Confusing Crypto Blobs - <AUTHOR> http://daeken.com/confusing-crypto-blobs <comment><USER2> It is absolutely not the case that people tend to get encrypted blobs right nowadays. All-zeros IVs, ECB-mode encryption, failure to authenticate date, repeated CTR nonces, wrappable/seekable CTR counters --- these are all things that we've found just within the last several months.

Major components of popular high level web stacks have had bugs of this severity lurking in them for years.

<comment><USER3> what's seekable CTR counter mean (i know what CTR mode is)? would appreciate a reference if you have one. thanks.

<comment><USER2> CTR generates a keystream using a nonce and a counter as inputs; neither the nonce nor any single value of the counter can be used for more than 1 item of data.

<comment><USER4> If you find this kind of stuff interesting, take Dan Boneh's Cryptography class on Coursera. It covers issues like this very well...

<https://www.coursera.org/course/crypto>

<comment><USER3> as i said, i think i understand CTR mode. or thought i did. i was more curious about how you could seek to a particular counter value. and then was even more confused by the idea that _neither_ nonce nor counter can be repeated, as i thought it was the _combination_ that had to be unique. so maybe i do need to take that course. hmmm.

<comment><USER2> There are systems that use CTR mode as a way to do "random access" bulk encryption, because Schneier suggested that in both his major crypto books.

The specific exploitable condition is indeed the recurrence of a specific nonce/counter tuple; the point is, there are systems in which attackers can induce that condition, as opposed to simply having the system blunder into it (for instance, by using the same nonce every time).

<comment><USER3> ah, ok, thanks. "random access" makes everything much clearer.

<comment><USER2> You end up with similar problems when you try to use CTR with 64 bit block ciphers, like Blowfish and DES-EDE --- both of which are very common.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Can anyone offer any insight as to why you wouldn't generate a one-time random string with a short lifetime for password reset emails? Sending a blob with data in it (encrypted or otherwise) seems like a potential information leak with no upside.

<comment><USER2> That is exactly what you should do. The only upside to sending semantically meaningful data in email tokens is that parsing the responses doesn't require a central database lookup --- but that upside itself comes with the downside of losing the control that a simple database table gives you over outstanding tokens. And that's not really an "upside"; it's just a convenience.

Don't encrypt reset tokens. Send random strings.

<comment><USER6> You have to be careful though. If someone managed an SQL injection and can read tables, but you are using bcrypt hash properly, you might think you are [somewhat] safe. (i.e. at least they can't write anything.)

But if they can read the password reset tokens from your database they can login as any of the users. (This is especially bad if changing a password doesn't invalidate "keep me logged in" cookies.)

The solution is to treat those tokens as passwords, and hash them as well.

(I know this because I had to clean up after this exact senario happened to someone using Joomla. They got an admin login from a password reset token, from there they were able to write files to disk and fully take control of the server.)

<comment><USER2> If you're writing injectable SQL queries, there is nothing I can tell you about crypto and password resets that can help you.

Not all vulnerabilities are equally easy to blunder into. We can presume a competent development team will avoid SQL injection, or at least, will discover accidentally introduced SQLI quickly through testing. The same is not the case with crypto flaws.

<comment><USER6> In that case why bother using bcrypt? After all your queries are perfect and no one can access the database.

I'm being sarcastic if it wasn't obvious.

<comment><USER2> Another way to think about it is: if you're using an SQL database at all, you've signed up for SQLI mitigation whether you use the database for reset tokens or not. However, you still have the option of not having to deal with crypto bugs.

</comment></comment></comment></comment></comment></comment><comment><USER7> > but if you can put in any data you want, you could poison the compression > enough to put it into a bad state -- one where effectively nothing > compresses properly, and you end up with your own data completely in the > clear.

This sounds interesting, and completely counter to my understanding of how compression works.. I thought CRIME's innovation was to exploit compression ratios as a proxy for cleartext. Poking a compressor into emitting probabilistically assigned bit-aligned symbols that happen to correspond to its input seems unlikely.

<comment><USER8> A lot of compression algorithms use fixed size dictionaries over a window. Let's take the canonical example of zlib/gzip, which does this.

With careful control over the data, you could make it so no dictionary lookup would ever succeed. This would mean no strings would ever be eliminated through backreferences.

Most also have a minimum match length, making your life a bit easier here. Most also are outputting encoded streams that basically a little decompression VM (IE literal, 0, backreference, 255 bytes ago, size 30). Because of this, they will not eliminate duplicates where the match is too small (only 2 bytes).

This will get you past the duplicate elimination phase, but not the huffman phase.

Getting past the huffman phase is harder. To get it to output a stored block, you have to convince it the raw literal length of the block will end up less than the length of the block as encoded.

For zlib, we have opt_len = (sizeof (compressed data in bits) + sizeof (huffman tree in bits ) + 3 + 7) / 8

if (stored_len+4 <= opt_lenb) use stored block

So you do have some chance to beat it by messing with the probability distributions, and do get a little leeway.

On the plus side, you only need to mess with the probability for a single zlib block, not the whole shebang.

</comment></comment><comment><USER9> Other than forgot-password, why use blobs at all? Only other rare use of blobs that I can think of is proxying users from one domain to another (single sign- on, session sharing etc.)

Why would a site use blobs for reporting?

<comment><USER10> I dont get why you would bother using a blob for forgot password.. Isnt something like reset.php?account=joeblow&auth=md5(accountname/secretkey/first10charsofcurrentpasshash/yymmdd) enough?

You cant replay attack the reset link once its used, it expires in 24 hours and so long as the 'secretkey' was sufficiently unique, you wouldnt be able to bruteforce or crack it.

All the php script needs to do is attempt to build a 'good' md5 hash and see if they match- if they do, let you input a new password to store.

<comment><USER2> An attacker can do an offline brute-force attack on the "secret key" in this scheme, since attackers can be presumed to know at least one valid password in the system.

Just use a random string as a primary key for a token table in a database and be done with it.

<comment><USER11> The secret key could easily be huge without much of a penalty, though.

<comment><USER12> Why go for a second rate solution when a first rate solution has the same operational costs?

<comment><USER11> No idea. Just saying that the stated objection need not apply.

</comment></comment></comment></comment></comment></comment><comment><USER13> Why do they even need to store arbitrary data in the blob at all? You can simply use it as a token-id for the server. While it does dramatically increase the amount of data that needs to be stored, and accessed, it nearly prevents attacks like this.

</comment><comment><USER14> TIL, you can make significant money bug hunting.

<comment><AUTHOR> It can be good money, but it can also be a big time sink; really just depends on the site. CCBill was super easy for me on the whole, but I've struggled with others: I only found 3 or 4 bugs in PayPal, never found anything in Facebook, etc.

<comment><USER15> What was you experience with the PayPal bug bounty? It seems there's a lot of negativity (like [http://l8security.com/post/33876600904/paypal-bug-bounty- a-l...](http://l8security.com/post/33876600904/paypal-bug-bounty-a-lesson-in- not-being-a-fuckup))

<comment><AUTHOR> I submitted a couple bugs a while back, and they asked for some clarification on one of them which I didn't ever take care of (just haven't had the time or motivation). Given that, I really don't have any opinion on their bounty program either way thus far; should I ever put some real effort into it, I'll probably write about my experience.</comment></comment></comment></comment>


Image Spark released - <AUTHOR> http://www.imgspark.com/ A creative tool - FFFFOUND with tags and screenshot capabilities. <comment><USER2> nice looking site, beautiful demo. However, I think your homepage needs more info about what it is really all about.

I'd take a bit more info from your ABOUT US page, and either put something about your value prop on your homepage, or at least in the video demo.

Nice work. Love the clean design.</comment>


Active shooter drills don't protect students or help stressed teachers - <AUTHOR> https://www.usatoday.com/story/opinion/voices/2019/05/23/teachers-active-shooter-trainings-ineffective-stressful-column/3754113002/ <comment><USER2> The article itself doesn't contain any research statistics, but links to one site that did some research. The results of which were inconclusive. Also of note, the purpose of active shooter training isn't to prevent the situations, but to save lives if it does happen. I do agree that training for these situations doesn't address the root cause, and I would love to see that get addressed. Is there a technological approach that can be taken to help the psychological and social issues that drive these events?</comment>


Fixing the Python subprocess interface - <AUTHOR> http://amoffat.github.com/pbs

<comment><USER3> FWIW, re-replaying the stack trace to figure out what was imported and re- implementing it is a horrible idea. There are much better ways to do this type of import voodoo, specifically the import hooks that Python ships with. Here's an example of their use inside a small side project of mine: [https://github.com/tswicegood/maxixe/blob/master/maxixe/__in...](https://github.com/tswicegood/maxixe/blob/master/maxixe/__init__.py)

All that said, this is horribly un-Pythonic. A much better route to so is something like envoy[1] which simply wraps `subprocess` in a sane API.

[1]: <https://github.com/kennethreitz/envoy>

<comment><USER3> Just to clarify. I applaud this type of development for people trying to learn various parts of Python like playing with the stack, but the idea of this being used in the wild scares me a bit.

<comment> steve-howard It's like operator overloading for novel syntax in C++. It worked all right for iostream, but if you've ever seen boost::spirit you can see that even very smart people can make very weird things happen by trying to kludge features into new syntax.

</comment></comment></comment><comment><USER4> It's odd that the import mechanism is abused here to make objects "out of thin air". The fact that "from pbs import ffmpeg" works only if ffmpeg is actually on the path is somewhat surprising.

I think the more comfortable (and Pythonic?) way to do this would be to explicitly create these command objects:

       >>> import pbs
       >>> ffmpeg = pbs.Command('ffmpeg') # or '/usr/bin/ffmpeg', perhaps
       >>> result = ffmpeg(...)

[Edit: I really like the concept of using Python's positional and keyword arguments to construct a shell command, though. Great insight there.]

