Snowden on FBI's Clinton Email Investigation - <AUTHOR> https://twitter.com/snowden/status/738014840543797249 <comment><USER2> The biggest difference between Snowden and Hillary is that Snowden did what he thought was right, owned up his actions and suffered the consequences. He lost everything just so Americans could know that their government was spying them. He lived the American spirit.

Hilary Clinton denied first, lied next and then claimed ignorance. Pretty much like her husband and the worst part is the Law enforcement accepted her "ignorance of law" argument.

FBI director's conduct is despicable and reduces average citizen's faith in law and order. It shows that Hillary is either too powerful or FBI is compromised.

<comment><USER3> It's really not conceivable to you that, given the way the law is written, her actions are not clearly illegal, while Snowden's were? The laws in question are written around intent, and Snowden's intent was clearly different than Clinton's.

<comment><USER4> I'm citing section (f) of the law:

"Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer— Shall be fined under this title or imprisoned not more than ten years, or both."

[https://www.law.cornell.edu/uscode/text/18/793](https://www.law.cornell.edu/uscode/text/18/793)

Gross negligence is sufficient, intent is not required.

<comment><USER5> From discussion about this outcome: "Extreme carelessness doesn't necessarily translate into gross negligence," said Laurie Levenson, a professor of law at Loyola Law School in Los Angeles and former federal prosecutor. [http://www.huffingtonpost.com/entry/hillary-clinton-email- sc...](http://www.huffingtonpost.com/entry/hillary-clinton-email- scandal_us_577d08f8e4b09b4c43c1a785)

<comment><USER2> Sure, poop is not same as shit as per the same lawyer.

</comment></comment></comment></comment></comment><comment><USER4> FBI director Comey said: "Although we did not find clear evidence that Sec. Clinton or her colleagues intended to violate laws governing the handling of classified information, there is evidence that they were extremely careless."

What I find interesting about that is that the law states that intent to violate the law is not required, gross negligence is sufficient.

Here the FBI director states himself that Sec. Clinton was extremely careless yet he doesn't recommend prosecution.

The law (section f): [https://www.law.cornell.edu/uscode/text/18/793](https://www.law.cornell.edu/uscode/text/18/793)

<comment><USER3> Gross negligence and extreme carelessness are not the same. Gross negligence is a conscious and voluntary disregard of the need to use reasonable care. Clinton clearly understood the need for reasonable care as she took some security measures and asked people not to email her confidential materials. She merely did a poor job executing on the knowledge that care was needed, which in this case is not actually illegal (especially when grave harms did not occur, which is an additional legal factor).

The laws are written around consent because the goal of the law is to enable punishment of people who intend to harm the US government. Note that Comey said that it's the individual's responsibility to know when material is confidential, even if that is not marked. Yet even information that is widely reported on in the media can still be considered confidential. The law is written to protect those who take "careless" or "negligent" actions in light of the difficulty of the task of maintaining confidentiality during the kind of extensive communications required to execute the business of government.

<comment><USER4> I'm not convinced by this, especially when I see emails from Sec. Clinton like these:

[https://sli.mg/gHT80S](https://sli.mg/gHT80S)

Someone had issues sending her a secure fax and she replied that he should send it nonpaper and unsecure and to make it even worse - remove the identifying header (classified, secret, top secret and so on)

This is intent in my view. Not to harm the US, but to ignore the law because it's more convenient to her.

<comment><USER3> That's not clear at all -- there's no evidence that information was classified in the first place, but moreover a request to convert to "nonpaper" refers to sending a written summary or briefing. Jake Sullivan is no fool, he's a law professor at Yale. It is equally reasonable to assume that the request to send nonsecure includes an implicit request to not include confidential materials in the "nonpaper" version. Rational and intelligent actors could be assumed to act in a legal way based on this legal request.

</comment></comment></comment></comment><comment><USER6> Granted there is a difference between publicly releasing > 1 million secret documents, but he makes a solid point.

<comment><USER7> The only difference in actions that I see is intent and exposure of public information:

Snowden attempted to whistle-blow through reputable non-government actors (Reporters living in a very public spotlight) for the benefit of the people. Snowden's actions were driven by the belief of being a true patriot.

Hillary meanwhile willingly bypassed operation security for personal convince, benefit, and quite probably as a means of evading oversight and data retention/discovery measures. The lapse in security cannot be estimated as their practices were so poor that any measurement is not possible; it is very likely that TIMELY, SENSITIVE, information made it in to the hands of foreign powers thoughtful enough to have even 'script kiddies' attempt to breach a very publicly known server.

<comment><USER8> Does anyone have a theory of why she did it? I mean, I can imagine using Gmail instead of corporate email if the latter doesn't really work and you can't do anything about it - definitely not the case here though. This prompts one to consider a more substantial motive than "getting a working email server" \- perhaps hiding something from someone else working for the government - but to add up, it has to be worth the risk, and it has to be the least risky way of doing it.

So why did she do it? Or rather, what could plausibly be the reason?

<comment><USER9> _So why did she do it? Or rather, what could plausibly be the reason?_

Why would you rule out plain ol' laziness and poor judgement?

Remember, the Clinton family already had the private email server in question, and Hillary's Blackberry was set up to use it:

[https://en.wikipedia.org/wiki/Hillary_Clinton_email_controve...](https://en.wikipedia.org/wiki/Hillary_Clinton_email_controversy)

Odds are good she just didn't want to be inconvenienced and didn't recognize the ramifications of that decision.

Edit:

The cited article goes into more detail:

[http://lawnewz.com/high-profile/we-now-know-more-about- why-c...](http://lawnewz.com/high-profile/we-now-know-more-about-why-clinton- set-up-private-server-and-its-sketchyy/)

 _Here's the results of our meeting yesterday… as I had been speculating, the issue here is one of personal comfort … S [Secretary Clinton] does not use a personal computer so our view of someone wedded to their email (why doesn't she use her desktop when in SCIF?) doesn't fit this scenario … during the campaign she was urged to keep in contact with thousands via a BB … once she got the hang of it she was hooked … now everyday [sic], she feels hamstrung because she has to lock her BB up … she does go out several times a day to an office they have crafted for her outside the SCIF and plays email catch up … Cheryl Mills and others who are dedicated BB addicts are frustrated because they too are not near their desktop very often during the working day_

So there you have it. Basic laziness combined with stupidity and, I think, a pretty hefty dose of hubris.

<comment><USER10> The Hanlon Dodge!

> By shifting blame from a locus where it would be attributed to malice, to > one where it can plausibly be attributed to incompetence, the severity of > penalties incurred is lowered.

[http://www.ribbonfarm.com/2011/10/14/the-gervais- principle-v...](http://www.ribbonfarm.com/2011/10/14/the-gervais-principle-v- heads-i-win-tails-you-lose/)

<comment><USER9> Suggestion: start going to murder trials. Every time someone gets sentenced to manslaughter instead of murder, shout "the Hanlon Dodge!".

I'm sure the judge will appreciate your insight into jurisprudence.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Edit: Title edited to reflect the fact that this is a month old. Still relevant IMHO, but I didn't notice the date before posting.

</comment><comment><USER11> And just like _that_ we go from #1 to off the front page.

<comment><USER12> This pattern of HRC Email articles falling way side on HN, is alarming.

<comment><USER13> It's not alarming. HN readers don't like HN being filled with the day's political drama and the kind of comments that follow it -- enough that the algorithm holds those stories to a higher bar, and the users tend to flag them. This is a link to a month old tweet, not something especially thought provoking.

<comment><USER14> I think your theory is right. If we wanted drama, that's every corporate media outlet right there waiting for us. If we want insight, better chance of it being on places like Hacker News with filtering out the rest. I comment a little on these threads but mostly ignore them.

Also, thanks for HN replies if I haven't said so. Kept me from missing two things just today. :) Btw, are you same guy behind Cyclone or different Dan Grossman?

<comment><USER13> Not me :)

<comment><USER14> Oh well. Good comments and great comment reply feature earns you your own respect. :)

</comment></comment></comment></comment></comment></comment><comment><USER2> The government wants to have a secret list of "potential terrorist" and then wants to deny them right to own guns and ability to fly. Yet, a lady who has clearly put national security at risk can run for president and commander in chief of American forces. Tells a lot about how government operates more like a Mafia. You cant touch Mafia bosses no matter what they do.

