How much you have to earn to be in the top 0.01% in every US state - <AUTHOR> https://www.cnbc.com/2018/08/02/how-much-you-have-to-earn-to-be-a-top-earner-in-every-us-state.html <comment><USER2> To save you scrolling -

=== Alabama

        - Annual income required to be in the top 0.01 percent: $4.74 million
        - Average annual income of the top 0.01 percent: $12.20 million

=== Alaska

        - Annual income required to be in the top 0.01 percent: $5.30 million
        - Average annual income of the top 0.01 percent: $12.03 million

=== Arizona

        - Annual income required to be in the top 0.01 percent: $5.93 million
        - Average annual income of the top 0.01 percent: $16.10 million

=== Arkansas

        - Annual income required to be in the top 0.01 percent: $6.34 million
        - Average annual income of the top 0.01 percent: $26.04 million

=== California

        - Annual income required to be in the top 0.01 percent: $12.89 million
        - Average annual income of the top 0.01 percent: $45.39 million

=== Colorado

        - Annual income required to be in the top 0.01 percent: $8.74 million
        - Average annual income of the top 0.01 percent: $25.1 million

=== Connecticut

        - Annual income required to be in the top 0.01 percent: $19.5 million
        - Average annual income of the top 0.01 percent: $70.2 million

=== Delaware

        - Annual income required to be in the top 0.01 percent: $5.71 million
        - Average annual income of the top 0.01 percent: $15.23 million

=== Washington, D.C.

        - Annual income required to be in the top 0.01 percent: $13.69 million
        - Average annual income of the top 0.01 percent: $43.13 million

=== Florida

        - Annual income required to be in the top 0.01 percent: $12.03 million
        - Average annual income of the top 0.01 percent: $45.17 million

=== Georgia

        - Annual income required to be in the top 0.01 percent: $6.74 million
        - Average annual income of the top 0.01 percent: $18.62 million

=== Hawaii

        - Annual income required to be in the top 0.01 percent: $5.28 million
        - Average annual income of the top 0.01 percent: $14.91 million

=== Idaho

        - Annual income required to be in the top 0.01 percent: $5.57 million
        - Average annual income of the top 0.01 percent: $15.5 million

=== Illinois

        - Annual income required to be in the top 0.01 percent: $10.45 million
        - Average annual income of the top 0.01 percent: $34.18 million

=== Indiana

        - Annual income required to be in the top 0.01 percent: $5.2 million
        - Average annual income of the top 0.01 percent: $13.39 million

=== Iowa

        - Annual income required to be in the top 0.01 percent: $4.86 million
        - Average annual income of the top 0.01 percent: $12.27 million

=== Kansas

        - Annual income required to be in the top 0.01 percent: $7.2 million
        - Average annual income of the top 0.01 percent: $21.52 million

=== Kentucky

        - Annual income required to be in the top 0.01 percent: $4.76 million
        - Average annual income of the top 0.01 percent: $13.68 million

=== Louisiana

        - Annual income required to be in the top 0.01 percent: $5.3 million
        - Average annual income of the top 0.01 percent: $13.88 million

=== Maine

        - Annual income required to be in the top 0.01 percent: $3.63 million
        - Average annual income of the top 0.01 percent: $7.98 million

=== Maryland

        - Annual income required to be in the top 0.01 percent: $7.45 million
        - Average annual income of the top 0.01 percent: $19.60 million

=== Massachusetts

        - Annual income required to be in the top 0.01 percent: $14.53 million
        - Average annual income of the top 0.01 percent: $50.74 million

=== Michigan

        - Annual income required to be in the top 0.01 percent: $6.4 million
        - Average annual income of the top 0.01 percent: $19.25 million

=== Minnesota

        - Annual income required to be in the top 0.01 percent: $8.11 million
        - Average annual income of the top 0.01 percent: $23.13 million

=== Mississippi

        - Annual income required to be in the top 0.01 percent: $3.4 million
        - Average annual income of the top 0.01 percent: $7.93 million

=== Missouri

        - Annual income required to be in the top 0.01 percent: $6.72 million
        - Average annual income of the top 0.01 percent: $20.95 million

=== Montana

        - Annual income required to be in the top 0.01 percent: $5.77 million
        - Average annual income of the top 0.01 percent: $16.42 million

=== Nebraska

        - Annual income required to be in the top 0.01 percent: $6.28 million
        - Average annual income of the top 0.01 percent: $17 million

=== Nevada

        - Annual income required to be in the top 0.01 percent: $10.68 million
        - Average annual income of the top 0.01 percent: $43.99 million

=== New Hampshire

        - Annual income required to be in the top 0.01 percent: $8.04 million
        - Average annual income of the top 0.01 percent: $24.96 million

=== New Jersey

        - Annual income required to be in the top 0.01 percent: $10.79 million
        - Average annual income of the top 0.01 percent: $29.77 million

=== New Mexico

        - Annual income required to be in the top 0.01 percent: $3.8 million
        - Average annual income of the top 0.01 percent: $9.52 million

=== New York

        - Annual income required to be in the top 0.01 percent: $17.42 million
        - Average annual income of the top 0.01 percent: $69.49 million

=== North Carolina

        - Annual income required to be in the top 0.01 percent: $6.06 million
        - Average annual income of the top 0.01 percent: $17.04 million

=== North Dakota

        - Annual income required to be in the top 0.01 percent: $6.7 million
        - Average annual income of the top 0.01 percent: $16.39 million

=== Ohio

        - Annual income required to be in the top 0.01 percent: $5.64 million
        - Average annual income of the top 0.01 percent: $15.22 million

=== Oklahoma

        - Annual income required to be in the top 0.01 percent: $6.52 million
        - Average annual income of the top 0.01 percent: $19.83 million

=== Oregon

        - Annual income required to be in the top 0.01 percent: $5.96 million
        - Average annual income of the top 0.01 percent: $16.15 million

=== Pennsylvania

        - Annual income required to be in the top 0.01 percent: $7.82 million
        - Average annual income of the top 0.01 percent: $24.28 million

=== Rhode Island

        - Annual income required to be in the top 0.01 percent: $6.28 million
        - Average annual income of the top 0.01 percent: $17.54 million

=== South Carolina

        - Annual income required to be in the top 0.01 percent: $4.65 million
        - Average annual income of the top 0.01 percent: $11.22 million

=== South Dakota

        - Annual income required to be in the top 0.01 percent: $7.83 million
        - Average annual income of the top 0.01 percent: $22.6 million

=== Tennessee

        - Annual income required to be in the top 0.01 percent: $6.67 million
        - Average annual income of the top 0.01 percent: $20.33 million

=== Texas

        - Annual income required to be in the top 0.01 percent: $9.85 million
        - Average annual income of the top 0.01 percent: $31.31 million