<comment><AUTHOR> Hi! Author here, there are a few ways to use it, including your suggestion (did you make your suggestion up or were you pulling from the docs?):

        # magical, designed only for single shell scripts
        from pbs import *
        ffmpeg()

        # less magical
        from pbs import ffmpeg
        ffmpeg()

        # or
        import pbs
        pbs.ffmpeg()

        # no magic
        import pbs
        ffmpeg = pbs.Command(pbs.which("ffmpeg")) # command takes full path
        ffmpeg()

I tried to cover the main use cases adequately. My goal was to ease a pain point myself and others have experienced, that other popular packages don't address well unfortunately.

If it's helped anyone like it's helped me, I'm happy and glad to share!

<comment><USER4> Wow -- no, I entirely missed this (and just happened to end up with the same name). Thanks for clarifying.

</comment></comment></comment><comment><USER5> Neat but way too magical for my taste. The code to figure out what to do in the case of 'from .. import *' is particularly ugly.

Perhaps the commands should accessible from an object you import. That's slightly more typing but more explicit and would not require ugly magic. E.g.

      from pbs import sh
      print sh.ifconfig('eth')

If it's not clear, the 'sh' object could override __getattr__ or __getattribute__ and wrap commands as necessary.

<comment><USER6> Anything that encourages a from ... import * usage is evil irrespective of its implementation.

<comment><USER7> Why?

<comment><USER8> Because it leads to namespace pollution and hard-to-track-down bugs.

It's especially bad in this case where adding an executable in the system can suddenly shadow any built-in name (e.g. imagine someone adds a "print" or "sys" executable).

<comment><USER9> Refactoring is also made much harder with import * if you have cascading modules. I have a pylint hook forbidding these before committing to our hg repo

</comment></comment></comment></comment></comment><comment><USER10> So many people saying this is "too much magic". Whatever, I'm into it. The idea of commands being functions that can just pass their output to other functions is intuitive, and passing arguments as, well, arguments is as well.

It might not be pythonic, it might be a crime against Guido and everything he represents, but it's pretty awesome.

<comment><USER9> I have the feeling you misunderstood the problem with magic. In fact, having a function calling shell command is ok. The problem is to know, from reading the code, where it comes from. In python there is this idea of transparency, the determinism, which is with it feels enlightening, like in the docs cartoon. Anything obscuring that is said to be unpythonic.

</comment></comment><comment><USER11> I use Python for shell scripting a lot. Ignoring all of the issues people have brought up here, I really like how function composition is piping:

      # sort this directory by biggest file
      print sort(du("*", "-sb"), "-rn")

      # print the number of folders and files in /etc
      print wc(ls("/etc", "-1"), "-l")

The reason that I like that method over, say, envoy's [1] method is that _envoy.run('uptime | pbcopy')_ has what I consider code in strings. When I'm writing a script, the programs I'm calling, and how they interact, is part of the "code" to me. I would prefer that they're at the language level, and not represented as strings.

[1] I only just learned about envoy in this thread. Thanks! Sadly, one of the places where I run my Python scripts is a location where I can't install my own packages, and I don't want to deal with using my own install of Python, so I tend to just implement something like this:

      def checked_exec(seq):
        p = Popen(seq, stdout=PIPE, stderr=PIPE)
        stdout, stderr = p.communicate()
        if p.returncode != 0:
            print 'err: ' + stderr
            print "'" + seq + "' failed."
            sys.exit()
        return stdout

<comment><USER8> As long as the package you need doesn't include a C extension (which most don't) you can just ship it with your code (license permitting ofc.) - <USER2> add the path to the libary to sys.path. It's not a very clean solution but can be a real life saver when you have to work on "broken" systems.

<comment><USER11> Sorry, I wasn't clear. This is a system I log into every day, and I don't want to maintain my own install of Python and related packages on it. It's too much overhead. I'd rather just use the default Python, even though it's old.

<comment><USER12> For simple libs I just dump the py file/folder in the same folder as the script and import.

</comment></comment></comment></comment><comment><USER13> This module is a huge hack. It's a neat hack, though :)

I've written what I feel is a much better solution to this problem: Envoy.

<https://github.com/kennethreitz/envoy>

It's pythonic and makes far fewer assumptions about both your code and what you're running.

<comment><USER14> +1 for Envoy. It's a really nice replacement for subprocess (which is awful).

Clint and Requests are worth a look too.. Thanks Kenn!

</comment></comment><comment><USER15> I like Kenneth Reitz's envoy too. He describes it as "Python Subprocesses for Humans™", similar to how he describes Requests, which he also wrote.

<https://github.com/kennethreitz/envoy>

</comment><comment><USER16> Can we please stop titling postings like this? How about "An Alternative to the Python Subprocess Interface". Fixing something implies that it's broken or inadequate, and from my limited experience, Subprocess is already a major improvement over os.system. I'm not saying this idea doesn't have value, I'm saying that the way it's framed lacks the requisite humility it ought to.

</comment><comment><USER17> This is a cute little hack, and quite possibly a very useful one. (And if it isn't useful, then it is certainly interesting and instructive.)

However:

Please, please, _please_ don't use or recommend things like "from pbs import * ". Namespace pollution is bad enough when importing a documented collection of functions. Importing functions that are named based on whatever happens to be in my path at the moment ... that's seriously scary.

But "import pbs" looks like fun. :-) And "pbs.ls" isn't _that_ much to type.

As The Zen of Python says:

] Namespaces are one honking great idea -- let's do more of those!

P.S. Hmmm ... but does "import pbs" work? Haven't tried it.

</comment><comment><USER8> Wow this is so frighteningly magical and will break in many entertaining ways.

For a sane alternative I'd recommend Kenneth Reitz' awesome Envoy (<https://github.com/kennethreitz/envoy>)

</comment><comment><USER18> Reminds me of something I saw not too long ago...

<https://github.com/JulienPalard/Pipe>

It would be really cool (though admittedly less Pythonic) to combine the infix notation provided by the Pipe library to allow more shell-like function chaining.

Instead of this...

      print wc(ls("/etc", "-1"), "-l")

You would have this...

      print ls("/etc", "-1") | wc("-l")

<comment><AUTHOR> There's a few ideas floating around here <https://github.com/amoffat/pbs/issues/6> on how to implement it, but nothing looks really feasible. If you have any insights, I welcome them :)

<comment><USER19> I wrote some code for that a while ago: <https://gist.github.com/1300342>

</comment></comment></comment><comment><USER20> The value/cost of a "hack" is offset by what it provides. If something can be implemented at the same cost in a less brittle and more future-proof way, then by all means label it horrible.

If you think "horrible" hacks are a slight against something that provides an amazing level of functionality to an end user, then you've lost sight of what we're coding for.

</comment><comment><USER21> If you don't like the import *, don't use it. Python supports it, so why shouldn't this library? (not that it's a great idea)

If you'd like to handle missing system executables, catch the exception. You should be writing in that style anyways.

Honestly, this cleans up a ton of system scripting code, making it way more readable/maintainable.

Maybe the code could be cleaned up, but this is the direction that Python should be heading. Abstract away the complications when possible, keep low- level stuff around for when it's absolutely needed.

Beautiful is better than ugly.

</comment><comment><USER22> __Magic!!!!! __

I code in Ruby for a living, and this is even a bit much magic for me. I suppose you can use it in magic-less mode with `from pbs import Command`, and set up your command set manually.

</comment><comment><USER23> It states that the lines

      curl("http://duckduckgo.com/", "-o page.html", "--silent")
      curl("http://duckduckgo.com/", "-o", "page.html", "--silent")

are equivalent. This worries me, I would much rather always have it be one argument corresponding to exactly one shell argument. Here it looks like in some (maybe all?) cases arguments are split on spaces, which means always having to be extremely cautious about escaping, something a good abstraction shouldn't force you to deal with.

<comment><USER24> Exactly. If you look at the sources, you'll see that the arguments are all joined into a single string with spaces, then split back into separate words using shlex.split().

So cat("filename with spaces in it") will fail, but cat("'filename with spaces in it') ought to succeed.

It's a neat experiment, but using this module in production would not be a great idea.

</comment></comment><comment><USER25> Very impressive, but the use of globals and the dynamic lookup mechanism are a little scary. Looking at the source there seems to be some magic involved like hacking the interpreter.

I'd feel more comfortable if it only exported one variable.

</comment><comment><USER26> That's pretty brilliant, well done.

</comment><comment><USER27> This is basically a dynamic DSL. A confusing muddle of syntax and semantics. Will result in pain. Usually when least expected.

</comment><comment><USER28> <https://github.com/Harshavardhana/pbs> \- Refactored the code into more Python library like and still trying to fix the command line import problem.

</comment><comment><USER29> This looks great, but I really don't like the fact that I can't fire up a Python shell and try it out interactively. Having to run pbs.py itself to get a different kind of shell is uncomfortable.

<comment><AUTHOR> This is fixed on master as of version 0.4, just fyi. It has some limitations (no star import) but otherwise works as expected.

</comment></comment><comment><USER7> Why not use pipes for piping? e.g. print du("*", "-sb") | sort("-rn")

<comment><USER30> Would break syntax too much and would make even less sense to python user reading the code. But there is several packages which does this (piping using pipes), maybe you could use that.

</comment></comment><comment><USER31> The import hack is the only thing I don't really like (I'd prefer the `from pbs import sh` syntax proposed elsewhere) -- and without reading the code... is piping really piping, or will the function composition example actually consume the first command result fully first?

Anyway, this is a great idea. :)

</comment><comment><USER32> Too much magic! Too much magic!!

</comment><comment><USER33> With this, maybe having python as a shell will be possible :)</comment>


Ask HN: When will the 'we use cookies' popover end? It's insane - <AUTHOR> I can't take it anymore. On mobile, it's insanity. On desktop it's annoying. On mobile, I can't read an article until I remove [x] the useless disclaimer. Then I need to remove [x] the excessive amount of ads to get to the content. Is the "we use cookies," a law that's here to stay? Honestly, seems like a major annoyance on my tiny little screen as it takes up too much real estate. Does every site need this or can we tell the little sites to chill with that plugin? <comment><USER2> "When will the 'we use cookies' popover end?"

As soon as you disable Javascript. They will not do this to you without the use of Javascript. Take away the Javascript, and the popover technique comes to an end.

