The Tablet Is Being Squeezed Out - <AUTHOR> http://www.sanspoint.com/archives/2015/04/29/the-tablet-is-being-squeezed-out/ <comment><USER2> My observation has always been, tablets; specifically iPads; are too expensive for what they are doing. That and just because its an Apple tablet doesn't mean I need to pair it up against an apple laptop. Hence cost comparison is done against other laptops which are priced even lower than the iPad at times.

Its hard to get excited by technology when every price point is four hundred and up. How many items do they want me to have now? phone, watch, tablet, and laptop? Far too many redundancies

<comment><USER3> I'm not going to deny they are expensive, which slightly taints my take on it, but I see tablets as the ideal consumer device and a terrible retailer device. Once you purchase a sufficiently powerful device there is no need to upgrade it in anything like the sales cycle that people like Apple are hoping for.

A yearly product update is useless for a device that is primarily used to view the internet, check email and watch Netflix or whatever. If it does that when you buy it, it will do it for 4 or 5 years. It lives on the couch or on the bed meaning general wear and tear don't exist much so replacement from damage is a low possibility too.

Apple even help out here because the App Store makes getting old versions of the apps that are supported on your version of the device (where available) transparent, thus the feeling of becoming out-dated is kind of non-existent unless you are a tablet gamer.

For example until last month both me and my partner used a Gen 1 iPad probably for 2 or 3 hours a day every day. I upgraded to a newer version mostly because JS heavy pages like the Guardian and Facebook had started to crash regularly. The latest iterations are so much more powerful that I don't see this being an issue for another 5 years at least.

Sales can be flat even though consumers can be happy with the tech.

<comment><USER4> While I agree with this, the unfortunate reality is that with the iPad specifically, older versions become useless as Apple pushes OSes that demand more from the hardware, and performance becomes a huge issue. And if it's not performance, it's storage space.

And opting out of the upgrade isn't much of an option, due to app upgrades that require the latest OS. And I guess you can also opt out of app upgrades, but then you're left with a 2-year-old+ device and 2-year-old+ software.

Maybe this is intentional. But for me, at least, rather than upgrading, I've learned to just move on to using a combination of my iPhone and MPB, and my iPad (3rd gen) mostly collects dust now.

<comment><USER5> This is what happened to me as well. I fought off the push to buy a tablet despite a lot of friends showing me theirs (and admitting that they were cool).

At the same time, I had a desktop for "heavy lifting" like graphic design and 3d animation, storing a big media library, playing games, etc. I also kept a cheap, portable laptop for the occasional times I needed to travel and wanted some semblance of computing from a hotel room or an event. For all of the other lightweight tasks, I had been using smart phones since the early Treo days so that was fine for email and looking up info.

But then I was planning a longer trip from the US to Southeast Asia for several weeks and it was going to involve a lot of hopping from town to town. Suddenly even my laptop was too much to carry when I already had everything on my back. I caved and bought an iPad 2 for a good deal more than I wanted to spend. They were still hard to find so I could only find the larger capacity models and the only Android tablet worth considering (Xoom) was not as capable and still cost about the same.

That iPad was pretty cool and I used it for a year or two before it just got to be a pain in the ass. Updates were de facto mandatory as you mentioned. Staying on old OS versions meant unsupported apps and constant nagging. But each OS update made the thing perform worse and worse. The hardware cycle was much faster than that of desktop/laptop computers at that point so I couldn't assume the normal 5+ years of usefulness I'd get from a laptop and there's no option to just install a lightweight Linux distro or downgrade. Even after I jailbroke it I couldn't really do much to speed it up. At this point, doing more than opening a single browser tab or lightweight application will make the thing lag and stutter and generall suck.

I think now it gets powered on a few times a year for me to check on updates and see if there's anything worth checking out. Haven't bothered selling it since it's my only iOS device and I figure there may be a point where I want to try some iOS exclusive so I keep it around for that.

</comment></comment></comment></comment><comment><USER6> John Gruber had a good observation about the charts published in Quartz (specifically the last one): _" Apple has sold more iPads in its first 57 months than they sold iPhones in its first 57 months."_

[http://daringfireball.net/linked/2015/04/27/quartz-chartz- ap...](http://daringfireball.net/linked/2015/04/27/quartz-chartz-apple)

[http://qz.com/392202/were-live-charting-apples-second- quarte...](http://qz.com/392202/were-live-charting-apples-second- quarter-2015-earnings/)

If Apple pumped out over 250 million iPads, a great majority of which is probably still in use, with the usual Android and Windows numbers the whole tablet population must be in the neighborhood of one billion.

I believe the "slower update cycle" explanation, and I'd guess many are waiting for wireless battery charging, nowadays the obviously missing hardware feature.

<comment><USER7> First of all, Gruber is absolutely right that there are still a whole lot of tablets being sold.

That said, sales have plateaued at best and there are probably a lot of contributors:

\- Slow upgrade cycle as you suggest. I have a 2nd or 3rd gen iPad and I have absolutely zero reason to upgrade at this point.

\- They are probably being squeezed to a certain degree. I find that, even with just an iPhone 6 rather than a Plus, I'm often more inclined to just read on my phone than go grab my tablet.

\- I've probably become more quick to grab a Chromebook or some other laptop I have laying around than do anything half-way complicated on my tablet. So there may be some realization that tablets are sometimes more trouble than they're worth even for more complex mostly-consumption tasks.

\- I suspect that we may end up with some sort of tablet and laptop reconvergence even though tablets took off in large part because the convergence between the two devices was broken.

<comment><USER8> Nah, tablets will be huge again. The key will be making them a better input device. Voice recognition, stylus, haptics, keyboards, touchless gestures: [http://youtu.be/qKQCjwMDiPM](http://youtu.be/qKQCjwMDiPM)

At the very least, sliding a Bluetooth keyboard and mouse next to your tablet then having it turn into "laptop mode" would solve the problem.

<comment><USER7> >At the very least, sliding a Bluetooth keyboard and mouse next to your tablet then having it turn into "laptop mode" would solve the problem.

I don't really disagree. This might well be what the reconvergence looks like --in combination with software changes that better bridge different modes of operation.

That said, you may also be right that enhancements to interfaces could make a tablet-type device qualitatively better than today while also pushing it in directions that are fundamentally different from the type of device needed to do the types of tasks we mostly use laptops for today.

<comment><USER9> Do you guys know you're actually describing the Surface 3 in detail? ;)

<comment><USER8> The Surface probably needs another rev or two. Microsoft is doing a lot with Cortana. How long before I can sit down and write a small document with it, for instance, with the ability to make significant edits? It's also laptop heavy.

Microsoft is approaching the tablet by scaling down a laptop. I like it but it needs more work.

</comment></comment></comment></comment></comment></comment><comment><USER10> I still don't "get" tablets. What are they good for again? If I need/want to code (or type anything longer than a text message), I want (at least) a laptop. If I want to consume media while on the go, I care more about portability than anything else, so I use my smartphone -- it fits in my pocket so I always have it with me (unlike a tablet). If I want to sit up in bed (or on the couch) and read a novel, I use an e-reader. It's MUCH easier on the eyes (and I think I spend enough time staring at LCDs as it is).

There's nothing I want to do these days that would be better served by a tablet than a more specialized device. I bought a Gen1 iPad when they were new. It sat unused 99% of the time, until my kids got a little older (they love tablets, huh).

<comment><USER11> I use a tablet to do all my reading, 95% of my media consuming, and it's an integral part of my music studio.

I may be an anomaly, I do not like having a smartphone, and am looking forward to the day when my device set will be watch, tablet & desktop.

<comment><USER12> I'm similarly anomalous, for whatever that's worth. I prefer a feature phone and sometimes a tablet as well when I'm out but wanting some basic tools and connectivity. I use high-spec desktop workstations for most real work, proper servers for shared facilities and larger-scale storage, and a mid-range laptop for things like meetings or on-site client visits.

I don't really see the attraction of smartphones given the alternative devices you can use today -- they're sort of half-OK at lots of things but not really great at anything, and a lot of them seem to have worse stability, security and privacy problems than every other device I use put together.

</comment></comment></comment><comment><USER13> Tablets are content consumption devices first, and productivity devices second. I love my iPad, but I see very little reason to upgrade it considering its perfectly suitable for reading books, browsing the web and watching the occasional movie / show on Amazon video, Fios etc...

I am also very jaded by how much performance degrades with every iOS update and refuse to get caught up in the "upgrade every year" Apple cycle.

<comment><USER14> > _I am also very jaded by how much performance degrades with every iOS update > and refuse to get caught up in the "upgrade every year" Apple cycle._

I haven't noticed any of this ever, except in the cases of bugs (stealing cpu for some apps etc) that eventually get corrected. And I update my iPad the first day any new OS version comes out.

I even still use my 2nd gen iPad update to the brim.

</comment></comment><comment><USER15> Personally, I use a tablet for media (ebooks, tv, movies, etc), but as a programmer I need a real physical keyboard and acces to the programmer stack (vim, git, ssh, grep/awk, etc)... But honestly unless you're a student or business doing data entry I don't see the need for a full blown computer, though recent instability in the Android OS has made me wish linux tablets would get to the US market sooner rather than later.

<comment><USER16> What is this recent instability in the Android OS that you speak of?

</comment></comment><comment><USER17> I think this is fairly self explanatory. Since iPad 1 launched, phones got bigger-better and the median laptop got more portable (weight, battery..). If you take a bag, your little laptop can come. If not, phones fit in pockets and need to come anyway. The space between the two got smaller, I agree.

My 3 years old Ipad's job is mostly watching movies on planes. It does that job well enough and I won't replace it unless it breaks. I just don't need any more from a tablet.

Honestly, I think iPad's will almost go the way of the ipod, but with tougher competition. Good enough.

OTOH, if I was king of the apple…. I think a good idea for a new product category is a ~€500 iOS laptop. Chrome OS is selling well, and I think Apple would probably do a better job in that general space. Iphone apps could run as 'widgets" which would automatically tick a lot of boxes (Skype, VLC.. whatever your non negotiable apps are).

There's still a poorly served market here. Home users who don't like computers much, don't want to spend a lot and need something simple that works.

I don't know if you still call that an iPad, but I reckon it'd sell.

