No Bread, Beer or Biscuits: How I Lost 63lbs in 100 Days - <AUTHOR> http://chuff.it/articles/no-bread-beer-or-biscuits-how-i-lost-63lbs-in-100-days <comment><USER3> This is great and certainly don't want to discourage anyone.

Some people need extreme transformations like this to be successful. Most people, however, don't.

You'll have a much higher success rate if you're patient and change just one little thing at a time. Once you're comfortable, you move on to the next.

I myself have lost over 30lbs and increased strength tremendously (power clean 250+).

I went about it by doing one small thing at time. First I got used to going to the gym a couple days at a time. Once I was used to going to the gym, I started a strength program. Once I was used to going to the gym and being on a program, I started crossfit. Then after I was used to that, I started omitting wheat from my diet. Once I was used to that...you get the point.

<comment><USER4> I'd have to say of the three things, the one that definitely has to be given up to lose the weight is beer.

Beer is not only caloric, but contains alcohol. When alcohol is ingested, the body's fat metabolism practically stops until it's out of your system. Drinking a beer each day would almost make it impossible to lose fat efficiently.

It wouldn't matter if you were eating under, because your body would not be able to easily burn fat for fuel. Instead, it would burn other things, acetate (from the alcohol), carbs, your own muscle, then fat, etc.

<comment><USER5> _Instead, it would burn other things ... your own muscle, then fat, etc._

That's the first I've ever heard that a human body would burn muscle before fat. Also, _a_ beer _each_ day would be out of your system relatively fast, so it should have no lasting affects on your body's metabolism.

Also, if you're drinking a beer a day, then be sure it's at least bottle- conditioned craft beer since the suspended yeast has many nutrients. ;)

<comment><USER6> The only circumstances where you will burn a significant portion of muscle before fat is if you are eating a high fat diet with less than 30 grams of carbohydrates or protein per day.

If you are fasting or in nutritional ketosis, your brain still needs about 120 grams of glucose (or as low as 20 grams after it adapts to producing and using ketones for fuel). If you aren't getting the glucose it needs or ingesting carbohydrates that can be broken down into glucose, your body will begin gluconeogenesis, a process that turns amino acids (from the breakdown of protein) into glucose. If you are still consuming dietary protein, it will break this down first, but if you are not, it will get these amino acids from your muscles and other "lean" tissues.

Basically, if you are consuming an adequate amount of protein, it's pretty hard to lose muscle mass without losing a significant amount of fat.

<comment><USER4> I might not be right on the money that the body would burn muscle first, but I can say with certainty that drinking causes your muscles to degenerate: [http://ajpendo.physiology.org/content/277/2/E268](http://ajpendo.physiology.org/content/277/2/E268)

RE: the only circumstance -- I think sleep deprivation would do the trick, too.

</comment></comment></comment></comment></comment><comment><USER7> After attending hundreds of weight watchers meetings, and being involved with hundreds and hundreds of people losing a ton of weight, I still genuinely believe too many people make weight loss too complicated, which leads them to give up. Keep it simple (as the article did)

If you burn more calories (energy) than you eat, _you will lose weight_.

Obviously, you have choices. You can cut down on all the really high calorie stuff. You can increase your exercise to burn more. You can (ideally) do a bit of both.

Of the hundreds of people I've known that have lost life-changing amounts of weight, I would estimate less than 1% of them had any idea how calorie dense the foods they were eating (and drinking) every day really are.

For the majority of people that are severely overweight, all they have to do is cut out high calorie snacks like chips, soda and anything deep fried and they'll lose significant weight, without even getting off the couch.

<comment><USER8> All calories are not translated to weight equally, the efficiency your body uses them matters greatly.

Sure dieting couch-potatoes will lose weight, but it will include losing a lot of muscle.

I believe the most well researched book on fat control is Carb-Back Loading by John Kiefer, the references chapter is 50 pages, it's terribly fascinating.

<comment><USER7> > All calories are not translated to weight equally, the efficiency your body > uses them matters greatly.

Who cares. A beginner doesn't need to know that.

It's like telling a first time driver to worry about double-clutching the gear changes.

Stick to the basics, as the person picks everything up, they can worry about the complicated stuff that builds on.

</comment></comment></comment><comment><USER9> Exercise is wonderful, and (particularly strength training) can dramatically change how you look and feel. If you just want to lose weight though, just stop eating carbs.

It really is that simple. There are many ways to lose weight, but dropping sugar (in all it's forms) is the most straightforward. It's the closest thing to a 'weight hack' I've ever seen.

If you are currently overweight, just cut out carbs completely for 3 months..don't bother to count calories; don't fret about nonsense like whether your food is organic, or free range, or locally sourced. Just stop eating sugar. No rice, no potatoes, no bread, no sugared soft drinks, no pasta.

<comment><USER10> Elimination diets work because people fail to replace the missing calories, not because there's something magical about the thing you choose to eliminate.

You can do this with colors of food, textures, anything that eliminates ~30-40% of the available food options.

<comment><USER11> You couldn't be more wrong. You realize you can stock _different_ foods in your house, right? Or buy different things at the store? You really think people go to the store on a wheat belly / LCFH (low carb high fat) diet and buy 30-40% less stuff?

I've lost over 10% body fat cutting the bread and carbs with NO exercise. Get a clue and either 1. try a no wheat / sugar / starch diet for just 2 weeks 2. read up on insulin, its causes and effects.

<comment><USER12> While we're on anecdotal evidence, I stay at a steady 155 (6 feet tall) eating pints of Ben and Jerry's and Krispy Kreme donuts fairly often.

</comment></comment></comment></comment><comment><USER13> I'm 31. A recent physical revealed that I have both high blood pressure and high cholesterol. They've put me on meds for the bp (which is now under control rather well) but they wanted me to try a lifestyle change before putting me on cholesterol meds. I was ~ 10 lbs overweight, nothing major - <USER2> while I wouldn't say I am fit by any means I wasn't out of shape either. But they wanted me to lose the 10 lbs and so they told me to stay under 2500mg of sodium per day, and less than 150g of carbs per day - no more than 50g per meal. And no red meat - all I can have meat wise basically is chicken, turkey and fish. Occasional lean pork.

I am two months into it - and have already lost 15 lbs, without any additional exercise. The carbs were rather easy to give up really - less sugar in my coffee, no pasta, few potatoes. Sodas were a little harder, but at 40g of sugar for a single Dr. Pepper, the choice between that or a whole sandwich is an easy one to make. The sodium is quite hard if not impossible though, unless you make every meal at home and only use fresh ingredients. If it is in a box, bag or can you can forget it. There is hardly anything at any restaurant you can get that is low sodium though. Even salads are absolutely loaded with sodium.

I will say I feel a little better, and not just from losing a couple inches around my waist. Water all day certainly helps. I don't think my cholesterol numbers are going anywhere really, I think my genetics are to blame, but I hope not.

Just a short anecdote, but if you sit behind a desk all day and have put on a few lbs, its fairly easy to give up the fast food and watch your carbs. It sure didn't seem like it at first though.

<comment><USER14> It's weird how that stuff works.

I'm 32, my last physical revealed that I'm 63 lbs overweight, I smoke (pack a day), drink fairly regularly, my blood pressure is fine, my cholesterol is fine, and have a great insulin response. Lung capacity is definitely not where it should be though.

