anyway.

\- It would be good to have a '# of accusers' in the person's data page. As it stands, Al Gore (1) is compared 'equally' with Weinstein (>50).

\- categories of accusation: grope/rape/verbal/???

\- categories for evidence or proof advanced

\- ability to sort/compare

I like the list of sources, but again: Weinstein only has a single link, which seems very incomplete.

<comment><AUTHOR> It's certainly a work in progress, and so far I've given less attention to the better known alleged perps. I don't even have Brett Ratner on there yet.

I've also thought about rating or categorizing the allegations in a more systematic way, but it would be difficult to do well. Any sort of rating system seems like it could be easy to mess up. Point taken about Weinstein or Cosby being at the same level as, say, Ben Affleck. Perhaps grouping them by ranges of accusers would work (eg, "1," "2-5", "6-10", "10+").

One possible feature could be whether someone was convicted of an offense. That should be pretty straightforward and wouldn't involve any editorializing.

<comment><AUTHOR> Also, regarding "armchair vigilantism" \- I am really trying to be careful to only use reputable publications as sources, and to not be judgmental about who I include. Some of the accusations are quite shaky, but if they were made publicly and/or covered by mainstream media, I included them. I'm trying not to bring my own person judgment into it because it's not about that.

</comment></comment></comment><comment><USER3> 21st-century righteousness porn.</comment>


TSA officers now required to wear masks at airport screening checkpoints - <AUTHOR> https://www.tsa.gov/news/press/releases/2020/05/07/tsa-implements-additional-covid-19-safety-measure-us-airports <comment><USER2> Why wasn't this enforced 3+ months ago?</comment>


Key Flaw in Solar Panel Efficiency Identified - <AUTHOR> https://www.manchester.ac.uk/discover/news/solar-cell-defect-mystery-solved-after-decades-of-global-effort/ <comment><USER2> The article is very poorly written and contains several major errors. "As the electronic charge in the solar cells gets transformed into sunlight"? The original announcement is at [1].

One wonders if this kind of research is relevant. Utility-scale PV does not use the very highest quality silicon panels. They just get a lot of cheap land. Panel efficiency is mostly of interest for space flight and other exotic applications where ordinary silicon panels aren't even used. Unless this makes panels cheaper on a per-joule basis, do we care?

1: [https://www.manchester.ac.uk/discover/news/solar-cell- defect...](https://www.manchester.ac.uk/discover/news/solar-cell-defect- mystery-solved-after-decades-of-global-effort/)

<comment><USER3> isn't panel efficiency important for end-user-installed panels, rather than large power producers' installations? E.g. home use, or factories.

<comment><USER4> Euros per installed Watt is the important metric. It has been dominated by installation cost (not panel cost) for a while now.

<comment><USER5> It's one metric, not the only one. Im my residential installation, I was constrained by roof surface. Given certain subsidies, it would have made economic sense for me to pay more per watt if that had meant I could have produced more overall (up to a point, of course).

<comment><USER6> Using an example of current generation silicon cells, it certainly makes sense not to buy a lot of old technology polycrystalline 72 cell panels with a 300W rating, if you can buy mono si 72 cell 365-370W rated panels instead. There is only so much space on a house roof for a dozen or two dozen, 2.0 x 1.0 meter size panels.

But beyond "top grade 156mm mono cells", such as you can get in a new 360W stc rated panel, there is significantly diminished returns in dollars per watt. Yes you can get sunpower 23% efficient panels but they will literally cost twice as much.

</comment></comment></comment></comment></comment><comment><USER7> Actual paper: [https://aip.scitation.org/doi/pdf/10.1063/1.5091759](https://aip.scitation.org/doi/pdf/10.1063/1.5091759)

</comment><comment><USER8> > for every kW of equivalent sunlight, about 200W of electrical power can be > generated.

I wish journalists learned to use consistent units. 0.2kW would be better.

<comment><USER9> Just be glad they didn't mix up kW and kWh ("megawatts per year")

</comment></comment><comment><USER10> Url changed from [https://www.sciencealert.com/scientists-identify-a-key- flaw-...](https://www.sciencealert.com/scientists-identify-a-key-flaw-in- solar-panel-efficiency-after-40-years-of-searching), which points to this.</comment>


Americans are so Narrow Minded - a GDC report - <AUTHOR> http://www.glgroup.com/News/Americans-are-so-Narrow-Minded---a-GDC-report-47165.html

<comment><USER2> I'm calling link bait. A more appropriate title would have been "the Americans I saw at GDC are narrow-minded in my opinion". The title is worded in such a way as to imply that this is some kind of "official" report.

<comment><USER3> I'm European and I agree somewhat with the author. It appears that Americans are indeed more focused on the one big platform or opportunity, whereas Europeans are more focused on the smaller untapped opportunities. It's a broad and sweeping generalization of course, and should be taken with a grain of salt.

<comment><USER4> I don't understand this.

Smaller untapped opportunities are only small until they gain traction. There is no end to browser based games right now.

Facebook started small, Twitter started small in fact most companies start small.

The difference is just as likely that European companies haven't understood the power of using large ecosystems to leverage their own business. Instead they are puritans who want to create their own companies.

When ecosystems like ebay, FaceBook and Twitter appear why shouldn't people take advantage of that?

Business opportunity is business opportunity. It is very few peoples luxury to create something truly unique and in that game Europeans aren't really making any dent's in the universe.

<comment><USER3> A very American perspecive :-)

There are millions of opportunities that will never make you fuck-you money, but will afford you a decent living. They are often less risky because there's less competition. Patio11's Bingocardcreator is an example. No matter how much traction it gets it'll never be the new facebook. Europeans seem to be happier with these kind of opportunities, while Americans go for the homeruns.

<comment><USER5> I have to call sweeping false generalization. I can think ten local companies that meet that same criterion without even trying, and "local" for me is not Silicon Valley, either.

Maybe _some_ Americans try for the homerun and _no_ Europeans do (I can't judge), but even in America by company-count, which I accept as a reasonable proxy of number-of-people-starting-companies, the "home runs" attempters are the outliers. And of course the VCs are interested in the home runs, that's the VC business model!

</comment></comment></comment></comment></comment><comment><USER6> Speaking as a European - it seems rather ironic that the author is describing Americans as "narrow minded" for only being interested in following the big existing success stories when those are all American!

A very silly article indeed.

