The fight to 'free' the Aboriginal flag - <AUTHOR> https://www.bbc.com/news/world-australia-49315063 <comment><USER2> Its ironic that a flag designed to support a land rights movement ends up in a situation where the indigenous peoples are fighting for the rights to it. Is there some deeper reason behind why the designer of the flag would claim copyright and try and make money off the flag - maybe to prevent some other sort of exploitation? Otherwise that seems like a pretty greedy and directly hypocritical thing to do.

<comment><USER3> Looks like just greed.

<comment><USER4> I don't think it's fair to say this is solely the result of the greed of the designer. It's much more nuanced than that.

</comment></comment></comment><comment><USER5> There is no good solution to this problem. Harold Thomas (an Indigenous Australian) designed this flag and asserts his moral rights over it. The Australian government designated it a national flag without consulting him. In the past there have been discussions about the government buying the rights to the flag, but have not proceeded. If Harold Thomas is the designer, he has the right to profit from his design as he sees fit - and the demands of extraordinarily rich companies like Google or the AFL demanding to use his design for free is disrespectful to all artists.

The Australian government thus has two choices:

A. Support Thomas's copyright claim, which allows him to lease those rights to private companies. If he wishes to sell to them for an agreed amount he can - but this hasn't happened in the past as the price is too high.

B. Reject his copyright claims, and take ownership of the flag on behalf of Indigenous Australian.

Under option A, Indigenous Australian's don't have the ability to use a flag they believe is "theirs". Under option B, the Government will be seen to be repeating history by ignoring indigenous rights to property (albeit intellectual property).

There is no easy solution, so people attack WAM clothing (who are just asserting their leased claims) because demanding that Harold Thomas give up his moral rights over the design is not an easy sell to people who are trying to respect Indigenous rights in general.

<comment><USER6> The government should make a one-off large payment and buy the rights. Of course the details could be complex, but it's a starting point.

<comment><USER4> I would expect that the for same government that destroyed indigenous families and culture to buy the rights to an indigenous symbol doesn't sit right with indigenous people.

</comment></comment></comment><comment><USER7> I'm surprised something that simple can be protected by copyright. But apparently it is: Wikipedia says so. (I wouldn't trust a BBC journalist to understand the difference between a copyright and a trade mark or even a patent.)

I wonder where the limit would be. If it had been just two coloured stripes, using standard flag colours, without the circle, would that be protected by copyright?</comment>


Lightspeed Summer Fellowship - <AUTHOR> http://lsvp.com/summer-fellowships/ Earn up to $45,000 this summer to build your startup at Lightspeed!
Are you an aspiring entrepreneur looking for more than an internship this summer? How about getting quality time with some of the investors behind companies like Nest, Snapchat, TaskRabbit and GrubHub? Follow in the footsteps of the founders of Pinterest, Pulse and Lark.  Lightspeed Venture Partners' is now accepting applications for its Summer Fellowship Program.
What exactly is Lightspeed's Fellowship Program?  Think of it like a scholarship - we provide resources, mentorship and guidance so you can spend your summer experiencing what it is like to build a company. Now in its 7th year, the program's alumni include over 150 fellows, including Ben Silbermann of Pinterest, and a number of successful founders of companies.
Each selected team will receive $5,000 per team and $10,000 per team member, mentoring from Lightspeed's partners, space at Lightspeed's office in Menlo Park, CA and additional resources to help you make connections and get started. Fellows are under no obligation to Lightspeed and we receive no equity as part of the program.
To see a short video about the program here: http://bit.ly/VXOsN4
Applications are due March 22, 2013.  For more information about the program, past participants and the application check out: http://lsvp.com/summer-fellowships/
-- Krish Parikh Lightspeed Venture Partners <comment><AUTHOR> Application deadline is March 22, 2013</comment>


Should I learn Scala or Erlang - <AUTHOR>

I am planning on learning a new language and both Scala and Erlang seem interesting but I am not sure which one I should pick. I would appreciate if someone who has had more experience with these languages could help me in making a decision. <comment><USER2> I've used both; erlang more. You really can't go wrong from a learning perspective with either choice. You would need to post more on the types of things you want to build in order to get further opinion.

</comment><comment><USER3> if you are used to procedural or object oriented programming, you may need to unlearn few coding styles before you can master a functional language.

2 better known apps built on erlang are ejabberd(jabber/XMPP server) and couchdb(a popular NoSQL datastore)

</comment><comment> b-man Sincerely, I advice Scheme. Perhaps PLT scheme using htdp.org or SICP.</comment>


1700 blogs for hackers - <AUTHOR> https://github.com/abdelhai/devblogs <comment><USER2> This is kind of crazy but I'm looking for this fascinating blog I found ages ago via HN. It was someone who was posting their father's diary online, as a blog -- he was an engineer and kept a diary, which was full of fascinating minutiae. Does that ring any bells for anyone? No worries if not, I'm finding this blog hook or by crook.

<comment><USER3> Was it the one where his father was a retired doctor or something like that and he, the son, just blogged the things his dad would say through out the day? Actually as I type this, I think it was a twitter account. Either way, it was hilarious. I'd love to find that again.

<comment><USER2> Not exactly -- his dad had died, and he was posting pages of his diary on a seperate blog to his, I think. His dad ( I think it was a father-son relationship) was a retired engineer, maybe something academic too. Thanks for the lead.

</comment></comment></comment><comment><USER4> Looks cool, but 1700! I can keep up with like 10 blogs. Which of these should I even _try_ to look at? These entries need some meta data. Like I don't care about a blog on Objective-C but I will read a SQL Server blog...

<comment><USER5> I think it's meant to be a collection to feed in to machine learning system? Maybe? Agree that the format isn't terribly human friendly....

<comment><USER6> Hmm creating metadata for this, with all the URLs already aggregated wouldnt actually be that bad.

</comment></comment></comment><comment><USER7> Would be great to just subscribe an RSS reader to these and see a single unified feed. Oh, wait.</comment>


Alleged leak of more than 5M Gmail accounts - <AUTHOR> https://isleaked.com/en.php <comment><USER2> Now is a good time to enable two-factor authentication on your accounts. Here is how to do so for some common services:

\- Google: [https://www.google.com/landing/2step/](https://www.google.com/landing/2step/)

\- Github: [https://github.com/settings/security](https://github.com/settings/security)

\- AWS: [http://aws.amazon.com/mfa/virtual_mfa_applications](http://aws.amazon.com/mfa/virtual_mfa_applications)

\- Facebook: [https://www.facebook.com/settings?tab=security](https://www.facebook.com/settings?tab=security)

\- Twitter: [https://twitter.com/settings/security](https://twitter.com/settings/security)

\- Dropbox: [https://www.dropbox.com/account/security](https://www.dropbox.com/account/security)

\- Lastpass: [http://helpdesk.lastpass.com/security-options/google- authent...](http://helpdesk.lastpass.com/security-options/google- authenticator/)

\- More: [https://twofactorauth.org/](https://twofactorauth.org/)

<comment><USER3> With two-factor authentication you are happily providing gmail with your phone number. They say they need this to send you a verification code when you log into your gmail account. Then they say:

"During sign-in, you can tell us not to ask for a code again on that particular computer."

Well, if that's the trick, they don't need your phone nr at all, they can do ip and os check anyways..

<comment><USER4> I'm not sure exactly what point you're trying to make, but you seem confused about how 2FA works.

The goal of 2FA/MFA is to make you demonstrate that you're in possession of two independent secrets (authentication factors). Once you've shown that, it's considered safe enough to replace the second secret (OTP sent to your phone or generated by your TOTP app like Google Authenticator) with a cookie (the check is not IP-based). Typically the cookie only lasts for 30 or 60 days.

If what you're concerned about is the idea that Google knows your phone number, you can use Google Authenticator or another TOTP app instead.

<comment><USER5> > If what you're concerned about is the idea that Google knows your phone > number, you can use Google Authenticator or another TOTP app instead.

I'm under the impression that you need to provide Google your phone number before being allowed to enable TOTP.

<comment><USER6> TOTP algorithm is open, has RFC. Check Google Authenticator Wikipedia page for OSS clients.

I guess phone number is needed for the secure reset. In the case you lose the device this would render your account inaccessible.

<comment><USER5> I do have an OSS client, but the very first step to enable Gmail's 2FA is to give your phone number.

I agree that there are good reasons for asking that, but the comment above apparently raises a good point, namely, that you apparently cannot enable 2FA without giving Google your phone number.

</comment></comment></comment></comment></comment></comment><comment><USER7> Links to zip archive with plain email list (without passwords):

[https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4...](https://mega.co.nz/#!ewU1wCKA!P52rdL5tMcugRxi8ALyZlGnfE_KSB4pERGIJjsPsyCQ)

Alternative: [http://rghost.net/57937836](http://rghost.net/57937836)

The thing is that this site mentions other site where in comments section you can find links to 7zip archive with emails

<comment><USER8> OK, my address was in there. I've changed my password. But, how do I know if they actually had my correct password? Shit this is scary...

<comment><USER9> Assuming hacker did sign in into your Gmail , you might be able to get that information from the list of last logins in your Gmail account. Any IP that's out of your normal location would reveal that. More in this link [https://support.google.com/mail/answer/45938?hl=en](https://support.google.com/mail/answer/45938?hl=en)

<comment><USER8> Yeah, this is an account that only forwards emails, so I almost never log in. However, when I changed my password now I logged in and out a bunch of times. This made this very short list of recently logged locations only contain one line that was not from today. Hmm. Would be better if they showed 50 recent logins or something...

</comment></comment></comment></comment><comment><USER10> Every time something like this is posted, where there is a site to check if your email address is in some leaked list, I really wish they'd just tell me how to get the list itself. Instead, they ask me to trust that they will not use my email address, and I have to hope that they won't leak it.

I generally don't bother, because it's just more security risks.

<comment><USER11> Exactly. just show me the list and let me do a command+f. I'm not trying to enter my email into their system.

<comment><USER12> Are you being serious? Next time you search google, would you rather they display 5,000,000 results on one page and you Ctrl+F the response?