<comment><USER3> It's not actually clear to me that she put national security at risk. During the recent U.S. State Department hack, an unclassified email system was compromised. Most of the emails Clinton sent (99.6%) were not classified at the time, and could have been sent on that email system. Even most of those that were classified were not marked as such, and still could have been sent on the unclassified system in error (which would not have been illegal either, assuming there was no intent).

For me, a better argument has to do with minimizing exposure to freedom of information.

<comment><USER2> > It's not actually clear to me that she put national security at risk

What contained in those emails is irrelevant. The very fact that she deliberately to serve own personal purposes violated all security protocols. That itself shows that the lady is unfit to be trusted with national security.

Just the way police would arrest any guy with DUI whether or not he threatened someone else's safety. In California you would be arrested immediately if you are carrying your legal firearm in a car and if the case + barrel is not under a proper lock. Your intent, ignorance or whether you really put someone at risk would not matter.

</comment></comment></comment><comment><USER15> (1 Jun 2016) This isn't news.

<comment><USER16> It's relevant in light of recent developments.</comment></comment>


Show HN: Treenga – simple task management for remote teams - <AUTHOR> https://treenga.com/ <comment><AUTHOR> I wrote thousands of tasks over the years, and all of them were written for remote team members. And for most of them I needed a big canvas to explain everything, utilizing a combination of written paragraphs and images to make my vision clear. I don't like to have to attach my images at the end of a document, but rather to integrate them in order to better explain the text. But tools like Trello and Asana didn't satisfy me because the text field is small and images attached at the end and not within a description.

I want my images to be placed right after the text they relate to, because I want my readers to be able to review all visuals before moving on to the next paragraph. This is why I favor text representation such as Medium, where images are first-class citizens used to enhance descriptions, and are not treated like an afterthought or text appendix. When creating task descriptions, I frequently needed to include screenshots from the live website or from a prototyping tool to better explain what needed to be done, so I used OneNote (note-taking tool from Microsoft) or good old-fashioned emails (add text, images, files — everything kept within a single message). OneNote, despite its simplicity, didn't work all that reliably for document sharing, so once I discovered Dropbox's Paper two years ago, I instantly switched to it.

Eventually, I realised that what I wanted was to use a mix of Paper and Github, so a "single task at a time" interface with rich task descriptions, along with category/people assignment features. So we created Treenga. Tasks are grouped by categories (tags), which can be hierarchical and represent your project structure, or be designed around task attributes such as milestones or urgency.

Implementations details: about 1 year of development time (with multiple core- feature modifications), PHP (Laravel), Vue.js (Element component library).

Try it, we create a sample team upon registration, so you can easily understand how it behaves.</comment>


Don't fear Facebook's emotion manipulation experiment - <AUTHOR> http://www.newscientist.com/article/dn25815-dont-fear-facebooks-emotion-manipulation-experiment.html#.U7Ly55SSxdI

<comment><USER2> > You can certainly question whether it is fair to expect users signing up for > a service like Facebook's to read and understand user agreements containing > dozens of pages of dense legalese, and which includes a clause consenting to > the kind of research under discussion.

This apparently needs a correction: Facebook flat-out did not obtain anything resembling informed consent from their subjects. They added the 'research' blurb _four months_ after they experimented on their users.[1]

No amount of reading the ToS would've informed you that you were a research subject.

The thing everyone seems to be missing is a discussion about what Facebook believes it can do within the parameters of its ToS. I'd love to hear someone from Facebook explain what they believe they _can_ do, ethically and legally, and what would be crossing a bright red line.

[1] [http://www.forbes.com/sites/kashmirhill/2014/06/30/facebook-...](http://www.forbes.com/sites/kashmirhill/2014/06/30/facebook- only-got-permission-to-do-research-on-users-after-emotion-manipulation-study/)</comment>


Falling Valuations: Poison for Venture Capital - <AUTHOR> http://bits.blogs.nytimes.com/2009/08/07/falling-valuations-poison-for-the-venture-capital-industry/?ref=technology <comment><USER2> In today's down environment, cash is king and any startup that has short-term capital intensive needs, and no way to meet them apart from VC funding, is going to get lousy terms - the first of which is a much lower valuation relative to what it would have been a couple of years ago. That means major dilution at best, _assuming_ such a startup can get funding at all.

Even so, bootstrap startups are proliferating in Silicon Valley (and I assume elsewhere) and will be in line to approach VCs down the road if they deem it desirable, but on much better terms and with much higher valuations. For founders in today's environment, patience, perseverance, and frugality are the key. Opportunities abound but VCs are no longer the sole or even primary entry point toward realizing them.</comment>


A meteor that came from another solar system may have hit Earth in 2014 - <AUTHOR> https://www.technologyreview.com/the-download/613318/a-meteor-that-came-from-another-solar-system-may-have-hit-earth-in-2014/ <comment><USER2> Shouldn't they be calling it another _star_ system? Our sun's name is Sol, and whatever spins around it is in the Solar System. The point of the article is that these meteors don't originate in the Solar System.</comment>


Why Has Seed Investing Declined? And What Does This Mean for the Future? - <AUTHOR> https://bothsidesofthetable.com/why-has-seed-investing-declined-and-what-does-this-mean-for-the-future-6a9572357130 <comment><USER2> "Traditional VCs have raised larger funds that allow them to pay slightly higher prices and still hit preferred ownership sizes."

Corollary: funds will offer large secondaries to small firms - buying back founders and early investors - in order to deploy enough money to make the investment metrics make sense for their large fund.

</comment><comment><USER3> Mark Suster writes great data-driven commentaries on VC.</comment>


HN: New flag feature - <AUTHOR> Posts now appear with a flag link.  Anyone care to explain its proper use? <comment><USER2> You guys are so fast I didn't have time to write anything about it. The purpose is to let users over a certain karma threshold flag spam and troll submissions.

It should only be used for spams and really egregious trolling, not for stuff that's merely vapid or mistaken or off-topic.

Please don't click on it just to try it out. Flags are really being recorded, so flagging something randomly could damage the reputation of the flagger and/or the submitter of the thing that got flagged.

<comment><USER3> Here's a random idea... Display a text box that requires a _reason_ for flagging the post or comment.

That would cut down on flagging for the sake of flagging.

<comment><USER4> Isn't that premature?

And if some really use it inappropriately then they could just lose their right to flag. No need to bother the vast majority who will use it when it's deserved.

<comment><USER3> Whether it's premature or not, I'm just putting the idea out there. The question is, what does that take away? If the item is truly flagworthy, then it shouldn't be any problem filling in a box.

The added benefit is that you have much less accidental flagging.

<comment><USER2> _The question is, what does that take away?_

Simplicity.

</comment></comment></comment></comment></comment><comment><USER5> I suspect it's a "report this post to the moderators" feature, although so far I've not really seen the need for it, so who knows.

EDIT: Ugh, it's already annoying me on the new/front pages, as the "<n> comments"/"discuss" links are harder to see and click now.

pg, would you mind swapping the "flag" and "discuss" links on story listing pages? Thanks!

EDIT2: same for the "parent" link on thread pages, I've had a couple near misses in the last 2 minutes.

<comment><USER6> It's funny... I hadn't realized the extent to which my subconscious was trained to scan down the right-hand side of the links, evaluating the "X comments" display and using it as a guide for what to click on.

When I hit the homepage I got this sudden feeling of _wrongness_ in my stomach, like vertigo. Only _then_ did I consciously see the new "flag" links.

So, yeah, I also vote to move the flag links to the left.

(This reminds me of Teresa Nielsen Hayden's stories about the superhumanly- talented copy editors who perceive typos as literally _jumping out of the page_ , or blinking, or who feel physical pain at the sight of misspelled words.)

<comment><USER7> I agree with this. At the moment the "flag" link, which you want to use very rarely, is more prominent than the "comments" link, which you want to use often. Maybe changing the colours to make "comments" dark and "flag" light might work as well.