</comment><comment><USER7> _Americans are very narrow minded. They seem to fixate on the "winner", and pile in to follow the market leader, ignoring the other successful, profitable businesses or platforms that have got quite so big yet._

Is this not true for the rest of the world? All industries are prone to fads. Just because the guys in the US - where, arguably, the action is - are caught up in this fad does not necessarily make them narrow minded. It makes no sense to extrapolate this to all Americans.

(Note: am neither American nor European.)

</comment><comment><USER4> Being an European having lived in the states for five years and coming there often having great friends it's pretty basic.

There are morons and fantastic people in the US, just like Europe and everywhere else.

It borderline absurd to talk about American vs. Europeans unless you are talking statistics and even there is problematic.

</comment><comment><USER8> It seems to me this is how capitalism works. Those that say a free market economy maximizes choice I think are out to lunch. If you want exactly the same thing that everyone else does, then yes there are tons of choices (e.g. 50 different types of toothpaste in the store), but if you want something that's even a little out of the mainstream, forget it. Try finding _electronics_ at an electronics store, where by electronics I mean something that isn't a shrinkwrapped gadget, like a breadboard, for example.

Another personal story: I have fairly small feet, where by small I mean 39-40 in European size, which by no means is abnormally small. Finding shoes for me is a frustrating exercise because most stores don't carry sizes that small. And the thing is that _every store_ stops at the same size, so if you don't find it in the first store it's highly unlikely that going to ten more stores will help.

It seems to me that what the article is describing is exactly what happens: everyone rushes to the largest market with the largest potential and, while _in theory_ there should be someone establishing themselves in the smaller markets, when deciding whether they want to be a big fish in a small pond or a small fish in a big pond, they go with the latter.

It's like when you get to a fraction of the total market (defined in some way) and it's below 5% or something, it's not like only 5% of the actors in the market will offer something for you. Everyone makes the same decision so the selection quickly drops to zero.

Thing came out longer than I expected, sorry for rambling.

<comment><USER9> Fry's has breadboards. A small section, couple of rows in what is otherwise a massive consumer electronics store.

I can get most of what I want in my city, but then that's one of the reasons I've chosen to live in a big city.

Of course, the main place your argument falls down is that the items you describe are in fact available. Perhaps not in the channel you want, but they're available.

So where exactly is capitalism failing you?

<comment><USER10> I've seen these sorts of arguments before - what he is really complaining about is that he thinks more people should want the kinds of things he wants.

</comment></comment></comment><comment><USER11> I see it more as a big publisher trait. The execs at the top are falling over themselves to use Twitter and Facebook and iPhone games. They've never used Facebook or Twitter themselves, of course, and they have Blackberries, but these platforms are making lots of money so it's important to stumble in to the market as soon as possible. Mandate issued.

</comment><comment><USER12> I'm a European and I know there are narrow-minded people over here as well.

</comment><comment><USER13> It's just an opinion piece, stop getting your knickers in a twist. Of course it's full of hyperbole.

</comment><comment><USER14> perhaps his sample size was too small</comment>


Ask HN: Why do we have different simcard sizes? - <AUTHOR>

One thing that baffles me is why do we have different sim card sizes. Phones keep getting bigger and bigger by the day but phone manufacturers think it is wise to reduce simcard sizes. Is this by design or dont they just want me to remove my sim and put it in another phone model? <comment><USER2> Same reason why we have different USB ports (normal, micro, mini, etc). Designs keep evolving.

Also, I think the weight of phone is very important so anything to shave even a few micrograms off it could be one of the reasons (Read: Why Steve jobs tossed the first iPad in an aquarium [1])

Lastly, i think it is also because of what you said, especially with the new closed walled phones where the device manufacturer (read Apple) would like to seal you into a contract with the phone company and phone.

[1] [https://my.news.yahoo.com/steve-jobs-dropped-first- ipod-1521...](https://my.news.yahoo.com/steve-jobs-dropped-first- ipod-152100470.html)

</comment><comment><USER3> It's known as "The Cable Conspiracy".

By making all our connectors different, we have to keep buying stuff. Consider that I can't take my SIM card out of my phone then put it in a different phone. That means I have to buy a new SIM card, if I want a new phone. That means sales of SIM cards.

Consider that we have both Firewire and USB, and that USB has four different kinds of connectors. It moves product!</comment>


Ask HN: How long until we can become immortal? - <AUTHOR>

At the rate science is advancing, i can assume at one point we'll be able to live forever - the method is not at question here, rather in how many years it will be possible. Expand if you like. <comment><USER2> It's been posited that people would live on average to 200 just from unnatural causes of death (accidents, etc.)

The way to live forever is to not die of something first. Aging is merely a combination of natural processes we're only slowly getting a firm handle on.

The primary fundamental aging mechanism that we're showing promise for is telomere shortening. Essentially, the mitochondria in our cells have DNA that slowly and steadily degrades, much like your car guzzling more and more gas to go the same distance as it ages. There is an enzyme called telomerase that repairs this damage, and it is showing promise in animal trials. If it works in humans and comes out in a pill, I'd expect lifespans to go up by about 30-40 years.

To become immune to natural causes of death, I'd say we're looking at 200 more years. Living to the age of 10,000, perhaps 100.

</comment><comment><USER3> Exercising to live longer actually works against us because it speeds up cellular division which we actually want to retard if we want to live longer.

</comment><comment><USER4> Problem is we are starting to go backwards. It is more likely we will see a new Dark Ages in the next 30 years or so. :(

</comment><comment><USER5> With the technology we have, 10-20 years from now for sure scientist will be able to figure out a way for us to be immortal. It's a big possibility and not impossible.

</comment><comment><USER6> At the rate science and technology was expanding since we landed on the moon, we should've been on Mars. What makes you think that this particular point in time presages a predictable increase in scientific discovery?

<comment><AUTHOR> Well, there have been more scientific advancements in the last 500 years than over the last 50000 before them. I don't imply we're getting inmortality soon, but we're exponentially getting there.

</comment></comment><comment><USER7> I think expanding the life to 100-130 years might be possible in next 20-30 years for people in private jet category.

I don't think we can get to the point where person can live over 90 years old and has his cognitive capabilities intact and here is why:

If you hang around with old people in their 80's and 90's who are still exceptionally smart and have retained their faculties, you can still see how their cognition has changed. Brains might change only slightly after they reach their peak around 25, but we still carry the baggage of previously learned stuff. We don't have the so called "fresh eyes" anymore.

