Designing 2D graphics in the Japanese industry - <AUTHOR> https://vgdensetsu.tumblr.com/post/179656817318/designing-2d-graphics-in-the-japanese-industry <comment><USER3> If you're in Tokyo and interested in this kind of art / graphics, you need to check out Pixel Art Park next month

[https://pixelartpark.com](https://pixelartpark.com)

<comment><USER4> Looks like it happens every December, going to have to make it to one of these!

</comment></comment><comment><USER5> _You would color in the squares on graph paper. And then after you coloured those individual squares, you would convert them in to numbers, and then you would key in the numbers in hexadecimal using a ROM writer_

I used to do this on the BBC Model B, you could re-program character codes to be any shape and would use that to build up graphics. It was really exciting when the thing you'd drawn on paper finally appeared on screen. Or if you'd made a mistake with the hex, there would be pixels or (often) horizontal lines in the wrong place on a row.

<comment><USER6> like this?

[https://flickr.com/photos/51035661423@N01/sets/7215760031291...](https://flickr.com/photos/51035661423@N01/sets/72157600312919597)

</comment></comment><comment><USER7> Probably it's related with age - we like what we were used to - <USER2> contemporary (3D) games feel terribly boring comparing with the ones when I was a kid. My will to play them is literally zero.

<comment><USER8> Do you still find playing the old games enjoyable?

<comment><USER7> Playing old games is not enjoyable anymore (they are symbiotic with old hardware) but playing _old style_ games adapted to nowadays hardware is.

From the top of my mind: curious expedition, stardew valley, undertale, freecol, dwarf fortress (...)

<comment><USER9> Can you talk a little more about what you find enjoyable about these types of games versus new style games? Is it that they have more depth in their mechanics? Is it their presentation? Something else entirely? I know this might be a rather hard question to answer.

<comment><USER10> Here's my take. Back in 80s there was no established concept what video game was supposed to play like, so developers experimented much more than today. Some of those experiments didn't belong to any established genre (Seven Cities of Gold, Civilization, Harvest Moon) but managed to get huge following.

Modern remakes aim to bring back same spirit and open-endness of those games, but with UX improvements, more streamlined gameplay, multiplayer and other nice features we came to expect from games.

Another improvement over classics is more open development process with fascinating dev logs, creators requesting feedback and with suggested changes making it into future version.

<comment><USER9> It sounds more like a case for indie games rather than for old-style games. That is, games that aren't afraid to try new, different, unconventional things.

</comment></comment></comment></comment></comment></comment><comment><USER11> 2d (pixel art) never die.

<comment><USER12> At least it ages way more gracefully than early 3D models.</comment></comment>


Make Dope Beats with ReactJS - <AUTHOR> https://formidable.com/blog/2016/08/22/make-dope-beats-with-reactjs/ <comment><USER2> While you check out this very cool repo on Formidable's Github, if you're interested in React and/or data visualization, be sure to also check out their Victory React dataviz project, and accompanying charts library.

Victory is somewhat similar to what we discussed putting together as the underlying React-based dataviz library for our react-d3 chart library, except they seem to be figuring out a nice animation API where we struggled.

I ended up burning out from (both paid and open source) overwork last year, and never got my (very basic) dataviz library code out the door, but I'm incredibly impressed with the comprehensive library Formidable has come up with[0], with lots more to come it would appear. I'm easing back into open source work now, but it's pretty clear there's no longer a need for a good low-level, React-based dataviz library.

If you're looking for an interesting new dataviz library to check out, take a look at Victory.

0\. [https://formidable.com/open-source/victory/](https://formidable.com/open- source/victory/)

</comment><comment><USER3> I'll take a second to shamelessly plug my library TinyMusic for those of you who might want similar-ish functionality but aren't familiar with or don't like React

[https://github.com/kevincennis/TinyMusic](https://github.com/kevincennis/TinyMusic)

<comment><USER4> nice! I just used it last week to make this little thing [https://github.com/jhsu/atom-tonetype](https://github.com/jhsu/atom-tonetype) .

<comment><USER3> Hahaha. That's awesome!

</comment></comment></comment><comment><USER5> There's a whole subgenre of programming called algorave (algorithmic rave) which is oriented around building music using functional/declarative paradigms.

It's a super cool creative branch of prog research, much of it involving live programming, funky editors/IDEs (Ixi Lang is the macOS rich text editor, where on certain key combos its content is piped and the colours of the editor changed live -- bit of a hack and super cool).

Check some out -- [https://www.youtube.com/watch?v=uAq4BAbvRS4](https://www.youtube.com/watch?v=uAq4BAbvRS4)

</comment><comment><USER6> Ken Wheeler makes many cool things: [http://kenwheeler.github.io/](http://kenwheeler.github.io/)

<comment><USER7> Indeed, I use slick regularly. Thanks Ken!

</comment></comment><comment><USER8> React is actually really ideal for web audio components. The web audio api is quite easy to use for the most part. The hard part tends to be building usable ui on top of it. I've tried in the past to bundle up modular audio components in a way that they can be used in a package manager. It is hard to do well since you also need css and html to go along with the js. With react, all that stuff is already together in one modular piece that is easy to install in your audio chain.

I've worked on building some audio stuff before using backbone. I might restart with React. In the very least, I will try and implement the redux pattern.

My pet project: [http://robotaudio.com/](http://robotaudio.com/)

more full featured synthesizer: [https://github.com/joshontheweb/synth](https://github.com/joshontheweb/synth)

Edit: Looks like the layout is bonkered for some reason. It normally looks better :D

<comment> david-given That's really cool!

How much of the audio processing is software DSP in Javascript, and how much is wiring together API components?

<comment><USER8> Ideally none of it. In this app I don't believe that I used any scriptProcessorNodes. I can't remember though. The general idea is that you are connecting nodes into an audio grid but all of the dsp is happening natively. You can process the audio manually in js but it isn't as fast and is generally frowned upon. I believe that they are deprecating the scriptProcessorNodes and providing a way for you to define dspin js but have it run on the system level.

</comment></comment></comment><comment><USER9> That's pretty badass.

Does someone know what the name is of the song used in the video? It sounds familiar, but I can't come up with the name.

<comment><USER10> DMX - X Gon' Give It To Ya

<comment><USER11> maybe this version could be called "JSX Gon' Give It To Ya"

<comment><AUTHOR> lol

</comment></comment></comment></comment><comment><USER12> I can relate to the author of this article. I taught myself JavaScript in parallel with the Web Audio API around 2012.

Warning, shameless plug: Since there are no books that teach sound artists how to program using JavaScript I decided to write one based on the process I went through.

It is available for pre order if anyone is interested:

[https://www.amazon.com/JavaScript-Sound-Artists-Learn- Audio/...](https://www.amazon.com/JavaScript-Sound-Artists-Learn- Audio/dp/113896154X)

<comment><USER13> As someone currently using (aka fighting) the web audio API, there's definitely a market for better, clearer information out there, but I'm curious how successful targeting a such a niche market has been?

<comment><USER12> The book I wrote is a "how to program" book that uses JavaScript coupled with the Web Audio API as a tool to appeal to sound artists. It is not a book to teach those who already know how to program the Web Audio API. When I've gone on Amazon to look at beginner programming books I've found that most "themed" books are directed to those who want to learn how to build websites, mobile apps or games - but none are directed to DJ's, electronic musicians, sound artists etc. I wrote a book that does just that, but as it stands I have no idea if it will sell.

</comment></comment></comment><comment><USER14> I'm a huge fan of this kind of programming! While not using the Web Audio API, I built a DSL in Ruby that allows you to sequence an analog synth (or anything that speaks MIDI): [https://github.com/tubbo/mass](https://github.com/tubbo/mass)

I'm also working on a synth that models a Moog Voyager called "Worf: Son of Moog".

</comment><comment><USER15> I'm interested in this and I have bookmarked it to try out some time.

Maybe in the not-too-distant future the days of standalone audio software will be gone and everything will be run in a web browser. This would solve all the piracy problems, no need to update ever, and no compatibility issues.

I never tried the hardware MPCs, but I recently splashed out on an MPC Touch and I'm having a great time with it.

</comment><comment><USER16> Clever and cool to see such things in progress. Reminds me a bit of the Garage Band "Drummer" utility that I've been really impressed by. It could be the sample library used in the example but I would probably characterize the beat/output as more "MIDI Throwback" than dope. Slick and worth checking out for sure.

<comment><AUTHOR> Its a work in progress. Right now the synths are single oscillators with no filter. When I get those composing with effects, it'll sound more like a real patch. Also, sample maps for the sampler with note input will make doing things like wav based piano lines a lot easier.

</comment></comment><comment><USER17> Neat I made a grid sequencer synth thing using react and webaudio a few months back. Let's you edit the adsr envelopes in realtime, sync to a plugged in launchpad over midi, and supports sharing.

Music is fun!

[http://ell.github.io/grid/](http://ell.github.io/grid/)

<comment><USER18> I don't hear any sound using Firefox 48.0 on Fedora 23. The tab has the loudspeaker icon on it indicating that it probably should be making sound. I pressed a bunch of the buttons, turning them green and they are changed to yellow row by row.

Meanwhile, Chromium 51 on Fedora 23 works fine.

