Android Developer Income Report #10 - <AUTHOR> http://www.kreci.net/reports/developer-income-report-10/

<comment><USER2> Love these posts; even though the website is heavy on ads, I feel like the tradeoff is that you are opening up your ledger and letting us all glance at it. I have no problem with you wanting me to click an ad or two in the process.

You are genuinely producing content that is valuable to me (at the least, interesting). Thanks for sticking to your guns and continuing to do these series.

<comment><USER3> I wasn't really aware of the ads (running AdBlock), but I think he is a little bit abusing his blog. I think HN traffic is very valuable if he knows how to leverage it.

<comment><USER4> As long as people can't game HN points, I don't think there's a problem with people trying to get their ads on front page - Only if enough people thought the content was worth looking at the ads it gets upvoted, so the quality stays good. (As an aside: I don't know much about this, but wouldn't it be relatively easy to create a couple of dozen hn accounts, set up a script and upvote any post you like.. Indeed, with the amount of geeks visiting the site, I'd be surprised if it hadn't already been done. Anyone care to explain?)

<comment><USER5> in reply to your aside: you could use something like Twill for command-line navigation script (doesnt work with javascript though I don't think) <http://twill.idyll.org/commands.html>

</comment></comment></comment></comment><comment><USER6> Would be interesting to get a summary at some point of how many total hours you spend on each of these and when you spent it.

</comment><comment><AUTHOR> As usual all comments are welcome and very desired! =)

<comment><USER7> Those Google adds are really distracting for me. It's good to see you're still doing so well though.

</comment></comment><comment><USER8> I remember your post from about a year ago when you quit your day job and wanted to make money with website flipping. However, I haven't checked your blog since then and this looks like you're doing quite well.

</comment><comment><USER9> What are his running costs?

</comment><comment><USER10> are you making all your android income from those 7 apps listed on your site? Can you give a breakdown of income per app ?

</comment><comment><USER11> quite interesting

</comment><comment><USER12> Really? This is upvoted on HN and on the front page?

What are the apps? Let's see, all super simple, very marginal quality gag apps, presumably with lots of ads since that is the income.

And an e-book on how to do this? How to flood the Android market with apps that exist ten times over so you can make a few pennies off the ads?

Do we really need updates on this monthly? Yes, you can make a little money shoveling endless crap and putting ads on it. But I don't personally find it something to aspire to.

</rant>

<comment><USER12> Really? Downvoting? Please comment on why you think this is frontpage material while you are at it.

The apps are crummy, there's no denying that. How does that fit in with typical HN content of trying to build good, no, great, products?

And an ebook on how to do it? _sigh_

<comment><USER3> You didn't ask "Please comment on why you think this is frontpage material while you are at it." on your first comment. You are saying something like "You stupid HN crowd, this shouldn't be on front page and it's useless".

You are not the one who decides things that get to the front page, but I don't bother answering if you asked why I upvoted it: It's interesting.</comment></comment></comment>


Fossil Found on Mars - <AUTHOR> http://www.meteorwatch.org/2012/11/20/fossils-found-on-mars/

<comment><USER2> Cute, but this isn't Reddit.</comment>


Sustaining Digital Certificate Security - <AUTHOR> https://googleonlinesecurity.blogspot.com/2015/10/sustaining-digital-certificate-security.html <comment><USER2> > It's obviously concerning that a CA would have such a long-running issue and > that they would be unable to assess its scope after being alerted to it and > conducting an audit. Therefore we are firstly going to require that as of > June 1st, 2016, all certificates issued by Symantec itself will be required > to support Certificate Transparency.

Symantec said they did an audit, Google spent 'a few minutes' and found many more mississued certificates just from the CT logs. In other words, Symantec can't audit themselves, so Google now require public issuance logs for all their certificates.

> [Google] expect Symantec to undergo a Point-in-time Readiness Assessment and > a third-party security audit.

This is a massive (and justifiable) smack in the face to Symantec.

Disclaimer: we're a Symantec competitor, as you may have realised:

[https://certsimple.com/blog/seal-in-search](https://certsimple.com/blog/seal- in-search)

[https://certsimple.com/blog/sgc-ssl- certificates](https://certsimple.com/blog/sgc-ssl-certificates)

<comment><USER3> What is a "Point-in-time Readiness Assessment"? I googled it and found it in the requirements for some CAs, but not what it actually is.

<comment><USER4> "Point-in-time" is a term of art for audit. It basically means that a third party will attest to a given state at a given time. They're in contrast to "continuous" audits, which is more focused on auditing records over a period of time, or on a recurring basis.

A "point-in-time readiness assessment" is kind of redundant, but it basically means getting a third party to come look at their CA (processes, procedures, standards, implementation) and assert on Symantec's behalf that it meets some criteria.

<comment><USER3> Thanks for clarifying.

</comment></comment></comment></comment><comment><USER5> Days after the initial reports of rogue certificates being issued, Symantec wrote in their blog that they had already fired employees:

 _In addition, we discovered that a few outstanding employees, who had successfully undergone our stringent on-boarding and security trainings, failed to follow our policies. Despite their best intentions, this failure to follow policies has led to their termination after a thoughtful review process... At the end of day, we hang our hats on trust, and that trust is built by doing what we say we're going to do._

[http://www.symantec.com/connect/blogs/tough-day- leaders](http://www.symantec.com/connect/blogs/tough-day-leaders)

It's starting to look now like this the fault of systemic flaws at Symantec, and not just a few employees who didn't follow procedure.

<comment><USER6> Yes, that was a very old-school way of dealing with the problem. It's mostly symbolic.

Most problems are systemic, which is a nice way of saying "ultimately management's fault".

Most things that most people do, most of the time, are reasonable in the circumstances. Management creates the circumstances. "Human error" is a non- explanation.

Here's a book on the topic, often called systems thinking: [http://www.amazon.com/Field-Guide-Understanding-Human- Error/...](http://www.amazon.com/Field-Guide-Understanding-Human- Error/dp/1472439058/ref=asap_bc?ie=UTF8)

Getting even more bookish: firing "bad apples" for "human error" is a form of substituting an easier question when presented with a harder one, as Kahneman describes in Thinking Fast and Slow.

<comment><USER7> >Most problems are systemic, which is a nice way of saying "ultimately management's fault".

Systemic problems are _everyone_'s problems. Both management and employees are a part of the same system. Firing bad apples for human behavior is equally as pointless as firing/resigning management (or pointing fingers).

<comment><USER8> Managers are the ones responsible for setting the system. Systemic problems are their fault.

<comment><USER9> Not past a certain level where many people become part of the problem, otherwise replacing managers would be a effective way to fix organisations.

<comment><USER10> Replacing managers IS an effective way to fix organisations, if there is a systemic problem, if other parts are not problematic and if you find good replacements.

</comment></comment></comment></comment></comment></comment><comment><USER11> It makes me* uncomfortable that Google has effectively appointed themselves as the internet police and using their power to push people around like this. But at the same time, there is nobody else (?) who is taking care of this, and I suppose the good of someone/ _anyone_ looking into and taking action on the sorts of serious problems that Symantec has exhibited probably outweighs my discomfort.

* Disclaimer: Google employee, no connection to any of this cert stuff.

<comment> glass- It makes me uncomfortable that the CA system is set up in a way that makes this necessary. If an alternative, such as Convergence, had taken off we wouldn't be in this situation.

<comment><USER12> If an alternative, such as Convergence, was perfect, it would have taken off.

<comment><USER13> This argument is valid only if you implicitly assert that the current system is perfect. Every system has it's trade-offs.

<comment><USER12> exactly. thats what makes the parent comment so preposterous.

<comment><USER14> If this is your argument it also requires the assumption that the trade-offs with Convergence are identical in both scale and type to the current system; at least in reference to this specific problem.

</comment></comment></comment></comment></comment></comment><comment><USER15> A clear example of too big to fail. If this was any smaller CA (like cnnic before), they would now be gone from the trusted roots.

I wonder what's coming out of this. Personally, I think Symantec doesn't care in the least about Google's sabre rattling here. It's clear to everybody that Google hardly wants to release a browser which doesn't display 50% of the encrypted web sites.

This is a further issue with the current PKI: too few CAs are around (after symantecs buying spree lately) which gives them way too much power to do what ever they want. Furthermore, the process of acquiring a certificate (especially an EV one) makes switching CAs very burdensome, so not even bad reputation will compel people to leave.

What a mess.

<comment><USER16> Symantec already agreed to start using Certificate Transparency in the near future, as per Google's request. This is a good thing.

</comment></comment><comment><USER17> Is the CA model just unfixably broken at this point? What should replace it if so?

<comment> glass- Convergence was the perfect replacement, but it never gained any traction.

Moxie's talk at BlackHat[0] introducing it is a good watch for those unfamiliar with the idea, and if you want to be wistfully frustrated at what could have been.

[0] [http://www.youtube.com/watch?v=Z7Wl2FW2TcA](http://www.youtube.com/watch?v=Z7Wl2FW2TcA)

<comment><USER18> We still don't know how that would have worked in practice. Even skilled people have trouble making trust decisions reliably for everything and while we'd avoid the compromised CA threat I'm certain we'd start seeing equivalents like dishonest or incompetent notaries – and those might last longer because fewer people see the dodgy results since not everyone is using the same set of notaries.