We see our current situation filtered trough our past experiences and I think this emotional and cognitive crystallization just goes on even with fully healthy brain. Using machine learning terminology, human brain can't backtrack from previously learned and their learning bias only increases. If our brains only increase their bias and specialization over time, learning stuff that is outside that field becomes more difficult and we lose the ability to adapt to big changes that will happen.</comment>


Ask HN: Tell us about your startup - <AUTHOR> What's the story behind your exciting and inspiring startup? <comment><USER2> Mine isn't particularly exciting or inspiring, but somebody has to be first to respond. I'm working on a mobile optimized, Bitcoin powered MTurk company called Labl ([https://labl.ml](https://labl.ml)). I have a few reasons:

1\. This is my first company, so I figure starting with something simple and low-capital would be nice (not interested in capital, currently a student, etc). Most of my concerns are with litigation and running a business in general

2\. I like Bitcoin, and I figure an easy way to increase adoption is to make it lower friction to earn. Contractor payments are only done in Bitcoin for the time being, client payments are done through Stripe. Having both options for both types of users is on the list

3\. I'm a numbers guy, and it seems like there are a lot of interesting optimization opportunities running any automated platform at scale

The general plan is to be a platform of new reasons to pay people over the internet. We have more interesting ventures along the "find reasons to pay people" line, but are finishing this up first to test drive our infrastructure.

NOTE: Sign ups are broken right now, should be fixed at some point</comment>


Baseline Security Guidelines (BSG) and More Than 5000 Objects in MOSP - <AUTHOR> https://objects.monarc.lu/object/view/5112 <comment><AUTHOR> Source code of MOSP: [https://github.com/CASES- LU/MOSP](https://github.com/CASES-LU/MOSP)</comment>


PIA: Our Merger with Kape Technologies – Addressing Your Concerns - <AUTHOR> https://old.reddit.com/r/PrivateInternetAccess/comments/dz2w53/our_merger_with_kape_technologies_addressing_your/ <comment><USER2> It might be that PIA is not going to start doing anything shady, and they'll still be a (relatively) well-respected VPN company after the merger. But if you're currently a PIA user, it would be foolish to keep using them while you're waiting for them to prove that. Cancel PIA for now, and if a year from now they're still on the level, you can make a more informed decision about whether or not to go back.

There's no reason for you personally to be the canary in the coal mine, just use someone else while you're waiting to see what happens.

I advocate somewhat strongly for paid 3rd-party VPNs, not because I think they're great, but because I think they are sometimes the least-bad option -- 3rd party VPNs address privacy problems that self-hosted VPNs can't, and unlike Tor, VPNs actually scale well for regular Internet browsing.

I do however fully acknowledge that shifting trust can be dangerous, so I recommend people be willing to quickly jump ship between VPNs, and possibly use different VPNs for different services. You should be a little nervous around your VPN provider, and you should hold them to really high standards.

In PIA's case, I notice looking at their pricing page that they offer 1-2 year plans in addition to monthly plans. Not everyone has the money to ignore deals, but if you do have the money, paying an extra $35-40 a year so just so you can easily switch VPNs on a whim is probably worth it. In general, for services that can pivot in quality quickly (like a VPN) it is usually worth paying monthly rather than yearly (again, assuming you have the extra money to do so).

<comment><USER3> So what're the recommendations for alternatives? It seems like quite a lot of VPNs play their cards close to the vest - and at the end of the day, all I want is a modicum of privacy and to safely torrent a movie for my PLEX server instead of having to dig up my Blu-ray reader and rip it myself once in a while.

<comment><USER2> I can't give you a checklist for how you should determine who you trust -- that's one of the reasons why I don't advocate for or endorse any particular VPN, and one of the reasons why I don't disclose which VPN providers I use. The difficulty of determining which VPNs to trust is why I call them a "least- bad solution" rather than a "good solution."

There are a few other people on this post who are recommending specific VPNs, and you can (and should) look through some of their justifications for why they like their providers. A couple of things you can look into if you want to know where to start:

\- What technologies are they using, contributing to, etc? Do they have a good rapport with Open Source communities?

\- Do they support OpenVPN/wireguard? I advocate against using a custom VPN client, I don't want my provider to ever touch my computer, only my traffic.

\- What's their privacy policy look like? Do they make public commitments to destroy logs? Are their claims on-their-face absurd? There's no such thing as a VPN that does zero logging at all, so if someone is claiming perfect anonymity, I distrust them from the get-go.

\- Have they had data breaches in the past (for example, NordVPN)?

\- Are there any high-profile cases of them refusing to provide logs to someone?

\- What country are they located in? Depending on the country, a foreign VPN can complicate collusion efforts.

\- Do they pay for ads, and how do they advertise? Do they make inaccurate guarantees about what a VPN can and can't do? A VPN isn't going to protect you from the police, and a VPN on its own will not make you private, so I distrust companies that make those claims.

\- Do they seem competent? Do they have instructions on how to deal with things like DNS leaks, or how to set up killswitches?

That's not an exhaustive list. It is absolutely a pain to determine trust -- this is the biggest problem with 3rd-party VPNs. Don't go crazy with it; a VPN is just one layer in your privacy setup, so it's OK to have something imperfect. Don't aim for perfect privacy, aim for "better than what I currently have."

<comment><USER4> You come off rather imperious in your comments here. Between the number of "I" self-references in your first post, to this saccharine checklist that is more show-off than informative.

As usual, I think the reaction of PIA's corporate restructuring is a lot of hot air over nothing. Typical of most hot air, it is released to draw attention to the source and not convey any real concern.

</comment></comment></comment></comment><comment><USER5> This is an interesting turn after PIA committed to "open sourcing our software" in March 2018:

[https://www.privateinternetaccess.com/blog/2018/03/private-i...](https://www.privateinternetaccess.com/blog/2018/03/private- internet-access-goes-open-source/)

20 months later, PIA open sourced its iOS app, older versions of its browser extensions, and 2 Swift libraries. Everything else is still closed source.

[https://pia-foss.github.io/](https://pia-foss.github.io/)

<comment><USER6> Thanks for bringing this up commoner and really appreciate your patience. You are absolutely right that we are open sourcing our software - there were some delays as we completely rewrote our desktop application from scratch.

This was a major concern from our new partners as well, as they have been asking us to release the code as well - we are all on the same page here.

While I can't give an exact date, I'm confident that the rest of the code will be released in 2 weeks or less. Along with our QT/CPP cross platform application, we will also be open sourcing our search engine, private.sh!

Hope this helps and sorry again for the delay, Andrew

<comment><USER7> Two years of patience?

You can still open source in-progress software.

