Sam Altman talks with Mark Zuckerberg about how to build the future [video] - <AUTHOR> http://themacro.com/articles/2016/08/mark-zuckerberg-future-interview/ <comment><USER2> Refreshing advice: Work on a problem you care about and don't worry about the rest until it's working.

> Sam: So you were 19 when you started Facebook. One question we hear a lot at > Y Combinator is, "I'm 19 today. I really want to do whatever I can to make > the world better. What should I do?"

> Mark: I always think that the most important thing that entrepreneurs should > do is pick something they care about, work on it, but don't actually commit > to turning it into a company until it's working, and I think that...if you > look at the data of the very best companies that have gotten built, I > actually think a tremendous percent of them have been built that way and not > from people who decided upfront that they wanted to start a company because > you just get locked into some local minimum a lot of the time. A local > maximum, sorry.

<comment><USER3> And also be extremely lucky.

<comment><USER4> "I find that the major objection is that people think great science is done by luck. It's all a matter of luck. Well, consider Einstein. Note how many different things he did that were good. Was it all luck? Wasn't it a little too repetitive? Consider Shannon. He didn't do just information theory. Several years before, he did some other good things and some which are still locked up in the security of cryptography. He did many good things. You see again and again, that it is more than one thing from a good person. Once in a while a person does only one thing in his whole life, and we'll talk about that later, but a lot of times there is repetition. I claim that luck will not cover everything. And I will cite Pasteur who said, 'Luck favors the prepared mind.' And I think that says it the way I believe it. There is indeed an element of luck, and no, there isn't. The prepared mind sooner or later finds something important and does it. So yes, it is luck. The particular thing you do is luck, but that you do something is not."

\--R.W. Hamming

<comment><USER5> There was a lot of luck in Facebook, even if Zuck is a particularly talented individual.

Also - if Harvard is a great school - how the F does someone find time to do the work and make a product at the same time?

When I did Engineering, I didn't have time to take a shower.

<comment><USER6> You can say that about any successful person/company.

Sure, luck may have played a large role in Facebook's initial success. But that was over 10 years ago. Many companies experience that initial success and then go nowhere, e.g. MySpace. Facebook, on the other hand, has continuously surpassed everyone's expectations. It's not until recently that people have began to accept that Facebook is here to stay. Discounting Facebook's repeated successes as luck is just silly.

Building a $350B company does not happen from luck, it requires a constant stream of good decision making.

<comment><USER7> I agree that the luck angle needs to be tempered by considering that there are _many_ ways to accidentally destroy a good thing. It should also be recognized that luck is required to prevent other, bigger companies from catching on to you before you're big enough to stand up for yourself.

I don't want to discount merit or work, but we too often seriously discount luck. Luck plays a large part in every success. That's not to say that people are justified in being unsuccessful; it's just to recognize that we're all involved in something larger than ourselves.

As failure doesn't always correlate to incompetence, success doesn't always correlate to competence.

</comment></comment></comment></comment></comment></comment><comment><USER8> The TL;DR of how Zuck wants to build FB's future w/his quotes:

1) "Connectivity, so getting everyone in the world on the Internet."

2) "The next one is AI. I think that that's just going to unlock so much potential in so many different domains."

3) "[The next computing platform] - I think that's going to be virtual reality and augmented reality."

For all the flack that Zuck is getting in this thread he lays out a pretty concise vision of what he needs to do to continue the FB's juggernaut run.

<comment><USER9> _For all the flack that Zuck is getting in this thread_

It's pretty safe to ignore most of the flack in this thread. Most people vote with their feet (or wallets, or eyeballs, or attention), and they've voted that they love Facebook, regardless of what a minority of people in this thread say or upvote.

Nerds have a cantankerous side and are as prone to virtue signalling as any other group. Those of us who read Slashdot ages ago may remember the Microsoft hate it hosted and the way every year was going to be the year of Linux on the desktop. Well, Microsoft is still here; Linux on the desktop is still a minority pursuit; and most people never cared that much about the OS they used.

The specific target nerd derision has changed some, but the form of the attack and disdain has not. Any company or country or person's haters is proportionate to its size. Look at what people do and how they behave rather than what they say.

<comment><USER10> I don't think he is getting much flack. I think he is more like Bill Gates with some luck involved. Let us not try to put him in the same bucket as Steve Jobs or Elon Musk. Facebook started as a way to hook up college students, remember poke? It did not start out as a vision to connect the world

<comment><USER11> Since a solid five minutes of the interview are devoted to Mark explaining how he never expected to start a company, let alone do anything as big as "connect the world", I don't think this is much of a rebuttal of anything. What makes you think Steve Jobs belongs in a "better" bucket than Mark? Even at his grandest vision he just made phones. They were good phones, sure, but he never tried to do anything bigger.

</comment></comment></comment></comment><comment><USER12> > I heard this story recently that at this conference where

> someone has built a machine learning application where you

> can take a picture of a lesion on someone's skin, and it can

> detect instantly whether it's skin cancer with the accuracy

> of the best dermatologists and doctors in the world. So who

> doesn't want that, right?

I wonder what that app is? Is it SkinVision[1] or IBM's proprietary medical techonology from T.J Watson Research Center[2]?

[1]: [https://news.ycombinator.com/item?id=12299930](https://news.ycombinator.com/item?id=12299930)

[2]: [http://www.computerworld.com/article/2860758/ibm-detects- ski...](http://www.computerworld.com/article/2860758/ibm-detects-skin-cancer- more-quickly-with-visual-machine-learning.html)

<comment><USER13> > So who doesn't want that, right?

What about privacy? Doctors in my country (France) are legally obliged to respect the privacy of their patients and the confidentiality of medical data. A third-party cloud service, not so much.

Edit: To be more precise, I'm not saying that medical apps can't be done right. I'm just disagreeing with the implication that an efficient medical app is automatically a good thing.

<comment><USER14> Similar apps have been around a while - [http://www.wired.com/2015/09/social- network-doctors-swap-gro...](http://www.wired.com/2015/09/social-network- doctors-swap-gross-pics-patients/)

> And finally, if you're worried about your own gnarly ER visit showing up on > Figure 1, the app is very careful about patient privacy. Every time anyone > uploads an image, the first thing they do is fill out a consent form. Figure > 1 has an algorithm that automatically obscures faces, and tools that let the > user erase any pixels containing names, dates, or any other identifying > details.

<comment><USER12> Mark Zuckerberg didn't say this app was brand new - he just mentioned that he became aware of it recently.

SkinVision has been around for 5 years. "It was founded in 2011 in Bucharest, Romania based on a PhD study to apply the mathematical theory 'fractal geometry' for medical imaging. Fractal geometry simulates natural growth of tissue and is widely used and documented in biology." [1]

[1]: [https://skinvision.com/team](https://skinvision.com/team)

</comment></comment></comment></comment><comment><USER15> > _And just to make this point, how far into Facebook did it actually become a > company?_

> _I don 't know. I think it became a formal Delaware company when Peter Thiel > invested about six months in._

Isn't this an outright lie? He sure stammered over his answer. He's joked himself about the fact that Edwardo incorporated Facebook as a Florida LLC originally.

This is how history gets rewritten to be more streamlined...

The fact is Zuckerberg was extremely ambitious about starting a company and had many attempts. That Florida LLC could've been dissolved easily if Facebook had failed. There's no downside to incorporating really.

<comment><USER16> There's details of this on page two of this Business Insider article.

[http://www.businessinsider.com/how-mark-zuckerberg-booted- hi...](http://www.businessinsider.com/how-mark-zuckerberg-booted-his-co- founder-out-of-the-company-2012-5?page=2)

"His plan: Reduce Saverin's stake in TheFacebook.com by creating a new company, a Delaware corporation, to acquire the old company (the Florida LLC formed in April), and then distribute new shares in the new company to everybody but Saverin."

</comment></comment><comment><USER17> Interesting interview, but I felt Sam could have asked more probing questions (for the lack of a better phrase) and I don't mean the controversies from the early days of Facebook.

What was the thinking behind acquiring WhatsApp for such a large amount of money and how will they monetize the platform? How is WhatsApp going to be an important part of the future?

Facebook's mission is to connect the world, but in the case of Free Basics, they violated net neutrality principles which is clearly not in the best interest of the users.

Mark Zuckerberg also mentions that he finds it frustrating that people talk about AI turning against humanity, which is one of the things that Elon Musk, Sam and OpenAI are trying to educate the population about. Maybe a discussion about that could have been included in the interview.