If it became popular, it's really easy to imagine something like the Great Firewall being configured to block outside notaries to encourage people to use local notaries which are still under the control of the local authorities.

That's not to say it's not interesting work or potentially a solid improvement, only that I would be extremely hesitant to make absolute statements about an untested internet-scale security protocol. The approaches we're seeing work now do so because they're adding to well-understood protocols (e.g. HSTS, key-pinning, etc.) or don't change the trust model (if Google goes rogue, Chrome users are already screwed).

<comment> glass- I have no doubt that there would be incompetent or dishonest notaries. The difference being that in an alternative universe, where Convergence is used, a rogue notary doesn't destroy the trust of the entire system. When Symantec is a rogue notary, oh well, Mozilla and Google push out an update and no one uses Symantec anymore, their notary just becomes irrelevant. However, in this reality, the darkest timeline, deciding to stop trusting Symantec immediately breaks 30% of HTTPS websites on the internet, so even though Symantec has given everyone plenty of reasons to stop trusting them, we have no choice. Same for Comodo, their notary would have stopped being used in 2011 (after their root certificate compromise).

Instead, with Comodo and Symantec combined, we now have over 60% of HTTPS websites secured by authorities who are incompetent and/or dishonest.

</comment></comment></comment></comment><comment><USER19> >Symantec performed another audit and, on October 12th, announced that they had found

>an additional 164 certificates over 76 domains and 2,458 certificates issued for

>domains that were never registered.

:|

</comment><comment><USER20> I don't know much about how the CA system works, but "there's something fishy going on with this CA" in conjunction with "starting with June 1st 2016" is not very reassuring.

<comment><USER21> Well the CA in question represents a large market share of both internet and non-internet certs. You can't just top trusting them, large parts of the internet would crash and burn.

<comment><USER22> And until that happens, why do we expect and significant portion of Symantec's customers to care? And unless they care, why would Symantec?

Apple are using a Symantec ssl cert right now:

"The identity of Apple Inc. at Cupertino, California US has been verified by Symantec Class 3 EV SSL CA - G3. Valid Certificate Transparency information was supplied by the server."

But their level of give-a-shit is clearly demonstrated as well:

"Your connection to www.apple.com is encrypted using an obsolete cipher suite.

The connection uses TLS 1.2."

</comment></comment></comment><comment><USER23> All the more reason why client-side encryption needs to become part of our daily interaction with software and cloud services.

<comment><USER12> You mean client-side authentication? And how would this have helped.

<comment><USER24> I would venture that your parent meant that we should use 'dumb' cloud services that just store encrypted data which are then retrieved and de- crypted on the client side.

<comment><USER23> Bingo.

<comment><USER25> Say you attempt to do this all in JavaScript; you've still got to deliver the page (the encryption code, really) to the user securely; otherwise, I can modify it s.t. when it gets a blob from the server and decrypts it on the client, that decrypted value is also sent off to a shady spot. You still need to get your app from you to your user securely, and how do you do that?

It's the core problem really: how do you distribute your public key? How do you make sure Joe user gets the right public key? Today, we have the CA infrastructure, which admittedly isn't great, but… what would you do differently? (And the big problem is that it needs to work for average Joe.)

<comment><USER26> Couldn't you have a browser plugin that would verify your js is being served up from the correct source?

<comment><USER27> Subresource integrity (sort of) solves this.

[http://githubengineering.com/subresource- integrity/](http://githubengineering.com/subresource-integrity/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> To state the obvious (again) the third-party based trust system underlying TLS is broken. It places a massive amount of faith in a large crowd of human beings (the collective employee populations of all the CA's in the world) to behave with absolute rectitude and discipline for years and years without fail.

The sad part is that all of us, collectively, trust pretty much our entire financial lives and other matters requiring secrecy and authentication to this system everyday. It's mind-boggling how we came to be in this situation. How did the entire society, including very very smart security experts came to vouch for and blindly trust this system?

</comment><comment><USER29> DNS certs would be better [https://en.wikipedia.org/wiki/DNS- based_Authentication_of_Na...](https://en.wikipedia.org/wiki/DNS- based_Authentication_of_Named_Entities)

</comment><comment><USER30> This reminds me of [https://www.agwa.name/blog/post/how_to_responsibly_misissue_...](https://www.agwa.name/blog/post/how_to_responsibly_misissue_a_cert)

</comment><comment><USER31> This is terrible. This is sad. Is it any wonder so many people have no faith in Government, in the Financial system? How much of the system we take for granted is corrupt? I'm not intending to be negative, I know I am. But for Pete's sake. This sucks sucks sucks.</comment>


The McRib is back – now there's an app to help you find it - <AUTHOR> http://www.dailymail.co.uk/news/article-3946144/McDonald-s-McRib-returns-new-iPhone-locator-app.html <comment><USER2> I really liked it here in Greece back in 2000. I hope to see it again.</comment>


Margaret Hamilton, lead software engineer, Project Apollo - <AUTHOR> https://medium.com/@3fingeredfox/margaret-hamilton-lead-software-engineer-project-apollo-158754170da8

<comment><USER2> She also developed Universal Systems Language [1] [2], which I'm struggling to comprehend how it is different from UML, or why it would be a superior approach than a functional approach. Can someone who has actually worked with USL comment on the experience?

[1] [http://en.wikipedia.org/wiki/Universal_Systems_Language](http://en.wikipedia.org/wiki/Universal_Systems_Language)

[2] [http://htius.com/About_Us/About_Us.htm](http://htius.com/About_Us/About_Us.htm)</comment>


Ask HN: Any single developers or small teams making a living from desktop apps? - <AUTHOR> Hi HN, are you a single developer or a small team  making a living (or earning something) from desktop applications? Care to share something about your story? I've been building web apps for too much time, and would like to have one or two apps (preferably desktop apps), so I'm looking for inspiration and stories of people doing it.. <comment><USER2> You also may want to check/ask on Indiehackers.</comment>


A Catfish Stole My Identity - <AUTHOR> http://row-k.tumblr.com/post/74992087173/a-catfish-stole-my-identity <comment><USER2> I hope he asked the writer for permission before posting a private message. That message contains a lot of very personal information.

<comment><USER3> This worried me as well. I didn't read the whole letter, but there wasn't anything at the start or end about "feel free to tell the whole internet my full name and location, that I'm bisexual, and all of this other stuff about me."

</comment></comment><comment><USER4> For everybody who doesn't know where that catfish use comes from (I didn't):

[http://en.wikipedia.org/wiki/Catfish_(film)](http://en.wikipedia.org/wiki/Catfish_\(film\))

Probably itself a "fake documentary": "why the filmmakers would begin obsessively documenting Nev's online relationship so early on."

<comment><USER5> I vaguely remember seeing the trailers for this in the theaters and thinking at the time "oh great, another fake 'documentary', just what we need". So yeah, it does not surprise me in the least that it was most likely faked (or at least partially faked). It had been a while since I saw the trailer and I didn't remember the name of the movie, so thanks for putting these two together, I never would have connected the two otherwise.

<comment><USER6> Fake or not, it's a really great movie. Recommended to anyone on HN looking for movie suggestions.

</comment></comment></comment><comment><USER7> I have to wonder whether there is an easy technical countermeasure to catfishing, or whether human psychology will always be the insurmountable hurdle here.

It seems like it would be easy to verify that a given message is from a particular internet pseudonym, or to construct a challenge that would be easy for a real person to respond to, but difficult for a catfish. We've had proof of life from kidnappers seeking ransoms before the Internet even existed, after all.

If you ever watched the Catfish movie or the MTV show, you'll notice that the common element is that the victims all have an overwhelming desire for their relationship to be non-fraudulent, to the point where they actively ignore any and all warning signs. Is there something that people with low technical ability can do to verify online counterparties that cannot be affected by their desire for the results to come out in a particular way?

<comment><USER8> PGP.

<comment><USER9> PGP is essentially useless for verifying the identities of people you've never met who are not well-known.

<comment><USER10> Without a chain of intermediaries, anyway.

</comment></comment></comment></comment><comment><USER11> Felt a lot like a Radiolab story, somehow. Maybe the weird melancholy of the "I still feel that I'm your friend, though you're not mine, and that's alright" note it left out on. Strikes a similar emotional chord to, say, knowing someone with dementia.

(That, and as a writer, it really kind of makes me want to see the "intuitive narrative conclusion": the blogger and the victim becoming real friends. But it's left without that resolution, because that's what life really is like.)

</comment><comment><USER12> I've never heard of "catfishing" before. I'm inferring it means "impersonating"?

<comment><USER13> "Catfishing" describes con schemes that involve the mark developing a trusting (usually romantic) relationship with a fictional person.

In the most common form, the conman finds a guy on a dating site, and pretends to be a girl who is interested. The relationship escalates for a few months, including swapping risque photos, until they try to meet in person (the fictional identity is always several states away). The conman than uses the pretense of logistical barriers and bad luck to extort cash from the mark, while delaying the in-person meeting ('my connecting flight through Detroit canceled, and I don't have money for a hotel! please wire me two hundred dollars ;_;'). The mark gets increasingly distraught and desperate, and is too emotionally involved to realize he is being lied to.