</comment></comment></comment><comment><USER8> Usually, Subreddits are created by fans of the service. This is the first time I'm noticing a complete corporate subreddit. All the moderators are the staff of PIA. [1]

It will be interesting to see how much they accept criticisms on the subreddit about PIA.

1\. [https://old.reddit.com/r/PrivateInternetAccess/about/moderat...](https://old.reddit.com/r/PrivateInternetAccess/about/moderators)

<comment><USER9> It's not that uncommon. The stadia subreddit mods are all Google employees as well, for example. I agree it's not an ideal setup.

<comment><USER10> It's technically against the Reddiquette:

      Please Don't

      ...

      Take moderation positions in a community where your profession, employment, or biases
      could pose a direct conflict of interest to the neutral and user driven nature of reddit.

[https://www.reddit.com/wiki/reddiquette](https://www.reddit.com/wiki/reddiquette)

<comment><USER11> Something to add though, it's informal.

> Reddiquette is an informal expression of the values of many redditors, as > written by redditors themselve

But I guess it makes sense for Reddit to move away from that rule. That's how you get big campaigns with companies like Adobe. Not by taking away their sub- reddits.

Personally I think I even prefer that though. Better than having heavily biased "community moderators", which is the case in way too many sub-reddits.

</comment></comment></comment></comment><comment><USER12> I lost faith in PIA caring about privacy of its customers when I noticed how they use unique tracking codes in their newsletter emails. I never received a response when I asked about it.

<comment><USER13> Care to explain in detail, please?

<comment><USER14> Just about every single one of the email newsletters you receive from anyone does this. It's for tracking clicks to links in an email, opens of an email, etc.

Not apologizing for PIA - They definitely shouldn't be doing it if they're trying to advocate for privacy. But just stating it's extremely common practice and the default for most email services. I use it on my e-commerce websites so that I can send specific emails to people who have viewed a certain page, abandoned checkouts, opened a certain email but didn't convert, etc.

</comment></comment></comment><comment><USER15> We had an issue with PIA's Android VPN breaking our app, they never responded to our PGP'ed ticket and the email address embedded in their PGP keyblock bounces.

I wonder what will happen to Freenode now: [https://freenode.net/news/pia- fn](https://freenode.net/news/pia-fn)

<comment><USER16> Freenode and PIA have different parent companies, freenode hasn't changed owners so nothing will happen to it.

<comment><USER17> You've written this twice in this thread but how do you square it with this: [https://freenode.net/news/pia-fn](https://freenode.net/news/pia-fn)

<comment><USER16> Sure, that was back in 2017 as per the date in the blog post itself. Then this month from Kape themselves I've described here [https://news.ycombinator.com/item?id=21614447](https://news.ycombinator.com/item?id=21614447)

<comment><USER18> You are just plain wrong. They're both owned by the newly formed "Imperial Family Companies" and they both show up under the portfolio, along with the rest of the brands that used to be part of LTM.

[https://imperialfamily.com/](https://imperialfamily.com/)

To be clear, this is a brand new site that was created in the last few days, they bought up the domain for 15k a few days ago ([https://domainnamewire.com/2019/11/12/21-end-user-domain- nam...](https://domainnamewire.com/2019/11/12/21-end-user-domain-name-sales- at-uniregistry/))

<comment><USER19> FYI, OP is associated with them.

[https://irc.com/](https://irc.com/)

[https://kiwiirc.com/blog/Kiwi_IRC_gets_sponsored_by_PrivateI...](https://kiwiirc.com/blog/Kiwi_IRC_gets_sponsored_by_PrivateInternetAccess)

[https://web.archive.org/web/20191022202131/https://gist.gith...](https://web.archive.org/web/20191022202131/https://gist.github.com/prawnsalad/7b3f5929dadc81c39228e373fa0ca569)

[https://www.privateinternetaccess.com/blog/2016/12/private-i...](https://www.privateinternetaccess.com/blog/2016/12/private- internet-access-partners-reddit-irc-hub-snoonet/)

[https://snoonet.org/posts/2016/12/15/introducing-our- newest-...](https://snoonet.org/posts/2016/12/15/introducing-our-newest- partner-private-internet-access/)

[https://web.archive.org/web/20181109070719/https://snoonet.o...](https://web.archive.org/web/20181109070719/https://snoonet.org/updates/56-snoonet- joins-the-privateinternetaccess-com-family)

</comment></comment></comment></comment></comment></comment><comment><USER20> Any recommendations? This looks bad really bad. Cybergoast a previous VPN bought by Kape went to shit.

For the Pia engineer who ends up reading this. I have bin a Pia user for 5+ years. I have recommended it to friends and family. Now I have to tell them all to cancel.

<comment><USER21> Just cancelled my subscription.

Looking for alternatives now. Is NordVPN any good?

<comment><USER22> NordVPN is a security nightmare. I usually recommend either Mullvad or TunnelBear depending on whether you care more about quality of service or ease of use.

<comment><USER23> I use NordVPN, didn't know it had a bad reputation (purchased it because of a promotional offer). Care to elaborate?

<comment><USER24> The problem with NordVPN isn't that they had a breach and their keys were leaked (ok, well that is huge fucking problem) due to a forgotten KVM but that they didn't fess up till 18 months later when some independent researcher brought that to light.

<comment><USER25> Also they spend huge amounts of money on advertisement and their promotions contain lots of misinformation.

</comment></comment></comment></comment></comment></comment><comment><USER26> I've been on the fence about cancelling my subscription to PIA after being a user more than five years. This prompted me to finally do it.

I'm not sure there are any companies left to trust.

<comment><USER6> This is the problem with several privacy companies and one that we don't take lightly. At Private Internet, we are heavily focused on research and, specifically, have been focused on creating service architectures that limit or remove the need for trust altogether. That is what Zero Trust and Zero Access are about, and it's the only direction we are heading. That's why, for example, we launched private.sh, a search engine that you don't need to trust.

That being said I do want to mention, most VPN companies won't sign a binding agreement not to log - whereas our partners at KAPE signed an entire binding mission statement which you can find here:

[http://investors.kape.com/about-us](http://investors.kape.com/about-us)

<comment><USER27> It doesn't seem very trustworthy when the whole page talks about how much they value privacy, then the video at the bottom of the page requires you to enter an email address to watch it.

<comment><USER28> Also no [https://](https://)

<comment><USER29> This is the kicker here. Nothing else matters.

A business dedicated to privacy is completely incompetent if they can't even use HTTPS.

I cancelled my sub minutes after learning about the news. I would hope the PIA engineer can see through what buyout propaganda they are being fed and see the writing on the wall.

