Cosmo, the God who fell to Earth - <AUTHOR> http://www.wired.com/gadgetlab/2012/09/cosmo-the-god-who-fell-to-earth/all/

<comment><USER2> In 2005, I worked support for a company with a mobile offering. At the time, app purchases were handled exclusively by the carrier and were completely opaque. A little while prior, we had partnered with a shady marketing company, netting us a bunch of unintentional signups that I had the displeasure of fixing.

Since we didn't handle billing, I had to call AT&T with the customer on the line and talk them both through the process of removing the charges(AT&T was feeding customers a line about not handling billing either, for some reason). After doing it a few times, I realized I could do it without the customer, all I needed was a name and a phone number.

It never came down to impersonating the customer, instead, I would just say I was calling on behalf of a customer. Once, a call got escalated to a higher support tier, with the miscommunication that I was a VP of a partner company, which made the agents more responsive, making the process easier, so I just kept reusing that line.

Eventually, I just asked, "what do I tell the next agent I have to deal with so we can just bypass all the lies?" (regarding their inability to modify billing charges). This was happily given to me, and I could now call AT&T support and say, "I'm calling for user X with number Y. I need you to go into the tool and click on Z and then remove the charge from such and such service." Again, when delivered with authority, the rep would do it, no questions asked.

It's hard to fault them, I probably would have done the same in their position. Still, it's scary knowing how little it takes to get customer service to reveal/modify things without hard verification.

<comment><USER3> I bought a Palm Pre2 last year on ebay and had to go into an AT&T store to activate it. The person helping me had a little trouble activating it, so he called AT&T support and got help so quickly without being asked stupid questions, I've been using his technique ever since.

Whenever I call tech support of a company that has physical locations, I always start with:

 _"Hello, my name is Kevin, I'm an associate with [company] at the [store] location. I'm trying to help a customer with [my problem] issue..."_

And very quickly I'm having a conversation with someone who knows their stuff and doesn't insult my intelligence.

<comment><USER4> What do you do when they ask you access the intranet at the terminal that is obviously right infront of you?

<comment><USER3> Lol that would be a bit of a dilemma. Haven't encountered that yet.

<comment><USER5> Tell them the screen broke.

</comment></comment></comment></comment></comment><comment><USER6> Oh, Wired... you write an article about a hacker and change his name to "protect" him, but publish a photograph of his neighborhood with readable house numbers and license plates.

<comment><USER7> He was doxed a long time ago, so it's not like someone who really wants to know can't find him; they still aren't going to print the name of a minor for everyone to see.

</comment></comment><comment><USER8> What's really bad about stories like this is that social engineering is not new. I recall working on closing some of these types of loops at companies 10 years ago.

<comment><USER9> When I was reading this, I was thinking the same thing. Are the IT leads who put these systems in place forgetting the 90s?

<comment><AUTHOR> When the Wired author was hacked and it was first posted here about half of us jumped on 'shoulder surfed', 'is it possible to brute force' and half a dozen decent technical explanations. I think often people are now looking for the next over the top attack and forgetting the simplest tricks are often the most successful.

</comment></comment></comment><comment><USER9> It's interesting to me how easy it is for some people to circumvent their ethics. This kid is intelligent enough to know what he's done is unethical but I've never been a teenage boy so I consider what would come with that feeling of discovering a sweet hack: a desire to use that knowledge to assert power above all costs.

<comment><USER10> I'm not sure it's so much "circumvent" as "it's not fully hooked up yet".

Ethics are intellectual, but they're grounded in a human moral sense that is rooted in biology. (For a readable start on how, de Waal's _Good Natured_ is a good book.) When I was his age I was much more aware of mechanism than of morality. For me the motivation to hack wasn't power in the social sense; it was tinkering with systems.

It took me years for my moral sense to integrate well with my intellectual side to yield a proper system of ethics. In some ways that's still going on; the older I get, the more I have learned how to be compassionate. For me, the ethical framework is given force by very specific instances of compassion. For example, I was just looking again at Project Unbreakable:

<http://projectunbreakable.tumblr.com/>

It's not like I ever thought sexual assault was ethically ok. But reading bout each one of those people gives it more emotional power.

<comment><USER11> Without incriminating myself, let's say that maybe I've seen some files belonging to other people that I shouldn't have when I was a teenager.

At the time, I justified it easily to myself - I don't care if someone sees the contents of my hard drive, so why should it be unethical for me to root through someone else's?

I'm 28, now, and a year ago my mom reminded me that I'd said that. I was pretty embarrassed at how I'd acted, and how I justified it to myself. I hope I remember that sequence of events when I have kids.

</comment></comment></comment><comment><USER7> Reading this reminds me of a gripe I have; is it possible to use 2-factor authentication on gmail without a phone? You can print a list of OTPs but you can't enable it without also registering a phone number. Given how easy it is to intercept voice and SMS, that seems like a huge security hole.

<comment><USER12> The device doesn't need to be internet connected if you use the app. An iPod Touch does the job just as well as SMS, though you need to make sure the times are synchronized.

<comment><USER7> Still doesn't answer my question. It won't let me turn on 2FA without giving them a phone # that can be used (SMS or voice) to authenticate, which means anyone that can redirect my phone or capture my SMS messages (both fairly trivial in a targeted attack) can bypass 2FA.

<comment><USER13> You have to just do that once to activate 2FA. Once activated, switch to mobile app. No one can turn it off without having code and password later. (apart from finding some flaw in system)

</comment></comment></comment></comment><comment><USER14> >>People Are The Key to Every Lock

Great section title. Here's my favorite bit of "social engineering". Using the term loosely, I know, but it still makes me laugh.

<http://www.youtube.com/watch?v=94LL8J8WYT0>

</comment><comment><USER15> This is really interesting. Makes me wonder why I bothered generating those hard-to-crack passwords if they can easily be reset by a bit of sweet-talking.

<comment><USER16> No joke. Cyber security's a constant game of 25 steps forward and 122 steps back.

<comment><USER17> Is that your ROT cipher?

<comment><USER18> damnit!

</comment></comment></comment></comment><comment><USER5> The trouble is that normal operations are often indistinguishable from social engineering.

I have worked several places where I have been told by management that something needs fixed on a web server, but they can't remember any passwords, so could I call up their ISP and just get it sorted.

In these situations, I have never had to prove anything I couldn't have faked and I usually get asked to provide an email address so they can send me the details.

As this kind of behaviour seems very common, most everything seems to be wide open for social engineering. So given that everything isn't hacked all of the time, people in general must be both much nicer and much lazier than I had otherwise assumed.

<comment><USER19> "Your security is based on the kindness, and apathy, of strangers."

I repeat that warning to anyone who has become just computer-savvy enough to use a computer as well as they drive their car.

The tinfoil-hat jokes have tapered off, over the years, with the mainstream news coverage of stolen user information.

<comment><USER20> Just had a reminder of that this morning... Was doing a bit of routine maintenance on the server at work when I noticed repeated ssh login attempts appearing in the system logs... with usernames that clearly don't exist. Tracing the source ip address sent me to Beijing somewhere, so someone there was trying a port scan and random ssh login attempts.

I've never really looked for this kind of interaction before, and I wonder just how common it is these days - but I'd say that you can now pretty much guarantee that it will happen at some stage, and you'd better hope your security is up to the task.

<comment><USER21> It is so common I'd be surprised if you weren't seeing these login attempts. Every ssh server I've run in the last 10 years has had this happen, even those without domain names. They must just scan random IPv4 addresses for anyone responding on port 22. It's the modern equivalent of wardialing.