<comment><USER18> I disagree. What I do with the iPad is different than what I do with a laptop, and I would guess most of the people who opt for an iPad instead of a notebook uses it like that too. After starting with the iPad reading anything on the computer sees intolerable, and this reading web pages/pdfs/etc use case by itself for me validates the iPad. Now, I understand other people may prefer to carry a notebook all the times, but if Apple replaced the iPad with an iOS laptop I would have absolutely no reason to buy it. Everything I like in the iPad is related to its form - size, weight, no keyboard, can be rotated etc.

</comment></comment><comment><USER19> > Something needs to happen to break it free, but what that is, I don't know. > It has to take advantage of the form factor in a way that cannot be > replicated on the smartphone, and do it better than a small, ultra-light > laptop.

This is where "perceptual computing" and in particular 3D sensing comes in. Both smartphones (too small for a decent sensor, battery life and screen issues) and laptops (too bulky to handle) have sub-optimal form factors for this but tablets are perfect.

Take a look at Google Tango [1] for instance or -- shameless plug -- my own company DotProduct [2]. We have been doing this for a while and have tried many different platforms for 3D capture and what we found is that tablets just feel by far the most natural in this environment.

[1] [https://www.google.com/atap/project- tango/](https://www.google.com/atap/project-tango/) [2] [http://dotproduct3d.com/](http://dotproduct3d.com/)

</comment><comment><USER20> There's several things to disagree with here.

I see a trend where people want smaller phones. The current phone are getting too big and people are getting fed up.

Secondly, I bought my wife a tablet 6 months ago, and she haven't used the laptop since.

Tablets have clearly peaked, but I don't think they will be going away anytime soon.

<comment><USER21> Realy? I think the opposite is the case...

Smartphones are getting bigger and tablets are getting obsolete.

I have a 6.1" Smartphone and stopped using my tablet with this. Before that I had a tiny phone and a tablet.

<comment><USER22> your choice of the biggest smart phone is a personal choice, makes a tablet unnecessary for you, not OBSOLETE. You're going to find devices spread out more rather than consolidate. despite what people think, things get more complex, not less and the market for products grows a longer tail rather than things disappearing.

</comment></comment></comment><comment><USER23> Remember how the tablet was going to totally destroy desktop computing?

That said, tablets are a little bit better for reading, or for "computing in bed" and those sorts of things.

<comment><USER24> Tablets are also better for non-technical users as their primary computing device. This is entirely a software issue and has nothing to do with tablet form factor except that is where this software philosophy became mainstream.

<comment><USER23> I don't agree. Apple and Microsoft have been entirely about making computers easier to use and bringing them to the masses for a long time. To the extent tablets are easier to use it's because they don't support multitasking.

<comment><USER24> You don't seem to disagree! Yes, they don't support multitasking. They're also very restrictive with limited application interaction modes. The primary interface is a full screen of evenly spaced product icons. All of these things are why they're good for non-technical users.

These restrictions also make them very malware proof. They're products which just work and don't much, if any, support or maintenance.

Microsoft and Apple could have never brought out a desktop or laptop with these kind of limitations before tablets became popular.

</comment></comment></comment></comment><comment><USER25> Whenever this topic comes up, I'm reminded of a line from the BBC drama "Micro Men", referring to a slump in sales of home computers:

"In December 1983, every child wanted one for Christmas; By December 1984, every child who wanted one had one."

PC sales have been steadily declining for years, because there are few new users and existing users see little reason to upgrade. Tablets have reached a similar point of market saturation and sales are starting to stall. Smartphones are the exception, because of natural churn - smartphones are far more likely to be lost or damaged, and they are "free" at the point of purchase.

</comment><comment><USER26> I honestly think that Apple will be able to reinvigorate iPad sales when they offer some new capability. The iPhone has (almost) always had a compelling reason to upgrade. My wife's iPad 3 Retina doesn't seem to perform better than my non-retina iPad 2. While I'm itching to replace the iPad (it's getting slow, app crashing, etc.) I'll be moving to a Surface Pro 4 (or 3 if I can't wait that long) or a $200-300 Android tablet depending on how I see my use cases playing out. I really like the idea of a 4-5" Android phone + an i5/i7 surface eliminating the need for a tablet and a desktop.

If there was a compelling new iPad coming out, we'd be on the hook for at least 1, and I imagine that many of the 250m iPad users would be ready to upgrade ASAP.

Then the question becomes, what would be compelling enough to upgrade?

\- Possibly size, but probably not. A $600+ iPad in 10-12" would be hard to justify over a Surface. \- New sensors? Adding the PrimeSense 3d sensor (maker of the original Kinect, now owned by Apple) would enable a TON of new use cases. \- Multitasking? \- Ability to run OSX software?

</comment><comment><USER27> I think an average user has only so much time in the day to commit to "screen time" or some time spent in front of a screen for work or leisure purposes. Between my phone, computer, laptop and TV I am already spending 60-80% of my day staring at some type of a screen. The tablet doesn't help me do my work or leisure activities better than any of those devices.

The only reason I ever spend any time with my tablet is because I love to draw and I have the Samsung Galaxy Note 10.1 with a built in Wacom digitizer (and even then I sometimes prefer to just pull out a sketchbook and a pencil).

</comment><comment><USER28> My Nexus 7 is basically a glorified Reddit + YouTube device. It works quite well for that, but I've never really seen the appeal for using it instead of a laptop for most of what I do.

</comment><comment><USER29> A problem is that a lot of people who might get a computer, and use it to do/write stuff, get a tablet, and use it to watch/read stuff. Because it has no keyboard.

</comment><comment><USER30> Another data point on upgrade cycle: I dropped my Asus Transformer and cracked the screen recently. While trying to make a repair-or-replace decision, I looked around for options with a similar rigid hinge detachable keyboard and came up unimpressed. All far too expensive; much easier to spend £20 and a couple of (slightly nervewracking and fiddly) hours replacing the touchscreen.

I suspect a large driver of phone replacement is more frequent accidents, loss, and theft.

</comment><comment><USER31> Since I got an iPhone six I find myself using my iPad far less for anything but drawing.

I bought it entirely to do drawing during skype tutoring sessions. Now I'm also using it with Astropad to make drawings for screencasts.

When I had an iPhone 4, I started doing a few other tasks on the iPad as well. But now that I have a larger, faster phone, I have no desire to be on the iPad apart from the things I can only do on the iPad.

<comment><USER32> iPhone six

</comment></comment><comment><USER33> My two cents on the slow upgrade cycle: tablet users just don't care.

Phone users upgrade for two reasons. Status symbol, and phones get abused. You need the new iPhone. You drop your existing iPhone. You lose it. People are more careful with tablets. At the coffee shop nobody gives a crap if you have the iPad or the iPad Air.

Not to mention that tablet users aren't as techy as laptop users or even phone users. Seniors love iPads. They don't see what the hubbub is all about with the new models. They can't see well enough to care about Retina screens. They don't like change and they don't see any point in spending $400 every 2 years on the latest stuff.

</comment><comment><USER34> The iPad is a strange beast from an upgrade cycle. We were upgrading pretty fast at the start (upgrade ours, give our to others) particularly because of the iOS compatibility problems with older iPads. That changed in the last 18 months, we don't upgrade as aggressively and it seems like we can keep using our older hardware longer. The iPhone is an every two years item (buy, skip next, buy), and that doesn't seem to be changing.

I would bet on a bump with a bigger screen model which will put some distance from the phablet iPhones. I really see no reason for both an iPod touch and iPad mini.

</comment><comment><USER35> Thinking about device types is backwards. The choice should be what cloud services from Google, Microsoft, Github, Bitbucket, etc. that we need to use and make sure that access to our working and entertainment data assets is simple on all device types.

As much as I like my iPad for web browsing, my Note 4 phone is much more part of my digital life because it can access my data assets and is almost always with me.

Microsoft seems to have hit a sweet spot with the Surface 3's and I wonder if Apple would ever offer an iPad with the same kind of cover/keyboard when you need it.

<comment><USER36> I don't know what happened, but in the last six months, the number of Surfaces I've seen has absolutely exploded, they're _almost_ everywhere now.

I think there's been a push in some corporations to start offering it as a truly mobile device in lieu of less portable, and not as useful Dell machines and the folks I've talked to about them absolutely love them.

The idea of having a tablet you can easily show documents and presentations off of, and when you have to type the cover _is_ the keyboard, drop it in a dock and you've got a large screen with mouse and traditional keyboard, grab it and you're immediately on the run. Great battery life, runs all the important applications without fuss, decent specs.

I've definitely felt some envy for the beautiful doc, especially when I'm struggling with all the various cables and dongles and crap I have to plug in and out of my Mac to make it a useful desktop machine. Maybe the new Mac Books will solve this with USB-C?

 _sidenote_ I have a Note, and it's easily the best portable computer I've ever owned. I've easily gotten through an entire day's worth of meetings using nothing but my phone to deal with emails (while listening to music or podcasts), get directions, make some calls (often while surfing the web), and then when I'm there, scribble pages of notes (which I can then email out to participants before we've left the room). A couple places I go even have Chrome casts and I can just mirror the screen and present right off of my phone.

It's kind of a magic portable office device, and I don't think I've ever drained the battery on it. I know other phones offer all of that, but there's something about the Note devices that _clicks_ (once you get rid of all the crapware on it). It might also help I have one of those fold-over covers that makes it look kind of like an oversized Moleskine.

But it's reduced the amount of _stuff_ I have to haul around to meetings to something I'm already carrying.

</comment></comment><comment><USER37> The 12-13" iPad Pro could be a big deal, assuming it comes with a real multitasking interface in the OS. We've amply covered the market with portable 7-10" tablets, but I think there's space for a device that stays at home or in the office and does more.

Personally, I just want a bigger screen for reading large-format books. Tilting a laptop sideways is not a good solution for that.

</comment><comment><USER38> I always doubted tablets, and then I got an iPad (3? the first retina one) for the kids and for development purposes. That was a while ago now, and it never really caught on here. It just kind of sits there, sometimes going months between uses.

<comment><USER39> I was in the same boat. Then I took the iPad on a vacation and got used to it – it's now the exclusive devise for the hour or so/day I spend browsing.

</comment></comment><comment><USER40> at my workplace there're many fans of the surface pro 3.. enough muscle to run a few VMs in vmware workstation and portable..easier to carry around to different customers' sites.. but i guess most tablets aren't like that.

