The Boomerang Kids Won't Leave - <AUTHOR> http://www.nytimes.com/2014/06/22/magazine/its-official-the-boomerang-kids-wont-leave.html?hp <comment><USER2> Is there anything wrong with young people staying at home for longer? The "move out before you're 21 or you're a loser" message is a relatively new one and doesn't make all that much sense.

There are so many people paying half of their salary to live in some tiny flat in London while their parents have a 5 bedroom house somewhere much nicer that is mostly unoccupied. Just because they feel they must be "independent" (even though some of these people are receiving parental subsidies anyway).

Why not just let the buy to let market shrink and bring some semblance of sanity back to house pricing. People who live with their parents will have much lower financial risk and thus can take jobs which focus on experience rather than salary and they can save money for entrepreneurial activity or to later on buy the houses which will be cheaper as a result.

<comment><USER3> >Is there anything wrong with young people staying at home for longer?

Well, one of the reasons is that oftentimes this ends up being a crutch. Little reason to take any chances, or really apply yourself when you can tell yourself that mom & dad will bail you out. Of course, not everyone is like this; some people have the necessary drive (and resources) to kick ass right out of high-school. But many don't realize their true potential until they're forced to do so.

<comment><USER2> If you live at home you can afford to take more chances. You can start a business with less worries of having to cover extortionate rent every month which is something that keeps many people in their 9-5.

<comment><USER3> I totally agree with you. But there is a big difference between living at home so you can get your business off the ground, and living at home so you can more easily afford your video game hobby.

All I'm saying is that the world isn't black-and-white. Parents need to make the judgement call about _what is best for their child_. Sometimes that's letting them stay at home to build up resources. Sometimes it's forcing them out to let them learn and develop themselves. Sometimes it's probably something between the two, like charging rent.

<comment><USER4> > I totally agree with you. But there is a big difference between living at > home so you can get your business off the ground, and living at home so you > can more easily afford your video game hobby.

Or so that you can afford the rent-sized payment on your student loan debt.

</comment></comment></comment></comment></comment><comment><USER5> Here is another thought, younger generation are being sold a bill of goods and the older generation is not delievering.

The bill is the time/cost of education and the end product is supposed to be "training for a career".

We have this younger generation who is not ready work (needs more training) and/or trained for something that no longers pays out (greater than the cost of education or jobs that no longer exists).

I've seen enough job postings that should just require basic skills, but ask the world (5+ years experience where it's only been out for 3 years). Also the cost of education is really crippling, that is pretty obvious.

It's hard to blame the kids for problem. the older generation created it by working longer than ever, creating the job postings requirements, and not training the next generation. But I see these boomerang kids are pretty clever, because they found the best place to live for less. Some will create their own jobs, or find meaningful work. Others will just fail. That's life, but in the past failing was way worst, now it's "going to your parents home".

When the younger generation has kids, they will create problems for the next generation, and deal with the consequences. Maybe the younger generation will better train the next, maybe they will lower hiring requirements, and maybe they will just be happier with less.

</comment><comment><USER6> Younger people (say 30ish and under, so me included) have been told their entire (or close to it) lives that they're precious snowflakes and that they're going to change the world and they can be or do anything they want to.

If you're a highly motivated, hardworking person or you already know what your passion is, this is great news to hear. The sky's the limit!

If you're not so highly motivated or you aren't passionate about anything (that you know of) this kind of message is debilitating. The flip side of "you are talented and special" is that if you're not doing what you're passionate about and you're not changing the world and whatever, that the only person you have to blame is yourself. If the world isn't placing any constraints upon you to keep you from succeeding then the only thing that stands between you and success is you.

I realize that in truth we tend to limit ourselves more than others put those constrains upon us. But what that cheery, the-world-is-your-oyster message fails to communicate is that life can be difficult and that for a great many people just keeping themselves alive SOMEHOW is really about all that they can do. And that for the entire history of the world minus about 50 years that could be considered Success(tm). It might be a job that they're not passionate about but are good at. Or it might be that circumstances out of their control took a substantial portion of their energy (sick parents for example). Or maybe they just found someone and got married and had kids before they figured their work-passions out and now they have whole other people counting on them for support. But when you could be Doing Anything (!!) just getting doesn't necessarily feel like success.

The "you can do anything" SEEMS really amazing and that you really should impress it upon all kids from an early age. It SOUNDS great, I mean who doesn't want to encourage kids to succeed? Ultimately though it may have been a bit self-defeating. When faced with too many choices many people fail to take any action at all.

[http://en.wikipedia.org/wiki/Analysis_paralysis](http://en.wikipedia.org/wiki/Analysis_paralysis)

<comment><USER7> This old canard is quite tiresome, and is rarely presented with evidence, but it's always written as capital T truth.

The realities, laid out in the article, are all economic and well researched. Millennials have high debt and low wages with a poor job outlook. The underlying trends have existed for quite some time and appear to be getting worse over time, especially with the recent recession hitting youth hardest.

But yeah, let's blame motivation rather than figure out how to improve the system. Clearly kids with college degrees aren't motivated enough to will jobs that can cover their debts and maintain the comfortable standard of living their parents had.

<comment><USER8> This is absolutely on point. My observation among my circle of friends (I'm 30), is that we are if anything more pessimistic and pragmatic than our parents.[1] Indeed, look at how 'msandford couched his point: in terms of what baby boomer parents said to millenials, not in terms of what millenials actually believe. My parents have always said: just get an education, don't worry about the debt, if you work hard you can do anything! I'm the one who has always had to push back with reality.

[1] For example, millenials are less trusting in others: [http://www.washingtonpost.com/blogs/monkey- cage/wp/2014/03/1...](http://www.washingtonpost.com/blogs/monkey- cage/wp/2014/03/17/the-real-reason-why-millennials-dont-trust-others).

<comment><USER9> >This is absolutely on point. My observation among my circle of friends (I'm 30), is that we are if anything more pessimistic and pragmatic than our parents.

That's true _now_ , but was it true the day you graduated from college? Finally finishing school is always a splash of cold water, but my impression is it was especially so for people your age.

<comment><USER10> I think there have been two times in the past 15 years that it's happened. Once in 2000ish after the first tech crash and once again starting in 2008 as the general recession took hold. We haven't recovered from the recession yet, and although corporations are making more money now than [in some cases] ever before, there isn't adequate profit sharing via increased salaries and broader hiring to affect worker sentiment in a meaningfully positive way.

I graduated in 1999 and, after shifting from physics to history mid-way through, I got a temp-to-hire job doing web dev as the bubble was popping. while everything worked out for me, things are not working out for people who've graduated in the past few years. I only paid $2500/semester tuition and, with a 15-25hr/wk side job was able to live happily and graduate with barely any debt, which I repaid in the first year of employment. Many public universities now charge upwards of $15k/yr tuition for in state students -- this is just untenable for the majority of matriculating high school grads given the current job market. When I went to college, my engineer father said "study anything that interests you. You're smart and if you work hard you won't have any trouble finding good work." He was right. Now, when my son is planning and preparing for college, I will very strongly encourage him to pursue an engineering degree with a minor in math, statistics, or economics... unless he's set on a physical science, in which case I'll encourage at least a minor in CS. I don't want my kids to be forced into unskilled work while carrying boatloads of debt, and the way things are going, the only pretty reliable way around that is to have the skills and knowledge to create things (and communicate clearly verbally & in writing).

Like rayiner, I'm pessimistic. Living/working through this and experiencing wage stagnation and utter apathy from employers & government only reinforces it.

</comment></comment></comment></comment></comment><comment><USER11> One thing my Mom taught me is that when you child reaches around 14 years old, or around high school age, you have to stop coddling them. My parents started "being mean" as my sister and I called it, when we got into high school. Later she told us it was on purpose and from love. She was right. I think this tradition has been forgotten, but it used to be conventional wisdom in that generation (my Parents are in their 80's). What we called "being mean" meant taking responsibility for yourself. For example, if you wanted to live in their house after age 18, they charged rent.

<comment> guard-of-terra This, as well as a lot of things that are fine when economics is okay, makes zero sense when there's recession.

I see a great number of commenters who don't understand that and therefore shovel blame around

<comment><USER12> Your comment embodies the millennial stereotype. _There 's a recession, therefore I can't be successful._ The economy doesn't improve by magic, we need people creating wealth. And that may not be in their chosen field.

<comment><USER13> I think you're missing the larger observation: the expectation that children will move out of their parents homes around age 18 may have been a temporary phenomenon.

I find it strange that some people would rather assume that an entire generation is uniquely incompetent, rather than assume that they're pretty much like all other human generations, but the environment in which they live has changed.

<comment><USER12> I don't believe that this generation is uniquely incompetent, nor do I believe that they are uniquely hampered from succeeding. I would be more swayed to your point that this is some sort of cultural shift towards multi-generational households if there weren't so much angsty finger-pointing from self-appointed millennial spokespeople.

</comment></comment></comment></comment></comment><comment> at-fates-hands One big point that I think was missing in the article was the proliferation of a temporary workforce. I just read temp hiring accounts for 15% of all hires these days.

The days when you're pop took a job at the steel mill and then worked his way up to management and then president are long gone. Most workers are only temporary. They put in their time, do the work and then its off to the next gig. This makes it nearly impossible to ever move up in any organization. And when you gain some experience as a contractor? Your job opportunities diminish since your experience demands a higher salary.

I've also seen a lot of commentary about the lack of motivation the millennial generation has which I'm sure is adding to the "normalization" of this boomerang stage in young adults lives.

EDIT: just found the article about increasing temp workforce: [http://www.economicmodeling.com/2013/06/21/temp- employment-i...](http://www.economicmodeling.com/2013/06/21/temp-employment- is-dominating-job-growth-in-the-largest-cities-is-that-a-good-thing/)

<comment><USER2> You can still work your way up to management, you might just move through more companies in order to do it. This might be as a result of workers now having more options as recruitment is easier due to the internet and other things. It might be better to have the flexibility and gather a variety of experience rather than feeling indentured to a single company. The flipside of this is that companies are less likely to invest in workers who they are worried will leave them in a few years.