If any of the mods are reading this, maybe there could be some way that future interviews can include questions from HN? We could have a discussion about the questions that the HN community wants to ask, and the mods can pick out the questions that generate the most interest from the community?

<comment><USER18> Seems like a lot of those questions and deeper probing were off the table before the interview even started. Considering Sam Altman was doing the interview and the content was geared towards ycombinator, it was very startup focused.

</comment></comment><comment><USER2> "I think Peter [Thiel] was the person who told me this really pithy quote, 'In a world that's changing so quickly, the biggest risk you can take is not taking any risk.'"

</comment><comment><USER19> I'm not sure what to think about Mark's non-answer to:

"So can you tell us about some of the hardest parts in the history of the early history of Facebook?"

(He basically says the hardest point was not selling for $1 billion, and that it was a non-issue months later.)

<comment><USER15> He also left out the part where investor-genius Peter Thiel was pressuring him very hard to _sell_ Facebook to Yahoo.

Peter Thiel almost cost Zuck one of the biggest mistakes in business history.

Another inconvenient fact that goes unsaid.

<comment><USER20> Was is it a mistake? What's the probability of massive success there? In 1000 universes with FB, how many times would FB take off like that?

Groupon's looking silly for not selling at 6BN, at least as a company. (I think they personally made out ok?)

</comment></comment></comment><comment><USER21> Two things that need to be highlighted:

I came looking for a video that would talk about building the future and I am surprised Sam & Mark spent lot of time talking about FB origins and other things related to FB and talk future only for the last few minutes.

Its almost palpable the cold nature of the interview, they don`t shake hands nor greet each other as someone else noted the conversation seems very detached to say the least.

<comment><USER22> Why shades of Asperger's Syndrome are the secret to building a great tech company

[https://www.washingtonpost.com/news/innovations/wp/2015/04/0...](https://www.washingtonpost.com/news/innovations/wp/2015/04/03/why- shades-of-aspergers-syndrome-are-the-secret-to-building-a-great-tech-company/)

</comment></comment><comment><USER23> Is Sam consciously mirroring Mark's body language and style of dress, or is that just a weird coincidence?

<comment><USER24> The symmetry of the staging adds another uncanny element: the frontal camera angles and the identical chairs add on top of the similarity in dress.

And you're right, the similar affect of the two -- the earnestness, the forward posture telegraphing intensity, the lack of humor -- all together, it is off-putting. Later in the interview, Sam leans back which seems to break this unpleasant symmetry.

<comment><USER25> The poor staging and lighting are responsible for most of what people are reacting negatively to in terms of body language and appearance. Terrible location for an interview for a number of reasons.

They do seem intensely earnest, but both of them always do in the interviews I've seen. I personally don't see that as a negative in this sort of context, however.

</comment></comment></comment><comment><USER26> He gave away, or atleast appeared to give, 99% of his wealth away. I can think of better PR stunts for much less money. He is still a net positive person for me, who inspires me more than most others.

</comment><comment><USER22> Peter Thiel view on the $1B offer from Yahoo

Starts at 1:15 [https://youtu.be/54NIcx3HJSE?t=75](https://youtu.be/54NIcx3HJSE?t=75)

</comment><comment><USER27> All these comments, yet no mention of how Zuckerberg stole the project from the Winklevoss twins? My, the memory hole is really working great.

<comment><USER28> It was shocking me too. You're not alone though:

[https://news.ycombinator.com/item?id=12302303](https://news.ycombinator.com/item?id=12302303)

</comment></comment><comment><USER29> Election campaigners of Trump/Hillary would cringe at this video.

Zuck's body language looks bad because of the chair their are using. It is slanted and Zuck is sitting straight. It makes him look less relaxed (like a job interview). Same with Sam Altman.

Complete lack of emotions in Zuck's eyes. It might be part of his personality but it makes him look very detached from what he is talking about.

<comment><USER30> I can relate to Mark having to disconnect from emotion or feeling in business. It's a very personal thing for me that I don't really want to get into, but it has to do with being consciously aware of free choices.

<comment><USER29> I am not judging Zuck at all. I am just saying it is a pretty bad way to showing a leader.

</comment></comment></comment><comment><USER31> Calling BS on Mark, with FB new sponsored links in FB feed... this is total Business, not solving my problem or making my life better. To make the world a better place, Mark should have worked for FriendFeed.

<comment><USER11> It's disingenuous to claim that because a new feature isn't making your life better means he's failing at making the whole world better.

Maybe you're one of those 10-100K experiments where some engineer pushed something out to see if it worked. Maybe a new feature boosts revenue so they can build solar-powered internet planes that bring entire cities a connection. Maybe it's just noise and isn't actually relevant.

</comment></comment><comment><USER32> Is the photo below the future? Zuckerberg zombies living in a virtual Plato's Cave.

[http://i.dailymail.co.uk/i/pix/2016/02/22/16/3173A83C0000057...](http://i.dailymail.co.uk/i/pix/2016/02/22/16/3173A83C00000578-0-image-a-1_1456157751384.jpg)

</comment><comment><USER33> Anyone have a link to the transcript that's not trapped inside scribd?

Really, just plain HTML would've been fine, but instead it's trapped in a PDF that's trapped inside Scribd!

<comment><USER2> I downloaded the plain text, stripped the line wraps, and put it on Genius.

[http://genius.com/Mark-zuckerberg-how-to-build-the-future- ma...](http://genius.com/Mark-zuckerberg-how-to-build-the-future-mark- zuckerberg-annotated)

</comment></comment><comment><USER34> Is someone else surprised that Peter Thiel invested in Facebook when it had 100000 users and Mark Zuckerberg said that he planned to go back to college? What are the chances of that happening with a product today?

<comment><USER35> Today people get an order of magnitude bigger rounds with 0 users :)

<comment><USER34> Hmm...that can happen, but does that happen for a 19 year old college guy? That happens today but mostly with experienced founders.

<comment><USER35> After FB any 19 year old with a product that has 100K users and is growing at a rate of FB I would guess would be showered with money (I am not a VC so my guess might be very wrong).

<comment><USER34> I guess so. Even I am not sure though :) I would love it if someone can provide some data on the inside of such deals with numbers :)

</comment></comment></comment></comment></comment><comment><USER36> It's somewhat comforting to know that Facebook relies on the learn startup framework to constantly experiment and innovate.

</comment><comment><USER5> No mention of MySpace?

Because that was a pretty big deal back in the day.

The Lycos or Excite of Social ...

Without MySpace, I'm not sure if FB would be.

Oh - and remember 'Friendster' ?

:)

</comment><comment><USER37> After turning down the YHOO offer:

> ...It was the fact that after that, huge amounts of the company quit because > they didn't believe in what we were doing. If you look at the management > team that we had...

>Interviewer: Did that whole management team leave?

>Mark: The whole management team was gone within about a year after that.

That's an eye opener. Guess most people are in it for short term cash. I bet a lot of them regret leaving now.

</comment><comment><USER38> Σ$0.02: Perhaps a way to contribute to the world would be to figure out how to get rid of Facebook: [https://stallman.org/facebook.html](https://stallman.org/facebook.html)

Σ$0.04: Mark Zuckerberg mentions talk on the threat of AI as fear mungering, however, [https://intelligence.org/](https://intelligence.org/) (MIRI) argues that advanced AI is a legitimate existential threat. Note that when MIRI speaks of "AI", they are not talking about fancy neural networks, but the fact that since humans are no where near any kind of upper bound on intelligence, and the space of possible Turing machines and self modifying algorithms is overwhelmingly large, plus reams of other arguments you , humans will eventually be able to produce computer programs with the capability of destroying civilisation. N.B: This is my brief summary of what their stance seems to be, and isn't a direct quotation or paraphrasing of MIRI's official opinion.

</comment><comment><USER39> Founders of successful companies don't spend their time reading about how other founders became successful. When Zuckerberg was 19 do you think he spent all his time reading interviews about billionaire startup founders? Thinking that copying their traits, following their do's and don'ts and imitating them will lead to success? No, he spent his time working on the product. That and being lucky. Some of these people lucked out more than others, and because of that they get famous, get interviewed and spiel out some B.S. about how to be successful as if everyone could do it (and that they 'made it' because of intelligence, skill, and hard work).