<comment><USER19> Apparently it uses Web MIDI, and apparently Web MIDI only works in Chrome right now.

Of course, this would all have been a lot easier to root-cause if _somebody_ had documented his stuff a little, but... :)

</comment></comment></comment><comment><USER20> [dat cowbell, hihat, kick, and snare tho]([https://github.com/FormidableLabs/react- music/tree/master/pu...](https://github.com/FormidableLabs/react- music/tree/master/public/samples))

so dope, thanks and nice work.

</comment><comment><USER21> I made a visual drum sequencer in React a couple years back as I was learning React/Flux: [http://mikesea.github.io/beats/](http://mikesea.github.io/beats/)

I'm sure the React code has aged quite a bit, but it was a fun weekend project.

</comment><comment><USER22> This is barely react. It's a container element that does all the heavy lifting with some children that are used as data stores. Would be cleaner and nicer to just use JSON and stop pretending it's React.

</comment><comment><USER23> This is cool! I was a music producer before I got into engineering as well. I was very fond of my MPC, which I still own. It would be fun to make a replica of one of the early drum PC-based drum machines: Hammerhead

</comment><comment><USER24> It would be awesome to see an interactive playground for this, where people can just mess around with simple examples. I wonder if it would be simple enough to have a codepen/jsfiddle of this.

</comment><comment><USER25> X gon give it to ya!

</comment><comment><USER26> uhh isn't this just XML with a pointless render cycle since the DOM isn't mutable?

<comment><USER27> The render cycle is what makes it actually play the sounds and show the EQ.

</comment></comment><comment><USER28> What advantage does this have over a regular DAW (other than being free)? Wouldn't most artists not be familiar with all of the concepts inherent with using JSX, and find it easier using a more traditional DAW? (FL Studio, Cubase, Reason, Logic, etc.)

I get that this is a for fun project it seems, just seems a little low on the practical scale for an artist.

<comment><USER29> > _What advantage does this have over a regular DAW (other than being free)?_

Absolutely nothing, and wasn't meant to at all. The purpose of this is is not to be practical, it's to make some noise with React.

<comment><AUTHOR> Yeah, its severely limited compared to a DAW in almost every way. But its super fun to mess around with, and if you like React and the Web Audio API then its a cool example integration as well. My vision long term is that this will serve as a set of primitives that can be composed into instrument presets and have UI hooks so you can build something like a step sequencer UI or a drum machine.

<comment><USER30> Have you ever played Rez on the Dreamcast? I kept wondering if you could do procedurally generated music from monitoring inputs so that you could listen to your production system.

I mention this only because I've flailed and failed to even figure out where to start to do such a thing a few times, and what you're doing looks like sufficient fun that I'm actually tempted to try again. No promises I ever will or that I'll remember to tell you if I do, mind ;)

Or, tl;dr: "I don't care if it's powerful, it actually looks like fun and that's awesome".

<comment><AUTHOR> i haven't but that sounds dope. you should give it a shot!</comment></comment></comment></comment></comment>


How long will it take before the right eye moves independently of the left? - <AUTHOR> http://graphics8.nytimes.com/images/2013/09/01/magazine/01computers1/mag-01Computers-t_CA0-articleLarge.jpg

<comment><USER2> I like the title ("How long..."). It reads almost like the punchline from a Christian New Testament parable.

</comment><comment><USER3> Never for most people, because it's a medical problem.</comment>


Ask HN: Cheap VPS provider with backup solution? - <AUTHOR> Does anyone knows a reliable and as cheap as possible VPS provider that supports some simple backup/restore solution through their admin panel? I already worked with DigitalOcean & Vultr and looking for other possible candidates. <comment><USER2> What exactly would you call backup?

Snapshots and copy of those snapshots which are often offered are not true backup solutions. Then most providers tend to offer an integrated or not panel to have traditional backup agent alongside external storage capacity to copy those backups too.

</comment><comment><USER3> I can't say enough good things about [http://arpnetworks.com](http://arpnetworks.com) They're a great provider and I relieve they offer a managed service as well as their standard unmanaged offerings.</comment>


The Design and Implementation of XMonad - <AUTHOR> http://xmonad.wordpress.com/2009/09/09/the-design-and-implementation-of-xmonad/ <comment><USER2> I can't believe metacity is 50,000 lines of C code. I always thought it was so bland and minimalistic.

<comment><USER3> It doesn't do a whole lot for that, but C can be quite verbose and the standard Xlib bindings don't help at all.

</comment></comment><comment><USER4> I use a really similar wm called Awesome (written in C and Lua), but I might switch once I grok haskell more.

<comment><USER5> Another fellow awesome user on HN :)

I used xmonad for a while actually before switching to awesome. I found the latter easier to configure and better out of the box (especially with multiple displays), plus I wanted to learn Lua over Haskell at the time. I found my productivity increased dramatically using either.

</comment></comment><comment><USER6> Great slides, and having tried nearly all of them, this is my favorite Window Manager.

<comment><USER7> My favorite tilling WM <http://wmii.suckless.org/> You can configure it with any scripting language but the downside is the help is lacking compared to the IRC community for XMonad and awesome.</comment></comment>


Higgs Boson particle discovery confirmed - <AUTHOR> http://www.forbes.com/sites/alexknapp/2012/09/12/higgs-boson-discovery-has-been-confirmed/

<comment><USER2> > after the debacle of the OPERA group's claim they discovered faster-than- > light particles

AFAIK, this is wrong! They never made such a claim: they just stated what they had observed and asked for help to find out the error in their own measurements.</comment>


Announcing Guetzli: A New Open Source JPEG Encoder - <AUTHOR> https://research.googleblog.com/2017/03/announcing-guetzli-new-open-source-jpeg.html?m=1 <comment><USER2> How long until someone makes a front-end to this that lets you preview the image at different compression rates? Or does it exist already?

Also...

> Note: Guetzli uses a large amount of memory. You should provide 300MB of > memory per 1MPix of the input image.

For web images that's probably not an issue but for photos that is beefy machine.

</comment><comment><USER3> As an aside: I love to see projects named after food in my mother tongue (guetzli is Swiss German for cookie). I guess this is a project somewhat based on the Zürich office of Googles.

Before this one we got brötli (small bread) and zöpfli (also a small bread, but a specific type), though both lost their umlauts in the transition to a software project

</comment><comment><USER4> I wonder how the quality compares with MozJPEG?</comment>


Making News Feed nearly 50% faster on iOS - <AUTHOR> https://code.facebook.com/posts/340384146140520/making-news-feed-nearly-50-faster-on-ios/

<comment><USER4> I really hope Apple will come up with a modern alternative to Core Data; it's neat and all, but it just doesn't feel like it's a good match for most situations.

In my own anecdote, we had to show a list of autocompletion items - <USER2> enough. Read XML, write a few hundred entries to a Core Data storage - <USER3> this list was relatively static, updated only once a week.

A week after release, we got crash reports - the XML read and store in CoreData was still running while people were already accessing the autocomplete list. It took (IIRC) 10 - 15 seconds to run (on an old iPhone 3GS), which was far too long from any standpoint.

So we just tossed CoreData, stored the list as a simple in-memory list, and made the autocomplete match search a very naive iteration-based search. Ten times faster, if not more.

TL;DR I would avoid CoreData, unless it's relatively static and non-time- critical data. And even then I'd look for alternatives first.

<comment><USER5> CoreData is really meant for storing the entries that back your table view. Trying to use it as a universal data model seems unintended.

<comment><USER6> You might be right that it's best for that, but CoreData pre-dates table views by many years and has always been sold by Apple as a general store for object graphs.

<comment><USER7> Pre-dates table views? NSTableView dates to the 1990s. Core Data was introduced in 2005.

<comment><USER8> Core Data was based on the Enterprise Object Framework from NeXT.

<comment><USER7> Only loosely. And I don't believe EOF predates table views either.

<comment><USER8> Okay, but I"m still not buying that Core Data had no design goals beyond backing store for table views.

<comment><USER7> Oh yes, I certainly wouldn't try to argue with _that_. In classic Apple fashion, they seem to try to sell it as the solution for all things data storage.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I could have told them that. In my previous job I dealt with large JSON data as well but did not use Core Data but went with an immutable data layer as well. If you had to modify anything you had to make a new one. Core Data is fine for things that have to be modifiable and uploaded but if your requirement is mostly read only it's silly overhead.

<comment><USER10> I am pretty confident this is how Twitter manage data on their iOS app as well, and I'm also pretty sure they went through a similar "let's use a database/ORM, actually let's just write it to disk" process.

</comment></comment><comment><USER11> The three principles they listed for their model have served me well in apps I've written, especially the first (immutability). Most of the Apps I write rely on some kind of server data so it works really well. I'm writing a recipe book app as a learning project and I'm experimenting with just saving JSON to the App's document folder as a persistence layer.

</comment><comment><USER12> Interesting article, but worth pointing out that core data is not an ORM, but an object graph with facilities for persistence.

<comment><USER13> You're right about this. My terminology was incorrect.

</comment></comment><comment><USER14> [https://www.youtube.com/watch?v=XhXC4SKOGfQ](https://www.youtube.com/watch?v=XhXC4SKOGfQ) is from the @scale conference last month that goes into more technical details about the architecture. Presented by the same person as the author of the article.