</comment></comment><comment><USER14> So I'll admit my biases up front: I got a BS,CS degree at an in-state school, and used the GI Bill to pay for all of my tuition, and took loans for study abroad.

But taking a look at the slideshow, I'm seeing a trend in degrees/schools/debt.

BA, advertising & PR, Loyola, $75K

BA, lit & writing, UC San Diego, $44K

BA, economics, Loyola, $90K

BA, film studies, Full Sail, $80K

BA, psychology UCF, MS, counseling, Nova Southeastern, $40K

BA, biology, Northwestern, $50K

BA, economics, Hunter, $12K

BA, asian humanities, UCLA, $10K

BA, art history, Sonoma State, $27K

BA, history & religion, Midland, $11K

BA, comparitive literature, Hamilton, $20K

BFA, painting, Rhode Island School of Design, $25K

BFA, graphic design, School of Visual Arts, $130K

BA, communications, Calf. St. Fullerton, $22K

How do any of these student think that they'll do anything with these degrees to overcome the debt? The only two that make some sense to me are the $40K to get psychology/counseling, and $12K for economics.

<comment><USER15> The $50K biology degree from Northwestern is arguably worth it. Northwestern is the best school on that list, and an undergraduate degree in biology is often a stepping stone to an MD, MHA, MPH, or PhD.

<comment><USER16> That's what I was thinking, it's one of the nation's top schools, and you get paid for at least a PhD education. Still a tough job market.

I also wonder about the Rhode Island School of Design degree, I really don't know much of anything about that whole area of design and fine arts, but I been told they're one of the top schools in their areas of specialization, and a moment with Wikipedia indicates they're #1. Plus it sounds like they're intertwined with Brown.

So _if_ you're going to get such a major, it sounds like the place to do so. And 25K in debt isn't _completely_ insane.

<comment><USER15> Honestly, $10K for Asian Humanities at UCLA doesn't sound so bad, either. Maybe that major isn't a natural moneymaker, but UCLA is another very good school, and I bet plenty of companies wanting to do business in Asia would be happy to hire a bright student with that background.

<comment><USER16> I think it would depend on the quality of the studies. If focused on the gender, class and race food group of a large subset of the humanities, I can see corporate employers avoiding such potential trouble makers like the plague, but there are always non-profits and NGOs, even Foreign Service, although per Wikipedia the odds for the generalist path are very low.

If it actually made them useful, e.g. included some time "in country", and ideally minimal language and cultural fluency in at least one country of note, sure thing. Especially at such a price.

I have a friend who did both physics and Japanese and for a long time did well using both.

</comment></comment></comment></comment></comment><comment><USER17> Also during the US recession, many people had their retirement funds drastically affected (I know several people that saw near a 40% loss) This forced many people nearing retirement age to keep working. Those people are often more senior, and with them staying on, there was no "movement" up the chain, so not many new entry level positions opening up. if they were smart, and did not touch the money, it should be fully recovered now, so we might start seeing some mobility again.

<comment><USER18> A previous reply mentioned that the US, finally, after 6 years, is back to the pre housing crisis workforce numbers. This is true, however, the population has grown since then and we are still about 7 million jobs short [0]. Also, the labor department includes, as said in the OP, underemployment. Typically you then have to work more jobs or live much less high on the hog. This is in addition to the older workforce continuing to stay in their positions.

I have an anecdote on this as well. My brother used to work for Lockheed. Many times, an expert would retire with no replacement in the free world to step up. They would then need to hire the expert back again for a much inflated price. The cows recently came home for that particular plant, as this last year all 4000 employees were fired. I'm sure the rehiring of more expensive contractors played a role.

[0]It's Friday, google it please, my apologies on the laze.

</comment></comment><comment><USER19> The amount of debt some of these BA and BFA holders have is staggering: 80k, 90k, 130k (with a graphic design degree!!)

Didn't anyone sit them down and run the math of avg salary vs monthly loan payments for any of these careers? It would be tough to pay them off quickly without a hefty salary.

I feel like the parents are to blame here big time, setting these kids up for failure by not being real with them.

I have 3 kids and I definitely plan to instill a serious respect for loans and career goals etc.

<comment><USER20> I know someone who is currently thrilled about soon going to physical therapy school (3 year graduate degree). Estimated debt taken on: approximately $240,000.

Federal government will let you take all this with a few clicks of a button.

Average income of these "doctors" is what -- $70k?

<comment><USER21> wow, really? 240k for a DPT? My wife graduated the last year her school offered the Masters program, 2007 I believe with something like 7k in loans. Granted, her parent's pretty much covered everything, somehow.

I walked away with my CS degree (CIS, really) with ~80k in debt in 2008.

Average income varies I think, starting salary for her in 2007 was 45k, but that was Mid Missouri. Here in the Seattle area, it's a bit higher, and as a manager of a clinic (also practicing PT) it's close to twice that. I think as a non manager, 70k is about right here though.

</comment></comment></comment><comment><USER22> I was only able to skim this particular article, but I'm really curious about the international perspective of this "phenomenon" and the general attitude in America. Europe is dealing with staggering unemployment among people in their twenties. Meanwhile, plenty of developed countries still cling to the multi- generational home system where you stay with your parents until you're a married homeowner. Would an influx in the number of people remaining with their parents even be considered a "generational crisis" in the rest of the world?

<comment><USER23> I'm Italian, we're one of the countries in Europe that have been hit the hardest by the economic downturn. Staying at home with your parents in your early 20s has always been the norm here (mostly because you don't have to move to go to college, the local university is usually as good as any other). The problem is, even if it's generally acceptable to say that you still live with your parents, there are literally no jobs, not even low-wage, menial jobs. There is no hope for things improving in the long term and there's the lingering suspicion that this whole staying at home with your parents is more than a temporary situation. The only option seems to be moving to another country, but it's not as simple as it sounds. First of all, if you're unemployed, you don't have the money to move to another place, let alone stay there until you find a job. Secondly, you can't move to another country if you don't know someone who's already there and can help you out. And lastly, there's no reason for an employer to pick you (a foreigner) over some local guy. So the outlook is really grim and there's not even an inkling of hope on the horizon.

</comment></comment><comment><USER24> I was born in the 70s and grew up in the late 80s, early 90s. My friends and I consider ourselves 'GenX' though I'm not sure what we are.

I find this article interesting because my friends and I often discuss how lucky we are to have been born when we were. We got off a crazy train right before it was about to take a perverse, fiery decent into economic hell.

In the 90s, college was cheap, and it was easy to get in to. In the 90s, it was cool to be a 'slacker' \- and you could accomplish quite a lot, as one. There was hardly any competition and tons of opportunities. With a little bit of brain and a little bit of motivation, you could get into a top school, and it didn't matter much what your grades were. But, it wasn't just schooling that was easier to achieve - everything seemed a lot easier, and simpler.

I was recently talking to an older acquaintance, a person who recently retired as a top executive for one of the largest technology companies in the world. He's about 20 years older than me. And, he basically said the same thing: he was a B-C student in high school and college. He was pretty much a slacker, as I was. We both joked about how neither of us would be able to accomplish much, if we had been born in the 80s, or later.

</comment><comment><USER25> Staying with your parents as long as they'll let you is often the smartest financial move you can make. With student loan debt skyrocketing, housing prices high, job market weak, and wages stagnant, there's almost nothing economically to encourage kids to stake out on their own. Moving to a different city in pursuit of a job is unlikely to be worth the financial risk over keeping the job you have near enough to your parents and living without room or board expenses. That would have to be one hell of a good paying job to justify a move.

<comment><USER26> Pretty much my whole graduating class is shipping off to San Francisco immediately. The pay is literally 3x more than you can get in Canada and everything but the rent is _cheaper_.

</comment></comment><comment><USER27> > "Everyone tells me to just pick something," she says, "but I don't know what > to pick."

Why is this not the _obvious and glaring_ problem? After four years of going to a college with doubtlessly many opportunities, and she doesn't even know what she enjoys?

</comment><comment><USER28> My parents started making me pay rent as soon as I was 18, but that's not what made me want to get my own place - I just couldn't live the lifestyle that I wanted at my parent's. So, as soon as I got my first real job I left and never looked back.

I would love to live with a bunch of like-minded people, but that's easier said than done.

</comment><comment><USER29> The 'boomerang kids' are just people who were socialized to see a middle class life as beneath them. Offer these young adults 40k to drive a bus for a living and they would turn it down. They will stay at home and hold out for that job that pays a political science major $100k starting. The middle class is being decimated because no one aims for middle class.

edit: Perhaps bus driver was a bad example. I do know plenty of people who lead comfortable middle class lives as electricians, installing garage doors, commercial fishing etc... I don't know how many would describe it as their 'passion'.

<comment><USER30> Driving a bus is not a middle class job. Also politics is not automatable in the nearest future, so could be a wise choice if you have an aptitude.</comment></comment>


Software companies demand own copyright law - <AUTHOR> http://www.thinq.co.uk/2011/1/14/software-companies-demand-own-copyright-law/ <comment><USER2> This smells fishy. The Digital Economy Act isn't harsh enough, so something even more draconian must be done! Think of the children!

Given that the Digital Economy Act passed in that weird way that didn't get any discussion, and that a variety of other governments have gotten "help" ([http://blogs.computerworlduk.com/simon-says/2010/12/three- st...](http://blogs.computerworlduk.com/simon-says/2010/12/three-strikes- typhoid-mary-identified/index.htm#)) from the USTR about 3-Strikes laws and etc, why do we belive this is actually "software companies", and not the RIAA and MPAA lobbying via US State Department?</comment>


Most Digital Photocopiers Save Every Page Ever Scanned - <AUTHOR> http://www.cbsnews.com/stories/2010/04/19/eveningnews/main6412439.shtml <comment><USER3> What I am finding really absurd about this whole thing is, the photocopier companies knew about this (obviously), and a number actually had services/software available to wipe the drives - but failed utterly in actually telling anyone who might care about them.