</comment><comment><USER41> I thought for a second it said sneezed out</comment>


What Percentage of Your Country Smokes Marijuana? - <AUTHOR> http://priceonomics.com/what-percentage-of-your-country-smokes-marijuana/ <comment><USER2> Whoever wrote this needs to fact check better. Singapore figures are way out. Death penalty is for 500g weed not 15g. 30g is the threshold for being considered a dealer. For hash the figures are 100g for death penalty and 15g as dealer quantity threshold.</comment>


How to Save 90% on your S3 Bill - <AUTHOR> http://www.appneta.com/blog/s3-list-get-bucket-default/ <comment><USER2> Yikes! That's a horrible thing for a library to do to its users. This definitely should be changed in the library.

I noticed that no such Issue exists, so I opened one. [https://github.com/boto/boto/issues/2078](https://github.com/boto/boto/issues/2078)

<comment><USER3> I kind of agree with garnaat's reply, if they just suddenly change the default from TRUE to FALSE they're going to break backwards compatibility with anyone using the library and worse still in a really subtle way!

All they can really do at this stage is add a warning to the documentation and hope that new people using the library figure out the significance.

<comment><USER4> That's why you should avoid using default arguments in library functions.

<comment><USER5> Great point! I have never heard that, but it makes perfect sense. Hopefully I will remember in the future.

<comment><USER6> I don't agree, you should just know what they are. Defaults are helpful.

<comment><USER7> Until they change, and your code breaks, and you have to go figure out why. The point of not (silently) using defaults is that as long as you're explicit with your arguments, you won't get surprised by changing defaults. Of course, you might get surprised by any number of other changes, but you can at least reduce your failure surface area a little bit :-)

</comment></comment></comment></comment></comment></comment><comment><USER8> I found this exact same issue a few years ago after determining I had a reasonably-long-existing $75/day "leak" in my S3 expenses :/. (Seriously: $75/day, a number I am not exaggerating at all.)

> 09:00:04 < saurik> dls: I am performing millions of ListBucket request to > this one amazon bucket every day

> 09:00:25 < dls> d'oh

> 09:00:28 < saurik> adding up to almost 1.5 gigabytes of data traffic in/out > on just those requests

> 09:00:41 < saurik> I have NO CLUE what could POSSIBLY doing even a SINGLE > ListBucket request on that bucket

> 09:00:49 < dls> LOL

<comment><USER9> Even the infamous saurik got floor-hit. _closes jaw_

</comment></comment><comment><USER10> Also see MimicDB [0]. Runs a transparent cache that responds to most S3 API calls locally using Redis to store metadata. Besides the cost savings, it's extremely fast. Listing an entire bucket with millions of objects is close to instantaneous.

[0] [http://mimicdb.com/](http://mimicdb.com/)

<comment><USER11> It also adds another piece of infrastructure that needs to be maintained and can go down. Not necessarily the best option for everyone.

<comment><USER12> While the caching would be more effective with one large centralized instance, I think the intended use case is to have one cache per server. So then it's not really extra infrastructure.

<comment><USER10> Actually, you can do it either way since it's backed by Redis. You can set all servers to connect to the same Redis instance, or run them all individually.

<comment><USER13> What if Redis goes down?

<comment><USER10> "What if X goes down?" is my new favorite straw man on HN.

Regardless, it's just a caching layer, and requests are passed through to the API in that case.

</comment></comment></comment></comment></comment></comment><comment><USER14> > One utility in general that's provided us with an easy way to slice up and > investigate our AWS spending is the awesome Asgard.

The tool they're actually referring to is Ice (also by netflix) [1]. Asgard is another AWS-based tool for managing deployments and auto-scaling.

[1] [https://github.com/Netflix/ice](https://github.com/Netflix/ice)

<comment><USER15> Now mentioned in the article.

<comment><USER16> I'm the article author, and yes, we're using or evaluating both services. I find myself swapping the two all the time in conversation. Pretty silly typo on my part :)

</comment></comment></comment><comment><USER17> I _really_ hated working with boto for s3. The abstractions they chose are really ambiguous and it feels like it's fighting against the underlying api. If you're building anything on top of s3, it might be easier to write a thin S3 REST client and use it directly instead of going through Boto. So many fewer surprises, and no more digging around in the boto source trying to figure out what so and so function _actually_ does.

<comment><USER18> I would look at tinys3: [https://github.com/smore- inc/tinys3](https://github.com/smore-inc/tinys3) It was motivated by exactly the same reasons.

(disclaimer: I used to work at Smore, and I'm friends with the author, but I've been burned by Boto myself)

</comment></comment><comment><USER19> interestingly enough, here's the original commit that defaulted `validate=True`:

[https://github.com/boto/boto/commit/95939debc3813468264159d5...](https://github.com/boto/boto/commit/95939debc3813468264159d5feb7a3333ae82070)

 __EDIT __: Looks like the original committer is an Amazon employee.

<comment><USER10> Before you jump on the conspiracy train, most Boto contributors are Amazon employees.

<comment><USER19> Agreed, I doubt Amazon had any evil intentions with this change.

I wonder more if this was a product of Amazon developers using S3 (i.e. dogfooding) and not noticing the cost side effect because I'm assuming they don't get billed?

<comment><USER20> We actually do get billed, but we don't have to pay. I always check my bill to make sure that I am not using any resources that I don't need.

I also pay for my own personal EC2 instance and about 350 GB of S3 storage. Begin a genuine user and customer of AWS helps me to be a better employee.

<comment><USER21> Jeff,

You may want to check LIST request statistics over the next few weeks. Between this thread, an Issue for boto, etc. I'm curious if you see a noticeable decline in LIST requests with the attention this has brought. I'm just curious from a data standpoint.

</comment></comment></comment></comment></comment><comment><USER22> This has been in the boto library for years, across multiple services. I noticed it when first using SimpleDB, switching it on in a production environment was much more expensive than we had originally calculated. I noticed the bizarre "Domain Validate" calls after pouring through logs of all boto activity.

The boto guys have justified it in the past: [https://groups.google.com/forum/#!topic/boto- users/1DVfbo4CD...](https://groups.google.com/forum/#!topic/boto- users/1DVfbo4CDW4)

I still don't agree with their reasoning to leave it default, once you try to do something on a non-existent domain/bucket it will throw an error anyway, and I would argue the "extra work" is much cheaper than leaving these defaults on which I would expect are completely redundant for most users.

</comment><comment><USER23> Good news for django-storages users – this is off by default:

[https://bitbucket.org/david/django- storages/src/cb7366693ce1...](https://bitbucket.org/david/django- storages/src/cb7366693ce16d462b48535e575561f4d2efad0c/storages/backends/s3boto.py?at=default#cl-332)

<comment><USER24> To further add: the PyPI version hasn't been updated since March 2013 but the last time the relevant lines were changed was January 2013, so you should still be good with the PyPi version (assuming changes from then went out in the last release).

The setting in question is: AWS_AUTO_CREATE_BUCKET.

</comment></comment><comment><USER25> I discovered the 'validate' argument just recently. My concern was not costs, it was latency and response times. My server is generating a HTML page with signed URLs to resources on S3. The 'get_bucket' call adds a bit of latency as it contacts S3 and I was thinking, does it really need anything from S3 to generate signed URLs if I already know the exact key names, and am pretty sure the bucket exists? Well, it does not, and adding "validate=False" speeded up things noticeably.

</comment><comment><USER26> Because of the lack of fast and reliable s3 clients out there, I built [https://github.com/rlmcpherson/s3gof3r](https://github.com/rlmcpherson/s3gof3r), that can do over 1 Gbps with ease, both multipart uploads and parallelized downloads. The killer feature, though, is streaming that enables things like gof3r get -b <bucket> -k <key> | tar -x to extract directories tarred directories or any other streaming application. It also provides end-to-end md5 integrity checking. For objects over a few GB, I haven't found anything matching in speed or reliability.

<comment><USER27> From when I was looking into doing something similar, I recall s3 needing to know the content-length of upload parts up front. How do you handle that for streaming? Do you buffer in memory up to the max part size so that you can give the correct content-length header for the last part? I ask because my uses would include low-memory VMs so I'm curious about the memory overhead.

<comment><USER26> You don't need the content length of what you are uploading for multipart uploads, see ([http://docs.aws.amazon.com/AmazonS3/latest/API/mpUploadIniti...](http://docs.aws.amazon.com/AmazonS3/latest/API/mpUploadInitiate.html)). For each part of a multipart upload that is sent, however, you do need to include the content-length header, so that may be what you are referring to. These have a minimum size set by amazon of 5 MB. With the [https://github.com/rlmcpherson/s3gof3r](https://github.com/rlmcpherson/s3gof3r) the memory overhead of a streaming upload is approximately part size * concurrent uploads (plus a couple of buffers in the pool). So, for example, if you configure the part size to 20 MB and set concurrent uploads to 10, that would be about 220 MB of memory usage.

<comment><USER27> Yeah, having to buffer the stream in order to set the correct value for the content-length header on the last part of the multipart upload is what I was referring to. Your example using a 20MB part size is quite feasible. Thanks! Is it safe to use the master branch? Do you have build instructions? I haven't used go before.

<comment><USER26> We use the version in the master branch at CodeGuard to transfer many terabytes into and out of S3 daily. While I hesitate to call it "production- ready", as that means different things to different people, we do use it in production with no issues. If you want to try it without having to install go, there are statically linked binaries for OSX and Linux Amd/64 linked on the github page that should run on any distro without having to install any dependencies. If you have any issues or questions, feel free to contact me at the email in my HN profile. I hope it works for your use case! :)

</comment></comment></comment></comment></comment><comment><USER28> This is one of the reasons why Rackspace simplified pricing of Cloud Files from the start. No fees for PUT, POST, LIST, HEAD, GET, DELETE...no extra fees for Akamai CDN requests. Very simple with no hidden fees that surprise you at the end of the month.

<comment><USER29> Those fees for "operations" are there for a good reason. Otherwise, us smart techies would hack it.

I heard a talk by someone at a mega tech company that has their own internal cloud for their teams, and they "charge" each team based on usage. One team stored lots of file with 12,000 character filenames with zero contents. Since the company only "charged" for file size, that team had a tiny charge!

</comment></comment><comment><USER30> If you read the source code it calls a method called get_all_keys. Please realize, this does NOT get all the keys in the bucket. Passed to it is the maxkeys=0 argument which means no keys are returned and a single list call is made.

Yes, it is still a waste of money, but just make sure you understand that it's not actually listing your entire bucket.