</comment><comment><USER3> Just close the tab/window and move on.

I refuse to allow cookies. If websites need to be read, they can forgo the 'cookies' crap. It's not as if my life depends on some random website.

</comment><comment><USER4> i would be concerned about what sort of exploits may be facilitated by we use cookies popups</comment>


Oracles x86 Reference Manual (AT&T syntax) - <AUTHOR> http://docs.oracle.com/cd/E19253-01/817-5477/817-5477.pdf

<comment><USER2> Why is this an Oracle document?

<comment><AUTHOR> not entirely sure, I was looking for a good at&t ref and came across this thought it might be of use to other HNers who do this stuff too. It probably has to do with solaris which I guess belongs to oracle now (from sun).

<comment><USER3> It _is_ very useful, thanks!</comment></comment></comment>


Ask HN: Fear? - <AUTHOR> I am suffering from a very weird fear. I fear that if I do x thing, then other person will gain the benefits of my hard work. I want to hide everything from others, be it learning new stuff, or starting a new task. It is badly spoiling my life.
I want to overcome this fear.
Help me how I can overcome it? <comment><USER2> Just do it.

The more you give, the more you get; might not be awesome profits, might be even better. The secret with giving is to not expect anything in return, the very definition of Karma Yoga; real Yogis practice that all the time.

There's nothing wrong with you, we're being carefully programmed to reason just like this; to mistrust and compete with everyone but our fabulous authorities. Cut down on the mainstream media and social networking if you want the power over your mind back.

</comment><comment><USER3> I used to have this fear too, of telling my friends what I was working on, especially my programmer friends, before I realized there are two types of scenarios:

1\. A person is that headstrong and passionate about your project and will steal it. They steal your idea and become successful.

2\. The person says, "Oh that sounds awesome. Good luck with that." Then they move on with their life and I move on with mine.

In most cases, #2 is more likely and logical, isn't it? How many people have you heard of doing #1? The only time #1 _may_ occur is when you've already established the business and your business partner breaks away and enhances upon your idea.

I don't mind telling people about my ideas or brainstorming because its most likely: I know what I want it to be like, they don't.. they just have a vague idea. They are probably not as passionate about you as your own projects.

Thus: Get to it. Don't let that hold you back. In fact, embrace the times where people actually listen to your idea and give you feedback on it. It really does help.

</comment><comment><USER4> Let it go.

I stopped caring about what other people will think/feel/benefit, it has nothing to do with me.

If you love what you do, then f __* them. Just do it.

This is for you: [http://zenpencils.com/comic/140-invictus-a-comic-tribute- to-...](http://zenpencils.com/comic/140-invictus-a-comic-tribute-to-nelson- mandela/)

</comment><comment><USER5> I wouldn't call this fear. It is more of an insecurity. You seem to lack confidence in yourself. Hence you think that others will gain more from you than you gaining from your hard work.

Think of this as knowledge. The more you share, the better you become yourself. Same with doing x. The more you do, the better you get at it even if it helps others. In fact, if it helps others, even better for you. Most people are not looking to "gain" anything from you or take advantage of you.

Also look at the alternative. If you never do anything because you think someone else will benefit more, you will never do anything for yourself. You are the loser at the end because that imaginary person who MAY benefit more probably does not even exist. I would say most likely they don't exist.

</comment><comment><USER6> My first startup was in Arts space. I used to do Art exhibitions along staircases, where people in companies would walk up the stairs and see photo- journalism stories (instead of taking lifts). I did a few good exhibitions and later closed the startup because of financial reasons.

I was a bit scared that someone established in Arts industry, would take up my idea and because they had more networks and artists, would do a better than me locally and then more people would steal it in different cities.

I tried to go open source later and literally tried that an art gallery or a photographer steals my idea and does staircase exhibitions. I tried to pitch it to people from different countries, they all loved it, said would try it, but never did. I sent them elaborate checklists on how to execute and pitch these exhibitions.

Nobody steals your idea - unless they see that you are making money doing it already. At which point, your idea is no longer a secret.

Since then, I have shared my ideas for months before working on them and received valuable feedback to refine them or weed bad ones out. I have even shared ideas that I thought were patentable - that made me uncomfortable, but no one ever stole them either.

Interestingly, at times I have thought of stealing someone ideas (we were co- founding and I felt cheated). I tried, but could not steal the idea either - though I was the developer. I guess, it is a lot of work to steal an idea.

And my latest startup idea is a game - [https://halfchess.com](https://halfchess.com) . I shared it for a few months before starting to build it.

It can still make me uncomfortable to share an idea at times. So I stopped sharing ideas with people who make me feel uncomfortable or don't have a constructive feedback.

</comment><comment><USER7> You should read "Give and Take" by Adam Grant. It clearly shows all the benefits of being a Giver rather than a Taker. I've written down my learnings [0], since I really enjoyed reading it.

\- [0] [https://www.robinwieruch.de/lessons-learned-give-and- take/](https://www.robinwieruch.de/lessons-learned-give-and-take/)

<comment><USER8> This is great!

</comment></comment><comment><USER9> 99.99999% of the things you enjoy in life will be from the benefits of others' hard work. The rest is your contribution. Your contribution will make almost no difference to the lives of others, even if you are Steve Jobs. The math just doesn't favor individual contributions a whole lot. Don't worry about it.

</comment><comment><USER10> You need to think it through. Imagine the worst case scenario, that you do all the hard work, and then someone really does come along and gain all the benefits. Then what happens? You will still get the experience from doing the hard work, if not the money or recognition. The only thing that matters when it comes to getting things done is experience. Fame and fortune come later, if at all. Eventually, with enough experience, you will be so good that it will be impossible for anyone else to take credit for your work, even if that isn't true now. Have faith in yourself and your future.

</comment><comment><USER11> Realize your value is not in what you do, but how you're able to do it, that you're able to repeatedly do it over and over again with high quality.

Also nothing really matter on its own, it's up to each of us to make our own meaning. So, if you're really set on these fears they'll be real. If you focus on a different strategy that will be your reality.

You want a non zero sum game perspective.

</comment><comment><USER12> Mind over Mood: [https://www.amazon.co.uk/Mind-Over-Mood-Change- Changing/dp/0...](https://www.amazon.co.uk/Mind-Over-Mood-Change- Changing/dp/0898621283/)

</comment><comment><USER13> The reasons for this may be in your past and discussion those online with strangers might be uncomfortable. Better if you talk in person to a psychiatrist.

</comment><comment><USER14> If you are scared of technical projects being stolen document all your learnings and store code on git.

Everything is timestanped and proved you were there first maybe?

<comment><USER15> I've thought about this, are patent offices even needed anymore? We used to need the centralized store of timestamps--proof of who thought of what idea first. Since you can check your idea into github these days, and show later you were indeed the first person to your idea, do we still need a central office for this?

</comment></comment><comment><USER16> Give other people the benefits of your hard work.

</comment><comment><USER17> How about contributing to OSS, in case you are a software engineer, to overcome this fear/insecurity?

</comment><comment><USER18> You might get valuable feedback if you reveal your work. You won't if you don't.

</comment><comment><USER19> Goto doctor/psychotherapy ?

</comment><comment><USER20> Practice generosity. Giving with no thought of getting back.</comment>


How to Brexit? – Explore the (im)possibilities of the different Brexit scenarios - <AUTHOR> http://howtobrexit.eu/ <comment><USER3> Brexit has definitely changed my mind on one thing - majority vote in a referendum is bad. Or rather, the percentage vote required should be proportional to the gravity of the question. Referendums are rare, so most votes should require well over 50%.

I did not used to think this. In 2007 British Columbia had a referendum on switching to proportional representation from FPTP. The result was like 52% in favour, but the government had set a minimum of 55%,so it did not pass. I thought it was a a terrible idea at the time (the people had spoken! Democracy!), but I don't think so anymore. Another example is the 1995 Quebec independence referendum, which "stay" narrowly won, but afterwards the federal government passed an act making it much harder to pass a referendum.

Basically, the bigger the question, the longer and larger implications it has, the more it has to be thought through, the more consensus there should be. The US constitution has features like this when it requires large majorities to pass amendments etc.

As an engineering metaphor, having a fast-response system without any dampening can lead to out of control oscillations, which ultimately destroy your system.

<comment><USER4> The problem with Brexit is that "leave the European Union" is not a policy, it's an outcome. All of the thinking about how to do it should have taken place before the vote, and then we could have voted on that (this is actually the way legislation is typically developed in the UK, and the job of our sometime venerated civil service). Compare it to the recent Irish referendum on abortion, where there was a clear plan for what would actually happen following a vote for change.

<comment><USER5> I think you're kind of splitting hairs, all policies can be viewed as outcomes. "Bring back grammar schools" is both a policy and an outcome. "Improve education" is only an outcome because it doesn't discuss how to achieve it. "Leave the EU" is 100% achievable and has an obvious way to achieve it, it's policy just not detailed policy.

Realistically they should have planned more, but planning is limited when you're going into negotiations with an unpredictable third party. If other countries had voted to leave the EU, or the German or French elections had been different then the negotiation would be very different. Even the UK election after the vote could have wildly changed our brexit policy.

<comment><USER6> The trouble is that of the two obvious options, one is pointless ("Norway") and the other ("Canada") breaches the peace treaty in Northern Ireland.

<comment><USER5> Fortunately we're something like (top of my head) ten times as important to the EU as either of those, and so even the most hardened remainer would privately admit that we should have more leverage in negotiations.

Presumably Norway isn't in the ECHR, which would be significant. Neither is it obligated to join the Eurozone. It's more complicated than you're painting it.

<comment><USER7> Norway is part of the ECHR. In fact, just like the UK it was a founding member of the Council of Europe which agreed to create the ECHR at the Congress of Europe at which Winston Churchill was a delegate from the UK.

The ECHR is a separate institution to the EU anyway so I'm not sure why it would be relevant. Leaving the EU does not leave the ECHR, and there has been no referendum to suggest that the UK should do that.