Probably the most famous catfishing case in the last year was college football player Manti Te`o's fictional dead girlfriend (which does not completely follow the textbook outline above): [http://deadspin.com/manti-teos-dead- girlfriend-the-most-hear...](http://deadspin.com/manti-teos-dead-girlfriend- the-most-heartbreaking-an-5976517)

<comment><USER14> The Te'o case, as you mention, doesn't follow the outline above, because to many, there is the definite possibility that Te'o was in a homosexual relationship with the person involved (that claimed to have hoaxed him), and that this spin was much more damage control for Te'o (given that the NFL does not have an 'out' gay player).

</comment></comment></comment><comment><USER15> This may come off as jokative, but the people that are tricked could always ask for a picture of the person with a newspaper or a love note for proof that they are talking to the actual person, and not just some impersonator.

Personally, I can't get past the fact of falling for someone online. Just today I met one of my online professors and it was awkward, yet online we're both very chatty.

</comment><comment><USER16> Tragic. I still don't get the objective of the person pulling these scams: it doesn't seem they want money or fame or any of the 'normal' drivers. Are the scammers typically lonely individuals or are they suffering from some social disorder such that they are rewarded by others' pain?

<comment><USER17> The objective isn't necessarily malicious, for people with very low self esteem and disdain for themselves it can be nice to talk to someone without any personal baggage, it can be nice to be someone interesting for once and once your in too deep there's no coming back, admitting your identity is fictional is a death sentence for the relationship.

<comment><USER18> I agree with this. Someone who doesn't want to be who they are -- which is sometimes a reason people to into acting -- or wants to have, as you said, no personal baggage. I kind of see it as fiction writing for lazy people: instead of creating a cast of characters, the "scammer" focuses on one in great detail. This person has the excitement of studying another person's identity through their photos and/or videos and making up an entire fictional identity around it.

</comment></comment></comment><comment><USER19> My roommate repeatedly gets catfished on dating sites. It's kinda sad but he's just an easy mark. At least I've talked him into not giving strangers over the internet money (though he'll still occasionally give $20 but never more at least now).

It's a shame too, because he's not a dumb guy at all.

<comment><USER20> Dumb is defined as "lacking intelligence or _good judgment_ ".

Sounds pretty dumb to me.

<comment><USER19> Well, yeah, I hear you, but everyone has their area. I know folks with Ph.D.s who fail at simple stuff.

</comment></comment></comment><comment><USER5> This is the first I've heard the term catfishing. Can someone provide a more concrete definition? Is it simply pretending to be someone else online?

<comment><USER21> [http://en.wikipedia.org/wiki/Catfish_(film)](http://en.wikipedia.org/wiki/Catfish_\(film\))

It originates from a movie, and is also now a TV show.

</comment></comment><comment><USER22> I was hoping this would turn out to be some bizarre tale of monkey-wrenching, involving high school student RFID tags, or a lost RFID debit card, or some such thing, and a scientific study that involved tagging catfish, to study their migration patterns.

C'est la vie...

</comment><comment><USER23> Well worth reading, if only to be someone else for a moment and also to remember that internet is a harsh place. I really feel for this person.

</comment><comment><USER24> Am i the only one who thinks it was kind of fucked up to publish the victim's name?

</comment><comment><USER25> Urban Dictionary definition of "catfish": [http://www.urbandictionary.com/define.php?term=catfish](http://www.urbandictionary.com/define.php?term=catfish)

</comment><comment><USER26> Doesn't sound real. Maybe it's fictional piece writen out of sheer creativity of that guy or for promotional purposes?

</comment><comment><USER27> I just got an email this morning that someone tried to sign me up for Kik. I was able to disable the service through that email.</comment>


ReDsgn.Co – Redesign stories worth sharing - <AUTHOR> http://redsgn.co/ <comment><AUTHOR> The main idea is to curate worthy stories of redesigned products, concepts and unique point of view in designs.</comment>


Setting a Baseline for Web Security Controls at Mozilla - <AUTHOR> https://blog.mozilla.org/security/2017/01/25/setting-a-baseline-for-web-security-controls/ <comment><USER2> zap is bit like some parts of burp suite, right?

<comment><AUTHOR> Well, burp suite is a bit like some parts of ZAP :) Theres an overlap, but ZAP is completely free and open source. It was originally a fork of Paros (now much extended) which actually predates burp.</comment></comment>


EPPlication – Our Test Automation Framework - <AUTHOR> https://github.com/nic-at/EPPlication <comment><AUTHOR> Years ago I helped a colleague automating some tests for the austrian domain name registry. The result was EPPlication, our own test automation framework.

We needed something to:

\- create tests without programming skills

\- execute tests

\- display test results

I did some basic research if there is an existing solution for our problem but haven't found something.

Recently I was given green light for publishing the code on github. To make getting started easier it's now dockerized so you can get it up and running easily.

Feedback welcome!</comment>


A most (un)realistic story about privacy - <AUTHOR> https://areknawo.com/the-most-unrealistic-story-about-privacy/ <comment><USER2> I'd hate to sound dismissive, but what was "the point" of this article? Is it based on something that actually happened? Is it trying to tell me to do something? Is it just a nice story to read?

<comment><USER3> It's a parable that illustrates the crux of everyday privacy issues. Maybe it's intended for a non-technical audience.

<comment><AUTHOR> Yeah, that's true... Also, it's just a nice story to read. I'm a beginner blogger and wanted to try to write something different than usual...

<comment><USER3> Good work! I think your blog is beautiful and the story is illustrative. I enjoyed reading it.</comment></comment></comment></comment>


Researchers Connect Flame to Stuxnet - <AUTHOR> http://www.securelist.com/en/blog/208193568/Back_to_Stuxnet_the_missing_link <comment><USER2> After reading Sanger's NYT piece, I am becoming more and more concerned about the administration leaking/deciding-to-release information about Stuxnet. As this article shows, once the cat is out of the bag people can start learning all kinds of interesting things about your intelligence activities.

Usually such covert acts which could be considered an act of war are separate and disjointed. You find a spy in East Germany and it's a one-time incident. But with technology, you find one op and you start pulling the thread and all sorts of ops come out of the woodwork.

I'm a libertarian and definitely support a more open society. But I also believe that any government must keep secrets on occasion. Whether or not Stuxnet (or any other sort of cyber-warfare) was a good idea is a separate issue. My concern is that, from a technology standpoint, there may not exist the separation of operations that is critically necessary for continued intelligence activities to be successful.

Or, to rephrase, Stuxnet wasn't just the ratcheting up of cyber-warfare in the particular arena of nuclear non-proliferation. With the acknowledgment that the U.S. is responsible, and the way deconstructing one operation can lead to exposing another, it's ratcheting up the stakes for all intelligence-based cyber activities in all arenas. When the eventual shit storm comes, the U.S. will be the one that gets the blame for it (fairly or not).

<comment><USER3> The US govt has basically thrown down the gauntlet to every hacker in the world and invited them to take a crack at the US. I hope the leak was worth it, for Obama's reelection campaign. Because it was incredibly irresponsible to boast about it, that is like a red rag to a bull.

<comment><USER2> I'm a firm believer that the president gets final call on what's secret and what's not. If that wasn't the case, you'd have the intelligence agencies basically running around unfettered.

I also understand that it's an election year, and the party that is out of power is going to do their best to make everything into a crisis.

Having said all of that, when the administration releases information that affects programs that might have taken large sums of money to develop over many years, that might have many more years of usefulness, that has the potential to change the geopolitical landscape for the country for the worse, and that draws attention from every hacker on the planet? It's a little more serious than the usual election year nonsense.

My concern is that I do not believe the country received any benefit at all from the release, and the harm could go for quite some while. Quite frankly when things like this happens it helps make a strong case for the idea that the agencies _should_ keep things from oversight, and I think that's the worst part of the whole thing. We need to get rid of a lot of the secrecy we have -- perhaps 99% or more -- but the things that remain secret should be soberly treated as such. Time will tell what kind of damage has really been done after all the smoke clears. Hopefully not much, but I doubt it.

<comment><USER4> But the administration has rules, yes secrecy is determined by executive order but there are processes to follow. You can't say some stuff is so secret that you can't confirm or deny and then in the next breath brag about it.

</comment></comment></comment></comment><comment><USER5> Quote "The above conclusions point to the existence of two independent developer teams, which can be referred to as "Team F" (Flame) and "Team D" (Tilded). Each of these teams has been developing its own platform since 2007-2008 at the latest."

This ties in with the data that David Sanger released in his NY Times article just over a week ago. He reveals that the NSA collaborated with Israel's Unit 8200 to create Stuxnet in an op titled "Olympic Games". So we can probably just rename them to "Team USA" and "Team IDF".

Sanger's article: [http://www.nytimes.com/2012/06/01/world/middleeast/obama- ord...](http://www.nytimes.com/2012/06/01/world/middleeast/obama-ordered-wave- of-cyberattacks-against-iran.html?_r=3&pagewanted=2&seid=auto&smid=tw- nytimespolitics&pagewanted=all)

<comment><USER6> Please don't refer to that NYT article as "data" (noun: _Facts_ and statistics collected together for reference or analysis). The it-must-have-been-us presumptive mentality despite the absolute lack of concrete evidence bothers me to the point of contempt.

<comment><USER5> Dear "forgotusername". David Sanger is a Pulitzer prize winning reporter and Chief White House correspondent for the NY Times where he has been for a spectacular 30 year career. He worked with the US administration to determine what data in that article was safe to publish and what would compromise ongoing ops.