My gf works at a hospital and there are many panties in a twist about this right now. She contacted one of their major photocopier providers and asked about what happened to the ones they had on lease that were returned in the last few years. "Oh, they were sold, or scrapped, or given away... couldn't really tell you for certain though." So the obvious question: "Did you wipe the drives first?" "A: No, that wasn't included in our contract with you." - because nobody knew about this 'feature' when the contracts were written!

Massive fail both security wise and from the sales side on missing easy upselling. Very likely any hospital or police dept would gladly have paid for these services had they know it was necessary.

</comment><comment><USER4> _"In 2008, Sharp commissioned a survey on copier security that found 60 percent of Americans "don't know" that copiers store images on a hard drive. Sharp tried to warn consumers about the simple act of copying."_

Does anyone remember this warning? I certainly heard nothing about this; and while I knew there had to be a hard drive in there to temporarily store the image, there was no reason to expect that it would store images permanently. Of _course_ Americans "don't know" that copiers store images like that; how would we? Who had ever, EVER told us?

<comment><USER5> I'm surprised it's only 60%!

<comment> brown9-2 Depends on how the survey question was structured. I can imagine

 _Do you know that photocopiers store image on a hard drive?_

would get very different response rates than

 _Do you know that photocopiers store image on a hard drive permanently until manually wiped?_

<comment><USER6> >Do you know that photocopiers store image on a hard drive?

Is still pretty leading. People would say yes because they don't want to appear naive.

"Do photocopiers keep any records of copies made?"

<comment><USER7> Ah, but in that case you'd get fifty-fifty since people who had no idea would just guess.

<comment><USER6> I was considering it as an open question not a yes/no. If they say yes you ask them how. That way they are demonstrating their knowledge rather than claiming it.

Like if you wanted to find out if people know that bacon flavour crisps are vegetarian you'd ask something like "do any crisps contain meat or animal products?" and be prepared with follow on questions. So if the response is "no" you go back with "not even BBQ beef or bacon flavour?". If they answer "yes" you ask "out of these, which are suitable for vegetarians: ..." or somesuch.

</comment></comment></comment></comment></comment></comment><comment><USER8> At my last "office" job, the new machines they brought in were fully networkable. (The next time you're using a newer generation copier, check whether there's some cat5/6 plugged into the back.)

So, if you copied something personal during your lunch break (considered a de facto perk, as long as exercised in restraint, e.g. that tax form before dropping same in the mail), would it remain on the copier hard drive? Worse, would it be deliberately archived in a company datastore?

This place was big enough and sophisticated enough to have some technologists dedicated to managing the machines (in conjunction with a service contract). Yet I ended up having to help them with some configuration difficulties. Which led and leads me to consider the implications also raised by this story. Any organization with a halfway decent security policy should understand and address these problems when first deciding the bring the machines in. Yet they apparently don't. And manufacturers should have addressed them up front in the feature set and use/management guidelines (e.g. a setting to wipe images on job completion, whether user controlled or in overall systems settings; a clear machine management feature to securely wipe (e.g. to a clearly defined and understood DoD standard) all drive data storage). Yet they apparently haven't. Or they don't clearly steer customers to knowledge and use of those features.

The reasons for the technological features are obvious. Their mis-management, unfortunately, seems all too familiar. I'm sure there were people arguing for better, but that would have been _hard_.

</comment><comment><USER9> Can someone explain the need for a copier to do that? Which engineer in his right mind thought that this would be a good idea without some routine clean up procedure?

<comment><USER10> You need it to do multiple copies, double sided copies, collated etc. All the major maker's built-in software does overwrites of the data to various levels of security. Otherwise the government wouldn't buy them.

They also have fairly small drives - the companies are out to make money - <USER2> at somewhere like kinkos your job would be overwritten multiple times by the end of the day. It's only an issue if the system fails and the drive needs to be replaced - but anywhere operating under any sort of security regs would destroy the drive before it went off site.

We used to destroy them along with any waste explosive/munitions. Then health and safety stopped us and we had to buy a super monster shredder - which is a lot scarier than explosives but it can shred drives/entire files/interns etc.

<comment><USER11> Why would you need nonvolatile storage for that? Why not just store it in RAM temporarily?

<comment><USER12> A hard drive could be cheaper than the amount of RAM required to store 20 pages of uncompressed scans.

<comment><USER11> If it's only 20 pages, I'd actually guess not. HDD + controller, for a minimum of (say) a 20 gig drive (I couldn't find any smaller ones), I'd guess would be a lot more than the extra hundred megs (tops) in the RAM that it already needs to have anyway. So it only makes sense to have a drive if you want to store a LOT more images than 20.

Maybe it needs a drive anyway for some other reason (like the software that runs it lives there instead of on a CF card or something), so it ends up being cheaper and easier that way?

<comment><USER13> 100 megs? A single letter-size sheet is 30 megs at 600 ppi.

<comment><USER11> Okay, so 600 megs. An extra gig of RAM has to be cheaper than a hard drive + controller you wouldn't otherwise need, right?

<comment><USER13> Many people occasionally copy/print multi-hundred page documents. That runs to many gigs of RAM, $30 just for the DRAM chips. And then you need to design what amounts to a custom PC motherboard to talk to them. The price could easily run to $75, not counting the enormous engineering costs.

Or you buy a $40 ATA drive and connect it to your embedded processor's built- in interface.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Unexpected conclusion: Photocopying your rear end counts as pro-privacy activism.

<comment><USER15> If done properly, this could be part of an awesome XKCD.

<comment><USER16> What would a stick-person's scanned butt look like?

V?

</comment></comment></comment><comment><USER17> From the article: "All the major manufacturers told us they offer security or encryption packages on their products. One product from Sharp automatically erases an image from the hard drive. It costs $500."

This should not cost extra. It should be included in every single hard-drive- based copier.

<comment><USER18> It would be a shame if your business were to 'happen' to catch fire, but luckily we can prevent that from happening... for a fee.

<comment><USER16> ... says the insurance company, who installed char cloth in your walls as "insulation".

</comment></comment></comment><comment><USER19> Isn't it ethically questionable for the manufacturers to know about the issue (as they admit in the article), but to charge extra for software to address it? At the very least, shouldn't encryption or the mentioned erase utility be sold with the machine, with the buyer having the option to opt out if they don't want it?

<comment><USER20> Lots of manufacturers charge extra for various security options, on all sorts of hardware and software. We can go back and forth all day on the "ethics" of it, but it's pretty standard practice.

And Sharp's add-on module might not be required if the copiers were treated like the computers that they are; it would be perfectly fine to just remove the hard drives when the units are being sold at their EOL, as I suspect most healthcare and government facilities do with their old PCs.

</comment></comment><comment><USER21> From an Infosec perspective this is terrifying, not simply because of the amount of data, but how difficult it is to scrub. Most people/businesses know that they need to scrub the hard drives from computers before donating/surplussing. Doing the same with copiers is a nightmare.

This is why I'd recommend all businesses use some kind of secure disposal service to get rid of old equipment. Hopefully the businesses that specialize in this field will add copiers to the list of items they scrub.

<comment><USER20> It's not just copiers. Most office printers these days contain their own servers, with hard drives for the spool. It would be just as simple to analyze the drive from one of them and grab whatever's left.

And there you'd just be dealing with PS and PCL, probably, rather than some weird proprietary image format that you might get on a copier's drive.

</comment></comment><comment><USER22> "All the major manufacturers told us they offer security or encryption packages on their products. One product from Sharp automatically erases an image from the hard drive. It costs $500."

That's just outrageous. I can't think of a reason why copiers need to store images to begin with. It's a huge fail from the producers, and they shouldn't charge for cleaning up the mess.

Instead this should evoke a scandal like the Toyota braking thing and make producers have to recall their copiers, with millions or billions of losses.

</comment><comment><USER23> Any Idea how to extract these stored images. There has been more then one occasion where I would have likes copy of an accentually shredded original.

<comment><USER24> You'll need to get the drive out. The connector needed is the only complication; it could be anything but is probably one of the mini IDE style connections.

Once out and connected to a computer you can recover data using any manner of tools.

I think FTK 1.8 still has a free trial you can use (<http://accessdata.com/downloads.html>). It's a bit of overkill for such a simple job but it will recover files fine. Otherwise just Google for programs to use on your OS of choice.

<comment><USER25> I'd try Foremost: <http://foremost.sourceforge.net/>

</comment></comment></comment><comment><USER26> This reminds me of the hidden identifying markers put on all printed color pages for later possible "forensic" investigation by FBI/spook types:

"Government Uses Color Laser Printer Technology to Track Documents"

[http://www.pcworld.com/article/118664/government_uses_color_...](http://www.pcworld.com/article/118664/government_uses_color_laser_printer_technology_to_track_documents.html)

</comment><comment><USER27> Copiers saving potentially (very) sensitive information to enable features most people don't use. Seems like a poor choice of default...

</comment><comment><USER28> <http://lab.arc90.com/experiments/readability/>

<comment><AUTHOR> I've found the Readability Redux Chrome extension to be just as good and significantly faster! [https://chrome.google.com/extensions/detail/jggheggpdocamnea...](https://chrome.google.com/extensions/detail/jggheggpdocamneaacmfoipeehedigia)

In re: the article - Do you think arc90 is logging every document that is passed through Readability? Is this body of information worthwhile? I suppose it is good ammo for them to use to approach large media properties about the possibility of a paid site redesign project.