=== Utah

        - Annual income required to be in the top 0.01 percent: $7.43 million
        - Average annual income of the top 0.01 percent: $22 million

=== Vermont

        - Annual income required to be in the top 0.01 percent: $5.33 million
        - Average annual income of the top 0.01 percent: $14.34 million

=== Virginia

        - Annual income required to be in the top 0.01 percent: $7.47 million
        - Average annual income of the top 0.01 percent: $20.71 million

=== Washington

        - Annual income required to be in the top 0.01 percent: $10.27 million
        - Average annual income of the top 0.01 percent: $35.11 million

=== West Virginia

        - Annual income required to be in the top 0.01 percent: $2.95 million
        - Average annual income of the top 0.01 percent: $6.57 million

=== Wisconsin

        - Annual income required to be in the top 0.01 percent: $6.68 million
        - Average annual income of the top 0.01 percent: $19.64 million

=== Wyoming

        - Annual income required to be in the top 0.01 percent: $15.05 million
        - Average annual income of the top 0.01 percent: $74.30 million

<comment><USER3> "To save you scrolling"

<comment><USER4> Yeah that was painful on mobile lol</comment></comment></comment>


Why Religious Health Care Restrictions Often Take Patients by Surprise - <AUTHOR> https://fivethirtyeight.com/features/why-religious-health-care-restrictions-often-take-patients-by-surprise/ <comment><USER2> This seems to be an additional argument for socialized secular health care. Reproductive services are only one of many services denied at these institutions. LGBT persons are unlikely to be welcome as well sometimes even for issues unrelated to their sexuality or gender. Will they treat STD patients in the future? What about the women injured by unlicensed abortion providers?</comment>


Encryption in Transit in Google Cloud - <AUTHOR> https://cloud.google.com/security/encryption-in-transit/ <comment><USER2> This document has been a long-time coming, and finally lets us talk about the encryption we perform on your behalf when transiting outside our physical boundaries. There are lots of paths, but I think the diagram [1] captures it well.

Edit: Of particular note is that if you have a VM in say us-central1 talking to another of your VMs in us-east1, we encrypt that traffic across regions (even though it's riding our backbone).

Disclosure: I work on Google Cloud (and even sort of contributed to this).

[1] [https://cloud.google.com/images/security/whitepaper- transit-...](https://cloud.google.com/images/security/whitepaper- transit-01.svg)

<comment><USER3> Any chance you guys will support dual RSA+ECC custom certs on the HTTPS load balancer at some point? :)

<comment><USER2> I've pinged the PM to ask. Send me an email or check back here :).

<comment><USER3> Holy moly, it's actually possible right now!

It wasn't there before, but you can assign multiple certs to a front end now, and it works as you expect (tested with SSLLabs.com).

Great, thanks! :)

</comment></comment></comment></comment><comment><USER4> The key thing here for my use-case is this point (which took a lot of digging to uncover when I last dove into this a year or so ago):

> Data in transit inside a physical boundary controlled by or on behalf of > Google is generally authenticated but not necessarily encrypted.

Previously I believe this was not explicitly called out, but this is very important for GKE! In the default configuration, Kubernetes can arbitrarily bounce Service traffic between nodes, since the cloud LB selects a node at random, and then the Service iptables rules redirect the traffic to a node which hosts a pod that backs the Service.

So if your regulatory environment (or SLA) requires end-to-end encryption, you are not covered using GKE out of the box.

Options I've found to resolve this:

1) TLS to-the-pod

2) Using source-IP-address-preservation to ensure that the Service doesn't reroute your traffic to another node.

I'd really prefer if Google made this limitation a bit clearer in their GKE docs, since it's a major security gotcha, and took me a lot of digging to piece together. But it's definitely a big step forwards that the encryption policy is spelled out explicitly here.

<comment><USER5> Does this section on Istio apply to your use-case?

> If you want to implement mutual authentication and encryption for workloads, > you can use istio auth. Specifically, for a workload in Kubernetes, Istio > auth allows a cluster-level CA to generate and distribute certificates, > which are then used for pod-to-pod mutual Transport Layer Security (mTLS).

[https://cloud.google.com/security/encryption-in- transit/#ser...](https://cloud.google.com/security/encryption-in- transit/#service-to-service_and_vm-to-vm_encryption)

<comment><USER6> That was our intent (though we can always be clearer). If your regulatory environment requires that level of encryption, you'll want to use something, like Istio, that provides pod-to-pod mTLS (likely via a proxy or service mesh or both).

Disclosure: I work at Google on Kubeflow

</comment></comment></comment><comment><USER7> Can someone explain how this pertains to Firebase hosted and FB realtime DB apps built using Angular5?

<comment><USER2> Sure. Firebase runs on top of Google Cloud. So if you say use Firebase Functions, that's a "Google Cloud Service" in the diagram [1] in the article. Similarly, Firestore is also a "Google Cloud Service", so all requests to it (from say your Firebase Function) are encrypted as well.

Disclosure: I work on Google Cloud (but disclaimer: not on Firebase).

[1] [https://cloud.google.com/images/security/whitepaper- transit-...](https://cloud.google.com/images/security/whitepaper- transit-01.svg)

<comment><USER7> Thanks @boulos. Appreciate it. I'm unclear on what encrypted at rest means. For example - I'd expect the data in Google cloud store to be encrypted (or have an option to be encrypted) so that if someone were to get access to our DB admin account, they won't be able to see the JSON data in plain text. The only way to see the data would be through API access which can be configured for ACL (and by Google cloud store so we can index and query data which is encrypted at rest).

<comment><USER2> Encryption at rest [1] protects against someone who has access to the _encrypted_ bytes from not being able to decrypt it. That is, if someone got the raw bytes off our storage somehow, it's not useful to them. If someone has access to your _account_ , then the storage system can't tell if it's you or not.

Data in Datastore (and Firestore fwiw, that needs an update) is encrypted at rest, and today's paper discusses how it's _also_ encrypted in transit between your app and the service. I don't believe Datastore supports Customer Supplied Encryption Keys [2] (yet) but that lets you have a key that even Google can't decrypt the data without you providing it. That's a pretty good way to separate permission from keys.

Disclosure: I work on Google Cloud.

[1] [https://cloud.google.com/security/encryption-at- rest/default...](https://cloud.google.com/security/encryption-at-rest/default- encryption/) [2] [https://cloud.google.com/security/encryption-at- rest/custome...](https://cloud.google.com/security/encryption-at- rest/customer-supplied-encryption-keys/)

</comment></comment></comment></comment><comment><AUTHOR> Direct link to PDF version: [https://cloud.google.com/security/encryption-in- transit/reso...](https://cloud.google.com/security/encryption-in- transit/resources/encryption-in-transit-whitepaper.pdf)

</comment><comment><USER8> I read "Encryption in Google Transit" for a second and was confused.</comment>


Big privacy changes at SmugMug - <AUTHOR> http://blogs.smugmug.com/don/2008/02/08/big-privacy-changes-at-smugmug/ <comment><AUTHOR> My timeframe was off, but my prediction otherwise held:

<http://news.ycombinator.com/item?id=105968>

</comment><comment><USER2> The big question that I have is whether the "key" in this scenario is a hash (or a pieces of a hash), or if it is randomly assigned.

