Ask HN: Is my terminology correct? - <AUTHOR>

I'm building out a website with the following setup:
Client <--> mysite.com <--> Nginx <--> Flask (Python) Website <--> DB
Where Nginx (Machine #1) either serves a static resource (js, css, etc...), or reverse proxies the request to my Flask application (Machine #2) which does any necessary communications with the database (Machine #3), and returns whatever html content was requested. Reason for this is because Nginx is great for serving static resources so I wanted to put that in front of my Python code.
Question: How do I classify them?
Is it:
   Nginx - Web Server, Flask - App Server, MySQL - DB Server
or:
   Nginx - Web Server, Flask - Web Server, MySQL - DB Server
or:
   Nginx - Proxy Server, Flask - Web Server, MySQL - DB Server <comment><USER2> Nginx is the web server which is reverse proxying to some other server that is running your Flask app. Flask is the web framework. MySQL is the database which may or may not run on a separate database server. Somebody might have a correction or two though.</comment>


Openrsync imported into the tree - <AUTHOR> https://undeadly.org/cgi?action=article;sid=20190211081518 <comment><USER2> > _The actual work of porting, however, is matching the security features > provided by OpenBSD 's pledge(2) and unveil(2). These are critical elements > to the functionality of the system. Without them, your system accepts > arbitrary data from the public network. ... rsync has specific running modes > for the super-user. It also pumps arbitrary data from the network onto your > file-system. Do you want that running without specific mitigation in place?_

This is a confusing claim. What exactly does "accepts arbitrary data from the public network" mean? (Most servers do that, they just choose not to _process_ the data without additional validation.) And in what way is it critical to the _functionality_ of the system?

Is the claim that, after calling pledge() and unveil(), the openrsync process is happy to satisfy arbitrary read/write requests from the other side of the connection, and so without them it is insecure?

Does openrsync view peer-induced memory corruption after pledge() or unveil() as a vulnerability? Or is the idea that the attacker can already "pump arbitrary data from the network onto your filesystem" and that the attacker gaining control flow is not a meaningful escalation of privileges?

My impression is that pledge() and unveil() are _hardening_ tools, intended to limit the damage from a process that has already gotten out of control (in the same way that e.g. running Apache as non-root does not mean that you're actively fine letting attackers run code as www-data). Is that impression wrong? Is openrsync using them for the basic functionality of making sure that a file is only being rsynced to the filename given on the command line?

<comment><USER3> I'm trying to understand your question.

Typically, a process once compromised can do all sorts of things: touch files, access the network, execute programs, and so on. Among other things, OpenBSD's security culture focuses on mitigating the damage done by compromised code through development practices such as privilege separation.

Traditionally this was done by splitting functionality into multiple processes, each serving a specific purpose such as doing network communication or parsing configuration, and dropping privileges in any way possible such as chrooting and switching to a dedicated user. Thus the attack surface is reduced, and the potential damage done by a compromised (sub‐)process is reduced as well.

pledge() and unveil() are the latest evolution in OpenBSD's technique. pledge() whitelists syscalls, and unveil whitelists files that can be accessed.

So your process reads this arbitrary data from the public network. You validate it through some function and pass the data on to the next stage of your program. But what if there's a bug in your validator, and your process gets compromised?

If your process hasn't had its capabilities reduced, the attacker can do practically anything, especially if the process has superuser privileges.

But if the program uses a multi‐process privilege‐separated architecture, your validation process can't access the filesystem or the network and isn't running as root. If it tries, the kernel will kill it for violating its pledge. All the compromised process can do is pass malicious data through whatever interface you've provided between your validator and filesystem processes, hopefully an interface that is simple, well‐defined, and well‐audited.

What if your filesystem process gets compromised? With pledge() it can't access the network or execute external code. With unveil(), even its file accesses are limited to the files whitelisted earlier in the program. It can't read your SSH keys or delete your photos.

Certainly, if the process can be compromised that's a bug that needs to be fixed. But we see new bugs constantly in the software we use every day. It's a safe bet to say we will encounter more. By using a secure architecture, the damage these bugs can cause is drastically reduced.

There's a really good description and demonstration of privilege separation in another project by Kristaps, acme-client (a Let's Encrypt/certbot alternative): [https://kristaps.bsd.lv/acme- client/](https://kristaps.bsd.lv/acme-client/)

Another such project is Google Chrome, which uses pledge() and unveil() on OpenBSD.

<comment><USER2> My question is that the README implies that pledge() and unveil() are _required_ for _functionality_ , to the point that porting to an OS without support for that is an inherently questionable idea. That certainly isn't true of Chrome (I run it on non-OpenBSD and there are no functionality / security issues in doing so). That isn't true of OpenSSH, which also supports pledge() on OpenBSD and still is pretty secure on other OSes.

I do expect this is structured as you describe - that it has a validator, and that it uses these kernel features as additional hardening if the validator has a bug. But I would not describe that as _requiring_ pledge() / unveil() and certainly not requiring it _for functionality_. So I don't know what the author means.

And I am worried, in particular, that the author means that the validator is not very strong, and the bulk of the validation is that it unveils the filesystem to the files it's supposed to write to and then blindly trusts the input, on the grounds that the worst the remote side could do is corrupt files but it could have just have sent different contents for the files in the first place. This seems unlikely to me, but I'm having trouble figuring out an alternate interpretation.

<comment><USER3> > My question is that the README implies that pledge() and unveil() are > _required for functionality_ , to the point that porting to an OS without > support for that is an inherently questionable idea.

Knowing Kristaps, he probably considers strong privsep and privdrop basic functionality. That is after all why he developed acme-client in the first place; he acknowledged at the time the plethora of "lightweight" certbot alternatives but was more concerned with security architecture.

> That certainly isn't true of Chrome (I run it on non-OpenBSD and there are > no functionality / security issues in doing so). That isn't true of OpenSSH, > which also supports pledge() on OpenBSD and still is pretty secure on other > OSes.

Chrome uses different techniques depending on the platform. On OpenBSD it uses pledge() and unveil(), while on Linux it uses seccomp. Kristaps isn't a fan of seccomp's complexity, as he mentions in the readme: "Linux's security facilities are a mess, and will take an expert hand to properly secure." He's not suggesting it can't be done, and the Google Chrome team in particular has the kind of expertise he's talking about.

For projects of less‐than‐Chrome scale, though, Kristaps feels that seccomp is too difficult: [https://github.com/kristapsdz/acme-client- portable/blob/mast...](https://github.com/kristapsdz/acme-client- portable/blob/master/Linux-seccomp.md)

> And I am worried, in particular, that the author means that the validator is > not very strong, and the bulk of the validation is that it unveils the > filesystem to the files it's supposed to write to and then blindly trusts > the input, on the grounds that the remote side could just have sent > different files.

I don't understand this interpretation. It's not what I got from the readme at all. What kind of validation do you expect Kristaps to be overlooking?

</comment></comment></comment></comment><comment><USER4> From a comment on the site: "(...) its (original rsync's) compressed manual page is almost as big as the compressed openrsync sources (...)"

It's license (ISC ofc.) and size makes it great resource to study rsync. I would like to have Dropbox on my phone as legendary combination of rsync and cron. It may be nice to have a port to Java so it would work without JNI, but maybe that's only my fetish.

<comment><USER5> I just want to point out that rsync is, in fact, no longer ISC licensed but rather GPL (v3, at that), which is likely a big part of the reason this new implementation even exists.

<comment><USER6> rsync was never ISC licensed afaik. The parent is referring to openrsync's license.

<comment><USER7> Rsync was developed by the Samba people, it is under the same license (GPL).

</comment></comment></comment></comment><comment><USER8> Very cool news. rsync(1) is one of the first things I install on a new OpenBSD instance.

Tangentially related, I've been using Time Machine-like wrapper [0] around rsync(1) for a few years. It's very helpful for maintaining snapshots of my home directory.

[0] [https://blog.interlinked.org/tutorials/rsync_time_machine.ht...](https://blog.interlinked.org/tutorials/rsync_time_machine.html)

<comment><USER9> I use rsnapshot [0] for the same thing.

[0] [https://rsnapshot.org/](https://rsnapshot.org/)

</comment></comment><comment><USER10> For those wondering what this is, see [https://github.com/kristapsdz/openrsync](https://github.com/kristapsdz/openrsync)

<comment><USER11> I'll try explaining it. It's a new implementation, from scratch (clean room) of rsync, which will become the new rsync in OpenBSD. The tree that it's been imported into is the openbsd cvs tree that contains openbsd, openssh, opencvs, and other major projects.

</comment></comment><comment><USER12> I would not be surprised if, in a few years, this becomes one of the CLI tools installed on macOS, either as part of the default install or as part of the Xcode CLI tools.

<comment><USER13> Why? MacOS has a bunch of GPL stuff, such as bash, IIRC.

<comment><USER14> And it already has actual rsync.

<comment><USER15> It has 12 year old rsync due to Apple not wanting to ship anything that's GPLv3: [https://bayton.org/2018/07/how-to-update-rsync-on-mac-os- hig...](https://bayton.org/2018/07/how-to-update-rsync-on-mac-os-high-sierra/)

</comment></comment></comment></comment><comment><USER16> Interesting. This is the first project I can think of where a clean-room implementation was done so that a project could use a _less_ free license ("free" as defined by the FSF).

Does anyone else know of instances where a company did a clean-room implementation of a previously FOSS tool so that they could make a paid/proprietary version? Usually it goes the other way.

<comment><AUTHOR> How is the ISC (version of BSD license used by OpenBSD) less free than the GPL3? This is very far from a "paid/proprietary" version.

<comment><USER6> Using "less free" or "more free" in this context just leads to pointless semantic debates. What happened is that someone made a clean-room implementation of a copyleft program in order to have it available under a copyfree license. Both licenses are Free.

[http://copyfree.org/policy/copyleft](http://copyfree.org/policy/copyleft)

<comment><USER17> First time I see this, thanks. The website isn't explicit about this point, but from what I gather, "copyfree" isn't viral in the way GPL is. It seems to provide "Free as in Freedom", but unlike GPL, doesn't _protect_ that freedom from being immediately taken away.