<comment><USER13> If the local client could handle it, this would be a _much_ more secure way of browsing.

<comment><USER14> i sure hope you are beeing sarcastic, if not, consider this: it is possible to use javascript to override ctrl+f or other keystrokes. if that site would have displayed the list, and someone used ctrl+f on it, they could have simply used such a technique to add your input to the list to generate positive findings on the fly.

[http://arstechnica.com/security/2012/12/how-script- kiddies-c...](http://arstechnica.com/security/2012/12/how-script-kiddies-can- hijack-your-browser-to-steal-your-password/)

</comment></comment></comment></comment></comment><comment><USER15> Weird, it gives me a very old password.

Though back when I had that password my account _was_ hacked. I'd wager this is just Gmail address+password combos collected from other leaks (read: not from Google). Really this just seems to be an attempt at sensationalizing.

<comment><USER16> Me too. It gives the first two letters of a pw that I have used in the past but as far as I'm aware, not on that account. This raises all kinds of questions...

Edit: it does the same on a much older account that I rarely use, too. Not the current password but the first two letters of what is likely a much older pw.

</comment></comment><comment><USER17> For me, it has a password I don't ever recall using with gmail. If I have, I don't think it's been in the past few years.

That said, it's my throwaway password I use on services I'm not particularly worried about. I fear that this isn't a gmail leak but instead a different service.

<comment><USER18> but matched up with your email... and many people don't have throwaways

</comment></comment><comment><USER19> If you search for the character '+' in the list of e-mails you can get an idea where the mails leaked from. It seems to me like this is a collection of databases scraped from different sources as others have suggested.

For Gmail users, it's a good practice to register to websites using firstname.lastname@example.com (e.g. firstname.lastname@example.com), that way you'll know who leaked your data when it appears in lists like this or when you get spam. Gmail ignores the plus character and anything that follows the plus. You can also add dots at arbitrary positions in the username part.

<comment><USER20> Going with your suggestion, the amount of DBs must be huge. The most prominent additions after the + sign (ignoring just single numbers) are:

\- Bioware (54)

\- Bravenet (19)

\- Bryce/daz3d/daz (244)

\- Eharmony (64)

\- Filedropper/fd/etc. (113)

\- Freebie/Freebiejeebies (64)

\- Friendster (65)

\- Hon (42)

\- Policeauctions (28)

\- Savage/Savage2 (116)

\- Xtube/porn (200ish)

</comment></comment><comment><USER21> It's suggesting a password that I do use on some sites, but never have on Gmail. I think this is a scraped database from somewhere else...

<comment><USER22> Same for me.

</comment></comment><comment><USER23> I can tell from the first 2 characters that the leaked password associated with my email address was scraped from Pizza Hut Australia's online ordering system (they only recently implemented SSL on the login page).

It's interesting that I setup a particular password for that service when I noticed it didn't use SSL. Make's me wonder how many databases this comes from. It certainly isn't Google's.

<comment><USER24> Out of interest, do you know from your data as to when your Pizza Hut Australia account could have been compromised? Was it a plus addressing firstname.lastname@example.com type email address?

Would be interested to know more about this. I'm @junto on Twitter if you don't mind contacting me. It would be appreciated.

<comment><USER23> Hi, No I assume that the breach happened in the last 3 years, and before they implemented SSL. I have noticed that [http://www.pizzahut.com.au/members/login](http://www.pizzahut.com.au/members/login) is still a valid page, inaccessible via SSL, but haven't checked if logging in on that page actually works.

I noticed that they've also implemented a password reset email, instead of their previous practice of just emailing you the password. Hopefully this means that they are no longer keeping unhashed passwords on the system.

It seems that they realised they weren't doing things correctly in the last 6 months (maybe a bit longer, not 100% sure) and have taken steps to rectify this. This _may_ be due to a discovered security breach, but may just be a change in their internal IT policy. Hopefully they're now following best practices!

</comment></comment></comment><comment><USER25> It isn't the actual Gmail passwords that are leaked. One of my accounts is there, but the password is one I have used on other sites, never on the actual Gmail account.

<comment><USER26> Can you disclose which site?

<comment><USER25> Can't be sure, it's a "garbage sites" password which I've used too many times on untrusted sites. Any one of those sites could have been hacked, or had been a phishing gateway itself.

Of course what I did was bad practice. One should store passwords in a secure password manager, and use a different (preferably 30+ chars) password on each site.

<comment><USER27> My present "garbage site" practice is to pop open a session to mailinator.com to a randomly generated box name.

Mailinator will give an alternate address that's a hash of the first, so that the address itself cannot be used to check. See below.

I'll create a set of long passwords (20-30 characters) with pwgen. Those are input as name, email, and password fields (different for each). If I need to verify an email, I can.

I don't record the values, they're throwaway.

If the site rejects 'mailinator.com', there are other domains provided as alternates.

Example: email@example.com is also

        firstname.lastname@example.com
        email@example.com
        firstname.lastname@example.com

(or m8r-ds4te4 at the other domains)

The 'm8r' address can't be used to check for mail.

Note, obviously, that anyone with the actual mailbox hash can check it. For example: [http://mailinator.com/inbox.jsp?to=facebook](http://mailinator.com/inbox.jsp?to=facebook)

Oh, there's even an RSS mailbox subscription, neat: [http://www.mailinator.com/feed?to=](http://www.mailinator.com/feed?to=)

</comment></comment></comment></comment><comment><USER28> A summary about phishing:

        1. Found you password with the same email address somewhere
         and ask if you still use that email address on another site.
        2. And get your IP, then login through proxy to bypass the security checking.
        3. Still, to know which email address is in use.

If you just worry, change you password right now without using their service. :P It may be good that every a few months some guys remind you to change passwords.

<comment><USER29> Exactly what proxy would allow to appear to be using my IP address?

<comment><USER30> For many security checks, a proxy in the same country would be sufficient. They might only check if you log in from Asia and America at the same time.

</comment></comment></comment><comment><USER31> I just checked using a bunch of throwaway email accounts I had to sign up for various promotions. One of them was leaked - and one of them had a very old password associated with it.

I now use KeePass2 to manage all my passwords - so the old password has absolutely nothing to do with the new one. This makes me think that they simply tried to use some other hacked site, and checked to see whether the same pwd was recycled for gmail.

</comment><comment><USER32> The full list was leaked, my email was on it but I've never used that password for an email account in my life. It's my throwaway "I don't trust this website" password. I use it for a reason!

</comment><comment><USER33> On August 20 an address of mine was entered and my Origin account was subsequently compromised. Looks like this leak matches the creds that account had before I reacted. Happily enough it was a low equity account, I had 2FA and nothing else seems to have been grabbed.

Edit: to clarify, I had 2FA on an account which alerted me to the Gmail compromise. I obviously messed up with that email account.

</comment><comment><USER34> It says mine is in it but suggests the wrong password. I don't think I even had a password with those letters plus I've had 2FA for a while now. Wonder how legit this is.

</comment><comment><USER35> I used the wildcard and mine is not in it.

So I don't think this is a hack of google itself, but rather just collecting addresses from elsewhere and collecting the gmail ones.

</comment><comment><USER36> Tried it with mine and it said yes but had the password wrong. It didn't match a password I've ever used...

</comment><comment><USER37> The problem with 2FA for me is that I am underground for a good part of my day, without reception.

I use google voice to get notified of calls and voicemails so I can be fairly responsive, but obviously using another service that can be accessed in multiple places defeats the point, especially when owned by the same people.

<comment><USER38> You don't need reception for 2FA; Google Authenticator and FreeOTP work fine even in airplane mode, if you have your phone / tablet with you.

<comment><USER37> Yeah, good luck on a windows phone.

<comment><USER39> Microsoft Authenticator works just fine with GMail :)

<comment><USER37> Confirmed! Though I had to go outside to get the initial pass code via SMS.

It does not seem like twitter supports this authenticator.

</comment></comment></comment></comment></comment><comment><USER40> My email is on there, but the password is not the one I'm currently using. Though I wonder which site or sites I've been using this password on. Has anyone figured it out? I'm going to crosscheck with my saved passwords list in Firefox when I get home.

</comment><comment><USER41> I tried it and it gave me a year old password. I am guessing they only got a hold of old passwords.

</comment><comment><USER42> My Gmail was hacked a few years ago. This database showed the first two letters of the password I had at the time.

I had (stupidly) been using the same password on other sites, so after I was hacked i made a new password just for gmail.

Now I also have two factor authentication :)

</comment><comment><USER43> It has a password for another site but not gmail.

Not sure which, but it isn't gmail.

</comment><comment><USER44> The passwords seem to have come from somewhere else. My email is on the list, but the password is wrong and actually matches the one I use for throwaway accounts.

<comment><USER45> There seem to be enough people reporting this to do some correlation and figure out what was really compromised.

</comment></comment><comment><USER46> This leak is more likely a result of phishing attacks. So, if you have been (and still are) careful enough, your email should not be on that list.

</comment><comment><USER47> It says mine is leaked too. But the two first digits of my password it gives me are not relevant with my password. What does this mean?

</comment><comment><USER48> I don't think this is leaked from Google. Probably people just were using the same password for some other service...

</comment><comment><USER49> My account was compromised a couple months ago. Google detected a series of logins from Poland, Lithuania and Oregon (probably botnets, which I think it rejected) and sent me a warning.

I expected my address to be there but it wasn't. Makes me wonder.

</comment><comment><USER50> So my wife's is in there but the password it gives is from over a year ago.

</comment><comment><USER51> Where the passwords at? Would make a good common passwords list for security testing.

EDIT: Not seeing the password list online, and below someone mentioned it showed an old password for them, so thinking someone is making this up.

</comment><comment><USER52> Interesting, the password associated to a secondary Gmail account of mine turned out to be not for Gmail login but for a Friendster.com account from years back that used it as user ID.

</comment><comment><USER53> My older account (8+ years) was leaked but my more recent one (4+ years) was not.

EDIT: This was good to find out because I did not have 2 factor auth on my older account as I hardly use it anymore.