</comment><comment><USER15> We hit similar problems with Core Data for [http://clothapp.com](http://clothapp.com) and ended up migrating to Realm ([http://realm.io](http://realm.io)) last month. Been pretty happy with it so far.

</comment><comment><USER16> Is it me or does this article end right when some actual implementation details would have been interesting to see?

<comment><USER17> Yeah I would've loved a little more detail on how they architected the move to NSCoding / serialization straight to disk. There's a lot more ways to do this wrong than right from how open-ended a 'schema' like that is. Any speculations?

<comment><USER18> A while back, I came to the same conclusion as Facebook's iOS engineers for some apps that I work on. I based the model layer of the apps on Github's Mantle: [https://github.com/Mantle/Mantle](https://github.com/Mantle/Mantle)

Facebook's implementation probably ended up looking somewhat similar.

</comment></comment></comment><comment><USER19> It's pretty interesting to read about this stuff, I'm glad they're making progress. I hope they also work on the app accumulating data that never seems to get purged, or at least add a button to manually purge data.

</comment><comment><USER20> What bothers me about this industry is that if you were to interview for an iOS position at a place like FB and suggest a KISS type solution, say using PONSOs for the data model, you would immediately be shown the door.

<comment><USER21> Since I had to look it up and I doubt I'm alone:

KISS - Keep it simple, stupid

PONSO - Plain ol NSObject

</comment></comment><comment><USER22> How long until they put messaging back within the fb app?

</comment><comment><USER23> What's up with all the Facebook posts ending up at the top of HN lately?

<comment><USER24> Lots of hacking efforts = greater likelihood of those efforts capturing attention and showing up in places like the top of HN.</comment></comment>


Review suggests that teens benefit from later high school start times - <AUTHOR> https://www.eurekalert.org/pub_releases/2016-12/aaos-rst121416.php <comment><USER2> The Seattle Public Schools shifted times around based on some of this research. While great for students anecdotally it has been hard for parents with inflexible employers. This has also caused issues for after-school sports both for students and for non-school leagues as it reduces availability of fields pushing sports and other extracurriculars later into the evening.

</comment><comment><USER3> For just these reasons, we convinced our child's small private high school to start a little later this year, moving from 8am to 8:30am. The only negative feedback I'm aware of is the kids report less time to hang with friends after school.

</comment><comment><USER4> It seems in many districts the higher you get through k-12 the earlier they start you.

Anecdotal point, Highschool bus picks up at 6:30, elementary at 8:30 in our district.</comment>


Daily Mail owner considering Yahoo bid - <AUTHOR> http://www.bbc.com/news/business-36011510 <comment><USER2> The Yahoo brand has really positive associations for me, their company ethos always seems to have been about good design, sharing with the developer community, providing really useful services.

The Daily Mail is a horrible company that will stoop to any level to earn a buck [1][2].

It seems like a terrible cultural fit and it would be a sad end to Yahoo.

[1] [https://news.ycombinator.com/item?id=11133950](https://news.ycombinator.com/item?id=11133950) [2] [http://www.themediablog.co.uk/the-media- blog/2013/01/daily-m...](http://www.themediablog.co.uk/the-media- blog/2013/01/daily-mail-turns-the-creepiness-up-a-notch.html)

<comment><USER3> Daily Mail may have questionable journalism, but when a large public-interest story breaks, it is often the first to have large pictures of the story. As they say, a picture can be worth a thousand words.

They also seem to be the first to cover category-B news, i.e. a light plane crash in some distant country. As long as there are photos, the Daily Mail will have it on their front page today, the Telegraph tomorrow, and the BBC perhaps on the third day.

<comment><USER4> I also like that they allow comments and discussion on controversial stuff like islamic terrorism. If you read the stories on the Guardian or NYT all discussion tends to be banned in those areas in case someone says something politically incorrect. I'm not sure trying to prevent people discussing the issues makes them go away. I think stuff like that has led to it being "the most visited English-language newspaper website in the world." As well as Kardashian stories or course.

<comment><USER5> My favourite line from the Guardian came when they realised that the vast majority of their left-leaning readers strongly disagreed with them regarding Islamic terrorism and the refugee crisis.

Closed comments on certain articles due to "a change in mainstream public opinion and language that we do not wish to see reflected or supported on the site".[0]

At least they didn't even pretend that it wasn't because the majority of their readership disagreed with them.

[0][http://www.theguardian.com/commentisfree/2016/jan/31/readers...](http://www.theguardian.com/commentisfree/2016/jan/31/readers- editor-on-readers-comments-below-the-line)

<comment><USER6> I didn't even know about this. Thank you. Saving it in case some mod removes your comment. It goes to show the insane biases people have. I know Daily Mail is trash. I also know Guardian is as well.

<comment><USER7> I'm not a mod but I know they don't remove comments like that.

<comment><USER6> You sure try though.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> A fate worse than death. I am a long time Yahoo user and email account holder. The thought of the Daily Mail tabloid having unfettered access to my private information fills me with horror.

<comment><USER9> Horror enough to switch to www.fastmail.com ?

<comment><USER8> Yes, horrifying enough to switch to something else (perhaps fastmail). I would also delete all my data from Yahoo. Unfortunately I doubt that deleting it through the UI would guarantee physical removal from their servers.

\--EDIT-- upon further consideration, I am just going to switch to something else ASAP. Hoping that Yahoo gets picked up by a responsible party is a risk I am no longer willing to take.

</comment></comment></comment><comment><USER10> Fairly brilliant from the Daily Mails perspective if they can raise the cash. They are growing in the US/internationally (if I am not mistaken) and taking over the yahoo front page would supercharge their growth in news and fantasy sports. Add to that the ad-tech / ad-sales. Sell off any other potentially valuable assets (tumblr, flickr, ..) shutter the rest and have some massive layoffs.

Obviously an awful fate for Yahoo, though.

<comment><USER11> Sounds more like an awful fate for the people losing their jobs.

<comment><USER12> Under Meyer's tenure it's actually much worse: you don't know when you're going to lose your job. With DM, you know if you're in or you're out.

</comment></comment></comment><comment><USER13> I have never enjoyed Yahoo. Even during their heyday I was an Altavista user, the search seemed to give much better results. Yahoo's website design always seemed to be extremely cluttered and hasn't really updated much since then.

Whenever I use their webmail half the time the page doesn't load. I get the sense that there are 100 unnecessary services running at any time. Their chat is dwarfed by a dozen competing products.

Their news offering is unnecessary. They don't offer new products. The entire site needs to be re-written. When you do that, why not just open an auxiliary company and redirect all of your users there?

What is the purpose of the Daily Mail buying them, what will that do? And why would anyone mind or care? The worst that will happen is nothing right.

<comment><USER14> I would mind and care. The Daily Mail is a sleeze journal. My guess is half the value would be unfettered access to email accounts. They would dig through all sorts of emails to find juicy news stories and photos. This is not a reputable or ethical journal -- they make up stories, publish disghusting articles and know no bounds.

<comment><USER13> Why wouldn't daily mail just offer their own email service @dailymail.com? Surely that would be less expensive. I doubt there would be too much juicy news flowing through yahoo's email server.

Then again as you say, Daily Mail is pretty much a tabloid. I think grabbing specifics from personal email might be a little extreme. They might, on the other hand, monitor trends to see what people are talking about in general.

That I might believe.

<comment><USER15> Because yahoo mail offers a 20year treasure trove of email whereas a new email service would offer no such history. I, like many, started my first email account on Yahoo. It still lives, even though most current usage has migrated to gmail. Also, only a fool would use @dailymail as their primary account knowing the history of the paper's privacy violations.

</comment></comment></comment></comment><comment><USER16> Yahoo for me just means an email account that I hang on to because I have had it a long time and still use for the occasional thing.

It's a website which, as only an occasional visitor, seems to do its best to makes it awkward for me to find the email log-in. What I see while there seems to be flashy glitzy trivia that's of no interest to me at all.

tbh I can't understand why it's valuable.

EDIT: just visited now and the email was easier to find than I seem to remember

<comment><USER4> >why it's valuable.

The market has been valuing yahoo's core business at about $0 after you deduct the value of its Alibaba and Yahoo Japan shareholdings.

However the remainder can have value. At the moment they have income of about $4.6bn/year from adds and the like which is spent paying the wages of 10,400 employees. How many employees do you actually need to run a site like yahoo? They could probably cut back a good bit and be quite profitable.

</comment></comment><comment><USER17> Given that Yahoo owns Tumblr, Tumblr's userbase is largely liberal, and the Daily Mail is very right-wing, that's not gonna end well.

</comment><comment><USER18> It is always interesting when most tech folks, even most business folks talk down Yahoo, as a relic of the internet of yesterday, a company with arguably the worlds biggest online news site can see value in Yahoo.

Whether you like the content on DM, they know how to be commercially successful in a difficult digital time, and might have interesting plans for Yahoo!

</comment><comment><USER19> Time to kill off any old Yahoo accounts you might have.

</comment><comment><USER20> It doesn't look like the Mail wants Yahoo Research, so that would probably end up owned by a private equity group who would naturally seek to extract the maximum value from it and its patents...