</comment></comment></comment></comment><comment><USER22> looks like wired got socialed themselves</comment>


Show HN: Simulate Facebook Chat Conversations via the Graph API - <AUTHOR> http://chatsimulator.com

<comment><USER2> The bad blur option really ices the cake.

</comment><comment><USER3> Just from reading the title I went wow that's really interesting....

And scary. What I would prefer to see is "get a prediction of answers to questions you make via the graph"

as a marketing tool "how would you react to a pricing drop in x goods?"

Or "what do you most want from y product?"

2this is just beginning.. . Look at Netflix built house of cards (apropos based on this) with graph input from their viewer base.

"How would fb graph inform my creation of x service?"

<comment><USER4> I don't even... It makes me start thinking how many comments on HN are like this. I used to feel like sometimes comments on HN is as valuable as the original story. This makes me think about how many other well-formed read- title-only comments in disguise.

<comment><USER3> WTH? I even said my comment was knee-jerk from the title only.

Whats wrong with admitting that? You know what I am tired of, the constant HN ego.

I'd love to see a conversation between you and any single person you know; do you cut them off after every single comment or sentence and ask for a source?

How hung up you are on ensuring that every single comment ever is always backed by reading everything?

 __ _I dont even...._ __what a ridiculous narcissistic way to open your non- rebutal.

^This

<comment><USER5> I think the issue was not that you read only the title, but that your interpretation of the title turned out to be incorrect.

<comment><USER3> And this is your literally only comment ever on HN?

My average contribution is far better than most, then....

Jesus F christ.

<comment><USER5> Apologies, I had hoped to help by shedding a little extra light on the misunderstanding.

<comment><USER3> You dont need to apologize, however. I appreciate you shedding light - but I would be much more interested in your potential other comments rather than meta-commentary....</comment></comment></comment></comment></comment></comment></comment>


From L3 to seL4: What Have We Learnt in 20 Years of L4 Microkernels? [pdf] - <AUTHOR> http://www.nicta.com.au/pub?doc=6930 <comment><USER2> Microkernels are a nice step toward security, but they're a concept ahead of current hardware design and they don't really bring the flexibility typically promised.

Services (virtual memory/swapping, file systems, the network stack, etc.) in microkernel systems typically can't be modified or replaced by applications any more than in monolithic kernels, which is probably party of why microkernels have stayed in the realm of embedded systems, etc. where you have control over the whole system.

Exokernels bring the flexibility that microkernels don't, by moving the security boundary down the stack. Instead of moving services into trusted user-level processes, they manage protection at the level of hardware resources rather than services. This enables those services to be in untrusted shared libraries that can be securely modified or bypassed on a per- application basis.

Thus, instead of the lingering "eh, it's a little slower but we can ignore that," exokernels provide much better opportunities for optimization and tend to be much faster. For example, a database could choose to discard and regenerate index pages rather than swap them out to disk and back; a file copy program could issue large, asynchronous reads and writes of all the copied files at once; a web server could use its knowledge of HTTP to merge packets, or co-locate files from web pages to improve disk seek time.

Further, exokernels and microkernels are not mutually exclusive; they are rather orthogonal concepts (you could move an exokernel's drivers into user space processes if you wanted). If we had hardware that were more conducive to a microkernel design, for example with direct process switching rather than going through the kernel (32-bit x86 did this with task gates, but they weren't used much and were abandoned with 64-bit), this would probably be the optimal design, rather than a purist microkernel approach. Incidentally, the in-development Mill CPU design does this very efficiently, as well as a few other things that are good for both micro and exo-kernels.

<comment><USER3> Exokernels tend to be a good idea for quite a number of things. In fact, all modern desktop systems use what is essentially an exokernel design in their graphics driver stack:

Rather than implementing OpenGL (or Direct3D or whatever) in the kernel, the kernel drivers provide an interface that allows user space to submit hardware- dependent command lists for the GPU.

OpenGL is then implemented as a very thin layer that loads a hardware- dependent user space library. It is this hardware-dependent library that contains the vast majority of the OpenGL implementation, including the shader compilers and everything else that is needed to build the hardware-dependent command list that is ultimately submitted to the kernel.

<comment><USER4> And you've just described the current state of Open-Source video drivers in Linux.

<comment><USER5> I believe both Windows NT and OS X do it this way, in addition to closed- source video drivers for Linux and Android? Not certain, and I won't speculate about iOS.

<comment><USER6> Windows (NT) does since Vista. But I thought OS X still had all of it in kernel-space? Not sure though.

<comment><USER7> All the major OSes evolved through different paths, but eventually ended up with very similar schemes.

Windows (ignoring the 9x series): In NT 3.x, GDI was just a thin DLL that RPC'd over to CSRSS.EXE. CSRSS did the actual drawing directly from userspace. As recently as XP (I haven't checked later) CSRSS still has an elevated IOPL, which meant that despite being a userspace process, VMware had to use binary translation on it, instead of direct execution. In NT4/XP, GDI (and some other stuff) moved into win32k.sys. Userspace would essentially do a syscall, and the kernel would talk to the video card. For 3D graphics, the model is that userspace apps load a video-card specific library to generate command buffers for the video card. When the app wants to execute a command buffer, it uses a syscall; the kernel verifies that the commands are safe, and submits it to the hardware. In Vista and later, a path similar to the 3D path is used for all drawing, only the drawing is done on an app-specific offscreen surface. Another userspace process generates command buffers to composite those offscreen buffers together to generate what you see on the screen.

Linux/X11: In the dark ages, it was very similar to NT 3.x (X came first, I just ended up writing in this order). Applications used xlib to generate X protocol messages which were sent via a unix domain socket, or a TCP socket to the X server. The X server then, from userspace, programmed the video card. This had the same IOPL implications for the X server as CSRSS.EXE. When 3D acceleration was added, it worked very similarly to 3D in NT4/XP. Finally, with compositing and now Wayland, the model is similar to Vista+.

OSX: In NextStep/early OSX, applications drew (software only) into shared memory chunks. A userspace compositor process did software compositing from those shared memory chunks into the video card's VRAM. With middle OSX (can't recall exact versions here), the compositor process started to upload dirty regions from the shared memory chunks into offscreen VRAM surfaces, and then programmed the video card to composite them together. Finally, modern OSX works similar to modern Linux and Vista+.

I just wrote them up in this order arbitrarily. X did drawing via RPC to a user-space process long before NT and NextStep existed. NextStep did compositing _long_ before the other two. Ironically, given the flamewars and marketing of the 90's, Linux/X was exactly as "microkerneley" as NT3.x and NextStep, and more so then NT4. And they all evolved towards very similar architectures.

</comment></comment></comment></comment></comment></comment><comment><USER8> This article is a PDF document. Here's the abstract:

 _The L4 microkernel has undergone 20 years of use and evolution. It has an active user and developer community, and there are commercial versions which are deployed on a large scale and in safety-critical systems. In this paper we examine the lessons learnt in those 20 years about microkernel design and implementation. We revisit the L4 design papers, and examine the evolution of design and implementation from the original L4 to the latest generation of L4 kernels, especially seL4, which has pushed the L4 model furthest and was the first OS kernel to undergo a complete formal verification of its implementation as well as a sound analysis of worst-case execution times. We demonstrate that while much has changed, the fundamental principles of minimality and high IPC performance remain the main drivers of design and implementation decisions._

</comment><comment><USER9> Oh, the conundrum that is the very technical HN story. Do I dive in and devote the time to learn whether this is paper is as interesting as it seems on the surface, or do I wait for some explanatory posts or even a TL;DR summary to help me decide?