The former is much more susceptible to being reverse engineered and hacked. Especially with a relatively small search space: ~30 bits.</comment>


Ever Opened a Zip Folder or Downloaded Music? This Atlantan Made It Possible - <AUTHOR> http://www.hypepotamus.com/people/boris-jerkunica/

<comment><USER2> Zip was invented back in the 1980's by Paul Katz, not this guy. Yes, Netzip put a pretty UI on a windows version, but it's hardly deserving of a "made it possible" label.

Shame, PK died as a result of alcoholism.</comment>


Wirecard Files for Insolvency - <AUTHOR> https://www.reuters.com/article/us-wirecard-accounts/wirecard-files-for-insolvency-idUSKBN23W176 <comment><USER2> Amazing how quickly that went actually looking at how long it took to uncover this mess.</comment>


Google's social network sees 37% jump in users - <AUTHOR> http://www.usatoday.com/story/tech/2013/10/29/google-plus/3296017/

<comment><USER2> Because if you rate an android app you're a "google plus user"?

Because if you comment on youtube you're a "google plus user"?

Google+ doesn't really mean much more than "you use Google services", and their growth is inherently untrustworthy when they're still (forcibly) _transferring_ users rather than acquiring them.

</comment><comment><USER3> I have some photos I had uploaded on Picasa a few years ago. I recently noticed that these photos have each become posts on my G+ account. Apparently they converted what was an album into a bunch of G+ posts. Now I have zero confidence in anything google claims.

</comment><comment><USER4> I wonder how many of these users are real users. From what I know I need a google plus profile to review or rate Android apps or businesses on Google Maps. I really think they just growth hacked this number.

</comment><comment><USER5> Trying to find a way to change my full name into a nickname on YouTube made me a Google+ "user". I've also received Google+ recommendation e-mails without ever willingly joining or participating in the service.

</comment><comment><USER6> I think Google has expanded its team 37%</comment>


Natural Log: handwritten mathematics recognition system from MIT - <AUTHOR> http://www.ai.mit.edu/projects/natural-log/

<comment><USER2> Now all they need to do is have Wolfram|Alpha solve it and convert the work back into handwriting.

</comment><comment><USER3> anyone else getting errors when trying the online demo applet?

<comment><USER3> was using chrome..not compatible</comment></comment>


Ask HN: does anyone have trouble with the last 1% of app development? - <AUTHOR>

It seems I can develop the app and test it but when it comes to actually deploying it and all that is involved. Building the icon, default image, posting to app store I seem to just bet bored. Does anyone else have this problem? <comment><USER2> Yeah, its fairly boring unless you're into the creative art stuff. I'll usually just whip together some of my art assets and Photoshop something quickly.

Use this to publish your icons quickly: [http://appicontemplate.com/ios7](http://appicontemplate.com/ios7)

</comment><comment><USER3> Yes. But more like the last 20%. I generally follow the 80 20 rule I find. 80% I get done in like 2 weeks and the last 20 takes me a really really really long time.

<comment><AUTHOR> Yeah same here.</comment></comment>


Michelin, Safran unveil 'connected' aircraft tire at Paris Air Show - <AUTHOR> http://www.european-rubber-journal.com/2017/06/21/michelin-safran-unveil-connected-aircraft-tire-paris-air-show/ <comment><USER2> Interesting it took this long to carry-over the idea from automobile manufacturing: pressure sensors have been extremely common in the auto industry for what? 20 years now?

</comment><comment><USER2> TIL: there is a European "rubber journal"</comment>


Why cohort analysis? - <AUTHOR> http://www.onebigfluke.com/2012/11/why-cohort-analysis.html

<comment><USER2> I hope people appreciate the idea presented in this article. I don't know how much the average engineer learns about panel data regression, but panel data is the heart and sole of modern day econometrics, and quite frankly it's knowledge that every top data science candidate should have.</comment>


A fat-fighting drug that shows promise - <AUTHOR> http://www.newscientist.com/article/dn19929-finally-a-fatfighting-drug-that-shows-promise.html

<comment><USER2> I wonder if this will be a repeat of the Sirtris story - big pharma buys magic pill company for 500 million dollars for a drug that doesn't do shit.

Diet and exercise have been shown to improve CAD, HTN, Diabetes, even cancer risk. It doesn't cost nearly as much(probably), and leads to more than 9 lb weight loss(if consistently done). If only they made a motivational pill that made people want to eat healthy and exercise...

</comment><comment><USER3> tl;dr:

"ZGN-433 caused 24 obese women to lose, on average, a kilogram a week for a month – with no harmful side effects."

"This is a stunning rate of weight loss, especially as the women ate normally and were not given exercise advice. It is almost the maximum rate considered safe, and nearly as effective as surgery to reduce stomach size"

</comment><comment><USER3> Created by Zafgen a Cambridge MA startup.</comment>


Ask HN: Hacking an Echo Dot? - <AUTHOR> My company gave us Amazon Echo Dots for the holidays one year. I don't want Amazon in my home, so it's been sitting in the box.<p>Does anyone know if it's possible to get Alexa off of it and put custom software on it? Uses I can think of include making it a Bluetooth speaker, putting an open source assistant on it, or any number of other things if I could load custom code. <comment><USER2> I'd recommend taking a look at the ifixit teardown here: [https://www.ifixit.com/Teardown/Amazon+Echo+Dot+Teardown/613...](https://www.ifixit.com/Teardown/Amazon+Echo+Dot+Teardown/61304)

They document which chips are inside. This is first gen, but they don't have a second-gen with the same chip description. You probably have second (which is for the better, as it's a mediatek running android and much more usable).

Other things you may find interesting:

* This guy went over intercepting and tinkering with firmware updates. They were HTTP when he did it; that may have changed. If not, they may still be vulnerable to SSL stripping. [https://medium.com/@micaksica/exploring-the-amazon-echo-dot-...](https://medium.com/@micaksica/exploring-the-amazon-echo-dot-part-1-intercepting-firmware-updates-c7e0f9408b59)

* Part 2. Here it is found that it can boot fastboot and be hacked : [https://medium.com/@micaksica/exploring-the-amazon-echo-dot-...](https://medium.com/@micaksica/exploring-the-amazon-echo-dot-part-2-into-mediatek-utility-hell-b452f62e5e87)

* People here rooted an echo; this may or may not work on a dot: [https://github.com/echohacking/wiki/wiki](https://github.com/echohacking/wiki/wiki)

* Forum dedicated to it: [https://www.echotalk.org/index.php/board,2.0.html](https://www.echotalk.org/index.php/board,2.0.html)

* Paper on this subject: [https://vanderpot.com/Clinton_Cook_Paper.pdf](https://vanderpot.com/Clinton_Cook_Paper.pdf)

I suggest googling for more info. If all else fails, I guess just flashing the nand might do it? In summary, v2 is a linux system which means you could likely run anything linux on it (including an open-source assistant), though I suspect it will take no small amount of hacking.