</comment></comment></comment></comment><comment><USER6> I hope this ends up being a lot simpler and easier to understand than the original rsync. The rsync manpage is way too long.

<comment><USER18> Rsunc solved a complex problem that comes in many nuanced variants. It may seem trivial at the outset, but it is actually not. So I don't think that rsync has many features that are somehow unnecessary or bloat.

<comment><USER6> Well, the manpage for this is looking really good and it already has almost everything that I care about. The -a option isn't in yet, but it's in the TODO.

[https://github.com/kristapsdz/openrsync/blob/master/openrsyn...](https://github.com/kristapsdz/openrsync/blob/master/openrsync.1) [https://github.com/kristapsdz/openrsync/blob/master/TODO.md](https://github.com/kristapsdz/openrsync/blob/master/TODO.md)

I hope the -c and maybe -X option make it.

</comment></comment></comment><comment><USER19> What does a "clean-room implementation" mean?

<comment><USER20> The first (well-known) 'clean-room' implementation was when Phoenix implemented an IBM PC-compatible BIOS by having one team studying the IBM source (which was available), then writing up a specification for how it worked, handing that specification over to somebody else (they were Phoenix' legal team, IIRC), which then handed the specs over to another team that had never seen the IBM source. They sat down in their "clean room" (b/c it wasn't tainted by actual IBM source) and implemented a BIOS from specs only. In that way Phoenix was protected from any claims of copyright infringement: Nothing was copied, and the people writing the code had never seen the original source.

In that particular case the specs were reverse-engineered from actual source, but that's not a necessary part of the process. It's more common to have one team study the protocol, data going over the wire, disassembling, etc, then use the knowledge gained to write specs, and then another team implements the equivalent functionality from specifications only.

</comment></comment><comment><USER21> Is it any better than rsync?

<comment><USER22> All openrsync implements is the equivalent of a fast "cp -a" across the network, plus it can also remove files if they don't exist. rsync does much more and over the years I've used most of it, so there is no way I would use openrsync. The upside is the manpage of openrsync isn't that much more complex than cp, which is a definite bonus if that's all you are doing.

The only thing I would change about rsync is it's default, which IMO should be to copy all meta data supported by both sides. Ie, the default should be to make the destination as similar to the source as possible. It's default is to only copy the data, and you must add options to say what else you want copied. To make matters worse you can just add every option because if you say you want to copy something not supported by one side of the other it errors out. I may have missed it as I am reading the man page source, but openrsync didn't seem to change that.

<comment><USER23> No. openrsync implements the rsync protocol. It doesn't have all of its options, but the protocol is what it is. Do you have any idea what you're talking about?

</comment></comment></comment><comment><USER24> It is interesting that "open" part of openrsync refers to license -- BSD, vs original rsync's GPL

It's not often I see "open" to mean "non-GPL" in software :)

<comment><AUTHOR> I get the feeling the "open" part was because they were hoping to get it included in OpenBSD like OpenSMTPD, etc.

<comment><USER6> Yeah, that was my assumption too. It's coming from the OpenBSD community, so openrsync it is.</comment></comment></comment>


Instagram doesn't care about artists' rights - <AUTHOR> http://instagr.am/p/TWWqa2tmGb/

<comment><USER2> I'm sure many people will dismiss this as it's standard practice, the status quo has been set - though I feel when these kind of ethical issues are dealt with in a fair manner, then those platforms will be the ones who win in the end.</comment>


Ask HN: What gets you out of bed? - <AUTHOR> If half the work is showing up, half of showing up is getting out of bed. :)
What do HN readers do to get motivated and start the day awesomely when working on a startup?
Full disclosure: I'm asking because we want to make our startup's alarm clock app better. https://play.google.com/store/apps/details?id=com.chaoscollective.warmly <comment><USER2> I don't use an alarm clock, I just go to bed early and wake up in time...

But in periods when I've really had trouble with getting up, the core problem hasn't been physically awakening my brain, it's been that as soon as I woke up I knew there was just boring miserable shit all day to look forward to, so I was likely to just snooze.

In those periods, I discovered that the only effective way to get my brain going enough to understand the rational course of action (getting up & showered), was to have something fun within reach -- my computer, usually.

So I'd wake up at the first ring of my phone alarm, then flip up my laptop and read some Reddit or whatever.

If I really needed an exceptionally effective alarm clock, I'd want something that maybe starts talking for five minutes about something interesting, or prompts me with some captivating question, or shows me a gallery of cool pictures, or something.

</comment><comment><USER3> The neighborhood squirrel serenades the sunrise each morning as a sort of mammalian metronome for about an hour, filling me with questions about rhythmic chanting and the mammal brain. It's like a 60 decibel woodblock, only three octaves higher. That wakes me up. I don't recommend it for your alarm clock app.

Money, glory, and fun actually get me out of bed.

<comment><USER4> That squirrel sounds incredibly motivated. Would love to hear what that sounds like.

</comment></comment><comment><USER5> Getting to the office before everyone else, for two reasons:

\- It is quiet. Most of my coworkers get in between 9:30 and 10:00, so if I'm here at 8:30, I get a solid hour to handle the administrivia part of my job - emails, daily task sorting, etc.

\- I get to leave earlier. I like to have my afternoons, so if I'm in early, I get to take off early. This is not set in stone solid, and I can always take off if I absolutely have to (or work from home), but for the day to day, if I'm in at 8:30, I'm out at 4:30, and that lets me have time to handle my personal stuff, beat traffic, run errands, anything.

</comment><comment><USER6> My secret to getting out of bed: I sleep with socks on!

I find it's also much easier to get out of bed when you know what you need to accomplish and what's on your agenda for the day. A sense of urgency is a great motivator.

<comment><USER7> Having something on my agenda rather makes me not go to bed :P. But yes, that is indeed a good one that I hadn't thought of. In hindsight I notice I've often woken up more easily because of something cool on my agenda rather than the daily routine, so it might be something to practice.

</comment></comment><comment><USER8> Usually my wife.

She uses some sort of fitness wrist-thing to wake up - maybe a Jawbone? I love it, because there's no more harsh alarm noise - no noise at all, usually, although sometimes I can hear it buzz a wee bit.

<comment><USER9> The Fitbit Flex does that too. I just got mine today and I'm counting the hours till tomorrow morning to test it. I want to try being more of a morning person but I don't want to disturb the wife getting up too early.

</comment></comment><comment><USER10> Early Morning Meetings. If I know I HAVE to get out of bed I will get up. If not I will snooze for longer than I would like.

Additional motivators:

1\. Light - Before bed I open all the curtains

2\. Tasks - I lay out all my tasks the night before. Less stress thinking about all the things I have to do. Wunderlist everything and then stop stressing.

3\. Fun First - I try to put a fun task at the top of the list each morning. Makes it fun to get up.

4\. Alarm not near bed - Having the alarm away from the bed I have to get up to turn it off. Once I'm up and moving I rarely feel the need to get back into bed.

<comment><AUTHOR> great tactics. thanks!

</comment></comment><comment><USER11> I park my car on a parking spot that isn't free. If I don't get up before 9 I usually get fined.

<comment><AUTHOR> I think it's interesting that so many comments on here are about setting up a scenario where you'll be embarrassed or fined if you don't get up.

I guess it comes down to trying to plan logically the day before vs. being too tired to care when the alarm goes off. Reminds me of the extreme where your alarm starts sending money to a political party you don't like if you hit snooze. :)

</comment></comment><comment><USER12> My son (nearly three), usually around 6am. If I don't bounce out of need the instant he opens our bedroom door, he'll wake the baby and her mother, and both will be grumpy for the rest of the day! I love it because then we get to build something with Lego's for an hour before we have to get ready for kindergarten.

<comment><USER13> My eldest (4) woke me at about 6am this morning poking one of my iPads in my face, he'd started YouTube and was asking how he could watch Spiderman on it.

What got me out of bed was the thought of what he'd watch after the first video.

</comment></comment><comment><USER14> Nicotine and caffeine craving gets me up.

<comment><USER7> Well that's the first good thing I heard about nicotine besides stress relief I guess. Never thought about it this way.

</comment></comment><comment><USER15> I've been doing web businesses since I was about 16, circa 1996. I didn't particularly like computers growing up, but when I got introduced to the web, it struck me like a bolt of lightning. I saw the web as an unlimited global canvas that I could build anything on. Webchat Broadcasting! AltaVista and HotBot! Netscape! Yahoo! Geocities! Quake online! Porn! It was all so exciting to a teenager. If I had an idea, I could immediately go to work on it. That's what I still love about the web today, and that's what gets me out of bed in the morning (so to speak). I usually have a lot of things I want to work on when I go to sleep, and so inevitably I wake up with my brain on fire, eager to build.

</comment><comment><USER16> Body clock. I am up at 6 everyday and go to bed at around 10pm or so. I then proceed to my favorite activity - bug the wife till she wakes up :p.

It's interesting now that I think about it because I used to be totally a night person not too long ago.

</comment><comment><USER17> The more I have to do, the more motivated I am. If I know I have a few tasks to do, but no actual appointments or deadlines, it's pretty hard to get out of the bed. I need stress to be productive.

</comment><comment><USER18> I love the mornings and embracing the day. I try to imagine Rafael Nadal's bull run from the net to the baseline at the beginning of his matches, and try to match that energy and excitement for the day. Usually springing out of bed.

I like challenges, like workouts, in the morning as well. If I overcome stuff in the morning, before I start my day, chances are I will have a productive day.

</comment><comment><USER19> my cat pats my face meowing for food.

<comment><AUTHOR> haha. I used to wake up to that a couple years back. Kind of awesome, actually :)

</comment></comment><comment><USER20> A few things that get me out of bed in the morning:

* Looking forward to spending time with my children ( post work, or all day on weekends )

* Known exactly what I have to accomplish that day ( task breakdown )

* Exercise, I really enjoy known that I'll have time to workout, this goes with having a schedule.

* Interesting problems to solve at work ( related to task breakdown I suppose )

</comment><comment><USER21> I'm using Sleep Cycle on my iPhone and it works like a charm actually. Downside is that you should keep it in bed so it can measure your sleep, but the vibration of my phone and alarm sounds are always on the right time. It's my only alarm, in stead of the 7 alarms I used before (at the same time!)