Edit: The paper helpfully provides much of this itself, with boxed section footers with the change from then to now in how that component is handled. It makes for an interesting way to skim and zero in on sections you may find of interest.

e.g. _4.2 Lazy scheduling_ ends with *Replaced: Lazy scheduling by Benno scheduling"

<comment><USER10> The way to read papers: Read the abstract, if still interested read the conclusion, if still interested read the rest.

<comment><USER11> While working as a cell biologist, i followed a different approach: ignore the abstract, look at the figures, if still interested skim the materials and methods, and if still interested, read the rest.

The rationale for this is that the most interesting thing is what the authors have discovered, but it's only interesting if they've used sensible and relevant methods, and what is very unlikely to be interesting is the authors' attempt to convince you that the result is stronger and more important than it is.

<comment><USER10> Yeah, "my" approach[1] is probably best suited for computer science papers.

[1] It's not really mine, it's what I was told at university.

</comment></comment></comment></comment><comment><USER12> The OOTB/Mill people are apparently working on porting L4/Linux to their architecture: [http://millcomputing.com/topic/security/#post-802](http://millcomputing.com/topic/security/#post-802)

Their machine-supported security features will be very interesting to see realized.

</comment><comment><USER13> "For a successful technology, reality must take precedence over public relations, for Nature cannot be fooled." \--Richard Feynman

All of us need to learn this, re-learn it, revisit it, internalise it, live it and breathe it every day. I'm sure I could do better at attaining such an ideal. So too can these gentlemen.</comment>


Michael Crichton on talent: "I just work hard" - <AUTHOR> http://www.youtube.com/watch?v=X0bQnqD9dLA

<comment><USER3> If you're interested in more analysis of 'talent', read this: [http://money.cnn.com/2008/10/21/magazines/fortune/talent_col...](http://money.cnn.com/2008/10/21/magazines/fortune/talent_colvin.fortune/index.htm)

"Why talent is overrated

It is mid-1978, and we are inside the giant Procter & Gamble headquarters in Cincinnati, looking into a cubicle shared by a pair of 22-year-old men, fresh out of college. Their assignment is to sell Duncan Hines brownie mix, but they spend a lot of their time just rewriting memos. They are clearly smart - <USER2> has just graduated from Harvard, the other from Dartmouth - but that doesn't distinguish them from a slew of other new hires at P&G.

What does distinguish them from many of the young go-getters the company takes on each year is that neither man is particularly filled with ambition. Neither has any kind of career plan. Every afternoon they play waste-bin basketball with wadded-up memos. One of them later recalls, "We were voted the two guys probably least likely to succeed."

These two young men are of interest to us now for only one reason: They are Jeffrey Immelt and Steven Ballmer, who before age 50 would become CEOs of two of the world's most valuable corporations, General Electric (GE, Fortune 500) and Microsoft (MSFT, Fortune 500). "

<comment><USER4> I'm not getting the argument for talent being overrated. Two bright slackers become much more successful than all their driven, but less bright, co workers?

<comment><USER5> Who cares if two slackers succeed? The whole argument is that talent is inherently pointless. I wasn't a talented writer as a child, hell my 3rd grade teacher told my parents I might be dyslexic and I'd need to take special needs classes until I graduate. Before the end of the summer after I graduated I got a job as a journalist, and at the same time my friends who in 3rd grade were supposedly phenomenally talented in English were going to take a 2 year introduction to English at university and then a 5 year journalism course.

I wasn't born with an uncanny writing talent, I was thought to be retarded but I liked telling stories. So I spent a lot of my childhood from 13 years old, when I realized that I wanted to write books for a living, practicing writing. I read huge amounts of books to learn how different people write and taught myself.

At 17 (I'm from the UK I graduated at 16) the editor was telling me I was the most talented writer they had. I surprised him one day, he sent me an email at around 6 saying one review I did wasn't how they wanted it (which was the reason I left, the product I reviewed sucked ass but because it came from a big company we couldn't offend them) so he said it needed changing. An hour later I emailed him back with the entire thing rewritten the score from a 1 to a 8. For everyone who doesn't know the review game; for example a video game review, if it takes 10 hours to play the game it will probably take you around 20 hours to review and edit it, so getting an essentially new review in an hour was amazing to him.

The reason why I could do a review in an hour that would take anyone else a day to get back. Well because I'm driven. I'm sure there were more talented people on the staff, but that doesn't mean shit when I can consistently out perform someone 10:1.

So yes being talented will help you, but if you're a slacker you're not going anywhere to begin with.

<comment><USER6> Wrong. Slacking is great. You got a brain? Why not use it to figure out how not to work. Work is for people who don't know how to get everything they want without working. Slacking is surfing the path of least resistance and riding it to build up incredible momentum.

One game to play with the few waking hours you have to live is to work hard to get what you want.

I'd much rather not work hard and get what I want anyways. Relax, the structure of the universe will catch you if you do what you want and don't work.

</comment></comment></comment></comment><comment><USER7> Wow, awesomest thing I have seen in a while! This video just made me really, really like Crichton. A successful person is never truly great without humility. Thank you for submitting.

</comment><comment><USER8> Related reading: "The Role of Deliberate Practice in the Acquisition of Expert Performance", [http://projects.ict.usc.edu/itw/gel/EricssonDeliberatePracti...](http://projects.ict.usc.edu/itw/gel/EricssonDeliberatePracticePR93.pdf)

</comment><comment><USER9> I don't expect that I can work hard. I do my best to avoid the laziness. Yes, I am only 21 and have much to learn. But my experience told me, it is not that one work so hard to get success, instead, it is that the rest of us just too lazy to pursuit what we really want.

<comment><USER10> If I could tell my 21 year old self one thing it would be: Just be consistent with your work and build upon something, it will pay off for you. Don't work feverishly on something for months/days and then slack for months/days expecting your hard work to pay off. It's no so much 'slow and steady wins the race", fast and steady can win lots of races, the important part is steady.

<comment><USER11> My problem is trying to find which things I want to devote effort to. (I am also 21). Right now I try to put as much effort as I can toward every part of my life, and I usually become burnt out very quickly and get stuck in a sort of "waiting place" for a month or two. If I could figure out some solid priorities as far as what I really want to devote my effort to, I feel like it would pay off a lot in the long run. Right now I'm still trying to figure out how to do that...

<comment><USER12> This isn't a bad strategy to try, for morale, confidence and people wanting to help you: <http://www.paulgraham.com/good.html>

</comment></comment></comment></comment><comment><USER13> This is more true than most people believe. Particularly people that haven't tried hard.

</comment><comment><USER12> Another good "talent vs effort" article: [http://www.sciam.com/article.cfm?id=the-secret-to-raising- sm...](http://www.sciam.com/article.cfm?id=the-secret-to-raising-smart-kids)

</comment><comment><USER14> Each of talent, hard work, and luck is a necessary but not a sufficient condition: achieving great success requires all three.</comment>


Show HN: I built a Stack Overflow clone using CodeIgniter and open sourced it - <AUTHOR> https://github.com/sahan91/mobilehub <comment><USER2> People clone a lot of consumer apps. The ones I wish people will clone are like SAP S4/Hana ERP etc. there are not enough high quality Open source ERP systems

</comment><comment><USER3> Copyright (c) 2008 - 2011, EllisLab, Inc. All rights reserved.

3years ago was the last change .

what year is this?