</comment><comment><USER29> I found my email there, but the first two letters are of a password that I have never used with gmail (it is a disposable password i use for uniportant sites)

</comment><comment><USER54> I was on the list and now I got a Facebook password reset code to my phone, without asking for one. Someone already seems to be trying to use the passwords.

</comment><comment><USER55> My email address was there but "your first two symbols" listed there was wrong. Is that first two symbols hash of my password?

<comment><USER56> Based on the two letters of mine, I have a feeling that it's from a BB forum crawl or similar.

</comment></comment><comment><USER57> Two-factor authentication looks more appealing then ever. But first go to www.gmailleak.com make sure your account was not compromised.

</comment><comment><USER58> I just tried it with an old account. It correctly gave out the first two letters of existing password

Luckily, 2FA was already enabled.

</comment><comment><USER59> It has passwords collected from other sites, at least from heroesofnewerth.com

That's one more example against password reusing.

</comment><comment><USER60> Interestingly enough firstname.lastname@example.com is an email address.....grepping the email list txt file is ahhhmazing

</comment><comment><USER48> Quite a few of the leaked accounts also appear to be using SoundCloud. Could this be related?

</comment><comment><USER61> Sites should stop storing plain text password

</comment><comment><USER62> can anyone talk about how this site works and where they get the list of leaked email address from ?

</comment><comment><USER63> grep admin google_5000000.txt -c 1019

 _sigh_

</comment><comment><USER64> checked the plain text list against against 20 of my contacts, and nothing matched

</comment><comment><USER65> Site is down right now :(

</comment><comment><USER66> It's nowhere near advisable for anyone to submit their address to that box.

Notwithstanding the questionable reliability of this what is meant by "leaked"? a trove of phished credentials does not really qualify as a "leak".

<comment><USER67> I just tried it with my old Gmail account that I no longer use, and it displayed the first two letters of my password. The password was random letters and numbers, 16 characters, so not easily guessable. Seems legit to me :-)</comment></comment>


Strange VC Enquiry. Anyone else had one? - <AUTHOR>

Hi there
I received an email enquiry from a venture capital firm, which reads as follows:
"Hi Adrian,
My colleague, ######## is interested in SourceGuardian.com and would like to have a quick call to learn about the company and discuss the possibility of OpenView Venture Partners making a future investment in the company.
Do you have time for a brief call? Please let me know a couple of times that work well for your schedule."
I've never heard of them and a quick web search shows that they're based in Boston, have made investments, but a few results also show that it appears they've been sending out these emails in bulk.  Has anyone else had one of these or know anything about the firm?  Investment, or actually selling SourceGuardian, is something I've been thinking of, however I'm unsure whether OpenView Partners are the people I should be speaking with.
If anyone has any knowledge of them, please share
Thanks
Ade <comment><USER2> This might help you:

[http://thefunded.com/funds/show/OpenView+Venture+Partners?vi...](http://thefunded.com/funds/show/OpenView+Venture+Partners?view=search)

</comment><comment><USER3> Google Alerts are a VC's best friend?</comment>


Einstein Discovered Dark Energy, Says Historian of Science - <AUTHOR> http://www.technologyreview.com/view/508131/einstein-discovered-dark-energy-says-historian-of-science/ <comment><USER2> No. Einstein's reason for proposing a repulsive force (to balance an apparently static universe against gravitational collapse) had nothing to do with observation, wouldn't have produced the result he believed at the time (as any number of physics students will tell you), and was later abandoned by Einstein as "My greatest blunder."

To give Einstein credit for dark energy is a perversion of logic. Einstein's cosmological constant was meant to stabilize the unstable universe his GR equations predicted, whereas dark energy destabilizes the dynamic but predictable universe modeled by the Big Bang theory.</comment>


Ask HN:  Why not use technology to find people to talk to at a conference? - <AUTHOR>

The point of conferences is not so much to attend talks but rather to network with people in the field.
In reality, you may end up walking around aimlessly not knowing whom to talk to.
And when you do start up a conversation, there is too much introductory material.  The repetition in terms of questions and answers can get annoying pretty quickly.
So why not solve this problem using technology?
Specifically, why not have an iPhone app that lets you find people in the conference room who share your interests?  It would help you locate them in the room, learn more about them, determine the probability that they will want to talk to you, give an estimate of likely conversation duration, extent of potential mutual financial benefits, etc.
Why waste your time talking to the wrong people (or not talking at all) at a conference? <comment><USER2> When I'm at a conference, I prefer finding people with entirely different sets of interests. This gives me the opportunity to potentially learn something new and maybe even find out about a field I didn't previously know about.

This idea sounds interesting. I'd like to see where it could go if you built it online and let people use it while not at conferences; keep a virtual "hallway track" online at all times.

<comment><AUTHOR> You could use technology to find people with entirely different sets of interests as well at a conference.

The point is, this would be better than aimlessly walking around trying to find someone to talk to.

</comment></comment><comment><USER3> I'm in town for a conference which starts tomorrow. I was planning on seeing the talks that sound interesting, and then talking to the speakers, or other people who thought that same talk would be interesting.

I agree with you that I'm not here _for_ the talks, but everyone still goes to them (at least the marine-ecologists at the conference with me), so I won't have anyone to meet while there's a talk going on, anyways. Go to the talks, and see who goes to the same sessions that you do!

</comment><comment><USER4> This sounds remarkably like what Twitter gets used for during major conferences. I know its what I used it for during WWDC, at least.</comment>


The Steve Jobs Issue: Do Shareholders Have A Right To Facts About A CEO's Health?  - <AUTHOR> http://clusterstock.alleyinsider.com/2009/2/the-steve-jobs-issue-do-shareholders-have-a-right-to-facts-about-a-ceos-health

<comment><USER2> Yes. When the perceived value of Apple stock is so tied to Steve Jobs, the company must disclose it to potential and actual investors. It is not a privacy issue. If it turns out he needs a liver transplant, many people, who might not have invested, may loose money, and Apple will be open to lawsuits.

</comment><comment><USER3> How about letting the Board decide whether or not its a Shareholder issue? Isn't that partially the responsibility of the board to determine what is or isn't a share holder issue?</comment>


The Egg – Short Story by Andy Weir - <AUTHOR> http://www.galactanet.com/oneoff/theegg_mod.html

<comment><USER2> Profound.</comment>


Forgotten your password? Google can find it for you. Unfortunately. - <AUTHOR> http://blogs.guardian.co.uk/technology/2007/11/23/forgotten_your_password_google_can_find_it_for_you_unfortunately.html

<comment><USER2> Who voted this thing out of the crib? If you find this article to be fascinating or new, then I hope to god you're not designing any systems I use...

<comment><USER3> Before I read the article, I thought you were being a jerk... then I read the article.

</comment></comment><comment><USER4> I didn't really read the article, but the title gave me another idea:

Type your (potential or existing) password into Google. If you get _any_ hits, it's not a good password.

Of course there are exceptions, and just because Google doesn't get any hits doesn't mean it definitely is a good password. But it seems like a decent measure of password security.

</comment><comment><USER5> Salt.</comment>


What's coming in Go 1.12 [slides] - <AUTHOR> https://blog.myitcv.io/gopherjs_examples_sites/present/?url=https://raw.githubusercontent.com/mvdan/talks/master/2018/go1.12-pre.slide&hideAddressBar=true <comment><USER2> How many Go versions is it going to take for that slide viewer to work on mobile?

<comment><USER3> Swipe left to advance a slide. Swipe right to go back.

<comment><USER4> That's not the problem.

The problem is I can only see about 50% of the slide, and pinch-to-zoom doesn't work.

<comment><USER3> It's fine in landscape

</comment></comment></comment></comment><comment> ainar-g Direct link to the _draft_ release notes: [https://tip.golang.org/doc/go1.12](https://tip.golang.org/doc/go1.12).

<comment><USER5> Looks like a very minor release. No changes to the language spec and the changes to the standard library are all marked "minor". The most significant thing is the deprecation of `godoc`'s command-line features in favor of `go doc` (maybe someone with more info could explain the difference between the tools or the rationale for having two similarly named tools and why the CLI features are moving from one and into the other?).

<comment><USER6> Changes to the language spec? It's 1.11->1.12, not 1.11->2.0.

<comment><USER5> It looks like you're trying to point out an inconsistency with my post, but I'm not seeing it. My observation, "No changes to the language spec" is entirely consistent with my claim, "a very minor release" and your observation, "It's 1.11->1.12, not 1.11->2.0".

<comment><USER6> It's _literally_ a minor release. That's what an increment in the numbers on the right of the decimal point means.

<comment><USER5> Is this a bad attempt at pedantry? "Minor" WRT version numbers doesn't mean "boring" or "insignificant". Go introduced modules in a minor version, for example. Other minor versions cut GC pause times considerably. Others improved compile times a bunch. It's pretty clear that the aforementioned changes are all more significant/interesting than anything in 1.12.

</comment></comment></comment></comment></comment></comment><comment><USER7> TLS 1.3 support, strangely omitted from these slides: [https://github.com/golang/go/issues/9671](https://github.com/golang/go/issues/9671)

<comment><USER8> I find it curious they implemented it themselves instead of using a standard library like OpenSSL/LibreSSL.

<comment><USER9> They implement everything themselves, in part so you can build truly static libraries without paying the _significant_ cgo tax.

The biggest thing they implemented themselves is effectively their own linux libc (including dns and networking stack).

This results in wonderful bugs like them not having a working POSIX Setuid [0] because that's implemented correctly in libc, not the linux syscall of the same name. This release also contains the UserHomeDir function which is another example where they didn't use libc and thus implemented it incorrectly.

You have to justify using any outside libraries in the go stdlib because right now there are no required external dependencies, so adding one is a very high bar indeed.

[0]: [https://github.com/golang/go/issues/1435](https://github.com/golang/go/issues/1435)

</comment></comment></comment><comment><USER10> runtime: non-cooperative goroutine preemption github.com/golang/go/issues/24543

HUGE deal for large companies Possible for certain code patterns to bully the runtime Redesign the runtime to remove those edge cases

wow.

</comment><comment><USER11> Doesn't work on mobile

</comment><comment><USER12> This site is horrible on mobile. Probably the worst I have ever seen. Totally unusable.