</comment><comment><USER22> Girlfriend and child - wakes me right up.

<comment><AUTHOR> Just curious, does that motivate you and put you in a good mood?

If not, are there other ways you wake up that put you in a productive mindset?

<comment><USER23> My answer is "a toddler", which, before having one, would have sounded like a nightmare to me (not a morning person). It turns out having a little person who is so ridiculously happy to see me puts me in a pretty good mood.

</comment></comment></comment><comment><USER24> Throughout winter, a light+radio alarm clock, something like: Philips-Hf3470

Since recently, a recorded motivational message: [http://blog.wojt.eu/post/51792538207/get-your-custom- motivat...](http://blog.wojt.eu/post/51792538207/get-your-custom-motivational- alarm-clock-on)

<comment><AUTHOR> reminds me of this guy who uses two alarms; one set to go off quietly a few minutes before the loud alarm.

[http://veenix.blogspot.com/2005/10/alarm-clocks-are-bad- how-...](http://veenix.blogspot.com/2005/10/alarm-clocks-are-bad-how-to-wake- up.html)

<comment><USER24> Yeah I'm planning to create one long alarm mp3. It'd start with ambient sounds of slowly increasing volume, then some motivational recording reminding me of my resolutions. Finally plain old annoying alarm.

</comment></comment></comment><comment><USER25> That I will return from work eventually back to my personal projects, reading and writing.

</comment><comment><AUTHOR> For the past couple months I've made it a point to read the news when I get up to get the gears turning.

On one level it's great, but at the same time it's often distracting relative to sitting down and being productive.

</comment><comment><USER26> I wish my project management system (currently getblimp.com) had a way for you to sync the alarm clock with it. So I would get daily alarms on important things. Why don't you give your app an api?

</comment><comment><USER27> Wake up Glass of luke warm water with a splash of lemon juice in it. 20 slow pushups Shower. Coffee. Wake up daughter and chat to her about the dreams she had last night :)

</comment><comment><USER28> If you go to bed before midnight, you're actually _ready_ to get up in the morning.

I haven't used an alarm in five years, ever since I stopped staying up late on weeknights.

<comment><USER29> Your experience doesn't necessarily generalize.

</comment></comment><comment><USER30> Working on a product for developers that they love to use.

<comment><AUTHOR> Does that literally wake you up? Or is that more of a motivator once you're up and moving?

<comment><USER31> Not the OP, but once I was promoted to lead developer for the flagship app of the company I worked for and that was quite efficient in making me wanting to get to the office before everyone.

</comment></comment></comment><comment><USER32> I have to work 9 hours/day. So if I get out of the bed late I will have to come from office late in the night which I definitely not want.

</comment><comment><USER33> 100mg of caffeine (half a nodoz) taken 30 minutes before I need to get up. I set alarms for both events, but rarely need the second one.

</comment><comment><USER34> sleep as android + qr code in kitchen ( Not affiliated, I am just a happy user, now having two hours more in the morning to do something I want to/need to.)

[https://play.google.com/store/apps/details?id=com.urbandroid...](https://play.google.com/store/apps/details?id=com.urbandroid.sleep&hl=no)

</comment><comment><USER35> 1 kids. 2 dog. If you can make your alarm clock jump up and down on my bed and/or lick my face, it's a winner.

</comment><comment><USER36> I lay in bed thinking about the day's tasks until I feel motivated to get up & start on one of them.

</comment><comment><USER37> Usually a stretch and a phone check followed by another stretch does the job.

</comment><comment><USER38> Alarm --> email and google reader check. GR soon to be Feedly =/

</comment><comment> like-that Coffee & cigarettes

</comment><comment><USER39> (Mistakenly) thinking that I've overslept.

</comment><comment><USER40> The fire alarm in my dorm, today...

</comment><comment><USER41> BLACK METAL

</comment><comment> db-dzine My stomach ...

</comment><comment><USER42> a quote of jim rohn

</comment><comment><USER43> I had serious trouble getting up in college. Someone had given me a bizarre stereo that had an alarm clock that would set off the turntable. I would put Back in Black on vinyl set very loud as the alarm. Once I heard the crackle and high hat count in I knew if I did not get up before the first bar chord I would aggravate quite a few people. Needless to say it never got to the bar chord. :)

<comment><AUTHOR> That's awesome. Playing a card from the psychology deck and making it embarrassing if you don't get up in time. :)

+1 for having Back in Black on vinyl.

</comment></comment><comment><USER44> 5-hour energy.

I'm not joking. Slam one of those right after you wake up and you'll have a really productive first few hours of your day and over time will start to look forward to getting out of bed because of the near-instant high it gives you.

<comment><AUTHOR> Do you slam it while still in bed? or after you're up an moving.

I find that the small gap between in-bed and out-of-bed is the crux of getting up.

<comment><USER45> I'm with you on that - the inbed/outofbed crossover can be a real challenge.

Once I'm up and about I'm generally OK, but those moments of pain when I open my eyes to see it's time to get up and do stuff are the killer.

</comment></comment></comment><comment><USER46> If I have too much money in the bank, I will not get out of bed. So being poor would help.

Once I hit a certain savings threshold, I quit my job because I know the whole (my bank account) is greater than the sum of its parts (putting up with horrible software shops)

Then...I do it all over again.

<comment><USER28> _> I know the whole (my bank account) is greater than the sum of its parts (putting up with horrible software shops)_

I think the saying you're looking for is actually "the ends don't justify the means".</comment></comment>


Can we live 1000 years? - <AUTHOR> http://www.dailygalaxy.com/my_weblog/2007/08/can-science-con.html <comment><USER2> Living a thousand years has some pretty interesting implications.

\- Things that seem safe will become dangerous. Small daily risks, such as crossing a red light, will have a much bigger chance of killing you. If you live 15 times as long the risk is 15 times as big. Expect to see people being insulated from the daily dangers of the world.

\- Our personal drive will diminish. If you want to do a startup (or whatever else that is nontrivial) you have to act now or it might be too late. If you live a thousand years you can do it next month or next millenium, and you won't feel the same pressure to get started.

\- The relation between people that have just reached adulthood and "old" people will be tremendous in terms of experience. Can you imagine the experience of someone that lived through the middle ages, the Roman Empire, the colonization of America, the French revolution and both world wars?

And these are just off the top of my head...

<comment><USER3> Imagine the implications for wealth, too.

If the means of life extension is not hideously expensive, then anyone past a certain age with even the smallest bit of sense will be rich beyond the dreams of mortal men. Compound interest works.

This would have interesting social ramifications. As it is, most states are organized such that the old are relatively rich, the young are relatively poor, and the young's income subsidizes the old's healthcare costs. In a state with some people who are 420 and some people are 20, the Methuselah will be worth $300 million. For _every dollar_ invested back when he was twenty.

<comment><USER4> Regardless of lifespan we are going to move into a post scarcity economy, where wealth won't mean what it does today. We must do it because we can already see the decline of extracted resources like oil and minerals. We will do it because we can. The internet has enabled telecommuting. Telecommuting enables the move to smaller communities where housing is cheaper. As robots get more capable they will take over the manufacturing base.

I think we are closer to a post scarcity economy than we realize. The biggest big ticket item is housing. The biggest item in the cost of housing in sub/urban areas is land. If we disperse to small towns, the cost of land goes down. If housing were really low cost and we telecommuted, maybe 10 or 20 hours of work per week would meet our needs. Suppose we adopted a Peace Corps/Habitat for Humanity model. After school/college a person spent 3 years building housing, including their own? Maybe all he has to mortgage is the land and materials. Maybe not even that.

Add other ideas like a robot taxi service, 3D copying machines, reasonable health care; and the need for much of the need for the credit economy would disappear. I don't view this as a socialist utopia, more a natural evolution of our current market economy. It still has lots of room for entrepreneurs (less for VCs), volunteers, and open source whatever.

<comment><USER5> The only problem with your 10-hour workweek is that, as living expenses go down and people try to stop working, wages drop also (because workers won't complain as much if the cuts won't put them out on the street), so you'll still have to work two full-time jobs to keep your cheap house surrounded by endless farmland.

</comment></comment></comment></comment><comment><USER6> Give me a break. You think you're still going to be running around with fleshy arms and legs and a meat brain after one thousand further years of technological progress? Do you realize that the whole scientific revolution only started five hundred years ago?

No, you will not die "crossing a red light" after living a thousand years. Sheesh, talk about your failures of imagination.

<comment><USER7> It's called a metaphor. I suppose he could have said, "you might die accidentally hitting the wrong button on a hyperdimensional panfibrillator," but people don't generally talk like that, preferring more familiar and concrete imagery. Come to think of it, "1000 years" just means "really big number that's way longer than our current lifespan."

When someone uses an exemplar to describe a class of things, you're supposed to _imagine_ the other objects in that space.

<comment><USER8> Even if I did hit the wrong button on a hyperdimensional panfibrillator, I'd just be restored from my S3 backup.

</comment></comment></comment><comment><USER9> Saying 1000 years is too much is a just a matter of perspective. A few thousands years back, I am sure most people died at around 40. To them living 100 years would be way too much. 1000 is nothing. We will adapt to it and still find ways to be miserable and need more time to do the things we want to do.

</comment><comment><USER10> If extending lifespan from 30 years to 70 years was beneficial, and I believe it did, I don't see why extending it from 70 to 160 wouldn't be similarly beneficial.

</comment><comment><USER11> _Were it to do so, it would undermine what it means to be human._

 _They oppose the idea of life extension and anti-ageing research on ethical, moral and ecological grounds._

 _the finitude of human life is a blessing for every human individual_

Seriously, if you think that dying will give meaning to your life, go ahead and do it. No one's stopping you.

<comment><USER5> These statements (especially the one about "meaning") show how religion affects a person's view of science. For it to <i>mean</i> something to be human, there has to be someone who intends for it to mean something. Once you accept that God is imaginary, the problem of "meaningless humanity" disappears.

</comment></comment><comment><USER12> What's the ultimate end game of living for ever?

Who's read Asimov's "The Last Question" <http://www.multivax.com/last_question.html>

Imagine you can live to 1000 or more, at what point does your brain run out of space for memories?