<comment><AUTHOR> Yeah..... I was hoping the effort level would be more along the lines of flashing a Raspberry PI or Android phone. May not be worth it :P

</comment></comment><comment><USER3> I'm curious about this too. Amazon mistakenly sent me an echo 2 instead of a dot. They refunded me the cost of the dot, but apparently the echo serial number was reported lost/stolen in their system so it is unusable. They told me to just throw it out, but seems like a waste of perfectly good hardware.

</comment><comment><USER4> [https://github.com/echohacking/wiki/wiki/Echo- Dot-v2](https://github.com/echohacking/wiki/wiki/Echo-Dot-v2) has some links to resources regarding custom firmware and some great write-ups explaining the OTA updates.

</comment><comment><USER5> Hacking Amazon devices is IMO far worse than hacking Apple devices, I recommend selling the thing on eBay and buying a Google Home AIY kit or Google Home mini.

</comment><comment><USER6> You can use an echo as a BT speaker. Just don't connect it to the internet</comment>


A popular sugar additive may have fueled the spread of 2 superbugs - <AUTHOR> https://www.msn.com/en-us/health/medical/a-popular-sugar-additive-may-have-fueled-the-spread-of-2-superbugs/ar-BBHQ6ls?li=BBnbfcL <comment><USER2> Doesn't surprise me considering that Cancer likes to feed on sugar.</comment>


Suggested reads for a startup... given we have oh so much time to read? - D-Train

I love learning.  I love reading great, interesting pieces.  However, I'm also juggling time so that I can work on my startup and wrapping up b-school.
There are some great blogs and other articles out there including posts here to HN, PG's essays, LinkedIn, etc.  I also know there are great lengthier reads (books).
What books would be good to read that also don't need me to devote boatloads of precious hours to fully appreciate them (learn from)?  Unless there are none... <comment><AUTHOR> Here's some that I have found useful:

Hack Your Education by Dale Stephens - <http://goo.gl/O27Z8>

Lean Startup - <http://goo.gl/YVGuU>

Startup Communities by Brad Feld - <http://goo.gl/CaGTA>

Rework by Jason Fried and DHH - <http://goo.gl/IzGeB>

The Personal MBA by Josh Kaufman - <http://goo.gl/Ucf3u>

<comment> D-Train Yeah, I've got Lean Startup. Been a good read so far. Are there any particular blogs, sites you visit, too? I'm almost curious...

Thanks for the recs!</comment></comment>


Nimble – A Wolfram Alpha Menubar Client for Mac OS X - <AUTHOR> http://madebybright.com/ <comment><USER2> Looks very clean, nice work! Although, I can't see myself using it. A simple example[1] of plotting a graph on Nimble shows only the first "card" of information which is pretty useless, but on WA it shows more relevant data[2] that I was looking for.

Also, the extracted app size is ~100MB large for a indicator that does so little. I'm guessing it's because of the bulk from Electron or some other shell app.

Side note: right-clicking it to automatically quit is very confusing.

[1]: [https://i.imgur.com/6yzYcRX.png](https://i.imgur.com/6yzYcRX.png)

[2]: [https://i.imgur.com/Fq1lNpc.png](https://i.imgur.com/Fq1lNpc.png)

</comment><comment><USER3> Looks pretty neat.

Question: Why is this thing 170MB? Does it include the CDF player or something?

Suggestion: I use WA for nutritional info, so I make mishmash, then I do a search like: [http://www.wolframalpha.com/input/?i=2+onions+and+5+cloves+g...](http://www.wolframalpha.com/input/?i=2+onions+and+5+cloves+garlic+and+3+tomatoes+and+1lb+chicken+breast+and+30ml+oil)

This gives me same custom-made nutrition label as on food packaging, but for whatever I just made. Nimble returns one of the caloric-breakdown tables instead, which isn't as useful.

<comment><USER4> The size is primarily due to Electron, Nimble's backbone. Unfortunately, a large portion of Nimble's size is due to to Electron, and there's not a whole lot we can do about that aside from shifting the project to a completely different framework, rebuilding Nimble from the ground up. Although this is true, we're still doing everything we can to bring the size down.

The information provided by Wolfram's API is rather limiting, and definitely not as extensive as the information provided through its web service. We'll see what we can do about this problem.

</comment></comment><comment><USER5> Hey awesome! I'm downloading now, but the number one thing I hate about Wolfram Alpha (which I use often) is how long it takes to get to the website to ask my question and wait for an answer. I'm really hopeful this puts WA as nearby as Spotlight is.

<comment><USER6> How long is the delay in Nimble?

</comment></comment><comment><USER7> I'm installing this. On a tangent, I wonder when we'll get Siri on OS X.

</comment><comment><USER8> Too simple, it's both faster and more useful to just search Wolfram Alpha right away using Alfred or any other quicklauncher.</comment>


Can China take the lead in innovation and research? - <AUTHOR> https://www.techinasia.com/china-tech-industry-lead-innovation-research <comment><USER2> When will we see Western companies stealing Chinese tech? Because you know that's going to happen if the Chinese make meaningful advances, especially if there are military applications.</comment>


The Cobra Effect that is disabling paste on password fields - <AUTHOR> http://www.troyhunt.com/2014/05/the-cobra-effect-that-is-disabling.html

<comment><USER2> I hope everybody who thinks it's a good idea to "forbid" pasting in password fields at least uses the same trick (onpaste="return false" or something similar) so that I can remove that attribute from the HTML before pasting my password like the insubordinate fool I am. :P

Blizzard does the same as Paypal, I noticed: not allowing pasting of passwords when changing passwords, but you can paste it when logging in. Thankfully, I noticed yesterday, Starcraft II allows me to paste the password in-game! That was a nice surprise. Looks like they've given their policy some thought, at least.

The only reason I can think of is perhaps reducing the risk of people not knowing their password when accidentally pasting the wrong thing in the password fields. It's possible that your clipboard contains something else since you copied your password. Which is understandable, but it seems to me like they're replacing one problem with another whereby everybody gets to deal with the new one, whereas the old problem could be circumvented with a password-forgotten function that everybody has anyway.

Yeah, not a big fan of this practice all in all.

<comment><USER3> Disabling paste makes sense when setting your password.

If presented with two input fields for password & confirm your password, the lazy among us will type the desired new password in the first input box, then copy the contents and paste into the second... if you type it incorrectly in the first box you then have to reset it before you can log in again.