</comment><comment><USER4> Just a readme change in 3 years, are you picking back up on development?</comment>


NSA chief drops hint about ISP Web, e-mail surveillance - <AUTHOR> http://news.cnet.com/8301-13578_3-57589078-38/nsa-chief-drops-hint-about-isp-web-e-mail-surveillance/ <comment><USER2> > The head of the National Security Agency hinted yesterday that logs of > Americans' e-mail and Web site visits may be secretly vacuumed up by the > world's most powerful intelligence agency

Sounds like they have zeroed in on the audit trail of what Snowden was able to access and/or what he has already given to Greenwald or the Washington Post. Some pre-damage control going on here.

> disclosing details about such surveillance would cause "our country to lose > some sort of protection."

The people who they would be surveilling really wouldn't have suspected this capability already?

<comment><USER3> Especially after the NYT's disclosures in December 2005, which included mention of email. And an earlier disclosure by a U.S. politician (this is from memory) about intercepting Al Qaeda satellite phone calls, which was probably a disclosure that was actually damaging.

Sometimes claiming, without proof, that revelations will "hurt America" is simply a way to justify secrecy.</comment></comment>


Comcast CEO to angry customers: It's not me, it's you - <AUTHOR> http://www.vox.com/business-and-finance/2015/12/15/10161100/brian-roberts-comcast-bad?utm_medium=social&utm_source=facebook&utm_campaign=voxdotcom&utm_content=tuesday <comment><USER2> I had comcast xfinity tv and internet for 14 years. Month after month I had reliability problems. I replaced the cable modems. I replaced splitters frequently. The techs came to my house and said something was wrong but they had no idea how to fix it. So I went to Verizon FIOS with TV, Digital Voice (Phone), Internet for 6+ months. No problems and 2x the speed of Internet downloads. So no mister CEO it is not that I don't want to pay for the service. I want what I pay for.</comment>


How to Write a New Git Protocol - <AUTHOR> https://rovaughn.github.io/2015-2-9.html <comment><USER2> This would have been very nice to have a few months ago! At Aspera we wrote a protocol handler for Git[1] that let us send data over fasp (a reliable UDP protocol for fast bulk-data transfers). I learned a ton by reading Git's source code to figure out how to do it, but this blog post is much more pain- free.

Very good write up!

[1]: [https://www.youtube.com/watch?v=ECq7dCwixaY](https://www.youtube.com/watch?v=ECq7dCwixaY)

<comment><AUTHOR> That's very interesting! The alternatives to TCP that can be written in UDP which are optimized for a certain application are especially interesting to me. Working at the UDP level can present a lot of interesting performance options, kinda like working in C instead of Python.

Something I've been curious about is if there are proxies that can convert protocols. So for instance, on your local machine, you could have a proxy that turns TCP connections on port 8000 into FASP connections to another machine. This would let you use an ordinary web browser over FASP.

You could even pipe the proxies, e.g., TCP -> FASP -> MinimaLT [1]. That way any program could have really fast data transfer over an encrypted tunnel.

[1] [http://cr.yp.to/tcpip/minimalt-20130522.pdf](http://cr.yp.to/tcpip/minimalt-20130522.pdf)

</comment></comment><comment><USER3> Thanks for sharing this. It's a good walkthrough and potentially quite useful for anyone wanting to implement a new protocol. It seems like the wrong tool for the job to me however.

This seems like it would be more easily implemented with smudge/clean filters[0]. In fact, this is exactly what git-crypt[1] does. The idea is that you run a filter on every file as it's checked out to do the decryption and every time a file is staged to do encryption. This requires nothing extra on the remote repository and you can you git commands as normal.

[0] [http://git-scm.com/book/en/v2/Customizing-Git-Git-Attributes](http://git- scm.com/book/en/v2/Customizing-Git-Git-Attributes) [1] [https://github.com/AGWA/git-crypt](https://github.com/AGWA/git-crypt)

<comment><USER4> Depends on the behavior you want. With smudge/clean filters, the files in the repository history are encrypted. That means you don't get the benefit of delta encoding, and any tools you have that look directly at the repository (such as gitk or anything based on libgit2) cannot operate on the cleartext data.

On the other hand, git-remote-gcrypt ([https://github.com/joeyh/git-remote- gcrypt/](https://github.com/joeyh/git-remote-gcrypt/)) encrypts when pushing and decrypts when pulling, which leaves the local repository unencrypted but keeps it encrypted on the untrusted remote server.

<comment><USER3> That's a fair point :) Although I do like the fact that the smudge/blur approach means that you can selectively encrypt files as well as still share the entire repository publicly via any protocol.

<comment><USER4> True. And it also has the advantage of failing closed (if you accidentally push to the wrong place) rather than failing open.

</comment></comment></comment></comment><comment><USER5> For people wanting to store their passwords, personal data and large files in a git-like fashion, I recommend Git-Annex: [http://git- annex.branchable.com/](http://git-annex.branchable.com/)

</comment><comment><USER6> Nice job! I had no idea anything like this was even possible.

</comment><comment><USER7> This seems interesting to me from the perspective of being able to securely & incrementally back up a media collection to a cloud storage provider (S3, etc) without fear of it being scanned for copyrighted content, a la Dropbox. There are probably solutions out there to do this already; I'm just not aware of them.

Very interesting article, and well-written walkthrough.

<comment><AUTHOR> That's the reason I wrote this for myself, and why I made [https://filegrave.com](https://filegrave.com), as I thought it could be useful to others as well.

Git is already a great tool with a workflow for handling incremental updates that I happen to be used to working with, so there was no need to reinvent the wheel.

</comment></comment><comment><USER8> git over ssh should be as safe as ssh, right? Does it somehow go outside the ssh tunnel?

<comment><USER9> He is worried about data-at-rest after the ssh.

Specifically, he mentions wanting copies of his private keys backed up, but NOT having copies of his private keys in a github repository -- which would be the case with a standard push through ssh.</comment></comment>


Adaptive Traffic Lights FTW - <AUTHOR> http://www.wired.com/wiredscience/2010/09/traffic-lights-adapt/

<comment><USER2> _"It's a paradoxical effect that occurs in complex systems," says Helbing. "Surprisingly, delay processes can improve the system altogether. It is a slower-is-faster effect. You can increase the throughput - speed up the whole system - if you delay single processes within the system at the right time, for the right amount of time."_

Braess' Paradox! <http://en.wikipedia.org/wiki/Braess%27_paradox>

Alright, so not quite - one is talking about introducing delays and the other is about the availability of options to rational players, but everyone should know a little bit about it.

</comment><comment><USER3> It's about time somebody did a study like this. I don't know how many times I've sat at a red light with no cross traffic thinking about how much gas is wasted in such situations.

<comment><USER4> Near my home (southeastern Pennsylvania), if you pull up to an intersection and there's no traffic in the opposing direction, the light changes so you get a near-immediate green. It works great at night when nobody else is near the intersections.

I noticed the same thing when I lived in Seattle for a few months.

I doubt the signals are communicating with each other, but there is definitely some deployment of signals with sensors to detect whether a car is waiting on each side of the intersection.</comment></comment>


Show HN: Caldera – Phoenix LiveView for Node and React - <AUTHOR> https://github.com/calderajs/caldera-react <comment><AUTHOR> Hey HN, this is a side project that we made after realizing that a solid chunk of the time and code spent doing full-stack development was spent writing and debugging RPC layers - REST, GraphQL, GRPC, you name it.