When you're finally out of room in your memory buffer do you just turn it into a FIFO queue? So you could collect a whole bunch of information you like (like favorite books, music, movies, etc) start consuming at one end, forget that by the time you get to the end and start again. Repeat forever.

Alternatively you could expand your mind, you turn into a cyborg or something. See Asimov's The Last Question again.

Or you could stimulate your (possibly digital) brain's please center - forever.

And this leads me to a theory of what happened to all the other advanced civilizations in the universe.

Assume human like intelligence evolves somewhere out there, then:

Scenario #1: Self destruction.

Scenario #2: External destruction, asteroid or something.

Scenario #3 Super-intellect is achieved:

#3.1 Rational super intellect realized existence for the sake of existence is pointless and quits.

#3.2 Irrational super intellect wants to exist rational enlightenment be damned. Irrational intellect expands and expands.

In other words, if some alien species out there advanced enough to reach trans-humanism (or trans-alienism hardi har har har) then it probably also transcended any irrational genetic fear of death and then promptly took a bow and exited stage left.

I guess what I'm saying is you're doomed either way.

Either you are primitive and doomed to die a natural death.

Or you're super advanced and too smart to fear death, then you have something to do for a while but eventually...

<comment><USER13> So your assumption is life is pointless so kill yourself? Are you going to be the first person to test this laughably pessimistic hypothesis?

I'm a thousand times smarter than my pet rabbit, I've yet to even try suicide because its patently moronic. If human beings were a thousand times smarter than they are today then there's a high probability that less people will commit suicide as they'll finally be smart enough to realize it's not a solution to a problem.

Human culture is so diverse that even in 1000 years you'd barely manage 5 years in each country on the planet. I mean just look at how different human culture is today than it was 1000 years ago. We're talking the difference between Monarchy and Democracy in the entire western world.

There's no law of conservation of information, there's no finite limit to the amount of data in the universe. It's not like once a thousand books have been written you're stuck with them, there's going to be more and more unique information as the universe ages. A being with an infinite lifespan is going to have a lot of time experiencing all there is for humanity to offer before it even has to create something itself, even then it could likely explore the universe to find another culture to experience. I'm sure if you're going to live forever and spent 10,000 years experiencing humanity, it might not seem too long to take a quick 100 year jaunt to another star system to spend 10,000 years experiencing alienity.

<comment><USER12> I wouldn't just kill myself for several reasons, but the two top ones are:

First, I am afraid of death.

Second, I am mortal and my death is a certainty, there is quite literally no point in rushing it.

So there you have one emotional instinctive reason and one logical one. And I have to agree with you suicide is moronic.

And perhaps 1000 years is not nearly enough time to become bored. But how about 1000 000 years? More?

My question was about the veeeeeeeeeeeeery long run, do you think you'll find life interesting for ever?

<comment><USER14> The problem with death is that it's irreversible.

If I'm bored today, I might still find something interesting tomorrow.

If I'm dead today, I'll still be dead tomorrow.

<comment><USER12> How likely are you to find something new and interesting if you are a universe sized super intellect?

<comment><USER15> I'll think of something.

</comment></comment></comment></comment></comment></comment><comment><USER16> I'd be happy with any radical advance in anti-aging (even extra 50 years would be significant). Alas, I fear the breakthrough may not come within our lifetimes. The article does nothing to dispel my pessimistic notions.

</comment><comment><USER17> I can state confidently that there are no fundamental physical laws preventing 1000-year lifespans. There aren't even fundamental biological limitations--- lots of organisms live that long. At this point it's "merely" a (very difficult) engineering problem.

</comment><comment><USER18> For the religious point of view:

I hold that if god did not want people to live to 1000 he would make it impossible to do so.

If it's possible, then god must be OK with it.

He was pretty specific about all the "possible but don't do them anyway" things after all, so no need to add some new ones.

<comment><USER19> From another religious angle - As I understand - prior Noah/Flood - the Bible records humans living long lives. (Say 1000 years)

Post flood / Noah - Humans were limited to 120? Or something like that?

Found the quote: Genesis 6: 3 Then the LORD said, "My Spirit will not contend with [a] man forever, for he is mortal [b] ; his days will be a hundred and twenty years."

So the religious interpretation could be: a) See this proves Chapters 1-8 of Genesis b) God will curse you / etc / etc

<comment><USER20> Isn't that interesting that the biblical limit is so close to the current outlier lifespans?

<comment><USER21> I assume 2000 years ago some people would live about that long. It's going to be a smaller percentage of a smaller population but the are reasonably healthy 105 year old people in the world today so I assume there were a few back then.

</comment></comment></comment></comment><comment><USER22> The third world country's / developing country's. How would they get a piece of this? I'm quite sure they wouldn't - or if so, it would be an order of magnitude below what the western world would have. Already more than enough to go to war for, by the havenots.

And resources? Would we just ultimately end up allowing 1 child per 1k couples to try and stem the rampant population explosion and resultant resource drain?

Would we tackle extreme age with a longevity based tax on a log scale?

It's the little things that add up and kick us in the arse, because even though we could live 12 times longer, the human condition would not advance anywhere as much.

</comment><comment><USER23> I wouldn't want to. I can barely tolerate family reunions now, no need to make them fill a stadium.

</comment><comment><USER24> I'm indifferent on whether we should want/attempt to live longer than natural life spans. Either way sounds good and bad.

</comment><comment><USER25> A 1000 years of memories could drive any one insane, i mean, what is our mental capacity? I'm sure we could keep the body alive and healthy for a long period of time, but a 1000 years is probably too much. The brain would have to adapt somehow, we would probably forget most of our experience and only keep the most important memories, our brains were designed for 30-40 year life- spans, nature really didn't intend us to live as long as we live today. We've managed so far by forgetting stuff thats not that important, but how would our memory management work in a longer period?

</comment><comment><USER26> It would slow down technical innovation.

People grow accustomed to their surroundings and find newer technology suspicious and unneeded. That's why leaps in innovation are most easily embraced by the generations born with them (ie., current teenagers using computers for communication where their parents use phones).

If people can live 1000 years, that would cause overcrowding of the Earth. So if we don't expand to other planets, there would need to be some kind of very serious birth control.

This would increase the average age of Earth's population and, as discussed before, make them less interested in innovative products.

<comment><USER27> If we can get to the point where we're reversing aging, I think we can safely assume reversible sterilization.

Use an economic solution (really simplified here): When you receive anti-aging treatment, you're temporarily sterilized. Each person then gets 1 credit for a child. 3 credits are required to bear a child. One can purchase or sell their credit for children as one would like.

For the first time in human history, if one wants children, they'll have to put conscious effort into it. Only those who _really_ want children will have them.

...unless you don't want anti-aging treatment, then you can have as many kids as you'd like and become 'immortal' the old fashioned way.

<comment><USER28> I'm not sure it would be necessary. Kids in developed nations are already considered optional (vs. undeveloped countries where you put your kids to work so you can eat) so as people get accustomed to having more time to raise kids then they may seem them as much less of a priority and birthrates would continue to decline to offset the increased lifespans. I do wonder what people would consider to be the age of maturity at which you are expected to be on your own. Would people expect to be cared for by their parents until they are 300?

</comment></comment></comment><comment><USER29> Hate to sound cynical, but I have to ask: why would technology like this be made accessible to the average person? What would be the economic payoff? Seems to me that this will be a technology for elitists, first and foremost. Or you would have to 'earn' it in some way. Would the 'unproductive' among us be allowed to have access to technology that increases their lifespans?

I'm pretty sure Larry Ellison is reading this story from his volcano lair about now, just barely holding back his maniacal laughter. :)

</comment><comment><USER30> I think an interesting side effect of extremely long lives would be people would be a lot more careful.

Driving fast, not wearing a seatbelt, skydiving, going to war, heck even leaving the house would be considered crazy. who would want to risk ending their lives in an accident if they could live for another healthy 900 years?

<comment><USER28> I'm not so sure. Did people become twice as cautious when life expectancy doubled in our fairly recent history? The retirement age of 65 was originally set because it was deemed so unlikely that anyone would reach it, now it is almost considered a given that people will live past it and I don't think people have become more cautious as a result. The other thing is that if people feel that medical technology has advanced enough that they can be pulled through ever increasing traumatic circumstances they are more likely to attempt higher risk behavior.

<comment><USER18> "Did people become twice as cautious when life expectancy doubled in our fairly recent history?"

Yes! Very much so they did.

So many sports have been gutted due to "safety", chemistry sets have most of the good stuff gone for the same reason. Kids can no longer just go and do what they want because it's "not safe".

People took far far more risks in the past.

<comment><USER28> This is probably more due to companies trying to protect themselves from lawsuits and a greater understanding of how to safely to things than any conservative attitude developed due to an increased life span. People routinely jump off cliffs with every expectation that they will live, given the appropriate safety measures these days, and the Darwin awards do not seem to be lacking any candidates.

</comment></comment></comment></comment><comment><USER31> If you live 50 years from today you'll probably live 1000, but if you live 1000 years you'll probably live until the fundamental laws of physics leave no possible means for your survival. Why would you stop at the limits of biology?

</comment><comment><USER32> Imagine that everyone had time to get education, have several generations of kids (& debug the process), maybe figure a few things out.

OTOH, we'll have to explore space, as we'll quickly run out of room.

</comment><comment> ryan-allen Someone please quote The Eyes of Heisenberg by Frank Herbert! In fact that book is a take on living for, well, ages. :) I enjoyed it.

</comment><comment><USER33> methuselah lived 900 years, methuselah lived 900 years, but who calls that livin when no gal will give in to no man who's 900 years

<comment><USER34> Maybe the downvoters just don't recognize "Porgy and Bess"? Regardless, it was relevant commentary and not deserving of a downvote.

</comment></comment><comment><USER35> No. We have shockingly little control over basic diseases and health issues. This de Gray character is just an attention whore.

<comment><USER36> I'm surprised there are so few mentions about that.

I smashed an ankle a few years ago racing a motorcycle. The ankle is mostly fine, I can walk, hike, climb a mountain, lift weights, or just stand for as long as I want. It doesn't hurt. Jumping though is not OK, and neither is dancing (not that I dance anyway, but still) or running. It looks like it can't be fixed 100%. So, if such a comparatively trivial thing can't be fixed, how can they talk about immortality?