<comment><USER5> You're right on Norway being a member of the ECHR, I wasn't sure as I stated in my post, but you're vastly oversimplifying by implying there's no connection [https://www.bbc.co.uk/news/uk-politics-eu- referendum-3614979...](https://www.bbc.co.uk/news/uk-politics-eu- referendum-36149798)

<comment><USER7> There is no direct connection. But a respect for human rights is required to belong to the EU. Leaving the ECHR would cast the UKs commitment to human rights into question (at the very least it would be an indication that the UK has a different conception of human rights to the rest of the EU) and would mean that the EU would have to scrutinise whatever legislation took its place to ensure that the UK did still intend to retain a conception of human rights close enough to the other member states.

None of this means that the recent referendum gave any mandate for leaving the ECHR.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> This is actually terrible, for one thing the bridges don't move independently, you click one and another moves, making it FEEL deceptive and not allowing you to easily work out the whole problem space or why. They should move independently and if the configuration doesn't make sense, tell you. For another thing, it conflates economic disalignment with having a hard border, the whole argument of the UK government is that you don't have to do that.

It therefore makes no comment on the Checquers plan which even if you don't like it, is just deceptive. Checquers plan would be equivalent to a different kind of checkbetween NI and Ireland, not a hard border but the idea being (I think) that we check good on the way in for whether they're intended for consumption or export to the EU, if they're passing through to the EU we apply our own tariffs. On the EU side I think we don't put tariffs, then we don't have to do any checks on the way in or out on that border because the EU tariffs have been applied on the way in.

Whether you think that's feasible, mixing up hard borders with economic alignment and completely ignoring the nuance of hard border vs tech border and the government's current proposal is gross.

<comment><USER8> > For another thing, it conflates economic disalignment with having a hard > border, the whole argument of the UK government is that you don't have to do > that.

This pretty much the case in the entire rest of the world. Political or economic misalignment == hard border, so people and goods can be checked and charged for. It's not so much a conflation as just becoming any other country outside the EU.

The solution to this, a soft border managed by technology just doesn't exist, it's science fiction. Even if you believe it is possible, you've got 6 months to 1. Negotiate this between the UK and EU, 2. Get the UK political system to agree to it, 3. Create and test the system and 4. Deploy it. That's a tight timescale for any project of this size, let alone one that has so much required work that needs to be done beforehand.

</comment></comment><comment><USER9> A strange game. The only winning move is not to play.

<comment><USER10> > _The only winning move is not to play_...

That's a losing move too.

The Leave voters would all label you 'undemocratic'. That sentiment imposes a definite cost on you as well.

Unfortunately, at this point there really are no " _winning_ " moves. Probably just a few moves that might be less _bad_ than other moves.

<comment><USER11> >The Leave voters will all call you undemocratic. That sentiment imposes a definite cost on you as well.

This is the same country that has the queen give "consent" for all legislation, correct?

What exactly is the point of the monarchy if they won't step in during this serious issue to act as the "adult in the room"?

<comment><USER10> I guess I'm not familiar enough with the monarchical aspect of their government to know how (if?) that would go down?

But you make a good point. Why can't their queen or whatever just say no we're not leaving? I'm not sure? I'm from the US. We don't have the whole monarchy thing going on.

<comment><USER12> Because the position (and power) is symbolic and the centuries old understanding is that the ruling monarch will never exercise it. Should they do so, especially in opposition to a full referendum of all things, it would spell the end of the monarchy.

The last time royal assent was refused in the UK was in 1708:

[https://en.wikipedia.org/wiki/Scottish_Militia_Bill](https://en.wikipedia.org/wiki/Scottish_Militia_Bill)

<comment><USER13> What if the king or queen was a crazy bastard hell bent or just too stupid to do anything but destroy your normal democratic behaviors and support authoritarian practices? I think you've been lucky up to now, at least for the recent 100 years.

</comment></comment></comment></comment></comment></comment><comment><USER14> Scotland and NI quit UK to form their own republic and rejoin EU together. Everyone happy. Maybe even republic of Scotland-Ireland.

<comment><USER15> Rejoining EU would not be automatic. They will have to to again all the accession iter.

EU countries that have issues with independence movements (e.g. Spain w.r.t Catalonia) will not let automatic re-join, because the "You will be out of EU if you secede" is one of the arguments used for saying that secession is a bad move.

<comment><USER16> Yes they would have to join, but if Brexit happened they are no longer in the EU and so need to leave the UK and then apply for the EU. Wonder if they would need to go through a period of not being in either?

Imagine a hard border on Scotland.

Don't think the monarchy would approve of that much.

</comment></comment></comment><comment><USER17> Amusing, but facetious. The border problem as stated is indeed impossible to solve, but both Brexiter and EU strategy hinges up the idea that the other side will blink first, the EU betting that the Tories will fudge up a sea border, and the Brexiters that the EU will plump for any deal to avoid a no deal (as that would definitely have a hard border).

<comment><USER18> Problem with the Tories not blinking is that they don't have a majority in parliament. They're currently being propped up (they have a confidence and supply arrangement) by the DUP who are very much against a sea border and would likely vote against a deal that had a sea border and doing so could bring down the government.

<comment><USER19> Ultimately there is no majority in parliament for any of the options, we are headed for either another election or a re-run of the referendum.

<comment><USER20> Or indeed in the country: the "smartest" (sleaziest) thing the leave campaign did was to refuse to actually lay out any specific kind of brexit - <USER2> there was no unity on the brexit side.

</comment></comment></comment></comment><comment><USER13> The current situation is so depressing. The combined ongoing destruction in the uk and the us of many years of relative safety and peace while claiming it's all to protect us from change or something like that reminds me that the many poor leaders and failures of ancient countries making terrible decisions that lead to the end of their countries can happen now. What a run on sentence. At the same time, I'm extremely fortunate to have a great job and be part of the "programmer class". So many people in both countries have lost their economic confidence and a job that pays for a decent lifestyle.

</comment><comment><USER21> This idea of "alignment" is absurd, countries have non-transitive border arrangements all the time. It might bring the always-questionable idea that the EU ever had a "single market" under scrutiny, but that's weird ideological posturing not a serious obstruction to Irish access to the UK market and vice versa.

<comment><USER22> Alignment is a mechanism to prevent beggar-thy-neighbour policies that lead to a race to the bottom, with everybody worse off. If you have a porous border without alignment, you get smuggling.

The EU single market is a definitional concept, it exists by definition. Not all goods and services are in the single market, but the scope gradually increases over time. Necessarily, as the scope increases, the need for harmonization increases, and that's what often leads to accusations of loss of sovereignty.

</comment></comment><comment><USER23> This presentation is biased. It doesn't take into account that the Northern Ireland is really a problem of the EU. There are soft borders in the EU for example Poland - Russia, where people can roam freely. EU is just not being flexible to make a "political point", which is pathetic. They shouldn't include a provision to leave the Union in the first place.

<comment><USER8> > It doesn't take into account that the Northern Ireland is really a problem > of the EU.

As somoene who grew up in the UK with the IRA blowing up bits of the country, some rather close to me, I disagree. It's likely that the communities that would be split by a new border in Ireland would disagree too.

The EU is negotiating in it's best interests, as is the UK. There aren't going to be any favours traded on either side.

<comment><USER23> If the UK doesn't put up a border then it is the EU that is causing a problem. There doesn't have to be a hard border, but EU insists that there should be.

<comment><USER24> I'd love to see that result, purely for the hilarity of watching the people I share a house with, who voted for Brexit, explode at the idea of the UK government not policing an external border.

The only reason they voted for Brexit was because they think it means they can get rid of all the migrants, they tell me this quite regularly.

One of them moved here from Bahrain, though apparently this means their family were ex-pats, not migrants. The other is from a long line of Christian overseas missionaries.

If they thought for a second that Brexit would mean leaving the border with Northern Ireland wide open, they would be screaming blue murder.

</comment></comment></comment></comment><comment><USER25> Gimme Scotland / Wales borders to play with too, that'd make for some funny pictures.

<comment><AUTHOR> Great idea! Then you would want to play with the scenario of Scotland (also) remaining aligned with the EU e.g.?

<comment><USER25> Well, the ability to make only Northern Ireland leave the EU was chuckle- inducing, so I'd probably play with things that way :P

<comment><AUTHOR> haha excellent

</comment></comment></comment></comment><comment><USER26> There should be more options, like Republic of Ireland joining the United Kingdom.

Or Scotland making a bid to join the EU.

<comment><AUTHOR> Good one. Yeah so many more options as I was programming it... Like the EU giving up on their "colony" Northern Ireland. Or France or the NL exiting the EU too...

<comment><USER17> Have you seen this?

[https://www.bloomberg.com/graphics/2018-pick-your-own- brexit...](https://www.bloomberg.com/graphics/2018-pick-your-own-brexit/)

<comment><AUTHOR> Ooh like it, did not see that one yet :)

</comment></comment></comment></comment><comment><USER27> Looking forward to the pro-brexit commenters posting their realistic workable plans for leaving the EU that addresses these issues.

I mean someone must have plan. You've been complaining about the EU for (checks notes) decades. Didn't you use any of that time to come up a plan?

Want to call me a remoaner or other insults? That's fine, but maybe post your plan first and then call me a remoaner?

</comment><comment><USER28> hacker news is a communism

<comment><USER29> absolutely. dont you enjoy these painfully long and out of breath explanations on why this inconvenient majority of voters must be further disenfranchised ?

and all of the appeals to the authority of the EU's rules and regulations and why that makes it "impossible" ?

what hogwash. we all played by the same rules which were agreed upon beforehand and now the economically well off (and isolated) minority seek to invalidate the vote.

I think if the 'vote' is taken away from those who voted for Brexit then they'll do you one better and choose to ignore more fundamental aspects of our "social agreement", namely ones involving physical safety.</comment></comment>


CloudGirlfriend.com - Social Network Girlfriend - <AUTHOR> http://cloudgirlfriend.com/

<comment><USER2> Step 5: Enjoy months of constant questions from your friends about why this wonderful girlfriend can't ever visit, and why Googling her doesn't seem to produce any results, and how no-one who comes from the same putative town has ever heard of her...