The fact that the frontend and the backend are separate services leads to a bunch of cruft ([https://thume.ca/2020/05/17/pipes-kill- productivity/](https://thume.ca/2020/05/17/pipes-kill-productivity/) is a perfect description) and security holes, so we had the idea of merging them. It turns out that Phoenix LiveView already did server-side execution with changes streamed over WebSockets, but we weren't the biggest fans of having to learn an entirely new ecosystem and paradigm. So, we built a framework that allows (at the moment, admittedly simple) vanilla React apps to run on Node.js, with DOM updates being streamed to the client. That way, we can delete the RPC layer and greatly reduce development complexity and total code.

Would love to hear your thoughts!

</comment><comment><USER2> I had this same inspiration from Chris McCord's talk about LiveView ~1.5 years back, and created Purview: [https://github.com/karthikv/purview](https://github.com/karthikv/purview) \- we've been using it in production at the company I work at for over a year now.

It's great to see a similar mindset here, and I hope an approach like this becomes more widely used. I appreciate how Caldera is built using React's reconciler and is centered around hooks, both of which are different than the approach Purview takes.

Two of the challenges we've experienced here:

\- Transferring server-side state between processes: in production, you'll likely have multiple Node processes handling requests via the cluster module or other load balancing. If a client were to disconnect their websocket temporarily (e.g. put their laptop to sleep), they can be reconnected to a different process, which doesn't have the state of their components. As a result, you'll need some way to transfer/persist component state between processes. This same issue will also arise during deploys--you'll spawn new processes with your new code, but you don't want to disrupt existing clients, so those new processes need to load existing component state from old processes. Even more subtly, this issue can occur on page load, since two requests need to be made: one to fetch the initial page and one to initiate the websocket connection. Those two requests can be sent to two different processes/boxes.

\- Working with existing client-side libraries, like selectize or date range pickers. We've opted to use the Web Component spec to create custom tags that can be sent down just like normal tags from the server, but making sure these interoperate nicely with server-side state is challenging.

Very excited to see how Caldera tackles these problems!

<comment><AUTHOR> Great minds think alike! I had a feeling this was a relatively straightforward insight, and Purview looks like a pretty cool implementation.

To answer your questions:

1\. We have a mechanism to serialize the React state tree, as long as it can be copied with the HTML structured clone algorithm ([https://github.com/calderajs/caldera- react/blob/master/src/s...](https://github.com/calderajs/caldera- react/blob/master/src/server/walkFiberRoot.ts)) which has always seemed to be the case in practice. Each tree is associated with a unique token which is stored on the client, but the current storage implementation is in-memory only as we haven't addressed the application upgrade issue. Outside of that, there's nothing stopping us from adding basic versioning (along with react- hot-loader-like reconciliation behavior) and moving the state storage to a database that is shared among application servers.

2\. This isn't really fleshed out yet, but we'd likely take inspiration from React Native's native module approach where lifecycle events for mounting/unmounting/updating a component are implemented on the client, with bindings being called in the server application code (a React-specific version of your web component implementation). I know we're against high-level RPC, but React props naturally have a data/async callback structure that is amenable to being represented as RPC calls (which works for React Native), which is why we're leaning towards that approach.

</comment></comment><comment><USER3> Can you add a flappy bird demo? I find that flappy bird demos for state-over- wire tech like LiveView and Blazor to be a great gauge for performance and latency. If there is the slightest delay or inconsistency in performance you will be able to tell immediately.

I have a longer list of such technologies here: [https://news.ycombinator.com/item?id=19716696](https://news.ycombinator.com/item?id=19716696)

<comment><USER4> Nice list. I have been cataloging LiveView workalikes ([https://github.com/dbohdan/liveviews](https://github.com/dbohdan/liveviews)), and I've added some of the ones you mention.

<comment><USER5> You should add laravel livewire

[https://laravel-livewire.com/](https://laravel-livewire.com/)

</comment></comment></comment><comment><USER6> one of the things I worry about other platforms attempting to do phoenix LiveView is that the BEAM vm gives you process isolation. If there's a miscode, then the process crashes and you're all good. How does JS handle such a situation, and does it result in a malicious attack vector?

<comment><AUTHOR> We are able to catch errors in the React tree (which is per-client) and restrict the crash to the specific client instance. Unfortunately, we haven't gotten around to implementing it yet

</comment></comment><comment><USER7> Awesome, I was literally searching nodejs alternative to elixr live-view a few months ago, but couldn't find anything. Great work!

</comment><comment><USER8> One of the contributors here: here's a live demo: [https://la- inst.caldera.app/](https://la-inst.caldera.app/)

Check out the console for DOM updates streamed from the server. React is running on Node.

</comment><comment><USER9> For a moment I thought it's something about Caldera Linux [1] :)

[1] [https://en.wikipedia.org/wiki/Caldera_OpenLinux](https://en.wikipedia.org/wiki/Caldera_OpenLinux)

</comment><comment><USER10> Nice to see someone finally tackle this in JavaScript!

Although Phoenix is great, it's good to have similar things on Node in pursuit of velocity.

<comment><AUTHOR> Just trying to save the world from 1MB JS bundles ;)

<comment><USER11> That's exactly my starting point to work on ts-liveview. I want to have the runtime property of phoenix liveview (being lightweight and deliver first meaningful paint ASAP) while enjoying the type-checked dev-experience.

Erlang, Elixir, and Lisp(s) show great concepts but missing dev-time type checking (from IDE and compiler) is my road blocker.

Edit: I know there are typed-racket and dialyzer for erlang but my experience with they are not reactive as I do dev / refactoring with TS so far.

</comment></comment></comment><comment><USER12> Woah! This is super cool.

</comment><comment><USER13> Very interesting. Why wouldn't I use this for normal web apps if I want to keep my react code server side instead?

<comment><USER14> One of the contributors here - not entirely sure if you're asking for pros or cons, but the entire point of Caldera is to execute/keep the React code on the server and only stream DOM updates. It's set up such that existing React web apps can be easily ported over (essentially just move all client logic to the server), so you can definitely make normal web apps with the framework! If you're asking about drawbacks, one of the biggest issues is latency, since events need to be sent to the server to be processed, but this can be relatively easily alleviated by hosting servers closer to clients.</comment></comment>


Configuring WiFi Access with 2FA - <AUTHOR>
 We want to configure our WiFi in our small group for users authenticate with two factor credentials.  So the user would first set up the 2FA. than for regular use, would get prompted to enter in 2fa code from say Google authenticator.   So as the administrator for this commercial wireless service, we are looking for the quickest, easiest way to set this all up.  Is there a  wireless access point that is good for small business that has a tool built in that can do this?  or something that works with DUO?  We are hoping there is an easy solution <comment><USER2> You would need to use a captive portal for the input of the 2FA and then allow network access.

<comment><AUTHOR> thank you. I'll check this out on the WAP and choose a 2FA service</comment></comment>


D-Wave Launches Free Quantum Cloud Service - <AUTHOR> https://spectrum.ieee.org/tech-talk/computing/hardware/dwave-launches-free-quantum-cloud-service?href= <comment><USER2> Last I knew (a few months ago) we were somewhere less than 20 qubits and getting a straight answer on "does it work" depended on who was being interviewed. How do they have a 2048 qubit chip? And why is it a binary multiple? Did I miss some announcement?

<comment><USER3> At best, d-wave is making an adiabatic quantum computer, not a gate based quantum computer, at worst (most likely), they're a scam.

<comment> core-questions It doesn't look like a scam. When you sign up, you get an API key, and you can get an SDK and submit problems to it.

I'm not enough of a mathematician to be able to formulate anything, but there's a growing list of people that have been able to get useful results from it.

<comment><USER4> No one questions its ability to do some amount of math. The doubt is in how it scales.