<comment> ainar-g Plain text version here: [https://raw.githubusercontent.com/mvdan/talks/master/2018/go...](https://raw.githubusercontent.com/mvdan/talks/master/2018/go1.12-pre.slide).

Also, it is an issue: [https://github.com/golang/go/issues/27026](https://github.com/golang/go/issues/27026). Marked as "help wanted".

<comment><USER13> The issue isn't describing what I see on Android. It's chopped off on the left and I can't zoom out. Not usable at all. As mentioned elsewhere, forcing the desktop view is better.

<comment><USER14> Forcing the desktop view is still pretty unusable on iOS Safari for me.

<comment><USER13> Forcing desktop "works" in portrait mode on my Android, but the text is pretty small. Landscape is cut off.

Interesting though, that iOS Safari is borked too. Did they just take wild guesses on the mobile css and hope for the best?

</comment></comment></comment></comment></comment><comment><USER15> Is the GOPATH bullshit gone already?

<comment><USER16> [https://github.com/golang/go/wiki/Modules](https://github.com/golang/go/wiki/Modules)

</comment></comment><comment><USER15> Completely unreadable on a phone. And the entire thing is 3 slides, from which the first one is the title and the last one are the credits and links.</comment>


The Thing - <AUTHOR> https://en.wikipedia.org/wiki/The_Thing_(listening_device) <comment><USER2> Soviets attempted to repeat this in the 80s when passive eavesdropping devices were embedded into concrete slabs and columns used in a construction of new US embassy and supplied by local contractors [1].

From what I remember the case lingered well into Perestroika period when complete documentation on this project was passed to the Americans as a gesture of "goodwill and friendship", presumably in exchange for chicken leg imports (aka "Bush legs") and other Western luxuries.

[1] [https://www.nytimes.com/1988/11/15/world/the-bugged- embassy-...](https://www.nytimes.com/1988/11/15/world/the-bugged-embassy-case- what-went-wrong.html)

<comment><USER3> Once on an international flight, I overheard some construction workers describe how the US government must fly in US citizenship-holding personnel and US sourced materials in construction of certain foreign projects for security reasons. Does anyone know more about this?

<comment><USER4> I worked on a software project that was targeted at the federal government and required all programmers to be US citizens. It didn't require us to have special security training or anything, though; and there was a different project that required programmers to leave their cell phones in lockers during the day.

I'm convinced that the government doesn't believe citizens are any more loyal or hard to bribe than other people, but insisting on citizenship would make it easier to charge us with particular crimes if the need arose.

<comment><USER5> >I'm convinced that the government doesn't believe citizens are any more loyal or hard to bribe than other people

Seriously? While they have to plan for an inside threat, do you really think that they don't view their own citizens as being more reliable than foreign nationals?

<comment><USER6> You're not looking at a random subset but at a self selected group. It's entirely likely they consider "10 US born volunteers" as much a threat as "10 global volunteers".

</comment></comment></comment></comment></comment><comment><USER7> If you are a high ranking government official and receive a gift that you want to keep in your office, then make a replica, and put _that_ on your wall instead.

<comment><USER8> And lose the opportunity to do a counter-intelligence move on your part? No way. Better analyze the shit of those "gifts", hope they are bugged and then use them to feed false information while you keep your real intelligence room free of anything.

<comment><USER9> Yep. Intelligence is all about keeping the other side in the dark while looking like you're in the dark.

</comment></comment></comment><comment><USER10> The creator is interesting:

[https://en.wikipedia.org/wiki/Léon_Theremin](https://en.wikipedia.org/wiki/Léon_Theremin)

And his most famous creation:

[https://en.wikipedia.org/wiki/Theremin](https://en.wikipedia.org/wiki/Theremin)

<comment><USER11> Interesting? Wikipedia article doesn't even get close. There are various accounts of his life and achievements, memoirs of witnesses, people who knew him in various contexts, the descendants/family, records of his own recollections -- all available on Internet. Unfortunately, most of it is in Russian. Reading it gives you that messy, undefinable feeling of experiencing a genius.

<comment><USER10> > Unfortunately, most of it is in Russian.

You can still post the links that are most interesting to you, please, the google translate service is quite usable.

<comment><USER11> See, for example, [https://statehistory.ru/1038/Lev- Termen/](https://statehistory.ru/1038/Lev-Termen/)

More links are at the bottom.

</comment></comment></comment></comment><comment><USER12> I'm currently reading "Spycatcher" by Peter Wright, I would recommend if you're interested in topics like this.

<comment><USER13> It is fascinating. People often disregard the book because its main thesis, the identity of a mole within MI5, appears to be misguided in light of post- Cold War knowledge. But there's more to the book than Wright's speculations -- it's his direct experiences with things like analyzing The Thing that make the book worth reading.

<comment><USER14> Also, in the same vein, I highly recommend R.V. Jones' 'Most Secret War' on his experience as Chief Boffin in the UK during WWII.

Chapter after chapter devoted to figuring out what the Germans were up to on the technology front, then one-upping them. Lots of engineering porn.

<comment><USER15> "The Ministry of Ungentlemanly Warfare: Churchill's Mavericks" by Giles Milton describes a lot of the equipment that SOE developed - e.g. the original limpet mine depending on condoms and boiled sweets and, of course, developed in someone's shed and tested at the local swimming pool.

</comment></comment></comment></comment><comment><USER16> Lev Termen is a legend. His work and inventions (as a young engineer; under Ioffe; in prison, etc) shows a huge breadth. Such coupling of talent in physics and engineering has always been rare.

</comment><comment><USER17> For a moment I was so excited. I thought my favorite road trip oddity made it to HN.

[https://en.wikipedia.org/wiki/The_Thing_(roadside_attraction...](https://en.wikipedia.org/wiki/The_Thing_\(roadside_attraction\))

<comment> 0-_-0 I expected the movie:

[https://en.wikipedia.org/wiki/The_Thing_(1982_film)](https://en.wikipedia.org/wiki/The_Thing_\(1982_film\))

</comment></comment><comment><USER3> I always wonder why open source mass surveillance isn't in fuller swing. Imagine a Kickstarter for $2 credit card-sized disposable listening devices which can mesh network for autocorrelated quality-enhancing signal reconstruction and 3d localization. They could be hidden behind objects and hard to detect. With a cellularly connected golf ball-sized gateway, they could egress data or receive updates. At this price point, there would be even less harbor from clandestine listening.

<comment><USER18> Why bother with dedicated hardware when most adults carry around a general- purpose device with a microphone, an internet connection, and some vulnerable software that can do the work for you?

<comment><USER3> More entry vectors means more coverage, and physical security is often nonexistent while phones come with at least base levels of protection and isolation.

</comment></comment></comment><comment><USER19> Maybe someday the Soviet side of things will be declassified, and we can read the technical account from that end. Would be interesting.

There seem to be some technical unknowns in the article. I don't think you can get FM back from the passive cavity, just AM, unless you can pump the cavity with feedback. Same goes for re-radiating at a harmonic. Maybe if the Q of the cavity were super high. Again, would be interesting to see the technical details of the receiving equipment.

<comment><USER8> There is nothing unknown in the article. You can do this at home as well. Is very well explained how it works. For start I would suggest you get technical of how Yagi antennas work, it's the same principle coupled with cavity resonator + membrane movement used in a microphone. In the end you get your high frequency beamed back modulated by the sound. And is not AM modulation, is FM modulation. But what article indeed lacks is the power required to get the device working properly. In my experience I would guess at least 1KW would've been beamed directly at the embassy walls when Soviets were doing their surveillance using this device.

<comment><USER20> I'm finding it hard to imagine no one noticed an intermittent 1kW at 330MHz from somewhere close.

<comment><USER8> Well, the article does say a radio-amateur stumbled upon it and alerted the embassy. So in the end someone did. Since Soviets did the surveillance on key moments, and not continuous, that's what enabled for device to remain undetected for so long

</comment></comment></comment></comment><comment><USER21> First stumpled upon this because it's mentioned in the slides of [https://idlewords.com/talks/our_comrade_the_electron.htm](https://idlewords.com/talks/our_comrade_the_electron.htm)

</comment><comment> gene-h I wonder if there are any uses for mechanically modulated retroreflectors today. NASA is investigating fully mechanical rovers for Venus because semiconductors do not work very well at Venusian temperatures while mechanical devices do[0]. To get data back from a fully mechanical device they propose to use retroreflectors. Although the bandwidth they can achieve with their approaches, using semaphore messaging with retroreflectors and looking at the doppler shift provided by spinning disks, is low. Perhaps by using a device like the thing they could transmit data at acoustic rates. I am also curious if there are more down to earth applications for devices like the thing other than espionage. [0][https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/201700...](https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/20170002798.pdf)

</comment><comment><USER22> It seems like with recent meta-material advances, you could create an object that was a hidden bug, without any hidden parts. Like if you tuned one of those metal concentric ring windchimes just right, it could modulate a radio signal based on acoustic vibrations.

</comment><comment><USER23> I'm guessing the hinge was added for the museum display right?

<comment><USER24> The pictures are of a replica.

<comment><USER23> You are right. This caption isn't shown unless you click on the image.

"Open view of a replica of a bugged US great seal on display at the National Cryptologic Museum in 2005."

</comment></comment></comment><comment><USER25> The description of the operation of this thing always seems incomplete. From the Wikipedia article:

>The length of the antenna and the dimensions of the cavity were engineered in order to make the re-broadcast signal a higher harmonic of the illuminating frequency.

That wouldn't actually work by itself. There would have to be some sort of non-linear element to cause the harmonics. Chances are there was something like a varactor in there. The original technical description probably omitted critical details because spooks are like that...

</comment><comment><USER26> Another interesting Thing: [https://en.wikipedia.org/wiki/Thing_(assembly)](https://en.wikipedia.org/wiki/Thing_\(assembly\))

</comment><comment><USER27> It isn't hard to imagine that the recent occurrence of mysterious illnesses at US and Canadian embassies (news.ycombinator.com/item?id=17891427) may be related to this. Perhaps they are activating or experimenting with some new type of device. Given that the Theremin type of device confounded detection for years we probably won't actually know for a while.