Is this just attention whoring or has does someone genuinely think this is a good idea?

<comment><AUTHOR> Hard to tell exactly what the purpose is from the limited amount of information provided. I agree that it seems a little weak if it's just a fake girlfriend to impress your friends. Might just be some personal stimulation to add a bit of flavour to life? Bit like <http://www.awesomenessreminders.com/>

Anyone know more about it?</comment></comment>


Startup Quote: James Cash Penney, Co-founder, JCPenney - <AUTHOR> http://startupquote.com/post/11732609710

<comment><AUTHOR> Theory is splendid but until put into practice, it is valueless.

\- James Cash Penney

<http://startupquote.com/post/11732609710></comment>


A cinematic approach to drug resistance - <AUTHOR> http://news.harvard.edu/gazette/story/2016/09/a-cinematic-approach-to-drug-resistance/?utm_source=twitter&utm_medium=social&utm_campaign=hu-twitter-general <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=12470703](https://news.ycombinator.com/item?id=12470703).</comment>


The Biggest Mega-Tsunami in History - <AUTHOR> http://www.theatlantic.com/science/archive/2015/10/traces-of-an-ancient-mega-tsunami/411970/?single_page=true <comment><USER2> There was a much more recent, bigger one in Alaska: [https://en.wikipedia.org/wiki/1958_Lituya_Bay_megatsunami](https://en.wikipedia.org/wiki/1958_Lituya_Bay_megatsunami)

<comment><USER3> Why do you consider the Lituya Bay megatsunami to be bigger?

The prehistoric megatsunami was estimated to have a "minimum tsunami wave height of 170 m at the shoreline." The Lituya Bay crest was estimated at 90 m.

The run-up at Lituya Bay might be higher but, to quote from this Science paper, "run-up is a complex process governed by local bathymetry and topography".

<comment><USER2> If I was sitting in Lituya Bay, I'd probably be more concerned about how high I had to be to avoid the wave. To quote myself: "Shoreline height is a complex process governed by local bathymetry and topography"

</comment></comment></comment><comment><USER4> One potential source of a mega-tsunami in the future is Cumbre Vieja, a volcano in the Canary Islands that has an unstable side. [0]

This "fact" is actually in dispute and is somewhat controversial.

[0] [https://en.wikipedia.org/wiki/Cumbre_Vieja#Future_threats](https://en.wikipedia.org/wiki/Cumbre_Vieja#Future_threats)

<comment><USER5> This is the one that would theoretically hit the US eastern seaboard like a wall of water right?

<comment><USER3> According to the text on the other end of that hyperlink, yes.</comment></comment></comment>


Deploying Elixir - <AUTHOR> http://luk3thomas.com/notes/deploying-elixir/ <comment><USER2> Awesome post! I really like the idea of the custom config provider and the approach to config that is taken in this post. Config is definitely a pain point for Elixir deployment, but the core team knows this and is working on it.

My strategy is similar to the one in this post, however it is optimized to allow for separate stages for complication and runtime, so that you can compile your apps wherever you want and separately run them wherever you want. For this I use two different Fockery images. Docker also makes it really easy to manage multiple apps running at the same time.

If anyone is interested in my deployment strategy, I wrote up a post on how I do things and why I do them that way: [https://gist.github.com/jswny/83e03537830b0d997924e8f1965d88...](https://gist.github.com/jswny/83e03537830b0d997924e8f1965d88bc).

<comment><USER3> Intriguing post!

</comment></comment><comment><USER4> I also try to use the {:system, "MY_VAR"} convention to get around the weird "lets-compile-in-config-values" problem, but unfortunately, it is not supported by many libraries. Even some of the essential libraries, like Ecto, support it for some config variables (db_url), but not for others, which seems crazy to me.

For some dependencies (like exq), I've needed to take them out of the "start" list, and start them manually, hand feeding them the configuration values.

This issue has been the biggest annoyance by far in what is otherwise a really nice platform/ecosystem.

</comment><comment><USER5> Thanks for the article! I find it really surprising how difficult it is to deploy Elixir apps when it's so much more popular now and the Elixir team is so great at the developer experience.

<comment><USER6> Deployment and configuration is among the top priorities from both the core team and the community from what I can tell. There's been a lot of discussion about it and some resources being dedicated in the last year. So only a matter of time, but a little heavy on initial deployment for sure.

<comment><USER7> That's great to hear. Would be nice to have an "official" sort of tool for deployment.

<comment><USER8> In case you haven't heard yet, there's ongoing work [1] from Paul Schoenfelder for just that! Dockyard (employer of Chris McCord, father of the Phoenix framework) hired him some time back for this very reason.

[1] [https://dockyard.com/blog/2018/02/28/elixir-deployment- tools...](https://dockyard.com/blog/2018/02/28/elixir-deployment-tools-update- february-2018)

</comment></comment></comment></comment><comment><USER9> This article was great mostly as an affirmation that my cobbled together practices are sound. (I follow all these exactly, except my build server is a VM)

</comment><comment><USER10> Nearly every article like this seems to have long verbose steps. For me in 99% of cases my development machine and target machine have mostly the same configuration, and so it feels like I have it down to a 3-4 step process which can be scripted.

</comment><comment><USER11> Why do you use additional versioning?

1.0.0-v1, 1.0.0-v2 istead of just 1.0.0 and 1.0.1

are vX meant as pre-release?

</comment><comment><USER12> I'm curious as to why docker is chosen for build artifacts but not for running the app itself. Any info available here?

<comment><USER13> Generally speaking there is no way I'm installing a compiler on production servers, so having a builder is needed.

And rather than having a bunch of different machines for each stack, much cheaper and easier to have docker images.

Then you can deploy easily to any kind of production server: physical, VM, docker, cloud, etc.

<comment><USER14> So basically you're using an overcomplicated chroot as nothing more than chroot.</comment></comment></comment>


Is long-term solitary confinement torture? - <AUTHOR> http://www.newyorker.com/reporting/2009/03/30/090330fa_fact_gawande <comment><USER2> I have personal experience with interacting with those in / coming out (temporarily (going out for court) and permanently (being transported to a new facility after 7+ years of Solitary Confinement)) on solitary confinement. We ARE social creatures. We cannot survive on our own (I hypothesize we need Friends, Family and Lovers...if you have Two, you can survive emotionally).

These people are turned into schizophrenics, tattooing their faces, painting walls with feces (if you are offended, please research the effects of solitary confinement).

Solitary confinement inmates go Insane. To what degree, depends on the duration and the person. As a deterrent, it is warranted and probably (no statistical info) effective in the short term. As a long-term "treatment" for rehabilitation, it is NOT effective.

If we are in fact, trying, to rehabilitate criminals into society, solitary confinement just creates a dangerous creature.

<comment><USER3> > If we are in fact, trying, to rehabilitate criminals into society

Apart from superficial lip service I don't think we are trying to rehabilitate anyone. It is plain and simple punishment.

</comment></comment><comment><USER4> I think its unfair if you're being held without charge or trial. If you've been sentenced, it might be cruel punishment or even torture but at least you can accept your fate.

</comment><comment><USER5> Assertions such as those in the first paragraph are offensive -- as though we introverts weren't real or normal humans. I don't know from first-hand experience, but as bad as solitary sounds, being confined with other people sounds even worse, given how my brain is wired.

<comment><USER6> I am an introvert myself, but even us introverts interact with other people daily. If you voluntarily spend days on end utterly alone with no human interaction, you're unusual even for an introvert

<comment><USER5> Sure. But if it came down to lots of time alone or lots of time with forced contact, which would you pick? They both sound bad to me (what do you expect from being incarcerated?); the baked in assumption that what's bad for most humans is bad for all humans is what bothers me.

<comment><USER7> Even this text based communication on HN is a form of human interaction. I'm not sure complete isolation is something anyone is genetically predisposed to prefer.

<comment><USER8> Not really relevant to your point, but introversion vs extraversion most likely isn't determined by genetic factors. It's essentially a choice (albeit one that was made at such a young age that it's impossible to change).

</comment></comment></comment></comment></comment><comment><USER9> Some of Harry Harlow's _experiments_ were really... fucked up. [https://secure.wikimedia.org/wikipedia/en/wiki/Pit_of_despai...](https://secure.wikimedia.org/wikipedia/en/wiki/Pit_of_despair)

<comment><AUTHOR> > when six-month isolates were exposed to younger, three-month-old monkeys, > they achieved "essentially complete social recovery for all situations > tested."

[https://secure.wikimedia.org/wikipedia/en/wiki/Harry_Harlow#...](https://secure.wikimedia.org/wikipedia/en/wiki/Harry_Harlow#Partial_and_total_isolation_of_infant_monkeys)

</comment></comment><comment><USER10> Forced seclusion on any being that naturally seeks contact alters the mind and is therefore a form of torture.

<comment><USER11> What an idiotic statement All forms of punishment and/or rehabilitation "alters the mind", they are not all forms of torture.

</comment></comment><comment><USER12> If it wasn't torture, the United States wouldn't be doing it to Bradley Manning.

<comment><USER13> I love this kind of fallacy :) _Edit: Misread the parent post (too many negatives!)._

<comment><USER14> What fallacy?</comment></comment></comment>


Show HN: Sliproad – Combine filesystems into one API - <AUTHOR> https://github.com/gmemstr/sliproad <comment><AUTHOR> Hey all :) This is another one of my personal projects I'm sharing with the world in hope of improving it. This was primarily build to unify my Backblaze storage with my Raspberry Pi and external drives, but I'm hoping to implement more "providers" later down the line, e.g S3. The focus is mostly on the API, but the frontend works fairly well, especially for my own use. Very open to feedback!</comment>


Relive your 2012 on Facebook and Instagram on-line and off-line - <AUTHOR> http://hub.pastbook.com/en/relive-2012

<comment><USER2> The easy way to enable Facebook and Instagram users to make physical books from their own photos. The user can download it as PDF or just browse on line.</comment>


Nokia cuts 10,000 jobs, dropping its entire Linux R&D division - <AUTHOR> http://press.nokia.com/2012/06/14/nokia-sharpens-strategy-and-provides-updates-to-its-targets-and-outlook/ <comment><USER2> May be it is time for nokia to get out of mobile business.this is bad

</comment><comment><USER3> Anyone know the status of all Qt / trolltech guys?</comment>


Kayak.com Makes Developers Do Customer Support - <AUTHOR> http://www.inc.com/magazine/20100201/the-way-i-work-paul-english-of-kayak_Printer_Friendly.html

<comment><USER2> Great find, thanks! My favorite quote from this was:

"If you make the engineers answer e-mails and phone calls from the customers, the second or third time they get the same question, they'll actually stop what they're doing and fix the code. Then we don't have those questions anymore."