</comment></comment></comment></comment><comment><USER5> Lots of questions about "is this real or a scam", "what's it good for", "what's the difference between this and a true QC". Well...

I have signed up for this, I know very little about the nath, the theory etc. I'm not a computer scientist but apperantly that is what they want, they want people that will come at quantum computing with little to no previous knowledge and come at it with a different point of view..in particular they are hoping for the "killer app". I figure if the Kardashians can get ritch off the internet without knowing one line of code, maybe I have a shot with this!

It will cost me nothing but a bit of time and at the very least I will gain a bit of experience from it. I have not spent much time on it but have watched a few of their videos and they seem to explain things a bit better than the regular "both 0 and 1" crap most people spew.

Here are two links to their videos that cover a lot of the questions asked in this thread.

I say keep an open mind and give it a shot, don't let the nay sayers make you miss out on something that could be a great opportunity.

[https://m.youtube.com/watch?annotation_id=annotation_3470308...](https://m.youtube.com/watch?annotation_id=annotation_3470308643&src_vid=UV_RlCAc5Zs&v=zvfkXjzzYOo&feature=iv)

[https://m.youtube.com/watch?annotation_id=annotation_2178338...](https://m.youtube.com/watch?annotation_id=annotation_2178338285&v=UV_RlCAc5Zs&feature=iv&src_vid=zvfkXjzzYOo)

<comment><USER6> > I figure if the Kardashians can get ritch off the internet without knowing > one line of code, maybe I have a shot with this!

Promise me that if you DO strike it rich with quantum computing, you'll change your name to "Hadamard Kardashian"!

</comment></comment><comment><USER6> So is this actually useful for anything practical? Even with my limited understanding of the state of the art, I'm pretty sure that "factoring large numbers in milliseconds" is not actually something that D-Wave machines can do.

<comment><USER7> The nice thing that the uncertainty of what they do can be resolved now.

<comment><USER8> The superposition of D-Wave's states has collapsed?

</comment></comment></comment><comment> gog-ma-gog To my knowledge, there are still no tasks a D-Wave is better at (asymptotically) than a classical machine

<comment><USER9> Last time I checked they haven't even beaten semi-recent laptops in direct comparisons of execution time, even for very synthetic problems.

<comment> core-questions Probably true, but in some ways it's not a fair comparison - since the field is only 20-30 years old, it's not surprising the offerings are comparable to something in the earlier ages of computing. Many kinds of mechanisms that seemed esoteric at their origin (e.g. the primitive but groundbreaking neural networking of the Perceptron) have become everyday reality for us decades later.

</comment></comment></comment><comment><USER10> OT perhaps, but there's quite a good introduction to quantum computing by one of Rigetti's engineers at the Bay Area Rust meetup online: [https://youtu.be/mrJWpQMx2yo?t=119](https://youtu.be/mrJWpQMx2yo?t=119)

</comment><comment><USER11> Here's the sign up link: [https://cloud.dwavesys.com/leap/signup/](https://cloud.dwavesys.com/leap/signup/)

Things to note:

* You have to scroll to the bottom of the agreement to activate the checkbox, which activates the sign up button

* You have to be (or say you are) in the US

</comment><comment><USER12> I appreciate their service. But, is quantum computing going to be costly for dedicated use ($2000/hour)? I hope someone is working on providing a quantum computing service that is cheaper.

<comment> core-questions Keep in mind that that is an hour block of processing time. If a job only takes a few microseconds, that's a lot of jobs, and you don't have to (nor would you be able to) execute them in just one contiguous hour. You'd spread it out over a month as you refine your processes.

If you're in an industry that hopes to be able to get value from these machines one day, $2k is cheap.

If you're just a hobbyist, the minute or two of time they give you is enough to get started, and if you're good at it, you could probably arrange with one of the universities or national laboratories that have their own machine to get some time on there.

</comment></comment><comment><USER13> Has anyone compared the terms of these quantum cloud services to get the status of who owns the code & their security?

i.e do these companies have un-restricted access to the user's code. Considering any quantum advantage is worth million $, we need clarification on the IP.

<comment><USER14> A lot of the services say something about owning the code you send to them to run. But at the present time this really does not matter, as these are only tech demonstrations that barely run even toy models. Even worse with dwave, they do not have a quantum computer as usually defined (something supposedly more powerful than a classical computer).</comment></comment>


The Elite Brian network - <AUTHOR> http://www.theatlantic.com/life/archive/2011/11/the-elite-brain-network/248422/

<comment><USER2> Brain not brian.

<comment><USER3> There is still time for the submitter to fix it - titles can be edited for up to two hours. If they don't, I hope the mods fix it.</comment></comment>


How I won the housing market without trying - <AUTHOR> http://www.theguardian.com/society/2015/feb/05/how-i-won-the-housing-market-without-really-trying <comment><USER2> Real estate is so expensive around the world now because of unfair tax policies. True wealth creation is taxed mercilessly via a multitude of income taxes, while gains from real estate are often not taxed at all, even though they're completely unproductive. A person holding a land in the city for 25 years didn't make anything new, their profit is a direct zero-sum transfer from someone else. How is that fair?

The net result is an enormous redistribution from productive young people to (mainly) older owners and inefficient land use, a growth-killing policy.

The solution is simple. Abolish all personal income taxes (or at least reduce their levels) and replace them with land value taxes (not property), something like 30% of value annually. Unproductive use of land would disappear. Retiring people with homes close to jobs would move out fast somewhere else, as short commute times have no value to them. Uneconomical building limits would disappear (more efficient use of land - multilevel housing - would have much smaller land tax per living surface area) which would reduce transport costs and time wasted. It's easy to imagine many more positive effects.

Sadly that's never going to happen.

edit: After some thought, never is too strong. If aging gets cured, something like that will be a certainty, because the alternative is the world in which - more numerous - generations after the invention don't own almost anything, which won't work for long.

<comment><USER3> Extrapolating the data from the US [http://taxes.about.com/od/statetaxes/a/property-taxes- best-a...](http://taxes.about.com/od/statetaxes/a/property-taxes-best-and- worst-states.htm) the states with highest property taxes (New Jersey, New Hampshire) don't seem to be the economic powerhouses compared to the states with ultra-low property rates as the theory would imply. (The rates there are on "property value", so the rate for land value would be higher than indicated.)

> A person holding a land in the city for 25 years didn't make anything new, > their profit is a direct zero-sum transfer from someone else.

For one, he took the opportunity risk of locking his liquid capital into a piece of land, which only accumulates property taxes, as opposed to owning a bond or a stock that pays dividend or interest. When you calculate the IRR, land doesn't necessarily come out ahead of S&P 500 over longer periods of time.

For two, he took on the appreciation risk - the land is not guaranteed to go up in value all the time.

<comment><USER2> >the states with highest property taxes (New Jersey, New Hampshire) don't seem to be the economic powerhouses compared to the states with ultra-low property rates as the theory would imply

These are property taxes, not land taxes, unless the article is lumping them. A property tax doesn't provide incentives for more efficient use of land, on the contrary actually.

Even if they were land taxes, they would be way too small for a meaningful difference. Also the biggest effect would come from replacing income tax with land tax, as the most productive people would gain the most, and presumably invest the gain in whatever productive thing they're doing.

>For one, he took the opportunity risk of locking his liquid capital into a piece of land

>For two, he took on the appreciation risk

There's nothing valuable in risk. Your argument works even better for buying a piece of a rock for a million dollars and expecting profits, as the opportunity risk and appreciation risk are way higher than buying a piece of land.