I don't see immortality becoming less than a dream until we are able to fix the vast majority of diseases and health issues. The simple fact that we can't do that is a sign that we're pretty far from understanding our biology.

<comment><USER37> I think most of the issues with your ankle are simply problems of mechanical engineering. Total ankle replacements exist now, they just aren't very good.However, I find it highly unlikely that in the next 10 years, incremental improvements to artificial ankles will not lead to ankles capable of jumping, dancing and jogging.

</comment></comment></comment><comment><USER38> I think it's optimistic to state that the first 1000-year-old is alive today. We don't know anything about the challenges that a 200+ year lifespan will pose. What scares me is that imperfect, expensive forms of "immortality" will exist before the desirable, cheap ones. I wouldn't want to "make the cut" but be demented for 900 years.

I think I'll die at a relatively normal age, between 70 and 100, and that the first 200-year-old will be alive when I die. I make no projections about 1000, much less over 9000.

</comment><comment><USER39> I don't know, but I hope we get space colonization first, or it's going to get awfully crowded and competitive around here.

<comment><USER40> It would be some pretty big spaceships that could outpace the birth rate.

<comment><USER41> ...or very numerous. If wealth keeps trending upwards, then anyone who wants will be able to afford their own ship out, as the wealthy can all afford yachts today.

</comment></comment></comment><comment><USER42> so the question is. what happens at 1000 that kills us, and why aren't we solving that problem?

WTF didn't anyone see this coming? might as well just die now if it's all going to be the same...

<comment><USER43> ISTR that, on average, people would live to be 1000 on average if they died only from accidents/violence rather than disease and old age.

The age distribution would be different. With the simplifying assumption that everybody's chance of dying in a given year is the same, the mortality rate would be proportional to number of people alive, which means that 1000 years would be a half-life. So you'd see 1/8 of the people living to be 3000 or more years, 1/16 living to be 4000, etc.

</comment></comment><comment><USER44> ?

First of all we would have _not_ to kill the not yet born ones. This would be the very first step necessary.

The next step necessary would be _not_ to help to kill the old ones.

Currently we have no real respect neither for the not born ones, nor for old ones.

In other words: currently we still (kind of) _hate_ life.

</comment><comment><USER45> No.

</comment><comment><USER46> Imagine the number of people competing for jobs.

</comment><comment><USER47> Imagine having been born in the year 1100 and still be alive with about 90 years to go.

PS: For what it's worth, humans actually did live for about 900 years on average until the Great Flood---if you believe in the Bible.</comment>


Lab explosions and accidents - <AUTHOR> http://uvicrec.blogspot.com/2015/12/lab-explosions-and-accidents.html <comment><USER2> Once upon a time, in the nuclear submarine navy, my shipmate tags out the ship's battery breaker. As part of the tagout, he checks that the ship's DC bus is deenergized - within the battery breaker box itself. During the check, he finds some voltage, which isn't entirely unexpected, since there is enough capacitance on the DC bus to hold it charged for a while. So he uses a specialized grounding probe - about 1/8" diameter copper rod with a reinforced handle - to discharge it. Unfortunately, he has misunderstood what was inside the breaker box and is actually shorting out the ship's main battery! This is a couple hundred volts DC, and a few thousand amp-hours of capacity, and it delivers enough current to instantly vaporized the grounding rod. He's knocked on his ass by the arc blast. Fortunately, he was correctly considering the box to be energized gear and was wearing a full set of PPE, suffering only minor flash damage to his eyes.

<comment><USER3> Lucky guy, lucky too he used a relatively thin rod, a thicker one and it would have been quite a different ending.

I did a similarly stupid thing one day. While repairing a clock for a display on a trade show I hooked the ground crocodile clamp of my scope to what I thought was the ground but which in fact was V- of the DC supply voltage of the neon light installation that was use to drive the display. I had a blind spot in the middle of my eyes for many days after that (and took out a fairly large chunk of the mains supply for the Eastern district of Amsterdam). The crocodile clamp totally disappeared, the scope, miraculously survived and wasn't even out of spec.

Every time I use a crocodile clamp to hook it on to something I think back to that moment when the clamp makes contact and some part of me expects it to happen again.

<comment><USER2> > I hooked the ground crocodile clamp of my scope to what I thought was the > ground but which in fact was V- of the DC supply voltage of the neon light > installation that was use to drive the display.

Yeao! I own a couple of high-voltage differential probes for this very purpose. Even though most single-ended scope probes are rated to 300V Cat II, I won't go anywhere near main's power with them.

</comment></comment></comment><comment><USER4> Early on in my 'take things apart for fun' youth, I knew that capacitors held a charge long after power was removed. So when disassembling a camera with built in flash, I popped off the small board holding the 330V capacitor and thought it would be a great idea to discharge it using the end of my needle nose pliers—for the tiny capacitors I'd done this to before, it might've caused a tiny spark, but nothing more.

Well, I learned a valuable lesson that day; even relatively harmless camera flash capacitors can pack quite a charge days after a battery's been removed!

The giant spark made me jump back and fall over my chair, and my pliers still have two nice molten burn marks where it touched the contacts. I'm just glad the pliers had rubber handles!

I'm much more cautious around capacitors these days.

<comment><USER5> Not to brag, but my friend Sean and I are much dumber than you. We took the capacitors out of two disposable cameras and hooked them up inside the casing of a 9v battery – our "9V Taser", we called it. Looked great, but then of course we needed to test it. We decided to do the honorable thing and self- experiment; being the younger and slightly more foolish, I was the subject. We charged it up and he touched it to my arm. I remember my heart sort of "skipped" and I felt really weird for the next couple of hours. Ah, youth.

<comment><USER6> Similar, but stupider, in my mid 20s while in the Air Force my buddy and I built a rail gun out of disposable camera capacitors. It didn't take long after getting the first capacitor out for us to wonder and discover what it would feel like to short the leads on our skin. That soon turned into a game of tossing a loaded capacitor to the other at various times throughout the day in the hopes that the natural reaction of catching something tossed your way would kick in before the brain figured out what it was catching. Your tax dollars at work.

</comment></comment></comment><comment><USER7> In chemistry class in middle and high school, I thought all the safety precautions we took were stupid, given that we were using harmless chemicals to do harmless experiments. I wish this had been around, and it had been required reading--I would have all about that safety gear.

</comment><comment><USER8>
        Takeaways:
        Don't store strong chemicals in your bedroom

Some of these seem the wrong side of irresponsible

</comment><comment><USER9> Darwin award applicant.

 _" I had made some gunpowder and had some sitting on an outside table. I was experimenting with fuse design and was burning a fuse 6 feet or so away."_

 _" I bought some H2SO4 and used most of it immediately. Unfortunately the original plastic bottle didn't fit in my cabinet. So I transferred the contents to a couple of small plastic bottles. Finally, the cabinet was temporarily blocked so I decided to temporarily store them on a shelf next to my bed."_

 _" I had a few hundred mL of acetone and H2SO4 waste stored in a glass peanut butter jar."_

<comment><USER10> Yeah, I enjoy occasional shenanigans with dangerous items and substances as much as the next nerd, but this guy is just plain reckless. He needs to find something else to do, preferably before something tragic occurs.

He's incredibly bright (the X-ray machine with the 2D positioner is just plain brilliant) but he just doesn't seem to think far enough ahead.

</comment></comment><comment><USER2> That 450VDC electrolytic capacitor wasn't the worst failure I've experienced with such a device. I had one let go about 3 meters away from me. It sounded like a shotgun had gone off, and left my ears ringing for a few minutes. There wasn't anything left but the terminals.

<comment><USER11> Reminds me of a similar situation. We were working on a device powered by what looked like a 6 pack of 16 Oz cans caps charged to 500V. SCRs controlled the discharge of the capacitors into the device and caps were charged in opposite polarity so that the device could deliver current in opposite polarity depending on which way the mechanism was to move. There was a flaw in the logic that controlled the SCRs and in some circumstances both directions were on resulting in a direct short between the two banks of caps, discharging all stored energy in a fraction of a second (about 300 ms IIRC) That resulted in catastrophic failure of the SCR which propelled pieces of casing across the room and left my ears ringing.

I asked that a cardboard box blast shield be placed over the H/W before participating in further tests.

</comment></comment><comment><USER12> Fantastic! I love reading accident reports, for some reason. There's so much practical knowledge contained in them.

</comment><comment><USER13> > Think twice before "stop, drop, and roll" as the floor may be on fire

Wow. Just... wow.

</comment><comment><USER14> In school we had a public display exhibition - a series of LEDs mounted on PCBs with shifters. Like, you put in a color at the first PCB and pressed the "shift" button and the color would shift through the chain, the color of the last PCB in the chain would vanish. Each PCB had a capacitor on the 12V supply rail.

So, I needed to swap the PSU because we planned to add more of them, and I plugged it out - and cut the supply cable with a scissor. Twelve capacitors blew out (I believe because the ICs turned off the power of the LEDs before the caps were discharged, they were ridiculously huge anyways)... right in the middle of school day, and a week before there was some retard running amok and killing students.

tl; dr: Shorted 12 caps, huge explosion sound, peoples panicked and thought of a school shooting.

</comment><comment><USER15> I'm almost glad I didn't pay more attention in chemistry class because I'm sure I'd do some of these blunders.

</comment><comment><USER16> > This released profuse magic smoke and severely damaged the power supply.

Magic smoke needs a magic fume hood or being outside ;-) I can't say for sure, but I would err guessing a lot of smoke coming out of exploding or burning electronic components is not good for you.

</comment><comment><USER17> How is this dude not dead yet?!

<comment><USER18> This dude is really passionate. I don't know anyone who did chemistry for fun, let alone had any budget and enough parent leniency to do it before 18yo. As he grows up you notice he talks more and more about security gear.

I don't know how someone can get into chemistry before 18. I understand reactions that are presented to me, but how do you get the initiative of trying something new? How can I be confident those are the _only_ reactions that happen? OP has only produced H2S by mistake a few times in his life, far fewer than I'd expect anyone experimenting to produce unexpected chemicals.

<comment><USER12> > I understand reactions that are presented to me, but how do you get the > initiative of trying something new?