<comment><USER28> NYTimes says it was crickets.

[https://www.nytimes.com/2019/01/04/science/sonic-attack- cuba...](https://www.nytimes.com/2019/01/04/science/sonic-attack-cuba- crickets.html)

<comment><USER29> Or microwaves [https://www.nytimes.com/2018/09/01/science/sonic-attack- cuba...](https://www.nytimes.com/2018/09/01/science/sonic-attack-cuba- microwave.html)

</comment></comment></comment><comment><USER30> Yeah... theramin's bug. This is a great story! What a brilliant example of passively powered electronics from 75 years ago. Now it's all the rage to build this king of functionality into passive sensors, etc.

</comment><comment><USER31> > The device, a passive cavity resonator, became active only when a radio > signal of the correct frequency was sent to the device from an external > transmitter.

Super interesting, especially given this was early 1940s.

</comment><comment><USER32> How far can the receiver be from the thing to still get a good signal?

</comment><comment><USER33> Are there any good books on Communist science and innovations?

<comment><USER34> "Much has been written in the West on the history of the Soviet space program but few Westerners have read direct first-hand accounts of the men and women who were behind the many Russian accomplishments in exploring space. The memoirs of Academician Boris Chertok, translated from the original Russian, fills that gap."

[https://www.nasa.gov/connect/ebooks/rockets_people_vol1_deta...](https://www.nasa.gov/connect/ebooks/rockets_people_vol1_detail.html)

</comment></comment><comment><USER35> and now..just imagine what China has been listening to on all the cells sent out from their factories into our homes ;-) Privacy & Secrets are soo 2000.

<comment><USER36> Can't be worse than all the software manufactured in the US.

<comment><USER37> I think it's entirely sensible in this day and age to avoid electronic products from China, Russia or the US.

Back to Nokia, I guess.

<comment><USER38> Those are manufactured by Foxconn and running software by Google.

<comment><USER39> >running software by Google

My 1280 surely doesn't.

</comment></comment></comment></comment></comment><comment><USER40> How did it power itself for so many years to transmit?

<comment><USER41> That's the beauty of it - it works by passively modulating incoming radio frequencies, so it has no power supply. The power comes solely from the incoming radio energy.

</comment></comment><comment><USER42> related prior discussion/submissions:

[https://news.ycombinator.com/item?id=15498685](https://news.ycombinator.com/item?id=15498685)

[https://news.ycombinator.com/item?id=15272072](https://news.ycombinator.com/item?id=15272072)

[https://news.ycombinator.com/item?id=19854787](https://news.ycombinator.com/item?id=19854787)

[https://news.ycombinator.com/item?id=11771587](https://news.ycombinator.com/item?id=11771587)

<comment><USER43> Three of the four links here, have no discussion. One has hardly any. Posting interesting topics which have not received much prior discussion is encouraged here.

<comment><USER44> I didn't know it too. How do we define interesting though, given three of the four times it garnered no interest (do we keep on posting until it does)? I'm not sure if GP deserves downvotes for pointing them out at the least.

<comment><USER44> So a genuine question downvoted too? People are so reasonable here :).</comment></comment></comment></comment>


Finding an arbitrary file upload vulnerability in a filesharing script - <AUTHOR> https://0day.work/finding-an-arbitrary-file-upload-vulnerability-in-a-filesharing-script/ <comment> fake-name > I thought about a possible fix for a while, but in the end decided that the > quickest and easiest fix would be to adjust the regular expressio

..... WHAT?

Python has a suite of facilities _exactly_ for this very kind of problem.

Literally, the solution is "os.path.abspath(filename).startswith(os.path.abspath(dlfolder))"

This should, in all cases, return true if the filename is within the download folder directory, and false for any other case.

<comment><USER2> It doesn't do the right thing if dlfolder doesn't end with a slash.

</comment></comment><comment><USER2> So I was curious what translate_path does:

        def translate_path(self, path):
            """Translate a /-separated PATH to the local filename syntax.

            Components that mean special things to the local file system
            (e.g. drive or directory names) are ignored.  (XXX They should
            probably be diagnosed.)

            """
            # abandon query parameters
            path = path.split('?',1)[0]
            path = path.split('#',1)[0]
            path = posixpath.normpath(urllib.unquote(path))
            words = path.split('/')
            words = filter(None, words)
            path = os.getcwd()
            for word in words:
                drive, word = os.path.splitdrive(word)
                head, word = os.path.split(word)
                if word in (os.curdir, os.pardir): continue
                path = os.path.join(path, word)
            return path

That... that doesn't make any sense.

<comment><USER2> Oh, and thanks to urllib.unquote, I can disguise slashes as "%2f", so the tightened regexp doesn't help.

<comment><USER2> Never mind me, I misread how this function is used.

Apparently this code was copied from stdlib, including a different directory traversal bug on Windows:

[https://bugs.python.org/issue26657](https://bugs.python.org/issue26657)

</comment></comment></comment><comment><USER2> Apparently the upload directory is the same as the script directory, which is not good. If you upload a file named "cgi.py", it will be imported next time someone runs the script. No directory traversal needed to exploit this.

<comment><USER3> Hi,

I asssumed that the script would not be restarted, but you're totally right.

Thanks for the comment :)

</comment></comment><comment><USER4> [https://www.owasp.org/index.php/Unrestricted_File_Upload](https://www.owasp.org/index.php/Unrestricted_File_Upload)

</comment><comment><USER5> Nice find, I commented on your blog a method you can use to extend this vulnerability into RCE without admin interactivity.

<comment><USER6> >Upload a .py file to the untrusted directory that has the same name of one of the imports used in the Python script. It will be executed the next time Python is called by the script, so you don't need to wait for interactivity on the admins part

I have a feeling that only works on python2 because of absolute imports on python3.

<comment><USER7> Upload a script that replaces the old file source and wait for gunicorn or whatever to reload the app server.

<comment><USER3> The script seems to ship with a rundimentary webserver by default, so I don't see a reason to wrap gunicorn et al. around it?

However, you're right that overwriting the source is a possible attack vector.

</comment></comment></comment></comment><comment><USER8> This is hilarious -- I found this exact script and noted the exact same vulnerability last year. Good on you for posting about it.

<comment><USER3> Nice catch :)

I thought the the amount of forks and stars warrants a short writeup.</comment></comment>


Show HN: Quill – Messaging for teams that focus - <AUTHOR> https://quill.chat <comment><USER2> As somebody who is often said to be right in the age bracket who should like things like these, I think in most cases I'd prefer email over this.

This is why: friction is not _always_ a bad thing. Having to print out that mail twice before putting it into the envelope stops you from sending stupid stuff – it would just not be worth the effort, or you'd reconsider before you bring it to the mail. This means also friction saves you from reading a lot of unconsidered, badly worded and meaningless words, people would just easily write off their chest if it was frictionless.

The lack of friction in messengers is great for friends, family and loved ones – but I'd rather have work collegues either see me in person, call me, open a ticket or write me a nicely worded mail than chatting me up using a messenger at work. This is mostly due to the fact that many people can't keep messengers strictly work related. If you send five mails in a row because you always "forgot something", you look like an idiot. If you do the same in a messenger you will just come away as beeing casual. And the other side ends up having to filter through that mess. The energy you save by the lack of friction is payed by the other side.

<comment><USER3> I have a weird observation about the friction of e-mail. I think a high percentage of the friction comes from having to think up a subject. It seems that step, if required, forces some extra thought. It changes things a bit if you don't enforce subjects.

<comment><USER4> How do you need to think of a subject? You can just copy and paste the main part of an email or use an external reference (Jira issue name etc)

</comment></comment></comment><comment><USER5> Am I missing something here? It talks about focus but has an extremely busy UI with colors and icons in your face all the time. Maybe it's better to actually use it than see the screenshots?

<comment><AUTHOR> (I work at Quill.) Everything in Quill is a thread -- which is quite a big shift from an IRC-like firehose (even with _optional_ threading.) We've found the shift to have threading by default creates a behavior where you opt into _just_ the conversations you care about, and don't have to skim through hundreds of messages to find what's relevant (or, say, replies to an earlier conversation.)

May be hard to get across the _feel_ of using a product in screenshots -- we're ramping up our invites (making sure things scale + features work as expected!) but we'll be fully open quite soon! :) (and, we might be slightly partial to dense UIs!)

<comment><USER6> IRC is very different from teams. IRC is a public server and each channel could have 100s of members which leads to an unmanageable firehose.

Are you sure the same problem is also applicable to teams which are going to be much smaller than an irc channel and wouldn't be as busy as IRC? A private channel with a subset of team members wouldn't be the same as a public irc channel.

<comment><USER7> (I work at Quill). We've found threading to work really well with teams as small as 3. (2, probably not.) In professional contexts, conversations tend to be about specific topics -- someone posts a GitHub issue, bug report, feature discussion, etc, vs say a more social conversation that is less structured.

It's a way to keep track of the conversations you're having instead of a stream of consciousness (with multiple conversations interleaved) that is often times what people find in a channel. Once you shift to using threads, you sort of unlock a lot of things: revisiting old conversations via search, restarting conversations becomes trivial (all the context is right there!), managing your notifications (per conversation instead of per message now), quickly catching up on what you missed vs. sifting through hundreds of messages.

We're mostly solving for teams bigger than 3, but, we think it's really important that it does scale down to small teams.

<comment><USER8> > We've found threading to work really well with teams as small as 3. (2, > probably not.) I

For what it's worth, my company is (unfortunately) very chat-heavy, and I use threads in two person conversations fairly often. Sometimes conversations branch off of other conversations.

<comment><USER9> I'm pretty sure the GP was referring to total team size, not the number of participants in any particular conversation.

<comment><USER8> Sure, I'm not just talking about participants in a conversation either (with the possibility of a wider audience). Even in DMs, I use threads plenty. Sometimes someone asks multiple questions not realizing that they'll branch off significantly, and threads are a tidy way to address that. I don't see why habits relevant to a DM wouldn't generalize to teams of that size too (in which case you're always DMing).