<comment><USER3> > These are property taxes, not land taxes, unless the article is lumping > them.

I am not sure I understand. The property tax in the US is the tax on land + additions, both subjects to appraised value, so yes, the rates listed do include both.

> Also the biggest effect would come from replacing income tax with land tax, > as the most productive people would gain the most

How would this be sustainable for farmers or ranchers? If they have to radically increase their prices to account for new 30% land value tax, does the society benefit or lose?

> There's nothing valuable in risk.

He provided liquidity to the market when somebody was willing to sell that piece of land. If you're taxing someone for providing liquidity, the price of the underlying good will plummet, as that removes incentives for current buyers, and then you're back to square one - low tax revenues collected from land owners.

> Your argument works even better for buying a piece of a rock for a million > dollars and expecting profits

People do invest in gold and silver.

<comment><USER2> >I am not sure I understand. The property tax in the US is the tax on land + additions, both subjects to appraised value, so yes, the rates listed do include both.

Land tax is a tax on a value of unimproved land only [0]

>How would this be sustainable for farmers or ranchers? If they have to radically increase their prices to account for new 30% land value tax, does the society benefit or lose?

Why would it change anything? The land prices would just fall so that the net result would be neutral for average farmer.

>He provided liquidity to the market when somebody was willing to sell that piece of land

Land tax increases liquidity drastically by making it much more expensive to hoard it.

>and then you're back to square one - low tax revenues collected from land owners.

It's not back to square one - it's a situation in which people with more productive use of land can get it much more cheaply. Think of a situation in which a prime residential city land costs one __average __annual wage.

>People do invest in gold and silver.

People do many weird things. [https://images.angelpub.com/2014/17/24245/returns-on- stocks-...](https://images.angelpub.com/2014/17/24245/returns-on-stocks-bonds- gold.gif)

[0] [http://en.wikipedia.org/wiki/Land_value_tax](http://en.wikipedia.org/wiki/Land_value_tax)

</comment></comment></comment></comment></comment><comment><USER4> In the UK it's normal practice to get in a chain. You sell yours, line up the one you want to buy, and all 14 people in the chain complete on the same day. Not sure you should be selling your house, then deciding to look.

You have to ask yourself what changed in the UK mortgage market to create this increase in housing value. It comes down to a bank regulation change the government put in place in 1996. Banks were able to offer buy-to-let mortgages.

This has fundamentally distorted the housing market in the UK.

In London you also have another issue. Apparently 40% of new build apartments are bought and never lived in. They are used as an investment to hold money 'safely' primarily by foreign buyers.

[EDIT] Citation for "buy to leave" [http://www.theguardian.com/business/2014/dec/04/property- inv...](http://www.theguardian.com/business/2014/dec/04/property-investors- islington-london-homes-empty-jail) [http://www.theguardian.com/commentisfree/2014/dec/08/islingt...](http://www.theguardian.com/commentisfree/2014/dec/08/islington- council-buy-to-leave-investors-uk-housing)

So you have a situation where the Banks leant like crazy inflating the housing market, the crash happened, the banks hardened their mortgage lending criteria, which forced most people into renting, enabling landlords to maximise returns and invest further in rental properties using buy to let mortgages that use rental income as part of the payment calculation.

It's one hell of a vicious circle.

From my point of view I have benefited, but I honestly cannot see my 11 year old daughter ever owning her own property.

<comment><USER5> I seriously doubt that 40% figure. Why would "foreign buyers" who by flats as investments not take home the (very substantial) London rents? It would be financially imprudent.

I suspect that this is really a form of xenophobia, used, among other things, to sensationalise newspaper articles.

<comment><USER4> [http://www.theguardian.com/business/2014/dec/04/property- inv...](http://www.theguardian.com/business/2014/dec/04/property-investors- islington-london-homes-empty-jail) [http://www.theguardian.com/commentisfree/2014/dec/08/islingt...](http://www.theguardian.com/commentisfree/2014/dec/08/islington- council-buy-to-leave-investors-uk-housing)

It's called "buy-to-leave" and no it's not xenophobia, it's a symptom of a housing bubble very much centred on London.

<comment><USER5> The article is a bit sketchy on the methodology used. The fact that not everybody flat investigated has somebody on the electoral register can easily be explained by several factors.

\- The central London population is very transient. Many stay only for a few weeks, months or at most a year or two. Why bother registering?

\- Many central Londoners, especially the young and newly arrived, move about quite a lot before they settle in one place for longer. They would not bother with registration.

\- Many, probably the majority of central Londoners are foreign and don't bother with the electoral register because they can't vote in the general elections anyway, and may not know that the can vote for the major (or may not care).

\- There's a lot of legally questionable subletting going on (think AirBnB), where the subletter and / or sublettee might not necessarily want to be on an official register.

\- Some owners may simply fail to find a tenant, for example because they pitch rent too high.

As a piece of anecdotal evidence, I offer myself: I only got on the electoral register about 10 years after I moved to London.

</comment></comment></comment></comment><comment><USER6> Thanks to banking deregulation housing has become an investment commodity. In major cities in Australia at the moment half the purchases are for investment rather than owner-occupier. Government incentives like first-home buyer grants (if you can't save for a deposit) have only lifted the prices and helped vendors. Another one is negative-gearing introduced a couple of decades ago allowing tax deduction for investment properties making a loss (after rent), pushing prices higher. Only a few years ago the rules were changed around Australian pension funds (superannuation) allowing leverage. Property purchases from these funds sky-rocketed. All of this while Foreign Investment Review Board (who should be in charge of making sure foreign investors only buy new properties) has not had a single prosecution in last 8 years making you wonder if the rules are being followed at all. It is hard not to make a connection between constantly rising house prices and baby boomer generation dominating the government. It has been recently estimated Australian politicians hold a $300m property portfolio. Talk about conflict of interest..

<comment><USER7> It's basically inevitable though that in demand property will rise in price, especially with regulation constraining building height/form factor. Home cost in urban areas is much more about location than it's about any real cost to building the residence. Lots of people buy large houses for very little a few miles out of town where land is abundant and demand is more reasonable.

I guess I'm just having trouble really feeling sorry for anyone who decides that living within a select few square miles is worth paying an obscene percentage of their income towards that pursuit. It's a housing _market_ and prices will rise to meet demand until buyers finally split off to other nearby locales.

As to your last line; There's a reason that most people don't want to admit that 2008 was the housing bubble popping and instead insist that homes are "finally returning to their true value".

<comment><USER8> "There's a reason that most people don't want to admit that 2008 was the housing bubble popping and instead insist that homes are "finally returning to their true value"."

It may have burst in the US, but certainly nowhere else

<comment><USER9> With the current prices just with a gun pointing to my head, I would agree to buy a house in Australia as investment.

With the money needed to buy a crappy flat, you can buy a luxury house in a lot of places around the world. Prices are crazy.

</comment></comment></comment></comment><comment><USER10> What is interesting, is that the policy makers have a financial interest in ensuring that the housing market does not crash. Therefore every time it should have crashed big time (2001, 2008), the BoE has propped it up by making sure that borrowing remained dirt cheap and the government made sure that the market stayed liquid (raising stamp duty levels for example).

Every time they do this, they just exacerbate the problem long term, which is quite simply, that the market needs a correction, and the longer they put it off, the more painful the correction is going to be (like it was early 1990's in the UK but worse).

I for one say let it burn.

<comment><USER11> I don't think you achieve much by 'letting it burn,' as it were. All you do is force a large number of people into a bad financial situation – that's not good for anybody.