<comment><USER7> Absolutely correct. Zuckerberg lucked into Facebook after stealing the concept from a client. Zuck's self-esteem would be destroyed if he had this same honest evaluation of himself, so he has to tell himself that he made it due to his unusually high work ethic, intelligence, or other personal traits.

<comment><USER40> Probably the biggest thing I've learned through hard experience is that great ideas by themselves have very little value. At this point it's irrelevant whether he copied the idea from his client(s), or from Friendster or MySpace. Out of pure luck, Zuck's version appealed to the masses enough to get them to register for the site and use the contact importer. After that, skill took over - Zuck knew that if a high enough percentage of users allowed the site to spam their contacts, growth to billions of users was a mathematical certainty.

This is instructive for many startups. You don't need amazing or even original ideas. You do need to have growth features in place that, if users choose to use them, will make world domination an inevitable conclusion. Then it's just a matter of optimizing until a high enough percentage of users use that feature. If you are successful at this, you will have perpetual growth.

<comment><USER2> > Actually, startup ideas are not million dollar ideas, and here's an > experiment you can try to prove it: just try to sell one. Nothing evolves > faster than markets. The fact that there's no market for startup ideas > suggests there's no demand. Which means, in the narrow sense of the word, > that startup ideas are worthless.

> —PG, Ideas for Startups (2005)

[http://paulgraham.com/ideas.html](http://paulgraham.com/ideas.html)

<comment><USER41> I think that view is a little simplistic in more ways than one.

The first is that, erm, yes, there's a huge market for startup ideas. It's called the get-rich-quick-scheme industry. Sells billions of dollars worth of goods every year trying to teach people what business ideas will make them rich.

The second is that it depends what you mean by "idea." If you mean some generic one sentence pitch about some vague idea ("Uber for pets"), then, sure, it's probably not worth much.

If you have a very precise plan that includes details about go to market strategies and execution, and that is based on data only you are in possession of, it can be worth a lot of money. That's essentially what Peter Thiel talks about when he mentions good startups being based on "secrets" (the way I understood it, anyway).

That there's no liquid market for such ideas doesn't tell you much about their value.

<comment><USER2> I think when Peter Thiel talks about "secrets" in Zero to One, he's referring to truths you hold that aren't (yet) generally accepted.

> What important truth do very few people agree with you on?

> Recall the business version of our contrarian question: what valuable > company is nobody building? Every correct answer is necessarily a secret: > something important and unknown, something hard to do but doable. If there > are many secrets left in the world, there are probably many world‐changing > companies yet to be started.

The text of that chapter is on Genius: [http://genius.com/Peter-thiel-zero-to- one-chapter-8-secrets-...](http://genius.com/Peter-thiel-zero-to-one- chapter-8-secrets-annotated)

<comment><USER41> Yep. And presumably such secrets (or "ideas" for some value of the word "idea") are incredibly valuable.

Which, _of course_ , is not to say that ideas in and of themselves build companies. But that point is so obvious it seems a little stupid to have to point it out.

That's the thing with "ideas don't matter, it's all about execution." It's either true by definition (every company has to execute something at some point to even exist), or incredibly shallow and wrong (as long as you execute something you'll get great results).

<comment><USER2> > Which, of course, is not to say that ideas in and of themselves build > companies. But that point is so obvious it seems a little stupid to have to > point it out.

It seems stupid to us, but I run into people every few weeks who "have the next big idea if only they can find a dev" but are hesitant to share more than a two-sentence pitch of fear that their coveted idea would get "stolen".

Fixed mindset vs growth mindset is still a battle for many people, especially (would be) first time non-technical founders.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER42> is this available as a podcast?

<comment><USER43> It's on Soundcloud: [https://soundcloud.com/ycombinator/how-to-build-the- future-m...](https://soundcloud.com/ycombinator/how-to-build-the-future-mark- zuckerberg)

<comment><USER44> Weird, searching for ycombinator [https://soundcloud.com/akharris](https://soundcloud.com/akharris) this podcast comes up and not the one linked on soundcloud above

</comment></comment></comment><comment><USER45> His low point was when Yahoo offered to buy FB for a billion dollars. Dark times.

<comment><USER46> "The part that was painful wasn't turning down the offer, it was the fact that after that, huge amounts of the company quit because they didn't believe in what we were doing...the whole management team was gone in about a year after that."

<comment><USER47> Making a choice that led to the entire management team leaving is tough, no doubt. Making any massively unpopular decision that leads to some of the smartest people working with you to actively flee your enterprise would be hard for anyone.

That being said, there is something to be said about how this comment was made. Because the hard part wasn't turning down the offer. It wasn't even dealing with the outcome of an unpopular choice per se -- hard to imagine these people thought "acquired by Yahoo" was the road to product success, even back then. It was dealing with the outcome of telling people they'd have to wait, possibly forever, to see their efforts rewarded (it took them 6 more years to IPO, with Zuckerberg famously devaluing the stock of early contributors along the way).

Noticing the lack of trust (possibly in both directions) _is_ a dark time, but it's hard to come to that conclusion when these things are referenced so obliquely ('people left' isn't a dark time, it's business).

<comment><USER11> "Dark time" strongly implies a subjective experience. Maybe Mark meant that was an event he personally experienced as intensely dark.

That's more or less the same situation that the TV show Silicon Valley used to stress out their founder. He's got something with potential and an offer to buy it for more money than he's ever thought about before. What do you do? Maybe go throw up in the bushes? How would it feel when you make your decision and then most of your team leaves? What if they're right and you ruined everything?

That scenario is dramatic enough when you get to watch it happen to someone else. Living through it could easily be "dark."

</comment></comment></comment></comment><comment><USER48> Sigh. Mark Zuckerberg is not the fellow to listen to if you want to build the future. He's only managed to re-invent the past. AOL, MySpace, FriendFeed, and probably a few others I'm forgetting.

edit: Folks are getting a bit philosophical so I'll clarify. There are better models to look up to if you want to invent the future: Bret Victor, Elon Musk, Alan Kay, Richard Feynman, etc. Each of those people did invent the future or is currently in the process of actually doing it. Study the great minds, not the great businesses and business practitioners.

<comment><USER49> Sigh, you've overlooked the fact that he built a hugely profitable business so now he can now throw money into "building the future". AI, VR, etc.

Google was probably the 20th search engine. They make most of their money selling ads.

Microsoft just rebuilt CP/M and bought many of their big apps.

It's what you do after you build a great business that matters.

<comment><USER50> Making gobs of money and making the future are orthogonal though.

Exxon makes tons of money but is likely irrelevant to the future.

<comment><USER49> "It's what you do after you build a great business that matters"

<comment><USER48> Why's that? Why not just skip the business step entirely? There is some kind of fallacy in your argument.

<comment><USER49> How are you going to pay for all those moonshot projects that cost billions and might not make money for a decade, if ever. Google still hasn't made any money on the self-driving car. Oculus Rift?

<comment><USER48> I don't think Oculus Rift is going anywhere. They bungled that project pretty well. My question was more about your assumption about getting some kind of cash cow and then milking it to provide for "moonshots". It is one model that works but it's not the only one. Well, actually, it's debatable whether it works or not.

<comment><USER49> What you think about Oculus is irrelevant. FB has the money to see it through, along with dozens of other similar projects. Feel free to explain the other models.

<comment><USER48> State sponsored fundamental research for one. Pretty much all of the actual computing innovation was a direct result of fundamental research that was sponsored by the state either directly or indirectly. Heck, modern compilers have a direct line back to Grace Hopper working at the naval research lab.

Commercializing stuff is great and all but there is no point in pretending it is the same or equal to the kind of innovative work that consistently happens at research universities and arguably a lot of the future is invented there even if it is not commercialized.

Also what are these dozens of other projects Facebook is currently innovating on? I do see a lot of duplicated effort across google, facebook, apple, and microsoft when it comes to AI research though. This is why I don't quite get how people can argue for commercial innovation and market efficiency all in the same sentence or paragraph when there is obvious and clear evidence to the contrary.

<comment><USER49> I guess you don't understand the value behind the trillions of dollars of R&D spent over the past 50 years by tech companies like Xerox, Intel, Microsoft, IBM, AT&T, Google, etc

<comment><USER48> Not really. I do see a staggering amount of waste though. Duplicated effort across the board, re-invention of the same basic building blocks re-packaged and re-branded, billions spent on patent suits, billions spent on lobbying, etc. Competition in basic innovation does not make sense. In fact I'm not even sure how much of those "trillions" contributed to actual innovation. I suspect a proper analysis would reveal an extremely poor efficiency ratio and only a few keystones that could trace their history directly back to a university research projects and other state sponsored projects.