</comment></comment></comment><comment><USER8> There should be a popup confirmation and the action should bring you back to where you were last, instead of the top of the page. Ideally, the row where the username where you clicked flag (starting from the point total and ending with the flag link) would turn yellow, and also keep you on that same page, like the voting buttons (which use ajax).

</comment><comment><USER6> I am _so_ tempted to just press it and see what happens. But I fear that I will end up banishing you to the netherworld.

<comment><USER7> I'm hoping somebody will start submitting some rubbish stories so I can try flagging them.

<comment><USER9> I flagged this post :-) (the post, not your comment)

edit1: I did this before pg explained what 'flag' is for. Now I feel bad.

edit2: oops... I am used to clicking on the last link 'parent'. Did it once by mistake on a comment.

<comment><USER10> i wish we could un-flag. some will be curious to what will happen if you click on it.

<comment><USER2> ok; here's the source, btw:

      (def flaglink (i user whence)
        (when (and user (> (karma user) flag-threshold*))
          (pr bar*)
          (w/rlink (do (if (mem user i!flags)
                           (pull user i!flags)
                           (push user i!flags))
                       (save-item i)
                       whence)
            (pr (if (mem user i!flags) "unflag" "flag")))))

</comment></comment></comment></comment></comment><comment><USER3> The flag link still shows for deleted comments

</comment><comment><USER11> heh...could we have a list of flagged posts, in the lists page?

<comment><USER12> You want to see all your spam trophies?

<comment><USER11> something like that..., but I was really thinking of something resembling the "Best of the Worst" of the last-man-standing reality genre (American Idol, Last Comic Standing, etc). It would be good fun to occasionally look at the list of flagged posts just like it's fun to occasionally poke fun at William Heng.

</comment></comment></comment><comment><USER13> I'm sure he's writing it up as we type...but I would assume this is a "downvote" compromise.

<comment><USER2> Actually it's not related to the downvoting problem. I added it because spam submissions have been increasing.

</comment></comment><comment><USER14> Having both a downvote and "flag" on comments seems a bit too much. Nobody seems to spam the comments, and trolls get downvoted.</comment>


Most Americans say climate change should be addressed now – CBS News poll - <AUTHOR> https://www.cbsnews.com/news/cbs-news-poll-most-americans-say-climate-change-should-be-addressed-now-2019-09-15/ <comment><USER2> Most americans also belived in angels last I checked.

[https://www.cbsnews.com/news/poll- nearly-8-in-10-americans-b...](https://www.cbsnews.com/news/poll- nearly-8-in-10-americans-believe-in-angels/)

Hmm, yup, more than climate change.

(/s the implication is that CBS is not trustworthy 'news', not that americans are dumb)

</comment><comment><USER3> Sometimes it doesn't matter what the Americans want. It matters what their president want.

I'm not into politics at all But it seems to me like Trump is doing a lot to ignore everything that is about global warming.</comment>


Changes in Brain Size during the Menstrual Cycle - <AUTHOR> http://www.plosone.org/article/info:doi/10.1371/journal.pone.0014655

<comment><USER2> If this is true, I wonder if the Feminism 101 manifesto will get revised.

EDIT: Feminism 101 asserts "that time of the month" has no alterations in behavior or thought other than threshold of feedback. That patience is lessened, so a woman doesn't think differently, she is more likely to speak her actual mind on something she would have otherwise just put up with.

Citation: [http://shakespearessister.blogspot.com/2010/01/feminism-101....](http://shakespearessister.blogspot.com/2010/01/feminism-101.html)</comment>


Air Force budget reveals how much SpaceX undercuts launch prices - <AUTHOR> https://arstechnica.com/science/2017/06/air-force-budget-reveals-how-much-spacex-undercuts-launch-prices/ <comment><USER2> The US lost a significant part of their launch capability and ULA was the only provider left. They were free to charge whatever they wanted, and it was in the national interest for them to stay in business, hence the subsidy.

Now spacex is starting to compete, costs will come down. Is something not going as expected?

<comment><USER3> They were the only one left because the two remaining competitors merged to form ... ULA.

ULA used all of their political connections to keep SpaceX out of the government launch as long as they could, to maintain their monopoly pricing.

<comment><USER4> But it was Congress that forced the creation of ULA. Both Boeing and Lockheed were planning to leave the launch business and leave the US with nothing (except the Shuttle). Launch is an ugly business, you have big fixed costs but very lumpy revenues since you get paid when the rocket leaves the ground (which can be delayed for years due to late payloads, political roadblocks etc), and Delta and Atlas weren't competitive in the commercial market so they couldn't smooth things out.

So Congress told them to form ULA and they would give them a readiness contract to make it worth it to them even if they weren't launching often. Basically, it was that or lose the heavy launch capability which would have been a huge national security problem.

Obviously, that changes with SpaceX around, but what hasn't changed is that if Congress pulls that contract, they'll just kill ULA and the Delta and Atlas will be gone. Lockheed and Boeing still don't really want to be in this business and there is nothing they can do to make Atlas price competitive with Falcon, since their customer won't let them change anything.

<comment><USER5> >Launch is an ugly business, you have big fixed costs but very lumpy revenues since you get paid when the rocket leaves the ground (which can be delayed for years due to late payloads, political roadblocks etc), and Delta and Atlas weren't competitive in the commercial market so they couldn't smooth things out.

Add to that the real money is in the satellites themselves. If you were a big company like Lockheed it made far more sense to stick to building sats and buying launch services from someone else.

>Obviously, that changes with SpaceX around, but what hasn't changed is that if Congress pulls that contract, they'll just kill ULA and the Delta and Atlas will be gone.

Congress will probably allow Delta to die, but they're not going to be 100% dependent on Falcon. All it takes is a failed launch and nothing goes up for six months while investigators figure out what happened.

<comment><USER6> I am not a rocket scientist... but it seems like a 6 month investigation delay would be comparable to the time it would take to procure and integrate the payload into a completely different rocket?

Also if the launch savings exceed the total payload costs, in a pinch couldn't they just roll the dice given falcon's success %?

(The last falcon investigation delay was only ~4 months)

<comment><USER5> The problem is a six month delay pushes everybody's launch back six months. So if you had an interplanetary probe scheduled for the next Mars launch window in April of 2018, a six month delay starting today would mean your probe doesn't get launched until the _next_ window in July of 2020 unless you have enough clout to bump other launches.

</comment></comment></comment></comment></comment></comment><comment><USER7> My read [which, knowing full well we're talking about the US government I'm still having a hard time believing] is that the SpaceX cost is 23% of the ULA cost. Meaning 77% less.

Do I misunderstand: "SpaceX won a contract to launch another GPS 3 satellite for $96.5 million. These represent "all-in, fully burdened costs" to the government, and so they seem to be roughly comparable to the $422 million "unit cost" in the Air Force budget for 2020."?

<comment><USER8> It's wrong.. but not because you misunderstood.. thats what the writer wants you to believe... because the writer is attempting to pump the numbers to make it sound more exciting.*

but the article that they linked to for the $83m figure says spacex undercut ULA by 40%.. which means ULA was going to charge under $140m for that same launch.

ULA didn't bid on the 96m launch.. so it's impossible to say what it would have charged... but it likely would have been around the same $140m, since it's for the same gps 3 sat.

[http://www.reuters.com/article/us-space-spacex-launch-ula- id...](http://www.reuters.com/article/us-space-spacex-launch-ula- idUSKCN0XP2T2)

* Yes, I think the writer is being dishonest. They have a link to an article that clearly says 40%.. then the writer discards that number, and finds other data that isn't directly comparable to write an article about it, and waives away the differences with "seems to be comparable to"

<comment><USER9> There's no dishonesty. The author makes it very clear that the GAO report prices in the billion dollar a year fixed subsidy ULA receives.

<comment><USER8> The article says the $422m is "maximum amount the Air Force believes it will need to pay, per launch".

Are you saying that the air force ALWAYS pays the maximum for every launch -- no matter the payload?

If not, then clearly the number includes much more than just a subsidy.

<comment><USER10> No, it means that this is the maximum that total_paid/launches could be. And includes fees that are paid independently of whether a launch happens.