<comment><USER30> The user seemed to only omit HTTPS. It certainly is configured for SSL.

[https://investors.kape.com/about-us](https://investors.kape.com/about-us)

<comment><USER31> The company is still incompetent if they're not forcing that HTTP request to HTTPS.

<comment><USER13> Server sided redirection mistake. Most likely crappy developers were hired, or they don't care about their website in general.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> Friendly reminder: Azure and AWS both offer a free tier of VM which are perfectly sufficient for a personal openVPN server. Azure even has a preconfigured option in their marketplace that's easy to set up in a legal jurisdiction of your choice.

Probably so does AWS and even DigitalOcean, but I'm most familiar with Azure because of my own preference for open source (Azure's orchestrator is [https://github.com/microsoft/service- fabric/](https://github.com/microsoft/service-fabric/)). After the free year, a minimal always-on VM costs about $13/mo.

<comment><USER33> First that costs too much for many.

Second, you don't just want to prevent MITM, you (hopefully) also care about site's tracking you. For example, you have a Linux/Firefox user-agent and you are browsing HN in private mode, you close the window and start over. No cookies or other artifacts of the previous session remains but your user-agent and IP combibation is unique enough to identify your device. Now if you are using a VPN service there might be at least a handful of Linux/Firefox users out of millions that share the same IP.

Third, most VPN users like the geoip flexibility it allows them (bypass filtering or access different content).

Fourth, a VPS dedicated to this one service means you are now the admin of one more server that needs to be patched and supported by you (admin overhead)

Fivth, some sites block you if you use cloud provider IPs

Sixth, some VPN providers specifically host their infra in privacy friendly jurisdictions and take precautions cloud/vps providers might not (legally and technically).

Seventh, reputation. No one will bat an eye if Microsoft let some country's law enforcement have logs of your traffic in Azure. But by design, outbound VPN traffic can only be logged on the VPN server and it would ruin their reputation if they disclosed logs or tampered with traffic which translates to monetary loss.

VPN services are far from perfect but they hardly have any replacement. Just pick one with a good reputation.

For example with PIA, they are incorporated in the great surveillance kingdom of the UK, which is why I avoided them. They did not take the neccessary legal precautions and their freenode aquisition made little sense from a profit perspective which all in all suggests a grand scheme/vision not obvious to customers.

<comment><USER34> It depends on your threat model. If you're worried about threats below the level of major nation-states a big company could make more sense. If for example a VPN company was caught bundling malware with their VPN client they would be over, but their owners would loose much less than Google would under the same circumstances.

Google will cooperate with big governments, but you can be confident they aren't owned by the Russian mafia.

<comment><USER33> If you're dealing with nation states, all the big cloud providers have NSA presence in their network. Even without that,secret warrants are a thing and VPS providers rent datacenters from someone else ,that someone else (azure,hetzner,ovh,etc...) also rents out infra to VPN providers. The only differrence is VPN providets sell VPN while VPS providers let you access the whole vm.

The only differnce is how a VPN provider can be incompetent or malicious. It is less likely for MS to be incompetent but so long as the nation state is a western nation,they are more likely to be malicious.

I guess it does depend on your threat model but I would say for most people who don't have specific threat in mind they should exclude highly sophisticated attackers much like how you don't secure your housr against sophisticated bank robbers that might pull a heist on you.

<comment><USER34> > The only differnce is how a VPN provider can be incompetent or malicious.

Agree completely

> It is less likely for MS to be incompetent but so long as the nation state > is a western nation,they are more likely to be malicious.

Yes, but as I argued in the comment you replied to the difference in maliciousness is effictively infinitesimal because the govt can get access to any VPN provider.

<comment><USER33> There are different factors to consider,even if Microsoft intentionally infected people with ruddiam malware, at worst they get a fine and bad PR with tech circles -- their cash cows windows and azure remain unaffected. With a VPN provider like say Freedome , any sign of malice will cost them not only their VPN business but Fsecure's ability to provide infosec services. Same with ProtonVPN and ProtonMail, and unlike Microsoft the CEOs are much more likely to be held accountable since they reside in countries like Finland and Switzerland where privacy laws are very strict. Those countries may not like it if Microsoft did the same thing but they can't extradite Microsoft's CEO and even if they do the company is not incorporates in those countries. You want a VPN provider to be run by well known people that are not too powerful or too connected and reside in countries that will hold them accountable. Their main revenue stream needs to also depend on the reputation of the VPN service.

<comment><USER34> > Their main revenue stream needs to also depend on the reputation of the VPN > service.

I disagree with your last statement completely. A company dependent on VPN revenue will be incentivized to do whatever they can to get and monetize VPN customers. A company that offers VPN services as a side operation that isn't financially key to their operations won't be incentivized to lie to gain users, cut costs to compete with other VPN operators, or use malware to monetize their user base.

Microsoft could not care less if you pay them a few dollars a month for a VPN. They're certainly not writing software to target people running VPNs on Azure and inject tracking and ads to make a minuscule profit. But - if news broke that they were abusing any Azure users - Microsoft would lose a significant amount of corporate and government business.

Can you name a single example of Microsoft exploiting anyone with malware? No, because the resulting reputational crisis would devastate their ability to sell their "cash cows".

Fsecure's infosec business is worth a minuscule fraction of Microsoft's businesses, and thus the potential losses from being exposed as a scam are much less.

In contrast, 57% of the top 150 free VPN apps on the Google Play Store contain code to get the user's last location, and a small number request permission to read SMS messages and take pictures [https://www.bleepingcomputer.com/news/security/malware- user-...](https://www.bleepingcomputer.com/news/security/malware-user-privacy- failures-found-in-top-free-vpn-android-apps/)

Your comment on extradition isn't particularly relevant. Users abused by Microsoft could sue Microsoft in US court, and Microsoft would face significant legal and reputational penalties if they broke the law.

In contrast, while Finland and Switzerland do have strong privacy laws, that doesn't mean it's impossible for a "Finnish" or "Swiss" VPN provider to get away with violating user privacy. A criminal VPN provider could for example claim to operate in a country they didn't, or incorporate in a country while residing in a country less likely to prosecute them. Not saying I have evidence this happened, I am however saying that the fact that European countries in general care more about privacy doesn't make it impossible for a European company to get away with violating user privacy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER35> > Subscribed since: November 23, 2014 12:10 (Yearly payment)

I could simply not have asked for a better day for this to surface on HN :D

</comment><comment><USER36> PIA also very strangely bought freenode and has since engaged in a number of suspect activities.