<comment><USER11> LOL, you see "a staggering amount of waste" in commercial entities and thing the way to find efficiency is to look to the government? Like government- sponsored research is going to be more efficient? That's a good one.

<comment><USER51> Basic research is exactly the kind of thing that markets are bad at doing, so it really wouldn't be surprising. Which country do you see as a model of the success of privately funded research? As far as I can see, all countries that are making significant contributions to science are spending lots of government money on it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER52> Does this include Internet.org, the "wolf in sheep's clothing" of technology initiatives?

</comment><comment><USER53> Seeing how he behaved while getting to his success i don't think he should be idealized. I would rather listen to what Elon Musk has to say about future than Mark Zuckerberg.

<comment><USER54> Elon is coming up in the series. Hopefully up in a few weeks.

</comment></comment><comment><USER55> Why is M. Zuckerberg qualified to tell us how or to build us our future? Because he built brain dead website where people waste their precious time and lives?

Building facebook - glorified yellowpages - is somehow a sign of high knowledge or achievement these days?

<comment><USER56> Building a $350B tech company from nothing in 12 years might be a sign of "high knowledge or achievement"...

<comment><USER57> Because stock price == value.

</comment></comment></comment><comment><USER58> Fyi, the parent of the OP ([http://themacro.com/future/](http://themacro.com/future/)) has a header image that breaks on mobile.

</comment><comment><USER59> I'm sure the hardest part was backstabbing all his partners.

<comment><USER60> That's neither civil nor substantive. Please don't comment like that here.

We detached this subthread from [https://news.ycombinator.com/item?id=12299823](https://news.ycombinator.com/item?id=12299823) and marked it off-topic.

</comment></comment><comment><USER61> Link to Scribd is broken.

<comment><USER2> It's working now - [https://www.scribd.com/document/321383212/How-to-Build- the-F...](https://www.scribd.com/document/321383212/How-to-Build-the-Future- Mark-Zuckerberg)

</comment></comment><comment><USER62> .

<comment><USER60> Please don't comment like this here.</comment></comment>


Twilio: Someone broke into our AWS S3 silo, added 'non-malicious' code to JS SDK - <AUTHOR> https://www.theregister.com/2020/07/21/twilio_sdk_code_injection/ <comment><USER2> I love AWS as any other developer, but this is their fault.

They've invested all their resources into building out the infrastructure, and have spent very little if any time on building the UX around it. You have to be fairly technical, never mind painstakingly detailed-oriented, in order to manage their services, a big chunk of which is hidden behind black screens and various control nobs.

Amazon's logic is probably to provide the piping, and leave the rest of the end user, but at this point it's not enough. In my opinion, they need to heavily invest into the customer-facing layer of their applications that shows all the status, gaps and holes, or these things keep happening.

Then again, they can continue as is, and the incidents will keep as is, and as long as nothing implodes and no big customer leaves, financially it makes sense to do nothing. Just thinking out loud.

<comment><USER3> I really have to disagree here, at least with your conclusions re complexity. No doubt AWS S3 configuration is very technical and has a lot of docs and corner cases. However, if you are a company like Twilio, and S3 is front-and- center the source of your business (and if it's serving your SDK, it probably is), your S3 bucket permissions are clearly worthy of periodic review. And you should have this done by somebody who knows it well, or who learns it well in the process.

I worked for a company where our CTO identified the same thing (unauthorized modification of JS SDK served via S3) as a potential vulnerability. It took us half a day to get the bucket locked down to where only the root AWS IAM user—secured by physical 2fac—was permitted to change the SDK, and then only after "unlocking" the configuration changes. Since the SDK was not updated frequently, having a little manual ceremony was fine. If it had been a high- touch path we would have had to do a little more engineering to keep it safe, but not that much more.

That said, I don't blame Twilio for not catching this; shit happens at a company with years of legacy built up. I do blame anybody who says "S3 is hard" and throws up their hands. You're a professional! Read the docs, they're dry but quite extensive! Play around with it in a test bucket! It's no harder than learning any other moderately complicated professional system. If you can learn Rust, you can learn S3's API. If you can learn Kubernetes, you can learn S3 ACLs and the IAM authz model. It may not be as interesting as the topics you want to read about, but it will probably be even more useful.

<comment><USER4> The flaw in your logic is that "S3 is front-and-center the source of your business" is never true with AWS.

To do anything in AWS there's at least 3 or 4 vaguely connected services, including IAM and RAM as a completely separate UIs. Usually with S3 you also have Cloudfront or some other CDN. You probably also have Cloudwatch logs and CLoudtrail event tracking. You might have VPCs involved. Some or all of these things, in an org like Twillio, could have entirely different teams managing them.

The problem isn't that S3 is hard. The problem is, as OP suggests, the UX of actually doing anything non-trivial across half a dozen services is somewhere between abysmal and war-crime.

<comment><USER5> Each of these services are highly different concerns and don't belong together, and are honestly not _that_ hard to orchestrate together with the liberal application of Terraform.

If you've got one team managing your logging who don't talk to whatever team who manages your s3/cloudfront setup, then that's your problem.

<comment><USER6> > and are honestly not _that_ hard to orchestrate together with the liberal > application of Terraform.

I love Terraform, but the fact that you require an entirely different company's orchestration tools to make AWS "not that hard to orchestrate" is evidence of how poor the UX of AWS is.

<comment><USER7> But terraform is using the aws sdk behind the covers.

Most of the stuff available with terraform is available with CloudFormation minus a thing or two. (takes them a minute to catch-up to other teams new services/features)

</comment></comment></comment></comment></comment></comment><comment><USER8> Having an S3 Bucket with writing permissions to anyone is a major fuck-up. I know many people open buckets to the world at the read-level for whatever reason. I do that myself for static websites. But also writing permissions?

This requires a Bucket Policy that is written explicitly to allow this. I don't want to make assumptions because of course we don't know all the information and I personally know very little about infosec, but that sounds very strange.

Why would you do that? I assume the SDK gets uploaded from a secure environment that has the credentials to upload objects, so there's no legitimate reason to have writing permissions open to the world.

<comment><USER2> Potentially because it was spun 10 years ago while permissions were basic/different/even harder to track, and has since fallen off the wagon?

It seems this incident has reminded Twilio to audit all their access right, which is a net positive.

Actually, imagine you were an employee who wanted to get this done, but couldn't get management approval? This is one way to fix things ... :)

<comment><USER9> For such an important bucket, they should have

a. adopted the resource into a Cloudformation stack & a1. Enabled drift detection.

b. Use an AWS config rule to monitor (appropriate) s3 buckets for any public access.

<comment><USER10> 1\. Drift detection is a relatively new feature. 2\. CloudFormation was so basic for so long that most AWS professionals don't use it. They use Terraform or a similar, non AWS product.

<comment><USER9> You're absolutely right, and I think most of us have a hard time a. learning about all of the new features and b. justifying going back and fixing up stuff to adopt the new features, but IMO for such a critical piece of infrastructure it should have been done and the engineers/architects should have been adding that sort of stuff to the backlog or requesting training or asking for resources, etc. For me, that sort of stuff is the only way I can get the green light to go back and refactor.

</comment></comment></comment></comment></comment><comment><USER11> Doesn't sound so non-malicious to me:

 _" Specifically, the modification added code to the end of the TaskRouter.js v1.20 SDK that made an HTTP GET request to hxxps://gold.platinumus.top/track/awswrite?q=dmn and followed the URL returned in the HTML by that request."_

<comment><USER12> > followed the URL returned in the HTML by that request

Translated: we can't possibly know it's non-malicious.

TFA even has this to say:

> And judging from the URL involved, it appears to be an attempt to install a > payment-card skimmer – RiskIQ has spotted the same URL in other S3 buckets > targeted by miscreants.

Details in the linked blog post[0].

So, very much malicious.

Why the hell they included "non-malicious" in the title (granted, in quotes), I don't know. Readers could have easily dismissed this as actually non- malicious.

[0] [https://www.riskiq.com/blog/labs/misconfigured-s3-buckets/](https://www.riskiq.com/blog/labs/misconfigured-s3-buckets/)

<comment><USER13> FWIW, that's a redirector and not a skimmer.