</comment></comment><comment><USER29> So, wait, when I push "Print + Delete" it deletes the page from the job queue, but still stores it on the hard drive? Now _that's_ misleading.

</comment><comment><USER30> I wish I had enough money to buy some digital photocopiers from interesting places. Government surplus sales would probably be the most fun.

</comment><comment><USER31> In general, you can't really scrub a hard drive. No company in their right mind should ever let an old computer go out the door with a hard drive in it. Hard drives should be destroyed. I recommend something like this: <http://www.youtube.com/watch?v=sQYPCPB1g3o>

<comment><USER32> Not true. A single pass of 0's is sufficient to make a magnetic drive unrecoverable. Anything more is FUD.

<comment><USER24> Yeh agreed. It's a much argued situation in the Forensic world - but this paper pretty much agrees that it is impossible: <http://www.springerlink.com/content/408263ql11460147/>

<comment><USER31> Given that our government requires the destruction of storage devices to protect their secretes from seeing the light of day, I have to wonder why anyone would ever want to risk it: [http://www.nsa.gov/ia/guidance/media_destruction_guidance/in...](http://www.nsa.gov/ia/guidance/media_destruction_guidance/index.shtml)

Seriously, how expensive are hard drives these days?!

<comment><USER24> Yeh it' sensible if you have, say, confidential/classified information (we have to destroy most of our dead drives).

But I think that's mostly just overkill. I'm fairly sure that it is completely infeasible to recover data even for the mighty government. :P

I suspect the theory is that wiping a drive is prone to accidental failure/mistakes. Destruction is pretty unequivocally permanent :)

<comment><USER33> Wipe the drive, _then_ destroy it.

After all, simply destroying a drive would allow you to magnetically scan the bits and pieces of the platters left over.

<comment><USER24> meh, I don't imagine anyone could do that - the positioning of the platters is important and with a load of it munched you're screwed :)

<comment><USER33> Hm... two steppers geared down quite a bit, a hard drive head. Striping between platters really is a problem, but given enough time...

That would be an interesting challenge, now to find someone to pay for it.

I don't think it would be easy, but if the information is still on the platters you should be able to recover at least some of it.

Especially if it is email or other textual information it would not take a very large fragment to contain a large chunk of text.

On a single platter drive you'd have a better chance than on a multi-platter one, the synchronization tracks would help in figuring out what went were. It's a bit like puzzling together shredded documents.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER34> EVERY page? That could finally solve all my hard drive space problem. Store the images on a photocopier!

<comment><USER35> 20GB Hard Drive (Cheap) / 100KB / Jpg stored = 200,000 pages.

Effectively infinite, when considering the copier lifetime. Certainly falls within most people's definition of Every.

<comment><USER36> At 300dpi (which is pretty minimally low), an 8.5x11 image is 8.4 Mpixels. At any decent compression, that's going to be more like 1MB/page, or 20,000 pages.

Maybe we're talking monochrome? That reduces image size, but I'm not sure how to calculate that.

<comment><USER35> Don't worry, it's not "every" page like the journalist sId, it's only the last 20,000. Somehow, I don't think that will make anyone feel better.

It's "every" by any normal definition, particularly in this context.

<comment><USER37> So the answer is to have the work-experience kid press the copy/scan button 20,000 times! :P

</comment></comment></comment></comment></comment><comment><USER38> Another interesting, related fact, that not many people know of: the small photo booths you find on airports, train stations, malls etc., the ones often used to take that classic, romantic strip of pictures with your loved one, or your passport photo and so on, exposes each frame on a special type of transparent, photographic film laid flat onto a strip of photographic paper. The directly exposed paper is the copy you get in the slot, but the reel of film is kept in the machine for "governmental bodies' reference".

<comment><USER39> reference?</comment></comment>


The history of Kubernetes and the community behind it - <AUTHOR> https://kubernetes.io/blog/2018/07/20/the-history-of-kubernetes--the-community-behind-it/ <comment><USER2> the last thing the article mention is any history of anything</comment>


Blekko is alive - <AUTHOR> http://blekko.com/?

<comment><USER3> An interesting example:

<http://blekko.com/ws/global+warming+/conservative>

<http://blekko.com/ws/global+warming+/liberal>

Also, really impressive SEO stats. Be sure to check out all the tabs.

<http://blekko.com/ws/http:%2F%2Fblamcast.net+/seo>

<comment><USER4> Excellent find, those SEO features really are great, especially for free tools.

</comment></comment><comment><USER5> My reaction is a big "wha???" I don't understand what is supposed to be done, even after clicking on the "what is a slashtag" link. Maybe I'm getting old? Can the site describe what it does without a video? I hate clicking on videos. Anyhow, that's my reaction, FWIW.

<comment><USER6> _My reaction is a big "wha???"_

That was my first reaction. The front page really needs a plain text description of what it does - preferably in a single sentence. I clicked the /about page and gave it a quick glance (as a typical user might do). I don't think a Bill of Rights is something a typical user will slough through in order to use the service.

The other issue is the registration requirement. It may be tough to get users to sign into a search engine in order to tag sites.

With all that said, it looks promising.

</comment></comment><comment><USER7> Blekko had me at: "You have marked the site www.w3schools.com as spam. it is now dead to you. You will never see it in your search results again."

<comment><USER8> Really? I've found the site quite useful when I've forgotten some piece of CSS that I don't generally have to remember because I'm not doing web stuff all day.

What site do you use instead? Or do you just have it memorised? :)

</comment></comment><comment><USER9> Some random thoughts:

I'm really happy to see this open up live. I think it's about time someone tried to "take on Google" - the competition will be great for us users, and it looks like Blekko _might_ be a serious contender.

I love the fact that they've taken the concept of the "search box as the new cli/all purpose interface", and extended it. That's basically what they're doing, after all - giving every user customizable cli commands they can use to search smarter. The big question is, will this kind of thing catch on with "normal" users? I'm not so sure, but I hope so.

I don't understand why they're sticking to the name "Blekko". It's pretty obvious the word they're really pushing is "slashtag", so why not go buy that domain and call themselves slashtag? Makes a lot more sense to me. If you're trying to get people to remember you, and you're spending so much time on pushing the term slashtag, at least make that the way to find you. (And no, Googling "slashtag" only turn up Blekko as a 5th result or so.)

I love that they make their SEO/ranking system very public and very accessible. This is an interesting strategy - developers are more inclined to optimize for the tools they understand most, and developers sometimes drive later adoption.

</comment><comment><USER10> I lost interest the moment you told me I couldn't sign up because I'm not in one of the 'geographic regions' you opened up. What's the point of that? I could very well just tunnel to a server or use one of my paid VPNs, which I'd actually do if I knew it was of any value to me (as I used to do with Hulu), but since I don't I don't feel compelled to do so.

Edit: I'd argue that you want your service adopted by people instead of them feeling left out because of where they live. Maybe you should have constraints on the number of users and not on where they reside. I can easily see interested parties now not using the service when it's open to them because of this.

<comment><USER11> We're trying not to go down on launch day like cuil.com did. It's not an exclusionary thing, it's trying to keep the site up & responsive despite a flood of traffic. WolframAlpha hit >2000qps at launch, which would kill us.

Nevertheless, blekko should be open for everyone now...we'll keep it open if we can.

<comment><USER10> I'm not saying that you shouldn't exclude people for performance reasons. You should do whatever you need to keep your service up and running. I'm saying you shouldn't exclude by geographic location.

I'd rather see a "Whoops capacity for the party is 500 and we're full so you cant get in" instead of "Whoops we have a capacity of 500 and even though we only have 50 people in the party right now you can't go in because you're not from the US".

Anyways, I just signed up and I've got to say I really REALLY like this. I'll try it out for a week before deciding if I'm using it instead of Google, but from what I've seen it looks really good (and I think I will end up using it instead). I do have two things to complain about though, when registering a popup came but telling me it couldn't find my user, though it worked fine after that (perhaps its a known bug), and the 'profile' page would benefit from being either centered or fluid. Great job though!

</comment></comment></comment><comment><USER12> I love the results, the slashtags, and the awesome metadata, but I hate that the search box is relentlessly autofocused on result pages. This breaks keyboard scrolling and some other keyboard interactions, like hitting backspace to navigate back to the previous page.

Autofocus is fine on the front page of a search engine, but it gets in the way on result pages.

<comment><USER9> OT: Does it also bother you that Google's Instant has broken the back button on search pages? Back now transfers the cursor to the search box, which is a feature I find incredibly annoying.

<comment><USER12> Yes, I find this annoying as well.

</comment></comment></comment><comment><USER13> Looks good. I still think the name is going to be hard to market to the general public.

After I checked out the site a few months back, I couldn't remember the name. It's also hard to say over the phone without spelling it out.

</comment><comment><USER14> 1\. It is better to post such an announcement on Monday. Weekends tend to be quite here.

2\. I couldn't get what is meant by "slash in" and "slash out" when visiting the main page.

<comment><AUTHOR> News is news. Don't worry, it will be here tomorrow too.

<comment><USER15> I was pleasantly surprised to see an indie search engine developer introduce another search engine. If you don't mind me asking, are you involved with blekko at all or just testing it out?

<comment><AUTHOR> Nope, not involved at all.

</comment></comment></comment></comment><comment><USER16> I did a search and it says "1 to 20 /yahoo results for (query)"

Does that mean Blekko is just a nice-looking front end for the yahoo API?

I'm guessing the answer is no and the technology goes far deeper than that, but as an average user with an attention span nearing zero, it might be wise to make all this terminology a bit clearer. I don't want to have to distinguish between slashtag results, yahoo results, web results etc (and learn what they all mean) - why can't I just have _results_?

<comment><USER11> We have our own crawl/index/serve technology end-to-end. We have a 3 billion page web crawl, a machine-learning trained ranker, and then the slashtag vertical features. Since BOSS gives us an additional 20-40B pages for very long tail queries, we fall into /yahoo if we don't have any of our own results.