<comment><USER37> Could you elaborate on this?

<comment><USER38> Announcement: [https://web.archive.org/web/20181109070719/https://snoonet.o...](https://web.archive.org/web/20181109070719/https://snoonet.org/updates/56-snoonet- joins-the-privateinternetaccess-com-family)

Original link appears to 404 for some reason: [https://snoonet.org/updates/56-snoonet-joins-the- privateinte...](https://snoonet.org/updates/56-snoonet-joins-the- privateinternetaccess-com-family)

ycombinator article: [https://news.ycombinator.com/item?id=14101538](https://news.ycombinator.com/item?id=14101538)

<comment><USER39> Also

Announcement: [https://freenode.net/news/pia- fn](https://freenode.net/news/pia-fn)

Weird ad for PIA guys cryptocurrency scheme: [https://freenode.net/news/spam- shake](https://freenode.net/news/spam-shake)

</comment></comment></comment></comment><comment><USER40> This is the same PR blabbering that occurs with any acquisition. It means nothing just like any other. I'm cancelling and changing providers. Does anybody have recommendations?

<comment><USER41> I'll be going from ProtonVPN to Mullvad because Mullvad does not offer any deals (which, in a way, I like as besides it being honest for a low price it allows me to unsub for a month). ProtonVPN with Secure Core is just too expensive IMO but the primary reason is Mullvad offer WireGuard, and when I looked them up I saw no red flags whatsoever. You could argue "Sweden" but not all ProtonVPN employees are residing in Switzerland either, so they could be coerced.

<comment><USER40> Thankfully, I don't have to worry that much about it. My only concern is that they don't keep logs and that they're not automatically updating and loading my PC with malware.

Though, if PIA ever put malware in their installer it would be like hitting the self-destruct button.

<comment><USER41> Neither do I. I don't tunnel 0/0 through VPN; only some BitTorrent traffic. This is civil court work; not criminal court. That the NSA (and EU counterparts) can figure out what I use BitTorrent for, that I take for granted. They're [in this use-case] not my adversary.

</comment></comment></comment></comment><comment><USER42> Can anyone give some substantiated information about Kape? Why is so bad? All I found was FUD.

<comment><USER43> [https://news.ycombinator.com/item?id=21584958](https://news.ycombinator.com/item?id=21584958)

With sources

</comment></comment><comment><USER44> What will happen with Freenode now?

</comment><comment><USER45> The submitted title was "PIA bought by company known for distributing malware". We changed it to the article title in accordance with the site guidelines: [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html), which ask " _Please use the original title, unless it is misleading or linkbait; don 't editorialize._" One reason we have that rule is that we're not in any position to decide the truth or falsehood of contentious claims.

</comment><comment><USER46> Time to go. Any suggested alternatives?

<comment><USER47> I went to Mullvad personally.

</comment></comment><comment><USER48> I've never used these VPN services before. Is it possible for them to MITM a connection?

<comment><USER49> Yes, they can install certificates that enable MitM.

That's one reason why I never use custom clients for VPN services. That is, no binaries.

I just get the OpenVPN PKI stuff, and use stock OpenVPN.

<comment><USER50> > Yes, they can install certificates that enable MitM.

Well, only if you give them permission to. Just use a non-provider specific client and you're okay.

<comment><USER49> I don't use them, so I don't know whether they'd ask specifically about the TLS cert. It might just be something about "web security" or whatever.

And about using stock clients, that's what I said :)

From openvpn.net or in Linus distros or in pfSense, for example.

</comment></comment></comment></comment><comment><USER51> Can anyone vouch for mullvad VPN?

[https://mullvad.net/](https://mullvad.net/)

<comment><USER52> They're recommended by PrivacyTools.io¹ You can read more about their methodology² and what's wrong with most other "VPN review" sites.³ They're also a top pick from wirecutter.⁴

¹[https://www.privacytools.io/providers/vpn/](https://www.privacytools.io/providers/vpn/)

²[https://blog.privacytools.io/choosing-a- vpn/](https://blog.privacytools.io/choosing-a-vpn/)

³[https://blog.privacytools.io/the-trouble-with-vpn-and- privac...](https://blog.privacytools.io/the-trouble-with-vpn-and-privacy- reviews/)

⁴[https://thewirecutter.com/reviews/best-vpn- service/](https://thewirecutter.com/reviews/best-vpn-service/)

</comment></comment><comment><USER53> Your plan will expire on October XX, 2020. Well... shit!

</comment><comment><USER54> I believe that the title should be changed because: "In late 2012 Sagi acquired the start-up company Crossrider for $US 37M." [1]

That alone tells you that Kape's (or rather, Crossrider's current owner) had nothing to do with their past actions, and could be therefore considered libel.

Moreover, post that someone linked with all the proof is pretty much a lot of FUD, and while I'm not happy with the sale, I fail to see any actual proof being brought up.

[1][https://en.wikipedia.org/wiki/Teddy_Sagi#Kape_Technologies_p...](https://en.wikipedia.org/wiki/Teddy_Sagi#Kape_Technologies_plc)

<comment><USER55> > current owner had nothing to do with their past actions, and could be > therefore considered libel.

I'm not sure that follows. When you buy a company, one of the things you're acquiring is that company's reputation -- for better or worse.

<comment><USER54> But the title of the thread insinuates that Kape is known for distributing malware, not the company it had acquired. I personally believe that there's a big difference between saying: "PIA bought by company that also acquired a company known for distributing malware" and straight out claiming that PIA's acquirer distributes or has distributed malware at some point in time.

<comment><USER56> Kape _is_ Crossrider. Crossrider was renamed Kape and a new CEO was put in place to "exit the advertising market" transitioning to cyber security.

</comment></comment></comment></comment><comment><USER57> What PIA is this about? Pakistan International Airlines? Who also own the Roosevelt Hotel in New York? Famous for the livery with the green tail marked PIA.

<comment><USER58> How about clicking on the link? It's in the path, the subreddit name and the post.

<comment><USER57> On a second look the sub Reddit is named privateinternetaccess, but nowhere on the page can I see PIA expanded as such.

<comment><USER59> You have to employ basic reading comprehension skills sometimes

<comment><USER57> It is common copy editing practice to expand an acronym it appears the first time in a text, that is all.</comment></comment></comment></comment></comment>


YugaByteDB high-performance, transactional database for distributed services - <AUTHOR> https://github.com/yugabyte/yugabyte-db <comment><AUTHOR> Comparision with SQL and NoSQL DB on their homepage. [1]

Claims to be a CP system with Distributed ACID transactions. Has anybody checked this out before? Any opinions?