</comment><comment><USER21> What's everyone after when acquiring Yahoo? I can't even think of a product outside of Flickr that they've done a decent job on. I started forwarding my Yahoo mail to Gmail because the mail client was always buggy and slow. Their online news is nothing but blatant reposts from NPR and AP. Their own "journalists" write mostly celebrity garbage. What is it at this point? Traffic?

</comment><comment><USER22> I have so much internal confusion when it comes to Yahoo. I remember them as innovators, as the go-to search engine when I was a netscape-obsessed middle school student. I respected their site and work.

Now, I go to Yahoo and am just...disappointed. The front page has become a home for stale clickbait, and other areas of the site a home for hateful comments and obtuse advertising. I just think to myself "who the hell are they trying to appeal to, what am I looking at. Why don't I switch mail services already?"

I am used to their email, and still use it daily. I have been hoping to see Yahoo make some serious changes and be on the upswing for a number of years. If The Daily Mail touches Yahoo in any way, I would be finished with them, without hesitation, without question. That would be the death knell. And it doesn't appear I am alone in the sentiment.

</comment><comment><USER23> Keeping the DM site up and snappy for so many users is no mean feat. Making an efficient digital workflow for users (journalists) who are quite picky consumers of IT solutions (I have my way of working and only my way)... The DM, technically speaking, is an impressive beast.

Perhaps this is a real story even though my gut says this has agenda written all over it.

</comment><comment><USER24> What a sad end for Yahoo. The Daily Mail

</comment><comment><USER25> I bet it won't be for $44 billion

<comment><USER26> Also worth noting that Microsoft wanted to pay half in shares which were worth on Feb 1st 2008 27.20 (post announcement - a huge drop!) - today they are worth 54.42 - almost exactly double.

This means that today if the deal had have gone through (and people kept their MS shares) in 2008, Y! shareholders would have assets worth ~$66bn.

</comment></comment><comment><USER27> I don't think this is a good idea. The Daily Mail is more tabloid. Yahoo is not a tabloid, and I think it would be a mistake to take it in that flippant, Gawkeresque direction.

<comment><USER28> > I don't think this is a good idea. The Daily Mail is more tabloid. Yahoo is > not a tabloid, and I think it would be a mistake to take it in that > flippant, Gawkeresque direction.

It's kind of a Tabloid where I live. But yes, it's not as bad as the DM. But Yahoo seems desperate to sell or it wouldn't even consider the offer.

</comment></comment><comment><USER29> Is all this due to Marissa Mayer's failure at the helm of Yahoo or is it just a logical business decision the shareholders made? Whats the backstory.

</comment><comment><USER26> It'd probably allow the Daily Hate to steal people's copyrighted material from Flickr without having to ask. Not that they did before.

</comment><comment><USER30> DMGT is a big group who owns lots of publications, like Euromoney.

Yahoo will be one among many.

</comment><comment><USER31> Was going to say "that should end well" but the front page of yahoo already looks like the Daily Mail so maybe its a good fit.</comment>


How to beat writers' block - <AUTHOR> http://www.newyorker.com/science/maria-konnikova/how-to-beat-writers-block <comment><USER2> I've thought very long and hard (and written loads) about writer's block, and have made a lot of personal progress in dealing with it. [I'm currently 550,000+ words into a "write a million words" project.] I'd be happy to chat about it with anybody who struggles with it.

I like to think of writing (or any creative work, really) as a large-scale process with many intermediate steps, like say, producing diamonds. You have to start by locating the raw materials, drilling them out, getting a sense of what they are, isolating them, cut them up, polish them, set them, present them, sell them.

Block can happen at any point along the process. It could be that you don't have enough raw material. It could be that you're not sure how to cut the particular stone that you have. It could be that you've got the wrong tools for the job, or that the job itself is not worth doing.

The challenge is to zoom out from the present moment and to see the bigger picture, and often to move upstream in the process. Sometimes you need to abandon the process altogether, and maybe return to it later.

The creative person's anxiety and paranoia can seem like a petty thing compared to say, somebody who has to deal with "real" problems. (I'm reminded of Anthony Bourdain saying "Cooking professionally is hard work. Writing is a privilege and a luxury. Anybody who whines about writers block should be forced to clean squid all day")

It's a fair point. That said, I think it's useful to try and understand what exactly the block is. It's fear, anxiety, attachment to outcome, a sense of incompetence and worthlessness.

Elizabeth Gilbert also has a great TED talk on dealing with that, about separating your self-esteem from your work: [https://www.ted.com/talks/elizabeth_gilbert_on_genius?langua...](https://www.ted.com/talks/elizabeth_gilbert_on_genius?language=en)

<comment><USER3> I have problems with writer's block, but my problem seems quite different from what's described here.

Usually, I'm fine with the creative aspects -- I know what ideas I want to communicate. What troubles me is finding the words to say it. And the more time I spend thinking about it, the more difficult it becomes. Sometimes, I can spend an hour working at a paragraph, and still can't get comfortable with the wording.

Does anyone else have this problem?

<comment><USER2> Certainly! I experience this periodically, usually (perhaps always) when I'm approaching new topics or ideas that I'm not familiar with.

I wouldn't say it's writer's block altogether, I think it's just the "stretch" of trying to communicate something you haven't effectively communicated before.

The analogy I would use here is– it's like a standup comedian trying out new jokes. He knows that it's funny, but the audience isn't laughing– because there's something about the delivery that he isn't getting right.

My advice for people struggling with these things is to do multiple drafts. Try to write it down, then start over altogether from scratch. Explain it to other people. After a while, you'll start "catching" the right turns of phrases and sentence structure and so on.

<comment><USER4> Yes, and I think lowering the "stakes" of the paragraph is important. Sometimes switching to longhand on a legal pad helps me, because then I know that I'm not working on the final, final version, and I can allow the paragraph to be, temporarily at least, imperfect.

<comment><USER2> > then I know that I'm not working on the final, final version, and I can > allow the paragraph to be, temporarily at least, imperfect.

Absolutely. This is so important. The writing and editing process should be decoupled– trying to do both at once typically leads to frustrating contortions.

<comment><USER3> Really good suggestions. Thanks!

</comment></comment></comment></comment></comment></comment><comment><USER4> Recently I learned a good trick for turning of your internal editor while writing, which is one of the things discussed in the essay. Try turning the screen of your laptop off so that you can't see what you are typing, and just type away for a set period of time. This helps you "allow for error" and not worry over every word or phrase you are putting down. I can usually get hundreds of words out of this trick in just 20 minutes or so, after which you can turn the screen back on and have something to edit, revise, and polish.

</comment><comment><USER5> TL;DR excerpts:

\- allowing for error—and realizing how nonlinear a process creativity can be—was an essential step for overcoming blocks in writing

\- It's useful to escape from external and internal judgment—by writing, for instance, in a dream diary, which you know will never be read—even if it's only for a brief period... [your dream] serves as a reminder that, no matter how blocked you may be, you still have the capacity to imagine something new—no matter how small and silly it may seem

\- Such escapes allow writers to find comfort in the face of uncertainty; they give writers' minds the freedom to imagine, even if the things they imagine seem ludicrous, unimportant, and unrelated to any writing project.

\- Creative people do a lot of trial and error and rarely know where they are going exactly until they get there

</comment><comment><USER6> Writers' block is a myth. Writing is work. Put your ass in a seat and get the job done. Creativity is a vocation, not a bolt from heaven.

You want to beat a slump? Produce more work until it gets better. That's all. Want to get fit? Eat right and exercise.

<comment><USER7> What informs this opinion?

<comment><USER6> Anecdata. A lifetime of "writing" followed by several years of actually writing.

</comment></comment></comment><comment><USER8> Im quite partial to Randy Newman's solution (loosely quoted) 'I just lower my standards and plow on through'

<comment><USER2> Works really well. The key is to be committed to seeing the process and not obsess pathologically about the outcome.

</comment></comment><comment><USER9> No mention of Eno's Oblique Strategies [0]? I've found them very useful for prompting me to think in different ways, which often leads to something to write about. I set up a little shell script, `strat`, which prints out a randomly selected strategy. I've also started adding my own strategies and tips and reminders to correct routine personal issues (e.g., shut the fuck up and listen). I used to have them printed out every time my shell started up but that led to me ignoring them; now I have to seek them out and often enjoy the result.

[0]: [https://en.wikipedia.org/wiki/Oblique_Strategies](https://en.wikipedia.org/wiki/Oblique_Strategies)

<comment><USER10> Thank you for pointing this out, never heard of them before.

</comment></comment><comment><USER11> Something that works for me is to switch media. Start talking into a microphone. It's fast and easy to work things out a few different ways, and hearing it can help you find flaws that you might miss otherwise.

</comment><comment><USER12> The author of this article is the very same Maria Konnikova who does the weekly "Is That Bullshit?" segment on Slate's excellent daily podcast, "The Gist with Mike Pesca."

Pesca manages to write ~15 minutes of extremely witty news-related material every day, and I am constantly amazed at it.

</comment><comment><USER13> One thing that has helped me in the past is writing shitty first drafts:

[https://wrd.as.uky.edu/sites/default/files/1-Shitty%20First%...](https://wrd.as.uky.edu/sites/default/files/1-Shitty%20First%20Drafts.pdf)

Editors block is much less prevalent.