We're auto-firing slashtags for certain regular queries now, e.g. [cure for headaches] will auto-fire /health, [industrial design colleges] will auto-fire /colleges. We're doing this initially for health, lyrics, colleges, autos, hotels, recipes, and personal finance.

Getting the crap from sites like ehow out of the results and pushing results into a curated set of high-quality sites for queries in spammy categories really cleans up the results there.

<comment><USER17> Hmm, /lyrics in particular doesn't seem to do what I personally want, though I'm not sure how it could easily be fixed. What I want in order of preference is usually: 1. the official lyrics page, if any; 2. lyrics from a fan site, if one exists; 3. lyrics from one of the big ad-filled lyrics sites, like lyricsmode.com, only as a last resort (I tend to put them in the same category as ehow/etc.).

But it seems the /lyrics slashtag explicitly gives me #3, and actively excludes any results from the #1 or #2 categories that would normally come up.

For example, the ideal result for the search [pearl jam spin the black circle], imo, is the official page, <http://pearljam.com/song/spin-black- circle>. Without /lyrics this is the #4 result, which is decent. But when I add /lyrics, the official lyrics page gets excluded!

</comment></comment></comment><comment><USER18> This is great. I looks good, feels responsive, works well.

Starting a new search engine seems like crazy, but if anything can win out, this seems like it should.

Who's doing the design work and frontend? How big are you? [Also - <USER2> checked you jobs page - what you use Perl for?]

<comment><USER19> We have a designer (Dan) and a front end team (the Three Musketeers!) in- house. We use Perl+XS for all of the back-end stuff: our NoSQL data store (multiple petabytes of data), crawling, indexing, and serving queries.

<comment><USER20> It seems like Perl and search engines go together. The other being DDG.

</comment></comment></comment><comment><USER21> How are results weighted for the search engine in general? It seems to value individual articles vs. sites for specific things more. For example if you search for Minecraft you'll see most of the topic results are individual items, and some of the links are just crazy. The Team Fortress 2 blog (an unrelated game, the only relation is they mentioned Minecraft once in July) ranks higher than official sourced of information? The first link for the Minecraft forum is rank 15, that isn't even a general link it's a specific topic.

The Slashtags idea looks awesome, but the search ranking seems terrible.

</comment><comment><USER22> I don't think I get it.. The slashing, is this like public bookmarks?

How will they stop spammers / SEO gamers? They say search results shall involve people, but spammers and SEO gamers are people too.

<comment><USER23> I don't get it either. I tried it out a month or two ago and to me it's just not that useful and doesn't give me anything that delicious, or custom Google search doesn't give me. Or maybe I am just the wrong audience.

</comment></comment><comment><USER24> My immediate reaction to "slashtag" was: "oh does this somehow tie into searching the slashdot archives?"

<comment><USER11> Given the CLI syntax we're pushing in the search box, we were looking for a novel way to describe it. "Hashtag" caught on pretty well on twitter, so we figured with the / modifier in front of what are essentially category tags, "slash tag" would be pretty descriptive. It strikes some people as being a cheesy marketing term. Not sure what to do about that though.

<comment><USER10> You could leverage the popularity of hashtags, since people already use them and feel comfortable with them. IMO I'd rather slash than tag though.

</comment></comment></comment><comment><USER25> Very cool idea!

I set up a slashtag for "hackers": /zb/hack

<http://blekko.com/ws/+/view+/zb/hack>

I couldn't really think of what sites to add, so right now its just HN & stackoverflow.

<comment><USER26> Nice. Check out a few of the slashtags I have created:

<http://blekko.com/ws/+/view+/krishna/startups>

Example query: find out something in the "about us" pages of all startups: <http://blekko.com/ws/about+us+/krishna/startups>

<http://blekko.com/ws/+/view+/krishna/yc-startups>

Example query: find out all yc startups that mention "ron conway" : <http://blekko.com/ws/ron+conway+/krishna/yc-startups>

<http://blekko.com/ws/+/view+/krishna/pg>

Example query: all PG's mentions of LISP: <http://blekko.com/ws/lisp+/krishna/pg>

<http://blekko.com/ws/+/view+/krishna/yc>

Example query : stuff about startups mentioned in various YC sites: <http://blekko.com/ws/startups+/krishna/yc>

</comment></comment><comment><USER27> Its based on ShashTags and has API. I can not find how to add/edit my SlashTag via an API. Since I run a directory that would really help them, its a bit of a pain.

I do like the search though.

<comment><USER11> You can embed a slashtag search box on your own site. And you can hit us on rss by adding /rss to any search. We intend to fill out more APIs after the launch. The goal was to first get the site open to humans..

</comment></comment><comment><USER28> Like some of the others, I don't get it either. I think this is curated search results? I don't grok.

And the name is ... blech-o? I'm not mocking or making fun, I'm just saying.

</comment><comment><USER29> Pretty cool. How long before they get acquired by Google?</comment>


Needed a co-founder  how to find one? - <AUTHOR>

<comment><USER2> <http://www.gabrielweinberg.com/startupswiki/Ask_YC_Archive>

Search more. It's covered like once a month.

</comment><comment><USER3> first.. identify their role, and yours. Be clear about it. It's the first thing they'll ask you after you tell them what the company will be doing. The lines need to be very well defined, especially if you don't know this person, so that the roles don't conflict.

Before you "find" one, do the above. Then repost :)

Cheers R

</comment><comment><USER4> Pair programming is like casual dating for finding co-founders. :-)</comment>


Dissecting Boredom - <AUTHOR> http://www.sciam.com/article.cfm?id=bored--find-something-to-live-for

<comment><USER2> great article.

it's kind of funny though, how the majority of the article bashes boredom, and then with the last few lines says 'but wait, boredom may be good, so sometimes you should embrace it.'

</comment><comment><USER3> good article

one of my coaches used to say 'only boring people get bored'.</comment>


Sending SPF and DMARC passing mail as any Gmail or G Suite customer - <AUTHOR> https://ezh.es/blog/2020/08/the-confused-mailman-sending-spf-and-dmarc-passing-mail-as-any-gmail-or-g-suite-customer/ <comment><USER2> She reported this issue on April 3rd. Google marked it as a duplicate on April 21st, meaning someone else had already reported it.

After it was not fixed, she publicly disclosed the issue and within 7 hours it was patched.

What broke in the process at Google? This issue allowed GSuite users to impersonate each other to send email. That is very serious.

<comment><USER3> Especially since Google gives a fairly strict 90 day disclosure deadline themselves.

[https://www.google.com/about/appsecurity/](https://www.google.com/about/appsecurity/)

<comment><USER4> Yeah I do not understand why the author waited so long to disclose and also feels that Google deserves a "stellar job" here. Sure, Google patched the bug very quickly after disclosure. But given that Google waited so long, it sure looks like they only prioritized the fix once disclosure was a risk. If anything, I think that the author should have scheduled disclosure sooner.

<comment><USER5> > I think that the author should have scheduled disclosure sooner.

Yup. Ninety days is fine. More people should choose ninety days up front and not allow themselves to be strung along indefinitely.

Project Zero actually has granted two exceptions to their policy (out of well over a thousand cases), both to rival companies (Apple and Microsoft). On the whole I would say you should resist doing this, just set the policy and reap the consequences whatever they might be. If somebody's $100Bn company burns to the ground because they couldn't get their shit together for _three whole months_ too bad.

<comment><USER6> The problem is that you hurt a lot of users a long the way in extreme cases.

<comment><USER7> It's not you that hurt the users, it's the company for not being able to competently route, schedule, and fix their issue.

The reporter is only to blame if they actively exploit the vulnerability in order to harm users, not if they publish it publicly, with or without advanced notice to the company.

<comment><USER8> Or the bug fix can be hard to implement, test, and release in 3 months. I'm not saying it's the majority of bugs but these could qualify

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> You can do the same thing with Fastmail. Completely indistinguishable from a legitimate email - all signatures look exactly the same. Any user can impersonate any other user. Not considered a vulnerability.

What's especially frustrating is that Fastmail have a special opaque sender header that only they can interpret, and they put a little "verified" icon on email that _actually_ comes from them. So it's a vulnerability if I impersonate _them_ , but not any other Fastmail user. Sigh. I'm a happy FM user, apart from that. But I'm going to keep bringing it up until they do something about it. At least let me blacklist my domain from being used by other accounts jfc.

<comment><USER10> Email is an absolute disaster for security and privacy. Its a shame we will never see a real alternative because the age of open and decentralized standards is over. Matrix shows hope but I doubt it will come anywhere close to the popularity of email and SMS

<comment><USER11> Meh, we've continuously built stuff on top of older protocols and have made them very usable.

It seems shortsighted to say email as a whole is a disaster for security and privacy.

</comment></comment></comment><comment><USER12> This is a great find. I bet there are similar bugs hiding in many hosted mail platforms.

I always wanted to test MS365, but never got around to it. IIRC if you don't configure DKIM, they'll still sign messages using your x.onmicrosoft.com perma-ID. I remember being surprised those signatures show as valid when received in GSuite since the DKIM signing domain is different than the sending domain. Does that have something to do with ARC sealing? It should be impossible, right?

I could be totally out to lunch though since I noticed that when trying to diagnose broken DKIM signatures on a domain.

I'm also skeptical with half the planet having SPF records that point to Microsoft or Google. The dependence on domain validation after that is what makes me think there could be a lot of bugs of this class hanging around.

I bet shared hosting is a massive disaster in this area too.

<comment><USER13> If memory serves me right DKIM only mandates that the DKIM signature header is valid for the d= domain used by verifiying that the protected fields where not changed - but it makes no claims on alignment of the d= domain in the DKIM signature and the protected headers.