<comment><USER3> that works as long as the company encourages this.

i.e. at my mom's job(she is also a programmer) she used to do these little fixes for the users, and they all loved it. Then new management came in, and now to do a little fix a user has to send in a request, which the programmer needs to get signed off by 3 bosses.

And here is the funny part, the fix takes literally 5 minutes to do, boss #1 will say..."better tell the next boss it takes a few hours to give us some breathing room', boss #2 will say..."better tell the next boss it takes a few days, to make it seem like we are doing a lot of work" and boss #3 will say "better tell the user it'll take a week, we want them to know that we are doing major code for them"

So this tiny 5 minute code fix, that literally just required a change in a few lines of code that used to be done in 5 minutes, now gets expanded into a 2 week "project"

THAT's the difference between a startup and corporate culture

<comment><USER4> It's a two-way street. Bosses demand sign-offs because someone at some time deployed something that didn't work. Signoff processes are there as a pain avoidance technique.

If you are positive about the quality that goes out, you can have a corporate culture that encourages this sort of thing. If you're in a company that feels like it has to fill seats you get a combination of people who are good at their job who have to deal with bureaucracy and people who aren't good at their jobs who are saved by it.

</comment></comment></comment><comment><USER5> He lives this. I once sent in some feedback via Kayak's web form, and got a (brief) personal reply from Paul English within 24 hours.

> "We developed our own customer support software. One of the things it does > is randomly select an employee response to a customer and send that response > out to the entire company and to all of our investors each day. It keeps us > on our toes."

That's a clever little social hack.

<comment><USER6> I see the idea, but you can take everything too far. To the entire company and to all investors? Every day? Really? That's borderline fascist surveillance regime.

<comment><USER7> The proof is in the pudding. Is Kayak keeping their customers happy. Are the investors happy and of course are the employees happy? If the answer is yes, then the approach works. Fascism is a strong word for a novel approach to customer service. If this approach stops working then they will try something else. This is not an ideology, you know.

<comment><USER6> I didn't intend to say the method is fascist, just that it reminds of practices that were and are employed by fascist regimes. If everyone's happy, then there's of course no reason to complain. I just don't see how employees could be happy under a system like this, but to each his own.

<comment><USER8> Part of their job is to write reasonable responses to customer inquiries. That's the output of their working time, for which they are paid.

Saying that should be private is like saying someone's code check-ins should be private.

And if we assume people are good rather than bad, it's a chance to show off, without ego, a particularly good response and/or responder. That gives them a morale boost from knowing their boss and co-workers saw them doing a good job in a natural environment, and it motivates co-workers to do a similarly admirable side.

</comment></comment></comment></comment></comment><comment><USER9> As a developer, I'm not so sure that I buy this. I mean, I get it, developers are going to know how to deal with the bugs much quicker than a customer would. But does it scale well? If I was constantly interrupted by a loudly ringing code I can assure you that my code is going to be a poorer quality than if I had been able to work on it undistracted. So distractions lead to bad code leads to more distractions... that could be a really vicious cycle.

As someone else pointed out, you have to judge the process by its fruits. It looks like it's working for them, but it would drive me crazy.

</comment><comment><USER10> This page seems to randomly show the feedback phone number:

<http://www.kayak.com/feedback>

Hit refresh a few times.

Perhaps they don't like the phone ringing that much after all?

<comment><USER11> This is clever. You want to have some amount of personal feedback to learn about customers, but you also want to be efficient about handling he bulk of the support issues.

</comment></comment><comment><USER12> "On any given day, you might find him tracking down potential hires, going for a run with his software engineers, or personally answering calls to Kayak's customer hotline." <\- what is this? software engineers don't run ;)

Honestly, he seems very down to earth and genuinely happy. I also like how he doesn't have a problem constantly checking his email unlike all these productivity blogs and such saying its the worst thing you could ever do. I feel my behavior is somewhat vindicated in being one of those differences that doesn't really make a difference.

</comment><comment><USER13> I welcome the idea and practice so wholeheartedly that I feel the use of word "make" in the title is inappropriate.

It implies that the developers at Kayak.com are forced to do something outside of their responsibility -- it certainly would sound stupid to say "XYZ.com Makes Developers Do Proper Coding", however, both practice lead to the same outcome -- better product.

</comment><comment><USER14> Cool article! Although for me what stood out in the article was not that he made his developers do customer support, it was his work ethic and his outlook on life.

I like it that he advocates "work really hard for 40 to 45 hours a week, but we believe in people having strong personal lives". Makes for a more balanced life and ultimately a more sustainable company.

</comment><comment><USER10> Rather than hoping that employees recognize patterns in customer communications, it might be better for a group of employees to review a sampling of emails and figure out some common root causes. Perhaps they already do this...</comment>


The Evolution of Web Design (2016) - <AUTHOR> http://fabianburghardt.de/webolution/ <comment><USER2> Hilarious that it doesn't work on phones. I guess this is only the evolution of web through 2009?

<comment><USER3> Yep. Mobile is the primary and indeed _only_ way a lot of people access the internet now. Ludicrous that they just flat out reject those users!

Web design/development from the past 5+ years absolutely _requires_ specific, deliberate, and thoughtful support for mobile users.

<comment><USER4> On a serious note: "Mobile-first" was a rallying cry a few years ago - but all I remember are pages that didn't work well on desktop, especially pages with above-the-fold (`height: 100vh;`) full-screen graphics or worse: videos. It's cute on a handheld 480x640 display you can scroll-flick, but terrible at 2560x1440 with a mouse-wheel.

</comment></comment></comment><comment><USER5> 1991: simple and readable, minimizes scrolling, no menu to click through, lightweight

2015: complicated with low-contrast text set against an animated background image, maximises scrolling, requires clicking through a hamburger menu with gratuitous animations, heavyweight

Or, put more simply...

1991: content

2015: content + cruft

<comment><USER6> 1995 has black text on black pen illustration.

2014 has thin gray text on brightened starry sky, which is too faint for my FHD Dell. Indians still buy 800p laptop and desktop screens which are too faint for rooms without curtains.

1997 and 2015 are also painful to read.

Early 2000s with "IE at 1024X768" haven't aged well for high resolution screens.

I will fight to not diverge from stock Bootstrap and landing pages to be upto 3 screens and definitely no scroll hijacking.

</comment></comment><comment><USER7> Now if I could just get this slider onto every website, and keep it locked at 1993. :)

<comment><USER8> it's pretty much how I see the web thanks to umatrix

</comment></comment><comment><USER9> You know what? I prefer the very first one. But then I am strange I admit.

</comment><comment><USER10> 1995 was the first time I used EDIT.EXE to write down a high level graphical thing (HTML) to be interpreted by a program (IE). I felt like god. Prior to that I only made pascal/asm shitty demos..

</comment><comment><USER11> Prefer the text only version, at least it reflows.

</comment><comment><USER12> Great job! You nailed the Sci-Fi aesthetic from 2005.

</comment><comment><USER13> Very cool! For some reason, 2003 is loading blank for me.

<comment><USER14> Probably because 2003 requires Flash!

<comment><USER4> With the death of Flash comes the loss of a huge part of internet cultural history, mostly interactive parts - as at least flash cartoons can be rendered to video and put up on YouTube. There were a lot of innovative games and concepts on sites like MiniClip and Newgrounds.

I remember seeing a very early demo of a <canvas>-based SWF player shortly after the iPhone came out - I wonder what would have happened to Flash if Adobe, Apple, or Google put effort into making it work the same way they did with the JavaScript-based PDF renderer.

<comment><USER15> Same with the death of Java applets. There were a lot of neat educational Java applets, especially in STEM subjects. Some have been recreated in JavaScript, but a lot are gone.

<comment><USER6> I remember downloading a VR web pages of a cell and atom in 2000s and hoping to get a magazine CD with a VRML player plugin. It may have been 25MB to download, but it took hours of billable phone time. Seems that dream is lost forever.

</comment></comment></comment></comment></comment><comment><USER16> We could do a lot with 1993 and a modern stylesheet. I hope that's where we'll be in 2023...

</comment><comment><USER17> ahah loved it, the frontpage two column and background theme really connected with me, having wrote my first website for grandpa in the 97

this made me wonder tho, 2015+ design are all specialized for sparse information and selling something. what would a modern content heavy site focused not on monetizing would look like today (say, a modern wikipedia of sort for timeless pieces)

said site was brought to 2010 levels of design but got stuck there due how the modern template are not suited for such things

</comment><comment><USER18> I couldn't get past the first heading: "NASA and the Space".

<comment><USER19> It's a direct translation from the author's (presumably) German native language, where space is indeed referred to as a distincted "das Weltall/der Weltraum" or literally in English, "the space".

It was weird for me, too - NASA, _the_ American space agency, with blatant grammar errors on their front page? Ehhhh...

</comment></comment><comment><USER20> So the evolution is more about aesthetics than format or anything else!

</comment><comment><USER21> that was cool

</comment><comment><USER22> 1999's the best !

</comment><comment><USER23> I thought you wrote 'The Eurovision of Web Design'

I guess I saw too much TV lately.

It might be cool due

</comment><comment><USER24> 1\. See that background rocket video in the 2015? Now "imagine" the video is instead pron1.

2\. Don't act like you don't know that scrolling down from pron1 will autoplay pron2 when it enters the viewport.

3\. Don't act like you don't know about infinite scroll.