CEO[2] & CTO[3] are ex-FB, Oracle, MS guys. From the site and docs, the product seems to be quite capable.

[1]. [https://www.yugabyte.com/](https://www.yugabyte.com/) [2]. [https://www.linkedin.com/in/kannanmuthukkaruppan/](https://www.linkedin.com/in/kannanmuthukkaruppan/) [3]. [https://www.linkedin.com/in/kranganathan/](https://www.linkedin.com/in/kranganathan/)

Edit: Added info about the CEO and CTO.</comment>


An iPod Watch Project Explodes Online - <AUTHOR> http://bits.blogs.nytimes.com/2010/12/03/an-ipod-watch-project-explodes-online/

<comment><USER2> Hopefully this brings Kickstarter & garage-scale entrepreneurship to the mainstream.</comment>


Cryptographic key used to sign one of Facebook's Android apps compromised - <AUTHOR> https://www.androidpolice.com/2019/08/29/cryptographic-key-used-to-sign-one-of-facebooks-android-apps-compromised/ <comment><USER2> > (apkmirror) We're especially concerned about security, given how dangerous > downloading apps from third-party sources can be, so we go out of our way to > manually review and vet every APK that hits the site.

Kudos. I wonder why PlayProtect didn't catch this? On one hand project-zero does stupendously well and on the other a project like PlayProtect fails at checks that an _untrusted_ third-party routinely does. It can't be incompetence? It can't be blind reliance on AI?

Android has a 2B install base, and security will quickly turn into an unprecedented nightmare as more and more people get exposed to scamware, spyware, scareware, malware for the first time. This is not even factoring privacy encroaching viral apps like Helo, ShareChat et al that have in some cases 100M+ installs.

<comment><USER3> GPZ has some of the very best whitehats in the entire world and they are evaluated based on what they find, not what they fail to find. They have the time to review code in depth. They are also usually investigating vulnerable code rather than malicious code, which doesn't seek to hide from investigation.

PlayProtect needs to be able to evaluate every app in existence (millions of apps on the Play store, ??? off the play store, and dozens or hundreds of versions of each of these apps). Malware authors are incentivized to perform all manner of tricks to avoid detection (code obfuscation to prevent static analysis, environment detection to prevent dynamic analysis, etc). It needs to do so in a (presumably) fully automated fashion since there are so many apps. It also gets little credit for when it works and instead only makes the news when it fails.

So 100% of the coverage of GPZ is positive and 100% of the coverage of PlayProtect is negative.

<comment><USER2> I get your point but my intention was not to highlight the different areas of security GPZ and PlayProtect tackle, but the gulf in class in competence and level of execution between those groups (if I may say so from the armchair I'm sitting on).

That said, the last bit abt a 100% coverage rings true. The signature check; however, seems like one of the important things to do (of course, there are lot of edge cases to be taken care of)? It can't be any more expensive than the AI they run on millions of apps.

<comment><USER3> "It isn't that hard" isn't always a good reason to implement something. I don't know the details, but it could be entirely reasonable that at every prioritization step people have decided that something else was higher impact.

Add to this the fact that signing keys are often shared in weird ways (usually with OEMs) and maybe it doesn't make too much sense to use "this is signed weirdly" as sufficient evidence to remove from Play.

</comment></comment></comment></comment><comment><USER4> Does anyone have a recommendation for what best practice for Android app signing key maintenance is (or maybe multiple people strongly suggesting entirely opposite ideas ;P), under an assumption that one absolutely intends to be distributing their app via numerous sources (not just the Play Store)? Our app (which hasn't launched yet) is security critical for the user (it is a VPN client, and so can see all of the user's traffic, as well as a cryptocurrency application, and so has access to some amount--not likely a large amount for various reasons: this isn't really a wallet--of money), and so with the appeal of "immediately steal money from users" we expect it/us to be targeted even with lower install counts (so this isn't a pipedream with a reality check of "we are never going to get popular anyway").

We are totally willing to do "weird" things with hardware signing keys in the name of security... it just isn't really clear what the correct thing to do is :(. Should we be using Google Play App Signing for the Play Store, even if we can't do that for other distribution mechanisms? As I kind of remember unrelated stores being able to manage and upgrade apps (particularly free ones) from different stores, as they just get a list of installed apps from the OS, it would seem problematic to use a _lot_ of different keys (such as one per store)? I will again note that, due to our constraint of being pretty sure we will have off-App Store distribution (some of our key markets don't use the Play Store much), we need to solve the key security problem for non- Play Store distribution "anyway", and so can't just fall back on "don't do local signing".

Meanwhile, I didn't even know yet about the Android 9 key rotation feature mentioned in this article, which I could see maybe having major changes on best practices here, though maybe only "going forward" (given how few users have upgraded to Android 9 so far, and now that I think about it probably won't for years to come...). In a world where you can effectively never change your key, it seems really important to have your act together on "day 1" to get stuff right (though I also am not even sure what is reasonably possible, given how I think it all fundamentally relies on a single key? so we can't do some kind of multi-sig? I also don't know if we can do sub-certificates with short signing duration with a root certificate backed by a vaulted key, as people often do for SSL?)

<comment><USER5> Whatever you do, if you are high value then you should consider the risk that your source repository could be compromised too. Using separate hardware signing keys for git/whatever is something you should therefore also strongly consider I think.

Reproducible builds can also help you to mitigate this risk - so you then can cross check that the source is properly signed and produces the right binary before signing the binary. If you are publishing source code then your customers can also double check this as a second vector, should they want to.

</comment></comment><comment><USER6> How was the key compromised?

Did someone breach Facebook to steal it, or did Facebook employees post it somewhere?

Curious to learn more details. Probably again much worse then initially being reported on.