</comment><comment><USER31> That's a crap default and a crap name. It should be prefetch_all_keys=False. (edit: and some documented reason WHY you would want to do such a thing)

I ran into this recently when making my own s3 sync tool, because the commonly used tool is completely broken (requires something called a 'config file' to function). But I didn't pay it too much mind, because I forgot the price discrepancy for ListBucket calls.

PS if you want to see what boto is doing do this: logging.basicConfig(filename="boto.log", level=logging.DEBUG)

<comment><USER32> > It should be prefetch_all_keys=False.

It does not prefetch any key (maxkeys is set to 0), it performs a query on the bucket to validate that the bucket exists and blow up if the bucket does not exist. With validate=False, you can call get_bucket and get a bucket object where no remote bucket exists.

<comment><USER33> It sounds like an annoying limitation of the API that (apparently?) you can't cheaply validate whether a bucket exists.

Two manual work-arounds that come to mind:

\- store a list of created buckets as keys in another bucket.

\- store a dummy file in each bucket you create.

Either method allows you to check the existence of the bucket with a GET request rather than a more expensive LIST request, but both are hackish. It seems like this is functionality S3 should already provide cheaply.

<comment><USER32> > It sounds like an annoying limitation of the API that (apparently?) you > can't cheaply validate whether a bucket exists.

It looks like there now is: [http://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketHEA...](http://docs.aws.amazon.com/AmazonS3/latest/API/RESTBucketHEAD.html)

I'm guessing (hoping?) that didn't exist back when the feature was added to Boto, 7 years ago: [https://github.com/boto/boto/commit/8410c365ee0120e073bf00bd...](https://github.com/boto/boto/commit/8410c365ee0120e073bf00bdc9b913a0575d54f7)

</comment></comment></comment></comment><comment><USER34> How to save 95%: don't use AWS long-term, buy dedicated hardware. [http://blog.backblaze.com/2013/02/20/180tb-of-good- vibration...](http://blog.backblaze.com/2013/02/20/180tb-of-good-vibrations- storage-pod-3-0/)

<comment><USER35> Thank you. For the long-term medium data center, it's a good choice. But other then the hardware disk space part, there are the hosting service part which at least provides a stable Linux instance and static IPs, and it' must be up and running 24/7.

</comment></comment><comment><USER36> Idea: A tool which give you some improvements advises on your code to save up money on your AWS bills

</comment><comment><USER37> The interesting thing is that the Boto S3 tutorial ([http://docs.pythonboto.org/en/latest/s3_tut.html](http://docs.pythonboto.org/en/latest/s3_tut.html)) uses s3.get_bucket() with impunity and never mentions you're paying 13.5x more for your usage if you use that bucket object for just one GET and don't pass validate=False. (Perhaps someone from AWS wrote that tutorial? :P) Probably deserves a mention there, though.

</comment><comment><USER38> We ended up writing an s3 library out of our frustration with Boto's slowness and it has a nicer, requests-inspired interface too

[https://github.com/smore-inc/tinys3](https://github.com/smore-inc/tinys3)

</comment><comment><USER39> Is there something similar to this that exists that also caches s3 objects locally?

<comment><USER10> Check out MimicDB [0]

[0] [http://mimicdb.com/](http://mimicdb.com/)

<comment><USER39> It stores everything but the object

<comment><USER10> Yes. If you're storing the objects on your server, why would you use S3?

<comment><USER39> Caching. We request the same objects quite frequently and bandwidth is killing us.

</comment></comment></comment></comment></comment><comment><USER40> OR You can move from S3 to some cheap servers with lot of data bandwidth.

<comment><USER41> There are a lot of use cases where s3 makes sense. For a small operation (one or two people) the admin time cost alone makes s3 pretty appealing. Also, the cost of a colo + server + redundant drives is a big initial spend when I have no way to know if my idea/app is going to get traction. Self-hosted may be cheaper for larger scales, but for a couple GBs s3 is going to win every time.

</comment></comment><comment><USER42> thats a good catch! thanks man :)

</comment><comment><USER43> You only need to worry about this if you're doing 100k+ LIST requests. For me, turning off validate would save 0.2%.

</comment><comment><USER44> I wonder how much savings we're talking about. I always worry when engineers start talking about saving money.

<comment><USER45> Depends on your scale. Another commenter on this thread was in the +$75/day range from this issue.

I don't worry about cultivating a connection between engineering and business needs.

</comment></comment><comment><USER17> Are you sure this counts as a LIST request? Technically the method of the list bucket API call is GET.</comment>


Introducing Sailfish X and all the details you want to know - <AUTHOR> https://blog.jolla.com/sailfishx/ <comment><USER2> 50€ for a mobile operating system, in the age of free everything?? o_0

<comment><AUTHOR> I am still rocking my dumb phone. But should I get a smartphone I'll gladly pay 50€ for this OS.</comment></comment>


Netflix and YouTube could start using AV1 as soon as early 2018 - <AUTHOR> http://www.streamingmedia.com/Articles/Editorial/Featured-Articles/AV1-A-Status-Update-120214.aspx <comment><USER2> This is exciting!

I wonder how long until it gets hardware support.</comment>


How Limits Boost Creativity  - <AUTHOR> http://www.wired.com/culture/design/magazine/17-03/dp_intro <comment><USER2> This makes a good point, but it also misses an important issue: whether any particular limits will tend to boost the _right kind_ of creativity.

To give one of the more obvious examples, many a dreary company places all kinds of limits on its employees. So people get creative, finding ways to circumvent rules without getting caught, or ways to live a not-so-dreary life in confining circumstances, or ways to get back at the company, or ways to run a job search under the radar of supervisors.

These are very different from finding creative ways to please customers, or ways to make the company successful. And, while this does not refute the principle in this article, it does put a damper on some possible applications.

In any case, upmod for making me think.</comment>


Learn one subject after another or all in parallel (like at an university)? - <AUTHOR> There are a lot of things I want to learn.
It's really hard to prioritize them and even if I do - a lot is left to undefined time to the future.
What I've realized is that at an university we used to learn everything in parallel, in small steps.
What if I apply this approach in my self learning too?
Would it be too slow for fast changing fields (ML, Big Data for instance)?
I am gonna give it a try anyways, just wondering if someone else here has similar experience. <comment><USER2> Are you studying full-time or part-time? The difference between you and a student (I imagine) is that you have 8 hours of the day blocked off</comment>


Tons traffic with zero effort is real, All you need is to translate your site - <AUTHOR> http://wplang.org/get-more-traffic-creating-multilingual-site/ <comment><AUTHOR> Let me guess, your current site is only in English.

Without realizing it, you've just given up on of over 74% of all global users that speak languages other than English. You've also committed yourself to the most competitive market in the World.

Why not create various translations of you site? Neil Patel did it. He translated his blog to 82 languages, and saw a 47% increase in his search traffic – within just three weeks!

<comment><USER2> It all depends what is your market. English is international language so... Fun fact: China has more people that speak English than US+UK combined ...

<comment><AUTHOR> It might be international but people still prefer to read on their own native tongue. It almost doesn't matter what your product or site is, you can always benefit by building at least one more site in a different language.

</comment></comment></comment><comment><USER3> Hopefully to a higher standard then demonstrated in this headline.

<comment><AUTHOR> That's right... but it's my first hackernews submission so be gentle. the article itself is written better I promise.</comment></comment>


The Pleasures of Drowning  - <AUTHOR> http://www.samharris.org/blog/item/the-pleasures-of-drowning

<comment><USER2> I remember the very first UFC. Maybe it was pre-UFC, I can't be sure, but I remember that it was very, very early in the MMA days. There were fighters entering the ring citing their discipline as "Shaolin Tiger Kung-fu" and the like.

One-by-one, we watched the fights devolve in to a standing clinch, with many athletes sporting a confused look, glancing at the referee as if to ask "aren't you going to separate us?" The fact was that many of these fighters, althogh well respected in their individual arts, had absolutely no idea how to "fight".

We even saw a few self-defense specialists enter the ring. One guy had formed some self-defense art with "bear" in the name. I can't remember the specifics. He was refreshing. During the pre-fight interview, he was confident, but humble. His comments could be summarized as, "I feel pretty confident that what I've developed works, but we're about to find out for real."

It was a unique time with a lot of the layers of delusion being stripped away with the swipe a leg and a thud on the mat. Sometimes I wish we could turn the clock back, just to watch it all over again.

</comment><comment><USER3> The Aikido videos are indeed sad. The saddest part is knowing how surprisingly representative they are of the Aikido mythos, originating with the founder himself. Accounts of Morihei Ueshiba and his supernatural adventures in ki are perplexing at best.

That being said, I don't think Aikido is as ineffective as the videos may lead one to believe. I recall a similar experience to the one described in the article, when I strolled into the Aikido dojo with a new black belt in TaeKwonDo. The sensei saw my colossal attitude and broke my confidence repeatedly in front of his students. It was entirely open ended; I attacked and he countered. Each attack landed me in a painful pin. And while my strength and stamina were utterly exhausted, he managed me effortlessly. I was made an example; humbled.

The core techniques of value are not exclusive to Aikido, however, being borrowed from prior arts, and I believe more practical sources of them are Bujinkan and Krav Maga.

</comment><comment><USER4> It made me cringe to watch that. This isn't the first time I've come across this. There are plenty of such people going around deluding themselves and their "students" (or maybe they're just liars). Youtube has several such examples.

</comment><comment><AUTHOR> It's a great article on Brazilian Jiu Jutsu (BJJ) and MMA with a couple of mind blowing examples highlighting blind faith in martial arts. Watch the videos. They will make your day maybe in a sad sobering sort of way.

</comment><comment><USER5> This is all moot, of course, if the opponent brings a gun.

<comment><USER6> If the other party is armed and you are not then chances are your fate is sealed. Still a sudden violent attack when no option to escape is present is still likely the correct course of action. As Harris states in his early post(1) if they shoot you during the struggle (or escape attempt) they where likely going to shoot you anyways.

1\. <http://www.samharris.org/blog/item/the-truth-about-violence></comment></comment>


Some ISPs offer YouTube/Netflix/Facebook for free. How do they monitor that? - kuba-orlik In Poland, it is common for mobile ISPs to offer plans with limited amount of bandwidth per month, with exclusion of some popular apps. So for example all traffic from youtube is not counted towards the data cap, but any other casual everyday browsing is.
Aside from net neutrality issues, I am wondering how is this achieved in the HTTPS age? How does the ISP know which packets to count towards the data cap?
It doesn't seem to be per-app, and no proxy is installed. My guess is that it's done by some kind of packet inspection. But what exactly are they looking at? <comment><AUTHOR> It should be enough to look at the IP address.