<comment><USER6> Making an appeal to authority doesn't change anything. Most people seem to fail to grasp that there is an $8bn industry spanning the globe who _thrive_ on secret software vulnerabilities.

Beyond the presence of these, the only surprising fact surrounding either worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is nothing to demonstrate either of these worms weren't written by an entity as relatively benign as an acutely talented, bored teenager.

But ignore reality, pepper dramatic terms like Iran, cyber war, espionage, license to kill around liberally and see what effect it has on your freedom to use your computer in coming years. That may be the only tangible result of all this hot air.

You should also be aware that same industry stands to make the most direct gain from any increase in public perception of information security, and any resulting regulation.

<comment><USER7> > Beyond the presence of these, the only surprising fact surrounding either > worm is that Stuxnet targeted Siemens PLCs. If it weren't for that, there is > nothing to demonstrate either of these worms weren't written by an entity as > relatively benign as an acutely talented, bored teenager.

Apart from the fact that flame used a previously unknown chosen prefix collision attack against MD5? I'd love to meet that bored teenager...

[see <http://news.ycombinator.com/item?id=4080240>]

</comment></comment></comment></comment></comment><comment><USER8> I have to say, although I can only appreciate at a distance the level of skill needed to pull something like this off, reading articles about it blows my frickin' mind. It is both fascinating and terrifying that there are people out there who can do these kinds of things. This, imo, is the stuff that really separates the wheat from the chaff when it comes to hackers. And just look how the media frenzied over the likes of LulzSec. I hope they never have to grasp, first hand, just how deep that rabbit hole can go. Really, money and political whim aside, a large portion of our freedom can be attributed to these individuals. That is damn scary. I hope they're kept on a very tight leash, anyway.

<comment><USER9> > Really, money and political whim aside, a large portion of our freedom can > be attributed to these individuals.

How so?

<comment><USER10> We won _the cold war._

<comment><USER11> The soviets had an economic crash.

The USA did not win the cold war, the USSR lost it.

<comment><USER10> Wow, I never thought about it like that. Imagine how much earlier _the cold war_ would have ended if American actions effected the allocation of Soviet resources? ;)

<comment><USER12> Do you ever question that narrative? I know it's a widespread one, and it seems to make sense, but I'm wondering how many of those who bring it up have retraced the research or have the background to even be able to retrace it.

This is not a dig at you -- who knows maybe you _did_ do the research, and if not, it's a probably a good and reliable strategy to trust the consensus narrative by default.

<comment><USER10> I appreciate your comment, in fact I think a lot of this thread is based off blind adherence to the popular narrative (just look at the attention given to who leaked and why). I have done a lot of research and reading in this area. The intelligence/military arena is a hobby/fetish of mine. Just look at the impact of the Stinger and the broader US involvement with Russia's occupation of Afghanistan (Ghost War is the canonical reference). For further evidence of the US's awareness of the importance of economics take a look at the grain subsidies and the discussions for and against.

</comment></comment></comment></comment></comment></comment></comment><comment> at-fates-hands The most fascinating part of this for me was the fact it looks like Flame was developed prior to Stuxnet. Not the other way around as most people believed.

<comment><USER13> Well flame is alot more complex than stuxnet, so it only makes sense it would be better at keeping itself hidden, and for longer.

</comment></comment><comment><USER14> If true, since we now know who wrote Stuxnet, therefore we now know who wrote Flame.</comment>


Ask HN: Things New Developers Struggle with Most? - <AUTHOR> Hi HN! I am developing some educational materials based around programming/web development (PHP, Java, language agnostic concepts) and I am wondering what your personal experiences have been regarding the concepts/topics/workflows that are most challenging to new (or even intermediate) developers. These could be struggles you've personally had, or difficulties you've seen while mentoring or pair programming.<p>I want the curriculum I design to directly solve real problems that developers face, rather than be based on my own single subjective experiences/personal bias. I think aggregating a list of these topics might not only be selfishly beneficial for my project, but might be a good resource for a new programmer who can see what challenges they might face (and more importantly, that those challenges can be overcome!). <comment><USER2> Building an accurate mental model of a typical web request is important and sometimes tricky. You mention both PHP and Java. I'm not sure how you're planning on teaching both of these, but using each to build a web app has different implications from the other regarding how/when/by what your code gets called. Adding JavaScript makes it even more complex.

<comment><AUTHOR> Thanks for your answer; that is a great point about the mental model of a web request. I mention PHP and Java because I have experience in web development in both languages, but my training materials would have completely separate tracts for each language.

Essentially I would like to target non-academically trained beginners who want practical/actionable knowledge in the respective language. So my basic outline would be: installing the language, choosing/installing an IDE, setting up a simple web server, language basics, OOP, database interaction, front-end rendering, etc. The reason for this Ask HN is that I would hate to waste extra time on something that 90% of students will grasp immediately, at the expense of a topic that might need extra attention.</comment></comment>


Aus Govt may record users web history, email data - <AUTHOR> http://delimiter.com.au/2010/06/11/govt-may-record-users-web-history-email-data/

<comment><AUTHOR> First the great firewall of Australia, now this.

Our govt really are the worlds biggest luddites.

<comment><USER2> To what do you ascribe the paranoia? To me, it seems Australia is a lowish- crime country which, despite its cultural closeness to the US and UK, doesn't have nearly as many international enemies.

So why so much interest in preemptive data collection for law enforcement? Has there been a crime wave (even a cynically exaggerated one) using the internet?

Is there already a tradition of surveillance and meticulous just-in-case record-keeping, for example of all books someone has purchased or checked out of libraries?</comment></comment>


Blockchain in Healthcare - <AUTHOR> https://www.devteam.space/blog/blockchain-in-healthcare/ <comment><USER2> > _While blockchain technology would not have prevented such attacks, it > could, in some instances, have prevented the hackers from being able to > access much of the confidential data._

> _Since the access and transfer of data can be made more secure by > blockchain, it facilitates a more trusting environment where doctors, > patients, and third parties can regularly transfer data to one another._

This is some hand-wavy bullshit. How does Blockchain tech prevent access to confidential information? How can it be made more secure?

> _Blockchain-based electronic health records would allow records to be easily > sent from one location to another making them, in effect, the first ever > anywhere anytime electronic medical record. To potential of these kinds of > records to transform patient care is enormous._

Sure, except you need to send the entire blockchain - or you can send excerpts, in which case there's no need for a blockchain.

I'm tired of reading and pasting excerpts. This reads like a high school junior trying their best to justify picking an essay topic to a teacher. I'd give this a generous D-.</comment>


Ask HN: Is an automatic filter to remove seziure-inducing content possible? - <AUTHOR> It seems like it should be possible to make seizure-protecting software or hardware that does what this does in real time - http://trace.umd.edu/peat#download - and filters the screen but I can't seem to find any.  Is it infeasible to do this sort of processing in real time?  If, say, an HDMI dongle or software could protect epileptics by pre-processing the video signal to remove seizure-inducing content, it would seem like a big win. <comment><USER2> I see more content with strobe lights and crazy effects. I always wonder. Thank your for posting this.</comment>


Show HN: Dissoc, a simple Reddit like site without voting system - <AUTHOR> http://dissoc.xyz <comment><USER2> The heading/title should say:

       "We reimplemented reddit, but took out the feature of reddit that made reddit a success"

PS: the OP's site is now super NSFW. I assume someone is tying to prove a point :)

<comment><USER3> From the show HN rules linked at the very top of the page:

 _In Comments

Be respectful. Anyone sharing work is making a contribution, however modest.

Ask questions out of curiosity. Don't cross-examine.

Instead of "you're doing it wrong", suggest alternatives. When someone is learning, help them learn more.

When something isn't good, you needn't pretend that it is. But don't be gratuitously negative._

</comment></comment><comment><USER4> Without a voting system, users have no way to find "quality" content. Everything is mixed together, which means that the signal to noise ratio is only going to get lower and lower as more people contribute to the community.

<comment><USER5> This exactly

The voting system is extremely important if not necessary for any sort of forum site. Like phail said you won't be able to find quality content, which means if the site takes off or gains enough followings it will devolve into chaos of shitposting, fake news, and garbage. Of course there still will be good content yes but you won't be able to tell one from another.

<comment><USER6> I consider that to be a feature. Voting systems mean that homogeneity is prized first and foremost, since most people only look at what's highly voted. This leads to a situation where the site will foster users with particular views and biases. Voting systems can also be gamed (like on Reddit), when you can pay some people to bot-upvote your post. Applied to comments, it's even worse. "Echochambers" on places like Reddit aren't formed just from mod bans, but because they attract users who upvote content that appeals to their biases and downvote the rest. That's how they control the discourse.

This is in my view one thing 2channel-style boards get right. Not everything has to be about "quality content", and it does a bit of a disservice to users to say that they have such little control that they can't tell good content from bad. Humans aren't animals, we don't just take what we're given. Sites like Reddit, HN and Twitter destroy that agency within us, and it's a shame.