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> I've been using this tool with a 10 person team and it's - _awesome_ -

I love the focus and clarity it brings to our work. And I am so glad to have a much better sense of peace while working at my computer than when I've used other tools for collaboration.

</comment><comment><USER11> Sorry to be _that guy_ but there are two big players in the chat industry, and this page does nothing to convince me that this product is superior. There are lots of smaller competitors, including Zulip and Twist, that already do what they claim to be their innovation. There's no product, just an "opportunity" to give your email to someone you've never heard of.

<comment><USER12> There were always big players in the Chat Industry, AOL, MSN, ICQ, Mig33, Yahoo Chat, GChat, Wave (oh the nostalgia), Hangouts, Skype, Lync and now there's Slack, Teams.

But communication is essential to humans so there'll always be space to do more, or doing more by doing less. I really welcome the competition in this space.

At first I loved slack, now I have a love/hate relationship with it. I'm sure I could easily be swayed with a more performant product focused on basics and good integration with other services.

</comment></comment><comment><USER13> I am, it seems, in the market for this. But...

I don't want to be alerted unless something is important and _urgent_. I was taught at college to use that distinction.[1]

Not seeing the word "urgent" in the copy on the front page made me think the authors don't appreciate this.

[1] [https://en.wikipedia.org/wiki/Time_management#The_Eisenhower...](https://en.wikipedia.org/wiki/Time_management#The_Eisenhower_Method)

At the risk of sounding like that bloke who wrote about how he wants to be playing offense, not defense, when it comes to communication, this is what I tell people I work with:

Important/Urgent: Call me or come find me

Important/Not Urgent: Tell me when we next talk, or email me

Unimportant/Urgent: Hover by my desk, or message me. If I'm not dealing with more important things, I might see it in time.

Unimportant/Not Urgent: Bring it up when we next see each other, or email me.

The only things I want making a noise and interrupting me is calls on my phone, the doorbell, my egg-timer and my smoke alarm.

<comment><AUTHOR> (I work at Quill.) Yes! That's exactly how we think about it. By default, @-mentions _will not_ notify you, and instead end up in your activity feed. And if something is truly urgent, we have priority notifications (!!-mentions) which will send a notification. (They have a higher cost, and make it very clear that it will cause disruption on the other end.)

We think of it as bringing the way people behave in person, online. If you have headphones on, working away, and I have a low priority question, I'll find you later. But if I just brought down prod, I urgently need to reach you :)

</comment></comment><comment><USER14> We - fully remote team - made the switch from Slack to Twist about 2 years ago and really like Twist. Anybody here that uses Quill and used Twist can share a bit more about how these two differ?

</comment><comment><USER15> It looks like Zulip with more stuff flashing around. Can anyone explain how it's different?

</comment><comment><USER16> I don't see a download link or anything, just an email-harvesting "notify me" box. (Please do correct me.)

Is it really a Show HN if you only have screenshots to show?

<comment><USER17> No, I would say this submission clearly breaks the rules[1].

Still, looks like an interesting, well-designed product, so kudos to that. Just not a good Show HN.

1: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

</comment></comment><comment><USER18> Early user here. This has been great. It is hard to overstate the difference it makes to not be bombarded by random messages with constant fear of missing out on important conversations.

</comment><comment><USER19> I'm a sucker for good design and your product looks quite sleek and beautiful, so if I was starting a company tomorrow, I might consider giving it a try. (As others mentioned, it does look a tad bit overwhelming).

What concerns me about whether Quill could succeed is: why would I choose this over Slack?

The whole 'threading' part could be accomplished via better onboarding and policy around Slack usage, and at the last startup I worked on, we were diligent about threading conversations on different topics already.

Is this a bet that tailoring the app around that 'threading' use-case and further encouraging its enforcement will be enough of a marginal improvement to take some market share, or is there more that's new here?

Also, what about those fun channels where you just chat and ramble with your colleagues about stuff outside of work hours? Would someone still need Slack for that, or would you have very large groups of DMs?

</comment><comment><USER20> So, a threads-only Slack. Or, old-time phpBB forums, but with non-sucking native apps. Or, Wordpress' P2 made for public.

Finally - I waited years for this :).

</comment><comment><USER21> On top of my own company's, I'm constantly signed in to 21 Slack workspaces mostly belonging to clients, and the endless notifications are starting to become a real problem, particularly when people use @channel or @here all the time. Add into that the Slack's notification sounds are some of the most grating noises to hit my ears since Skype's. If I'm concentrating on a complex task and Slack starts going off I come very close to throwing my laptop out the window.

In short, I hope you succeed in solving this.

<comment><USER22> Turn off sounds and notifications?

<comment><USER23> That can work for some slacks and some channels. But with others, not so much. When you're being paid to pay attention to client needs, there's only so much you can get away with.

<comment><USER24> But I guess if you're being paid to pay attention to client needs, then you're going to get interrupted, no matter what the technology you use.

<comment><USER23> But Slack still creates the expectation of immediacy in a way that other tools don't. Handling the same number of clients via email is a whole different experience. And Slack makes it very hard for people to filter out noise.

To my mind, Slack is to virtual work what open offices are to physical collaboration. They can be used well, but the default is a continuous drain on attention.

</comment></comment></comment></comment></comment><comment><USER25> Is this mac only? Are there plans for PC, Desktop, apps? The website /feels/ very mac-centric which is why I am assuming and that feels like a disastrous mistake if its the case.

<comment><AUTHOR> (I work at Quill.) We're on all platforms! Can't have a team chat app unless the entire team is able to use it :)

<comment><USER26> So is it safe to assume you're using electron, then?

<comment><USER27> Based on their job listing it looks like native apps for each platform: [https://quill.chat/jobs/](https://quill.chat/jobs/)

</comment></comment></comment></comment><comment><USER28> > Coming soon: End-to-end Encryption. Your most confidential conversations > belong to you, and just you.

Although this seems so be a good intention, I question:

do the regular conversations _not_ belong to yourself?

<comment><AUTHOR> (I work at Quill.) Of course! We take your privacy and security very seriously. Your regular conversations are absolutely yours -- your messages by default are encrypted in transit and at rest.

For user's that want extra security, we plan on offering e2e encryption for direct messages and groups (and maybe eventually channels). There are some tradeoffs with e2e encryption including scalability, search, history, and just the ergonomics of using it, which is why we call out that distinction specifically.

(But, we can see how current wording may be a but obtuse -- we'll tweak it.)

<comment><USER29> Do you have transit and at rest encryption now?

<comment><USER7> > Your regular conversations are absolutely yours -- your messages by default > are encrypted in transit and at rest.

(I work at Quill too). Yes, absolutely! That is just table stakes when it comes to security for your messaging experience.

</comment></comment></comment></comment><comment><USER30> Looks interesting! I'll echo some other comments about the visual noise. From what I can see, each person has their own color and it is stable across contexts. It's a curious design solution. There are certainly some things gained from this - some sort of visual familiarity of names. But it makes using color for other purposes a lot more difficult, and I'm not sure it's a worthy tradeoff.

I'm also really curious how you'll handle End-to-End Encryption. The only good alternative in this space is Keybase, and even their UX has some ways to go. Do you plan to use MLS?

</comment><comment><USER31> Are the all apps native?

</comment><comment><USER32> I consider Threads to be among Slack's worst features, so 'everything is a thread' sounds like a dealbreaker.

<comment><USER33> I think you're confusing the implementation of threads with the feature itself. Emails (and mailing lists), forums, reddit, HN, etc has shown us that threads are great. IMO they make discussions less ephemeral which is a good thing for slower communication methods. So hopefully the use of this tool is less "chatty" and less stream-of-consciousness.

<comment><USER32> I haven't used Quill, but judging from the screenshots, the implementation looks nearly identical to Slack's. So when they say "everything is a thread", it seems safe to assume they mean "we like Slack threads so much that we made our entire app behave like them". I'm not here arguing against the concept of nested reply structures in all cases.

</comment></comment></comment><comment><USER34> Awesome web UI!

</comment><comment><USER35> Will there be a RESTish API available? Or really any well-documented API.

Will Quill play nice with federated systems?

</comment><comment><USER36> super disappointing it was only in beta.

how will the API work for developers? Personally I think the attention Slack put into their API is the reason it is so popular and will continue to own the space until there is a competitor with their api/bot building abilities.

</comment><comment><USER37> I just want a modern Google Wave to come back ... it was killed so quickly :/

</comment><comment><USER38> Haven't used it but what I like from the features is that it combines Slack and Discord (with the voice rooms, that's currently (now that we are a forced remote company) a bit annoying that we have to use third party tools just to add this voice channel functionality to Slack.

</comment><comment><USER39> What makes it better than slack?

</comment><comment><USER40> Is this related to [https://quilljs.com](https://quilljs.com) ?

<comment><USER41> I was about to mention that, seems to be unrelated but uses a similar logo...

</comment></comment><comment> awinter-py is the topic modeling automatic? or are people labeling their conversations

</comment><comment><USER42> "We grew up with IRC"

So your protocols are open and anyone can write a client and view the server source code? You know, like the spirit of IRC and the open internet?

Or is it a bloated webkit "app", hosted on private servers?

<comment><USER43> I know in an ideal world developers would make their software free as in speech, but most of the time that translates to free as in beer, which means getting paid nothing. Paid proprietary services don't meet ideals but they tend to provide good support for business customers who choose to use them.

<comment><USER42> I'm well aware of the dynamics of money in a capitalistic society. Especially for companies like this one who have taken funding and not launched a product yet.

My annoyance was them touting "we grew up using IRC" and then taking none of the hacker ethos from it. I'm not saying they have to abandon profit entirely, but I would like to have seen some openness in their protocols. Some mention of launching an open API. But nothing.

Let's project forward a little using lessons from the past : This is a company, that has taken funding, has not launched a product, and is presumably not profitable. So if they run out of cash they're going to say to their investors, we have run out of money, and the investors are going to say what are your assets?

\- The code

\- A huge database of private conversations

Can you see why I'm not rushing to put all my private conversations in there?

</comment></comment></comment><comment><USER44> 2 cents...