I also eat almost entirely meat and carbs, save for lettuce/salad. I can drop 5 lbs in a couple weeks just giving up soda, 10 lbs if I give up carbs entirely.

I think the low fat / no meat thing is a load of crap. At least for me all I have to do is drop the carbs, and especially sugar.

<comment><USER15> Have you kept going past the 5 - 10 pounds? It's doubtful that you'll continue to shed weight at that rate. What happens is that without carbs your body's glycogen stores begin to deplete when you stops eating carbs (carbs are essential to glycogen production). Your muscles will take a week or two to flush out all the fluid they were holding on to before eventually stabilizing at a new level. Most people tend to drop a lot of weight at the beginning of a diet, especially low or no carb, however once the initial glycogen depletion happens they level off with the weight loss.

Some people hit a plateau and get discouraged or think they're done and start eating carbs again and shoot right back up. Others continue on at a healthy 1 - 2 pounds/week until they reach their goal.

<comment><USER14> Yup, I was down to 10-15 lbs overweight before I stopped freelancing (perhaps it should be called free-ranging) and started employment again.

Office job plus free pop and chips plus stress = massive weight gain. I think for me at the core it's a stress + easy access to unhealthy food issue.

</comment></comment></comment></comment><comment><USER16> Interesting. A few months ago I was really ill one day. The night before I had drank heavily, but I think in this case I also got food poisoning from something. Anyway, I vowed to stop drinking that day, and have. What I realized is how much alcohol was affecting me. Even two days after drinking, I feel tired, less enthusiastic and more depressed. What I have found is that now I can exercise routinely (for several months now), where as before I would give up after a few days or weeks of trying. I think it's important for everyone to evaluate what in their lives may be holding them back, even if they don't realize it. Also, want to point out that I am not advocating everyone stop drinking, just that it seems alcohol affects me more so than others.

</comment><comment><USER17> _I upped my exercise, cycling 30-40 miles a day, every day for the first couple of weeks._

Good to see!! When you are burning this level of level of energy every day, its actually <hard> to keep a stable weight. (Author must have had some base fitness, too so good for him.)

At its core, Weight change is simple input/output math. The key variable is %deplete your glycogen levels (as % of full everyday.) That is the "cache" of energy from your daily diet. If you burn enough energy to deplete this, you will lose weight, as your body replenishes itself from non-dietary reserves (fat, protein en extremis).

Surprisingsly, these are highly realistic numbers (<1lb/day>), even for relatively fit (height/weight proportionate) people. Moderating the pace to emphasise endurance over power will lead to more loss of net-mass. Asympotically, you will reach a point of gradual returns, but it is not at all surprising to lose significant mass under such prolonged workloads.

TLDR: Glad to see this is not a crash diet.

edits: clarity

<comment><USER18> "At its core, Weight change is simple input/output math." But I also think that...at its core it's very complex. What if you do all of that input in a single large meal vs 6 smaller meals? That's a BIG difference. Similarly just doing lots of cardio (and "burning" calories) vs high intensity workouts (like crossfit) have very different results.

<comment><USER17> If you're interested in simplifying the analsis, don't look at people who are trying to lose weight for your data. Look at people who are fighting to keep it on!! Read up on people who have to do significant amounts of work under limited caloric availability (not caloric restriction per se). At that level, 6 smaller meals keeps weight on (more efficient digestion). Eating fat leads to more weight loss (heat entropy). At a certain stage, how you do the work (cardio/crossfit) etc is irrelevant, because the order of magnitude of output=input. For a normal person at a gym, they are at a fraction of this workload. Walking an 4m/hour a day burns 400 calories a day. That's an order of magnitude off your metabolic rate of 2500/day. Walk or run 10 hours a day, you will burn 4000-8000 calories a day. You will deplete glycogen at hour 3-4 without a couple of those six meals. If you do this for 60 days on a 2500 calorie diet, even if its 40% fat, you will lose weight. Probably pushing yourself into unhealthy territory afer only a fraction of that time (if you have a standard BMI). That's a non-cardio, non-intensive workout BTW. That stuff is irrelevant, provided your metabolism is set to max by dynamic caloric consumption requirements at the same order of magnitude as base metabolic reuquirements. Cycling 40 miles a day (as the author claimed) is much closer to this threshold than other examples.

</comment></comment></comment><comment><USER19> I dropped around 60lbs (5'10" SW: 285) in first half of 2012 and have roughly maintained since (crept back to 235 - down to 230 again, still aiming for 200!).

I made two small habit changes that I feel made a drastic difference:

        * Bring lunch to work everyday (brown bag, leftovers)
        * If I want to watch TV, I must be moving on the treadmill

I would still go out to eat at work about once every two weeks and I would sometimes sneak in an episode of Breaking Bad on the couch, but overall, I stuck to those rules and everything else seemed to fall into place.

<comment><USER20> Hah, awesome! I started in a similar build, and am down about 35 pounds mostly just through dietary changes (and stress, sadly). I've been biking everywhere this month and I can pretty clearly feel a difference. Congrats man.

</comment></comment><comment><USER21> While it's always great to hear success stories, I think the broader point of this post (and others like it) is that there's no "great secret" to weight loss. There's no silver bullet and certainly no short cut. The simple truth is: people in the western world eat crap and don't exercise.

The success stories all boil down to a few simple points: eat real food, cut down on alcohol, and do some exercise that you find enjoyable enough to do it every day.

<comment><USER22> Agreed, this story is as much about self-motivation and determination as it is about weight loss techniques. They both go hand in hand. I saw myself at 192 and didn't like that number, so I got myself down to 174 after a year and maintain that weight. It's not a huge difference in size, but I feel better because of it. I also learned the value of staying away from bad habits, like junk food and sedentary activities.

</comment></comment><comment><AUTHOR> Here's the author when he's heavy: [https://www.everpix.com/public.html?id=cKG7XXCRD8BUu1tC](https://www.everpix.com/public.html?id=cKG7XXCRD8BUu1tC)

And at the 1 year anniversary of his epic hangover: [http://www.flickr.com/photos/peterjlambert/8753966380/](http://www.flickr.com/photos/peterjlambert/8753966380/)

</comment><comment><USER23> Since this is another weight loss post on HN, I'll tread out the old lines again[1]:

If you only care about weight loss: calories in vs calories out.

 _However_

If you care about maintaining muscle while losing fat, the story is still pretty simple, and calories still count, but the macro ratio of those calories are very important. In this case, keep protein high and get the rest from carbs and/or fat. I personally recommend a more Keto approach in this case because most people will be satiated longer.

The point being, weight loss is one thing, but muscle sparring while losing weight is another. Understand what you are going after and know the correct path.

[1] - When most people say they want to "lose weight", they really mean fat. Really, who wants to lose muscle? Probably no one. That is why calories don't tell the whole story. If, however, you absolutely don't care about muscle (and if you say "yes" here, I would personally question that), sure, just pay attention to calories and ignore the macro ratios.

<comment><USER24> Bullshit. The fallacy is that someone can care only about weight loss.

I tried it for years. I burn 2200 cal/day so I can eat a large Cinnabon every day (800 cal) and still lose weight.