Here is an essay by Shii, one of the most well known historians of imageboard culture on the value of anonymity: [http://wakaba.c3.cx/shii/](http://wakaba.c3.cx/shii/)

</comment></comment></comment><comment><USER7> Maybe I'm biased, but in the last days there were plenty of Show HNs about social networks:

[https://news.ycombinator.com/item?id=21252544](https://news.ycombinator.com/item?id=21252544)

[https://news.ycombinator.com/item?id=21241476](https://news.ycombinator.com/item?id=21241476)

[https://news.ycombinator.com/item?id=21224211](https://news.ycombinator.com/item?id=21224211)

[https://news.ycombinator.com/item?id=21312318](https://news.ycombinator.com/item?id=21312318)

<comment><USER8> All centralized, too. :(

</comment></comment><comment><USER9> You can do without voting. All you need is a way to discern what is popular, in order to display 'popular' and 'new' categories. For example by measuring comments and clicks, maybe the amount of time users spend on the comment page relative to the amount of comments. Not a great idea since it can be gamed, but what can't nowadays.

It would probably favor clickbait, violence, etc like every other system. The only escape from this on a user-submitted site, if there are no subcategories outright banning certain content, is what's already in place, just sorting everything by date.

<comment><USER10> content is not valuable just because someone clicked it, you cant know its valuable until after having read it. otherwise its all about the headline, which is a bit of a reality of modern day news, but this would just make that situation worse.

secondly just because you dont want to comment doesn't mean its not valuable.

so basically this just seems like a plainly terrible idea.

</comment></comment><comment><USER11> You could also poll the client to see what threads they're reading. You could add this to an engagement score of some sort.

On a page with a long list, you add this score to all the items on it they're reading</comment>


Google's Quantum Processor May Achieve Quantum Supremacy in Months - <AUTHOR> https://interestingengineering.com/googles-quantum-processor-may-achieve-quantum-supremacy-in-months <comment><AUTHOR> It would be even more exciting if the device doesn't work for large number of qubits. Several theories (e.g. by 't Hoft, by Smolin) predict that quantum computers should not work when amplitudes become small enough.

<comment><USER2> Do you have a reference to these theories? Seems interesting

<comment><AUTHOR> Lee Smolins book "einstein's unfinished revolution" is a fairly accessible, and all of his papers are on arxiv, e.g. [https://arxiv.org/pdf/1902.05108.pdf](https://arxiv.org/pdf/1902.05108.pdf)

Stephen Wolfram has an interesting blog post which is somewhat related [https://blog.stephenwolfram.com/2015/12/what-is-spacetime- re...](https://blog.stephenwolfram.com/2015/12/what-is-spacetime-really/)

't Hoofts book about celular automata interpretation is free at [https://www.springer.com/gp/book/9783319412849](https://www.springer.com/gp/book/9783319412849)

There are several theories predicting collapse of wavefunction which would prevent quantum computers e.g. [https://en.wikipedia.org/wiki/Penrose_interpretation](https://en.wikipedia.org/wiki/Penrose_interpretation)

</comment></comment></comment><comment><USER3> Luckily for the competition Google will also lose interest in and cancel the processor a few months later to focus on developing a new web chat application or yet another mobile OS.

<comment><USER4> This is getting tiring, the same comment over and over again.

<comment><USER5> IKR? This isn't reddit.

</comment></comment></comment><comment><USER6> This seems intriguing.</comment>


Donald Knuth's 80th birthday will be celebrated by two events in Piteå, Sweden - <AUTHOR> http://knuth80.elfbrink.se/ <comment><USER2> Knuth is a unique character. I read the more personal of his books last year, "Things a Computer Scientist Rarely Talks About". It's essentially a transcript of several open lectures he gave at Stanford on topics ranging from his hobbies and side-projects to his thoughts on the Bible and his Christian faith. I've been a staunch atheist for the majority of my life, but seeing Knuth talk so comfortably about his spirituality actually helped me appreciate religion more.

<comment><USER3> What's the little book of his about a man and a woman trapped on an island where they geekily explain things to each other? I might be misremembering the setting...started it once but it was pretty cheesy.

<comment><USER4> Surreal Numbers

</comment></comment></comment><comment><USER5> It makes me sad that Knuth will no longer be at a prime age, but on the other hand, one more year and he will return to perfect power.

<comment><USER6> Three more years until 83, unless I'm misunderstanding.

<comment><USER7> "power", 81 = 3^4

<comment><USER6> Thank you.

</comment></comment></comment></comment><comment><USER8> For some reason, I stumbled across this website way back in August, before it was at all publicly discussed or advertised. So I secured tickets early on, filed for vacation and am gonna enjoy this so much.

<comment><USER9> I'm really glad you're able to go and I hope that somebody who attends will write up a report that the rest of us can read!

<comment><USER8> Sure will!

</comment></comment></comment><comment><USER10> Long may [https://www.nytimes.com/interactive/2014/10/23/magazine/old-...](https://www.nytimes.com/interactive/2014/10/23/magazine/old- masters-at-top-of-their-game.html) be relevant!

</comment><comment><USER11> On the other hand, he'll only be 0x50 in hex years!

</comment><comment><USER12> Why Piteå, of all places?

<comment><USER13> Maybe because of the awesome organ they have there ?</comment></comment>


How to create secure passwords and safely store them offline - <AUTHOR> http://www.hackthis.co.uk/articles/password-generation-and-safe-offline-storage

<comment><USER2> Too much work. One word: [https://passwordcard.org](https://passwordcard.org)</comment>


Container Platform Security at Cruise - <AUTHOR> https://medium.com/cruise/container-platform-security-7a3057a27663 <comment><USER2> It seems weird to me that a self-driving car company is doing work on core server infrastructure things like container security. Does the builtin GCP stuff really not work for them? My impression has been that it's really well thought-out.

<comment><USER3> To be fair, the write up isn't much more that.

TL;DR

They use Okta for SSO, GCP for Service Accounts (automation), vault for secrets, ca and tls, GKE generally, and this is how it all works.

That said, the article is good and the author has a good understanding of what's going on. Typically, you need to know how something works before you can form realistic opinion on whether or not it is secure. Too much of the industry is full of blind trust from people that can get things working but don't scratch beyond the surface of integration.

The author has likely had to understand this in order to explain it to InfoSec assurance, compliance and audit departments, but I think writing it down is really useful for people without the tech.

I think they could expand on why they use vault rather than the secrets engine directly, but I suspect that was because of integrations, protability, and the workload indentity functionality behing newer than their setup.

<comment><USER4> > I think writing it down is really useful for people without the tech.

writing it down, sure. but publishing it is useful for SEO and recruitment purposes.

</comment></comment></comment><comment><USER5> I do not buy the sentiment that self driving car company should leave infrastructure work to cloud providers.

On the one hand, such work has realistic roi, for example, a little foraging into infrastructure tech, allow outsized understanding which translate to outsized benefit. I.e., to have a few guys to work out these details easily help remove common simple defects for a large organization.

Additionally, staying connected with the industry is crucial. Nowadays, your value to hackers can be increased 10x overnight depending on some luck events. And the modern infrastructure is full of holes that a seasoned hacker can easily crack. It's just a matter of discovering the right entry way. And such entry ways keep changing with the new tech.

</comment><comment><USER6> Self-driving car security is going to need a lot more than just following the latest buzzword in the security community and thinking that's enough.

But if the Cruise team is keen on buzzwords that they can then brag to the media about then maybe they should start using the "disconnected self-driving car" buzzword instead, and then implement about a dozen more of Brad Templeton's security recommendations for self-driving cars:

[https://ideas.4brad.com/disconnected-car-right-security- plan...](https://ideas.4brad.com/disconnected-car-right-security-plan- robocars)

Then I might just start believing that GM (or any other self-driving) cars may end up with reasonable but still not bulletproof security in about a decade.</comment>


Bandcamp has paid artists $150m in 8 years, $4.3m in last 30 days - <AUTHOR> https://www.yahoo.com/music/bandcamp-paid-artists-150m-8-years-232844402.html <comment><AUTHOR> If soundcloud goes under, bandcamp could potentially be in a very happy place.</comment>


Johnny Cupcakes - <AUTHOR> http://shop.johnnycupcakes.com/story/

<comment><USER3> Johnny had a commercial dispute with a friend of mine. Short version is that my friend is an amazing designer, one of Johnny's guys ripped my friend off, and Johnny ended up selling my friend's stolen design on his t-shirts.

In the end, Johnny was a real gentlemen and took down the whole line, and actually ended up doing a joint venture with my friend. I think the ripper was fired. He handled it correctly.

</comment><comment><USER4> Fantastic story, and a great non-tech example of the importance of 'releasing often', shifting your focus and business in the direction of the best opportunity.

Reading the story, I don't doubt that Johnny is an energetic person to be in the room with, and he seems to have transferred that into creating an exciting brand experience.

</comment><comment><USER5> _I'd rather have a strong brand filled with knowledgeable customers who truly enjoy and appreciate what I've created instead of making a quick buck - <USER2> just another fad._

Come on now, it hardly gets anymore faddish. It's just t-shirts, and people want them because cool people they know have them. The fact that there is some random theme to them makes it feel like you are "in the know" about something, even though nobody knows what the hell it means ("keep on trunkin'"). Once it hits mass market, the cool early adopters have moved on and it is all over.

It is still inspirational that a guy can succeed like this just by being himself and being an original, which is undoubtedly what got him his early customers. Who knew that people are so hungry for something real that they are ready to line up for four days just to buy a t-shirt? That is somehow depressing.

Awesome story.