So anyone can sign for any domain for which they have published DKIM keys, and produce valid DKIM. It's DMARC that requires that a valid DKIM signature match the d= domain with the From domain to consider the message DMARC aligned and be awarded a DMARC pass. [or otherwise pass SPF checks and have SPF domain aligned with From domain]

Edit: typo, clarity

<comment><USER12> Ah. That makes a lot more sense. Thanks!

</comment></comment></comment><comment><USER14> Cue the sounds of frantic logs analysis trying to figure out who's been sending what emails as google.com

<comment><USER15> I'm not sure I could resist the temptation to do some serious trolling if I discovered a bug that let me send legit looking mail as @google.com users. Just imagine emailing email@example.com instituting a policy of riding a unicycle to work. It would be glorious.

<comment><USER16> Unfortunately all the company-wide aliases have someone who has to approve each message.

<comment><USER14> Not [redacted]-notify-[redacted].

</comment></comment></comment></comment><comment><USER17> It seems that this kind of weakness in tenant isolation is something that's hard to avoid in a public cloud environment, yet really critical to get right, to preserve confidence in it.

Yet given the nature of SPF and DMARC, they're inherently going to be pretty open to other tenants in the absence of IP-based isolation.

Perhaps each tenant could use a unique outbound IPv6 in future (if it reaches traction on servers), and have a small pool of such personal IPv6s allocated exclusively for their own email, across the other fallback systems?

DKIM is better as it uses cryptographic keys, but you need to give a cloud email host be access to these, or realistically load its own DKIM key into your DNS.

Any other ideas on ways to stop these kinds of cross tenant issues when designing cloud services? I'm assuming nobody will provision infrastructure per tenant due to scale and cost, but this is quite a serious issue underlining the risk of relying on a tenant account with public cloud providers when it comes to isolation.

<comment><USER18> DMARC is essentially the combination of SPF and DKIM, so it's a bit misleading that you are mentioning SPF and DMARC and make it sound like DKIM is something separate. See Wikipedia [1].

If I recall correctly, DKIM setup is simply publishing the public key as a txt DNS record under your domain. Whoever has the fitting private key can then sign emails on your behalf. The cloud email host can without problem generate a new pair for every domain. So the "upload it's own DKIM key" is essentially creating a pair for you and telling you to set the public key as a certain DNS text entry. Pretty straightforward. Stopping the cloud provider to sign emails for you is also as simple as removing the DNS entry from your domain.

> I'm assuming nobody will provision infrastructure per tenant due to scale > and cost

Actually, these services are available at a premium.

[1] [https://en.m.wikipedia.org/wiki/DMARC](https://en.m.wikipedia.org/wiki/DMARC)

<comment><USER19> DMARC is only policy, it is not SPF or DKIM.

You can have any combination of DMARC, DKIM, and SPF. They are all distinct.

Though with DKIM there is no way for a receiver to know if a message should be signed unless there is also a DMARC policy. SPF on the other hand can be verified without DMARC at all.

If Gmail.com had a DMARC policy that required a correct dkim signature, then the attack would have been much harder.

Also, to be clear, gmail.com DOES have a DMARC and SPF policy and does not have or use DKIM.

<comment> uhoh-itsmaciek >If Gmail.com had a DMARC policy that required a correct dkim signature, then the attack would have been much harder.

Can you have a policy like that? I was under the impression that DMARC passes if either SPF or DKIM passes.

<comment><USER20> > Can you have a policy like that?

No you cannot, like you said: DMARC passes if _either_ SPF or DKIM passes.

But what you can do is use the 'aspf' and 'adkim' settings to force strict alignment on SPF and/or DKIM for DMARC to pass.

We see some of our [0] customers using strict SPF alignment to basically force DMARC SPF alignment to fail most of the time, thus effectively forcing a DKIM requirement for DMARC to pass. We wouldn't recommend doing this though, unless you are already closely monitoring your email traffic, and getting close to 100% DMARC alignment.

Note that none of this would have helped against the vulnerability discovered in the OP though.

[0] [https://www.mailhardener.com](https://www.mailhardener.com)

</comment></comment></comment></comment></comment><comment><USER21> Related research paper from USENIX Security 2020 from Vern Paxson on DKIM attacks: [https://www.usenix.org/conference/usenixsecurity20/presentat...](https://www.usenix.org/conference/usenixsecurity20/presentation/chen- jianjun)

</comment><comment><USER22> I actually noticed yesterday that apparently G Suite customers can email Gmail accounts using domains with invalid SPF records (set to hardfail if not from a different mail service). I thought that was very odd. It seems that Google assumes G Suite's domain validation process is adequate, and doesn't bother checking SPF records for mail internal to Google's infrastructure. The flaw reported in this article depends on this apparent decision.

Whilst this general choice may not be the gaping security hole it feels like, because G Suite validates domain ownership, it does lead to people setting up G Suite, configuring their MX records (G Suite doesn't make SPF obvious to a new account, when I did it a few months ago for someone), and then people may email back and forth with a personal (likely Gmail) account to test it works.

Then, when they email someone with another mail server, they blame us when their SPF record is configured to block G Suite.

</comment><comment><USER23> I can see why Google would not require G Suite customers to set up DKIM, but why do they not have it set up for google.com? It seems like it would have added another barrier of defense in the case of this bug.

<comment><USER13> It is setup for google.com but you'll need to receive a message from Google to see the selector used. It's not possible[1] to establish if domain is DKIM enabled by doing DNS queries without knowing the selector used.

[1] You'd need permissions to enumerate the entire DKIM zone of the domain which you wouldn't have for a random domain and whilst you could by to bruteforce all selector names combinations between 1 and 63 characters long I wouldn't recommend doing so.

</comment></comment><comment><USER24> Was it the reason for the outage? Some details from google response after that post:

[https://www.zdnet.com/article/google-fixes-major-gmail- bug-s...](https://www.zdnet.com/article/google-fixes-major-gmail-bug-seven- hours-after-exploit-details-go-public/)

</comment><comment><USER25> I've reported similar things and people just gaslight me into thinking I'm reporting some other easily detectable problem.

I just go get multiple confirmations I'm talking to the right person now.

</comment><comment><USER26> A solution would be to extend SMTP with a new verb that allows specifying a domain-related signature prior to message delivery. This would be a hybrid of DMARC and SPF and would allow receivers to very the sender identity independent of the sending IP.

<comment><USER14> That still requires the actual sender (Google in this case) to possess the key material necessary to sign on behalf of the domain, which means you still have a "confused deputy" risk.

<comment><USER26> The sender could obtain that material from the message itself and could verify the veracity of the material against the keys stored in the DNS by the domain owner.

</comment></comment></comment><comment><USER27> Is this why I've been getting spam from gmail lately?

</comment><comment><USER28> Seems that this is answer why today there was short outage of few G services.</comment>


MainStreet launches, helps startups claim $10,000s in government tax credits - <AUTHOR> https://techcrunch.com/2020/06/15/free-money-for-startups-its-possible-with-mainstreets-platform-for-economic-development-incentives/ <comment><USER2> Correction: The founder is Matthew Lesko.

</comment><comment><USER3> More info here: mainstreet.us</comment>


Open IP over VHF/UHF - <AUTHOR> http://www.rowetel.com/?p=7207 <comment> non-entity So this might he a little off topic, but I picked up an SDR with some cool projects in mind. And when I opened SDR programs I quickly realized I had no idea what I was doing. Much of the terminology seemed foreign, etc. What kind of background knowledge do I need to get up to speed with this stuff? Would a few signals/ DSP course suffice to start out?

<comment><USER2> I recommend getting all 3 ham radio licenses: technician, General, and extra class. In the process you'll learn all kinds of things and have a lot of the concepts down. You'll learn about many different aspects of electronics, antenna design, RF propagation, and fun ways to use radios along the way. And you'll be ready to put it to use right away with your first license.

So if you research learning materials for those licenses you'll be off to an awesome start. There's excellent free and paid books available.

<comment><USER3> I have all three (WT1J) and I found them to be thin on digital signaling, SDRs, and understanding real world signals. I'd suggest getting a cheap SDR and starting here: [https://greatscottgadgets.com/sdr/](https://greatscottgadgets.com/sdr/)

You'll learn how to build a basic fm radio using gnuradio along with other cool stuff, like a simple explanation of decibels among other things.

</comment></comment></comment><comment><USER4> This is an awesome idea. I've questioned why the Amateur TV "channels" in the 430MHz range can't be re-purposed for digital TV or just 6MHz wide pure data channels (over which digital TV could be sent). Much of the resistance is from old HAMs who don't want anything to change. Hopefully TAPR can get behind something like this as well as lobbying for updates to encryption where TLS over IP over amateur radio is happening.

<comment><USER5> DATV is a thing on 430. The problem is equipment. MDARC runs DVB-S, I believe. For DVB-S, you can re-purpose satellite equipment. KH6ATV is a proponent of DVB-T (which in theory should be better than DVB-S for terrestrial paths). There is one company in Taiwan that makes DVB-T transmitters and receivers that are usable in the ham bands (available in their E-Bay store), and people have done DVB-T in the ham bands with LimeSDR. BATC has done a lot of work with DVB also. Sorry to be vague, I haven't been keeping up on my reading... about 1.5 years ago I was going to try setting up for DVB-T on 430MHz and 1.2GHz, but life got in the way.

In theory, you should be able to run 780p in a 6 MHz wide channel in the 430Hz band, or even squeeze 480i down to fit a 2MHz wide channel. (The max bandwidth allowed for amateur video in the USA on 430 is 6MHz, DVB-T does have 8MHz wide formats used in some countries for broadcast.)

Contact KH6ATV if you are interested in doing some experiments. I recommend reading his notes first: [https://kh6htv.com/application- notes/](https://kh6htv.com/application-notes/)

For those that haven't stopped reading already: DVB-C -- optimized for cable. DVB-S -- optimized for satellite path loss and fading, but not for multi-path. DVB-T -- optimized for terrestrial paths which may suffer from significant multi-path propagation. ATSC -- The US standard, which unfortunately was standardized earlier than the rest and is expensive to generate and has outrageously poor weak-signal performance, both of which make it a ridiculously bad choice for amateur radio.