</comment><comment><USER14> Emotional problems are best dealt with, in my experience, not by more emotional exercises (imagery, counseling) but by new experiences, expecially physical ones. Go on a week-long bicycle trip. Rock climb. Start running. Play basketball. Anything to get you out of your mind and back into your body.

</comment><comment><USER15> [http://www.brainstormpro.com](http://www.brainstormpro.com) is also another good resource when you need fresh words.

</comment><comment> ezequiel-garzon Why was the apostrophe in the title moved? The title uses "writer's block", not "writers' block".

Edit: Removed a suspicious apostrophe =).</comment>


Update on IT Security Incident at UCSF - <AUTHOR> https://www.ucsf.edu/news/2020/06/417911/update-it-security-incident-ucsf <comment><USER2> CISO: [https://cio.ucop.edu/spotlight-patrick-phelan-once-a-ucla- br...](https://cio.ucop.edu/spotlight-patrick-phelan-once-a-ucla-bruin-now- ciso-at-ucsf/)

I can't think of any reason not to use a cloud hosted service for backup today. OneDrive, Dropbox, and Google Drive all sign BAAs and give you versioning amongst a million other security features. AWS even has offerings that let you take periodic snapshots of on-premise volumes.

Point in time recoveries for the entire account would be nice add too but not having to fork over a million dollars in exchange for a few clicks sounds like a bargain. Hell we were setting up write-only S3 buckets for critical data stores 5+ years ago.

Gross incompetence, I'd fire everyone. A district-wide outage for a week, fine. A 1.4 million dollar check to get data that should have been archived somewhere GTFO.

<comment><USER3> There are reasons not to use cloud services for backups, not trusting them with your data being a major one. But then you should still be using some kind of internal backup system.

There is no excuse for not having backups.

<comment><USER4> "No, we can't use leading cloud providers to store this data. What if someone unauthorised looks at it?"

This attitude leaves the victim paying millions in ransom. Look, Microsoft and Amazon probably have a better handle on security than your IT dept which is two people who also have to fix any issues like the WiFi not working or software not updating.

<comment><USER5> There is no reason to believe clouds don't have security issues or software bugs that cause inadvertent data loss.

Just because the cloud provider is a big company doesn't mean the security is better. At the end of the day, they are a team of software engineers with all the usual people and org problems and can have usual human mistakes.

But cloud solutions are better in practice due to totally non-technical reasons. Here's how -

If UCSF can afford to pay millions in ransom, they can definitely afford to hire the right experts to do their IT systems properly.

It is likely that they hire the right people, but then the most commonly recommended security policies were considered but not implemented due to resistence from powerful non-security team members inside the organization. (Usually, the highly paid CISO is playing politics with peers to keep the job by ignoring those security experts).

If it also possible that the IT+security team is incompetent and is only good for deploying expensive but useless vendor solutions that do a lot of security theater but do very little to improve actual security. Also possible that the vendor solutions are susceptible to be misconfigured easily to become insecure.

Public cloud solutions can help overcome these above shortcomings of in-house security+IT teams in a org politics friendly manner.

<comment><USER3> > Public cloud solutions can help overcome these above shortcomings of in- > house security+IT teams in a org politics friendly manner.

The problem there being that the choice of "public cloud" is subject to all the same forces, so then the vendor with the best corporate marketing team gets the business even if their security is crap.

</comment></comment></comment></comment></comment><comment><USER6> The paid ransom, will unfortunately embolden the criminals to strike again in search of the next big payday. If it worked once, it could work again.

<comment><USER7> If the data is worth paying a million dollar ransom to unlock, it is worth setting up proper backups. I for one am grateful to people who commit these crimes in which they "lock" data in place rather than sell it to the highest bidder.

Proper data hygiene isn't brain surgery. There is zero excuse for this event. I don't blame the criminals. I blame the university system. Shame!

<comment><USER8>
        ... "lock" data in place rather than sell it to the highest bidder.

Why not both? And once the rightful owner of the data has paid a fat ransom, surely that's got to provide some kind of proof of its market value. The University did say that

        The attackers obtained some data as proof of their action

so unless they're logging their outbound traffic, who's to say they didn't exfiltrate all of it? It's the kind of thing that the University would remain tight-lipped about unless they were either sure that it hadn't happened (doubtful, seeing as they aren't running a tight ship) or had some kind of mandatory reporting obligation for the data.

<comment><USER9> The data is worth that much to the university because they're critical to grant continuity - it'll be hard or impossible for their researchers to keep the money flowing without it. It's pretty much useless in everyone else's hands because those grants also depend on individual reputation and research history.

</comment></comment></comment></comment><comment><USER10> Maybe there should be a law that if you pay a ransom, you are required to pay the same amount as a fine. Because paying these ransoms is funding the criminals.... how about you have to also fund law enforcement to combat those criminals?

(also, this should reduce the amount that actually goes to the bad guys, since the amount of ransom would have greater downward pressure, i.e. if they'd probably not be able to collect more than $0.57M because that would cost UCSF $1.14M)

<comment><USER11> This would make the payers far less likely to report it, and ultimately make it much harder to track

<comment><USER10> Well if it was illegal to not report it, they'd be putting themselves at a lot of risk. I can't see a university or corporation making a large payment like that illegally.

Also, it may not make the costs to them more. Remember the amount of ransom is based on what the ransomers think the ransomees are willing to pay. Today, the reason it was 1.4 million instead of 2.8 million, is that they didn't think UCSF would pay the latter amount. So if they knew UCSF would have to pay double the amount of the ransom, they'd have to only ask for half as much.

</comment></comment></comment><comment><USER12> I've worked in an institution for which I rewrote a public facing database to replace their old and clunky system. I had numerous emails with them to transition smoothly between the old and the new system, and the last step was for them to give me the latest snapshot of the MSSQL db that would allow me to import the last two weeks of data entry. Scripts were ready, so the down time would be 10 min which was totally acceptable for that tool. That's when I realize the backup was two weeks old, that they had already deleted the machine as soon as the transition started (against our plan), and that the automated backups at the scale of the university had not been working for months (they realized it because of this incident)...

</comment><comment><USER13> What kind of data is worth at least a million dollars and isn't properly backed up? Unbelievable. Some heads should roll .

<comment><USER14> It's a university, university IT is often ultra political and those who win the various battles make the rules, regardless of competence... and often without IT's sign off.

Some universities generally have done better about such things and are making progress... but generally there is a push and pull for IT dollars by unversity departments who want to spend that money as they wish for their given programs and then that money comes FROM IT ... who down the road are then tasked with the costs related to maintaining it and the terrible decisions a department made in the meantime... or in the worst of cases tasked with securing that data and / or making it work at all.

It's the same story for IT in the private sector to some extent, but it is way worse at many universities. Imagine if your HR director got to pick the PCs to support, networking equipment, software, backup methods (if any) all on their own and wanted zero input. That's kinda how it is at many universities.

I spent months helping a large university dig out from a program where they hooked up some super special microscopes worth millions of dollars ... to low grade network switches and storage. I got to try to explain why you can't put 10,000 pounds of data into a borderline consumer grade network ... in all of a couple milliseconds.

<comment><USER15> > _It 's a university, university IT is often ultra political_ […]

While you're not necessarily wrong, another option is budget.

If this is academic- / research-generated data, then it could have been paid for by grant money, and most of the cash goes to paying grad students and perhaps some computer equipment.

IT may have chargebacks (they have bills / cost centres to pay too after all), and no one wants to "waste" grant money. Often these things are 'shadow IT' run in an _ad hoc_ fashion by just throwing together some PCs.

If the group's expertise is in medicine / biology, how many members want to give up their day-light research hours to run the computer infrastructure?

I've spent about half my IT career in the academic sphere, and cheap solutions can be a fight to implement even if they solve the problem; even free (open source) ones can be an effort if they take time or slow down the workflow.

And these people aren't stupid: they 'know' they should do some of these things. But people 'know' they should get exercise, and how many folks do that?

</comment></comment></comment><comment><USER16> What I find crazy about this -- no guarantee that the ransom payment would unlock the machines -- did they send 1.14M in one go or was it a smaller amount for the first machine, then an additional fee for each additional machine?

Also would be interested to know -- was it Bitcoin or some other cryptocurrency that was used?

<comment><USER17> Apparently crypto-ransom people are actually pretty trustworthy about unlocking the machines. It doesn't really cost them anything (0% chance you were gonna send a 2nd payment if they didn't unlock), and their reputation as 'fair' is very important for securing future ransoms.

<comment><USER18> Someone's gotta be thinking about doing a ransomware operation that doesn't unlock the data in order to poison the well.

<comment><USER19> It's been done. There was one "ransomware" attack that just erased everything.

<comment><USER20> NotPetra

</comment></comment></comment></comment></comment><comment><USER21> > _The data that was encrypted is important to some of the academic work we > pursue as a university serving the public good. We therefore made the > difficult decision to pay some portion of the ransom, approximately $1.14 > million_

Once you've paid the Danegeld, you'll never get rid of the Dane.

</comment><comment><USER22> I recently listened to Mikko Hyppönen as the company I work for had invited him to give a talk. It was very interesting.

One thing I hadn't realized before was that ransomware criminals has developed their own backup strategy:

\- in addition to encrypting the data they will also exfiltrate it and threaten to publish it ob the internet for everyone to see.