<comment><USER14> Magecart is a well known framework in the underground for stealing credit card numbers from websites (if they can get the JavaScript running on a checkout page).

If you hit it directly they will redirect to a random "Spin the wheel win a prize" type site in an attempt to hide the malicious nature of the payload.

<comment><USER15> This is not magecart.

<comment><USER16> So they got really lucky it wasn't magecart - does this change anything?

<comment><USER15> Of course it does.

<comment><USER16> If someone drove drunk and drove into a pedestrian who survives after a month in ER does this diminish the severity of drinking or not?

<comment><USER15> An incident where the pedestrian isn't killed is almost certainly less severe than one where the pedestrian is killed.

<comment><USER16> I just don't see how that diminishes the action of crime though.

A failed drug dealer (who got caught), by your definition, should get less time because they never managed to sell the drugs they were transporting over the border and got caught :)

<comment><USER15> But why are we talking about the justice system here?

The impact of these actions matters far more to the victims than whatever consequence the perpetrator may face.

If your website was affected by this hack, surely you'd care about how your customers were impacted.

Lots of people here keep repeating the claim that this was magecart, that's just not true.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> S3 security is a pain. S3 options are tricky to master, docs are beyond confusing.

A common S3 use case is: Use a Bucket for Read-only static content, (js, html, imgs). From a dev perspective ideally it will work like a protected folder + Web Server, whereas the webserver will have read-only privileges, but reality is far more complicated.

I can understand why was easy for Twillio to have this infosec issue, since we've done it ourselves many times when using S3.

<comment><USER18> Is it really a pain though? Maybe because I've been working with it since the beginning. Bucket ACL with NO permissions, then manage all permissions on an IAM role on the account.

If it's cross account then allow assuming to other accounts, but no reason to bother with the bucket ACL.

Leave the bucket policy blank and you'll never have to worry about an open bucket. Better yet make a deny rule to everything but a single role, and you don't have to worry about rogue roles exposing the bucket.

Perhaps some of the issue is that permission can be managed on _both_ IAM _and_ a bucket policy?

<comment><USER19> It is absolutely a pain. I'm using S3 for the first time on a project right now and literally every time I have to do anything in AWS I end up confused and scared that I'm leaving a wide open security vulnerability. The documentation is complete insanity to anyone just trying to accomplish what should be an extremely common use case in a reasonable amount of time.

Before using AWS I was in the 'what morons!' camp whenever some company got breached via leaving things wide open on AWS. Now I'm in the 'ok I understand why its so common' camp.

<comment><USER20> The problem with S3 is the exact same problem with everything else in AWS. In their quest to be compatible and attractive to every single possible niche use case of the world's largest companies, they completely forgot the lone developer who just wants to upload a couple files.

You'll even see this in their sales pitches. AWS will spend so much time talking about the most advanced use cases and how they are possible, but if you ask them a simple question about how to run a single bucket that _doesn 't_ also involve using all of their ML tools and global accelerator and cloudfront, they'll be blindsided. It's almost as if they consider the common use cases to be "too simple/obvious" and therefor they never bothered to create any documentation or put any thought into it.

<comment><USER21> Your point is good, but one could suppose Twilio is not a "lone developer".

<comment><USER20> Certainly not, and in their layers of defense against this stuff, they should have had processes to train people, audit bucket policies, conduct penetration tests etc, and there's no excuse for them not having caught it before.

But with that said, one of those layers of defense is also using tools that are easy to keep secure so that the vulnerability doesn't appear in the first place. While Twilio isn't "a lone developer", I wouldn't be surprised if the person who did create that bucket on behalf of Twilio _was_ just a lone developer fumbling around in the console. And again, that's no excuse, but it still is an area for improvement.

<comment><USER21> I kind of miss the times when working with the cloud was easier or more straightforward.

Now, as has been stated before, reading any cloud vendor documentation is like reading the Oracle manuals of years ago, not a happy experience.

Granted, these clouds now do things much more powerful and target more difficult enterprise scenarios. One can miss Heroku, and AWS has Elastic Beanstalk for that, but EB gets much more difficult fast.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> One of the most shocking things I realized when I graduated college and started working as a software engineer is how insecure, or really just improperly-configured, large enterprise systems are.

This is anecdotal, of course, but it seems to me that any company that didn't start cloud-native is going to have flaws like this, and it's often not at the fault of developers but at the fault of top-down initiatives to "get to the cloud" ASAP instead of correctly.

</comment><comment><USER23> Wow. They were serving one of their SDKs out of this unsecured bucket and someone was able to upload a new version and it was distributed to customers.

</comment><comment><USER24> Hey folks, we've published a post with more details on the incident here: [https://www.twilio.com/blog/incident-report-taskrouter-js- sd...](https://www.twilio.com/blog/incident-report-taskrouter-js-sdk- july-2020)

(I work for Twilio)

<comment><USER25> Thanks for posting this. I'm really impressed with the transparency Twilio showed in actually admitting to having such a silly, silly bucket policy. Not impressed that it was there in the first place; but that should go without saying.

This incident report should really put to bed all of the "It's AWS's fault for making things so complex" complaints. (To be clear, it won't... but it should.)

Even a cursory look at that bucket policy should tell you something named "Allow Public Read" should NOT be associated with anything named 'Put'. This takes 0 AWS knowledge to figure out.

<comment><USER12> Really not impressed with the obligatory "really impressed with transparency" pat-on-the-back under every incident report for a big corp screw-up that provides any details at all.

And stating to the press the clearly malicious payload is "non-malicious" (assuming TFA didn't lie about Twilio's statement)? That's ridiculous.

<comment><USER26> Even if the payload was not malicious when they looked, it could change at any time. I don't see how that can be confidently labeled non-malicious.

</comment></comment></comment></comment><comment><USER27> I was curious about the URL that they indicated was non-malicious and so looked it up on google. I found this any.run report:

Report: [https://any.run/report/e8c581d52ca3527b61c7ddd9aba5dfeaf9440...](https://any.run/report/e8c581d52ca3527b61c7ddd9aba5dfeaf944069b625577889b83e425d54f887a/a5f1e345-5559-4955-960d-752bf877e028)

Original URL: h t t p s : / / gold.platinumus.top/track/awswrite?q=dmn

<comment><USER28> Nice find. That certainly indicates the exact opposite of "non-malicious".

</comment></comment><comment><USER29> If it's world-writable, then is it really a break-in?

<comment><USER30> "In local news, stranger off the street walks through residence's open door and moves around furniture."

<comment><USER31> Well, even in such a world, that would still be considered trespassing.

<comment><USER32> I am not a lawyer, I'm definitely not your lawyer. Trespassing and possibly theft, I think. Theft includes moving stuff without the owners permission. so if I ,say, have a tow truck and move a car across the street without the owners consent, I'm a thief.

I only know this because a friend talked about a case where they rotated a car in-place, and there was a question about is that theft? its center of mass is still where they left it, so it wound up not being theft. Moving furniture in a house is a weird one. Probably leans on ill intent, moving a chair to block a door seems like it's pointed to giving the owner a hard time. moving a chair to perform cpr has much purer motives.

So anyway, there's my ill-informed view.

<comment><USER33> I thought in common law countries theft required you to have the intent to permanently deprive the victim of the property. this is why there are separate statutes to cover stealing cars because people just claimed they were taking it temporarily.

</comment></comment></comment></comment></comment><comment><USER34> Quick shout out to GuardScript which exists to help catch malicious 3rd party (or 1st party) javascript changes: [https://www.guardscript.com/](https://www.guardscript.com/)

It's a really simple service that fetches a list of script URLs that you provide, and notifies you with the before/after diff whenever the file changes.

I found GuardScript through a Show HN a while ago ([https://news.ycombinator.com/item?id=20265141](https://news.ycombinator.com/item?id=20265141)) and have been very pleased with it.

<comment><USER35> Isn't this kinda solved by Subresource Integrity (SRI)?

[https://developer.mozilla.org/en- US/docs/Web/Security/Subres...](https://developer.mozilla.org/en- US/docs/Web/Security/Subresource_Integrity)

<comment><USER36> Some sites use ad networks that prevent them from setting good SRI policies.

<comment><USER37> So you don't set the SRI on those scripts. Nothing about the Twilio script referenced by this article would prevent SRI from being applied.

</comment></comment></comment></comment><comment><USER38> Twilio's examples[0] for taskrouter.min.js, even now, don't include Subresource Integrity hashes. Subresource Integrity would have stopped the modified script from being loaded, and removed a single point of failure.