The problem is it fucks your insulin resistance and turns into diabetes.

So, I don't consider a solution viable if one of the side effects is death.

<comment><USER23> I'm not going to fight you on the point, see my note at the bottom. I feel most people say weight when they mean fat.

Medically speaking, it is always about fat. If a doctor tells you to lose weight, they mean fat.

</comment></comment></comment><comment><USER11> This person has rediscovered the William Banting original low-carb diet from 1863[1] : "The emphasis was on avoiding sugar, saccharine matter, starch, beer, milk and butter."

Banting knew carbs made you fat over a century ago, but of course since the scientists couldn't figure out WHY they discredited it. And so it ever was.

They also knew carbs should be avoided by diabetics, but when insulin was invented they chose to (more profitably) just shoot people up all the time and make them sicker. Do you know what shooting yourself up with insulin constantly does, by the way? [2]

[1] [http://en.wikipedia.org/wiki/William_Banting](http://en.wikipedia.org/wiki/William_Banting) [2] [http://garytaubes.com/2012/02/on-the-greatly-exaggerated- dem...](http://garytaubes.com/2012/02/on-the-greatly-exaggerated-demise-of- the-insulin-hypothesis/) [ see disturbing picture ]

</comment><comment><USER25> >> I've gone from a 42" waist to a 36". I'm now buying t-shirts in a medium or maybe a large rather than an XL or XXL.

Clothing is not sized that way in the USA. 36" waist fitting into a medium?

<comment><USER26> Waist sizes for pants in the US are deceptive. When I started working with a personal trainer, I was wearing pants with a '34 inch' waist. However, when it came time to take measurements, and I finally relaxed my gut instead of sucking it in so we could get an accurate measurement, my waist measured 38 inches.

Also, one can get 'adjustable waist' pants with elastic slots in them that allow the waist to expand such that someone with a 42 inch waist might fit into a pair of '34 inch' pants comfortably. They don't help the situation any.

</comment></comment><comment><USER27> isn't that rapid? it sounds awesome (and congratulations), but i would perhaps check w a doctor or something that you're not losing weight too fast?

[edit: not to ask why you're losing weight so fast (because you're not eating, duh), but whether that rate is healthy.]

<comment><USER28> If you start rapidly losing (or gaining) weight with no obvious explanation that is a cause for concern. If you start eating much less, and exercising much more, you probably don't need to ask a doctor why you're losing weight.

<comment><USER29> I believe that the healthy rate is around 1 lbs per week with 2 lbs pushing it.

<comment><USER30> Not when you are morbidly obese like the author was. When you are that big( pushing 300lbs) it's not uncommon to loose 5lbs a week at the start.

<comment><USER29> Why is the weight loss mechanism different under those circumstances?

<comment><USER30> [http://www.livestrong.com/article/406097-why-do- overweight-p...](http://www.livestrong.com/article/406097-why-do-overweight- people-lose-weight-faster/)

[http://forum.bodybuilding.com/showthread.php?t=121373121&pag...](http://forum.bodybuilding.com/showthread.php?t=121373121&page=1)

Higher Metabolism, more water weight to shed.

</comment></comment></comment></comment></comment></comment><comment><USER31> This insistence in demonizing food groups or finding quick fixes by eliminating some sort of magic food stuff is fascinating to me.

Isn't it obvious this is incorrect?

I mean, go to Japan, where people live on white rice and wheat noodles and count how many obese people you see on the street.

You will also notice that consumption of bacon, butter, eggs and dairy is very low compared to western diets and even though they consume fatty fish they don't eat it in the portions westerners consume meat.

<comment><USER32> So you're saying, don't demonize or eliminate food groups, but cut out the bacon, butter, eggs and dairy?

</comment></comment><comment><USER33> I've lost a little over 40 pounds (272 to 230-ish) since February (and I'm still losing weight pretty steadily). Here's what I do:

1\. Bike to work (~5 there plus ~5 miles back for a total of ~10 miles per work day)

2\. Stopped drinking soda (and most sugary drinks)

3\. Switched to a standing desk at work (I pace when I think so it's almost like walking all day)

4\. Do minor exercise during down time at work (push ups, dips mostly)

5\. Regularly asking myself if I have time to go to the gym and actually going when I find I don't have a good excuse (I got this idea from that lucid dreaming trick).

6\. Consistently trying to eat less in general (based on rough calorie counts) by asking myself if I need to eat more or cook that much.

7\. Continually improving balance in diet (more fruits/veggies is usually what I need to do)

8\. Cooking as much as I would eat in one sitting, but saving half for lunch the next day (no more seconds)

I've always been pretty physically active, but I've also always had a tendency to eat as much as I wanted constantly. This led to rapid weight gain whenever circumstances had me exercising less. Restraining myself was a steady process, but now I actually can't eat as much as I used to, and I find I actually eat less when exercising less, which is good.

</comment><comment><USER34> I have never looked fat, in baggy clothes. In tight fitting clothes, years ago when I was at my grossest, someone called me "the fattest skinny person i've ever seen."

I began to exercise a lot. _A lot_ to lose that beer belly. Finally it mostly came off. Then I fell for the excuse of "you need to eat more to gain muscle!" and ate the amount of calories some online calculator told me i'd need to maintain a given weight.

I've never had abs, and I didn't get them then. I could out-run, out-squat, out-jump any crossfit contender I met; and I was still kind of flabby. My motivation sank. I moved away and stopped my routine. I went back to drinking and eating a lot, without working out as much. I lost strength. The belly began to return.

Recently I arbitrarily decided to cut out drinking for two months, which helped a lot. Then I decided to cut out wheat. Not gluten, just wheat and products made from it. So far? I'm looking more cut than I ever did, and i'm hardly exercising. Eating smaller portions and less empty calories/alcohol is giving me the body image I always wanted. (It's probably just the lack of calories and not the wheat specifically)

</comment><comment><USER32> OP probably has a gluten sensitivity. It causes inflammation and cuttiing it out of your diet like that can cause dramatic weight loss, even without exercise.

</comment><comment><USER35> [http://en.wikipedia.org/wiki/Fat,_Sick_and_Nearly_Dead](http://en.wikipedia.org/wiki/Fat,_Sick_and_Nearly_Dead)

<comment><USER36> I was going to post a link to this movie. I think they have it on AMZN Prime. Netflix has it. It's pretty inspirational, and discusses a great way to eat.

Another one of interest is Forks Over Knives, which talks about the benefits of eating a mostly plant based diet.

[http://www.forksoverknives.com/](http://www.forksoverknives.com/)

</comment></comment><comment><USER37> Reddit /r/loseit and /r/fitness have excellent FAQs for weight loss and becoming fit and they offer communities if you are looking to learn or for support.

[http://www.reddit.com/r/loseit/wiki/faq](http://www.reddit.com/r/loseit/wiki/faq)

[http://www.reddit.com/r/Fitness/wiki/faq](http://www.reddit.com/r/Fitness/wiki/faq)

<comment><USER38> /r/loseit helped me lose about 50 pounds, and getting another desk job helped me gain about 20 of those back :)

Regardless, loseit is highly recommended.