</comment><comment><USER6> Regardless of how inspirational this Johnny's business might sound, he's making his money on spam. I've never signed up for 'johnny cupcakes' merch and i've attempted multiple times to unsubscribe. Works briefly, but in a few months the emails start coming again. I don't bother unsubscribe attempts anymore; thank Regex for spam filters.

I am curious as to where he got my address - i usually tag anyone i don't know personally with an alias rather than a real address yet this guy has found a way to get a better email address. his story would be a lot more interesting if it shared that secret to his miraculous success.

<comment><USER7> Try using a disposable email next time. I never give out my real email address anymore. (of course i am the developer of a disposable email app, so i'm a little biased...WhySpam.Me)

</comment></comment><comment><USER8> Talked to him for maybe 10 minutes a couple of years ago in his Boston store. He picked up on my accent so I quite happily gave him a quick brain dump on t-shirty stuff in London, UK. He's very charming and polite.

Love his work.

</comment><comment><USER9> Johnny Cupcakes is a cool guy. We often get hung up on the technology here at HN, but this story makes it abundantly clear to me that business is about people, how you communicate with them and how they feel about you. Johnny Cupcakes isn't selling the utility of being less naked, he's selling membership of a tribe, he's selling the start of many conversations, he's selling mementoes of a cool experience with a cool guy. I think we have far more to learn from this than any number of case studies about AJAXifying a Social Platform with Ruby on Django.

</comment><comment><USER10> I originally thought this was spam, but after checking out the story I realized its an awesome and inspirational story. A story of entrepreneurial drive and passion. Love the site design as well.

</comment><comment><USER11> Be sure to click on the "Next" buttons, they don't scroll the story down, they scroll each little story sideways!

</comment><comment><USER12> I interviewed Johnny last year!!

<http://www.limitemagazine.com/2009/08/qa-johnny-cupcakes/>

</comment><comment><USER13> I'm intrigued about how to deal with the, hum... logistics issues that arise from being 4 days in line.

</comment><comment><USER14> I am honestly disappointed that this isn't about designer cupcakes.

Guess that tells you where my brain is located.

<comment><USER15> I'm going to guess, right about here:

<http://www.teeandcakes.com/blogosphere/>

</comment></comment><comment><USER16> The First time i heard about him, i couldnt believe he wasnt selling cupcakes, this just shows us about branding, its awesome.

<comment><USER17> I've walked by that store for years and until today didn't realize that it wasn't a store that sells cupcakes. I'm kinda glad too, that would have been weird.

<comment><USER16> i know right, going in and asking for cupcakes</comment></comment></comment>


It Started Digital Wheels Turning - <AUTHOR> http://nytimes.com/2011/11/08/science/computer-experts-building-1830s-babbage-analytical-engine.html?_r=1&ref=science

<comment><AUTHOR> Wonderful graphic as well: [http://www.nytimes.com/interactive/2011/11/07/science/before...](http://www.nytimes.com/interactive/2011/11/07/science/before- its-time-machine.html?ref=science)</comment>


You can't trust Amazon Underground - <AUTHOR> http://discours.es/2016/you-cant-trust-amazon-underground <comment><USER2> I have Xprivacy and Cyanogenmod's privacy guard, and also use the Amazon Underground store and apps. I can tell you that with location, contacts, and most other permissions blocked the apps work just fine. So whatever the author did to get this result, it isn't from blocking permissions.

It also seems strange that someone who cares so much about his privacy doesn't have xposed with Xprivacy, because then he could have spoofed the data instead of having to block it all together.

<comment><USER3> Using Xprivacy probably means you're giving up a significant portion of your security for increased privacy. When you are rooted and your bootloader is unlocked you're more exposed to hacking and malware. Also, last I heard the most popular root application by far (SuperSU) was silently acquired by a Chinese company.

I'm not saying you shouldn't use Xprivacy or other root-enabled apps, though, as some are very useful and it may be the only way to get Google to build in some of those features eventually, but just be aware of the trade-off you're making.

<comment><USER4> I thought "rooted" in the Android sense just meant that you had sudo installed.

Why would malware be helped by having sudo installed? A privilege escalation attack has no use for it, unless you think there are security holes in sudo. Has there been or do you have reason to believe there are?

I heard these statements before and I'm never sure what to make of it. For a casual user, the possibility to click yes to a sudo dialog is a code path to disaster, but as these things need to be flashed specifically (which is a big hurdle in itself) I'm not sure how big problem it is in practice.

</comment></comment></comment><comment><USER5> Amazon Underground pays the app developer for the duration of usage of the app, and so needs to track how long you are using the app for. Perhaps it needs data tracking enabled to identify the duration of usage?

<comment><USER6> Did you read the screenshot? That's exactly what Amazon says it needs data tracking for.

(For those who haven't read the article: The author only discovered this because they have CyanogenMod and a permissions blocker installed and in use. Most people wouldn't be told they were being tracked.)

<comment><USER7> It's actually just a setting in the Amazon Underground app to disable tracking of apps. The "actually free" apps require the setting enabled. He disabled it and it's telling him that. The CyanogenMod/Privacy Guard/Location stuff is all unrelated.

</comment></comment></comment><comment><USER8> What is the fear here?

I'm not talking about shady apps you downloaded off some dodgy pirated Android app store, or apps where you agree to this sort of tracking so you get free apps (e.g. Amazon Underground, which the author is using).

I mean - official apps such as Twitter, Snapchat, or say Microsoft or Google applications.

Can anybody quantify what they are scared of, if an app tracks how often you use it, or collects anonymised metrics?

<comment><USER9> "Scared"?

Will I be "scared" if a guest at my house is live-streaming his stay to the Internet without my knowledge or approval? Hell, no. I'll be _pissed_.

Now, that's _exactly_ naive, careless and fundamentally ignorant comment that the erosion of privacy is all about. You seem to genuienly think that tracking is not just acceptable, but a norm in some situatioons.

Not just several years ago if an OS or an app phoned home it was a scandal. It was commonly accepted that your gadget was yours, and anything running on it was a guest that had to follow some decency and basic etiquette norms. Theh, the push started - can we report this, just once? Can we report that, weekly? We'll call it a "telemetry", it's less scary that way. Perhaps you are getting tired of pushing OK, shall we do it automatically? OK, so we'll now just default to automatic. and make it hard to disable. Heck, we'll just build it in, because nobody now seems to be giving a fuck anyway.

But here's the best part - we now even have users _who are campaigning on our behalf_ to not give a fuck. That's just grand.

<comment><USER8> Yes, but you avoided my question - what exactly is the fear here?

As in, is there a particular type of data, or information about your app usage that you don't want developers having access to?

I worked at a trading company before, and one of the reasons we pushed out telemetry was due to user's feature requests - users would request features, and we wanted to see if they were actually using them, so that we could prioritise developer time accordingly.

That is a concrete example of how this data is _useful_.

I am curious about any concrete examples from the other side.

<comment><USER10> Why does it have to be fear, rather than preference?

Maybe there's no data you're _afraid_ of leaking, but you would _prefer_ never to leak that data. It's a consumer choice - the problem here is lack of transparency/information to the consumer.

The cultural standard is what we accept to be appropriate - do we want to accept a cultural standard of everything you use is tracked and logged by default?

<comment><USER8> If that's your preference, then you are free to _not_ use those webapps, or mobile apps - why would yo use Gmail, or Instagram, or Twitter, or Facebook, if you were worried about your data being held by a third party?

We shouldn't automatically assume people are stupid, or that they are being "duped".

There are numerous advantages to using a cloud-hosted service - if you tried to replicate Gmail or Dropbox, to the same level of reliability, performance and sharing features - the engineering effort alone would probably stump many of us.

Once again - is there a concrete fear here from application developers knowing how we use their applications? And is it one that we think people are somehow unaware of?

<comment><USER11> You asked for fear three times in a row. People tried to make you understand that 'fear' isn't the problem. I'm not sure how to state it more clearly: "It's not fear"

You presented a very weird case to begin with by implying that the reason people wouldn't want to be tracked is 'fear'. Why?

Maybe you're really just saying "Okay, ignoring all the other reasons why you might not like tracking: Are there any inherent flaws in tracking/something we can do to make this more trustworthy", but right now I feel as if you're presenting a weird "Either you consent to us tracking you or you fear something (specific)" choice.

<comment><USER8> Well, if it's not fear, is there another reason you don't want application or webapp developers tracking your usage of their services?

I mean, isn't the whole _point_ of these services that you store your data remotely on their services?

Why would you voluntarily choose to use something like Gmail, Instagram, Twitter, Dropbox etc, if you were concerned about the company in question or didn't trust them?

There are companies I _won 't_ use, precisely because of concerns like this (e.g. Sony, Lenovo) - but if somebody chooses to use a service, it's probably because the benefits of that service outweigh the "costs" to them.

In the case of Amazon Underground, which is the subject of the OP, I think it's a bit disingenuous to say, oh gee, I want free paid apps, but I don't want to allow Amazon to track my usage....which is sort of how the app developers get re-compensated.

Assuming you have voluntarily chosen to use a webapp or mobile app what are the key objections around those developers collecting telemetry data from you?

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> There is a desktop client for Play store called Racoon. When I used my phone for several years without a Google account, from time to time I would need some app (for taxes, bankning, public transport, whatever) that was distributed via the Play Store exclusively, but I had no problem downloading that APK using Racoon and installing it separately. You don't get notified of updates, and updating is a manual process, but for for a single user that wants to avoid the Google services it's workable.