<comment> kuba-orlik Yeah, but all traffic from googlevideo.com is uncapped, but traffic from google.com is... how do they know which IPs to block? Youtube has like a ton of them and they probably change from time to time. If it's IP-based, how do they compile a list of IPs that are guaranteed to be youtube video content, but not anything else?

<comment><AUTHOR> >Youtube has like a ton of them and they probably change from time to time.

While that's true, it is not that many IPs, and they do not change that much.

Maintaining a list of IPs for YouTube, Netflix, and other mainstream services is probably a couple hours of work per week at most, probably distributed between multiple people in whatever department handles it.</comment></comment></comment>


Amazon deciding if it will make a big move into selling drugs online - <AUTHOR> https://www.cnbc.com/2017/10/06/amazon-considering-selling-online-prescriptions-decision-coming-soon.html <comment><USER2> Interesting to think about the long term implications. What if Amazon then started a health insurance company? Could they cut costs on both ends for "consumers"?</comment>


Linguistics, Turing Completeness, and teh lulz - <AUTHOR> http://boingboing.net/2011/12/28/linguistics-turing-completene.html

<comment><USER2> It sounds like, with the no-length-field part, they're saying a protocol should define _all_ metadata _and_ data formats? I get this from the packet portion; if skipping over the data part of a packet is bad, but churning through it to get to the close-delimiter is good, then you must be validating the data somehow.

Well sure, validate your data. But why is that part of the _packet_ protocol? I would think it should only verify that the data is properly escaped (if it is indeed escaped - with a length field it doesn't need to be). Shouldn't the contents be validated by what's using it, and not the TCP/IP packet specification?

Adding a length field certainly doesn't make the protocol Turing-complete, a pushdown state machine should handle it just fine - push the length onto the stack, and iterate and decrement until it's exhausted. That even keeps it context-free (if the protocol is regular, and you just added a length field), which they claim is a safe zone.

\--

They also claim that escaping is a flawed art, citing SQL injection. Is it? It seems trivial to do a trivial escape that's not flawed (not claiming CSV here, just double-quotes or something), and such an escaping act _must_ be performed if you read open and close delimiters... unless your protocol is also specifying and validating the contents it's transferring, down to the very last bit, and it doesn't allow those delimiters in the data.

Doesn't this mean they've just claimed that arbitrary data transport protocols are all inherently flawed? And that any nested specs (ASCII in a TCP/IP packet, for instance) are inherently flawed, but single-depth ones (which could very well specify ASCII as the only data format for TCP/IP packets) aren't?

\--

All in all an interesting talk, and the core message is a good one - simple, non-Turing-complete protocols are best, and perhaps should be the only protocols, because they can be validated. But I don't think I buy some of the reasoning, though I'd love to be convinced otherwise if it is indeed valid.

<comment><USER3> The point about encapsulating arbituary data formats is a good one. Especially if you invent some protocol that may have to receive programming language code or worse images/mp3s etc etc especially compressed/encrypted ones.

Unless your protocol will have very limited use cases it's almost impossible to know what data will be sent over it , so you can't really guarentee any single delimited character. Even if you do make the use case limited someone will want to use it in a way you didn't intend (look at HTTP for example).

I don't think they were talking about validating everything at TCP/IP level, especially since it's unlikely you or I could affect meaningful change to the TCP/IP spec anyway. I think it's meaning application layer protocols that get invented for specific programs where what you are doing infact is creating another type of packet at a higher abstraction level.

I think the length field example was probably a bad one but I think the tl;dr is to KISS when defining a protocol. If somebody else re-implements your protocol and you can't easily run their implementation through a series of tests to know if it is correct or not then you run the risk of creating a so called "weird machine".

<comment><USER2> KISS seems to demand a length field on the receiving side of a protocol, though - you don't need to restrict, validate, (un)escape, or even _look_ at the data you're transferring, so you can easily transfer anything. Testing length is far easier than escaping - do the bits after skipping match the spec for the next chunk of metadata? You can therefore create tests which _only_ test the metadata (your actual spec), and completely ignore the data.

The only thing left is ensuring your tests fail when you specify the wrong length, which _should_ be assured by your spec (either a master-length value or a protocol-terminating character like \0 (where you touch on the escaping problem again)). This is the exact same thing as ensuring start/end delimited tests pass/fail when you are adding/missing bits of your packet, or if the bits/bytes are misaligned, which you should be doing regardless.

Given this, using lengths means you can avoid creating or testing any (un)escaping code, and the bit-alignment tests are identical between the two - lengths are simpler and more easily testable. KISS favors lengths.

On the sending side, length is still easier than escaping, unless you're streaming data of unknown length. In that case, you're probably _still_ breaking it up into packets that can be individually sent and validated with a known length, or you have to resort to escaping and delimiters (not that it's a bad option, just that it's the only remaining one AFAIK).

<comment><USER3> _Testing length is far easier than escaping - do the bits after skipping match the spec for the next chunk of metadata?_

What happens if the wrong length is supplied but something inside the actual data portion happens to match the spec for the next part of the metadata (either by accident or design)? This could result in too little of the data being read as input. You will then probably end up with some data/metadata further along the line being read by a piece of code it wasn't supposed to be since everything is out of whack.

This _shouldn't_ have security implications as far as I can think , but could lead to data that should be valid causing errors in some cases.

Could be fixed maybe by having a hash right after the data portion and checking this after reading it. That would fix "by accident" but not by design. Although if your purposefully crafting packets to confuse the parser at the other end you deserve to have them dropped on the floor.

This is really pascal strings vs C strings all over again.

<comment><USER2> If something 'happens to match':

Assuming only lengths, the packet length won't match - you'll reach the end of the structure before the end of the data. The point of all this is to validate before interpreting, so it fails validation, and no harm is done.

Assuming a \0 termination, which requires that it does not exist in the data (an escaping problem): there won't be a \0 after the should-be-last piece of metadata, so it fails validation, and no harm is done.

And _all_ of this assumes you have a correctly-transmitted packet to begin with. What if you don't? If your spec+validator can't detect it, then you are introducing possible attack vectors - your tests _must_ test wholly-invalid structures, which your validator _must_ fail, to be 'safe'. I don't see how delimiters protect this any more than lengths, and they add complexity due to escaping (which I do think can be done safely + correctly, but we're also assuming they cannot be because that was essentially a claim in the video), and you _must_ escape if you use delimiters and allow arbitrary data.

</comment></comment></comment></comment></comment><comment><USER4> One of my favorite bits from Vernor Vinge's _A Fire Upon the Deep_ -

>>> WARNING! The site identifying itself as Arbitration Arts is now controlled by the Straumli Perversion. The Arts' recent advertisement of communications services is a deadly trick. In fact we have good evidence that the Perversion used sapient Net packets to invade and disable the Arts' defenses. Large portions of the Arts now appear to be under direct control of the Straumli Power...

"Sapient net packets" seem like a really, really bad idea . . .

</comment><comment><USER3> Interesting talk in the video.

What I'm interested in is the performance implications of context-free parsing of some arbituary data without a length field.

Someone asked this in the talk and a paper was referenced and she thought context free could be _faster_ but I don't really have time to read it.

Let's say you get delimited data over a network socket and no length field. How do you know how big to make your receive buffer without losing efficiency (i.e scanning the data twice or allocating more than you need) or re- allocating and copying the buffer at some interval?</comment>


Ask HN: Is the bear market on Cryptocurrencies already here? - <AUTHOR> <comment><USER2> It's been here since middle of January.</comment>


Ask HN: Should I generate passwords for new users instead of asking for one? - <AUTHOR>

By generating passwords for users at registration, I would only have to ask users for their email (I'd email them a password they could change); thus, making registration simpler. However, doing this either requires the user to change their password or remember/look up a randomly generated password, possibly discouraging repeat visits. <comment><USER2> "possibly discouraging repeat visits." --- you nailed it on the head yourself, that seems to outweigh any minor benefit from having one less field to fill out at registration time.

Even worse, if the password e-mail gets spam-filtered or even just delayed a bit, your user loses interest waiting around and just goes to another site which will give him instant access.

</comment><comment><USER3> I hate that. I almost never end up changing the password and it's a pain in the ass to look it up each time. Just ask me for it up front.

</comment><comment><USER4> How about using OpenID?

</comment><comment><USER5> If you're trying to limit the sign up form to two fields, you can do it the hackernews way, just ask for an email and a password. Just a suggestion.

</comment><comment><USER6> I think that e-mailing a password for them to change adds another step, instead of taking one away.

</comment><comment><USER7> Not unless 99% of your users are one time users. Otherwise there are more steps, not less.

</comment><comment><USER8> Emailing them a password means you have their plaintext password. Please never do this.

<comment><USER9> Or it means he emailed you the generated password right before hashing it and never actually saved it in plaintext.

</comment></comment><comment><USER10> Use OpenId</comment>


Life Beyond the Pale BLue Dot - <AUTHOR> http://nautil.us/issue/26/color/life-beyond-the-pale-blue-dot

<comment><USER2> The article only briefly mentions Carl Sagan and how he coined the name, "Pale Blue Dot". If you haven't read or listened to where this came from in Carl Sagan's "Cosmos", it is a very beautiful and poignant reflection on humanity.

[https://www.youtube.com/watch?v=p86BPM1GV8M](https://www.youtube.com/watch?v=p86BPM1GV8M)</comment>


The untold story of the vegetable peeler that changed the world - <AUTHOR> https://www.fastcompany.com/90239156/the-untold-story-of-the-vegetable-peeler-that-changed-the-world <comment><USER2> Not sure if a peeler can be world changing, but these articles on Joe Ades are a well worth a read; a true character and gentleman, he sold the Swiss made Zena Rex/Star peelers which are arguably a design classic.