4\. Don't act like you don't _instinctively_ know that every single web design in the years before that has fewer prons per minute.

If you fess up to those four truisms and _still_ pine for 90s web, at least have the courage of your convictions to quit computers and become a street preacher already.

<comment><USER25> ... what?</comment></comment>


Legacies Never Die: How to Handle Legacy Code - <AUTHOR> https://www.olioapps.com/blog/legacy-code/ <comment><USER2> The author makes a very crucial point about legacy code — it's often simply code that's old. No addendums added. Standards and conventions change over time, especially so in, say, modern web development, and it's in everyone's best interest to practice empathy when interfacing with it.

Even more so when the code really isn't a good match to the standards at that point in time — there's a lot of context missing (deadlines, meetings, management and more) and code only shows a single aspect of a project.</comment>


Offer HN : MVP for 200$ - <AUTHOR>

I started playing with rails 2 weeks ago.I think I can get an MVP working in rails.The MVP will cost you 200$.It should not have a lot of features just the most important ones.I will not do any graphic design just frontend work with a css framework.You will not have to pay anything upfront. <comment><USER2> Good start but you should include an email for others to see. Good luck.

</comment><comment><AUTHOR> My emails : email@example.com email@example.com

</comment><comment><USER3> So did you get any lead?</comment>


Ask HN: What books on running a software/web dev shop are worth reading? - <AUTHOR>

I know there's tons of blog posts out there, but for more substance i sometimes like books. What have you read which was useful. Specifically going the bootstrapping / software dev shop route vs getting funding. <comment><USER2> Hmm... are you talking about the business side of things / the technical side?

The question will be clearer if you are more specific on this point...

<comment><AUTHOR> Good point, i'll resubmit. I know the technical side. But i'm interested in the business side.</comment></comment>


Who Watches the Watchmen? Sybil-Resistance in Proof of Personhood Protocols - <AUTHOR> https://arxiv.org/abs/2008.05300 <comment><USER2> This paper is really about solving a fundamental problem in decentralized identity, which is to combine the characteristics of self-sovereignty, privacy and Sbil-resistance, which seems to exclude each other.

I previously proposed formalizing this problem as Decentralized Identity Trilemma ([http://maciek.blog/dit](http://maciek.blog/dit)).

<comment> dane-pgp The paper even references that post directly in footnote 8:

> Those three requirements, sybil resistance, self-sovereignty and privacy- > reservation, compose the "Decentralized Identity Trilemma".[7][8]

> [8] 'Decentralized Identity Trilemma', Maciek, 2019.

</comment></comment><comment> dane-pgp Of the systems listed in the paper, the only one I'd really heard of was BrightID, and it still seems like potentially the best. The FAQ on their website is a good introduction[0], but the paper seems rightly cautious:

"To control for Sybil attacks BrightID runs GroupSybilRank, a modification of the SybilRank algorithm, to estimate the anti-Sybil score of the network participants based on affinity between groups. Proposed to be used as the official BrightID anti-sybil algorithm, the effectiveness of this algorithm in the presence of multiple attack vectors, remains to be proved."

Unfortunately, just proving personhood is only the first step in deciding someone's reputation, but it seems like a good basis to build some proper decentralized trust systems from, for example [1].

[0] [https://www.brightid.org/faq](https://www.brightid.org/faq)

[1] [https://adecentralizedworld.com/2020/06/a-trust-and- moderati...](https://adecentralizedworld.com/2020/06/a-trust-and-moderation- system-for-the-decentralized-web/)

<comment><USER2> The problem is that the more successful the system becomes (i.e. it's used for more valuable use cases) the more incentive there is to attack it. There needs to be a dynamic analogous to Bitcoin where the resources that go into securing the network grow along with the value of the network.

</comment></comment><comment><USER3> For those of us not familiar with the term (as was I before a few seconds ago): [https://en.wikipedia.org/wiki/Sybil_attack](https://en.wikipedia.org/wiki/Sybil_attack)

</comment><comment><USER4> Conjecture: a Sybil attack can always be performed if bootstrapped by some humans.

<comment><USER5> My friends voted on it and we decided that Sybil attacks are impossible. Nothing to worry about, please move along.

<comment> dane-pgp But none of my friends know any of your friends, so I ignore their votes. Admittedly that means that any sort of consensus reality breaks down online, but hey, it's 2020 and we are where we are.

<comment><USER5> Subjective social networks are the future. :~)

</comment></comment></comment></comment><comment><USER6> Great article! Idena is leading the way for decentralized human protocols with more than 3660 nodes. [https://idena.io/](https://idena.io/)

<comment><USER7> Quickly skimming the site, it seems like Idena validates identity by having all users solve a turing test at the same time.

I fail to see how this ever scales. Surely as the user count increases it becomes extremely difficult to get all the users to be ready to validate themselves at the same time?

<comment><USER2> This, plus who knows how long we can rely on the Turing test.

<comment><USER8> The current data on language-neutral AI-hard tests (analogous to Winograd Schema Challenge (save the textual representation) reasonably concludes that the current AI apparatus cannot sustainably achieve a human-level score (92% or above) on the FLIP-like tests as are used by Idena Network. FLIP creation by humans probably offers more protection from any of the bots and AI recognition schemes available as of now. Let's see what the future brings in this yet unknown realm.

</comment></comment></comment></comment><comment><USER9> Do SSI (self sovereign identity) systems such as Sovrin solve this?

<comment><USER2> No, Sovrin does not provide a source of scarcity. If you need to do KYC it's not SSI.

</comment></comment><comment><USER10> [https://certisfy.com](https://certisfy.com)

uses plain PKI certificates to solve identity and information verification in general.

<comment> dane-pgp For some values of "solve" and "in general".

> Certificates are information verifications issued to you by Certisfy > partners.

> Certisfy partners:

> * Police departments.

> * Government agencies, ex DMV, SSA, IRS.

> * A notary public.

> * A school, college, university

<comment><USER10> Keep reading, you'll see that these are not problems except for "perfect being enemy of good" rigidity.

The fact is the internet is in need of a privacy-friendly information verification solution that scales...when it comes to approaches for achieving this I think the more the merry.

</comment></comment></comment><comment><USER11> I watch them on Primevideo...</comment>


Facebook asserts trademark on word 'Book' in new user agreement - <AUTHOR> http://www.wired.com/threatlevel/2012/03/facebook-book-trademark/

<comment><USER2> One more reason not to have a Facebook account, especially if you register a business...

<comment><USER3> Would it really be in their best interest to shut down the marketing efforts (and Facebook pages) of every company with the word Book in its title? If that ever happened, this would get challenged and antitrust laws would rule against FB's terms of use.

Social is a proven channel and there's a lot to lose when you keep your business off of their platform.

<comment><USER4> Well, if you look at what they're _doing_ in the courts they're not trying anything so broad (if for no other reason than that they'd fail; do you claim they'd get any traction against Books-A-Million) and all their reported efforts looked OK to me (the parody site is a wobbler, but it sounds like it was settled amicably enough).

Focus on the "confusingly similar"; if you're for example doing sometime social and name yourself <one or two syllable whatever>book, aren't you trying to gain something by being very similar to their mark?

<comment><USER3> Yeah - I agree with you. I was responding to the commenter's post - re: staying away from Facebook altogether, especially if you're a business. That logic makes no sense.

<comment><USER4> Reading your reply more carefully I see that, you're enumerating many ways being that extreme would be stupid. Sorry for the misapprehension.</comment></comment></comment></comment></comment>


Gizmodo Banned from WWDC - <AUTHOR> http://www.pcmag.com/article2/0,2817,2364707,00.asp

<comment><USER2> "featuring the blogger walking through the CES floor using a TV-B-Gone kind of device to shut off television displays throughout the convention."

Wow, that's low. Really low. Gizmodo definitely shows its true colors: make money/traffic at any cost, even if it means sabotaging the hard work of others. (They were cutting off TVs during people's _presentations_.)

<comment><USER3> I met the Tv-b-gone inventor, Mitch, and he said he sold $20,000 more product as a direct result of that incident. He said he did't like what they did with the Tv-b-gone at CES.

<comment><USER4> Tech is not a zero-sum-game. Creating wealth while destroying other's hard work is not very nice, especially in tech industry, where opportunities at simply creating without destroying are so readily available.

</comment></comment></comment><comment><USER5> Gizmodo doesn't get to have it both ways. If they want the perqs afforded to journalists - things like press passes - they need to follow the established ethics of that profession. If they want to be outsiders and invent their own ethics, they need to be willing to forgo the perqs.

<comment><USER6> The established ethic of "cover people artificially warmly so they give you access" isn't necessarily something to be proud of.

It's fine if Apple wants to retaliate in a domain where they have control -- their own conferences. But it's not like Apple is defending the honor of all 'journalists' with this move.

<comment><USER5> Wow, you could teach a class on rhetorical fallacies from your comment alone. Let's try to unpack it here.

First, you've tried to claim access journalism as part of accepted journalistic ethics. In fact, access journalism is _not_ part of any accepted journalistic ethic, and is in fact the subject of great consternation among journalists themselves.

Second, you've implied that I'm somehow proud of the practice of access journalism. Once again, the fact is that I, like you, find the practice repugnant.

Third, you've tried to use this supposed anti-ethic to thus dismiss the entire ethical foundation of journalism via some sort of guilt by association. Of course, even if some aspect of journalistic ethics were to be found suspect, that still wouldn't negate the rest of the practice. In fact, like all ethical pursuits, the whole is greater than the parts: journalists, like lawyers and doctors, bind themselves to ethical practice. There are always those willing to violate those ethics, but an access journalist no more discredits his entire profession than a negligent doctor.

Fourth, you've made a false appeal to common ground ("It's fine if Apple wants to retaliate") which mischaracterizes my argument -- you'll note I didn't once mention "Apple" in my comment -- and sets up a false equivalency where Apple's behavior somehow excuses Gizmodo's. In fact, I think Apple's actions _are_ clearly retaliatory, but that wasn't the argument I made, and is still unrelated to Gizmodo's unethical behavior.