</comment></comment><comment><USER39> A couple diet strategies that have worked for me:

Drink a lot of calorie free, caffeinated liquids. I probably drink more diet soda than I should, but tea and coffee are great as well and healthier

I find eating small amounts of crap can actually help. If your diet wasn't amazing in the first place, and your goal is to lose weight so you cut out all unhealthy foods, you're fighting two battles at once - cravings for sugary/unhealthy foods, and hunger cravings. Eating a small amount of ice cream or a few french fries can satisfy the unhealthy cravings, and work as diet foods as long as your calories are sufficiently low.

<comment><USER15> _> hunger cravings_

A good diet should almost never leave you hungry. The problem is the no meat/no fat diets that people try to go on. When you eat high carb you get very little bang for your buck in terms of both volume and satiety.

1 pound of chicken is only 520 calories and the protein will keep you fuller much longer than 520 calories of Oreos. 1700 calories is a good target for a typical male who wants to lose weight, which on a high protein diet can look something like:

Breakfast: 16 oz non-fat cottage cheese (300cal)

Lunch: 10 oz chicken breast (330cal), 1/2 cup dry rice = 1 cup cooked rice (300 cal)

Dinner: 10 oz chicken breast (330cal), two pieces bread (220 cal), bbq sauce (140 cal)

You're at 1620 cals so you can still have an afternoon snack and be right at your target. Add some veggies to your lunch and dinner and I challenge you to eat all that and still feel hungry.

I'm not even recommending keto or paleo or any of that stuff, just that the reason people feel hungry when they diet is that they generally don't eat enough protein.

</comment></comment><comment><USER40> This is an excellent writeup, and one that I have a few friends that could benefit from. I try to tell people that it is the little things you do every day that add up to big change. My friends mostly have this idea that you have to make huge sweeping changes to your life to see any results at all, but that is simply false. Start going on a walk or jog every evening instead of sitting in front of the television. Start having nuts instead of candy bars for snacks. Stuff like that adds up quick to some pretty impressive results.

Excellent read, and keep up the good work!

</comment><comment><USER41> "But I made a decision to stop right there and then. I didn't want to wait until Monday, or until we'd run out of crisps in the cupboard. I was putting an end to it."

This is so true... why do we always say we'll start something on Monday? I'll start eating better... on Monday. I'll start my new workout routine... on Monday. Where did this come from? Why is it so hard to make the same commitment to yourself today? Congrats on making up your mind and following through! Super inspiring!

</comment><comment><USER24> >>I'm 6'4" and I'll never be slight in appearance, that's just genetics

Maybe not - I bet somewhere in your ancestry we're lean, ripped, warrior/hunters who were like that due to the type of work they did, and because people didn't bring donuts every time someone in their tribe had a birthday.

Serious congrats and well wishes to you in any case.

</comment><comment><USER42> You should trade some of that fat with muscle gain (especially upper body), instead of shedding it all. Develop a consistent weight lifting routine at the gym. You'll feel a lot better about yourself. Stationary cycling might make your legs great, but your upper body will probably start to look "skinny fat".

<comment><USER43> Can't forget the core muscle groups -- a solid core is essential to balancing yourself out. Lower back and abdominal regions being the main focus.

</comment></comment><comment><USER44> You were riding 100-150 miles a wee kand you didn't loose weight due to that? What was your caloric inputs...?

</comment><comment><USER45> I once lost 140 pounds in a day. She was just weighing me down..

</comment><comment><USER46> Great. This is going to turn into a weight loss show off site. Nothing wrong with that & congrats but here?

</comment><comment><USER47> That's just badass</comment>


Windows 8 Registered I/O Networking Extensions - <AUTHOR> http://www.serverframework.com/asynchronousevents/2011/10/windows-8-registered-io-networking-extensions.html

<comment><AUTHOR> I expect that yes, it would be useful to use RIO with Node.

What I'm hoping to find, once I've got RIO integrated into my IOCP framework, is that 'faster path' from user mode send/recv calls to/from the network stack will result in performance improvements for IOCP based servers that switch to using RIO. It likely wont be as much as if you used RIO in a tight loop polled situation, but you should still get some benefits from the pre-locked buffers and the reduced amount of work needed during send and recv calls. Going via the IOCP for completion notification will result in some kernel mode transitions but it's necessary to allow you to scale RIO to many thousands of connections.

I'll post some comparative perf tests once I've got a bit further.

<comment><USER2> That'll be great --- Thanks!

I look forward to seeing some results from you

</comment></comment><comment><USER2> Just going off a little bit on a tangent here; I remember reading the Node.js port to Windows is based on IOCP, so will this affect Node in Windows 8?

Are there any benefits to Node.JS if it is to use this new API?

Does anyone know?</comment>


Did humans truly domesticate dogs? - <AUTHOR> https://www.popsci.com/story/animals/dogs-a-love-story/ <comment><USER2> Very likely it was dogs domesticating humans, rather than the other way around.</comment>


Share my pain point: I want dead easy version control. - <AUTHOR> I am a research mathematician. I collaborate with various people on papers, around the globe. Math papers are written in LaTeX, which is basically plain text with markup.
When I worked for a software company, we had version control setup (Subversion), which was a godsend. It was a little bit of a pain to get going, but once it worked it was great.
I would love to use some kind of version control now. Nothing fancy -- for example, I collaborate with a mathematician from Japan, and I would love version control with a good diffing feature. I'm thinking web interface, we can both upload versions of the file, run diffs, choose which changes to keep and which to discard. Ideally, this could all be done from a webpage.
I know enough programming to speculate that this should not be too terribly difficult (although of course I could be mistaken).
Such a solution does not seem to be out there. Just this morning, I tried Github. It makes me install git first, and when I install it I get the following error message:
dyld: unknown required load command 0x80000022 Trace/BPT trap
Upon Googling and fixing that:
error: Cannot access URL https://github.com/FrankThorne/Frank-Test-Repository.git/, return code 60
What the f* is that? I could google that too, but I don't know how long it will take before it eventually works. I suck at system administration (and have more pressing things to do than learn it), and I have often found that "trivial" tasks take me several hours.
Subversion, Bitbucket, even Dropbox (on Linux), same story.
Now, of course, suppose I do whatever is required to install this, which is probably easy but could turn out to be a headache. The real pain point is that I then have to persuade my colleagues to use it, and if installation causes them any difficulty, then I look like an ass.
Almost no research mathematicians use version control. We all should be. The way to make this painless (as far as I can tell) is to make everything doable over the web. I would pay money to be able to work like this with my colleagues.
Is there something I am missing? Is there some reason such software does not already exist? If not, seems like an opportunity to me. <comment><USER2> I googled "latex track changes", knowing that for documents, people are more likely to call it "track changes" than "version control", and got this:

<http://trackchanges.sourceforge.net/>

<http://www.peteryu.ca/tutorials/publishing/latexdiff>

<http://narnia.cs.ttu.edu/drupal/node/130>

Seems like there are a few solutions.

</comment><comment><USER3> What's with the posts saying "Please send me your ideas. Maybe I can do something with them."? Um, no. Please publish your ideas and let the world help you with your problem.