Subresource Integrity is supported by every evergreen browser and 80%+ of market share (no IE11/pre-Chromium Edge).

[0] [https://www.twilio.com/docs/taskrouter/js- sdk/workspace/work...](https://www.twilio.com/docs/taskrouter/js- sdk/workspace/worker)

</comment><comment><USER39> would using the `integrity` attribute in the `<script>` tag mitigate this attack?

<comment><USER40> Yes! Subresource Integrity is the exact counter-measure to this kind of attack:

[https://developer.mozilla.org/en- US/docs/Web/Security/Subres...](https://developer.mozilla.org/en- US/docs/Web/Security/Subresource_Integrity)

However, on Twilio's documentation site, they do not include the integrity attribute in their examples: [https://www.twilio.com/docs/taskrouter/js- sdk/workspace/task...](https://www.twilio.com/docs/taskrouter/js- sdk/workspace/taskqueue)

<comment><USER41> It's difficult. I like the idea of subresource integrity a lot, but a counter example: Twilio discovers a bug in their JS SDK. Without subresource integrity they can push up a fix and propagate it to all clients immediately. With subresource integrity they would need every client to update their web site to change the integrity attribute. If it was a serious bug then that could be a huge issue.

Even putting the security arguments aside you can bet a lot of customers would be really irritated having to constantly update this stuff on their site. If a competitor didn't have that restriction it would become a selling point. IMO the ideal is that Twilio provides both options: a "sdk-latest.js" that's a moving target, as well as "sdk-v1.3.js" that is frozen and can be locked with subresource integrity.

<comment><USER42> What about an alternate for these 'platform script includes' like Twilio and Stripe:

        <script src="..." report-integrity="https://cdn.stripe.com/report">

in which clients compute the integrity and asynchronously ping a lightweight payload of the integrity to the third party? You would then seed your report service with a list of known hashes and set up alerting for when new hashes were observed.

<comment><USER30> Script tags (added programmatically) should support such errors via "onerror" functions. Though, I don't know if integrity errors could truly be determined. If they can then you can do whatever you want with such an error.

</comment></comment></comment></comment></comment><comment><USER43> One thing I wish AWS would do.

Allow admins to "down feature" the account. Ie, simple mode.

Basically, allow admins to toggle OFF S3 ACL's and even S3 Bucket Policies - zero those out. Then let users use IAM policies for access which may be a more familiar / more used mental model.

<comment><USER44> A better approach is simply not to grant normal users modify access to IAM, VPC, or anything else potentially destructive, and force them to make all changes via a ci/cd pipeline with ops/sre oversight and review.

</comment></comment><comment><USER45> > _someone was able to get into Twilio 's Amazon Web Services S3 bucket, which > was left unprotected and world-writable_

"Someone" was able? If the bucket was unprotected and world-writable, then _everyone_ was able.

> _' non-malicious'_

> _And judging from the URL involved, it appears to be an attempt to install a > payment-card skimmer – RiskIQ has spotted the same URL in other S3 buckets > targeted by miscreants._

In what world is that non-malicious? Non-immediately-damaging _maybe_, but it seems clear that there was a malicious chain of reasoning involved. Twilio got super lucky if this is all that happened.

</comment><comment><USER46> My immediate thought was about their Authy Desktop app - looks and feels like a web app in a container. If someone gets access to that then boom, all your 2FA tokens are stolen.

Time to find an alternative.

</comment><comment><USER47> Doesn't look isolated to Twilio - seems to be on 85 websites via other affected 3rd party scripts: [https://www.nerdydata.com/reports/gold- platinumus-top-track/...](https://www.nerdydata.com/reports/gold-platinumus- top-track/c5bb39e3-baa4-40ec-9dcb-f53876a59471)

</comment><comment><USER48> Non malicious? Does the person. That wrote that bit of bullshit even believe it.

They might as well have said "we are not smart enough to figure out the nature of this code. In unrelated news we are hiring senior JavaScript engineers, experience in opsec is a bonus"

</comment><comment><USER49> This wouldn't have happened if they just used an old school nginx file server. It has sane defaults like never letting random people edit your files through an API. Oh and it also would have been cheaper than S3. Just sayin.

</comment><comment><USER50> English is not my main language, but "broke into" doesn't implicate "breaking" something to get "into" something?

<comment><USER51> Yeah, in reality its like complaining someone "broke" into your care when you left all of your doors open.

<comment><USER52> > Yeah, in reality its like complaining someone "broke" into your care when > you left all of your doors open.

And you wouldn't get much sympathy, but this is a legally viable complaint. When my car was stolen, the thief was charged for theft, but his girlfriend who was joyriding with him was charged for criminal trespass. Just being in the car when you don't have permission is illegal.

</comment></comment></comment><comment><USER53> Is there a Twilio page that's confirming this?

</comment><comment><USER54> How did they track if the modification worked? By calling home? Because then they leaked PII

<comment><USER55> This is the Javascript SDK so checking any website which uses it would be enough to see if the modification is present.

<comment><USER54> Twilio says the only modification done to the script was to check if the modification could be done. If the hackers modified the script so it would call their own servers to check for that, they now have a list of IP addresses and timestamps.

</comment></comment></comment><comment><USER56> Don't they sign their code so that package managers can verify it's really from Twilio?

</comment><comment><USER57> Aws should start taking blame for this shit, then maybe they would start auditing their customers setups...

<comment><USER25> AWS's shared responsibility model is clear. AWS is responsible for security _of_ the cloud. The customer is responsible for the security _in_ the cloud (i.e. the customer's resources). By the way, enterprise support customers do get access to well-architected reviews by AWS.

If you ask for help from AWS, AWS will provide it. It may not be free, but it's available.

Even if AWS were to start proactively auditing customer setups, how in the world is AWS supposed to know what a customer's usecase is? Nevermind the fact it's a breach of the customer's privacy to just go rooting around in the customer's account without permission.

But let's assume AWS is going to take responsibility for customers' configuration decisions and violate customers' privacy by proactively auditing their accounts. Would AWS auditing Twilio's configuration here work?

The default is for S3 buckets to be private. The customer has to take specific, affirmative steps to give s3 buckets public access. You really have to jump through hoops to make a bucket public accessible.

Since the Twilio _chose_ to make their bucket public, AWS auditing Twilio's setup wouldn't be helpful. AWS would just assume the Twilio knows what they're doing. How is AWS supposed to know there is a misconfiguration? Because Twilio clearly decided to make their S3 bucket publicly available.

<comment><USER43> Not only do you have to jump through hoops to make it public, if you are worried can't you use Amazon Macie and have a separate org level view that alerts you to any public buckets?

[https://aws.amazon.com/macie](https://aws.amazon.com/macie)

I don't bother because it seems pretty clear what buckets are public.

That said, quick tip to make your life easier.

DON'T use S3 ACL's DON'T use S3 policies.

If I was AWS and didn't have so many customers I'd probably just create one mental model (IAM policies probably) as the place to manage things and block the rest.</comment></comment></comment>


A Very Old Man for a Wolf - <AUTHOR> https://www.outsideonline.com/2255971/very-old-man-wolf?page=all <comment><USER2> Didn't think I would read it through, but I did! Was a refreshing read amids all the tech. Pretty well written.

</comment><comment><USER3> Good read.

I'd also like to point out the Long Reads section of the Hacker News Letter. Otherwise, I wouldn't have noticed this.

</comment><comment><USER4> Reminds me of this This American Life episode about hunting the Custer Wolf in the 1920's

[https://www.thisamericanlife.org/radio- archives/episode/582/...](https://www.thisamericanlife.org/radio- archives/episode/582/when-the-beasts-come-marching-in?act=2)

[https://en.wikipedia.org/wiki/Custer_Wolf](https://en.wikipedia.org/wiki/Custer_Wolf)

</comment><comment><USER5> Reading about wolves crossing borders, killing stock, and people hunting them reminded me of the opening chapters in Cormac McCarthy's _The Crossing_. A good novel, though not among his best.

</comment><comment><USER6> Well-written. Heartbreaking.

</comment><comment><USER7> The narration is splendid! Couldn't stop reading!

</comment><comment><USER8> Losses credibility when it claims a wolf can run 10 times faster than Usain Bolt when it is running at 38 miles per hour. Usain runs at a rate of 22.5 miles per hour in a 100 meter dash. But a nice story.