I think you should call it QwertyQuill. Better suits the colour scheme, tone of the copy, product, market etc.

the logo should be a keyboard button with a quill on it.

(as you know) This is a very competitive market. You should lean into being the good-times-vibe-work-chat-app choice, be genuinely counter-culture, I don't mean put a gay flag on your social media profile. Get those eco-groups (the weird ones) using your app, get alt-right groups (not the ones that have killed people) using your app, fandoms, femdoms etc. Be proud of it, broadcast it, make sure you are the weird chat app people.</comment>


Now is the Time to Cash in on Your Passion by Gary Vaynerchuk - <AUTHOR> http://carsonified.com/blog/web-apps/now-is-the-time-to-cash-in-on-your-passion-by-gary-vaynerchuk/ <comment><USER2> Short and to the point. I really enjoy his enthusiasm.</comment>


Rock Pi X Intel Cherry Trail Board - <AUTHOR> https://www.cnx-software.com/2019/09/11/rock-pi-x-low-cost-intel-sbc/ <comment><USER2> I don't know why this has taken so long...

About 5 years ago, I was involved in a project where we purchased Intel based tablets based off a standard reference design in bulk for about $80 a piece - that included battery, cameras, screen, casing and more.

The cost of the board only was about ~$30 or so.

I really wondered why no one was selling these to compete against the Pi in the heyday.

The only problem we had and why we didn't sell to makers was because we didn't control the design and we had enormous technical problems with EFI/Bios 64 bit booting only and a headache like crazy trying to reinstall Linux which just randomly broke all the time.

Truth be told, I wish I pushed through with it.

<comment><USER3> Intel was selling the Edison [1] until 2017. I still have one. It had WiFi and Bluetooth on board, which was nice at the time.

[1] [https://en.wikipedia.org/wiki/Intel_Edison](https://en.wikipedia.org/wiki/Intel_Edison)

<comment><USER4> I still use and maintain about ~60 Intel edisons. Such a great little device. Onboard storage, 5ghz Wifi, and super low power useage. My only gripe was the yocto linux distro they used was a bit janky.

I was really disappointed when they discontinued the project. I guess Intel wanted to invest more in the Movidius ai compute stick, since that is where most of the Edison team was moved to.

</comment></comment></comment><comment><USER5> The processor in these board is about to celebrate its 4th anniversary, and its performance wasn't world-beating at the time of its release.

[https://ark.intel.com/content/www/us/en/ark/products/93361/i...](https://ark.intel.com/content/www/us/en/ark/products/93361/intel- atom-x5-z8350-processor-2m-cache-up-to-1-92-ghz.html)

<comment><USER6> People buying these computers aren't looking for performance. They're focused on cost. There are lots of reasons why you might not need something fast.

<comment><USER7> I'd even add that being slow and constrained is a feature in multiple uses.

A lab desktop cluster doesn't need to be fast, but needs to replicate the environment you want to play with.

</comment></comment></comment><comment><USER8> A little tidbit, Intel still manages to sell 5(!) generations old CPUs in China, and those are not old stock.

The industry been screaming murder for the last year because Intel stopped selling low and mid-tier chips as such in China aside from "new old stock"

The new 10nm Atom line refresh has been delayed 4 times already, and will very likely be delayed for the 5th time.

AMD however does not seem too much interested in China's domestic industry at all. AMD's China reseller is a company in a tiny dusty office in Shanghai.

<comment><USER9> Why is AMD not interested in selling chips in China? Seems crazy to ignore that market unless the price for access is too high.

<comment><USER10> AMD _was_ very interested in selling in to China. They did a deal with the Chinese government that was a little too friendly, and the US government effectively shut the operation down by listing the joint-venture as an export regulated entity.

[https://www.tomshardware.com/news/amd-joint-venture- partner-...](https://www.tomshardware.com/news/amd-joint-venture-partner- banned-us-trade-war,39703.html)

<comment><USER9> Ah yes a technology transfer joint venture

</comment></comment></comment></comment><comment><USER11> I wonder if these boards could be used for a DIY 802.11s mesh implementation? Maybe the hobby alternative to an eero/Google/plume/amplify setup...

<comment><USER12> [https://openwrt.org/docs/guide- user/network/wifi/mesh/80211s](https://openwrt.org/docs/guide- user/network/wifi/mesh/80211s) would be viable.

<comment><USER11> This might just be more dependent on the chipset these boards are coming with, but I'm admittedly just guessing.

<comment><USER12> Seen many OpenWRT installs running upon Intel Cherry Trail, not this particular board (yet), but certainly one of the more easier chipsets to get working over some random ARM SOC for sure.

</comment></comment></comment></comment><comment><USER13> Intel Edison was an interesting product at the time -- but they cancelled it before much community could develop around it. I wish Intel could "stay the course" a little more.

<comment><USER14> Edison was pretty annoying to work with in my experience.

To use the Edison CPU (without their Arduino-like breakout board) on your own hardware you needed a fine-pitch connector that was more or less impossible to solder in a typical home workshop. The Yocto Linux was annoying from a tinker's perspective because it was focused around building static firmware images and not like Raspberry Pi where you ssh in and apt-get away.

This all didn't make much sense for a product marketed to makers/hobbyists. More or less the only benefit you got from Edison was being x86. You could compile a static binary on your laptop, scp it over and it would just work without messing with cross-compilation etc. But that really wasn't worth all the other annoyances IMHO.

<comment><USER15> _More or less the only benefit you got from Edison was being x86._

...and Intel missed the point that x86 without the rest of the PC isn't that great. I suspect if the Edison was actually PC-compatible (to the point of e.g. being able to boot DOS and older Windows and run their applications) it would've had far more popularity (retro-gaming, etc.) than yet-another-maker- toy.

<comment><USER7> But then it'd need to bring in a DOS compatible RTC, a CGA/MDA/EGA/VGA output, audio out (PC speaker or Sound Blaster?), joystick port, serial port (or PS/2 emulation from the USB bus). Should the SD card pretend to be an IDE hard disk?

<comment><USER15> It just needs to have the base AT system board components at their usual places (which can easily be integrated into a SoC[1]) and a useful bus for expansion like PCI(e) or even (E)ISA. Video, audio, and other peripherals can be external.

The Edison module connector could've easily housed a PCI or ISA (which slow, but more "maker friendly" because the speeds are low enough that standard TTL ICs can be used) bus, but all they put on it was USB and GPIO.

[1] [https://en.wikipedia.org/wiki/Vortex86](https://en.wikipedia.org/wiki/Vortex86)

</comment></comment></comment></comment></comment><comment><USER16> Without PCIe it's not clear to me what advantages x86 offers in this form factor. I guess an Intel GPU is a plus.

<comment><USER17> The Atom CPU should be faster than an Arm.

<comment><USER18> Raspberry pi 4 should be as fast as Atom x5-Z8300

<comment><USER19> Yeah but using an Intel Compute stick with the Atom and a Pi 4 both with Ubuntu the Atom is definitely faster in my experience.

<comment><USER20> Real-world comparison here:

[https://openbenchmarking.org/result/1907128-HV-1907127HV99](https://openbenchmarking.org/result/1907128-HV-1907127HV99)

it's hard to make an absolute conclusion; it seems that the Pi 4 is faster than the Z8300 in more cases, but not all.

I wouldn't categorize these results as "definitely faster" though.

<comment><USER19> I think disk IO makes a lot of difference and I guess (didn't look it up) the Atom might get better IO results out of the eMMC SSD than the Pi4 does.

</comment></comment></comment></comment></comment></comment><comment><USER21> What I would like to know is how the GPU compares to a n RPi4 or the latest RPi3. I wish there was a comparison of that.

Regardless, I will probly still buy one of these Rock Pi's anyways :-)

</comment><comment><USER22> This trademark is confusing, with Rockchip and Raspberry Pi already involved in the little SoC board space.

</comment><comment><USER23> Been keeping my eye out for something like this. I have wanted to build a cheap bare metal k8s cluster for my homelab. While ARM is nice, most containers are targeted at x86.

<comment><USER20> It depends on how much you want to spend.

The ODROID H2 is finally available (it hasn't been available for a long time, due to Intel not producing enough chips (or not selling them to ODROID and others, not sure)), and you can consider it a high-end SBC or a low-end NUC.

The price for board+4GB RAM is roughly 150$ vs 80$ for the RPi 4¹.

It's the lowest priced x86 system available², and the performance is significantly superior to ARM boards (in the range 2-4x of RPi 4).

¹= _very rough_ prices; it's hard find the lowest prices, and it's not clear if it makes sense to do so

²=please no comparisons with discontinued machines (there's always somebody popping up with such comparisons...)

<comment><USER23> Was aiming to get the system together for $500 or less, including power supplies for a five node system. So SBC/NUC systems above $100 made it less compelling. Obviously performance isn't the consideration here, but number of physical nodes.

</comment></comment></comment><comment><USER24> I think it should take a nvme card (because of its small size) for storage.

</comment><comment><USER25> Every time I press "More Options" for the cookies and choose not to accept it just re-presents the screen...

<comment><USER26> I tried to dismiss the cookie wall and that completely breaks the page as well. I can't scroll down.</comment></comment>


A million people live in underground nuclear bunkers in Beijing (2017) - <AUTHOR> https://www.nationalgeographic.com/photography/proof/2017/02/atomic-rooms-beijing-china-housing/ <comment><USER2> A _million_ people living in bunkers? That means one of out twenty. That just doesn't pass the smell test.

The linked NYT article [1] says it's "well over 100,000" which is a whole order of magnitude lower. But more importantly, it also seems to conflate what is a true bomb shelter, versus what are merely regular basement apartments:

"Nearly every apartment building in the Digua Shequ center's neighborhood has a former shelter or a basement... If you get rid of these basement units, where will the migrants live?... A lot of landlords have spent money renovating the spaces they lease, so they don't want to stop renting out basements..."

I mean, c'mon -- people live in basement apartments in Manhattan too, it's not that bad. And then, yes, I could maybe believe that 1/20 people in Beijing lives in a basement apartment if the average building is 10 stories tall with a single-story basement. And that then a much smaller number live in the actual bomb shelters that aren't just basements.