<comment><USER4> Browsers disable copy on password fields.

<comment><USER3> hah, I was in firefox at the time and checked that I can copy and paste between password fields, it appeared to work.

I didn't look at what had been inserted into the clipboard though, it was just the asterisk characters visually displayed in the password field.

</comment></comment></comment></comment><comment><USER5> I'm told not to use easy to guess passwords, so I generate them randomly with Apple's Keychain. I can't possibly remember a random password, so I store them in a text file which I diligently encrypt with a strong master password I remember. Now, if you don't let me paste my passwords I don't have any means to sign in, other than typing a long string of numbers, letters and symbols or picking a simple, non secure password. This practice punishes security conscious users and benefits no one. Please stop doing that.

</comment><comment><USER6> Some of these policies (like not allowing paste into change-password fields) I can understand conceptually; for example, you don't want someone to mistype their password, paste it twice, and then not be able to get in again later. This example works around problems that most people have, and really screws over people who use secure passwords and password managers.

It's that old pattern of trying to be 'clever' to work around a problem, which in turn screws over anyone who doesn't actually have that problem, akin to plugging a sideways AC adapter[1] into a horizontal power strip[2]. The sideways AC adapter is a suitable workaround if you don't have a sideways power strip, but if you do it's often much worse (especially if you have two to plug in).

Perhaps LastPass et al should provide a browser extension to prevent this kind of behaviour in the first place (e.g. removing onpaste events from password fields).

[1] [http://i.imgur.com/zMSX7K2.jpg](http://i.imgur.com/zMSX7K2.jpg) [2] [http://i.imgur.com/AFfgq9a.jpg](http://i.imgur.com/AFfgq9a.jpg)

<comment><USER7> _for example, you don 't want someone to mistype their password, paste it twice_

And right there, you've made the wrong assumption that so many have in this thread; the whole _point_ of password managers is that you're _not_ typing anything in, ever. You generate the password, preferably in your password manager, _then_ paste it twice. No possibility of typos.

</comment></comment><comment><USER8> This bit me in the ass the other day when trying to change my PayPal password (because, you know, the company that owns them can't be trusted to securely manage my password in the first place). So not only could the 32-byte hexadecimal password I'd generated not be used at all, I had to manually type out the first 20 characters of it. Twice. The punchline was that PayPal rates the password as "fair" whilst hindering the best method of making it more secure.

</comment><comment><USER9> The opposite should be true: you should only be allowed to paste passwords.

In fact password keepers should put passwords onto the clipboard into some custom format that the password controls know about so that you have to paste from a tool. And then mandate that the password is at least 256 characters long. That would help move us in the right direction.

<comment><USER10> While I'm hoping this is a hyperbolic suggestion, it's almost certainly a bad idea to use the clipboard for this sort of thing, because none of that is sandboxed properly, and creating a special format that says, "I'M A PASSWORD" sounds to me like designing an API for malware authors, frankly.

At the moment, it seems like copy-paste in passwords is a nice intermediate step between the "password you can remember" era and an era where we have secure keyring managers. In the end, you can imagine that you'd want them stored not on the clipboard (where anything - including Javascript running on a site - can get them easily), but in a secured area of memory, and entered on demand on trusted sites.

</comment></comment><comment><USER11> I imagine that some of the examples are just left over from when browsers were allowing reading from the clipboard from js. In which case having a password in your clipboard was a huge security vulnerability.

Even if the issue has been resolved, few companies seem to be in a hurry to remove parts of their security policy.

</comment><comment><USER12> For throw away accounts I paste my password on the browser URL field and drag to the password input. So hardcore.

<comment><USER13> I hope you're not doing this in a browser like, for example, Chrome, where it sends everything you type into the address bar to Google.

</comment></comment><comment><USER14> I downloaded Hawken and played it once and enjoyed. When I went to play again I realized that I would have to type my 20 character random password in in order to be able to play, alt tabbing between the password manager and the game repeatedly.

I uninstalled the game.

<comment><USER15> I thought Hawken completely moved to Steam. It still asked for your password?

</comment></comment><comment><USER16> If I can't paste directly, I'll paste it elsewhere (except URL address bars). And I must ensure that I did not copy password right before I open a flash.

</comment><comment><USER17> 1\. Disable js. 2\. Paste. 3\. Reenable js. (Of course this assumes you're using a browser where it is easy to disable js.)

</comment><comment><USER18> There's an extra reason why pasting might be disabled on password creation fields: to prevent typos. If I mistype my password in the first box and then copy-paste it into the second, the text will match and my account gets given the mistyped password. You'll then never be able to log in.

If you force the user to type the password in twice, typos will be spotted immediately and can be fixed.

None of this affects password lockers like LastPass since they can autofill these forms in despite the HTML.

<comment><USER19> The thing is, you can't copy FROM a password field. So you need to type it somewhere else first, and it will probably be readable there.

<comment><USER20> Wooosh! Time to re-read your "HTML for Dummies book"

</comment></comment></comment><comment><USER21> Two things. 1) Change password screens want you to enter the new password twice so that a typo doesn't end up in your password and prevent your own access in the future. If you copy/paste you will be copying any typo and circumventing this mild protection. 2) The whole time I kept thinking this forces people to type their password which makes it an easy target for key loggers - which are AFAICT designed to snif user credentials.

<comment><USER22> You cannot copy a mistyped password, because password fields by default forbid _copying_.

</comment></comment><comment><USER23> This all seems rather bonkers. But 1Password isn't exactly the impartial "they've spent more time thinking about this so they must get it right" party. Their entire product and way of thinking depends on being able to auto-enter passwords. Anything that interferes with that, _regardless of whether it works or not_ , is going to get a thumbs-down from them.

As for pasting into the second password field on change-password, maybe they don't want people copying out of the original field and pasting into the second? I'd get that, and the organization-wide costs of password recovery are probably very significant for a company like PayPal. . . . But don't all browsers already disable copying out of password fields?

This is the silliest kind of arms race. Users try to keep ahead of security nonsense, and self-styled security gurus keep on trying to stop them.

<comment><USER24> > But 1Password isn't exactly impartial ... their entire product and way of > thinking depends on being able to auto-enter passwords.

You're not just talking about a product, 1Password, you're talking about the whole class of password managers - 1Password, KeePass, lastpass etc. [http://lifehacker.com/5944969/which-password-manager-is- the-...](http://lifehacker.com/5944969/which-password-manager-is-the-most- secure)

There are many and they all do this. Many of them also offer "auto-type" i.e. simulated keystrokes, as an alternative to paste. It works even when paste is disabled.