That way it doesn't necessarily help an organization just because they have multiple layers of offsite read-only backups.

</comment><comment><USER23> How did they not have backups of important data?

<comment><USER24> there was mentioned a threat of publishing of some secret data, and that i think may be a reason why UCSF was willing to pay

[https://www.trialsitenews.com/hacking-group-launches- success...](https://www.trialsitenews.com/hacking-group-launches-successful- ransomware-attacks-against-ucsf-experts-think-covid-19-connection/)

<comment><USER25> This seems much more likely than the scenario where they simply didn't have any backups of the data.

</comment></comment></comment><comment><USER26> What a cheesy attack. It only cost them $1.14M to get their data back. I can not tell if the attack hit something inconsequential, the criminals are stupid, or they just do not understand finances for them to ask for such a tiny sum.

UCSF received $1.43B in grants and contracts during 2017-2018 [1]. Assuming they are generating an equivalent amount of value in knowledge evenly distributed over time, the loss of one day of research would be ~$3.9M. So, if the the last whole organization backup was one day ago and the attackers were only able to stop access to the last day of work since they did not think to corrupt the backups before they went out, then the ROI of paying off the ransom would be ~3.43. If they were able to affect the entire organization for an entire week, then the cost would be ~$27.3M with an ransom ROI of ~24.

So, assuming they did any damage of consequence, asking for ~$1.14M seems like robbing a person at gunpoint for their pocket lint.

[1] [https://www.ucsf.edu/news/2019/02/413396/ucsf-top-public- rec...](https://www.ucsf.edu/news/2019/02/413396/ucsf-top-public-recipient- nih-funds-pushing-unbroken-streak)

<comment><USER27> Doesn't matter, it's the perfect crime...

The encryption is done on the user's machine using their processing power, and there's virtually no downside for you (either they pay and you decrypt or they don't and you just dissapear).

Ransomware will be an issue for years to come.

<comment><USER26> I am confused by your response since it seems to agree with my post but you used words that indicate you think that they do not agree. Did you mean to reply to someone else?

I am saying that that the ransom is hilariously small compared to what they would probably be able to get. So, when they realize they can actually ask for a number that is not a rounding error they will probably increase the number/outcome of attacks. They are criminals robbing people at gunpoint and only asking for their pocket lint. Once they all realize they can ask for a wallet and get it, I think the number is going to go way up.

<comment><USER28> On the other hand, the more they ask for, the less likely they're going to get paid for it.

If they keep asking for $1M from organizations that will pay because that's pocket change, the more organizations they can attack.

If they start asking for too much, they'll see they won't pay as quickly, other people will start selling services to protect against you that seem more attractive, etc.

</comment></comment></comment></comment><comment><USER29> The article is inconsistent about the severity, which lowers its trustworthiness. It states that everything is under control, a top super leading security guru expert is on top of it, no important data was stolen or exposed, everything will be fine soon. And... oh yeah, BTW, we'll be paying an astronomic sum of money to the criminals to get our data back.

</comment><comment><USER30> Wonder if the cost of backups for the affected servers would have been less than the US$1.1M they paid? ;)

At a guess, they could probably have put in a some fairly high quality storage + backups for that price, and still had money left over for all expenses paid staff vacations. :)

</comment><comment><USER31> Is there a way to restrict encryption at a hardware level? The conditions where you would like to voluntarily encrypt data are usually quite rarefied. Allowing any sort of encryption activity on your system seems like a hazard these days.

<comment><USER30> Storage systems will just see a lot of data being changed.

You _could_ have some sort of alert in place, but if the malware doesn't write fast enough to trigger it, you'd still miss the problem.

Generally, the approach places take is having backups (eg to tape, off site, etc), and/or having storage that makes a snapshot every few hours and retains them for days/weeks/months.

Snapshotx are generally very low cost and easy these days, as it's just a pointer manipulation thing on (say) ZFS rather than a complete copy of the entire data set.

<comment><USER31> Backups are the default solution. But my understanding of this UCSF case is that their system was compromised and then ransomwared. In this situation, the attacker could interfere with your backup system for several weeks or even spoil existing backups.

It would still be nice to restrict encryption on a system that you control. I suspect, but don't know, that encryption has a particular pattern of memory and CPU activity that could be recognised. Or if there are a few commonly used libraries you could do it that way, although an attacker could roll their own encryption.

</comment></comment></comment><comment><USER32> To understand why they didn't back up: a) they are academics, which means funding is lacking and b) it's in the field of medicine, known for its lack of tech adoption.

</comment><comment><USER33> Here is Dutch University of Maastricht paying 0.2 million euro ransom last year in December.

Seems like business is blooming.

[https://www.reuters.com/article/us-cybercrime-netherlands- un...](https://www.reuters.com/article/us-cybercrime-netherlands- university/university-of-maastricht-says-it-paid-hackers-200000-euro-ransom- idUSKBN1ZZ2HH)

</comment><comment><USER34> Don't they have insurance for these things? A small college near me had an attack like this but paid via insurance.

<comment><USER35> Would you want the insurance policy to pay out though?

At some level of recklessness, insurance becomes void. I think a lack of infrastructure to restore a hacked server — with data valued at over $1M — is negligent enough to not be covered.

But maybe UCSF are on MegaCo's _YOLO_ tier of server insurance, which is so expensive and isolated it has no impact on my MegaCo pet insurance premiums?

<comment><USER18> I'll venture a guess that UCSF was nominally in compliance with some relevant bureaucratic regime (ISO 27001, SOC 2, etc), and that was good enough for a stodgy insurance company that's not very sophisticated about "cyber risk" (in case use of the term "cyber" isn't a giveaway...)

<comment><USER35> The CISO's top 5 "security tips" PR piece didn't mention off-system backups. Policy voided.

</comment></comment></comment></comment><comment><USER36> This just illustrates how incredibly important solid backup strategies can be. A big university should be able to figure out how to make WORM (write once read many) backups of their data. A million bucks buys a shitload of cloud storage or physical airgapped tapes...

<comment><USER37> The same weakness that resulted in lack of backups may be related to how the intruders were able to get onto the machines in the first place.

</comment></comment><comment><USER38> How incredibly negligent and incompetent of the ucsf IT staff to not have this data sufficiently backed up, not to mention protected. Does this university offer IT courses? If so their reputation has been seriously tarnished.

</comment><comment><USER31> I have to assume things were backed up, and the attackers were deep enough in the system to find or delete the backups.

Anyway, I wonder how this payment was made...

</comment><comment><USER39> I'm surprised that paying the ransom is a thing.

This is a very selfish thing to do, as you encourage the authors of such attacks.

</comment><comment><USER40> Ouch. No backup?

<comment><USER41> It's pretty obvious that the answer is 'no backup'...

<comment><USER42> It's not that obvious. It could be assurance that the data would be deleted and not sold/shared.

<comment><USER41> > We therefore made the difficult decision to pay some portion of the ransom, > approximately $1.14 million, to the individuals behind the malware attack > _in exchange for a tool to unlock the encrypted data_ and the return of the > data they obtained.

I assume you read that though before you replied, right?

<comment><USER28> > and the return of the data they obtained

<comment><USER43> … as if you can't "return" the data and keep a copy at the same time …

<comment><USER28> Might require 'best effort' to keep data private.

</comment></comment></comment></comment></comment></comment></comment><comment><USER44> As a reminder, in 2017 UCSF offshored all of its IT staff to HCL Technologies and forced their then-employees to train their replacements before laying them off.

They brought the replacements into the Bay Area on H1B temporarily while they were trained by their soon-to-be-laid-off counterparts and then sent back overseas to continue their roles once training was complete.

[https://sanfrancisco.cbslocal.com/2017/02/28/ucsf-tech- worke...](https://sanfrancisco.cbslocal.com/2017/02/28/ucsf-tech-workers-have- last-day-on-job-after-outsourcing/)

<comment><USER45> How the heck did they qualify for H1Bs when they were replacing already employed Americans? Not only did the H1Bs unemploy citizens, we didn't even get the long term benefits of trained workers living and paying taxes in the States.

<comment><USER24> using H1B for 4 months stint is very strange. It is too valuable a visa slot (significantly oversubscribed lottery usually, at least in the recent years) to be wasted that way. Usually it is done using something like B1 for such a short trips, especially if it is training, etc. I wonder whether the journalists and others did mistake one visa for another, especially given that they naturally wouldn't be privy to such internal details of a 3rd party company like the HCL in this case.

<comment><USER44> I looked a little more and found this subsequent article talking about it:

[https://www.latimes.com/business/hiltzik/la-fi-hiltzik-uc- vi...](https://www.latimes.com/business/hiltzik/la-fi-hiltzik-uc- visas-20170108-story.html)</comment></comment></comment></comment>


Ask HN: How can I lay the foundations of a successful career? - <AUTHOR>

I'm turning 15. I've started getting into programming four years and a half ago. Computers interested me, so I started learning programming. At first I was only toying with BASIC and C; but over time I've started learning more. I've explored Ruby, Python, and then dived into the deeper workings of computers. I've read Code Complete 2, a few tens of other programming books about Ruby, Node.js, C, C++, software development in general, and hundreds of blog posts, Hacker News threads and StackOverflow questions. Now I'm learning Rust because its approach to memory management looks promising. I'm truly passionate about software development.<p>What can I do now, that will benefit my career in a few years? What should I do, learn or explore to become a programmer in the real sense of the word? <comment><USER2> Thinking about a career defined as sequence of well paid jobs you can already start building your portfolio keeping in mind what potential employers are usually looking for - experience and activity. Nowadays that means a GitHub profile featuring both own projects and contribution to FOSS.