</comment></comment></comment></comment></comment><comment><USER8> why did the article compare spacex's costs for one flight, to the maximum ULA may receive for a flight... these are not equivalent things. Is the spacex rocket used for that GPS sat equivalent to a delta heavy ($350m) or an atlas v ($100m)?

Edit: this is a better article than the one linked: [http://www.reuters.com/article/us-space-spacex-launch-ula- id...](http://www.reuters.com/article/us-space-spacex-launch-ula- idUSKCN0XP2T2)

it's the article for the gps sat, which clearly says Spacex undercut ULA by 40% on that contract -- so 83m vs 140m for ULA

That is a big difference, but much less than the 83m vs 422m in the article

<comment><USER11> Falcon 9 (the rocket used for the GPS launch) is comparable to the ~$100m Atlas.

The Falcon 9 (in 'expendable' mode) is roughly equivalent to an Atlas V in the 551 configuration (it's not an apples to apples comparison because the upper stage Atlas uses (Centaur) is _really_ capable).

In reusable mode, it's closer to a 511.

Delta IV Heavy is comparable to the (upcoming) Falcon Heavy (though again, due to the capabilities of Centaur, DIVH will be able to fly missions that FH cannot). It will be interesting to see just how big the price difference is there (I expect it to be pretty significant).

<comment><USER12> _Delta IV Heavy is comparable to the (upcoming) Falcon Heavy (though again, due to the capabilities of Centaur, DIVH will be able to fly missions that FH cannot)._

The Delta Cryogenic Second Stage is not a Centaur. Yes, it uses the same propellants and a related (though not identical) RL-10 engine. The tanks are very different, though, and those are arguably the most unique thing about Centaur: pressure-stabilised ("ballon") tanks made of stainless steel, plus a common bulkhead between fuel and oxidiser tanks make for a very good propellant mass fraction.

</comment></comment></comment><comment><USER13> I'd recommend watching the video of Elon Musk debate Michael Gass (of ULA) at a US Senate hearing. It's over an hour long, and really gets into the differences between the two programs.

Link to the part where Elon starts talking: [https://youtu.be/IWVZYKGTenE?t=1102](https://youtu.be/IWVZYKGTenE?t=1102)

</comment><comment><USER14> Why is Elon/SpaceX charging so much less for rockets?

Couldn't they make more profit, to reinvest in Mars plans, by charging something like 90% of competitors for near perpetuity?

<comment><USER15> Falcon 9 is a new rocket without a lot of statistics about mission success rate. They had a few failed launches in 2015 and 2016. This makes launching your payload on a Falcon 9 more risky and you have to pay a higher insurance premium, than if you were to launch on a Soyuz rocket (all large payloads are insured). If they can get more successful launches under their belt, it will lower their risk and make insurance premiums go down. Then they can up their prices.

</comment></comment><comment><USER16> What is a "non-mercerdi breach"(sp?)

Heard here: [https://youtu.be/IWVZYKGTenE?t=2876](https://youtu.be/IWVZYKGTenE?t=2876) (and earlier too)

Not sure of the spelling or the definition.

<comment><USER17> She said "Nunn-McCurdy breach"

cf [1]: <The Nunn–McCurdy Amendment> "requires notification to the United States Congress if the cost per unit goes more than 25% beyond what was originally estimated, and calls for the termination of programs with total cost growth greater than 50%, unless the Secretary of Defense submits a detailed explanation"

[1] [https://en.wikipedia.org/wiki/Nunn–McCurdy_Amendment](https://en.wikipedia.org/wiki/Nunn–McCurdy_Amendment)

<comment><USER16> Thanks!

</comment></comment></comment><comment><USER18> $422m per launch vs under $100m per launch.

Just imagine how many schools, bridges, cancer treatments, or who knows what else that money could be better spent on.

<comment><USER19> Just imagine what you could do if you didn't do those launches at all.

<comment><USER20> We could not have GPS, and still be trying to fly planes over other countries. I'm a fan of cost reduction, but it is more nuanced than this.

<comment><USER19> Sure, there is plenty of dual purpose stuff. Think of the Hubble as a Keyhole pointing the other way. But in general money spent on defense is spent in ways that make me wonder if we could not do something more useful with it. And a world with GPS could be more annoying than a world with say better education. And then you might end up launching those GPS satellites anyway, but from a different bucket and a little later.

Piggy-backing stuff onto the military budget that is dual use is a nice fig leaf but it does not reduce the component spent on the remainder: weapons of all sorts, kinds and shapes.

<comment><USER21> > _Think of the Hubble as a Keyhole pointing the other way._

I still remember one discussion on NRO where an user mentioned that it donated a space telescope to NASA [0], built around the same time as Hubble, that had better specs. And that's the spare one!

[0] - [https://en.wikipedia.org/wiki/2012_National_Reconnaissance_O...](https://en.wikipedia.org/wiki/2012_National_Reconnaissance_Office_space_telescope_donation_to_NASA)

<comment><USER22> That was fascinating! Thank you for sharing the link.</comment></comment></comment></comment></comment></comment>


Research into fusion went down a blind alley; a means of escape may be at hand - <AUTHOR> http://www.economist.com/news/science-and-technology/21676752-research-fusion-has-gone-down-blind-alley-means-escape-may-now-be <comment><USER2> The problem with Fusion has always been that R&D associated with it has no bearing on any first order weapons technology. Sure you might be able to put a reactor on an aircraft carrier, but studying powergeneration from fusion reactions does not yield higher yield!

<comment><USER3> >The problem with Fusion has always been that R&D associated with it has no bearing on any first order weapons technology.

actually i think it is quite opposite - the inertial confinement approaches have from the start been the most promising, and they are relatively easy to miniaturize - thus paving the way for the neutron weapons without fission primary. No first-rate power - who already has nuclear weapons and thus has no real need for new types of neutron weapons - is interested in second-grade players obtaining such weapons bypassing the need for fission primary, as all the hurdles related to fission primary is what provides for non-proliferation.

Thus all the government funded research has been only in non-miniaturizable (as seen decades back) Tokamak and laser confinement. Sandia Z-machine (great inertial confinement approach) could have been burning DT targets at the end of 199x, yet they started to do it only 15 years later (at least officially) - somebody definitely wasn't in a rush :) With tremendous progress in solid state lasers i kind of curious what fate (ie. government funding) is waiting for NIF as upgrading its warehouse size 3% efficient lasers to container size 20-50% efficient solid state would obviously be in order. Yet it doesn't seems it is going to happen - the last monthly NIF's status update was in May 2014 and officially it has stopped ignition experiments and back to material research (simulating plutonium compression in the nukes)

<comment><USER4> > _and they are relatively easy to miniaturize_

Wait, really? How?

<comment><USER3> while it is obviously a sarcasm, it suggests that there is need to point obvious difference between energy and power and its density. Inertial confinement schemas don't require large energy, they require huge power and power density though. I.e. a few joules in a femtosecond impulse concentrated in a few cubic millimeters volume. Reaching that power and density is just a pure engineering task, there is no hard physical limits preventing it as there are for example on the minimal size of tokamak.

</comment></comment></comment></comment><comment><USER5> I'm curious what HN thinks of that last line in the article, about solar.

"More likely, cheap photovoltaic and energy-storage technology will mean that much of humanity's energy comes from a different fusion reactor—one 150m kilometres away, called the sun."

5 billion years of evolution haven't given us solar powered animals that can run around. It seems like there are some significant hard limits on solar technology.

Energy storage technology actually makes nuclear much more practical... the big problem it faces is that it generates very consistent power, but power demand fluctuates by time of day.

<comment><USER6> > 5 billion years of evolution haven't given us solar powered animals that can > run around. It seems like there are some significant hard limits on solar > technology.

What do you think animals run on? Gasoline? Plants are like batteries, storing solar energy. Animals, including humans, charge up by consuming these plants. And for those who don't eat plants, they eat charge up by eating the animals who charge up on the plants.

<comment><USER7> Again, we can call oil 'solar powered' by that means. Of course 'solar powered' should mean 'directly powered by sunlight captured by the creature itself'. No animal can do this, because the light X capture efficiency is far too low.