On the whole, using a password manager is a very good thing: [http://anthonysteele.co.uk/nobody-knows-anything-about- passw...](http://anthonysteele.co.uk/nobody-knows-anything-about-passwords) [http://www.troyhunt.com/2011/03/only-secure-password-is- one-...](http://www.troyhunt.com/2011/03/only-secure-password-is-one-you- cant.html)</comment></comment>


How a weapon against war became a weapon against the web - <AUTHOR> https://www.theverge.com/2017/4/14/15293538/electronic-disturbance-theater-zapatista-tactical-floodnet-sit-in <comment><USER2> i speculate, putting kidz in jail for hacking, made room for the criminals. But hacking is still childs play. it was a long time since i saw "hacked by" on a web site, now the hacks are silent, and the servers are used as drones by criminals to make money.

</comment><comment><USER3> I would be curious what a decentralized Cloudflare would look like. Right now it seems like they are the main player against attackers online

<comment><USER4> The closest us probably IPFS or Storj at the moment. I'm sure there's other players.

</comment></comment><comment><USER5> So FloodNet was the ancestor of LOIC?

<comment><USER6> Id say ping floods were first, although I had good results cating executables thru the modem and getting interesting crashes. I guess that is more like ghetto fuzzing.

<comment><USER7> +1 ghetto fuzzing

</comment></comment></comment><comment><USER8> DDoS continues to look like an economic problem; we should not have grown used to the idea that small amounts of bandwidth are effectively a free good.

<comment><USER9> Or the lack of distributed networks. If available bandwidth for serving content scaled with demand for it it would be more difficult to attack it.

<comment><USER10> How would that work for malicious nodes in a distributed network? A torrent will be DoSed if there are 10,000 leechers for every seeder.

<comment><USER9> you are assuming that torrents only work when there are seeders, but that's not true at all. Seeders simply provide surplus bandwidth, allowing a torrent to operate on altruism. In the worst case where almost everyone is downloading it degrades into tit-for-tat behavior where everyone gets as much as others are willing to provide based on their current contribution, which still scales with the number of downloaders.

Maybe I should have mentioned one other condition. The network must be distributed and consist of nodes with symmetric bandwidth. If you have symmetric bandwidth you can upload as fast as you download and thus on average the network won't need altruistic nodes to saturate everyone's downlink.

We could go even further and demand ISP-local source-specific multicast, then you would have massive bandwidth multiplication for uploaders, making it trivial to replicate popular content. Alas, that seems to be a pipe dream.

<comment><USER10> > you are assuming that torrents only work when there are seeders, but that's > not true at all.

No, I'm saying that if someone is trying to DDoS your torrent, the bandwidth doesn't scale with the number of downloaders because all the malicious nodes are using download bandwidth but (deliberately) not providing upload bandwidth. I was playing a bit fast and loose with the term "leecher" (I meant someone downloading but <i>not uploading at all</i>, as opposed to active participants in the swarm), but I thought that was understood. Even if you had a system where people were prioritized based on how much they were sharing, there are a lot of ways to get around that protocol with a big enough botnet.

Don't get me wrong, the built-in scaling features of things like torrents are great, I'm just saying I don't see an easy way for it to solve DDoS because it relies on cooperation from the participants.

<comment><USER9> Well, that depends on what kind of ddos we're talking about. The primitive ones simply pick a server and flood it with some kind of request. The distributed part makes it harder to block and provides more bandwidth than most single points can take

If you make your content distributed it can be mirrored by many more nodes than are needed to satisfy demand, removing some of the asymmetry while also making it more difficult for the attacker to pick his targets. Note that p2p networks can also respond to demand. E.g. in torrents clients don't seed all the content they have all the time, they first check statistics which swarms could use the bandwidth most. So if there were some content under attack by fake downloaders it would look like a swarm in need of extra bandwidth and thus more real nodes would join it to serve content, thus making the attack more costly.

> Even if you had a system where people were prioritized based on how much > they were sharing, there are a lot of ways to get around that protocol with > a big enough botnet.

With a big enough botnet you can also take out any ddos protection service.</comment></comment></comment></comment></comment></comment>


Ask HN: Should we be Co-Founders? or CEO and CTO?  - <AUTHOR>

We graduate in May. He is a badass coder. I've done sales, design, growth hacking and everything uncoded.
Seems silly to take a title like "CEO" or "CTO" when there is nothing but an idea. Seems equally silly to avoid a critical conversation and leave roles ambiguous.
I understand that titles are somewhat arbitrary and meaningless. But I also understand that they serve some purpose.
EDIT: We have several ideas we are vetting. We are at different stages with different ideas. Some have prototypes. Some are just ideas. <comment><USER2> Personally, I prefer when people just say they are co-founders when there are no employees at the company. Kind of pretentious to introduce yourself as the Chief Executive Officer of no one.

</comment><comment><USER3> The most important thing you can do now is establish clear roles if you have identified your solution to the problem you guys are tackling. For example you both may code but one of you can take on the Role of Execution, meaning you will be in charge of executing any ideas the two of you come up with. And your other Co-Founder can take on the role of Strategy or Technical, meaning although he might not be the best at executing the idea or sales he can definitely understand how to get there. It really depends on your relationship and both of ya'll strengths and weakness. Anyhow I would suggest taking on these specific roles for now until you can validate the solution you are creating and gain some traction.

</comment><comment><USER4> As the other guys have mentioned, titles mean nothing. Equity and the controlling stake mean everything.

The guy with 51% (or maybe 50.1% or maybe the adequate amount in your jurisdiction) has majority voting rights and he is the one who calls the shots.

According to what you have said, you guys are already at different stages with different ideas, which means you're in quite deep without any formal equity structure.

This will always hurt you later on, even if the co-founder is your own sibling!

Get the equity right and then just be co-founders.

</comment><comment><USER5> Similar to other replies the most important thing is the definition of roles.

As a tangible example, our startup (team of 7) we actually use both within our title. Co-Founder and CEO. Externally this is good, because it provides initial guidance for others who are getting to know the company and aide them in making some initial judgements. For example the CEO is going to be the one responsible for raising money, acquiring customers, recruiting, etc.

So if it walks like a duck, and quacks like a duck, no reason to wait to call it a duck.

</comment><comment><USER6> It seems you are conflating two different topics here, one of splitting future titles and working order and the other of presenting things externally.

Figure out now how you intend to split the roles between you and how you intend to work together. The CEO will be in charge of the CTO.

After you figure that out figure out how you are going to present things externally and on business cards. For a two person company co-founders seems better but it really depends on you two and your views.

</comment><comment><USER7> CEO will hold more power than CTO. It just does, no matter how informal it is at that stage. It is the traditional leader's name. If that person makes it a routine of calling him/herself CEO, they will appear more powerful than you, even if you have equal equity and you write "CTO" on all of your stuff and in every conversation.

</comment><comment><USER8> Co-Founders. In my opinion, the titles CEO and CTO are only important in the context of large companies where you need to designate separate sectors and have a figurehead for each of those.