Besides that it will always be beneficial to build a network of contacts, by being curious, kind and helpful.

It's a very general advice, but important anyway IMO.</comment>


You Shouldn't Wake Up at 5AM - <AUTHOR> https://medium.com/1-one-infinity/you-shouldnt-wake-up-at-5am-12252618eef5 <comment><USER2> Sorry, I am not signing up just to read some friggin' blog post.</comment>


Savaged by Systemd: An Erotic Unix Encounter - <AUTHOR> https://www.amazon.com/Savaged-Systemd-Erotic-Unix-Encounter-ebook/dp/B075DYXZW1 <comment><USER2> If you've run out of BOFH stories to read, and want to take it to the next level...!</comment>


Ask HN: What are some good resources about CLI and shell design? - <AUTHOR> I'm looking for works that explain the design decisions behind shells like bash, ash, zsh, fish, etc. I've recently become curious about OS abstractions, the differences between Plan9 and Unix, off color shell implementations like Powershell, and so on. <comment><USER2> A point for further research on shells: bash was designed to be mostly compatible with the Bourne shell (hence: Bourne Again SHell). At that point one needs to research early Unix history.</comment>


Show HN: Routex – Modern Node Router - <AUTHOR> https://routex.js.org <comment><USER2> Very nice work! Takes the best features from other routers while staying minimal.</comment>


Lanyon, a Markdown web server in Go - <AUTHOR> https://github.com/mkaz/lanyon

<comment><USER2> Instead of using a custom webserver, I just use an apache markdown handler[0] that allows me to view any markdown files over the web. So I can just clone any doc repo and browse it instantly without firing up anything or having to compile it.

[0]: [https://github.com/sminnee/markdown- handler](https://github.com/sminnee/markdown-handler)

</comment><comment><USER3> > Lanyon was derived from my static site generator, Hastie. I grew tired of > the multiple steps for creating, generating and publishing. Plus, using a > static site generator has a duplicate source tree and generated tree, with > some assets in each. Lanyon simplifies this with one set of directories with > content and assets.

Isn't the point of a static site generator to generate a static site and deploy the output to a simple file server? I'm not quite sure if I understand the use-case of this project. Also, if you're looking for generating binaries across multiple OSes try [http://gobuild.io/](http://gobuild.io/)

PS: Thanks for this! The source code will surely be invaluable to a Go noob like me!

<comment><USER4> Also, most static site generators do include such a server to avoid having the second directory and rebuilding everything until you really want to release. Some generators also come with tasks to do "build&deploy" in one go.

Later in the README, the author suggests to put a reverse cache in front of the server, which seems to me far more elaborate than avoiding to put a bunch of files on a server.

<comment><AUTHOR> Yep, I wanted to avoid building in a web server into the static site generator, since it complicates that product.

The cache server definitely adds complexity and more so than a static site. However the complexity is setup and done once on initial server setup. On- going, the multi-process of a site generator adds up. Granted its one small step which as you say most already have scripted tasks.

Answering the first comment, the use case was something to play with for my personal site which I wanted to share if others found useful.

<comment><USER5> I had a look at your website and you write about interesting topics. I'd like to keep track of that.

It appears, before the rebuild, you had a feed @ [http://mkaz.com/rss.xml](http://mkaz.com/rss.xml) — which is gone. I guess the Lanyon web server doesn't generate atom or RSS feeds out-of-the-box?

That'd be a pity, while a Web based on Markdown+Git+WebSocket (or something alike) still is a long shot…

</comment></comment></comment></comment><comment><USER6> I did something very similar last fall: a blog structure that you deploy as Markdown, the server compiles and serves HTML.

[https://github.com/aybabtme/brog](https://github.com/aybabtme/brog)

I wanted to play with fsnotify, so not only will it compile your Markdown, it will also watch the blog path and reload/recompile the Markdown + Templates when they change.

Thus you can start the server once, make it watch a folder and then simply rsync/push your changes in that folder to see the change live. The deployment of a blog looks like this:

[https://github.com/aybabtme/antoine.im](https://github.com/aybabtme/antoine.im)

It's surprisingly fast; I've been working on a load generation tool at work and I use my blog [1] to try it out. It can handle quite a bit of traffic on a little 5$ droplet[2]!

[1]: [http://www.antoine.im/](http://www.antoine.im/)

[2]: I do the load testing on the IP of the machine, since [1] is behind Cloudflare.

<comment><AUTHOR> Nice! I'll have to check it out and see the fsnotify stuff.

That's one thing, it currently does not recompile the templates if there is a change.

</comment></comment><comment><USER7> You should consider renaming. There's a popular theme for Jekyll with the same name[0].

[0]: [https://github.com/poole/lanyon](https://github.com/poole/lanyon)

<comment><USER8> It's an endemic problem in Go community. The language itself was named Go despite the fact that another language named Go already existed: [http://en.wikipedia.org/wiki/Go!_%28programming_language%29](http://en.wikipedia.org/wiki/Go!_%28programming_language%29)

<comment><USER4> There is also Go, Thoughtworks Continous Integration Platform.

[http://www.thoughtworks.com/products/go-continuous- delivery](http://www.thoughtworks.com/products/go-continuous-delivery)

(although it came later)

<comment><USER8> And also an ancient board game. Interesting that the author of Go! asked Go to change their name in one of the first bug reports, but they refused. Some people propose calling Go "Issue 9" to avoid confusion. It's probably more Google-able too.

[https://code.google.com/p/go/issues/detail?id=9](https://code.google.com/p/go/issues/detail?id=9)</comment></comment></comment></comment>


ArkScript HTTP module is ready to be used (both server and client) - <AUTHOR> https://github.com/ArkScript-lang <comment><AUTHOR> After a lot of delay, it's here and we plan to use this module to develop small REST API, websites and maybe even our future package manager!

It can handle servers with get, post, put, delete routes, with functions to treat the received data (may it be route parameter or query body), and on the client side it handles proxy, basic authentification (login password or token), timeouts, headers, parameters (for application/x-www-form-urlencoded / writing user=hey&pass=nope more easily) and much more.</comment>


OpenBSD 5.6: What will be there - <AUTHOR> http://www.openbsd.org/56.html <comment><USER2> I used to use OpenBSD extensively in my job because of the awesomeness of PF but later moved on to big iron F5 and Cisco gear. In this new age of NSA wiretaps and cloud based services built around advertising and tracking however, OpenBSD feels more relevant than ever. I'd like to give it a shot as a desktop again.

So, who makes a modern laptop with good OpenBSD hardware compatability?

<comment><USER3> Lenovo X201 works well. Not exactly modern but a nice machine and more than adequate.

<comment><USER4> _Caveat laptopor._ I installed OpenBSD on my X201 just to give it a shot, and the battery life is _atrocious_.

<comment><USER5> [http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD- current/man8/...](http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD- current/man8/amd64/apm.8?query=apm&sec=8)

This may help. Using `apm -C` or `apm -A`

<comment><USER3> This.

People mustn't expect everything to ever work straight out of the box on anything. Much like you have to install the Lenovo PM driver on windows, you have to config apm on OpenBSD.

This is also well known.

Quick howto which covers the basics: [http://geekyschmidt.com/2011/03/27/openbsd-laptop-mini- howto](http://geekyschmidt.com/2011/03/27/openbsd-laptop-mini-howto)

<comment><USER6> They certainly can expect that, remember how it was before when nothing worked out of the box?

<comment><USER3> Yes. Even worse than that, I remember when the box contained a pile of bits and you had to sift through piles of manuals to assemble it all first.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Can anyone speak to SSD in OpenBSD? My understanding is that trim support is not supported in OpenBSD ([http://daemonforums.org/showthread.php?p=51377](http://daemonforums.org/showthread.php?p=51377)). That makes me a little worried about the potential to wear out an SSD drive in a workstation. The thread I linked discusses reducing some writes by using softdeps and the like, is that enough to make this a non-issue?

<comment><USER8> In general I wouldn't trust random forums for information about OpenBSD. People tend to repeat stuff long after its true. Send a message to misc@ or firstname.lastname@example.com and you'll hear directly from the devs.

Just make sure your partitions are 4k aligned to minimized write amplification. Many openbsd devs use SSDs. I've used one with openbsd for years without problems. Honestly it's a requirement given the shortcomings of ffs.

<comment><USER7> I've been away from OpenBSD for a while, and was just googling to try to get a starting basis. Thank you for pointing me to the 4k alignment issue. This thread ([http://openbsd.7691.n7.nabble.com/SSD-disk-alignment- td75046...](http://openbsd.7691.n7.nabble.com/SSD-disk-alignment- td75046.html)) seems to suggest that OpenBSD will try to align to 4k boundaries by default. Is that correct?