[https://www.nytimes.com/2009/12/27/magazine/27ades-t.html](https://www.nytimes.com/2009/12/27/magazine/27ades-t.html) [https://www.vanityfair.com/news/2006/05/grafter200605](https://www.vanityfair.com/news/2006/05/grafter200605)</comment>


What explains the growing gap in wages? Computers. - <AUTHOR> http://chronicle.com/free/v54/i46/46b01001.htm

<comment><USER2> Far too many people go to college. Most of you went to decent schools, so you're probably not aware that US state schools are literally inundated by federally-subsidized mouth-breathers, who are doomed to drop out and work at Burger King, or get communications degrees and work at Burger King.

A high school graduate in the 1960s could earn a middle class income through unskilled labor. This was an historical anomaly, and there's no reason to compare wage data today with that of the past. As soon as non-Western manufacturing labor entered the market, the price was driven down. Anomaly over.

<comment><USER3> > Far too many people go to college.

I am convinced that many people go to college only to become employable, not because they have any academic interest to pursue.

If a high school diploma actually meant that you could read and write and multiply and divide, then maybe there wouldn't be as many jobs out there requiring college degrees when all they really need are the skills you should have learned in high school.

<comment><USER4> >I am convinced that many people go to college only to become employable, not because they have any academic interest to pursue.

I know this is true of business schools. B-schools don't really teach anything; they're actually a way to signal to potential employers that you could come up with the 100k and 2 years necessary to go through school, the smarts to get through admissions, the persistence to get through it, and the willingness to absorb bullshit management-speak (meaning you'll be obedient).

</comment></comment></comment><comment><USER5> Actually, the article _actively refutes_ the idea that computers explain the wage gap. The thesis is that it's all due to supply and demand in the labor force, and that it has been going on since electrification in the early 1900s.

</comment><comment><USER6> After the second world war, the GI Bill heavily subsidized tuition for many American veterans.* This led to a _huge_ surge in college enrollment, which persisted through the decade. Greater exposure to higher education led to more interest among the general population. Furthermore, students could avoid being drafted for the Vietnam war.

The long-term increase in enrollment raised the bar for expected education in potential employees, and that has in turn perpetuated itself. The employability gap between the college-educated and those with high school diplomas or less has continued to widen, and may now be escalating to a split in the college-educated.

* These benefits were realistically only accessible to _white_ veterans, though. Most universities were still segregated.

</comment><comment><USER7> Occasionally someone posts to HN stating they want want to drop out of high school or go straight from high school to working full time. Maybe they should read this first.

<comment><USER8> eh, I didn't go to college. of course, when I graduated highschool it was 1997, and I had 2 years of paid experience as a sysadmin, so I was able to jump right into a .com job, and I'm a UNIX SysAdmin- a computer janitor. SysAdmins often have less formal education than Developers, so some of this was just that I 'got lucky' - but I do know many others who have done ok without formal education.

Yeah, if I had stuck it out, I'd probably be earning another 20%-30%, (just looking at what my co-workers make) but I'm still comfortably into the six figure range.

Granted, that's not great for the bay area, average nerd salary around here is north of $140K, and I don't rate that unless I'm contracting, but it's certainly an OK salary for someone who hasn't hit 30 yet.

The key to making decent money without college is to get jobs that count (really, this is good advice regardless of your other educational plans. Most places a year of experience is worth a little less than a year of education. If you can get both, you are golden.) If you want to be a computer guy, don't take a summer job tending a till- if you can't find an internship, pester local offices to see if they need a windows reboot monkey, or see if you can get the local web-design place to give you minimum wage to do basic stuff. Or repair computers for your parent's friends. Charge $5 or $10/hr if you have to... it's experience and reccomendations you are after at that stage.

My first job was at a mom and pop computer repair place... I was paid less than minimum wage, but it was an awesome experience, and it paid off handsomly. Remember that if you don't have education, you need experience. Without education or experience, nobody is going to hire you for a 'real job' (at least for 'real pay') Find someone willing to let you do a 'real job' for next to no pay for a period of time. Remember that at these jobs a good reccomendation from the boss is worth many times over what they are paying you.

Certifications are nice, but with the exception of perhaps, the ccie, none of them can touch a few years experience doing the job you are trying to get.

I wouldn't want to discurage people from getting educated- I think college can be very valuable (look at my grammar.) but not going to college doesn't condemn you to poverity.

<comment><USER9> _"... SysAdmins often have less formal education than Developers, so some of this was just that I 'got lucky' - but I do know many others who have done ok without formal education. ..."_

You could argue SysAdmins with _"a bit"_ of training make high quality developers. Of the best developers I know a lot are from the SysAdmin tree. The one downside of back room work though is it is just ripe for outsourcing. Narrow focus has it's own evolutionary disadvantages and it is "our" doing. This is one thing Phil Greenspun mentioned in JL's "Founders" and another reason startups kick-ass - outsource the management not the engineering.

<comment><USER8> Yeah. I know some very good developers who were first SysAdmins. Even I have written a patch here and there to various system programs. To 'level up' as a sysadmin, even if you don't want to be a dev, you do need to know some programming. I don't know if I have the attention span to sit down and write a large app from end to end, but many times I've had to hack up the programs a client was using. I once patched courier-imap so my employer could continue to use the same UIDLs

Ugh. nearly all customers were using pop3 like IMAP- 'leave mail on server' the problem was that UIDLS needed to stay the same, (the UIDL value is an identifier of a pop3 message- the pop3 client uses it keep track of what messages are new in the pathalogical 'leave messages on server' scheme. If we changed the UIDLs, all messages would be 'new' to the mail client and customers would scream.) and qpopper UIDLs contain characters that can't be in filenames, while courier-imap's pop3 daemon uses the UIDL for the filename... so I hacked it so that if the filename started with 0x, it treated the filename as a hex-encoded UIDL. (otherwise it acted as normal... that way next time they upgrade the courier server, they probably don't need to include my patch... most of the old 0x mails will be gone in a number of months.) A simple change, but it allowed us to move to maildir (which isn't always faster, but in this case was massively faster) without disturbing the customers. But yeah. as a more senior SysAdmin, you are expected to occasionally deal with that sort of thing. Being able to kindof read debugger output also really helps.

Oh, also the 'got lucky' comment was more about coming of age during the .com boom than about becoming a SysAdmin. The .com boom (and my timing) was luck. Becoming a SysAdmin, well, that was more the 'path of least resistance' at least once I got started down this path.

<comment><USER9> _"... Ugh. nearly all customers were using pop3 like IMAP- 'leave mail on server' the problem was that UIDLS needed to stay the same, (the UIDL value is an identifier of a pop3 message- the pop3 client uses it keep track of what messages are new in the pathalogical 'leave messages on server' scheme. If we changed the UIDLs, all messages would be 'new' to the mail client and customers would scream.) and qpopper UIDLs contain characters that can't be in filenames, while courier-imap's pop3 daemon uses the UIDL for the filename... ..."_

Not write a whole system app but the tools (like "duplo") so other devs can use them without shooting themselves in the foot having to learn or experiment in very specific niches.

</comment></comment></comment></comment></comment><comment><USER10> Why is inequality considered a bad thing? What matters is whether the median wage is falling or not. Better to allow some people to earn massive amounts and have a rising median wage than to focus on inequality and have a stagnant or falling median wage.

It's plainly obvious that people have differing skills, and the whole communist experiment showed that you couldn't motivate people without rewarding them monetarily for their skills, risk and hard work (startups being a good example here).

</comment><comment><USER11> "Europeans would look at our education system and be appalled by two things. One was that we were educating so many, which they considered to be highly wasteful. The other was that we were educating girls as much as boys."

I would have thought it was another two things: One, US high school education is poor; US graduates are one or two years behind the European graduate. Second, the US does not pay for college and university; preventing able individuals from getting a full education.

Maybe Goldin was confusing Europeans with the Church.

<comment><USER12> As a European, I am not appalled by the fact that you educate as many girls as boys.

What makes me wonder is why you Bachelor is 4 years, will ours is only 3.

</comment></comment><comment><USER13> The gap is explained by the constant growth of human knowledge and the constant stasis (or even retrograde motion) of high school curricula. Thus, one must go to college to make a contribution to society.

</comment><comment><USER14> I've often thought that subsidizing higher education would lubricate the U.S. economy.

<comment><USER8> higher education in the US is heavily subsidised. The meagre fees that the lower colleges charge are waived if you are poor, and at that point all you need to cover is food/books/rent.

<comment><USER14> I mean more subsidization, so that changing careers is a real option for most people.

<comment><USER15> I don't think that the problem with changing careers has to do so much with paying for college as it does with paying your bills while you change careers.

<comment><USER14> Can be construed as the same thing.</comment></comment></comment></comment></comment>


Don Buchla, Electronic Music Maverick, Has Died - <AUTHOR> http://www.nytimes.com/2016/09/18/arts/music/don-buchla-dead.html <comment><USER2> Aw man. My condolences to Don's family and friends.

I only met Don once, many years ago when my high school buddy Will Hegarty was visiting the Bay Area. Will had an audio electronics company called Tangent, and we went up to Don's house in Berkeley to talk shop. He was a great host, much fun to visit and to play with the neat instruments he was building.

On the way there we stopped at a recording studio in San Francisco on a cold call. No one was at the front desk, so we wandered around looking for someone to talk to. We ended up in the coffee room, and Art Garfunkel walked in. Really nice guy too. We chatted a bit, and Art asked us if we wanted to listen while he recorded a song.

That sounded like a very fine idea! Art brought us up to the control booth and he went down to record. We got to listen to part of the song, until his producer Roy noticed us, stopped everything, and practically shouted into the talkback mic, "Art! Who are these people?" Art said, "It's OK, Roy, they're cool."

Well, that didn't work. Roy threw us out the back door and we headed on our way to Berkeley.

After that minor humiliation, it sure was nice to get to hang out with Don!

</comment><comment><USER3> >> _"A keyboard is dictatorial," he said. "When you've got a black-and-white keyboard, it's hard to play anything but keyboard music."_ <<

Hence the cello interface and the alternative controllers.

My piano teacher once said that when she rehearsed with a string quartet they would tend to drift back to intervals like a _natural_ fifth unless she was actually playing alongside with the equal temperament adjusted fifth.

Din is Noise is another approach to getting out of the midi/pitch class universe

[http://dinisnoise.org/](http://dinisnoise.org/)

</comment><comment><USER4> I just discovered Buchla as thing two days ago with this concept album:

[http://pitchfork.com/reviews/albums/22300-sunergy/](http://pitchfork.com/reviews/albums/22300-sunergy/)

There's not enough people like this around anymore :(

</comment><comment><USER5> Below are some videos[1][2][3][4] of Buchla instruments being played, taken from the thread about Buchla's passing on Muff Wiggler[5], the largest modular synthesizer forum in the world.