At this stage, you're both going to be working so closely together that making such a rigid distinction is kind of pointless.

</comment><comment><USER9> I think any conflict later on will be disastrous. So why not decide beforehand. Decision can be altered but atleast there will not be any confusion for the initial period.

</comment><comment><USER10> Don't worry about titles at the idea stage.

<comment><AUTHOR> Thanks for the comment. To clarify: We have several ideas we are vetting. We are at different stages with different ideas. Some have prototypes. Some are just ideas.</comment></comment>


Google Video shutting down, disabling public downloads on April 29 - <AUTHOR> http://techcrunch.com/2011/04/15/google-video-prepares-to-enter-the-deadpool-for-good/ <comment><AUTHOR> Archive Team is already on it; they're in #archiveteam and #googlegrape on EFNet. I don't think that their backup will be complete or highly available, though.

<comment><USER2> Why not just ask for the disks from google?

<comment><USER3> Videos on GV are stored in some Google-proprietary database, so just shipping the physical disks probably isn't useful.

<comment><USER4> The spirit of his question stands: Why not ask for a database dump from Google?

</comment></comment></comment></comment><comment><USER5> This finally pushed me to move Simon Peyton Jones's presentation on How to Give a Good Research Talk from my Google Video account to YouTube. The original recording unfortunately has dodgy audio and video quality but it's still a gem of a talk. Check it out:

<http://www.youtube.com/watch?v=y1knJ6GIUr0>

It's lucky they recently removed the 15 minute limit on my YouTube account. I would probably not have had the patience to chop up the video.

</comment><comment><USER6> Why not automatically transfer all Google Video content to YouTube?

<comment><USER7> There is so much abandoned and bullshit video on there, it couldn't possibly be worth it.

<comment><USER8> There were a lot of great longer videos that were hosted on Google Video leading up to their acquisition of Youtube. Now, I won't argue that the majority of the videos there are worthwhile, but it seems to me that a company whose self-professed goal is to "organize the world's information" really shouldn't be in the business of deleting large swaths of it. Google isn't exactly hurting for storage capacity; what harm could come from rolling the videos hosted there over to Youtube? It certainly couldn't hurt the average quality of Youtube.

I'd hope that the company that runs Google Books, that saw the value in ReCaptcha, that has cached the majority of the public-facing internet, that has mapped most regions of the world, and that provides satellite images of most of its surface wouldn't erase that data simply because they'd like to reuse the harddrives.

<comment><USER9> I have to agree. Two weeks notice? WTF, Google. The evil meter is dancing.

If you want people to trust you with their data, you should demonstrate more responsibility. And just because the hosting's been "free", doesn't mean you haven't made your pound of flesh off the advertising (speaking generally, at least).

Here's a thought: Shove it through YouTube. Heck, just keep the data around and convert and cache when an item is hit (those who really want it will wait out / return after the conversion). I suppose you need to be able to tie back to Video accounts for ownership, DMCA, etc. Still, there should be a better solution. And a couple of weeks' notice simply isn't fair. What if someone's tied up? On vacation? They're hosed.

Put it this way: Demonstrating yourself to be a source of "public" data loss, is rather bad PR.

<comment><USER10> They gave notice years ago that they were phasing it out. You haven't been able to upload anything in years. Frankly, I'm surprised it took them this long.

<comment><USER9> Well, then, I guess that compensates somewhat. Still, I'd suggest announcing the hard date 3 or more months in advance (I'd prefer 6). People become busy and complacent. And people may not quickly realize that a work they value has been abandoned by its original poster.

On the upside, they are "allowing" downloads. I guess I should acknowledge that as a serious positive.

I may have become sensitized by years of management that had similar attitudes towards changes. Push, push, push... until suddenly, we're abandoning this, NOW.

Different settings, but not entirely dissimilar feelings evoked.

<comment> X-Istence Google announced this back in 2009, people have been able to download their video's since then.

Uploading was also stopped in 2009, so crying foul now is just unwarranted.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> The only problem I ran into was that there was no download link/button. Despite what their directions said, I currently _have_ no way to download my old video because there's no link!

<comment><AUTHOR> This works for me:

      python youtube-dl -t google-video-url

<http://rg3.github.com/youtube-dl/>

<comment><USER12> youtube-dl is great, and I find it to be well-maintained also; if ever it doesn't work, I just go see if there is a new version, which there invariably is, and which invariably works. It seems to have a decent feature set, too.

I've had problems with every other youtube downloader I've tried, and none with youtube-dl.

<comment><USER13> If you haven't used this already,

        youtube-dl -U

</comment></comment></comment></comment><comment><USER14> Does anyone know what happens to video uploaded through Blogger? Google says it puts it in Google Video but there is no options for me to download the video that has been uploaded. I'd email Google but... oh ya... They don't do support.

<comment><USER15> Just use keepvid.com or tubeminator.com to dw ur videos.

</comment></comment><comment><USER16> What a nuisance. It will take me an hour to transfer my stuff that I want to save. Er.

</comment><comment><USER17> Even if everybody reposts their videos on youtube, the links to them will be broken. Google could avoid that by moving everything to youtube themselves and putting up redirects at the original urls.

</comment><comment><USER18> For the love of god, please please please download as much as you can and post it on BitTorrent and Archive.org or some other site.

</comment><comment><USER19> That's really frustrating. I don't think the Internet Archive has been saving copies of the videos, have they?

</comment><comment><USER7> Respect.

Edit: not a good comment for HN. More: it was a great service, and it had a good run. And mad respect for Google for running it well but shutting it down gracefully.

<comment><USER20> I don't consider 13 days notice to be graceful. Imagine someone going on holidays for two weeks and coming back to find out their beloved video is lost forever.

Google isn't obligated to give a fair amount of notice but it'd be a nice thing to do. Don't be evil.

<comment><USER21> The TechCrunch article says people have until May 13 to download the videos. You just can't stream them after April 29.

Still, this is a pretty bad job on Google's part IMHO. More notice would have been good. (What if people were traveling or were sick for a month or something?) Plus Google should have an option to automatically transfer videos to Youtube.

Can't understand why Google's messing this up so badly.

<comment><USER9> In terms of public relations (when it comes to the "unwashed masses"), Google has _always_ been a very reactive company. This is at the core of some of their most intractable problems / failure to perform (e.g. "social").</comment></comment></comment></comment>


Tips For Entrepreneurs Before Making The Move To Silicon Valley - <AUTHOR> http://startupgrind.com/2012/10/tips-for-entrepreneurs-before-making-the-move-to-silicon-valley/

<comment><USER2> This article is mistitled. It should be "Tips for Entrepreneurs _Seeking Investment_ in Silicon Valley". There are tons of ideas that don't need investment.

> A great way to find out if you have a really killer idea is to go and ask > 100 random people on the street.