This is what kids do naturally, before they know any better. A lot of kids experiment with chemistry. The trick is keeping them alive and unmangled until they develop a respect for what they're working with.

<comment><USER2> In my attempt not to drill my young kids' exploration out of them, I tell them that "X is a tool, not a toy!", for values of X like knives, fire, light sockets, etc. And then promptly talk about how to use them :)</comment></comment></comment></comment>


Detecting harm from low-dose paroxetine through the Darwinian toxicity test [pdf] - <AUTHOR> http://www.gwern.net/docs/2015-gaukler.pdf

<comment><USER2> Paroxetine is probably better known (at least in the U.S.) by its brand name "Paxil". It's a widely used SSRI drug used for treating depression, OCD, etc.

</comment><comment><AUTHOR> "Low-dose paroxetine exposure causes lifetime declines in male mouse body weight, reproduction and competitive ability as measured by the novel organismal performance assay", Gaukler et al 2015; excerpts: [https://plus.google.com/103530621949492999968/posts/GbZQ48k5...](https://plus.google.com/103530621949492999968/posts/GbZQ48k5PZh)</comment>


Links sent privately through Facebook Messenger can be read by anyone - <AUTHOR> https://medium.com/@intideceukelaire/why-you-shouldnt-share-links-on-facebook-f317ba4aa58b#.mwoeohl1b <comment><USER2> Facebook's response seems inadequate. Because let's be frank here:

1) There are obvious security concerns thinkable. For example, plenty of websites (google docs, dropbox etc) offer an 'anyone with this link can view document' option. Which is generally safe, given these randomly generated links usually contain > 100 bits of entropy. Access to the link is access to the document, and so the link is a PW.

2) This link can be publicly accessed, despite having only been published in an ostensibly private FB conversation. Facebook has now admitted that the contents of a private conversation can partially be public. That's ridiculous. Not just because it's not safe, there are more things that aren't safe (e.g. sending risque images on Snapchat). But mainly because it's against expectations. Snapchat told me on my first day of usage, in the app, that my friends can save my snaps and that I should keep this in mind, and while many users of Snapchat use it recklessly, I would guess that most are aware of the risks. Users carry much of the burden of responsibility now. But there's no such awareness of the risks of partial contents of a private facebook conversation not being publicly accessible, nobody is aware of this.

3) The response seems wholly unnecessary. It seems to me relatively trivial to require a security token to see this data, much like the rest of the chat itself.

Now I'm not particularly alarmed by the issue itself, it's one of those 'safety in numbers' kinds of things. A hacker would likely be more effective setting up a phishing website and buying an email database, than to collect links and then review them for sensitive data. But the response of FB feels inadequate and unnecessary to me.

<comment> tuna-piano Couldn't an attacker simply run a script (from multiple source IPs) to get a large number of FB Messenger URLs - then parse the results for specific things - dropbox links, google docs links and other services that are secured through a long URL? I would guess there are examples of services that would be high value to attackers and are secured through the URL... although I can't think of any in particular.

</comment></comment><comment><USER3> This is one of the reasons many corporations have rules about only using internal messaging applications. Or, block external messaging apps. In environments I've managed, I've always enforced the rule: Anything confidential sent via a messaging app is no longer confidential.

Skype, Facebook & G+/GTalk have all "followed" URLs sent via their applications for at least a few years (that I have noticed). Anti-virus applications installed on computers have done it with URLs in email applications and such too.

One of the large A/V vendors (Trend or McAfee, I don't recall which) had a browser plugin that would follow all of your browsing activity. I used to be amused tailing logfiles to see a hit from a browser, then one of their corporate IPs with a "crawler"-like UA come along a few seconds later.

 __EDIT last line for clarity.

<comment><USER4> While that in itself is not necessarily desire behavior, the fact that this link is accessible to parties not part of the chat is by far the bigger problem.

<comment><USER3> Definitely. But, it wouldn't be a problem if people understood the implications of using external services in the first place (or were unable to do so via technical means).

</comment></comment></comment><comment><USER5> After hearing about people arrested for the content of their private chats on Facebook I basically act under the assumption that everything I do on Facebook is public.

<comment><USER6> Source? I'd really like to know more about this.

<comment><USER5> [https://www.cnet.com/news/facebook-scans-chats-and-posts- for...](https://www.cnet.com/news/facebook-scans-chats-and-posts-for-criminal- activity/)

<comment><USER7> While catching child predators and murderers is a good thing, I can't help but consider that if facebook operated in china, they'd be catching political dissidents, or if facebook operated in uganda, they'd be catching homosexual users.

<comment><USER5> Exactly. Ideally the communication should be encrypted in a way such that Facebook couldn't decrypt it if they wanted to.

</comment></comment></comment></comment></comment><comment><USER8> FB also considers "won't fix" a bug I found a while ago that allows anyone to send anyone else on FB a spoofed email that comes from @facebook.com, without knowing their email address ¯\\_(ツ)_/¯.

<comment><USER9> That's pretty severe surely. Any more information?

<comment><USER8> Not sure I'm comfortable with full disclosure as I still consider it potentially harmful (phishing mostly, or sending unsolicited emails without knowing the fb login email of a user)

Maybe I should try to report it again on Hackerone, as this was reported through the old whitehat program and the guy who answered never fully addressed the issue or replied to my follow up

<comment><USER10> Sunlight it, if they won't change it. Bad publicity and bad behavior from other actors will only increase the likelihood that the bug gets fixed.

If a company won't listen you've done your moral duty. The last step of responsible disclosure is publication. As a bonus, you'll probably even frontpage HN.

<comment><USER11> Agree.

Plus he has given lot of pointers so it's a matter of time someone find the comment and start trial-and-error to discover how to exploit the bug.

</comment></comment></comment></comment></comment><comment><USER12> This probably isn't a popular opinion, but I fail to see how this is a problem with Facebook.

The Google Docs URL is public whether or not you send it through Facebook. It's only secret until someone guesses the link (Edit: maybe not mathematically in the case of Google Docs, but many other services use 'unlisted' URLs without having a long token to guess) - something they can do without the URL even going through Messenger.

If you're sharing passwords or confidential information via a public URL with no authentication and hoping nobody finds the address, you're asking for trouble. I don't blame Facebook for not doing anything about it.

<comment><USER13> > It's only secret until someone guesses the link - something they can do > without the URL even going through Messenger.

Not really - a sufficiently large random number is effectively unguessable in your lifetime. This is no different than sharing a password with your partner in a private Facebook chat and discovering that outsiders can stumble on it.

<comment><USER14> Your one particular file is effectively unguessable, but that does not mean that guessing at files is a fruitless endeavor.

<comment><USER15> No, actually. It really doesn't take that many bits of entropy for you to be unable to find _any_ documents in a haystack of entries. My file ID is 45 characters of base-64 encoded string. This is a total entropy of 225 bytes. If there are a quintillion files in google drive (a hundred million files per person who has ever lived), you were loading a million possible files per second, you'd still take several times the expected time to the heat death of the universe to randomly stumble upon one.

</comment></comment></comment></comment><comment><USER16> [https://m.facebook.com/composer/mbasic/?csid=2d645076-9e83-4...](https://m.facebook.com/composer/mbasic/?csid=2d645076-9e83-4e08-8b4b-d34978d631d5&cwevent=add_privacy&av=100001516340790&view_overview&privacyx=286958161406148&_rdr) I was sent this link but upon opening it I'm redirected to a page that says I am not permitted to view such. Can anyone explain to me why I was sent this and what it could potentially mean?

</comment><comment> tuna-piano It's infuriating to me as a user that certain aspects of a private 1-1 conversation are made public for a "feature" as trivial as a link preview, especially when it seems the fix would be as simple as having a larger, random identifier.

Does anyone know what will happen when Facebook Messenger is encrypted end to end?

</comment><comment><USER17> This is only a lapse in security if you're relying upon URL obfuscation for security to begin with. It is only actionable if you can MITM or otherwise easedrop and find the graph ID.

Title rating: unreasonably alarmist

<comment><USER18> > This is only a lapse in security if you're relying upon URL obfuscation for > security to begin with.

Which is perfectly reasonable to do: a URL containing a cryptographically- secure identifier is itself a cryptographically-secure identifier. An example would be [http://foo.invalid/ed2e898ff0b132202cb0bd0dea0d389a7b6439160...](http://foo.invalid/ed2e898ff0b132202cb0bd0dea0d389a7b6439160b9aca5f3edcd99ad34bc2a9).

Another example would be OAuth2 bearer tokens, which may be encoded in the URL as a parameter.

> It is only actionable if you can MITM or otherwise easedrop and find the > graph ID.

It looks like the graph IDs are enumerable, rather than being high-entropy, so it looks like you can trawl through the graph looking for interesting objects.

</comment></comment><comment><USER18> Were they using 256-bit random identifiers then this wouldn't be a problem. In that case, the IDs would serve as capabilities to the resources.

<comment> tuna-piano Anyone know why they would choose to use incremented integers and not 256-bit identifiers? This seems like a gaping hole to me that makes me uncomfortable sharing links in the tool.

I would much, much, much rather not have link previews than be open to this sort of simple exploit.

Seems like someone could just write a script to pull down a few thousand links, and then search for links from specific sites, private Google Docs documents, etc.

<comment><USER19> In an earlier thread about this I wrote [1] that the contributing factors FB does aren't egregious by themselves. Specifically, in their view all of their link previews are public, as they were originally intended to catalogue the web.

Having predictable, incrementing integers as IDs for public resources isn't a problem. The problem is most people perceive Messenger as a private chat, and don't expect their privately-shared links to be catalogued in a publically accessible, trivially crawlable object store.

[1] [https://news.ycombinator.com/item?id=11873258](https://news.ycombinator.com/item?id=11873258)

</comment></comment></comment><comment><USER20> Does Facebook's response not having capitalization also worry anyone else more than the security hole? ;)

</comment><comment><USER21> I've been using the destructible.io for temp links. It was posted here not too long ago, useful and if anyone else tries to access it, it deletes itself [https://destructible.io](https://destructible.io)

</comment><comment><USER22> This reminds me of the similar thing in Microsoft Office recently: it automatically shortened all links in documents, even private ones, with a URL shortener service. URL shortener services are, by design, easy to brute force enumerate. Cue popcorn...