<comment><USER6> Oil is considered a non-renewable resource. Plants however are renewable, so they are fundamentally different.

You can consider the solar->plant->animal cycle to effectively be similar to using solar panels. Using solar panels directly would be inefficient without batteries anyways, so the solar->plant->animal cycle is directly analogous to how we would use solar panels.

<comment><USER8> Quick google search is about 100 wH per square foot of surface area. I'm just estimating about 8 square feet of surface area (one sided) for a human. Assuming 12 hours a day at that rate you get about 9.6 KwH or ~8000 kcal. With perfect efficiency and a storage system inside the body (which we do have, but not for light energy) that's probably doable.

Obviously our tissue is much well less adapted to so many hours of sunlight compared to plants. Also even plants only absorb a relatively small part of the light spectrum (none of the green light). Also even plants required compounds from the earth and the air to actually harvest the energy to store so it's a pretty complicated process to do in an actively moving human.

<comment> gene-h It appears you are assuming 100% efficiency for conversion of solar energy. The maximum efficiency possible for solar cells is the carnot efficiency at 86%.

<comment><USER8> Yea, this was kind of giving an upper bound. Actually that's not very impressive given that people CAN burn more than 8000 calories in a single day.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Can anyone who knows about fusion comment on non-plasma containment methods for producing fusion reactions? In a plasma only a small minority of particles will have enough energy to produce fusion; this means the vast majority of collisions will just send your ions pinging out of the magnetic bottle they are in. This seems a futile, difficult way to get what you want. Surely there are strategies where only high-energy collisions are likely; what are they?

<comment><USER10> The theory of how collisions make you lose particles, like you describe, is known as "neoclassical" theory. It's actually quite well-understood[1], and is what Wendelstein 7X is optimized for.

So while collisions are a major concern in stellerators in this sense, they are less so in tokamaks, where turbulence is the main limiting factor.

[1] By those smarter than me, that is. It's incredibly complicated.

</comment></comment><comment><USER11> Although I think the fusion will eventually happen (and ITER will help), I wish it wouldn't.

I think having fusion is a danger for our civilization. People will use this energy for stupid things, like moving mountains; eventually, it will either heat up the planet or produce huge amount of toxic waste or use up all the water we will be able to find. It will be like with carbon fuels but order of magnitude worse.

I would much rather see our civilization to learn to live with the plentiful, yet on decent timescales sustainable, solar energy.

</comment><comment><USER12> Where, by using the subjunctive verb "may", they mean "is not".</comment>


Ask HN: Has anyone gotten to Y Combinator through here? - <AUTHOR>

Has anyone been recruited to YCombinator through news.ycombinator.com?  If not through YCombinator, how about via angels or incubators via this site? <comment><USER2> You might want to read up on:

<http://ycombinator.com/apply.html>

<comment><AUTHOR> Which part does it mention news.ycombinator.com?

<comment><USER3> <http://ycombinator.com/howtoapply.html>

6th paragraph.</comment></comment></comment>


Show HN: EDB – A framework to make and manage backups of your database - <AUTHOR> https://github.com/RoxasShadow/EDB <comment><AUTHOR> Maybe it can be useful to someone. I'm using it for months on some production servers to make and upload to Amazon S3 ciphered backups of the databases.</comment>


An Engine that Harnesses Sound Waves - <AUTHOR> http://www.technologyreview.com/energy/32267/?p1=A1&a=f <comment><AUTHOR> I had never heard of Sterling engines before, so I found this quite fascinating.

I have a question though to whomever may offer an explanation. Towards the bottom of page 1, the article explains that "[w]hen pressurized helium on the top side of the metal plate is heated, sound waves traveling through the gas are amplified, causing the plate to vibrate...."

When the pressurized He is _heated_ it causes the sound to be _amplified_? But heating the He should cause the density to _decrease_ , of course, and therefore _reduce_ the power of the sound waves propagating through the He, no?

I'm not aware of any relationship between frequency and amplitude, just V=(freq)(wavelength). What's going on? The only thing I can think of is that perhaps there's some sort of resonance going on in the chamber? As the pressure drops, the speed of sound should drop. But this shouldn't necessarily affect the frequency... so I'm totally confused. Maybe there's a resonance effect as the waves propagate slower and slower and interfere with one another? I'm totally lost. I just don't see how _decreasing_ pressure (by increasing temperature) _increases_ amplitude.

It's been quite a few years since studying E&M as an undergrad, so I'm a bit rusty and just genuinely curious what I'm missing here.

Thanks!</comment>


The Self-Destruct File - <AUTHOR> http://blog.obiefernandez.com/content/2010/05/the-selfdestruct-file.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+obie+%28Obie+Fernandez%29&utm_content=Google+Reader <comment><USER2> I don't use full disk encryption, but I do have an encrypted partition that has my .ssh, .pgp, password reminder file, and sensitive customer information. Each time I boot up, I mount this partition. I have soft links in my home directory to .ssh, etc. on this partition.

</comment><comment><USER3> OS X has the "FileVault" system which encrypts the contents of your home folder. This should include things like SSH keys in ~/.ssh, and so forth. (This is not particularly useful if someone steals your computer while it's on and logged in, of course.)

<comment><USER4> I think it is better to use a full disk encryption product (which encrypts information) or encrypted disk images (which only encrypt sensitive information) as opposed to FileVault.

FileVault converts your entire home folder into a encrypted disk image. While this is fine for security (no worrying about whether your files are actually encrypted, as long as they are in your home folder), it is bad for usability. When you login or logout, FileVault will either mount and decrypt or encrypt and unmount your home folder/encrypted disk image. Sometimes this process can take several minutes. If your computer runs out of battery (or it is turned off in exasperation), the encrypted disk image can be corrupted. The data within is unrecoverable.

<comment><USER3> After a brief foray with "DoubleSpace" back in the MS DOS 6.0 days, I vowed not to try such nonsense again for fear of data loss, so I hadn't got around to trying FileVault yet. I only mentioned it because no-one else had and it seems to be an overlooked part of OS X.

That said, encrypted disk images work _great_ on OS X. I'd also suspect there's an interesting way to auto-mount/symlink USB drives into useful places so you have to carry it around with you for anything private to work.

</comment></comment></comment><comment><USER5> I would use a user account called Administrator, without password. Make this user, and only this one, auto-start a program to do all those things you want it to.

It's better than a .txt because it's easier to hide (you don't have to actually hide it this way) and the person that stole your notebook is more willing to wait a little for the default programs to load than when opening a file, especially a txt one.

When he/she thinks it logged in successfully, the portrait of the thief is already in your inbox and your sensitive files encrypted/deleted.

</comment><comment><USER6> After physical security, you should secure your data. Tips for Mac users:

1\. Using 1Password for random passwords encrypted with a master password

2\. Enable FileVault, if the password is entered wrong too many times it will wipe the drive.

3\. Password protect your iPhone, set it to remove personal data after too many bad attempts.

4\. Never use open WiFi.

<comment><USER7> _2\. Enable FileVault, if the password is entered wrong too many times it will wipe the drive._

I've never heard of FileVault wiping the user's encrypted sparse image after too many bad password attempts. Googling gives me nothing. If too many bad passwords _do_ wipe the sparse image, how do I disable that? I have backups, but I don't want anyone to be able to delete my data so easily.

 _4\. Never use open WiFi._

Umm... why? Pretty much every site uses HTTPS or hashes your password in JavaScript before sending it over the wire. Sure there's a chance of HTML injection if the login form is sent over HTTP, but it's a very small one. Unless you're at DEF CON or something, open wifi isn't a major risk. I guess if you're super paranoid, set up a VPN server and connect to it when you're on an untrusted network.

I think the ideal solution is to use FileVault or some sort disk encryption, then also have a cron job runs a script every hour/day/whatever. This script would check a certain URL for a message (say <https://your- website/is/my/computer/stolen>). If that message says, "yes I am stolen", the script would activate the camera, e-mail the picture to you, and run shred on the drive. Basically a poor man's version of <http://www.orbicule.com/undercover/mac/>

</comment></comment><comment><USER8> Full disk encryption. No worries mate.