[1] [https://www.nytimes.com/2016/03/22/world/asia/beijing- bomb-s...](https://www.nytimes.com/2016/03/22/world/asia/beijing-bomb- shelters.html?_ga=1.4562097.385821338.1462107904&_r=0)

<comment> dis-sys > I mean, c'mon -- people live in basement apartments in Manhattan too, it's > not that bad.

The underground space discussed by the OP article were actually designed/built/maintained as shelters for nuclear war. They are not fancy Manhattan apartments, you can't get it connected with broadband/water through official channels. If someone lives there, their kids can't even go to local public schools, as they are never considered as local residents.

There are of course actual basement apartments in Beijing, but a 70 sqm basement apartment can has a price tag of $1.5 million USD [1]. That is something for the middle class, not those people mentioned in the OP article.

[1] [http://www.sohu.com/a/229312750_100070963](http://www.sohu.com/a/229312750_100070963)

<comment><USER2> I'm not disputing they exist... I'm disputing that a full _twentieth_ of the population of Beijing lives in them, which the article claims.

That number doesn't sound plausible and it's not linked to any credible source or methodology.

</comment></comment></comment><comment><USER3> These are not normal basement rooms. Builders in China are required by law to build these bunkers that can withstand air strikes.

E.g. [http://www.sz.gov.cn/yjzhzx/ywgz_54281/rmfk/201711/t20171121...](http://www.sz.gov.cn/yjzhzx/ywgz_54281/rmfk/201711/t20171121_9904486.htm)

Those bunkers are actually owned by the government. Using those bunkers for other purposes are against the law.

[https://baike.baidu.com/item/%E4%B8%AD%E5%8D%8E%E4%BA%BA%E6%...](https://baike.baidu.com/item/%E4%B8%AD%E5%8D%8E%E4%BA%BA%E6%B0%91%E5%85%B1%E5%92%8C%E5%9B%BD%E4%BA%BA%E6%B0%91%E9%98%B2%E7%A9%BA%E6%B3%95/1226515?fromtitle=%E3%80%8A%E4%B8%AD%E5%8D%8E%E4%BA%BA%E6%B0%91%E5%85%B1%E5%92%8C%E5%9B%BD%E4%BA%BA%E6%B0%91%E9%98%B2%E7%A9%BA%E6%B3%95%E3%80%8B&fromid=11178372)

You can even find the build code for those bunkers with keyword GB50038 (Code for design of civil air defence basement)

<comment><USER4> A lot of the ant tribe lives in the basements of otherwise luxury apartment buildings, there is also a large network of older bunkers within the 2nd ring road.

Law doesn't mean much in China, just if the officials are in the mood to crack down on it or not.

</comment></comment><comment><USER5> "In Beijing alone, roughly 10,000 bunkers were promptly constructed...Now when night falls, more than a million people—mostly migrant workers and students from rural areas—vanish from Beijing's bustling streets into the underground universe, little known to the world above...Local laws require a minimal living space of 4 square meters (43 square feet) per tenant, which, in many cases, go ignored."

Something about this story doesn't add up — many bunkers are less than 43 sq ft per tenant, but somehow the average number of people living in a bunker is ~100 (1,000,000 people / 10,000 bunkers)??

<comment><USER6> These bunkers has multiple rooms. It is not uncommon to have 8 people living in one room, and a large bunker site can have 20+ rooms. A bunker site can have living area similar to a 20 room motel, underneath a much bigger building on top (at least when they are inside the city).

Since these bunkers were built, they were build for war, some of them have very thick gas tight door to complete seal the environment from outside.

<comment><USER5> Citation?

<comment><USER4> Think about how many apartment buildings are in Beijing. All of these have basements, each basement level has multiple rooms, and most apartment buildings have multiple levels of basement. A million people easily could be sheltered under that context.

</comment></comment></comment></comment><comment><USER7> Of the pictures at the top of the article, almost every bedroom captioned as being in an underground bunker had a window visible in the frame. One of them had something that looked like the door to a residential apartment next to that window. Another one had nice mouldings between walls and ceiling, which is not a detail I would expect in a bunker. To add to that, basement establishments are not exactly rare in Asia's big cities. I'm very skeptical of this story.

<comment><AUTHOR> > _window visible in the frame_

Take a closer look. These windows are not windows to the outside. They're windows to hallways inside of massive bunkers. You can even see giant steam/water pipes in some of the pics (say pic #1). Also, notice the window frames... they are not the types of window frames that would last even a week when exposed to outside elements like snow, wind and rain.

Large pic #1: [https://www.nationalgeographic.com/content/dam/photography/P...](https://www.nationalgeographic.com/content/dam/photography/PROOF/2017/February/atomic- rooms-china/22-atomic-rooms-faccilongo.jpg)

</comment></comment><comment><USER8> It reminds me of the sci-fi novelette Folding Beijing. [https://en.m.wikipedia.org/wiki/Folding_Beijing](https://en.m.wikipedia.org/wiki/Folding_Beijing)

<comment><USER9> Thanks for the referral!

Here's a link to the story, translated to English: [https://uncannymagazine.com/article/folding- beijing-2/](https://uncannymagazine.com/article/folding-beijing-2/)

</comment></comment><comment><USER10> This article made me ponder the utility of, as a nation, having an independently functioning portion of your economy and society underground at bunker depths, as a component of national security.

If the shit ever did really hit the fan, and you had something on the order of 10+% of your population entirely self-sufficient underground, these would be the survivors and they'd already be entirely acclimated to, and prepared for, the situation.

It's some food for thought...

</comment><comment><USER11> Wikipedia page on this place: [https://en.wikipedia.org/wiki/Underground_City_(Beijing)](https://en.wikipedia.org/wiki/Underground_City_\(Beijing\))

Wikipedia page states that is 85 square km.

Also another much longer and detailed Vice article of it: [https://www.vice.com/en_uk/article/nnmk8b/chairman-maos- unde...](https://www.vice.com/en_uk/article/nnmk8b/chairman-maos-underground- city)

</comment><comment><USER12> Some of the bomb shelters are above ground, as shown in the photographs, which is part of why the "million people underground" thing is just hyperbole. It doesn't make this an uninteresting article.

One of above-ground shelters is architecturally a little strange, with steel security cages built over first, second, and third story windows where you'd ordinarily just put a railing or balcony. It looks cool but I wonder what the actual purpose of it could be.

</comment><comment><USER13> Can someone explain why Beijing is so expensive as far as rents go? I'm surprised given how sprawling it is.

<comment><USER14> Imagine a city with so much housing demand that there are literal laws about who can and cannot move there for the sake of population control

Also, a lot of the people in the bunkers are not supposed to be there in the legal sense above, which is why they end up there.

<comment><USER15> The Hukou (户口) system that you're talking about wasn't established because of demand for housing in Beijing. It's not really clear why it was established and has origins that date back hundreds of years. It essentially serves as a social control mechanism and to promote people living, and thus laboring, in rural areas. Though it dates back to immigration control between states in "China". (When they were different sovereign entities.)

They're all migrant workers and are allowed to be in Beijing without Hukou. Hukou Just establishes certain privileges like home ownership and school access.

The best way to think about Hukou for Americans is that Hukou is like if California required a Texan or Floridian to get a Visa or become a "California Citizen" before working there, buying a home there, or using public services there.

<comment><USER16> It seems Hukou is being used to somewhat control the urbanisation plans CCP have been implementing. They create "Hukou free" regions like Shenzhen for periods of time to cause mass migration and economic growth.

But it's also created this strange "illegal migrant" issue in all the top tier cities (PK, SH, GZ, etc).

</comment></comment></comment></comment><comment><USER17> Too bad the excess in housing in China isn't being utilized to solve this issue.

</comment><comment><USER18> there's something on that page that autoplays. can't find it to stop it on mobile, so unable to read.

</comment><comment><USER19> Yes, yes this weekend is a perfect time to pull my copy of City Of Darkness off the shelf.

<comment><USER20> Or the Imperial Radch series—the undergarden.

</comment></comment><comment><USER21> We're over here playing Fallout Shelter; they're over there living fallout shelter.

</comment><comment><USER22> I hear 1BR underground bunkers are going for above asking price in Mountain View.</comment>


Looking for partnership - <AUTHOR>

Hello,
I'm looking for a partner(s) (preferably long-time) to start iPhone development.
Preference would be for someone who has coding AND graphics skills and has already worked with the iPhone SDK; and I wouldn't mind two individual partners (coder + designer).
I have already a few ideas of my own and won't mind sharing them when the time is right.
If interested, you would obviously provide some sample work as I'm looking to avoid producing (later on) crApps (pun intended).
I'm obviously talking here about "revenue sharing". I felt I had to clarify this in order to avoid conveying the wrong message.
Thank you in advance for your interest.
I can be reached at the following address:
fares [dot] fayad [at] gee mail [dot] com <comment><USER2> Were I an iPhone coder, I'd be asking what areas your software is aiming at (3D, geolocation, multiplayer, networking, games, medical, contract work...?) and what sort of partnership it would be (are you also a coder? What's your background? Have you started any apps? are you thinking internet-collaboration or small-office or shared-house?).

I would also be fearing you being an MBA/marketing/ideas person with planning for an 90/10 split on revenue sharing when the partner has done the simple bit of writing the ideas down in iPhonespeak. Yet you've found HN, so it can't be so bad...

<comment><AUTHOR> Thank you for your post jodrellblank.

You raise several important points "for someone who isn't an iPhone coder" and probably not interested in the subject.

For the record and to prove how serious I am to the people who this post is targeted at, I will answer your questions. Please find my reply below:

\- Although the main aim is Utilities and Games/Entertainment (as categorized in the App store), other areas could be targeted as well giving the right circumstances.

\- I'm thinking internet collaboration since I do not wish to limit the possibilities to people living in my area, whereas in another part of the world, there might be (is) someone with better skills.

\- I have very high respect for coders and do understand how hard it is to put a clean fast running app, bug free, therefore the mere concept of a 90/10 split is silly to me. In other words, EQUAL splits for the PARTNERS.

Regards.

</comment></comment><comment><AUTHOR> UP</comment>