<comment><USER23> The relevant blog post:

[https://freedom-to-tinker.com/blog/vitaly/gone-in-six- charac...](https://freedom-to-tinker.com/blog/vitaly/gone-in-six-characters- short-urls-considered-harmful-for-cloud-services/)

</comment></comment><comment><USER24> Related to this, the W3C maintains a best-practices document about private ("capability") URLs:

[https://www.w3.org/TR/capability-urls/](https://www.w3.org/TR/capability- urls/)

</comment><comment><USER25> What about WhatsApp? It fetches a page's title as soon as you type in a URL. I assume the fetching happens on the client, but does the URL (or the title itself) get uploaded somewhere?

<comment><USER26> That would be more worrisome given that Whatsapp is supposed to be encrypted end-to-end.

</comment></comment><comment><USER19> Also see previous for more discussion: [https://news.ycombinator.com/item?id=11868077](https://news.ycombinator.com/item?id=11868077)

</comment><comment><USER27> The first thing I did was share this particular link on Facebook :)

Precisely because of what the article says.

</comment><comment><USER28> Please. Delete. Your. Accounts. What are you waiting for? Challenge: Start a decentralized FB clone. Evangelize.

</comment><comment><USER29> Is it bad that the thing I most want to do with this story is share a link to it on Facebook?

</comment><comment><USER30> Why asking friend to share a link? Isn't it easier to log in using secondary account...

</comment><comment><USER31> How would you know the Graph ID number if someone doesn't explicitly tell it to you?

<comment><USER32> > I wrote a quick script that would take any identification number and > increment it gradually to discover other links. It worked

Apparently the numbers, while non-sequential, are not sufficiently large and random to be 'unguessable'. Take a known point and look around it, see if you get something good.</comment></comment>


Deconstructing the Computer Guy [Fitness] - <AUTHOR> http://www.t-nation.com/free_online_article/sports_body_training_performance/deconstructing_computer_guy

<comment><AUTHOR> This is an old article (couldn't find the date), but, if you can ignore all the body builder marketing, it's a great set of tips about what to do in the weight room.

Also has a second part: [http://www.t-nation.com/free_online_article/sports_body_trai...](http://www.t-nation.com/free_online_article/sports_body_training_performance/deconstructing_computer_guy_the_other_23_hours)

I've been lifting weights and training for about five years now. Lifting is one of the best things you can do for your health.</comment>


List.js » Version 0.2.1 - <AUTHOR> http://jonnystromberg.com/listjs-0-2-1-release-notes/

<comment><USER2> Link to the project's homepage: <http://listjs.com/>

</comment><comment><USER3> Love the inclusion of fuzzy search.

</comment><comment><USER4> Good work!</comment>


Ask HN: Privacy aware anti-theft phone apps? - <AUTHOR> Recently a friend lost their phone. They did not enable the phone tracking software that came with the phone due to privacy and data security concerns.<p>Are there any app's that track the phone and before sending to server encrypt the data in a manner only the user can later decrypt (https://en.wikipedia.org/wiki/End-to-end_encryption)? <comment><USER2> Good old [https://preyproject.com](https://preyproject.com) ?

<comment><AUTHOR> thanks for the recommendation. I couldn't find anything about e2e encryption or encryption before send to server in their documents. Typically this shows up, at least, as a statement indicating that the data is stored on their server in a way that even they are unable to read it.</comment></comment>


A quarter of Iceland´s cabinet members held offshore companies - <AUTHOR> http://panamapapers.sueddeutsche.de/en/ <comment><USER2> Presumably the translation screwed up and this should be "A Quarter ..." but either way, the writing style reminds me of the show "Blacklist" in the US. And while I have no idea how one might cross check the information, I do recognize that there is a lot more "light" being shown on various financial schemes and that is really interesting to watch.</comment>


Ask HN/PG: Y Combinator Program Questions - <AUTHOR>

Asked this earlier, but it got buried really quickly.
1) Do you use the noprocrast setting to evaluate potential founders? If noprocrast is set, do you assume that person can't stay on task and err to the side of caution?
2) Have you accepted any idealess teams into the YCombinator program this session?
3) If you're funding idealess teams, are you using ideas from prior rejected applications where you didn't like the original team and pairing an idealess team with one of the good ideas from a previous submission? <comment><USER2> No, yes, no.</comment>


Matchmaker, find me a grant - <AUTHOR> http://www.nature.com/news/matchmaker-matchmaker-find-me-a-grant-1.21191 <comment><USER2> > At present, Instrumentl covers non-human biology (including zoology, botany > and marine science), ecology, evolution, agriculture, soil science, Earth > science, palaeontology and environmental science.

No computer science yet :/ Finding grants and applying truly is a time sink.

Leo Szilard predicted it years ago:

> "but then why not do something about the retardation of scientific > progress?"

> "That I would very much like to do," Mark Gable said, "but how do I go about > it?"

> "Well," I said, "I think that shouldn't be very difficult. As a matter of > fact, I think it would be quite easy. You could set up a foundation, with an > annual endowment of thirty million dollars. Research workers in need of > funds could apply for grants, if they could mail out a convincing case. Have > ten committees, each committee, each composed of twelve scientists, > appointed to pass on these applications. Take the most active scientists out > of the laboratory and make them members of these committees. And the very > best men in the field should be appointed as chairman at salaries of fifty > thousand dollars each. Also have about twenty prizes of one hundred thousand > dollars each for the best scientific papers of the year. This is just about > all you would have to do.

<comment><USER3> Where did Szilard write this? If you had a reference, I'd be grateful.

Research funding was easier a century ago: [https://dirnagl.com/2014/01/14/otto-warburgs-research- grant/](https://dirnagl.com/2014/01/14/otto-warburgs-research-grant/)

<comment><USER2> [https://www.goodreads.com/book/show/1099497.The_Voice_of_the...](https://www.goodreads.com/book/show/1099497.The_Voice_of_the_Dolphins_and_Other_Stories)

:)

</comment></comment></comment><comment><USER4> We went through YC with Instrumentl and they are a phenomenal team.

Also, a great example of solving a real, impactful problem. Why someone would invest in the thirteenth food delivery app over something to help science do science is beyond me.

</comment><comment><USER5> Any know of a site like this that is targeted at non-profits?

<comment><USER6> Instrumentl is used pretty heavily by nonprofits, however nonprofits working in the fields of science education and environment (at the moment). What fields are you working in?

<comment><USER5> Education these days (specifically Tribal Community College and Vocation)

</comment></comment></comment><comment><USER7> It is not said there on their website. Is it for the US-only researchers?

<comment><USER6> We're not restricted by the researcher's location or their citizenship (many of our users are international) but we're focused on aggregating funders based in the US.

<comment><USER7> So you do not list opportunities presented in Horison 2020 and other EU research frameworks, right?

<comment><USER6> We do list some, but I wouldn't call us comprehensive yet :)</comment></comment></comment></comment>


The eleven nations of the United States and their cultures - <AUTHOR> https://www.businessinsider.com/the-11-nations-of-the-united-states-2015-7 <comment><USER2> American state boundaries clearly do not reflect these national regions. Federal states have boundaries that either serve to unite separate territories or to administer a united territory. It has probably a source of strength in the US, that states are either much too small or contain multiple different areas in them, since it fosters a broader, national US identity rather than an identity as a New Netherlander or a Far Westerner.

If Americans tried to reorganise their boundaries along the lines of the article's map, they would probably stop "coming together" and start "moving apart" in the course of a few generations. In the short term, though, it would probably ease a lot of the pressure currently felt.

Germany is another federal state made stronger by having internal boundaries that don't reflect historical identities (Bavaria being the weakness), and which has been able to foster a unified national identity in the past seventy years despite excluding Austria and losing much territory.

Canada's borders are more ... logical and accurate (visible in the map), and their federation is much weaker for it. The long border with the culturally similar US probably contributes to the weakness of Canada as a federal state.

<comment><USER3> Switzerland seems to be doing OK as a counterexample. Its cantons have a high level of self-government and a history as independent states and cultures. Yet Switzerland is a prosperous country with a strong national identity and minimal talk of secession by the cantons.

<comment><USER4> Being a much smaller country, in terms of land and population, I would assume variations within must be lighter too.

<comment><USER5> I don't understand what you mean by "lighter". You're aware that Switzerland has four national languages, right? That's a big variation!

</comment></comment></comment></comment><comment><USER6> It's interesting to see how canned phrases to represent certain concepts can become nonsensical when put together :

> The Deep South was established by English slave lords from Barbados and was > styled as a West Indies-style slave society, Woodard notes. It has a very > rigid social structure and fights against government regulation that > threatens individual liberty. Alabama, Florida, Mississippi, Texas, Georgia, > and South Carolina are all part of the Deep South.

The pro- slavery rigid society that somehow values individual liberty? Would anyone be able to explain how that works?

<comment><USER7> > The pro- slavery rigid society that somehow values individual liberty? Would > anyone be able to explain how that works?

It only valued individual liberties for free individuals, like slave owners. Slaves are by definition not free individuals, so the right to individual liberty by definition didn't apply to them.

It's practically tautological if you substitute the word "liberty" with "freedom".

<comment><USER8> No, it's far from a tautology. A strong belief in individual liberty was a distinguishing characteristic of that society. And especially of that political society, which meant landowners. Having lots of slaves was another characteristic.

The useful comparison is just up the coast, Massachusetts was almost the opposite, a theocracy of busybodies. Where a town council could re-arrange people's living arrangements if they thought X was a bit of a loner wanting to be out in the woods. And of course enthusiasm for every detail of the approved religion was not optional.

<comment><USER7> The tautology is that non-free people (slaves) do not have freedom (AKA individual liberty).

</comment></comment></comment></comment><comment><USER9> Upstate NY is not Yankeedom. It is Greater Appalachia.

Also, many of the Midwest states are less Yankeedom and more Heartland.

Also, Dallas is Greater Appalachia and not Deep South yet Houston is Deep South and not New France?

Also, LA is El Norte and not the Left Coast?

Was this map based on 200 year old data?