<comment><USER9> Perhaps combined with another operating system which performs the tasks mentioned in the article? [Taking a picture, and sending it, the ip address, and anything else interesting/identifying about the network (nmap dumps, nearby access points - assuming that it just connects to any unencrypted one - traceroutes, and so forth), to a predetermined email address].

</comment></comment><comment><USER10> The 'delete everything sensitive' step would either not be reliable (unlinking all the files) or would take an extremely long time (writing zeroes or noise over all those bytes).

<comment><USER11> I think you could just flip bits at random positions (probably blockwise to be faster) in those sensitive files. This should corrupt the files pretty quickly.

</comment></comment><comment><USER12> While encryption may save your data, you can't really brick the computer. Take out hard-disk throw in trash, replace with new 50$ disk, welcome to you're new macbook pro.

<comment><USER13> I know that Dell in particular can set a password on the BIOS that is extremely non-trivial to bypass. Other hardware makers probably offer similar functionality. Taking this a step further and allowing this to be set from the running OS could be possible, thus effectively bricking the computer (barring access to hardware support channels, but you registered your computer anyway, didn't you?)

</comment></comment><comment><USER14> I could see a file called "secret_accounts_dont_open.txt" being really attractive to my wife or son. Pass.</comment>


The Lowly Folding Chair, Reimagined with Algorithms - <AUTHOR> https://www.wired.com/2017/04/lowly-folding-chair-reimagined-algorithms/?mbid=social_twitter?ref=techpulse.co <comment><USER2> >when you let algorithms optimize the shape of the legs and back of a chair; they start to resemble animal bones

Evolutionary algorithm evolves biomechanics…

</comment><comment><USER3> Last time I checked, even basic folding chairs have backrests.

<comment><USER4> I'm not even sure which side is the back.

</comment></comment><comment><USER5> These types of chairs are common in the Middle East and parts of Asia they are usually called Syrian or fan folding chairs here is a 19th century example of a 19th century one [https://www.google.co.uk/amp/s/www.1stdibs.com/amp/furniture...](https://www.google.co.uk/amp/s/www.1stdibs.com/amp/furniture/seating/chairs/19th- century-syrian-wood-inlaid-folding-chair/id-f_7118093/)

There is also another common design in which the chair unfolds to like a bundle of crossed beams and you put a pillow in the middle to sit.

Not exactly sure what "algorithm" was needed to design the chair, I would think by now Sweden would be familiar with middle eastern designs.

</comment><comment><USER6> > lowly folding chair

> 27 cherry wood pieces

Yeah, okay.

<comment><USER7> To be fair, i couldn't help read this article with a picture in my mind of repeating the design or something similar using a simple laser cutter and acrylic. I bet it'd be cheap, easy, and look good. (If you like that kind of design.. a bit 60's retrofuturish I guess.)

</comment></comment><comment><USER8> I don't see a video of a person actually unfolding this thing, which looks like a complicated process when your friend gravity insists on helping you out.

</comment><comment><USER9> It doesn't even fold into itself? Just goes flat?

I'm tempted to say a good carpenter could eyball this quite quickly.

</comment><comment><USER10> Looks really heavy. Also, no back rest. And no pillow, so hard on your butt.

Not a great design if you ask me.

<comment><USER11> Unless your ass is in the shape of a bunch of curved piano keys.

<comment><USER12> > It also had to be comfortable, so Ratti designed the seat shape around a 3-D > scan of a human body.

If true, it shouldn't be too uncomfortable, no more so than a wooden chair. The gap between the slats doesn't matter much (again, you can see a lot of wooden patio furniture for examples).</comment></comment></comment>


How To Land a Job at Google - <AUTHOR> http://blog.fairsoftware.net/2010/11/10/how-to-land-a-job-at-google-or-elsewhere/ <comment><USER2> This always seemed like a sensible approach - so I tried it. I'll let you know if it works...

<http://www.appidio.com/apps/scrybe/>

(To save you the click through, it's a project of mine that combines Google Scribe with an Android keyboard. It's definitely alpha quality, but the concept is there.)

<comment><AUTHOR> Good attempt. What I would add, if you are really into landing a job, is add a byline that says "I'm a recent graduate" (rather than say I'm jobless), and make sure the product name you are targeting is in the title. This way, you maximize your chance that someone who works on that products eventually finds your page, and your bio will automatically make them think: "hum, why doesn't he work for _us_?"

<comment><USER3> Making sure a PM on the product reads your blog post isn't about optimising the title and having buzzwords like graduate. Think about being in the PM's shoes and where you would be looking for coverage and posts and so on on your product.

Hint: Writing a cool, insightful blog post, teardown or even nifty mashup (youtube instant?) that appeals to both the HN community as well as being hand crafted to subliminally read 'Please hire me, Google' would more than get you noticed.

The premise in the main post is very sound. If you want a product job at Google, put yourself in the shoes and start thinking product.

<comment><USER4> Another possibility:

Remember the guy that bought the AdWords targeted specifically to the hiring manager at Google?

That was a creative way to get noticed.

Maybe doing that + having the work to show for it (a landing page specifically for the manager! showing your work :) )

</comment></comment></comment></comment><comment><USER4> I don't think this is the best advice for everyone:

"How would I become a VC? By being one: pull some of my own money, invest it in startups, and build my track record. That's how. I can't imagine any other way."

I can definitely imagine another way - the way I suppose the people that went to the event being discussed ("how to become a VC.") might have in mind: learn the ropes from someone experienced, learn what's needed (lots of legal, economical and technical stuff I didn't even know existed before reading stuff like the A VC blog <http://www.avc.com/> ), learn from their mistakes and successes (and no, I don't think the Internet is a good enough substitute for the actual experience).

<comment><AUTHOR> How do you propose to learn what's needed, without actually doing the job? VC jobs have a crazy applicant ratio above 100 to 1. So even if you are super- qualified, with the best MBA, your chances are still below 1% to land that job.

The alternative, kind of what Jeff Clavier did, is just ignore the traditional ladder and just do it.

<comment><USER5> A problem with this is, most people don't have the money to just start investing in startups. This is one reason why startups tend to need VCs in the first place. It's not like the only thing holding people back from investing in startups is willpower.

<comment><AUTHOR> I don't think a 20-year old, fresh out of college, wants to become a VC. So that particular advice was more targeted at mid-level managers, with some cash in the bank, and the desire to become a VC. Do you know any VC who is less than 30?

<comment><USER6> Speaking personally, this probably has to do more with resources (money, experience, people) and less with desire.

<comment><USER7> Agreed. I know several young finance guys that would all like to get into VC one day, but they know that without a founder background they need to cut their teeth in banking/dealmaking before moving over. But there is definitely a desire.

</comment></comment></comment></comment></comment></comment><comment><USER8> This advice worked for Feross Aboukhadijeh, see <http://techcrunch.com/2010/09/24/youtube-instant-instant/> for proof.

However most applicants would be better off brushing up on basic algorithms and CS stuff that most people have forgotten.

</comment><comment><USER5> I guess telling Google what they should be doing differently might work, but I wasn't really prepared in my interview to give them advice. Still got accepted, though.

</comment><comment><USER9> Great advise, unique perspective. Gives me an idea for interview questions as well. Thanks.

</comment><comment><USER10> Why wd you want a job at google anyway?</comment>


Show HN: Docshare.io – Instant Document Tracking and Notifications - <AUTHOR> https://docshare.io <comment><AUTHOR> Hi,

This is Piyush from Docshare.io

Docshare is an instant document tracking tool which will notify you via email whenever someone visits your document. And You will get insights like: >> Overall Time spent on document. >> Location/IP: Know the exact location of the viewer. >> Email id (if enabled): Every time viewer will be asked to enter email to view your document.

Happy Docsharing!

</comment><comment><USER2> We've banned this site for trying to manipulate the voting system.

If you used an external network to produce votes for you, please let them know that we banned everything associated with them.

Edit: the submitter insists they didn't do this, so we'll give the benefit of the doubt and unban the site.</comment>


Fintech Week 2016: report finds Britain to be the world's leading FinTech centre - <AUTHOR> https://www.gov.uk/government/news/fintech-week-2016-report-finds-britain-to-be-the-worlds-leading-fintech-centre <comment><USER2> I'm a little suspect of the findings, mostly because the study was commissioned by HM Treasury...which is a department of the UK government.