Actually, you already have. Why _isn't_ there a one-button (or script) way to get started with github? This is exactly the sort of thing github should be doing to extend their community. The instructions at <https://github.com/> (GitHub Bootcamp) seemed pretty good to me, but that just means I didn't fail at some step for impenetrable reasons, and give up. It's not obvious to me that the entire business of starting up, including generating ssh keys and registering them with github, couldn't be done in a simple installer.

Next, of course, comes the difficulty in learning to use git. And no, it isn't obvious. I'm not entirely sure the problem can be solved with training, but I am sure it certainly would be better solved by training focused at a particular user community. For example (to pick one out of the air), where is the tutorial for people who collaborate to write a document written in LaTeX? Do they want a centralized, single-master repository with a small number of committers, a centralized repository wiki-style, where everyone on the list can push, or distributed repositories? How to manage these scenarios? What special problems will be encountered because of LaTeX markup? This is probably best addressed by the community of LaTeX users, if they could only get started, and if only they could figure out how to use the tool to best advantage.

</comment><comment><USER4> > Is there something I am missing?

Yes, training.

I assume you've had much training at being a research mathematician. Even, things that seem obvious to a layperson, say using library resources to research papers, takes training/experience to do efficiently.

Version Control tools are no different.

Given that. There are numerous subversion GUI clients both native and web. Google "GUI subversion client"

Google docs also provides some revision control features I believe.

</comment><comment><USER5> I believe I've run into the return code 60 problem before, IIRC, it had something to do with the curl library and https. Try using the SSH address instead, if possible, firstname.lastname@example.com/FrankThorne/Frank-Test-Repository.git.

What I found to work for using the https address was creating a file named '_netrc' (on Windows XP, it would be '.netrc' on Linux) in your home directory with the following:

      machine <git_host_ip>
      login <your_user_name>
      password <your_password>

This wasn't for github, but a local git server. May work regardless. I don't have the link to where I found this solution for further information. Hope this helps.

</comment><comment><USER6> I have found that the Github GUI for Mac is pretty good, my teammates who are designers figured it out pretty fast. But honestly, if you are using linux you are probably the type of person who would get comfortable with the command line tools pretty fast.

Like anything else there will be a learning curve. The hard part is getting used to the clone/commit/push/branch/merge/pull workflow as opposed to the typical open/save/send/saveas environment most users are accustomed to.

At first it seems like an extra step, but once the light bulb clicks it's like "This changes everything, again!"

I do agree that there is a lot of room for improvement in get an average user from zero to lightbulb phase faster.

A good place to start for anyone learning git is the github bootcamp, starting with: <https://help.github.com/articles/set-up-git>

</comment><comment><USER7> It sounds like the real difficulty is that you can't install these pieces of software on your particular operating system, which all already solve this problem in a relatively robust and well-tested way. All you should have to do is put together a robust piece of software that installs cleanly on your OS to support revisioning... but this is the same challenge faced by all of the examples you've mentioned. I'm not convinced that you're solving the right problem if the main difficulty lies in installing.

In the HCI research community, SVN is the norm, backed by sites like Unfuddle, Github, or private SVN servers. All of these sites let you upload directly through the web.

</comment><comment><USER8> It sounds like what you're looking for is a version control system (VCS) for rich text documents, whereas most are made for program source code. I built pretty much the exact application you're describing, but it was for the company I work for as an internal project only. (And not very pretty either)

If you had some specific ideas, I'm always looking for project to work on. Feel free to send them to me (firstname.lastname@example.com). I doubt I'd personally get much done on it, but I tend to get into things and go nuts sometimes. At the very least, you may get some workable code or ideas to go about it.

</comment><comment><USER9> You used Subversion and you said it was a godsend. Stick with that. I use Subversion with all sorts of non technical people such as writers, graphics people, etc.

On Windows you can download TortoiseSVN and install it and it works well <http://tortoisesvn.net/>

To get a Subversion server up and running, the easiest is to just buy access to a Subversion server. They are not expensive, e.g. I had good experiences with <http://wush.net/> at $6.66 a month, but there are many others out there.

</comment><comment><USER10> can you write me your ideas? I got the same problem with git (I hate it!) and we could find a solution maybe!

aw4y firstname.lastname@example.com

</comment><comment><USER11> Why not use a hosted VCS, so you don't have to install it? Most free VCS hosts offer public-only repositories for free. However, a few, such as BitBucket, provide free private repositories. There are likely others too. I think this would solve your problem.

<comment><USER12> That would take care of the hosting, but of the actual usage of the tool.

</comment></comment><comment><USER13> Most code-oriented version control tools are all or nothing, because if you take some of coder_x's changes, but not all of them, it's very likely that your software will break.

If you want to review changes like you're suggesting, Microsoft Word can support that.

</comment><comment> angry-hacker GitHub has released Windows GUI now too. It is really easy to use if you want to give git another try :)</comment>


Ask HN: If you had your own 3D printer, what would you make? - <AUTHOR> <comment><USER2> If my 2D printers are any indication, not very much.

Most of the time when I now need a 2D item, I use a Web-based service and have it delivered. For example I use Web-based services to to print photo albums, greeting cards, business presentations, signs, etc. I do so because the resulting quality is better and cheaper.

I suspect if I ever wanted some 3D item printed, I would do the same.

</comment><comment><USER3> Many things! There are all these designs floating around in my mind that I can't build easily because I don't have a 3d printer.

Adjustable camera mounts for my computer vision projects...a tablet mount to hold my tablet at a particular angle while I'm lying down and reading... better supports for my old arthritic dog...cat toys...waterproof cases for my embedded projects and sensors...chassis for small robotic vehicles...

</comment><comment><USER4> Prints of juggling patterns pushed through space. Henry Segerman and I have designed and printed a few, and sometimes you can learn a surprising amount about something you thought you already knew.

[https://plus.google.com/+HenrySegerman/posts/FGZdWSM2qET](https://plus.google.com/+HenrySegerman/posts/FGZdWSM2qET)

[http://www.shapeways.com/product/R8B97GHZN/3-club-cascade- mo...](http://www.shapeways.com/product/R8B97GHZN/3-club-cascade- motion?li=shop-results&optionId=41687643)

[http://www.shapeways.com/product/3UEJKYME9/3-ball-cascade- mo...](http://www.shapeways.com/product/3UEJKYME9/3-ball-cascade-motion)

</comment><comment><USER5> Probably bits and bobs for the wife's crafting projects (probably involve lots of rabbits) Custom cases for the odd bare electronic components I have. And some experiments in stylistic 3d designs.

</comment><comment><USER6> I made a workshop about 3d printer so i can buy a new 3d printer. Then i just start my master plan[1].

[1]: like they said. It will make the better world :D</comment>


Show HN: Georaptor – Geohash Compression (Considerable reduction in data size) - <AUTHOR> https://github.com/ashwin711/georaptor <comment><USER2> I don't really understand the purpose, what would be a typical usecase where you would compute and store such geohashes?

<comment><AUTHOR> Well if you have used geohashes, have an idea of the all use cases, you would know the purpose. :)

One sample use case would be, if you want to find which polygon (building or administrative regions like states or cities) a given location falls into, doing a point in polygon for a huge set wouldn't be the best solution. Here comes the use of geohash and s2 cells. Using GeoRaptor on the initial set of geohashes reduces the search space considerably. For instance, the entire shape of the US creates 18 million geohashes which get reduced to ~220K when compressed.</comment></comment>


Payment processing for Django - <AUTHOR> https://github.com/agiliq/merchant

<comment><USER2> This looks like great work. Does anyone know:

      * Approximately how much work it would be to port this to another Python framework (e.g., Flask+WTForms) from Django?
      * If something like this already exists in Python in a more framework-agnostic form?