<comment><USER9> Here's the direct quote:

"Wolves are so fast—they can do bursts of 38 miles per hour, ten faster than Usain Bolt..."

I can see why it was confusing! But as written, not 10 times.

<comment><USER10> I'd believe 10x. Usain Bolt runs on tracks, in shoes. Put him on the open tundra beside a wolf. Or in a forest. Running at speed through rough terrain is something we just dont do well. Watch any footage of wolves (or dogs) chasing something. Their brains do calculations, path-finding, beyond our abilities. Bolt would be on the ground and bleeding within a few strides.

</comment></comment></comment><comment><USER11> Why didn't the article cover the wolf's attempts to hack his diet to extend his life?

Was he on a life-extending keto diet, practicing intermittent fasting, or using Soylent as part of a calorie-reduction diet? What apps did he use?</comment>


Wooden Brain - <AUTHOR> http://neil.fraser.name/news/2008/01/04/ <comment><USER2> Dr.F: Would you mind telling me whose brain i did put in?

Igor: And you won't be angry?

Dr.F: I will not be angry!

Igor: Abbe...someone.

Dr.F: Abbe someone? Abbe who?

Igor: Abbe Normal.

Dr.F: Abbe Normal!

Igor: I'm almost sure that was the name.

Having gotten _that_ urge out of the way, this is really cool and would make a great educational product, I want one for me, um I mean my kids. Really, my kids would love this.

</comment><comment><USER3> Wow -- every head MRI should include one of these as a souvenir.

</comment><comment><USER4> Kinda cool, but also kinda weird. That had to have taken a lot of time. It takes a certain kind of person to go to the effort to put something like that together.

<comment><USER5> Yeah. He could have been watching "What About Earl" reruns instead.

</comment></comment><comment><USER6> Wow, thanks. I'd love to see the 1 cubic mm version that we use when mapping function to anatomy! Plus, that would be one heck of a 3D puzzle!

</comment><comment><USER7> 3D printing is here. Just mind-blowing!

</comment><comment><USER8> The news.yc code should have a third-level domain exception for *.name.</comment>


Ask HN: Moonlighting at a Startup on an H1B - <AUTHOR>

I'd love any input on the following situation: We are an early stage startup looking to bring on a co-founder who is currently on an H1B. Due to how early stage we are, we currently don't have sufficient traction to sponsor his visa on our own accord.
We are also in the process of incorporating, and are trying to determine the best course of action he can take so he can get involved in our company. Is there any way we can have him involved (via moonlighting, etc) in our company until we can show sufficient traction to co-sponsor an H1B on a part time basis alongside his current employer?
Any suggestions would be greatly appreciated <comment><USER2> IANAL, but I don't see any legal possibilities here. As long as he is on US soil, he can't work for any company other than the H1B sponsor. I've never heard of H1B "co-sponsorship"; it's usually a one-to-one relationship. The only way I see is to fully transfer the H1B to the startup.

Depending on which country he's from and how much money he brings to the table, an E2 visa might be an option. He would have to own at least 50% of the company though.

</comment><comment><USER3> H1-B co-sponsorship is one of the most viable options once you have some money. Do keep in mind that you can't sponsor a co-founder on an H1-B if he/she owns more than a certain % of the company (I think it's under 5%).

If he's a co-founder and has a large chunk, you'll need to look at other options. The best way to find all legal options are to talk to a good lawyer. My co-founder knows a great in SF but I can't seem to remember his name at the moment. Do send me an email and I can send his contact across.

We're (founders) all Indian citizens...before we quit our fulltime jobs in the bay area, we had looked into all possibilites.

<comment><AUTHOR> Thank you so much for your response, it's greatly appreciated!

With regards to ownership in the company, it was my understanding that it just had to be below 50%, or it could even be over as long as the company had the authority to hire/fire the individual on the H1B

Reference: [http://danashultz.com/blog/2011/05/06/can-i-get- an-h-1b-visa...](http://danashultz.com/blog/2011/05/06/can-i-get-an-h-1b-visa- working-for-my-own-company/)

Additionally, if you could provide any input as to how much cash is needed to co-sponsor an H1B (relative to future implied contracts, expected future cash flow, etc) would be greatly appreciated</comment></comment>


Some of my problems with correctness research - <AUTHOR> https://www.drmaciver.com/2018/04/some-of-my-problems-with-correctness-research/ <comment><USER2> Programmers may hate writing test cases and generators and proofs, but one thing they all seem to love is some good optimization. Flip a compilation flag and your program is smaller and faster!

And I think that is the key to solving this whole dilemma. Optimization and Verification, in terms of what they require from a program, are best buds. Quite a while ago, John Regehr wrote a blog post on the future of compiler optimization, where he suggested that verification and optimization will join forces, as well as some reasons and examples for why that should be [0].

Get people into languages and frameworks that are pushing the boundaries of optimization, and you'll find not only infrastructure that is ripe for correctness research, but large codebases solving real world problems. For example, Rust's MIR is a fully typed intermediate language that bridges the gap between LLVM-IR and Rust. It was created to help solve some ergonomic issues that made writing rust programs difficult, as well as for future optimization potential. And its existence should be a goldmine for correctness researchers. You have large open source codebases like Servo, written in a strongly typed language with a richly-typed intermediate assembly-like language that is just waiting for verification systems to be built on top of.

[0] [https://blog.regehr.org/archives/247](https://blog.regehr.org/archives/247)

<comment><USER3> There are lots of things you need to verify that will not help with optimization? "Feature X works with feature Y."

<comment><USER2> Why wouldn't that be an opportunity for optimization? At the very least, feature X that only works with feature Y is dead code when feature Y is not present. Even if you only enable feature X when the user chooses to enable feature Y, you have some opportunities for whole program optimization across the code boundaries of X and Y.</comment></comment></comment>


Apply HN: Voices – Making groups and individuals more influential in government - <AUTHOR> Voices - http://TryVoices.com - iOS + Android - Free
Voices is a tool that we made to make it easier for you to call your elected representatives. Was inspired by the SOPA protests in 2012. It uses your GPS location to show you who your representatives are and then gives you their email / twitter / phone number.
The longterm goal is to let people subscribe to advocacy groups that they care about, like the EFF, and receive calls to action from the advocacy groups. Users will be able to set notification settings so they don't get spammed.
Used it myself a few times during the FBI vs Apple battle and we are currently exploring partnerships with advocacy groups in NYC. Would love to hear what you guys think. http://TryVoices.com <comment><USER2> A great idea. Curious about the business model.

</comment><comment><USER3> Great app! Very easy to use. Identifies and allows me to call & email my congressman / senators / state legislators the second I open up the app.

It even gives directions on what to say. Simple.

</comment><comment><USER4> Awesome app. Great tool to help get more individual get involved in the political process especially when they know exactly who to reach out to.</comment>


Teen Arrested for 30+ Swattings, Bomb Threats - <AUTHOR> http://krebsonsecurity.com/2014/05/teen-arrested-for-30-swattings-bomb-threats/ <comment><USER2> If it's that easy to get a swat team beating down some innocent persons door then I see bigger problems than a teenager making prank calls.

Anonymous phone calls should not lead to people potentially being killed.

<comment><USER3> What, from the police's perspective, is the alternative?

If they get a credible report of a dangerous situation, they have to take it seriously. The clock starts running the moment their phone rings, so they have limited time for countermeasures.

I surely hope they're doing their best to prevent obvious fakes from getting through. They have the incentive; getting pranked by a 16-year-old makes them look like idiots. And I really hope that their procedures and training mean that they're well prepared for situations where they caller was lying, confused, panicked, or just mistaken.

But I think mere anonymity shouldn't discourage them much. For a lot of people, calling the police is a complex calculus of risk. Are they safe from the police? Are they safe from retribution from criminals? Are they inviting too much trouble for others? [1] People being anonymous may not be a great sign of a false report.

[1] E.g.: [http://tressiemc.com/2014/05/02/calling-the-white-mans- polic...](http://tressiemc.com/2014/05/02/calling-the-white-mans-police/)

<comment><USER2> For one you'd think that the point of termination of the call would have to be near the place where the crime is supposedly taking place. If that's not the case then the default should not be to go in with guns blazing but to use the time in flight to further verify the veracity of the report.

After all, what are the chances of someone reporting a hostage situation from a point of termination in another country, state, county or even town from where the hostage situation is taking place? Such information should be treated as hearsay at best.