I so disagree. I really don't think most people know what they want until they see it. Sometimes things that sound cool in the abstract are lousy in real life, and sometimes things that sound abysmal in the abstract are actually awesome. Plus, a random sampling of 100 people may well be completely inappropriate. If you're not reaching out to the right 100 people you're going to get some very misleading results.

> You can now launch your startup via Facebook, Twitter, and LinkedIn as well > as get coverage from companies like TechCrunch.

This isn't a marketing strategy! A launch is just the beginning, and probably the most insignificant portion of the uphill battle in user / revenue generation!

\--

Anyway, my pedantry aside, this article provides a healthy dose of realism that so many people, especially those seeking investment, sorely need.

</comment><comment><USER3> Agreed regarding traction... Zuckerberg had plenty of traction on Facebook before moving to the Valley. I look at that as a good model if moving wouldn't be affordable or easy.</comment>


Epitath: In Memoriam React Render Props and HOCs - <AUTHOR> https://medium.com/astrocoders/epitath-in-memoriam-render-props-and-hocs-9f76dd911f9e <comment><AUTHOR> Epitath: In memoriam React Render Props and HOCs. We are releasing Epitath as a way to show other ways to compose and use async code in React</comment>


Ask HN: 50/50 CoFounder Split - <AUTHOR>

Does anyone strongly suggest against it? <comment><USER2> A theoretical case is always made against the risk of deadlock, and it is a very real risk that I have seen lead to disastrous results at times.

With small-business type clients, where buy-sell agreements are the norm, you would normally want to have some special provisions for breaking deadlocks as well.

With startups (i.e., ventures that are intended to scale comparatively quickly over time), though, the norm is not to have such agreements and, indeed, those agreements will get in the way of normal funding, etc. and prove counter- productive in most cases.

In practice, then, an overwhelming number of startups do 50/50 type arrangements and it is very rare in my experience that a problem arises with this. I would be more cautious if it is an opportunistic teaming than if you know your co-founder fairly well and have a good sense about his character. This also assumes that the contributions are equal. 50/50 is a bad idea just to achieve a sense of comity if one founder is in fact more of a contributor than the other.

If you do have doubts of any kind, then you can usually achieve formal voting control even if the equity interests are otherwise equal by using a simple voting agreement to assure this. In such a case, there is a delicate balance between formal control mechanisms and the "spirit of the deal," which you shouldn't violate lest you do damage to the important relationship you have with someone as important as a co-founder.

</comment><comment><USER3> I think that it depends on what phase of the project you are in when you start working together.

If you start working on a protytype / v1 together then 50/50 makes sense but if you have already started / are close to being done w/ a prototype when you start working together then 50/50 would not make much sense to me.</comment>


DongleGate: A Legal Perspective and some social commentary - <AUTHOR> http://codebetter.com/johnvpetersen/2013/03/22/donglegate-a-legal-perspective-and-some-social-commentary/

<comment><USER2> Pretty interesting analysis and ties in well with this other one from quora (via forbes)

[http://www.forbes.com/sites/quora/2013/03/22/was-it- appropri...](http://www.forbes.com/sites/quora/2013/03/22/was-it-appropriate- for-adria-richards-to-tweet-a-photo-of-two-men-at-pycon-and-accuse-them-of- being-sexist/)

I take issue with this:

"One thing we can agree on, there is a massive lack of maturity in this business."

While true, the more general truth is that humans are human, fallible, full of mirth and wit and a need to socialize, laughing like chimps (and vice versa). Primates.

Zero tolerance is for robot species. Allowances must be made for errorful humans. This is why I dislike the firing of both of the people, though I agree that Richards' firing is much more justifiable. (The two CEOs had an opportunity to earn their pay and take a leadership stance that day.)

I do applaud Richards for one small thing in this. She tweeted those pictures using her name.

There are sites out there like the ihollaback sites that encourage the same exact behavior that Richards did, but allow their users to do this completely anonymously, and the people so shown and maligned no recourse.

Because of the cause ihollaback purports to advance, ihollaback drew a lot of acclaim when it launched, and still does. We should consider that.

</comment><comment><USER3> To establish all the elements of a tortious interference case, wouldn't the fired engineer need to provide evidence that the Tweeter's intention was to get him fired? Tortious interference requires a deliberate attempt to actually interfere with a contract you knew existed. Here, it's hard to argue that the Tweeter even knew the fired engineer was employed; he could just as easily have been a freelancer. That's before you get to the awfully murky claim that anything negative you say about somebody on Twitter must be an attempt to get them fired.

<comment><USER4> If I was bringing such a suit, I'd focus on the content of the blog post where she mentioned his verbal acknowledgment that the firm was a conference sponsors, and argued that wearing a shirt with his employer's logo made him a representative of the firm, the implication being that he was unfit to carry out his duties as a corporate representative.

I couldn't tell you if there's precedent for that; I haven't looked. If so, it might just as easily support a counter-suit for IIED or NIED. I hope nobody files any lawuits; if they do I'm going to take a vacation from HN and stick my head in a bucket of water until it's over.

<comment><USER3> Oh, good point about the conference sponsor stuff.

Still: there's a big gulf of persuasive evidence between saying someone is not acting in the moment as an effective representative for their firm, and in directly procuring the severance of an employment contract between them and their employer.

I think this case, or any case in the other direction, is extremely far fetched.

<comment><USER4> Indeed. Likewise, a counter-suit would be reaching for the outer limits of what constitutes emotional distress. That's why I'm hoping it won't end up in court; both sides would have to make stretch arguments, and the underlying issues would get lost in all the kindergarten Constitution-thumping and posturing.

When I was a young internet evangelist I used to think that always-on internet availability would lead to a breakout of civil communication in some sort of 21st century Agora. Unfortunately, I overlooked the fact that people behave badly in crowds.

</comment></comment></comment></comment><comment><USER5> Surprising argument from a lawyer: the "right to be offended" is one of the most pointless, meaningless and hollow arguments there is, legally or otherwise.

Especially when it's followed by the complete and utter nonsense "others should respect that".

No, they damn well don't. Everybody has the "right" to think the sky is green and the grass is purple. That doesn't mean anybody else has to respect that.

Claiming the right to be offended and the obligation to respect that is the argument of religious and ideological fundamentalists.

</comment><comment><USER6> This was a surprisingly interesting read, compared to what else has been written about the event so far. Someone should turn this into a little Grisham-style legal drama for the twitter age.</comment>


Best rational approximation  - <AUTHOR> http://www.johndcook.com/blog/2010/10/20/best-rational-approximation/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheEndeavour+%28The+Endeavour%29 <comment><USER2> Basically this is a binary search on the Stern-Brocot tree. See <http://en.wikipedia.org/wiki/Stern%E2%80%93Brocot_tree> for more.

</comment><comment><USER3> Also known as: Invoke the (extended) Euclidean algorithm on 1 and x.</comment>