The market needs correction, but it needs to be well-managed. That basically means long-term house price stagnation and investment in social housing to remove the incentives for buy-to-let landlords and multiple property owners.

<comment><USER12> Property is a zero sum game. People without houses lose the equivalent in future spending as homeowners gain. So propping up a market is directly taking money from the young and increasingly old non homeowners. So not doing anything is putting a large number of people in a bad situation.

<comment><USER13> Property isn't quite a zero sum game; as the last few years have show the overall losses from a crash outweigh the benefits of lower prices and greater liquidity to people without houses (especially if the result is that people without houses can't get mortgages even after the prices have fallen)

That's not to say there shouldn't be more pressure put on property price appreciation, not to mention confiscatory levels of capital gains tax on property speculators that aren't tax-resident in the UK. But inducing a property price crash (as opposed to slowing property price inflation) would be a bad move for the economy as a whole, as well as electoral suicide in a country where the majority of the population have a mortgage or own their house outright.

<comment><USER14> Doesn't "losses from a crash outweigh the benefits of lower prices" depend on who you're talking about?.

For me this has to be looked at from the point of who it affects the most. A person that already has a house is much better suited to "take the hit" of property prices than someone that doesn't have one (in general terms). Obviously you have to manage it, but in the end you should strive to protect those that are more vulnerable.

<comment><USER13> People most vulnerable to house price changes are people who own the title deeds to a house and an obligation to make mortgage repayments which may end up vastly exceeding the future value of the house. And the banks which see rising default rates from owners in negative equity, repossessed houses they can't sell. And anyone whose pension fund bought the wrong tranche of CDOs. Not to mention property developers, and workers in construction industries that support it, assuming the house price fall is generalised.

People _least_ likely to be positively affected by a house price crash include people that don't have houses, the majority of whom face considerably more difficulty and up-front expense in obtaining a mortgage in an environment of falling or unstable property prices.

Sure, there are some beneficiaries from a house price crash, just like some people make money shorting a failing company. That doesn't mean there isn't a deadweight loss, and if your conception of people who are "most vulnerable" to property prices prioritizes the welfare of those with no significant exposure to property but plenty of liquid funds and a long term investment horizon, it's a very strange conception.

Much of the world is still suffering from the after-effects of a major house price crash in the US several years later; I'm genuinely quite saddened that some people are so adamant the effects of that must have been "zero sum" they feel obliged to reach for the downvote button when HN commenters have the temerity to suggest otherwise.

</comment></comment></comment></comment></comment></comment><comment><USER15> A couple of things are worth mentioning. Firstly, everything but housing is much cheaper now than in the 80s/90s. People will spend their money somewhere. The ability to do your own repairs is also much greater, as the huge (and cheap!) hardware stores have sprung up and the DIY culture has become stronger.

Secondly, I don't know about the UK, but here in Australia, home loans in the 80s had interest rates of almost 20%, as opposed to 5-6% today. It had calmed a little in the 90s though. The cost in dollar terms was much cheaper, sure, but it was still difficult to service at the time. Buying a house was still monumentally stressful. I know a few boomers who were unable to maintain their mortgages in that time.

Just because the sticker price was significantly smaller doesn't mean that it was all that much easier.

Edit: it's also worth mentioning that the median wage in the UK has increased about 50% from 1990 to 2010 (~16k to ~24k) and the average wage more than that. Housing is still depressingly expensive, but the numbers aren't quite so wildly different as shown.

<comment><USER16> _here in Australia, home loans in the 80s had interest rates of almost 20%, as opposed to 5-6% today._

That's a pretty big exaggeration. Rates peaked at 17% in 1989, but were below 15% for most of the 80's[1].

[1] [http://www.loansense.com.au/historical- rates.html](http://www.loansense.com.au/historical-rates.html)

<comment><USER17> Individual loan products from lenders would have been slightly different to rate shown in the graph. So "almost 20%" isn't that far off.

<comment><USER16> I'm old enough to remember rates in the 80's (though not old enough to have had one!). And I have a loan now, and the rates almost exactly match the rates in that table.

Here's another reference: [http://www.abc.net.au/news/2007-08-08/the-reality- of-interes...](http://www.abc.net.au/news/2007-08-08/the-reality-of-interest- rates/2525330)

17% was as high as they got for mortgages.

<comment><USER15> Well, I guess my argument is completely blown out of the water because they peaked at 17% (I guess 17 is not near 20...) instead of 18-19%, and averaged around a couple of percentage points lower. Hardly a "pretty big exaggeration".

It doesn't change the fact that mortgages, _regardless of the percentage rate_ , were still not 'easy' back then. The smaller mortgages were not being paid off with today's rates and today's pay packets. They also had fewer flexibility features (things like redraw or offset accounts).

<comment><USER18> Yes, but in the period you state, when the average wage has risen by 50%, the average house price has risen by over 200%, and RPI has risen by 117%.

It's true that back then, the average monthly mortgage payment might have been similar, if not slightly more (adjusted for inflation). However, a lifetime fixed rate is unusual and they would have moved to lower rates when they came available.

Also back then, more people had a 'job for life', defined benefit pensions, and inflation-matching or beating pay rises without the risk of moving to a new company. One could be reasonably confident that if a mortgage was affordable now, it would continue to be so in the future. Nowadays, with stagnant wages, interest rates that can only go up, and the need to invest more into personal pension funds in order to mitigate the risk of retiring at a market low point.

</comment></comment></comment></comment></comment></comment><comment><USER19> I don't get it: she sold up and made a profit, but unless she downsized, the profit is gone on buying a new place.

<comment><USER20> If you get lucky and don't particularly care where you live, you don't necessarily have to downsize. London house prices are a lot higher than the rest of the country and have gone up a lot more. You could get a decent-sized house with a garden in most of the UK for what she sold her flat for.

<comment> UK-AL You could buy a McMansion in most of the UK for that price.

</comment></comment></comment><comment><USER21> I saw a startup tweeting yesterday about a shared investment.

The gist is that instead of investing in stocks and shares, you put your money into property and a shared structure gives you some % of the property in question. The startup actually owns the property, and there is some legal allocation of your portion, and they offer the means to exit your share of a property without the property itself needing to be sold... your share just gets sold to the next investor.

As a startup I can see this working, as an investor I could see this working, as a resident in London I'm frankly appalled.

<comment><USER3> This has been around, if you buy the house under LLC, you can divvy up the equity whichever way you want it.

How's liquidity provided when there's no "next investor"?

</comment></comment><comment><USER22> Be nice to have got into the market early, many people over here in Australia get the benefit of negative gearing too as they accumulate more houses.

I'd particularly be worried as a young person in the States now, a hefty mortgage on top of some of the student loans I've seen look like it'd spell an entire lifetime of loan repayments.

</comment><comment><USER23> > A person holding a land in the city for 25 years didn't make anything new

Of course they did. When they took out their mortgage, none of that 'money' existed. They had to participate in the creation of wealth in order to pay back mortgage + interest.

I've finally paid-off my mortgage. If someone has a more 'productive' use for my land and building, they are welcome to make me a financial offer.</comment>


Ask HN: How Not to Talk to a Programmer? - <AUTHOR> Share your best stories/anecdotes. <comment><AUTHOR> Once a "business" person contacted me under a pretence he was interested into an open-source devtool project I am working on.

It turned out to be false, as he was only interested into hiring me for his new startup idea - for which he spent 30 minutes explaining it to me first.

At the end he tried to convince me to abandon my project because no dev would use it (although he has no knowledge of the topic).</comment>