<comment><USER3> Why do you think they can tell? I doubt they can tell the difference between Ooma users, let alone the difference between an Asterisk user on that block versus anywhere else.

Also, I hope they don't go in guns blazing regardless of the report. A troublemaker could just as well be on the block as elsewhere.

</comment></comment></comment></comment><comment><USER4> There is zero discussion of accountability for the _cops_ in any of these situations. If they are so easily tricked, they need to either scale back the militarized force they are allowing to be abused, or become more skeptical about these threats.

<comment><USER5> Unfortunately, that isn't an option at all, because the one time they are skeptical wrongly can result in bad shit. The same way that the fire department has to respond to every single fire alarm, even when they are false alarms. You can't choose where you go or what you do when it comes to people's safety.

<comment><USER6> Actually there are many cases where the police completely ignore calls for help and courts have found that police have absolutely no responsibility to protect individuals.

The police do however love opportunities to justify large expenditures and fancy equipment.

Many courts have upheld this principle:

BARILLARI v. MILWAUKEE [http://www.leagle.com/decision/1995441194Wis2d247_1431](http://www.leagle.com/decision/1995441194Wis2d247_1431)

[https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia](https://en.wikipedia.org/wiki/Warren_v._District_of_Columbia) The Court explained that "[t]he duty to provide public services is owed to the public at large, and, absent a special relationship between the police and an individual, no specific legal duty exists."

<comment><USER7> No one would ever be a police officer if police officers were liable for damages every time they were unsuccessful in protecting someone. This is perfectly reasonable.

<comment><USER6> I completely agree. It is every individual's responsibility to protect themselves. The police have no obligation to protect the public.

<comment><USER7> No, they _do_ have an obligation to protect the public in general. That's the point of police.

What they _don 't_ have is financial liability for the death of every specific person they aren't smart/fast/legally empowered/well-funded enough to save, because that would be unreasonable.

<comment><USER6> > No, they do have an obligation to protect the public in general.

I see your point but I think it's a pretty arbitrary one. Have a police force every been held legally accountable for failing to protect the public? The case law that the police have no particular obligation to protect individuals is well established.

What does it mean to have an obligation to protect the public when the public is made up of individuals and the police have no particular obligations to protect individuals?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Currently in the US when you turn 18 you end up "losing" your juvenile criminal record. A proposal I read that made sense was keeping the juvenile record hidden unless you end up committing a serious crime after 18. Once that happens your juvenile record is opened up again. At least that's an incentive to play it safe after turning 18.

<comment><USER9> In the UK 17 is a golden age for crime and getting away with it. IANAL, however, I think that you are not an adult in the eyes of a court of law, yet, being over 16, mummy and daddy do not have to be told - so no beatings at home and no prison cell/fine/community service.

Fortunately most teenagers don't know about the relative benefits of being 17, but, if you decided that making an honest living was for losers and that a life of crime was worth giving a go, that year of being 17 is the best time to do some 'apprenticeship'.

Is this the case in the U.S. and Canada?

<comment><USER10> I've heard of many cases in Québec, where if the crime is judged severe enough, a 16-17 yo would end up being treated as an adult instead of going through juvenile courts.

</comment></comment></comment><comment><USER11> It's interesting to see him named in the article - since he is under 18 in Canada he will be protected by the young offenders act and cannot be identified in the media. I suppose that is only applicable for Canadian media outlets.

<comment><USER2> I am a bit ambivalent about all this. Krebs makes his living by picking fights with people and then writing about it so if you engage him you shouldn't be too surprised to find your name in print. That said he's a bit too eager about it all, there is a 'bring it on' attitude that makes me wonder if most or any of the things that Krebs has happen to him would happen if he didn't make such a circus out of it.

It's a bit like a big bruiser going downtown to the clubs and trying to pick fights with every drunk and then bragging later about how many he bagged.

And to post the name of the kid before he's convicted (assuming he will be convicted) is out of line and possibly even illegal (he's a minor after all).

<comment><USER12> Since Krebs doesn't live in Canada, what illegal act may he have committed?

<comment><USER13> The kind that crosses an international boundary but doesn't involve millions of dollars or major political embarrassment for either nation and therefore will never be fairly adjudicated in this generation. ;)

</comment></comment></comment></comment><comment><USER14> I'm glad that this trend didn't reach Austria, because as annoying as it may seem, swatting can result in deaths of innocents, if the cops are trigger happy or the victim fears that (possibly armed) robbers are breaking into his/her home.

This kind of hoax should be punished harshly, even for 15-17 year old juveniles.

<comment><USER15> What punishment do you recommend?

<comment><USER13> Something up to and excluding the punishment equivalent for negligent homicide.

... and that restriction only to avoid the calculus where the punishments are equivalent, so someone getting their jollies by ordering armed responders to an innocent person's house might as well go drop rocks from the local overpass instead.

</comment></comment></comment><comment><USER16> > "According to the FBI, each swatting incident costs emergency responders > approximately $10,000." (from the article)

So $10k each, and 30+ times: Make him pay that $300k back.

<comment><USER17> Oh, I'd really like to know where they got that number from first.

If it includes the salaries of the officers involved, by allocating the man- hours consumed by each response, then that number needs to be lowered.

I'll accept the fact that vehicles consume gallons per mile in gas, and that private residences have to repair busted down doors and damaged sheetrock, and maybe if some other expendables were used, if say some shots were fired and it cost 50 cents in bullets, but the officers would have been on the clock anyway (overtime or no), and the taxes are already budgeted for salaries.

Did the counties get sued by the swatted? If that's the source of the number, maybe he owes a large percentage of that, but then again, maybe the lawsuit has a point and how swat teams respond to prank calls should be changed?

<comment><USER18> It's not just the monetary cost.

Every time first responders of any kind are deployed there is an inherent risk to their lives.

First responders have to drive fast to get to their destination quickly. SWAT teams are heavily armed and accidents do happen. Innocent bystanders could get shot, pets could get shot, other officers could get shot in a confusion. They might get called out on a prank call but end up finding a sovereign citizen freeman-on-the-land at home who hates the government and is willing to get into a firefight anyway.

All these things are potential liabilities on the department, not to mention the danger of having your entire SWAT force deployed to a prank call while there's a real incident on the far other side of town and not enough time to get there.

So yeah, we can argue about the cost as long as we want, but at the end of the day the primary cost on the minds of the police departments are these dangers, and the actual price tag quoted by them must take these into account.

<comment><USER19> That's exactly why they should be more circumspect when busting down citizens' doors. It's just irresponsible to allow this kid to cause this much damage.

</comment></comment></comment></comment><comment><USER20> Two things strike me as sad:

1) This type of reckless, non-violent, anti-social behavior in young males has been quite common for all of recorded history. It's a shame it has to involve so much money and international crime nowadays.

2) We remember everything now. No more can you do some bone-headed thing in your teens that cost 400K and got you sent to juvenile hall for a year, then move on with your life. Now it's all over the interwebs.

I feel sorry for the guy. Don't get me wrong: this was a lot more dangerous than it seemed to him, and something had to be done. Still, as the author points out, this is a shame.

<comment><USER12> Is it really "non-violent" to make the cops think there is a hostage situation going on?

<comment><USER20> Fair point, and I debated making that statement.

I do not believe this kid was purposefully being violent. I do believe what he did could have had terribly violent results. But until I receive additional information to the contrary, I'm going to assume that he was engaged in a prank -- a very dumb prank.

</comment></comment></comment><comment><USER21> Where did all that personal info on the kid come from?

<comment><USER22> There's a link in the article - looks like the kid also managed to irritate a slightly more competent black hat crew who dumped all his personal info onto Pastebin.

But in general, BK is a very competent journalist who is often able to reconstruct the identities of people in the Russian cybercrime underground. An obnoxious, pimply adolescent in Ontario was unlikely to present him with much in the way of a challenge.

<comment><USER21> Yeah I saw the pastebin dump. I was more asking specifically how does such a large amount of person information be dumped like that.

<comment><USER22> I guess the answer is that there are ways of finding such things out, that I'd rather not even think about. If you're the sort of person who calls out SWAT teams to people's houses and then brags about it on Twitter, then you're probably going to be found out - either by more serious black hats, or someone like Krebs.

</comment></comment></comment></comment><comment><USER23> Its sad that most of the time the parents are to blame.

<comment><USER24> And _all_ of the time the kids are to blame.</comment></comment>