[1] - [http://www.youtube.com/watch?v=Uhtar8FlgzU](http://www.youtube.com/watch?v=Uhtar8FlgzU)

[2] - [http://www.youtube.com/watch?v=nYNSm0jojnY](http://www.youtube.com/watch?v=nYNSm0jojnY)

[3] - [http://www.youtube.com/watch?v=0UKY9UYt5iE](http://www.youtube.com/watch?v=0UKY9UYt5iE)

[4] - [http://www.youtube.com/watch?v=aDNZPzSaYKo](http://www.youtube.com/watch?v=aDNZPzSaYKo)

[5] - [https://www.muffwiggler.com/forum/viewtopic.php?t=168381](https://www.muffwiggler.com/forum/viewtopic.php?t=168381)

</comment><comment><USER6> He created amazing devices. iirc he invented the analog (knob driven) sequencer.

More info for those interested.

[https://en.wikipedia.org/wiki/Buchla_Electronic_Musical_Inst...](https://en.wikipedia.org/wiki/Buchla_Electronic_Musical_Instruments)

<comment><USER7> A demonstration video of the Buchla Music Easel: Analog Synthesizer, for those who are video-enabled: [https://www.youtube.com/watch?v=5JI0LzjvjjI](https://www.youtube.com/watch?v=5JI0LzjvjjI)

</comment></comment><comment><USER8> One artist who makes heavy use of Buchla's synths is Alessandro Cortini (live keyboardist for Nine Inch Nails).

He does ambient stuff, but I prefer his SONOIO project, which is more poppy and has vocals. Here's a cool song made 100% on the Buchla 200. I was hooked by the unique sound the first time I heard it:

[https://www.youtube.com/watch?v=r0jA3R6CnF4](https://www.youtube.com/watch?v=r0jA3R6CnF4)

<comment><USER9> Also Kaitlyn Aurelia Smith, highly recommended.

</comment></comment><comment><USER10> His work remains incredibly influential today in the current renaissance of modular synthesizers--a number of important eurorack designers (e.g., Make Noise) take a lot of inspiration from the West Coast style of synthesis.

Sad news.</comment>


VaultPress: WordPress backup service from Automattic - <AUTHOR> http://vaultpress.com/

<comment><USER2> Just noticed that they're using an ad-lib style signup form: <http://vaultpress.com/signup/>

<comment><USER3> It was fun to build. :) Check out how the a/an changes when you switch to "enterprise" and how we add an extra question if you're non-personal.

<comment><USER4> Nice, but you missed "I have __ other blogs". Entering 1 doesn't change it to blog.

<comment><USER3> Fixed!

</comment></comment></comment></comment><comment><USER5> $30 a month? Good luck with that.

<comment><USER3> We're showing 10-30 to different visitors and seeing how that affects pricing, like a behavioral economics experiment.

<comment><USER6> Will you publish the results? I'd love to see them!

<comment><USER5> You think there's a chance $30 pricing will be more popular than $10?

<comment><USER6> There are available alternatives and I wouldn't think backups provide any social status, so I don't think higher prices would mean higher demand.

But maybe... that's why I'd love to see the results (even just as an anonymised chart of price/demand).

The relationship between the "planning to charge" price shown and the price someone volunteers to pay in the "perfect world" would also be interesting.</comment></comment></comment></comment></comment>


IPhone Windows Vista Skin Makes Steve Jobs Cry Tears of Blood - <AUTHOR> http://gizmodo.com/391688/iphone-windows-vista-skin-makes-steve-jobs-cry-tears-of-blood <comment><USER2> It turns the iphone into a little headstone for the Vista grave. How sweet.</comment>


Confessions of a Digital Nazi Hunter - <AUTHOR> https://www.nytimes.com/2017/12/27/opinion/digital-nazi-hunter-trump.html?rref=collection%2Fsectioncollection%2Fopinion&action=click&contentCollection=opinion&region=rank&module=package&version=highlights&contentPlacement=1&pgtype=sectionfront&_r=0 <comment><USER2> [https://news.ycombinator.com/item?id=16018165](https://news.ycombinator.com/item?id=16018165)

Posted 2 hours earlier, 30+ comments, 60+ points

<comment><USER3> The last one kinda got overrun with trolls and people with strong differences of opinions, as did the Obama-social media post. Yesterday was weird...</comment></comment>


Show HN: Online C/C++ obfuscator - <AUTHOR> https://picheta.me/obfuscator <comment><USER2> I'm not entirely sure what is this for. This won't stop decompilation because it doesn't affect compiled code - constant folding is part of C language, "\x0A" is the same thing as "\n". I guess you are losing function names, but you could get the same by stripping debugging information. Strictly speaking, the only obfuscation that could be worth something (an optimization not mandated by the specification) is 0x0000000000000000 ^ thing, but the compiler likely would optimize that out realizing how silly that is.

I think a proper obfuscation tool for C should work at lower level than C source code.

<comment><AUTHOR> Indeed, the current transformations implemented by my obfuscator aren't particularly sophisticated, at least in comparison to some of the obfuscator's I evaluated such as Tigress[1] which can transform your code into a JIT.

But for the use case that my dissertation supervisor had in mind it works very well (gravypod outlines this use case well[2]).

Most of the work in this project was the creation of the underlying architecture for parsing and transforming C and C++ code. Now that this is done, implementing more sophisticated transformations should be fairly trivial.

1 - [http://tigress.cs.arizona.edu/](http://tigress.cs.arizona.edu/)

2 - [https://news.ycombinator.com/item?id=17478448](https://news.ycombinator.com/item?id=17478448)

<comment><USER3> I think this will not fly in court. Sourcecode is what you use to edit your program. Obfusicated code is like an assembler: an intermediate product. I think yoir use case doesn exist, at least here in Germany,

edit: I misunderstood your use case, still I dont think obfusicated code is source code by definition

<comment><USER4> > I think yoir use case doesn exist, at least here in Germany

that explains a lot.

</comment></comment></comment></comment><comment><AUTHOR> Nice to see this getting some traction.

To give a bit more context: this is a C/C++ obfuscator I have built for my BSc Computer Science dissertation. It's built on the clang parser and while it doesn't implement any fancy obfuscations right now, it does offer a solid base for further obfuscations to be implemented. I figured I would submit it here to see what you guys think of it and to figure out whether I should pursue developing it further.

For those interested in the details, I have uploaded my dissertation here: [https://picheta.me/c_cpp_obfuscator.pdf](https://picheta.me/c_cpp_obfuscator.pdf).

</comment><comment><USER5> You really shouldn't open up a compiler running on your own device, especially as your own user. [https://security.stackexchange.com/questions/138881/is-it- da...](https://security.stackexchange.com/questions/138881/is-it-dangerous-to- compile-arbitrary-c)

<comment><AUTHOR> Very true. I'm running it on a droplet that doesn't have anything else important on it, but I'll get the obfuscator dockerized anyway just in case.

Edit: It is done :)

</comment></comment><comment><USER6> As far as I can tell, the "rename identifiers" feature also renames externally-visible identifers, which should remain the same if the code ought to keep working.

<comment><AUTHOR> Which identifiers did it rename that you think should have been kept?

<comment><USER6> The 'compare' and 'generic_fizz_buzz' ones in the Generic FizzBuzz example.

edit: Ah, so the algorithm is deterministic (compare is always mapped to o_9277c6cd6b1431c4622b3bb03df7c6ef) and the assumption is that all compilation units are subject to the same obfuscation mechanism? Doesn't really match the use case where you give the obfuscated code to someone else to build into their program.

How does it decide whether a call to compare should be replaced by a call to o_9277c6cd6b1431c4622b3bb03df7c6ef or whether compare is defined in some external library to be resolved at runtime? At the moment, it is unconditionally replaced, probably with some whitelist for libc functions?

edit2: nope, "memcmp(a, b, 42)" is also name-mangled into something else that won't result in a call to memcmp. What's keeping the qsort in the original GenFizzBuzz example?

I'd probably restrict the name mangling to local variables, functions without external linkage and possibly struct field names. Everything else is likely just too hard to do automatically and will require whole-program analysis which you almost certainly can't do if you're handing out obfuscated source code.

<comment><AUTHOR> It checks whether the symbols are defined in an included header file. The `compare` and `generic_fizz_buzz` are not defined in any header files that are included so they are obfuscated.

One example of this is `printf`, it would be obfuscated if it wasn't for the fact that it's defined in `stdio.h`. You can try removing that `include` and you'll see that it is then renamed.

The name it creates for each identifier is the md5 of the identifier.

<comment><USER6> That explains the memcmp: I just declared it locally before calling it. I think it's not incorrect to do as long as my declaration exactly matches the actual libc one (otherwise, the behaviour is undefined). Not 100% sure, though.

</comment></comment></comment></comment></comment><comment><USER7> Academically, kudos! This seems cool and a nice idea but...

Speaking practically this strikes me as one of "this shouldn't be an online tool" things.

It sends the source code to the server and presumably if you are obfuscating your code you want it to be kept secret. So, I'm not saying this site would do this, but sounds like a great way to harvest code people think is sensitive.

<comment><AUTHOR> I agree completely. I'm warmly impressed that this is getting attention on HN. To give a bit more context: I wrote this obfuscator for my BSc dissertation and created a web version to better show it off and allow my supervisor to more easily play around with it.

I have now graduated and so I'm wondering what I should do with this project. Two options: open source it or try to sell it. Mainly I'm wondering whether there is actually a big enough market for something like this, I thought HN might help me answer that question so I submitted it :)

</comment></comment><comment><USER8> Also brand new: our fantastic online C/C++ de-obfuscator!

</comment><comment><USER9> <joke>I assumed the title referred to an online meeting of the C++ standards committee.</joke>

<comment><USER10> c++ is self offuscating. Drive in the final nail by erasing the comments.

</comment></comment><comment><USER11> What's the use of something like this

<comment><USER12> I'm assuming similar use cases to things like Proguard. If you need to provide your client with C code because they need to compile for a large range of architectures but they're not allowed to see the source code. It's a very unusual circumstance but it does happen.

<comment><USER13> Wouldn't you use a tool to do that automatically in your build process? I can't see using a web page to obfuscate an entire project, one file at a time.