<comment><USER12> > _You don 't get notified of updates, and updating is a manual process_

That's a lot of extra work, but it's also a huge security problem. Is it really worth the extra privacy? After all, you can't really hide yourself from Google because they index the entire web and public databases and your friends' emails...

<comment><USER4> That's the question. I think it depends on why you didn't want to install the Google Services in the first place. I mostly didn't want the remote wipe and remote code execution privileges the Google Services come with. It wasn't primarily a question of privacy as such.

I doubt the security problems are huge. Most userland apps run as a dedicated user. Security problems with the Google Services are potentially much more serious.

<comment><USER12> > _I doubt the security problems are huge. Most userland apps run as a > dedicated user._

There are tons of security holes that aren't prevented by running under separate users. I remember examples where sensitive data was being stored in the clear, where other apps could get to it.

</comment></comment></comment></comment><comment><USER13> Web apps know when and how often you use them, too. As long as Amazon Underground tells you in its TOS I don't see a lot of difference.

<comment><USER14> Yeah, but do web apps lock you out if you deny their location requests?

<comment><USER15> I've attempted to use a couple that have done so.

</comment></comment></comment><comment><USER16> So the Amazon Underground tracking requires location tracking as well? If it was just usage tracking I don't see an issue with it seeing as Amazon Underground is meant to be optional and you get free apps in return.

<comment><USER17> No it does not. It only requires usage tracking to pay the developer for time used.

<comment><USER18> So what is "data tracking"/"usage tracking" and how is it turned off/blocked on the authors device? As far as I know Cyanogenmod only blocks some APIs like location, contacts

<comment><USER19> Any application can request the permission to track certain Android app lifecycle events. In this case, when an app gains and loses foreground focus.

Data and location API access are separate permissions. But if all three are obtained, fairly detailed correlations can be made.

Although I don't know much about Cyanogenmod, it is likely it enables global toggles for the app lifecycle permission.

</comment></comment></comment></comment><comment><USER20> Replace Amazon Underground crapp with the regular Amazon Appstore: [http://www.apkmirror.com/apk/amazon-mobile- llc/appstore/](http://www.apkmirror.com/apk/amazon-mobile-llc/appstore/)

Disable "Collect App Usage Data" from settings, install apps, enjoy.

<comment><USER21> does the regular Amazon Appstore have 'free' paid apps?

</comment></comment><comment><USER22> Can't you feed it fake data?

</comment><comment><USER23> If you actually research it at all they're very clear that they track users time spent in each app as that is how they pay developers.

</comment><comment><USER24> This happened to one of my mates: 1\. Ordered some stuff from Amazon using Tor 2\. Amazon tracked the change in IP 3\. Amazon automatically cancelled the orders and sent a password reset email saying his account may have been compromised

<comment><USER25> Sounds like bad OPSec. If he used his normal account via Tor he identified himself towards Amazon. Amazon checking against a list of Tor exit nodes and warning customers is a good thing. I say that as a Tor lover.

</comment></comment><comment><USER26> Free has a price.

</comment><comment><USER27> It's a FREE app. If you don't like it, don't agree to the terms and quit using the app.

<comment><AUTHOR> Indeed, and that's the case with everything - Google, Facebook, Twitter, etc.

I get it.

My point in this post is that I (who am interested in privacy and rights online) didn't realise what was going on, how is Joe Average going to know?

<comment><USER28> Amazon aren't being particularly underhand here; a tiny bit of googling will explain how Underground relies on app usage tracking ( _not_ location tracking).

I agree that "Joe Average" may not question the free lunch, and that's a problem, but it's exactly the same problem as existing free apps like Gmail, Facebook, etc.

If you're a technical person with an interest in privacy issues, you need to pay a bit more attention.

<comment><AUTHOR> Cheers. :)

</comment></comment></comment></comment><comment><USER29> I love that Apple is run by a man whose pretty vanilla personal life would get him harassed by the security apparatus of lots of countries -- it really gives me faith that Apple make a good faith best-effort to protect user privacy in their walled gardens.</comment>


Astronomers Discover a Potentially Habitable Planet Just 14 Light Years Away - <AUTHOR> http://www.popularmechanics.com/space/a18573/closest-habitable-planet-wolf-1061/ <comment><USER2> Haha, _just_ 14 lights year away. As soon as we get that warp drive online and the worm hole opener all set then we have a backup plan for when we burn this planet out.</comment>


An Entrepreneurial Counter Culture is Looming – The Startup Market is Not OK - <AUTHOR> http://siliconangle.net/ver2/2009/09/18/an-entrepreneurial-counter-culture-is-looming-the-startup-market-is-not-ok/

<comment><USER2> Capital available in $200,000 chunks would be an interesting world:

1) You'd presumably want to make the offering mass-customizable, like a typical residential mortgage. There are a few levers to play with, sure, by 98% of the contract got vetted by the company lawyers _once_ as being Good Enough and folks can take it or they can leave it. This allows you to close deals quickly, avoid spending much time teaching buyers about your process, and have the deals offered by junior staff. Most home buyers want a house, they don't want a mortgage. Most startup founders have a business to have a business, not to raise capital.

(Note that this would make "comparison shopping" easy.)

2) Automate and outsource more of the process. Banks can profitably do loans for $200,000 houses because there is an infrastructure of people who can say "Yep, this is a $200k house" and FICO scores, which let you push a button and get a quick estimate of my propensity to default in a second. I know we all think we're beautiful snowflakes, but I'm willing to bet there is a function which can be evaluated cheaply that is unfair, misses all sorts of edge cases, has numerous theoretical problems, and nonetheless is Good Enough when only $200k is at stake.

3) As you reduce the amount of marginal effort in each deal, it becomes possible to scale it to the moon, in a manner similar to e.g. mortgages and mutual funds. (The fund has a lot of money, the individual investors have comparitively little money and reduced exposure to any single investment, etc.)

<comment><USER3> The big reason banks can say that about a house is that there _is_ a house, which is a commodity (or at least, they were until recently), so if the deal does not work out the bank can sell the house.

Without collateral of some sort this will not work. And if you have collateral you could simply either sell that or mortgage that (and plenty of founders do).

</comment></comment><comment><USER4> I found the article was rather long and a bit confusing. I wanted to summarize and clarify it:

There are more companies these days, but VCs are funding the same number of companies as before with the same huge expectations. Why not instead fund more companies with a lower amount of cash so as to not miss some opportunities.

My answer: putting all your eggs in one basket in a competitive environment will likely lead to better results than spreading the money out among a bunch of different baskets. Most startups are going to fail anyways, even with $200K of funding because the markets they are hitting are not that huge, not to mention all the other hurdles. What funding a bunch of different companies does is make a clear market winner harder to come by, which screws everybody. It's better if there was one clear winner sooner rather than later. My bet is handing out smaller investments like $200K would actually make the IPO market worse since most companies would get too tired to ever make it big enough to IPO.

The quick answer to why IPOs have not been good recently (other than the economy sucking): Sarbannes-Oxley made it very expensive to IPO with big requirements which means that the next best exit is selling. To sell, you have to get big fast to become attractive to suitors. Profitability/revenue is not a requirement/important for selling to a larger company (they use startups to cheaply get new talent and good ideas rather than quickly adding new revenue streams). So why don't more companies focus on revenue as a backup plan? It's very distracting and doing so means you might only scrape by. With such a do or die environment, the goal is not to create good businesses which will survive, just ones that will become great.

The good thing is that as it has become cheaper to run a startup, people have more options and can create self-funded sustainable businesses aimed at smaller markets. You won't become a billionaire doing that, but you'll get by. That's fine with VCs though, they are after big returns. If you are comfortable with creating such a business, by all means do so, but don't be pissed when a VC is not interested, even if it does make a little money. There is clearly room for both. If you do hit on a massive market opportunity, they can always catch up with you later.

So what is something like Y Combinator? It is a cheap way to vet companies for VCs and angels who see too many startups without enough information on them to make a good value judgement on whether they'll succeed. You don't need $200K to do that, you just need a small amount of money.

<comment><USER5> The writing in the parent is significantly better than the writing in the original post (the web page not on Hacker News). So, thanks, danielrhodes, for summarizing!

</comment></comment><comment><USER6> "Technology, however, isn't the driver any more for startups. The scarce talent is business model engineering and product marketing"

How true is this? Sounds like wishful thinking from a non programmer to me.

(Please note : I am not saying that marketing/product engineering is not important. They (obviously) are. I just think "Technology, however, isn't the driver any more for startups" is too broad a brush)

<comment><USER7> I think his point is that scaling up on the web is a solved problem, which is mostly true. If you look at most startup's pitch/plan the biggest risks are not in technology.

Steve Blank would say there's Market Risk (will your customers want it?) but minimal Invention Risk (can you deliver it?). Contrast this with biotech where you're trying to cure diseases. Minimal market risk, tons of invention risk. Read more here: <http://steveblank.com/category/vertical-markets/>

<comment><USER6> "his point is that scaling up on the web is a solved problem, which is mostly true"

Maybe, but that isn't what "Technology, however, isn't the driver any more for startups" means. "Technology" is a lot more than "scaling on the web", even in software based startups.