<comment><USER6> My understanding is that ATSC has fine weak-signal performance at UHF in rural areas; it's just extremely sensitive to multipath interference _and_ it doesn't do well with the terrestrial noise in the high VHF range, so anywhere with large flat surfaces (like city buildings) is not so great.

</comment></comment></comment><comment><USER7> Amateur radio, at least in the US, has a ban on encryption, so while we also have signal speed limits that may prevent it, secure sockets are forbidden. I'm not sure how some of the proprietary digital modes get away with it, but I guess money talks.

<comment><USER8> Arbitrary restrictions like that just make me want to get around them... and reminds me of this phrase I heard many years ago (in the era when encryption laws were _far_ stricter):

"What's the difference between encryption and steganography? You don't know."

<comment><USER9> Don't. Follow the rules, and get them changed if you disagree with them.

Amateur radio enjoys the privilege of pretty lax regulation, largely due to the players not making any trouble. Speaking as a fellow radio amateur, we don't want our hobby ruined just because someone wants to be a troublemaker.

<comment><USER10> > _Amateur radio enjoys the privilege of pretty lax regulation_

What. You literally have to have a license issued to you personally (no anonymity) by the government to even be allowed to do it. And the rules of what can and can't be sent are, to my Internet-accustomed mind, excruciatingly onerous. No encryption? No _foul language_?

<comment><USER9> The rules are _extremely_ loose.

1\. You need a personal license to identify you, as an operator of a radio station. This is similar to how radios on ships and airplanes work - you need to be able to identify every transmission (even cellphones are uniquely identifiable). This is not only _part of the entire sport_ (we're trying to contact and _identify_ each other), but is also used to identify problems.

2\. Just like for airplanes and ships, there are some rules to what you can transmit, as your transmissions can be heard (and cause troubles) for tens, hundreds and even thousands of kilometers away.

3\. You have _countless_ frequency allocations available, all over the spectrum, despite the scarcity.

4\. Unlike everyone else, holding that license permits you to build your own equipment and transmit with _kilowatts_ with no certification needed. It's extremely easy to cause _massive_ issues with this, such as interrupting cellular communication/gps/wifi an a large area, blowing up your neighbors stereos, and fun things like that.

There's a _reason_ that everything else needs to be tested, certified, and require dedicated band allocations - we avoid it by showing that we have the sufficient skills to practice our hobby and not cause trouble.

Unlike _everyone else_ , we can do pretty much whatever we want as long as we keep it around a kilowatt and talk nice. I consider that to be _extremely_ relaxed rules.

<comment><USER10> I am reminded of what Chinese people say when they are asked about how they feel about the oppressive government. They say "What's the problem? We have perfect freedom to do whatever we want, as long as we don't talk about politics, and who cares about that?". It's perfectly normal to them, and they don't feel particularly oppressed.

Those rules about absolute identifiability are only "part of the entire sport" because you have defined it to be that way. What if Internet chat had been defined the same?

Also, enumerating what you are allowed to do once you are granted a license does not help the argument that the requirement for a license is oppressive.

> _There 's a reason that everything else needs to be tested, certified, and > require dedicated band allocations_

Maybe there were reasonable technical reasons in the 1970's, but now with modern technology, there should be no problem, or at the very least significant relaxations of what the regular public is allowed to do.

I repeat: Having to get an individual government license to practice your hobby is draconian. But, of course, regulations don't really ever get _less_ restrictive.

<comment><USER11> It happens to be a hobby that has significant potential externalities, so of course it's heavily regulated. But OP's point is that the initial barrier to entry is so high precisely because once you get past it, nobody is looking over your shoulder, and the limits are lax enough that even very disruptive activity can still fall within them.

<comment><USER10> Firstly, I doubt that the externalities are that severe nowadays, and with modern frequency-hopping technologies, I believe that it could all be fixed by upgrading existing hardware (even though this would be hard).

Secondly, the _original_ argument was that, and I quote, " _Amateur radio enjoys the privilege of pretty lax regulation_ ". And a requirement to get a government license, tied to your personal name and identity, gated by a large fee and difficult exam, is not my idea of "lax regulation".

<comment><USER12> So, there is no large fee at all for getting a Ham Radio license. You can get your license for $15.00 at most testing sites. And if you've studied, you can go all the way to Extra class for that one $15.00

As to the difficulty, children at about 5 or 6 have passed the Technician class test. It takes some studying, but it is really easy. The most difficult part is in understanding the bands that you're permitted to operate on.

In reality, getting a license is easier than it's ever been. There are no more requirements for Morse Code - though some still use it. There is no longer a requirement to go to an FCC field office for testing - your local Ham Radio club can give you the exam. It used to be that you got your Novice ticket, and had to upgrade to Technician within a fairly short period of time - now you begin with the Technician exam.

As for the regulation, there is a real legit reason for this. As Amateurs, we're permitted to operate on a wide range of frequencies - some of which are close to those used for Radar, Wi-fi, and many other services. Some of the frequencies we can use are very long range. The reason for the regulations that exist are in order to prevent interference to other services, to avoid breaking international treaties, etc.

The technical knowledge is important because you're permitted to build your own equipment. It's important, if you do, to know that your equipment is operating properly, so that you don't disrupt many other services with transmitters that are spewing noise and harmonics on many unintended frequencies.

In short, Amateur Radio is FAR LESS regulated than any other service, because of the technical abilities that we have historically displayed. It's a worthwhile hobby and lots of fun. I don't know of any other hobby that has its own satellites in orbit, that has bounced radio signals off of the planet Venus - and regularly uses the Moon or even ionized meteor trails as a reflector for radio signals...

Seriously, given what we can do with the hobby, passing a relatively simple test and paying $15.00 to get your license - and no recurring annual fee ... I don't consider that restrictive at all.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> How about 30 Mbps with OFDM.

[http://www.w6rz.net/ofdm3.png](http://www.w6rz.net/ofdm3.png)

<comment><USER14> Looks like you spent about 1000x more $ on SDR, RF bits, and computer hardware for that setup than the rpi/rtlsdr options explored in the main article.

Still, very cool.

</comment></comment><comment><USER15> Oh this is awesome. In ancient times I set up email over uhf in a remote village in bougainville (the only link I can find is a paywalled pdf [https://shop.ata.org.au/shop/renew- issue-84](https://shop.ata.org.au/shop/renew-issue-84)) We had to pretend to be a ship the mv sunrise to access a system that ran out of san diego that was only licensed to provide service to ships in international waters. There was an internet provider in the solomon islands that did something similar, but for political reasons they were not allowed to help.

<comment><USER16> There is a one page preview here: [https://www.jstor.org/stable/renetechsustfutu.84.16?seq=1](https://www.jstor.org/stable/renetechsustfutu.84.16?seq=1)

Fascinating stuff.

<comment><USER15> Thanks for finding that, I haven't seen that photo for a long time, I remember the feeling of exhausted relief that it was finally working.

</comment></comment></comment><comment><USER17> Ignore open IP over VHF/UHF if anyone wants a challenge I found out recently that...

People have been able to eavesdrop on homes by targeting pretty much anything containing metal coils (including appliances) with advanced HAM radio equipment since the early 1970s.</comment>


Cancel culture takes the fun out of life, says comedian John Cleese - <AUTHOR> https://www.reuters.com/article/us-people-john-cleese/cancel-culture-takes-the-fun-out-of-life-says-comedian-john-cleese-idUSKCN24M2QV <comment><USER2> Cleese's 1987 monologue on "extremism" is delightful and well worth the two minutes it takes to watch:

 _What we never hear about extremism is its advantages. Well the biggest advantage of extremism is that it makes you feel good because it provides you with enemies. Let me explain. The great thing about having enemies is that you can pretend that all the badness in the whole world is in your enemies and all the goodness in the whole world is in you. Attractive isn 't it? So if you have a lot of anger and resentment in you anyway, and you therefore enjoy abusing people, then you can pretend that you're only doing it because these enemies of yours are such very bad persons, and that if it wasn't for them you'd actually be good-natured and courteous and rational all the time._

[https://www.youtube.com/watch?v=HLNhPMQnWu4](https://www.youtube.com/watch?v=HLNhPMQnWu4)

</comment><comment><USER3> I came up with a good analogy the other day for "cancel culture" as a renewal more than a destructive tendency, and it's an analogy baked into the name so partly intended despite easily forgot. We already have a "cancel culture": every season we cancel a few TV shows so new ones get a shot. In more than a century of radio and TV show cancellations we haven't yet run out of "fun", have we? We keep finding new sources.

This other sort of sociopolitical "cancel culture" seems nearly as effective (or not) as radio/TV cancellation: shows still show up in rerun in syndication sometimes, it doesn't stop (and isn't really intended to stop) people with tapes/DVDs at home from enjoying rewatches. Even early shows in TV show history were sometimes re-edited for syndication to remove jokes intended for a live audience that didn't always land or that needed a context that syndication could not provide. (Today sometimes shows going to syndication need re-editing because the show doesn't have the rights to original broadcast music.)

While there are of course extreme proponents of "cancel culture", a lot of it does boil down to certain forms of "audience" dissatisfaction and a request to maybe air a new "pilot", see if a new series is waiting in the wings ready to wow the audiences. That's not to take the "fun out of life", but to find new sources of fun in life.

<comment><USER4> The analogy sucks because there's a huge disconnect between how you portray cancelling and what happens in reality.

</comment></comment><comment><USER5> I don't live in a culture where culture wars are a big thing, probably due to prosperity and a high degree of homogeneity. But because I consume US and UK media, I'm aware of the term "cancel culture".