<comment><USER3> Hey, shameless self-promotion: <https://github.com/abunsen/Paython>

we are framework agnostic python library for payments & will hopefully be adding support for Braintree & Samurai in the next few weeks!

</comment></comment><comment><USER4> See also:

<http://github.com/hiidef/hiicart>

Built as a Django shopping cart, but talks to Paypal, Auth.net, Braintree, Amazon, and Google Checkout

</comment><comment><AUTHOR> Docs at

<http://readthedocs.org/docs/django-merchant/en/latest/> and

<http://agiliq.com/docs/merchant/>

</comment><comment><USER5> Thanks for releasing this just _after_ I finish up a Django e-commerce project. ;)

Seriously though, looks like this will come in handy in the future.

</comment><comment><USER6> This is much appreciated. Thank you for your efforts!

</comment><comment><USER7> Any idea if this app will handle stripe in the near future?

After a lot of initial enthusiasm I don't hear any mention of stripe in payment threads any longer. I was thinking of using it but haven't yet had the time to dig in. If not, perhaps this app would be helpful to look at for implementation strategy?

<comment><USER8> Seems like it could use stripe fairly easily.

</comment></comment><comment><USER9> For Authorize.NET CIM support (not in merchant yet) see django-authorizenet: <https://github.com/zen4ever/django-authorizenet>.

</comment><comment><USER10> One question -- does it work with Paypal Websites Standard?

I have been manually integrating with Paypal until now and it is painful; so thanks for this project.

</comment><comment><USER11> This is indeed great!

</comment><comment><USER12> This needs Dwolla.com support.

<comment><USER13> fork, code, commit, push, request pull

<comment><USER12> Touche! :)

</comment></comment></comment><comment><USER14> Awesome. We will be adding Samurai in the near future, but aren't there yet. If anyone wants to contribute, drop me a line

<https://samurai.feefighters.com/developers>

<comment><USER15> Keep in mind that the Samurai Python client already has some Django integration.</comment></comment>


Golang MiddleWare chaining - <AUTHOR> https://github.com/squiidz/pod

<comment><USER2> Superb timing as I'm just now implementing some web services in Go and using http.Handler compatible middlewares.

As an alternative there is also Alice[1] but I don't like it's implementation style. Coming from JS and using connect / express what I'd really like is something more like this:

      func helloWorld() http.Handler {
      	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
      		w.Write([]byte("Hello world!"))
      	})
      }

      func main() {

      	// Wrap the app in Middleware
      	app := SomeMiddlewareLibrary(helloWorld)

      	// Run the middleware in this order
      	app.Use(app.Logger("HELLO-WORLD"))
      	app.Use(app.CORS("*"))
      	app.Use(app.Delay("1s"))

      	// Give the app up to be served
      	http.ListenAndServe(":8080", app)

      }

[1] [https://github.com/justinas/alice](https://github.com/justinas/alice)

</comment><comment><AUTHOR> If someone have some idea of improvements, please let me know ! :)</comment>


The Great Toilet Paper Scare of 1973 - <AUTHOR> http://priceonomics.com/the-great-toilet-paper-scare-of-1973/ <comment><USER2> Price controls caused many of the shortages. The US went off the gold standard and inflation was the result.

The government instituted price controls and shortages were the result. We even had shortages of natural gas, which, at the time, came entirely from with the US.

In this environment, such a rumor was not hard to believe.

</comment><comment><USER3> Not even this caused Americans to start using bidets. The thought of using toilet paper to wipe one's behind is savage.

</comment><comment><USER4> Still remembering a sugar bubble in my country few years ago, when the price of a kilogram basically tripled within few weeks, this article reminds me that a lot of problems are caused just by people being idiots. That is, following their short-sighted interests.

<comment><USER5> > _this article reminds me that a lot of problems are caused just by people > being idiots_ //

Actually I think in these situations the problem is that individually the people _are_ acting rationally. The only way to be more rational is to act as a group, which requires reliable information, and/or requires government (or other similar bodies/structures) that you trust with your basic needs.

When the gov say there isn't a petrol shortage you know that in the past they've said this because there is and they're trying to avoid panic. Unless you've got better info "panic" buying seems quite rational to me.

If it only costs a small amount to buy lots of toilet paper but not having any would be a major inconvenience then any suggestion that might pan out to be true is worth following - you're down a few dollars that you would have eventually spent any way.

Isn't it precisely that people aren't being idiotic that makes such runs on resources [or banks] so difficult to handle: you go on TV and say "don't panic buy or we really will run out" \- well that just tells everyone to make sure they buy it first, because everyone else is buying and so "we really will run out". Your best bet is to have trustworthy news reporters that can show date verified information contradicting the shortage - eg warehouses packed with toilet paper that the experts say is enough to last x months of normal usage.

Not looking after your short term interests leads to privations.</comment></comment>


In Defense of Puns - <AUTHOR> https://www.esquire.com/entertainment/books/a15872842/in-defense-of-puns/ <comment><USER2> The problem aren't puns per-se, it's when people abuse them without rhyme or reason to derail a conversation. It gets real boring real quick. It's especially true on the internet where in my experience it seems that half the people received a government-mandated "100 puns you are legally obliged to place once a week in conversations".

I don't have a problem with puns, I have a problem with compulsive, unimaginative, lazy punning. You know, like replying "I did nazi that coming" in reply to a comment mentioning the third reich or WW2. Never gets old.

<comment><USER3> I don't like you. You need to get punted.

<comment><USER4> 1/6 forced

</comment></comment></comment><comment><USER5> I entered a pun contest once, much like the one in the video embedded in the article. I had ten puns prepared, hoping one of them would win. Unfortunately... no pun in ten did.

<comment><USER6> Will, that didn't _pan_ out well for you.

<comment><USER7> Who is Will?

</comment></comment></comment><comment><USER8> "being able to make a terrible pun" is my rough metric for real fluency in a language.

<comment><USER9> Which would be to say for fluency, the proof is in the punning.

</comment></comment><comment><USER10> There is no kind of false wit which has been so recommended by the practice of all ages as that which consists in a jingle of words, and is comprehended under the general name of punning.

It is indeed impossible to kill a weed which the soil has a natural disposition to produce. The seeds of punning are in the minds of all men, and though they may be subdued by reason, reflection, and good sense, they will be very apt to shoot up in the greatest genius that is not broken and cultivated by the rules of art. Imitation is natural to us, and when it does not raise the mind to poetry, painting, music, or other more noble arts, it often breaks out in puns and quibbles.

..I shall here define it to be a conceit arising from the use of two words that agree in the sound, but differ in the sense. The only way, therefore, to try a piece of wit is to translate it into a different language. If it bear the test, you may pronounce it true; but if it vanish in the experiment you may conclude it to have been a pun. In short, one may say of a pun, as the countryman described his nightingale, that it is a " _vox et prczterea nihil_ "–"a sound, and nothing but a sound."