"Steve Blank would say there's Market Risk (will your customers want it?) but minimal Invention Risk (can you deliver it?). "

Steve Blank is also careful to qualify that statement with "for some types of startups" (unlike the author of this article, hence my "too broad a brush" judgment). Assuming every software startup, even when the web is used as an interface, is a "web 2.0" startup with minimal Invention risk is intellectual laziness.

"The scarce talent is business model engineering and product marketing"

This doesn't have any supporting arguments/evidence/data. sounds like something a non programmer MBA type person, for whom of course programming is easy and programmers are commodity hires (like say receptionists) would say. I'd like to hear a supporting argument for why great programmers, who are what startups are usually desperate to hire, are not "scarce talent", but marketing folks are. Sure, for _some_ startups, that is no doubt true, but as a generalization it seems too broad, which was my point.

So yes I've read Steve's book too and like it a lot :-), but I don't think this dichotomy of risks supports the original article much.

<comment><USER7> I think we're agreeing. As I do for all blogs, I just assumed the courtesy implicit prelude: "This is my opinion shaped by my experiences and most likely only applies to the system I'm currently interacting with."

I mostly agree with his sweeping generalization if applied to, say, the subset of startups that get coverage on Techcrunch.

<comment><USER6> "I think we're agreeing."

Yes we are.

"As I do for all blogs, I just assumed the courtesy implicit prelude: "This is my opinion shaped by my experiences and most likely only applies to the system I'm currently interacting with.""

As did I, but if, as a writer, I made an unqualified claim (even if true) that is completely out of whack with my _readers_ experience, I think it is fair to get push back. This is perhaps due to my coming across this article on HN vs directly on the original site.

I think the article is a decent one (not great, but decent).

"I mostly agree with his sweeping generalization if applied to, say, the subset of startups that get coverage on Techcrunch."

As would I. But this is HN. :-)

</comment></comment></comment></comment></comment><comment><USER7> "The scarce talent is business model engineering and product marketing – building for scale isn't the problem anymore. I can build a hack protytype that works well into the "validation" stage to establish a funding event or customer revenue stream then use the new capital to rebuild, hire and grow."

This interestingly follows my own career growth. I was the tech lead responsible for scalability/reliability at IMVU for a long time, but eventually our bottleneck clearly shifted from reliability back to marketing/product development. Around that time I switched teams, and have since been the tech lead for our marketing team. It might sound less sexy to other engineers, but getting to be on the bleeding edge of marketing for virtual economies is constantly challenging and fun; especially with IMVU's data driven culture.

<comment><USER8> Do you think IMVU would be the great company it is today if it started with two product marketing folks and one business "model engineer" and all the programming was outsourced to "commodity" coders in elance.com or getafreelancer.com?

<comment><USER6> that seems to be a reaction to an exaggeration of what Tim said. He clearly said(emphasis mine)

"I was the tech lead responsible for scalability/reliability at IMVU for a long time, but eventually our bottleneck clearly _shifted_ from reliability back to marketing/product development. "

I read it as, " _Once_ we got reliability sorted out, the bottleneck _moved_ to marketing/product development."

He never said IMVU could have been built without good programmers(of which class, he is an instance), but product dev/marketing _became_ (or were) equally important (or more important) and so he moved to that team. At least that's how I read it

<comment><USER8> I agree. However the point I was trying to make is that technology expertise continues to be a "scarce talent" which seems to be the opposite view of that supported by Tim's post.

</comment></comment></comment></comment><comment><USER9> I really am enjoying the thread here on my post. Interesting to see some of the comments thinking that I'm anti-development with my quote about product mktg and validation is the scarce resource. Of course great architects and developer are the scare resource but I've seen many code a great solution right now a cul de sac of no market.

to me the biggest issue driving this counterculture that I'm seeing is "trust" of the capital markets. Especially since most of the productive actors in this marketplace have lived in a successful open source movement culture for 25 years. The capital markets (VCs) are at odds with this culture.

There are many other points in the post that I would be happy to discuss if there is interest.

</comment><comment><USER10> With cloud computing rising to prominence as the underpinning of many modern web applications the amount of technology already 'assumed' in any new application design.

This trend seems to align with John's key point.

</comment><comment><USER11> I read through the article but could not get the roots of "shrinking venture market" problem. Can someone please summarize/provide better explaination ?

</comment><comment><USER12> do you really think handling a (non-technical) investor will be less work/less distraction than contracting part time? Sure, contracting takes time away from what you want to do, but it's pretty easy, and clients don't push you to do things that may not be in the interest of your customers.

</comment><comment><AUTHOR> This is the final draft based on the original Hacker News thread and conversation about a month ago.</comment>


Lucretian Prehistory: An Epicurean view of the pros and cons of civilization - <AUTHOR> https://www.laphamsquarterly.org/roundtable/lucretian-prehistory <comment><USER2> Whether pre-agricultural societies were generally peaceful is a matter of some debate. If they were, it is probably because disease, accident and predators kept the population in balance with resources. See, for example, "Resource scarcity drives lethal aggression among prehistoric hunter-gatherers in central California" at [https://www.pnas.org/content/113/43/12120](https://www.pnas.org/content/113/43/12120)

>Results reveal that sharp force trauma, the most common form of violence in the record, is better predicted by resource scarcity than relative sociopolitical complexity. Blunt force cranial trauma shows no correlation with mean net primary productivity or political complexity and may reflect a different form of close contact violence. This study provides no support for the position that violence originated with the development of more complex hunter-gatherer adaptations in the fairly recent past. Instead, findings show that individuals are prone to violence in times and places of resource scarcity.

<comment><USER3> they were more peaceful in the sense that violence was individual and local to a large extent whereas once metals were introduced incidents took on a larger scale according to the article

</comment></comment><comment><USER4> Just as the Greeks thought they lived comfortably compared to their image of naked foragers in the wilderness, we have some misperceptions of our own advanced state.

For example, a common mismeasurement of the misery of pre-industrial life is very low life expectancy. On average, you'll be dead at about 35 years. But that number is skewed by a very high infant and child mortality rate. If you make it to adulthood, you're still subject to lack of modern medicine, but you'll probably make it farther than 35.

That sucks compared to present day low infant mortality, which has many benefits beyond just fewer dead children. But low infant mortality skews our view of the harshness of pre-industrial adult life. Relative comfort can impart smugness.

</comment><comment><USER3> > But the search for power and gratification by the few at the expense of the > many is an inevitable feature of civilization that could be better > controlled than it is, even if it can never be banished once and for all.

It's disappointing that there are no suggestions around how to better control this

</comment><comment><USER5> For a 2000 year old poem, De rerum natura offers a surprisingly scientific take on the world, as well as a fascinating insight into what was going on at the edge on Roman thought at the time. It's still a great and fairly accessible read, and if reading ancient poems is your thing I'd recommend the Rolfe Humphries translation.

<comment><USER6> Indeed. Lucretius is often credited for his prescient understanding of "atoms", but that's really a red herring. His view of atoms isn't all that similar to the 19th century atomic theory, and even less to modern atomic theory.

What he really had going for him was empricism. The win was the notion that the universe is governed by a small set of physical laws, and that we can understand those laws. The sun and moon operate by the same principles as our bodies do.

He anticipated what this would mean for free will, and cobbled in a "swerve" to allow for it. But it was still a world dominated by natural forces, not supernatural ones, in which science could be a thing.

</comment></comment><comment><USER7> This reminds me of Jared Diamond's article about humanity's biggest mistake...</comment>


The first calculating machine - <AUTHOR> https://thonyc.wordpress.com/2018/09/21/the-first-calculating-machine/ <comment><USER2> Beautiful device, but not the first calculating machine by a long shot. That would be the antikythera mechanism [1].

[1] [https://en.wikipedia.org/wiki/Antikythera_mechanism](https://en.wikipedia.org/wiki/Antikythera_mechanism)

<comment><AUTHOR> I think the distinction is that Antikythera was a calendrical device, but couldn't perform multiplication/division etc of a given number like the device described here.

<comment><USER2> Naturally. This would be more accurately described as the first mechanical calculator.

<comment><USER3> "Calculation" literally means moving little pebbles around on a counting board to solve discrete numerical problems.

</comment></comment></comment></comment><comment><USER4> From the same time period come the manually operated and far less complex Napier's Bones. Still pretty neat, and more likely what the 'average' person needing a calculating device would have used.

[https://en.m.wikipedia.org/wiki/Napier%27s_bones](https://en.m.wikipedia.org/wiki/Napier%27s_bones)</comment>


From Rust to Svelte, what tech stack will I use - <AUTHOR> https://hugodaniel.pt/posts/browser-tech-stack-2020/ <comment><USER2> I'd replace Parcel with [https://github.com/evanw/esbuild](https://github.com/evanw/esbuild)

<comment><AUTHOR> didn't knew about this one... let me check it and get back to you soon :)

thank you for this</comment></comment>


Chemistry can't be swiped - <AUTHOR> https://psiloveyou.xyz/chemistry-cant-be-swiped-f2fe172329c7?gi=a0254402dcd0 <comment><USER2> I was very confused until I figured out it was about dating chemistry and not actual chemistry.

From the title I thought it was something to do with patents or trade secrets in, say, industrial or pharmaceutical chemistry.

</comment><comment><AUTHOR> An article from an indie hacker who is launching her new app today.

You can find it at: [https://happyendin.gs](https://happyendin.gs)

A very novel concept.</comment>