Fifth, you've argued against the claim that Apple "is defending the honor of all journalists." That's indeed a specious claim, and one worth arguing against. Except that I didn't make it. In fact, you've again mischaracterized my argument which, for the record, was simply that Gizmodo needs to choose which side of the fence they sit on.

Finally, you've enclosed the word "journalists" in air quotes as a sort of argument-by-ridicule: you've tried to assert stylistically that journalism is something to scoff at, and thus that anyone -- like me -- who defends journalism is similarly subject to ridicule. In fact, journalism is generally accepted as being a requirement for democracy -- see, for example, the Bill of Rights.

<comment><USER6> Your grandparent comment defended Apple's decision, on the grounds that Gizmodo has abandoned conventional journalistic ethics, and has thus received their just deserts.

I suggest that's still arguable; Gizmodo may have just been very aggressive (and ethical) getting a story about a powerful agent -- Apple -- that otherwise manipulates the press _very_ effectively. Time will tell.

If journalists are competing for favors from Apple, like press passes and advanced review opportunities, then we won't get the full story. Your comment seemed to endorse that sort of competition for Apple's favor -- bad press, no press "perqs"!

If that wasn't your intent, you might have chosen your wording more carefully. Note that I wasn't the only respondent who saw your comment as a defense of access-for-favors journalism.

I'm queasy that Gizmodo _may_ have rewarded theft with its actions -- but I'm also glad that _some_ outlets don't play Apple's game. I'm similarly glad that _some_ outlets don't play the federal government's access-for-warm-coverage game. _Most outlets do play that game_ , sadly, and that's why I mocked it as an 'ethic' of traditional journalism.

<comment><USER7> > If journalists are competing for favors from Apple, like press passes and > advanced review opportunities, then we won't get the full story.

The full story, in this case, is CLEARLY a new iphone being announced. That kind of story can only work to Apple's (or, for that matter, any other company's) detriment, because it decrease sales of the current generation of products as people decide to wait for the next-gen one that'll be released in a month or two.

as for the "I'm ... glad that some outlets don't play the ... game" comment, it's like you're told since childhood, "if you're not willing to play by the rules, then you won't get to play at all."

and as for the "may" part, gizmodo has admitted, and they are proud of it, that they paid $10,000 for it. [http://www.guardian.co.uk/technology/blog/2010/apr/19/gizmod...](http://www.guardian.co.uk/technology/blog/2010/apr/19/gizmodo- paid-iphone-4g)

<comment><USER6> Gizmodo proudly paid $10,000 for _something_. Whether what they did was unethical or illegal depends on whether the prototype was stolen, whether Gizmodo knew it was stolen, and whether Gizmodo was paying to possess the property, or just to view it and shepherd it back to its rightful owner.

Yes, some of those interpretations may be strained but we often want the press to stretch the rules to get secrets out.

<comment><USER8> _... we often want the press to stretch the rules to get secrets out._

These people weren't exposing government secrets or trying to figure out the actual flow rate of the Deepwater Horizon oil gusher; they were trying to get exclusive pictures of an iPhone for their gadget blog.

<comment><USER6> Totally agreed there's a difference in significance... but that's Gizmodo's beat and there's a giant audience for that info. The entire industry gets reshaped by Apple's product moves. So Gizmodo being as aggressive as the law allows for scoops is to be expected.

Also, the argument that the news was ultimately a social triviality works both ways. No one's reputation was besmirched. The alleged-stolen property was returned to its owner fairly quickly.

Gizmodo's peek confirmed a few things and refuted a few others already rumored about the 2010 iPhone. While that info wasn't released exactly as Apple may have preferred, whether there was any net economic damage to Apple is debatable. Apple lost some surprise value around next week's announcements, but they also got tons of free publicity and hype about their flagship product.

So indignation about Gizmodo's actions should also be scaled to match your observation: it's just some exclusive pictures for a gadget blog. No permanent damage to any involved; perhaps a net win for Gizmodo and Apple.

<comment><USER8> You make fair points, though I think the central one is flawed:

 _No permanent damage to any involved; perhaps a net win for Gizmodo and Apple._

Exposing a trade secret the way Gizmodo did probably did hard-to-calculate damage to iPhone sales for the past several months. After all, there is a reason they stovepipe these announcements. I think it'd be hard to argue that this is a net win for Apple.

<comment><USER6> But: the 'secrets' about this model were pretty much as expected. Improved iPhone models are released like clockwork each summer. And the meme "your Apple product will be replaced by a better one in 6 months" is so strong it's a recurring joke on talk shows and late-night TV. So I think your 'hard-to- quantify' on buyers is in fact 'negligible' -- or failing that, 'outweighed by knocking news of all competitors off the front-pages for a couple weeks'.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Dear Jason Chen,

I was just hanging out at this bar in San Francisco and found these WWDC press passes someone left behind...

Cheers, Andrey

<comment><USER9> Let's give Cabel Sasser of Panic Software credit for that joke: <http://twitter.com/cabel/status/15436511209>

</comment></comment><comment><USER10> "Banned" is a strong word. "Not invited" might be more appropriate.

<comment><USER11> Why do you have an issue with saying banned? It's not like they were forgotton, or passed over due to space constraints, they were specifically not allowed to attend even after thy requested a pass because of the iPhone leak.

That sounds like banned to me.

<comment><USER12> Except it's not true that they were "specifically not allowed to attend." In fact, they were specifically not given the special privileges offered to other journalists.

<comment><USER11> Good Point. My mistake.

</comment></comment></comment></comment><comment><USER13> Great tweet I found from Cabel Sasser (via @davehayden)

 _"Gizmodo not invited to the WWDC keynote, and wants liveblogging help? What, they can't just "find" a WWDC badge in a bar?"_

</comment><comment><USER14> This article reads way too much into the Jobs quote from D8. He could have been using the word "stolen" according to the oft-mentioned California law about the responsibilities of the finder of lost property.

</comment><comment><USER15> I don't know if I would call a "master" a 3rd party in the legal system. They are part of the court and used--for the most part--to either mediate in hopes a case doesn't have to go to the judge or examine something that would take up too more of the court and judges time.

If you be been through a custody/support case, you probably know "masters" all too well.

I'm sure PC Mag meant a third party within the judicial system, but some may be scratching their heads as to why thar happened.

Disclaimer: I may not be 100% accurate as I a, not a lawyer and only going on what I know or experienced firt-hand

<comment><USER16> CNET has a decent article on this. The special master is an unpaid agent of the court (usually a retired judge or law professor) who are not related to the case at hand. In this case, the special master will examine Chen's possessions for evidence related to the stolen iPhone and forward only that information to the presiding judge. Chen gets an opportunity to object to the gathered materials. Only whe that is done will the judge decide what the DA gets to have for his or her case.

(paraphrased from <http://news.cnet.com/8301-13579_3-20006876-37.html>)

</comment></comment><comment><USER17> I would like to be one of the many to go:

HAHAHAHAHAHAHAHAHAHA.

You deserve it. Fools.

</comment><comment><USER18> I laughed out loud when I saw the headline - duh, what'd Gizmodo expect?

</comment><comment><USER8> I am so surprised.

</comment><comment><USER19> I guess this is why Apple PR has been'cold lately'

</comment><comment><USER20> Thankfully Apple didn't decide to go for the nuclear option and ban all gadget blogs, so we'll still be there live tomorrow.

<http://live.gdgt.com>

</comment><comment><USER21> Steve Jobs may be acting like a 5-year old here, but the thing I like about him is at least he's direct. It's the two-faced liars that I really despise.

<comment><USER22> He actually might be following advice from company lawyers; when somebody is being investigated for a criminal case against you for theft and extortion, you tend to not do business with them.</comment></comment>


What the Envato CEO does in a Day - <AUTHOR> http://inside.envato.com/a-day-with-collis-taeed/

<comment><USER2> Deloitte... vision for 2020... hmm, I smell an IPO.

(I love Envato btw. You've founded a great company that executes very well. But you sure do charge developers a lot -- 20%? Really? Another company will inevitably overtake you on that basis alone.)</comment>


Announcing Microsoft ASP.NET WebHooks V1 - <AUTHOR> https://blogs.msdn.microsoft.com/webdev/2016/12/14/introducing-microsoft-asp-net-webhooks-preview-2/ <comment><AUTHOR> Note that URL says "preview-2" but that was just a publishing mistake. we don't want to break URL's since its out in the wild already but please be assured that this really is RTM.</comment>


Ask HN: Virtual credit cards with access rules? - <AUTHOR>

I've been wondering recently about the possibility of an abstraction layer above credit cards where numbers can be created and controlled by the user in a certain way. I'm aware of EntroPay who offer prepaid virtual cards.
Is anyone offering a master card with full access to my account, but allowing users to spin up virtual cards that work in different ways? e.g., I could create one which only works with a wildcard match of "amazon" on the transactor field. Or a virtual card which is capped at $300/month (retainer for an employee) or one which has a maximum of $100 (gift card for a friend). Or only works in a particular country or currency. And can all be shut down whenever required.
Would this even be possible with the way credit cards are currently set up? <comment><USER2> Citi offers a similar feature on their credit cards. Not all the control that you mention, but it's good for making purchases on shady looking sites.

</comment><comment><USER3> Virtual credit cards with limits per card? Don't Paypal do this?

Why the country/currency limitation btw?

<comment><USER4> PayPal removed the single-use credit card number option a while back.

</comment></comment><comment><USER5> I have also been thinking about that, and why it is still not possible today!</comment>


Webhosts for Tor Relays Who Are Not; OVH, Hetzner or Scaleway - <AUTHOR> https://worldofmatthew.com/post/tor-relay-webhosts-list/ <comment> Pick-A-Hill2019 7 of the 9 providers listed are marked as 'Non-exit nodes only'. Generaly speaking, operating a non-exit Tor relay isn't going to cause any issues with the majority of providers. It's only when operating an exit relay* that things start getting more ... _problematic_.

*An Exit Node (User --> Tor --> Your Node --> WWW ) vs. a Non-Exit relay (User --> Tor --> Your Node --> Tor )</comment>