<comment><USER11> ^ By Joseph Addison, founder of _The Spectator_ (the original one), writing in 1711.

[https://books.google.com/books?id=JEqJpAPC5dsC&pg=PA146](https://books.google.com/books?id=JEqJpAPC5dsC&pg=PA146)

</comment></comment><comment><USER12> Non-native speaker here. Could someone explain the currency pun quoted?

> When one guy gestured towards his shirt and declared "I'll be _washing tons_ > of clothes later," his opponent instantly responded, "Better get a _tub, > man."_

I guess _Washingtons_ is slang for a certain denomination of US dollar bill? But what on earth is _tub man?_ Thanks!

<comment><USER13> [https://en.wikipedia.org/wiki/Harriet_Tubman](https://en.wikipedia.org/wiki/Harriet_Tubman)

I think...

Seems like there was some plan to but Tubman on the US$20

[https://www.bloomberg.com/news/articles/2017-09-19/tubman- st...](https://www.bloomberg.com/news/articles/2017-09-19/tubman-still-part- of-20-note-redo-as-mnuchin-focuses-elsewhere)

<comment><USER12> Oh, "On April 20, 2016, then-U.S. Treasury Secretary Jack Lew announced plans to add Tubman to the front of the twenty-dollar bill". Wicked. Thanks a lot!

<comment><USER14> BTW, seems this was put on hold: [http://fortune.com/2018/04/19/harriet- tubman-20-dollar-bill-...](http://fortune.com/2018/04/19/harriet- tubman-20-dollar-bill-delayed/)

</comment></comment></comment></comment><comment><USER15> If anyone is interested in a more in depth and humorous take on puns, I remember enjoying "The Pun Also Rises" by John Pollack - a book I randomly picked up a few years back from a Barnes and Nobles.

He explored some of the history of puns and general wordplay, why English is particularly suited for puns (unlike e.g. Romanian as someone else mentioned in this thread), how puns fit into modern and past culture (both the positive and negative bits), as well as some personal anecdotes.

It's a pretty quick and light read, and if you're the type of person that would actually enjoy reading a whole 150+ pages of book about puns, I'd definitely recommend it.

</comment><comment><USER16> What makes puns so annoying is the punner expecting to be told how clever they are.

<comment><USER17> Eh. I live for the groans.

<comment><USER18> Yes, the failure to success scale of puns is measured in anger. A pun so awful it makes the listener angry is a grand success.

<comment><USER19> I once heard someone say that the best puns cause physical pain, either with the listener groaning or the listener punching, but either way the pain is the proof of success.

</comment></comment></comment></comment><comment><USER20> The puns in this thread are a great example of why people hate puns. Also a lot of them are spoonerisms and not puns, which will get you ejected from a pun contest

<comment><USER21> It seems like a spoonerism is unintentional. I feel like a pun for most people means word play.

Spoonerism. a verbal error in which a speaker accidentally transposes the initial sounds or letters of two or more words, often to humorous effect, as in the sentence you have hissed the mystery lectures, accidentally spoken instead of the intended sentence you have missed the history lectures.

<comment><USER20> Yeah I personally use the concepts interchangeably but if you go to the pun competitions in the bay area they will disqualify spoonerisms in the general sense which includes any partial word substitutions like "punderdome"

</comment></comment></comment><comment><USER22> I found this article [1] to be much more enlightening [2]. The problem is not so much that puns are bad, but that so many puns are just bad puns.

As described here [3],

> "It's not enough to just substitute a word that sounds the same (aka a > 'homophone'); for example, which is funnier, 'Be kind to your dentist > because he has fillings too' or 'She ate my breakfast role'? You probably > said the first pun, because the meaning of the substitute word also makes > sense in the context of the sentence, and it's this second meaning that > actually makes the joke funny."

[1] [https://slifty.com/2016/03/a-puntitled-framework-for- evaluat...](https://slifty.com/2016/03/a-puntitled-framework-for-evaluating- the-quality-of-puns/)

[2] Heh.

[3] [http://blogs.discovermagazine.com/seriouslyscience/2014/06/1...](http://blogs.discovermagazine.com/seriouslyscience/2014/06/17/computational- model-measure-good-bad-puns-really/)

</comment><comment><USER23> Is there a list of punning competitions? I'd like to find one in the Bay Area.

The Punderdome is monthly in Brooklyn, NY. Tonight (May 1) at 7pm.

[https://www.littlefieldnyc.com/event/1620815-punderdome- broo...](https://www.littlefieldnyc.com/event/1620815-punderdome-brooklyn/)

<comment><USER24> "Orlando Punslingers" is a popular event that happens at SAK Comedy Lab in Florida every few months.

</comment></comment><comment><USER25> Coincidentally, I just watched this (posted 3 days ago): [https://www.youtube.com/watch?v=CbWP9nvnRhw](https://www.youtube.com/watch?v=CbWP9nvnRhw)

As a non-native speaker I never understood the hate for puns, I've always found them inoffensive fun.

<comment><USER26> Dont you have puns in your native language?

<comment><USER25> Nope. Romanian is not a great fit for puns. I think English is a special case, since the "word density" is so high, due to a huge (largest actually) vocabulary, and the propensity to use short words, usually with multiple meanings. Also it's such a foreign thing to do that it'd be really weird to try, although there are some (very silly) examples (corcodus -> cur cu dus, furculita -> fur cu lita, etc.).

I'm curious whether there are any other languages that are naturally "punny".

<comment><USER27> >I'm curious whether there are any other languages that are naturally "punny".

I never thought of this before, although I know some Sanskrit (having learned it for some years in school) - but due to its overall design and the fact that words can be built up from other words, and also due to many short words having potentially many meanings (and hence longer words built up from short words, even more so), I think there is probably a lot of scope in Sanskrit for punning. Sanskrit poetry probably has a lot of it, but likely prose too. A very rich and enjoyable language to study, even just for its own sake, i.e. even if you are not studying it in order to understand Indian philosophies, yoga, etc.

<comment><USER11> Yes, puns are called śleṣa (shlesha, श्लेष) in Sanskrit poetry. (For a bit more, you can search under those two spellings, make sure to search the first two pages and also Google Books.)

There are even entire long poems that are a "pun" — they tell two stories, depending on how you read each verse. Yigal Bronner has written a book about these:

> Extreme Poetry - The South Asian Movement of Simultaneous Narration (2010)

though the book is a bit lighter on examples and heavier on theorizing (the price of academia) than I'd like.

<comment><USER27> Interesting, will check that out.

</comment></comment></comment></comment></comment></comment><comment><USER28> I've heard many say puns are the lowest form of humour, including a close friend's mother, but anyone who thinks as much has fixiated on the wrong thing. It's a classuffocation error, like saying steak is the unhealthiest type of vegetabull. Puns are like oxygen to me. They are an art. Without that art I choke. Anyone who tries to gag my puns ought to be trampled by a Belgian Blue, in the face. I don't know what their beef is, maybe they tried out at a pun meet, didn't make the cut, and can't shoulder it. Let it go. Take a deep breath. Become a vegetarian. No need to go through life choking down burnt rump when you can have a breath of fresh lettuce spun. Let us pun.