So it could be re-worded to say that "the UK Government reports that Britain is the top FinTech centre in the world".</comment>


Popular WordPress plugin comes with a backdoor, steals site admin credentials - <AUTHOR> http://news.softpedia.com/news/popular-wordpress-plugin-comes-with-a-backdoor-steals-site-admin-credentials-501383.shtml <comment><USER2> What surprises me more is that we don't hear about these kinds of attacks more often. The value of WordPress is the massive ecosystem--you can find almost any plugin or theme you can imagine. But every plugin and every theme is a potential vector of attack.

What's to stop any theme author from inserting an on-page credit card number scraper into an obfuscated javascript file or a modified version of jQuery? Just look for common WooCommerce field names on every page load, and if you find something, wait for the visitor to enter their card information and then phone home by loading an image or something else innocuous. I'm not aware of anything that any of the theme distribution channels would be doing to detect or prevent this kind of thing.

Given how easy it would be to construct this kind of attack, given how hurriedly theme-based WordPress sites are built, and given the budget limitations of people setting up theme-based WordPress sites, I tend to think that the main reason we don't hear more about these kinds of attacks is that no one is seriously looking for them.

<comment><USER3> I suspect we don't hear about this stuff more because the WordPress site and its directories for plugins and themes are moderated and code (generally) checked for possible exploits and stuff. Is it perfect? No, and as the article example shows, updates seem to be checked a whole lot less than new submissions.

But we don't hear about it more because most examples presumably get caught in theme/plugin review shortly after submission. The process isn't perfect, but the moderators do catch most attempts to do stuff like this.

And it's not happening through third party sites, because most people are advised to steer clear of free themes and plugins hosted outside the official directory.

<comment><USER2> I hope that the moderators are catching this stuff, and if they are that's great. But for moderators to catch the kind of attack that I'm describing the moderation process would require a detailed code review of all included javascript files, a rejection of any minified or obfuscated javascript files, and some kind of process to verify that any included or referenced js libraries haven't been tampered with. Is that something that is reasonable to expect--or even possible to expect--from human moderators? And what are the specific guidelines that moderators follow? Is it verifiable that they are looking for the right things?

I worry that, if it's hidden well enough, and if the attacker is smart enough not to be too greedy, a scraper could be there for years without anyone realizing it. The signature that such an exploit would leave behind--unlike what is described in the article--would be minimal if it were detectable at all.

Furthermore, I'm not as confident as you are that people who are acquiring themes are necessarily getting them from sites that are doing the kind of review that is necessary to prevent this. Even if people are avoiding free themes (and I'm not sure that they are) there are dozens if not hundreds of paid sites out there.

<comment><USER3> A thorough review like the one you suggest is perfectly reasonable to expect. They already reject plugins for 'encrypted' code:

[https://wordpress.org/plugins/about/guidelines/](https://wordpress.org/plugins/about/guidelines/)

And for stuff like phoning home without informed consent. Presumably the WordPress team has to check every line of code to do that, so they catch out any of said attacks during that check.

<comment><USER2> I amended my above comment to note that the official WordPress distribution channels are not necessarily the ones that are most at risk for this. And for what it's worth, the rationale given in those guidelines for banning obfuscation is that it is not GPL-friendly--not for any security reason.

It's not a total ban, either: _" However, note that some systems, like Paypal donation buttons, use encoded code as part of their normal operating mechanism. This is not considered to be 'obfuscated' as this is simply how these types of systems operate and it is not a choice by the plugin author."_

That seems like a reasonably-sized loophole.

<comment><USER4> Disclaimer: I wrote those guidelines.

The "Paypal" loophole is specifically because the first version of the guidelines had people constantly emailing us asking if this Paypal code snippet was okay. All the Paypal code snippet does (or used to do) is to include the relevant form data for "who to pay" in a base64 encoded mechanism instead of including the email address directly in the HTML code snippet. People didn't know what the code was, or if it was okay, and I wanted them to stop asking.

We still look for suspect code, and obfuscation that makes no sense is right out. We even reject minified JS, unless the minified JS is distributed from upstream code and can be verified to be unmodified from the original upstream source.

</comment></comment></comment></comment></comment></comment><comment><USER5> For the curious: "The plugin in question was Custom Content Type Manager (CCTM), a popular WordPress plugin for creating custom post types that, in the three years since it was uploaded on the WordPress plugin repo, has amassed quite a following, being currently installed on more than 10,000 sites."

<comment><USER6> Also important to note that WordPress guru Otto commented the following on the Sucuri post about the vulnerability[1]:

"The plugin has been updated to 0.9.8.9, which is a copy of 0.9.8.6 (the last good version). This will remove the malicious code from the plugin, but not any code that was added to sites in the meantime. Please follow through with the Mitigation steps given by Denis in the post."

[1] [https://blog.sucuri.net/2016/03/when-wordpress-plugin- goes-b...](https://blog.sucuri.net/2016/03/when-wordpress-plugin-goes- bad.html)

</comment></comment><comment><USER7> Note: The (legitimate!) plugin was apparently taken over by another author and then an update pushed the malware. The comments here as they stand make it sound like the plugin was _always_ a backdoor, and that's not the case.

Another reason why autoupdates are a double edged sword.

<comment><USER3> This is a very good point (about autoupdates). That said, it's also to some degree why any sort of ownership change is a double edged sword, even in cases where updates aren't automatic. I mean, how many people check the software they're using hasn't been substantially modified when an update comes out? You could buy a popular program for Windows (or Mac OS, or any Linux distribution, or anything else), add in malicious code, push the update live and find 90% of users would 'upgrade' without even thinking.

</comment></comment><comment><USER8> This functionality should become part of wp-core. Currently you need a plugin like CCTM, Types, Pods or ACF to upgrade WP from a blogger platform into a general purpose CMS.

Once part of wp-core it opens the road for plugins to extend on this functionality much easier, since all can depend on it being there.

<comment><USER9> Custom post type are part of the core though, there's just no admin UI for it. That's really all these plugins provide.

[https://codex.wordpress.org/Post_Types](https://codex.wordpress.org/Post_Types)

You should be defining them in your theme anyways for source control.

<comment><USER3> No, you should be defining custom post types in a custom plugin for source control. That way, your code still works if they change theme, or you replace it when you remake the theme a few years down the line. Otherwise the client will inevitably switch theme, then find all their custom content inaccessible.

And I do think even though this API exists, it should definitely be improved upon and given a built in interface. I mean, don't other CMS scripts like Drupal provide a way to add custom fields and things in core, via a visual interface?

<comment><USER9> Yes, you should because dealing with keeping that in sync between dev, staging, production is a major hassle.

If you are changing your theme and using custom post types, you still have to modify the theme to support the custom post types. So copy and paste, or isolate the custom post types to a separate file and include in your functions.php.

If you're doing it any other way, then you honestly don't really know what you are doing.

<comment><USER3> Not really. If you're not running a test site, put the theme and custom plugins inside another folder and commit that to Git or SVN. If you are running a test site, oommit the wp-content folder, with the uploads directory and any third party code set as ignored.

And the way I suggest is also what a lot of WordPress experts suggest, as seen here:

[http://justintadlock.com/archives/2013/09/14/why-custom- post...](http://justintadlock.com/archives/2013/09/14/why-custom-post-types- belong-in-plugins)

[http://www.wpbeginner.com/opinion/wordpress-custom-post- type...](http://www.wpbeginner.com/opinion/wordpress-custom-post-types-debate- functions-php-or-plugins/)

[https://www.smashingmagazine.com/2012/11/complete-guide- cust...](https://www.smashingmagazine.com/2012/11/complete-guide-custom-post- types/)

</comment></comment></comment></comment></comment><comment><USER10> There was a popular (4000+ active installs) Wordpress plugin for Stripe that up until recently (read a week ago) wasn't PCI compliant. I wouldn't be surprised if this sort of thing is more common than just one or two rogue plugins (maybe not as bad as stealing admin credentials, but at a minimum doing things that most people would not consider secure). I would think as a large portion of Wordpress users just download and install which ever plugin looks popular and doesn't verify / validate the actual code.