<comment><AUTHOR> I created the web page just as a demonstration more than a practical way to use it. So yes, you'd likely want a CLI app and feed your whole project to it.

</comment></comment></comment></comment><comment><USER14> No template support?

template <typename T> T add(T a, T b) { return a + b; }

Is there a list of C++ features it supports?

<comment><AUTHOR> Afraid I don't have a list right now. C++ is a large language so I didn't get a chance to test it all out and make sure it works.

</comment></comment><comment><USER15> Thanks for sharing this. I'm a C newbie so it was neat to play with. Don't stop making and sharing neat stuff!

</comment><comment><USER16> It doesn't seem very keen on handling lambdas in C++ mode:

#include <stdio.h>

int main() { return [](){return 5;}(); }

Results in unhandled exceptions.

<comment><AUTHOR> Indeed. I haven't implemented support for those yet :)

</comment></comment><comment><USER17> can it defeat moss? [https://theory.stanford.edu/%7Eaiken/moss/](https://theory.stanford.edu/%7Eaiken/moss/)

</comment><comment><USER18> Doesn't work for basic C++:

#include <stdio.h>

#include <stdlib.h>

#include <iostream>

int main() {

        int someNum = 52;

        printf("Whale exists that does %d hz\n", someNum);

        std::cout << "Out";

        return 0;

}

/var/obfuscator/code_624952c3a4d4ebc7df41c830d3572272.c:3:10: fatal error: 'iostream' file not found

Stopping due to parsing error of severity Fatal

\-----

Removing the include for iostream yields:

\-----

/var/obfuscator/code_c963503bab4beb00483856ecd675548d.c:7:9: error: expected expression

Stopping due to parsing error of severity Error

<comment><AUTHOR> You're compiling it in C mode. Switch to C++ using the dropdown.</comment></comment>


Statik: A multi-purpose static web site generator for developers - <AUTHOR> https://github.com/thanethomson/statik <comment><AUTHOR> After going through quite a few of the top-ranked static site generators on [https://www.staticgen.com/](https://www.staticgen.com/) I just couldn't find a static web site generator that allowed me to define a generic data model in a simple way (I had to hack each application or write plugins to get them to do what I wanted). So I wrote my own: Statik.

Written in Python (3.5+). Define your models in YAML format, define instances for those models (YAML/Markdown), write your templates as Jinja2/HTML templates, write view configuration in YAML (with SQLAlchemy queries), and Statik will load it all up into a queryable in-memory SQLite database and crank it out as a static web site.</comment>


Edward Snowden responds to release of e-mail by U.S. officials - <AUTHOR> http://m.washingtonpost.com/world/national-security/edward-snowden-responds-to-release-of-e-mail-by-us-officials/2014/05/29/95137e1c-e781-11e3-afc6-a1dd9407abcf_story.html <comment><USER2> "No we never got any concerns from Snowden"...

(months later)

"Oh here it is, an email from Snowden"...

"So how do you explain that you lied before?"

(silence)

Is NSA just lying because it hopes the problem will go away? I guess that is not unreasonable. Public has a pretty short attention span. So rather than trying to engage just brush off and deny everything.

Was anyone at the NSA ever punished for lying to the public or Congress? If not they have exactly 0 incentive for not doing it. The part of "Oh yeah here is the email" and the follow up question of "Why were you lying?" quite often never comes. Everyone just moves on.

Looking at the organization as a whole and comparing to a person, NSA acts like a psychopath that climbed its way up to into a power position. Lying through its teeth. Engaging in illegal activities. Every time they are caught, telling lies, they follow up with more lies. Spy on Congress members and judges. Presumably to be able to manipulate them. This is a person you'd want to run away from in real life as fast as possible. They are dangerous because they have power and they have no morals.

<comment><USER3> Well, from the looks of it Snowden was asking a procedural question, not outlying any concerns. He also received a response. I have to wonder if you actually read the email.

<comment><AUTHOR> > The NSA's new discovery of written contact between me and its lawyers - > after more than a year of denying any such contact existed - raises serious > concerns.

^ Something Snowden says, at the beginning of the article.

<comment><USER4> It's something Snowden _claims_ , but I don't see the justification for it if you actually read Snowden's email.

Snowden says his one (instead of multiple emails as he previously claimed) disproved this NSA claim:

"after extensive investigation, including interviews with his former NSA supervisors and co-workers, we have not found any evidence to support Mr. Snowden's contention that he brought these matters to anyone's attention."

But his one email made no such suggestion as bringing any legal matter whatsoever to anyone's attention. It asked whether an E.O. was really at the same level of statute law (it is, it is only the scope of effect that is different). Snowden's email didn't even suggest he had any complaints to make about NSA interpretation of law. If anything it reminded me more of the arguments made by "Freeman on the Land".

Snowden claims that other emails do exist though, with actual substantive complaints. But I'm not sure what to believe, if he actually seems to think _this_ email of his represented a formal complaint, then who knows what was actually in his claimed email to the SID Office of Compliance?

He also doesn't mention who he sent his email regarding his EO 12333 question to. Was it this very email? Does he expect legal counsel to read minds too? And either way, his complaint was that the activity conducted under EO 12333 was "indefensible", not "illegal". But I don't know of any major organizations (private corporations or public agencies) that would deliberately take a harder route to undertake an activity they were authorized to do.

<comment><AUTHOR> First, there was a complete denial, and now magically, an email manifests. That's the point you seem to be missing.

<comment><USER4> There was no complete denial. Does anyone really believe the NSA said "We promise we have never received a single email from Edward Snowden"? He'd probably have to send dozens of emails every day in the normal course of his duties.

The NSA _did_ put out a complete denial that he has raised an actual issue with the agency's conduct of their intelligence programs, and this email doesn't contradict that line one bit.

There may be such emails out there (Snowden claims there's at least one), but this isn't one of them.

I mean, otherwise _NSA wouldn 't have released it_.

<comment><AUTHOR> > I mean, otherwise NSA wouldn't have released it.

Good point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> So yet again we have reason to trust Snowden's word and to further doubt official statements from the NSA.

<comment> k-mcgrady As he said in the article they continue to contradict themselves. They said no communications existed - and now suddenly they have one. Why should we believe them when they say they don't have any more when they've already lied about it once?

<comment><USER4> > They said no communications existed - and now suddenly they have one.

There's no contradiction at all.

He said he sent emails of a certain category. NSA still says they have no emails of that category—but they do have an email of a different sort, asking a procedural question.

NSA probably has _lots_ of emails from Snowden on file, after all. What they've said (and continue to maintain) is that they don't have any reflecting a concern (edit: typo fix) over these programs. The email they released from him certainly doesn't show any concern. Seriously, read the actual question:

"I am _not entirely certain_ , but this _does not seem correct_ , as it _seems_ to imply that Executive Orders have the same precedence as law."

This is hardly anything even approaching a hard charge of misconduct being done. Especially so given that the General Counsel announced that they agreed with Snowden's interpretation, "That said, you are correct that E.O.s _cannot override a statute_."

</comment></comment></comment><comment><USER6> On the Washington Post comments section, I feel that users "still here" and ".Morti" are shills from the NSA. One of Snowden's leaks confirmed that they do try to change viewpoints on online discussions.

<comment><AUTHOR> Who are the shills on HN? ;)

<comment><USER7> I have watched some accounts on HN gain over 1000 karma in less than 80 days. They appear to be using machine learning techniques to pump links into the site. They made no comments for days until their karma was high enough.

<comment><USER8> Well, why not name names?

<comment><USER7> Because w/o damning evidence of any wrongdoing at this point I don't want to turn it into a witch hunt. Watching.

<comment><USER6> You're like the Paul Revere of HN.

<comment><USER7> More like that other guy no one can remember. ;)

It is interesting to watch the ebb and flow of political opinion on discussion forums. And it would be extremely interesting to have logs of HN or Reddit to do shill and multiple account detection.

<comment><USER6> Someone could do their PhD thesis on this. All you grad students out there - pay attention!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> How can the supposedly most capable "intelligence" organization in the world be so dumb at understanding public opinion in the internet age? It's like they are operating out of a 1930s propaganda playbook ..

Especially when Snowden, Greenwald et al appear to be _masterminds_ at the same task. Of course, it helps to have the truth on your side, but considering that they are up against the most powerful people on the planet .. very impressive.

<comment><USER10> Two possibilities:

1\. "It is difficult to get a man to understand something, when his salary depends on his not understanding it." Replace "understand" with "acknowledge" as necessary.

2\. They know they only need to worry about the opinions of certain key players, not the public in general.

</comment></comment><comment><USER11> The fact Snowden had the conviction and courage to challenge the NSA on fundamental issues, both verbally and in writing, is remarkable.

This was Snowden's employer and the source of his income. Evidently, the preservation of civil liberties was more important to him.

<comment><USER12> He risked much more than his income - he risked (and is risking) his life.

<comment><USER13> I think he means before he decided to leak information, when he was just voicing his concerns to his superiors.</comment></comment></comment>


The Firebird Book (Second Edition) released : printed and ebooks - <AUTHOR> http://www.firebirdnews.org/?p=8455

<comment><USER2> I remember when Mozilla "Firebird" had to change its name to Firefox because the RDBMS guys strongly objected. At the time, I had never heard of the database project. Nine years later, I'm still not familiar with it. Is it widely used? What's keeping it from being as well known as MySQL or PostgreSQL?</comment>


Ageing process may be reversible, scientists claim - <AUTHOR> https://www.theguardian.com/science/2016/dec/15/ageing-process-may-be-reversible-scientists-claim <comment><AUTHOR> related: [http://medicalxpress.com/news/2016-12-scientists-reverse- agi...](http://medicalxpress.com/news/2016-12-scientists-reverse-aging.html)</comment>


Ask HN: Need tips from startup founders about discussing employee salary/options - <AUTHOR>

Hello everyone, I'm working on a great blog post about how startup founders and CEO can better discuss salary and stock options when hiring their first employees. Do you have 1 or 2 tips that founders should know when discussing salary and equity with newly hired employees? Thanks in advance for your help! <comment><USER2> Be prepared to disclose what percentage of the company they would have, rather than simply the _number_ of shares.

<comment><AUTHOR> Thanks staunch!

</comment></comment><comment><USER3> If you're asking how much, then this has some good info: <http://www.paulgraham.com/equity.html>

<comment><AUTHOR> Thanks abbasmehdi!</comment></comment>