</comment></comment></comment><comment><USER9> I can understand not supporting tape installation (although aren't tapes still used in large, serious, high-power businesses as backup media?), but why remove FTP? Granted, it's objectively a horrible protocol, but is the FTP client code more likely to be an attack surface than the HTTP client code? If you're after security, isn't it more secure to remove _all_ network installation and force people to use only physical media which they obtained from a secure and trusted source?

[http://mywiki.wooledge.org/FtpMustDie](http://mywiki.wooledge.org/FtpMustDie)

<comment><USER10> That surprised me, too, because in 2013 I was installing from FTP. But mostly from habit.

I'm hoping it's because they are going to be using HTTPS with pinned certs to ensure you are downloading from a proper mirror. But that's hope, not actual knowledge.

<comment><USER9> > HTTPS with pinned certs

Is there an FTP equivalent of this?

<comment><USER11> There's FTP/S (and RFC-4217, and _not_ SFTP), which uses an SSL session negotiated inside of an FTP session. I don't know if there's a client/server combo that supports pinning, but this much at least exists.

Frankly, if I was looking to implement this, I'd start with SFTP/SCP. FTP/S is, at best, a rarely implemented kludge.

</comment></comment></comment></comment><comment><USER12> "Major internal refactoring to begin to make part of OpenSSH usable as a library. So far the wire parsing, key handling and KRL code has been refactored. Please note that we do not consider the API stable yet, nor do we offer the library in separable form."

This is intriguing. I would certainly like to know more about what is happening with this.

</comment><comment><USER13> Should information like this be provided over an insecure HTTP connection?

        signify(1) pubkeys for this release:
        base: RWR0EANmo9nqhpPbPUZDIBcRtrVcRwQxZ8UKGWY8Ui4RHi229KFL84wV
        fw: RWT4e3jpYgSeLYs62aDsUkcvHR7+so5S/Fz/++B859j61rfNVcQTRxMw
        pkg: RWSPEf7Vpp2j0PTDG+eLs5L700nlqBFzEcSmHuv3ypVUEOYwso+UucXb

<comment><USER14> Public keys are intended to be public. So long as you're not transmitting them over the same connection as the one you're using them in, you're golden.

<comment><USER15> The point of HTTPS is not to hide things, it's to prevent tampering... Which seems relevant when transmitting checksums.

<comment><USER14> That problem can be solved by retrieving the key out of band. If you're that worried about it, use a VPN to verify that the key you're seeing is the right key. That will vastly increase the difficulty of pulling off a successful attack. They'd have to MitM both connections, as well as the connection you're using to download the software, in order to compromise it.

</comment></comment></comment></comment><comment><USER16> Why submit this now? The fact that the top item is "..." wasn't a hint it's not done?

</comment><comment><USER17> Fascinating that they removed the agp driver.

</comment><comment><USER18> "IPv6 is now turned off on new interfaces by default."

I have had to remove the IPv6 option from my kernels because enabling IPv6 by default (which to me seems like a "policy" decision) has become so pervasive. Nice to see this change; here's hoping other OS's follow suit.

</comment><comment><USER19> _MS-CHAPv1 (RFC2433) support has been removed from pppd(8)._

This is sensible but means I can't use OpenBSD to connect to one of my client's VPNs. Unless there's another way?

<comment><USER20> Untried, but you may be able to just recompile pppd with different options; the diff seems small.

[http://cvsweb.openbsd.org/cgi- bin/cvsweb/src/usr.sbin/pppd/M...](http://cvsweb.openbsd.org/cgi- bin/cvsweb/src/usr.sbin/pppd/Makefile.diff?r1=1.17&r2=1.18)

Worst case scenario you'd have to restore some bits of old source (chap_ms.c and maybe the necessary md4 routines).

</comment></comment><comment> enjoy-your-stay Does anybody know why they are dropping support for kerberos?

I didn't even know there was support for Kerberos in OpenSSl, but it's also under the LibreSSL bullet points as well.

<comment><USER21> Nobody uses it and it's a lot of code to audit.

      Log message:
      Remove SRP and Kerberos support from libssl. These are complex protocols
      all on their own and we can't effectively maintain them without using them,
      which we don't. If the need arises, the code can be resurrected.

Or in Theo's words:

      It is crap.  Eventually we recognize the risk is to high.

Another relevant commit message, with a fun quote:

      Log message:
      The complexity and quality of kerberosV and the fact that almost
      nobody is using it doesn't justify to have it in base - disable and
      remove it.  If the 2 two people who use it still want it, they can
      make a port or recompile OpenBSD on their own.

      There is a quote in theo.c from August 2010: "basically, dung beetles
      fucking.  that's what kerberosV + openssl is like".

      Discussed with many.  Tests by henning@ reyk@ and others.
      ok deraadt@ henning@

I recommend you take a look at the whole message, it'll give you a vague idea of how big the code base was. Keep in mind that this particular commit was followed by a lot of smaller commits removing remnants of kerberos that had kinda spread all over the system...

[http://marc.info/?l=openbsd- cvs&m=139816103911227&w=2](http://marc.info/?l=openbsd- cvs&m=139816103911227&w=2)

</comment></comment><comment><USER22> I wonder if I should wait for usb storage support on Octeon or if I should just buy a Soekris. It's for home, nothing big.

</comment><comment><USER23> >IPv6 is now turned off on new interfaces by default. Assigning an IPv6 address will enable IPv6 on an interface.

Why?

<comment><USER24> Off by default makes much sense given it is another vector to attack. If not needed then why be on and more likely to just use IPv4 over even touching IPv6.

<comment><USER25> Not just a vector of attack, it also causes performance and connectivity problems when misconfigured. As long as there is no critical mass for IPv6, it's not worth the headache. I know that if everyone had that attitude, IPv6 will never get critical mass, and that is exactly what I'm rooting for. I don't care for toasters with IP addresses.

<comment><USER26> Well I noticed today that some random hotel in Germany I was thinking of staying at was on ipv6, and it is way more popular than IE6... People want connected devices, in way more numbers than there are ipv4 addresses, and end to end connectivity is the internet.

<comment><USER25> I'd say putting mobile devices behind carrier-grade NAT goes a long way.

> end to end connectivity is the internet.

It was definitely the original idea of the internet, but I'd say it no longer is the reality. People want to access Google and Facebook. The vast majority of users don't need or want their device to be directly reachable from the internet but communicate through cloud services.

<comment><USER20> On the contrary, the statement seems correct.

End to end connectivity is the Internet.... and by contrast, privately addressed networks are not on the Internet but must reach it via gateways.

Reaching one another via centralized services rather than distributed federation is a problem, not a solution, in communications protocol design. See also: Everyone Hates Facebook.

<comment><USER25> You are stating an opinion/ideal as fact. If you'd look at actual data, you'd see that the vast majority of internet use by consumers is client to server, not peer to peer traffic (e.g., youtube vs. bittorrent), which means there is no need to be "on the internet" for most people. Distributed federation is great and it does not require end-to-end connectivity for everyone.

> See also: Everyone Hates Facebook.

I don't know in what kind of bubble you are living but 1.3 billion people are on Facebook; whether it's cool to hate it is not germane to the topic at hand.

<comment> vertex-four I'll point out that much of the reason for most traffic on the Internet being client-server is that most users are behind home routers which make P2P traffic difficult or impossible, slowing innovation dramatically. IPv6 could solve this by giving every computer their own IP address on the actual Internet. Sticking with IPv4 continues to slow innovation.

<comment><USER25> I don't think the client-server model is popular because people are behind home routers, but because it reflects the inherent asymmetry of producers and consumers. People being behind home routers is not a cause of that, but a state of affairs that is not-noticed by or tolerable for most because of this asymmetry. This asymmetry is not caused by any technical limitation; even on Wikipedia, which is probably the prototypical crowdsourced site, editors are vastly outnumbered by readers.

I don't disagree with the ideal of everyone being able to serve their own content directly to the internet, I just don't think it reflects reality, specifically the abilities and inclinations of most people. I'm curious how people come to hold on to such beliefs when they are so incongruous with actual human behavior.

<comment> vertex-four > People being behind home routers is not a cause of that, but a state of > affairs that is not-noticed by or tolerable for most because of this > asymmetry.

I would say that a great many things are not noticed by or are tolerated by the majority, and it's only when they're presented with a better solution do they notice.

Even client-server _business models_ can benefit from peer-to-peer communications. The most obvious is media providers using their clients' connections to avoid having to maintain as large a CDN, and to cut some costs that way. If someone's listened or watched something near you, you can download from them instead.

And then there's all sorts of systems which really could be truly peer-to- peer, from social networking to a replacement for ebay.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Does anyone know off the top of their head how OpenBSD performs on a Samsung 900X?

</comment><comment><USER28> Love the release song for this one.

</comment><comment><USER29> Everything 68k is gone?

<comment><USER19> Where does it say that?

Edit: If you mean mac68k then yes, but that platform was dropped after the 5.1 release. [http://www.openbsd.org/mac68k.html](http://www.openbsd.org/mac68k.html)

</comment></comment><comment><USER30> Order a CD rom? Talk about out of touch, ouch.

<comment><USER31> I think for companies that still do this, they acknowledge that the impetus for buying a CD is more for collection/novelty purpose than actual usefulness. My question is whether there are any more effective ways of generating some kind of profit that actually involves giving something extra to the user, whether physically or digitally.</comment></comment>