<comment><USER11> Don't we all do that? We install code from github, we run curl commands and pipe them through bash, we use apt or yum. How many people actually look at the code?

<comment><USER10> True, though to some extent I'd expect the moderation and reviews of people on Github or apt would be stronger than that of the average wordpress user.

</comment></comment></comment><comment><USER4> Once we were notified of the issue, I manually removed the bad code and shut down further updates. If you have this plugin, update to the latest version immediately.</comment>


Friend Suggestor - <AUTHOR> http://blog.facebook.com/blog.php?post=18829762130 <comment><USER2> I find it amusing that these features almost always show a list of people I dislike.

If I know a person and they're on Facebook, more often than not I've already 'friended' them. The friends-of-friends which are left tend to be those I'd rather avoid.

</comment><comment><USER3> I think that if a friend really wanted to suggest a request to me, I'd rather see it in a more personal medium. Otherwise, why haven't I already thought to add them?</comment>


Tell HN: PSA about getting hired via Stack Overflow - <AUTHOR> We've just signed up for the SO hiring platform in order to contact willing candidates about a role we have going. In the process we've discovered that candidates actually need to go out of their way to enable a link to their SO profile (profile -> developer story -> edit top right -> pick network -> SO).
As both a hirer and a candidate this came as a pretty big surprise to me. It seems a shame to have built up a reputation on SO to not be able to use it when you're trying to get hired.
I thought I'd point it out in case anyone else was using the platform and hadn't enable that flag. <comment><USER2> I believe what you're referring to are the required steps to create a _public_ link to a developer story.

This isn't required in order to appear in search results by recruiters. As long as a user has their job search status set to either "Actively looking right now" or "Open, but not actively looking", they will be included in candidate search.

(source: I work for SO)</comment>


Environmental Impact Disclosure – Nine9s Uptime Monitoring - <AUTHOR> https://nine9s.cloud/kb/infrastructure?ref=hn <comment><AUTHOR> Hey all developer here,

I wish more services would consider the impact of their software on the environment and that more hosting platforms would make tools available for sites to display this information to users. Climate Change will become a more dominant factor in business on the Web as time goes on. Our websites are virtual, but our servers aren't.</comment>


On Learning Haskell - <AUTHOR> http://esr.ibiblio.org/?p=1796 <comment><USER2> Pretty good article! I read the first few paragraphs and was a little scared, but the author redeemed himself with the line, "A simpler way to think about monads is as a hack to turn function composition into a way of forcing the sequencing of function calls, or the functional-programming equivalent of a shell pipeline." After that, I would agree with pretty much everything he says! (A first for an "I looked at Haskell today" article :)

A few nit-picks that come to mind; thunks and closures are related but different, every other language with thunks also calls them thunks.

Lisp is not really "based on lambda calculus" any more than any other imperative programming language; "(loop for i from 1 to 10 collect (+ i 42))" is not so different from a loop in assembler.

And finally, monads are not really a _hack_ for making function application look like a sequence, that's already what function application does. Monads just let you run some extra code between function applications. But given that most people write stuff like, "monads are like nuclear-waste burritos inside of spacesuits" (er...), I am not going to complain about this explanation too loudly :)

<comment><USER3> Well... if you consider IO to be the nuclear waste of functional programming, the IO monad is a way of wrapping up that nuclear waste so tightly that it can't escape until the functional program has logically completed executing. The high-level result (of some IO type) is logically an imperative program that the functional program built using functional composition with placeholders where the IO was supposed to happen.

But while I have to stretch to make this analogy, monads are sufficiently abstract that they could probably be made to fit many strained analogies...

<comment><USER4> When jrockway said the burrito thing, I think he was referring to the Brent Yorgey post about the "monad tutorial fallacy":

[http://byorgey.wordpress.com/2009/01/12/abstraction- intuitio...](http://byorgey.wordpress.com/2009/01/12/abstraction-intuition- and-the-monad-tutorial-fallacy/)

To summarize: everyone, once they learn Haskell, comes up with their own analogy for "what monads are"... and the analogy, while it makes perfect sense to the person that came up with it, never helps anyone else because everyone gets to monads via a different route.

<comment><USER5> I have the perfect explanation for Monads: Monads are like everything that satisfies the three monad laws. (Of course this only helps mathematicians, if at all. Not mere mortals.)

<comment><USER2> "A monad is like a functor, except there is also a 'join' operation."

<comment><USER5> Don't forget about pointed functors in between, i.e. return.

<comment><USER2> Yeah. My mental picture is "thing with return/pure -> thing with fmap -> thing with join". The second is a pointed functor, the third is monad. Not sure what the first is, probably because it is nearly useless :)

<comment><USER5> You may have it backward. The mathematicians use "thing with fmap (functor) -> thing with return/pure (pointed functor) -> thing with join (monad)", as far as I know.

Arrows are another generalization of Monads that goes in a direction different from functors.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> I was bothered by him equating closures and thunks. While they are kind of similar (a thunk is almost like a closure with no arguments), they aren't really the same thing.

<comment><USER5> Careful lying may aid in explaining. [1] The author knows the difference.

[1] Can anybody find the source of this quote?

<comment><USER6> The author feels that this technique of deliberate lying will actually make it easier for you to learn the ideas. --- Donald E Knuth, The TeXbook

<comment><USER5> Thanks! That's what I was searching for.

</comment></comment></comment></comment><comment><USER7> Nice article, but Haskell type system is not a logical limit.

I would say that Coq's type system (or some other Martin Lof type system) would be a logical limit.

(is there IO Monad in Coq?)

Again, nice article.

<comment><USER8> _(is there IO Monad in Coq?)_

To the best of my knowledge, no. If memory serves me, Coq actually isn't even Turing-complete, being a typed lambda calculus with no general fixpoint operator (specifically, a variant on the Calculus of Constructions). Any "program" that "type checks" in Coq is thus provably terminating.

Note that, in Haskell terms, the simplest general fixpoint operator is:

      y :: (t -> t) -> t
      y f = f (y f)

...which, interpreting "->" as logical implication, is a theorem stating that a proposition implying its own truth implies its own truth. Given that (t -> t) is clearly a tautology, this suffices to prove all possible propositions, also known as the "principle of explosion". [0]

On the other hand, see <http://ynot.cs.harvard.edu/> for an attempt to add side-effects and general recursion to Coq in a controlled fashion, in order to turn it into more of a programming language.

[0] <http://xkcd.com/704/>

</comment></comment><comment><USER9> _Haskell pushes [static typing] to some sort of logical limit._

I think that distinction should go to Qi. Derived from Common Lisp, but with a type system that's Turing-complete.

<http://www.lambdassociates.org/doc.htm>

<comment><USER10> I believe GHC's type system is also Turing complete. As an example, you can implement BrainFuck in the GHC type system. I haven't looked over the details, but it looks promising.

<http://killersmurf.blogspot.com/2009/11/typefuck.html>

<comment><USER8> Type-level computation is actually quite limited by default in GHC; it becomes quasi-Turing-complete only when using the UndecidableInstances extension, and even then it has a very shallow stack by default, though you can increase it if you want deeper recursion. If memory serves me, Oleg Kiselyov has a type- level implementation of the untyped lambda calculus, which is rather more pleasant than brainfuck.

</comment></comment></comment><comment><USER11> one odd thing reading through was the comment that _A benefit of lazy evaluation is that you can write code like an Icon or Python generator that spins forever, returning a value on each cycle, and it will only be called for the exact number of returns that the enclosing program actually needs even if the caller is itself a generator._

that sounds to me like it's making a contrast with icon and python generators. but, as far as i understand things, that's just the same as icon + python. also, "even if..." was emphasised, and i don't understand why.

i suspect i've misread it or am missing something. would someone be kind enough to set me straight? thanks...

</comment><comment><USER12> Any reason why Haskell is so popular here? I spoke to people on Prgmr IRC and they were wondering too. I've learnt lisp in the past, but I have to wonder what benefits Haskell really offers that makes it so popular currently?</comment>