<comment><USER7> There is also the possibility these other apps sharing the same key are secretly owned by Facebook and are another arm of their covert data harvesting tactics.</comment></comment>


My mission to solve the problem with Facebook, Google+ etc. - <AUTHOR>

Now I know everyone has their own issues with the current state of social networks. Some have issues with privacy, some have issues with too many friends, some have issues with spam. My issue is with all the above, but more importantly I am sick of the fact that I look like everyone else and I don't own the content. I am being controlled and it needs to stop.
I am tired of feeling like I live in an apartment complex where I have no control over how things function or look. It's not even like a complex anymore. It's more like a prison.
Best quote in a long time...
"If you aren't paying for a product, you are the product."
Your data is being sold to advertisers so they can find sneaky was to throw their ads in front of your faces. And who is going to take the time out to actually go through on FB and customize your ad experience so they are relevant to you? Not me.
For the past year and a half I have been working on a solution to solve these problems and many others. It's been a very difficult journey. But I am so passionate about it that I will stop at nothing to see this vision come to life.
I have had my car repo'd, 3-day notices from my landlord almost every month for the past year, cell phone service canceled for good, family and friends giving up hope and not believing in me and to make matters worse I have a wife and two kids under the age of 4. For 6 months I had to ride around Orange County on a beach cruiser pulling a trailer w my two kids in the back. Not complaining at all, it was a humbling experience and we had a lot of fun with it. There have been days where we literally haven't had anything to eat besides rice. It's been the single most biggest trial of my entire life. But I'm pushing forward because life is too short not too.
The good thing is, I have a very talented team behind me. Also a bunch of influential people that are backing us and this idea. We are wrapping up our prototype and will begin seeking funding soon to bring on more incredible engineers & designers.
My start-up's name is Seshn.com (http://seshn.com). Seshn is a network comprised of personal websites (not profiles) where content is aggregated to feeds that are based on interests/passions and people are ranked based on influence within those areas. Our people discovery engine will allow users to discover the top people in areas that interest them. It's very minimalist and the UI/UX is stunning.
Unlike Tumblr we are focused on full-blown sites and people only. Blogging and syncing your social media to automate as posts will be a big part of our network, but we also want the user to be able to tell a story about who they are through different pages on their site and we have made it so easy to do so.
Another huge thing is data and style portability. If I wanted to take my Facebook profile with me along with all my content and self-host it, there is no way to do that. Same with Tumblr, same with Twitter, etc. Our platform has 100% full data AND style portability so you can take everything with you to a new host if you chose to leave someday. The bad thing is you won't get the benefit of the network, but you will have all of your data and style in tact to go where you please.
We are about to solve a HUGE problem with the broken web design industry through an innovative approach to e-commerce within our site. I can't really tell you details on how this is going to work but it's going to allow people to have gorgeous sites that look like they paid thousands of dollars for them. Some say this problem has already been solved, but it really hasn't because for a completely custom look on somewhere like Tumblr or a self-hosted site, there is still a learning curve involved or you still have to shell out some major bucks for the design. These problems will be solved within our platform and we can't wait to show everyone how it works.
I have been reading some of the news here on HN about people's complaints with Facebook lately and I was inspired to let you know whats coming from Seshn. I've put my life into this and so have the rest of the members of our team.
I encourage anyone thinking about starting a business to just go out and do it. Don't worry about anything. Embrace the journey and embrace failure, because you will learn from the experience and it will be invaluable throughout the course of your life. Even live throws major roadblocks at you, figure out how to go around them, over them or through them. Don't give up!
Stay tuned for what's coming very soon. I know you'll love it. Coolest thing I've ever worked on and will inspire everyone to create more and consume less.
Thanks for reading!
Sign up for a beta at http://seshn.com or you can follow us here:
http://angel.co/seshn http://twitter.com/seshn
-Brand <comment><USER2> I feel you man, I really do. I share your concerns over the major social networks, and I can see that you're really passionate about what you're doing and where you're going. I can see two major roadblocks, though: getting users to quit their Facebook, Twitter, Google+ or Path is HARD. You're running against some mighty big dogs, here. How are you going to convince users to switch?

The other roadblock is monetization. If you arent't going to sell your users data to advertisers, how are you going to make enough money to keep things going?

If you figure these things out, you're onto something. Let us know how things are working out, I know we all like to read about a coding guy with a crazy idea who lives in a beach cruiser!

</comment><comment><USER3> Sounds like it will be worth checking out. Looking forward to the launch.

I signed up for the beta but the "spam our not yet launched product/service to your friends and maybe you can start using it sooner" is getting old.

<comment><AUTHOR> I agree it's getting old. What could we do to make it better?

<comment><USER4> I think just leaving that portion out would be a good start. If the service garners enough interest from the user then they will genuinely tell their friends/family about it without feeling like you pressured them to do so.

<comment><AUTHOR> Thanks for the feedback. I just changed the text to reflect your thoughts.

</comment></comment></comment></comment><comment><USER5> I don't like that you make me share before I get an invite.. It should be the other way around - why would I share something and recommend it to my friends before I tried it?

<comment><AUTHOR> See below... thanks

</comment></comment><comment><USER6> No offense but your product seems like a Tumblr clone. Not much to do with social networking at all, it appears.

<comment><AUTHOR> No offense taken at all. Tumblr allows anyone and everyone to create an account and participate on their network. Which is awesome. We are strictly focused on people. Rank and influence in areas you are passionate about will be a big part of Seshn. Also, Tumblr puts a strong emphasis on reblogging, which totally makes sense for them. Not for us. We want people to put value in creating original content themselves and not just sharing a bunch of things that have been shared over and over again. That is so noisy. Thanks for your comment. I really appreciate it!

</comment></comment><comment><USER7> Registered for beta and saw Viagra ads right away. Enough said. It sounded good but it blew it for me.

<comment><AUTHOR> Ha! What do you mean u saw Viagra ads? Where?

<comment><USER7> At the bottom of the page, I returned but I can't see them anymore.

</comment></comment></comment><comment><USER8> Seems like nobody here has any interest your world-changing product...

<comment><AUTHOR> Haha. I don't think it reached enough people to be honest and I didn't promote it to anyone. I have been reading HN for awhile now but never made a post. This was more of a test to see what sort of a response this got, without putting any work into it. The problem with any pitch over a forum is that it's sometimes hard to grasp due to lack of visuals and seeing it live. Regardless of the lack of response, it really doesnt mean much. Pressing foward like always...</comment></comment>


Our crazy-fun new visual search tool from Pinterest - <AUTHOR> https://blog.pinterest.com/en/our-crazy-fun-new-visual-search-tool <comment><USER2> For those who haven't clicked. You can zoom into an image and it will do image recognition on the item you are trying to view and pull up similar pins.</comment>


Show HN: CSS-in-JS (styled) library, just hit it's size in stars. Under 1k - <AUTHOR> https://github.com/cristianbote/goober <comment><USER2> Heyo! goober author here! Thanks for the shoutout!</comment>


Greece's doomed generation - <AUTHOR> http://www.guardian.co.uk/commentisfree/2011/may/11/greece-doomed-generation <comment><USER2> I feel bad for the unemployed youth, but are can they really be called "doomed", considering freedom of movement of workers in the the EU?</comment>