The questions I have are:

(1) Can someone direct me to evidence it actually exists in a way that was tangibly different to the past? I have a suspicion that a large part of power is about whose voice gets heard, and someone was always getting "cancelled". I ask this question as the demographic that complains most about cancel culture (mine incidentally) is quite narrow!

(2) Is "cancel culture" an aggressive form of product-market fit? Ie if your wares aren't attractive, you're forced to iterate (twitterate?) those views until they find a market.

<comment><USER6> Personally, I don't believe it is any different now than it was before. The issue is that it's not liberals and progressives being ostracized anymore.

20 years ago, we had Don't Ask Don't Tell in the army, which was cancel culture written into institutional policy.

40 years ago, people were "cancelled" merely by being born dark skinned, and by law would never take prestigious jobs, or even eat in the front of a restaurant, or walk around after dark in certain towns.

Now conservatives are feeling the heat of American culture, which has always been direct prescriptive when it comes to right and wrong, in or out. It's not that anything has changed, but you are hearing new voices calling out in complaint.

<comment><USER7> Also don't forget red scare / mccarthyism. Cancelled any semblance of socialism being instituted, even though universal healthcare was called for by many leaders back in the 50s/60's including Eisenhower and JFK.

</comment></comment></comment><comment><USER8> Is cancel culture a real thing among comedians, as in are there real-life examples of comedians who got canceled because of edgy jokes?

Lewis C.K. and got cancelled because of unwanted sexual acts, similar to other actors. It had nothing to with his humor or acts.

<comment><USER9> And it's hard to describe Louis CK as "cancelled" when he's still touring to packed audiences.

[https://www.washingtonpost.com/arts- entertainment/2020/03/11...](https://www.washingtonpost.com/arts- entertainment/2020/03/11/louis-ck-new-standup/)

</comment></comment><comment><USER10> Went to the Front Page, quickly got cancelled. I guess Cleese might be hitting a nerve.

<comment><USER11> It'll take more tries, but eventually the fourth one will stay up.</comment></comment>


Tell HN: Don't think just build - <AUTHOR> Too often we listen to everyone except our own heart. You wanna build something? Do it. Stop caring about the perfect result or what experts say will or will not work. Happy weekend hacking! <comment><USER2> You should still wait for having something good enough before presenting it, or people will have bad first experience...

<comment><USER3> _You should still wait for having something good enough before presenting it, or people will have bad first experience._

Don't do this. As soon as your product does enough to solve the customer's pain start selling it[1].

If people have a bad experience then talk to them and use that experience to improve the product. If you make changes in isolation without talking to people you may well be making the wrong changes - you don't know what the right changes are without feedback.

If your customers _don 't_ have a bad experience, because either you were lucky and built it right to begin with, or because the product is horrible _but is less horrible than the problem it solves_ then you can have paying customers, traction, investors, money, fame, etc! Most of all, you won't run out of money and fail.

Sell as soon as you can. That's usually earlier than you think, and _a lot_ earlier than the time the product is 'ready'.

[1] Unless you're in the sort of market where there's only one customer (eg defence contracting). But if you are then you'll probably have started the sales process before you've even started building the product, because if that one customer doesn't want it there's no point building it.

</comment></comment><comment><USER4> Exactly, there are always a few idiots who like the idea (if built well). From there you can grow.

<comment><USER3> _if built well_

Think of the SaaS products you pay for. Do you know if they're well built? No. You don't get to see the code. You're still a customer.

"Well built" affects your on-going costs. Maintaining a badly built app is tedious and expensive. That's the reason to build well. It has no impact on the customer (even bugs are tolerated so long as data isn't lost). No one cares about the quality of the code when they buy an app.

<comment><USER4> Good remark, fully agree. Though I was actually referring to user experience here (so a well built sugar-coating if you will :)</comment></comment></comment>


An interesting, recent, real-world example of what to do if the stuff hits the fan - <AUTHOR> http://www.frugalsquirrels.com/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=1;t=044387;p=1

<comment><USER2> Reminds me of those guys who have thought out every aspect of what they're going to do in a zombie apocalypse.

<comment><USER3> A bit different when you're hearing it from a guy living in the zombie apocalypse.

<comment><USER4> Hint: if you have easy internet access and can speak english even though it is not your first language, you do not live in a zombie apocalypse.

</comment></comment></comment><comment><USER5> Reading about the home invasions made me think of putting up a few obvious webcams and a few hidden ones outside and inside, maybe even with a small sign informing of continuous logging to remote storage. I've been thinking about doing something like that anyway, 'cause I've had a few UPS parcels stolen off my porch.

<comment><USER6> I am not sure that intruders in a state like the one the author is living in would care. Seems like the police is not very much on top of things there, so provided with the footage of your rape and murder, they might just not care.

</comment></comment><comment><USER6> Let's hope the shit won't hit the fan.</comment>


Mr. Abrams will contend that S.& P.'s ratings deserve free-speech protections - <AUTHOR> http://www.nytimes.com/2009/07/19/business/19floyd.html?_r=1&pagewanted=all

<comment><USER2> Unless specific instances of fraud can be proven, I see little reason to blame rating agencies for the losses investors incurred. The markets have risk. If they didn't, you couldn't make money.

If the ratings agencies are to blame for the losses becasue they overestimated the stability of certain companies, then by the same token shouldn't investors have to PAY the _ratings agencies_ if they make money on stocks that ended up being _better_ than the agencies predicted?</comment>


Limonade - A PHP Micro Framework For Rapid Web Development And Prototyping - <AUTHOR> http://limonade-php.github.com/ <comment><AUTHOR> Found via: <http://goo.gl/jUBkY> [Functionn - Open Source Resources For Web Developers & Designers]</comment>


China is Kenya's largest creditor with 72% of total bilateral debt - <AUTHOR> https://qz.com/1324618/china-is-kenyas-largest-creditor-with-72-of-total-bilateral-debt/ <comment><USER2> Translation: China is going to _own_ Kenya, soon. They're doing this on purpose.</comment>


Write Your Own Linux Twitter Client In Less Time Than It Takes To Find One - <AUTHOR> http://www.linuxplanet.com/linuxplanet/tutorials/6792/1/

<comment><USER2>
        $ easy_install twitter

will install you a minimalistic yet more powerful Twitter API with a sample command line client included.

</comment><comment><USER3> Why is this on the front page? It's nothing more than an ad-filled article talking about playing with an API wrapper in a command line.</comment>


Feinstein Releases Fake NSA Reform Bill, Legalizing NSA Bulk Data Collection - <AUTHOR> http://www.techdirt.com/articles/20131031/12394625090/feinstein-releases-fake-nsa-reform-bill-actually-tries-to-legalize-illegal-nsa-bulk-data-collection.shtml

<comment><AUTHOR> [a great comment was deleted, so I'll re-post]

Procedure for Recalling State and Local Officials in California

[http://www.sos.ca.gov/elections/recalls/recall.pdf](http://www.sos.ca.gov/elections/recalls/recall.pdf)

</comment><comment><USER2> She has gone over her electable expiry date by at least a decade. She should retire, where she can natter idiocies to herself instead of pushing garbage legislation ad nauseum.

</comment><comment><USER3> She is really a horrible person. Also don't forget she's supporting all kinds of shady stuff like SOPA etc.</comment>


Coroutines in Lua - <AUTHOR> http://www.lua.org/pil/9.html

<comment><USER2> I'm not quite clear on the norms for posting content here, so pardon me if I'm missing the point; but it seems strange to post a page from a 10-year-old reference book, especially since (as far as I know) Lua coroutines haven't changed significantly since then, and it doesn't seem that there has been a new Lua release recently.

Were you pointing out something especially interesting about coroutines in general, or in Lua in particular?</comment>


A Mother Finds Joy in Helping a Child Navigate Their Shared Traits - happy-go-lucky http://www.npr.org/sections/health-shots/2017/05/14/528116476/a-mother-finds-joy-in-helping-a-child-navigate-their-shared-traits <comment><AUTHOR> You can do the same for younger siblings who may sometimes struggle with school, friendship, love, career and life in general.

I have two and they both want to be engineers. One of them is very similar in character to me - and I'm already experiencing deja vus with her. I'm not replacing our mom, mom is the real deal, simultaneously fierce and loving. But there will be some things that they'll hesitate to tell her. So the best I can do is build enough trust so that I can be their soundboard if they need one, and a 'sifu master' if they need advice - with my history of failures it's unlikely that I'll be role model but hey, at least I know where the holes are and what to do if you do fall in. I'm investing in those brats so they better become engineers ;)</comment>


Bitbucket Server 4.10 comes with a new personal dashboard - <AUTHOR> http://blogs.atlassian.com/2016/10/new-features-bitbucket-4-10 <comment><USER2> All features RhodeCode has for long time ;)</comment>


Show HN: JKAN – A light-weight, backend-free open data portal, powered by Jekyll - <AUTHOR> https://jkan.io/ <comment><AUTHOR> Here's some info on why this was built: [https://usopendata.org/2016/03/28/jkan/](https://usopendata.org/2016/03/28/jkan/)</comment>


On the joys of creativity as a software developer. - <AUTHOR> http://colabopad.blogspot.com/2009/12/on-joys-of-creativity-as-software.html

<comment><USER2> I am definitely working hard to experience all of the mentioned "joys" :) I find developing software is a lot of fun because as long as you work hard enough it is within reach to create something that a lot of people will use and enjoy.</comment>


Ask HN: Problem Monday - compass-seeker

In light of the popularity of Idea Sunday, why don't we have a Problem Monday where instead of talking about ideas and solutions, we start off with problems. <comment><AUTHOR> Libraries. How can the idea of the public library extent properly into the 21st century? Sure there are solutions such as Oyster and Scribd, but they would be considered private libraries that you pay subscription fees for, how can you scale a library to remain free without DRM traps in this day and age?

</comment><comment><USER2> World hunger. Discuss.</comment>