<comment><USER10> Greater Appalachia definitely extends through PA in a T shape across the center of the state and the northern border (sometimes called Pennsyltucky) and covers at least the Southern Tier in New York.

<comment><USER11> See the image here: [https://en.wikipedia.org/wiki/Politics_of_Pennsylvania](https://en.wikipedia.org/wiki/Politics_of_Pennsylvania)

 _Like most states, Pennsylvania 's rural areas tend to be more conservative and support Republicans. The resulting political map of Pennsylvania is therefore a red "T" in the center of the state with the Pittsburgh and Philadelphia areas a strong blue._

</comment></comment></comment><comment><USER12> Interesting divisions, and certainly something that can be argued about forever.

My feeling is that Michigan probably has most in common with Wisconsin, Illinois, Minnesota, Maine and the rest of New England. I'm not sure it's a Yankee kind of thing though. More of a shared culture based on the environment, lakes, hunting, and exposure/familiarity with large forests.

I wonder how, in a parallel universe, such states combined with Ontario/New Brunswick/Newfoundland would end up looking like, as a nation surrounding the Great Lakes and North Atlantic coast.

Sorry I'm rambling.

</comment><comment><USER13> Strangely, I'd say the CO frontrange is more Left Coast than West.

It's a good attempt, but needs data backing. I remember another article that took daily commutes and then Voronoi Diagram'd them into a few 'states'. Can't find the link though.

<comment><USER14> to some extent, such a map would almost have to have fractal complexity. I can identify neighborhoods in my midatlantic city that fit into several different "nations".

</comment></comment><comment><USER15> There's a really interesting discussion of this on the Cracked Podcast: [https://www.earwolf.com/episode/the-11-nations-of- america..](https://www.earwolf.com/episode/the-11-nations-of-america..).

</comment><comment><USER16> Parts of East Baton Rouge Parish are liberal enough to be considered New France, but Livingston Parish doesn't deserve the title -- it's more like 50/50\. The line may be determined by Catholic vs Protestant; New France consists of Catholic majority Parishes.

I'm a part of the French revival movement in South Louisiana to help preserve the culture. Most French speakers are 60+ years old, which is sad. Before about 1970, children suffered corporal punishment if they spoke French in school. Blame it on the Anglo-protestants.

There isn't much French spoken in Nouvelle Orleans anymore. Same goes for Baton Rouge. This largely happened after Reconstruction: some of the Yankee leadership who took over were just as xenophobic as Southern slave-owners. I'm not trying to defend this change in leadership having to occur, it was necessary to make sure the South didn't try to keep slavery alive. Unfortunately, nationalist leadership was much like today's conservatives in wanting the only official language of L'etats Unis to be Anglais.

South Louisiana is highly underrated though, especially the city of Baton Rouge. Weed is decriminalized, there's an incredible symphony orchestra, plenty of art museums, and damn good food. But it's much more "American" of a town than New Orleans or Acadiana.

Here's a hilarious article explaining the division between North and South Louisiana:

[http://dailycrawfishnews.com/2018/05/07/despite-korea- unific...](http://dailycrawfishnews.com/2018/05/07/despite-korea-unification- north-and-south-louisiana-no-closer-to-making-peace/)

Anyway, laissez les bons temps rouler, vous-autres!

<comment><USER17> I am in South Louisiana as well, close to New Orleans. Grandfather is full Cajun, grew up in Cutoff, with his father being the captain of a shrimp boat.

One of my goals next year is to learn French. Do you speak French?

<comment><USER16> That's cool. Je parle un peu de francais, et vous? Parisien, pas cadien, malheursement.

<comment><USER17> No, not yet. It will most likely be Parisien as well, since learning Cajun French would make the journey much more difficult.

<comment><USER16> There are some mild differences in vocabulary and pronunciation (the Cajun 'R' is way more difficult) but they're mutually intelligible.

<comment><USER17> Good to know! Where do you find people speaking Cajun French in Louisiana? We went to the Festivals Acadiens et Créoles a few months ago, the only time I heard French was in the music, no one seemed to use French during a conversation.

<comment><USER16> Mainly Lafayette for me. Vermillionville has French speakers as well. There are a couple of French meetups in the Baton Rouge area as well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> There was a book and multipart PBS documentary by Robert MacNeil where he traveled and interviewed Americans about how they spoke and the evolution of accents.

 _Do You Speak American?_ (2005)

[https://en.wikipedia.org/wiki/Do_You_Speak_American%3F](https://en.wikipedia.org/wiki/Do_You_Speak_American%3F)

[https://www.imdb.com/title/tt0443484/](https://www.imdb.com/title/tt0443484/)

</comment><comment><USER19> The lack of demarcations that correlate at all with major economic area distinctions is a red flag to me that this map is questionable.

There's definitely a big cultural distinction between the Boston/DC corridor part of the east coast states and everything else in those states. DC has more in common with Boston than DC has in common with other parts (e.g. Indiana) of the "midlands" panhandle the map has it occupying. The fact that there's a line smack through the DC metro itself is kind of a wtf. There should probably be "left coast" dots for the counties that Denver, CO and Austin, TX are in. Maine North of Portland has more in common with Quebec and western Pennsylvania than it does with anything in Southern New England. If those are my gripes based on my personal experience then I would wager the areas with which I have no experience are similarly inaccurate.

Edit: Just confirmed with people from Michigan, Indiana and west Virginia. They all had some pretty raised eyebrows at this map.

Edit2: Asked some Mainers, one called the map "bold".

</comment><comment><USER20> The "left coast" has a similar idea in Cascadia. Up here in Seattle you'll see what's called the Doug flag, a symbol of Cascadian independence.

[https://en.m.wikipedia.org/wiki/Cascadia_(independence_movem...](https://en.m.wikipedia.org/wiki/Cascadia_\(independence_movement\))

</comment><comment><USER21> The author hasn't spent much time in Utah, if he didn't split it out.

<comment><USER22> The article aggregates. But outside of Salt Lake City, what did the author miss? Nevada is different from Las Vegas as well.

I was impressed with the north/south divide in Missouri and the east/west divide in Tennessee. However, I wouldn't put Santa Barbara, Los Angeles and San Diego in El Norte. The author may have had better reasons though.

<comment><USER21> The buzzing beehive? The state is predominantly LDS. It's one step away from being a theocracy.

<comment><USER22> But there are strong patches of LDS in Arizona, Nevada, New Mexico and Idaho. Harry Reid was LDS. Crapo and Udall are. I'd say LDS is an element of Far West culture in the way Protestantism is part of New England.

<comment><USER21> True, but there's balance in the other states.

</comment></comment></comment></comment></comment><comment><USER22> Chicago is in Yankeedom? I don't understand that entire western half of Yankeedom, Michigan, Illinois, Wisconsin and Minnesota.

SLO, Santa Barbara, Los Angeles, Orange County and San Diego are El Norte?

<comment><USER23> I got a good laugh out of seeing all of Wisconsin marked as Yankeedom. Starting to think they did that because it would look weird to have the majority of Wisconsin being "The midlands" when it's a northernmost state.

</comment></comment><comment><USER24> I find it to be a sizeable crock.

Look through the descriptions of the regions. Some are lauded for 'valuing education', 'hard work', etc. Others are tied to slavery, are "intensely suspicious", and so on.

This is a bunch of sorry tropes that don't hold water. It would have been just as easy to characterize the lauded regions as homeless poop-havens and the other parts 'eco-friendly' because the tree-to-human ratio is so much better.

</comment><comment><USER25> This map is really hit and miss for me. As a Missourian, I agree with the way Missouri is split up, right down the counties.

But the Upper Midwest (sans Chicago) is way closer to the rest of the Midwest than it is to New England. It has its own distinct flavor compared to the Lower Midwest. But not in "Yankee" way--more like "pre-Canada."

</comment><comment><USER26> I don't know for you, but all images were 404 in this article for me.

[https://web.archive.org/web/20170905210806/https://www.busin...](https://web.archive.org/web/20170905210806/https://www.businessinsider.fr/us/the-11-nations- of-the-united-states-2015-7)

</comment><comment><USER27> I had always divided the US into four separate countries but Woodard's theory of 11 isn't so far off.

<comment><USER28> I had a Prof in college who wrote a book about the US being 4 sections since its founding, he called them folkways

[https://www.amazon.com/Albions-Seed-British-Folkways- cultura...](https://www.amazon.com/Albions-Seed-British-Folkways- cultural/dp/0195069056)

</comment></comment><comment><USER29> There is some genetic basis for this: [https://slatestarcodex.com/2017/02/08/albions-seed- genotyped...](https://slatestarcodex.com/2017/02/08/albions-seed-genotyped/)

<comment><USER28> I never thought it had its basis in genetics, though that is pretty interesting. At least from what I remember in reading Albion's seeds it was the result of distinct cultures.

I think the division can be pretty broad. I live in Boston, and I've sometimes heard comparisons of North Shore vs South Shore to be culturally rooted in Puritans settling North, vs Pilgrims settling in South. Generally genetically the same but a little different starting point, culturally.

<comment><USER8> There's no conflict here. In a world where people were perfectly blank slates, and all such patterns were purely culturally transmitted, you would still expect a giant Yankee blob on the map just because they mostly came from East Anglia. (And the people of England when they left weren't perfectly mixed, most had lived in one region for millennia.)

</comment></comment></comment><comment><USER30> Colin Woodard: American Nations: A History of the Eleven Rival Regional Cultures of North America [2011]

Woddard's take on Trump victory

[https://medium.com/s/balkanized-america/the-american- nations...](https://medium.com/s/balkanized-america/the-american-nations- trumpism-and-the-2016-elections-653b74bf2ad0)

</comment><comment><USER31> The map with the nations extending into Canada makes me think of Manifest Destiny.

</comment><comment><USER32> Ugh. Another attempt to box in geographical regions so the author can make a name for himself.

</comment><comment><USER33> Wrong link. The link sends readers to the bottom of the page

> www.businessinsider.com/the-11-nations-of-the-united-states-2015-7#first- > nation-most-of-whose-people-live-in-the-northern-part-of-the-country-is- > made-up-of-native-americans-11

should be

> www.businessinsider.com/the-11-nations-of-the-united-states-2015-7</comment>