<comment><USER29> _> I've heard many say puns are the lowest form of humour_

Sarcasm is said to be the lowest form of wit. Or are we considering humour and wit to be independent enough to each have their own league tables in this respect?

While we are on the subject: A pun is it's own reword.

<comment><USER30> Sarcasm may be the _lowest_ form of wit, but puns sure are the puniest.

</comment></comment></comment><comment><USER31> It's not that puns are bad per se, it's just that people making them tend to be pompous bores anyway.

</comment><comment><USER32> I was expecting a nice treatise on something like this topic:

[https://lispcast.com/nil-punning/](https://lispcast.com/nil-punning/)

</comment><comment><USER27> Let's throw all puns in the Punama Canal.

Also: A man! a plan! a canal! Panama!

is a pulindrome.

</comment><comment><USER33> I like puns and rap music. Often Good rap is puns set to a beat.

</comment><comment><USER34> People who pun for sport also have a very high probability of having a narrow view of comedy. It's as if comedy were simply an expression of the wit of the speaker.

That leaves the audience with little other than the facile verification of the speaker's wit. Yes, we confirm that word X has a double meaning. The groan is verbal confirmation that the speaker has essentially wasted their time.

Besides, there are other types of low-hanging comedic fruit-- crowd work, street jokes, musical parodies-- which don't get groans. Those typically involve skills other than wit-- like relating to other human beings, improvisation, vulnerability, etc.-- which I think is the reason why.

</comment><comment><USER4> Wow this article is some self-serving tripe.

puns?

1\. most people aren't very funny

2\. some smart people conflate recognising a reference to some external knowledge with wit

3\. not enough people follow Shakespeare's lead and make lots of puns about genitals

</comment><comment><USER35> Attila the Pun gave them a bad name

</comment><comment><USER36> This article should have started with a punographic warning!</comment>


Rest-client gem is hijacked - <AUTHOR> https://github.com/rest-client/rest-client/issues/713 <comment><USER3> Hey since this is blown up I just want to address it directly.

I take responsibility for what happened here. My RubyGems.org account was using an insecure, reused password that has leaked to the internet in other breaches.

I made that account probably over 10 years ago, so it predated my use of password managers and I haven't used it much lately, so I didn't catch it in a 1password audit or anything.

Sometimes we miss things despite our best efforts.

Rotate your passwords, kids.

<comment><USER4> Wow, that's a pretty well executed and possibly targeted attack then. It blows my mind how easy it can be to perform a high impact attack by abusing popular libraries. Hopefully this was caught before it got into production in high profile implementations.

<comment><USER3> Yeah I'm assuming the methodology is:

1) Find high-value target libraries

2) Grab the usernames of accounts with push access

3) Check those against password dumps

I feel really stupid about this, but like I said it was an oversight. I apologize and will try to do better.

<comment><USER5> Sounds like rubygems and other registries like npm should try to get ahold of those password dumps and check them against their own account databases somewhat frequently!

<comment><USER6> If you find a reused password, how do you let the user know though? If I got a "your account is vulnerable" message I'd ignore it as junk like all the other ones I get pretty much daily. You could force a change next time the user logs to your interactive interface, but many users won't do that for some time.

The best approach is probably to disable the account completely until an interactive login is made and a password reset can be forced but some would be up in arms about the inconvenience caused: you can't just allow a simple reset as the login could be coming from an attacker not the original user, an extra channel will need to be used to verify the identity. You might just have to leave the account locked forever and expect the user to create a new one - <USER2> now you have the old account and its content which may be used as a dependency of many projects which now break, unnecessarily if there _hasn 't_ been a login by a nefarious type.

<comment><USER7> You could send that notification, invalidate any client tokens, and also disable the compromised password forcing the user to re-authenticate through their email address, a-la password reset, and I guess also verify they aren't using the same password again.

You wouldn't lock the account forever, the point is to establish that the person whose password was compromised knows, that the password is not the only factor which is used to regain access to the account, and to ensure that your service (rubygems) and its downstream users are not compromised as well as a result of the breach.

Any groaning about the inconvenience caused by disabling account access until the password is changed, can be simply shrugged away in favor of security concerns, with a link to this story about rest-client.

By the time you have learned the user's plaintext password, their account may already have been compromised. There's a case to make that you disable all downloads of any gems that might be compromised from the account until you've verified they aren't. That might be over the top, especially for popular projects as now we are talking serious inconvenience affecting potentially thousands or more of downstreams.

It's a sticky situation, since you don't really know how long that password has been in the open for hackers to use and abuse once you've discovered it in a password dump.

</comment></comment></comment></comment></comment></comment><comment><USER8> It looks pretty bad if you had deployed this :(

Here is a summary of the exploit re-pasted from a great comment [1] written by @JanDintel on the github thread:

\- It sent the URL of the infected host to the attacker.

\- It sent the environment variables of the infected host to the attacker. Depending on your set-up this can include credentials of services that you use e.g. database, payment service provider.

\- It allowed to eval Ruby code on the infected host. Attacker needed to send a signed (using the attacker's own key) cookie with the Ruby code to run.

\- It overloaded the #authenticate method on the Identity class. Every time the method gets called it will send the email/password to the attacker. However I'm unsure which libraries use the Identity class though, maybe someone else knows?

So... it potentially comprised your user's passwords AND (if you were on Heroku or similar like many Rails apps are) system-level access to all your attached data stores. About as bad as it gets.

[1] [https://github.com/rest-client/rest- client/issues/713#issuec...](https://github.com/rest-client/rest- client/issues/713#issuecomment-522967049)

<comment><USER9> Not only the data could be accessed, it's entirely possible it was modified. Unless you have good logging of all data changes (at DB level) it can be very difficult to detect these changes.

The first hijacked version was released on August 13th.

</comment></comment><comment><USER10> I think that rubygems should consider automatically enforcing multifactor authentication for popular gems.

So any gem with more than 50,000 downloads should force to gem maintainer to have MFA set up before they can publish a new version or do anything with that gem.

Because, having MFA is not about protecting gem maintainers, it's about protecting users. So, gem maintainers should not be allowed to be careless with security by not using MFA. It's not their choice to make.

<comment><USER11> It's not just rubygems that has this issue, it's all the other repos too, most of which (AFAIK) don't enforce 2FA

Also worth noting that whilst MFA helps, it's not a panacea as MFA isn't generally compatible with automated CI/CD processes, so API keys will still be required, and can be leaked/lost/stolen.

<comment><USER12> Why would a CI/CD need to permissions modify and commit code to a repo?

<comment><USER11> Say your CI pipeline runs automated tests, builds the gem and pushes to Rubygems, it needs permissions to push to Rubygems.

So if an attacker compromises the API key used by that pipeline, they get the rights to push to Rubygems.

<comment><USER13> Actually publishing new versions seems like something that happens infrequently enough that it would be fine to require a manual auth to complete it. Given the potential risks it seems prudent.

<comment><USER11> I'd expect that very much depends on the software in question. As one example that I'm aware of, gvisor from Google delivers nightly builds. So they're building and pushing every single day.

It'd depend on the individual software library and of course as a consumer of many libraries you generally will have limited or no visibility of the practices of all your dependencies.

<comment><USER14> I don't think nightly builds are the same thing as releases - you can have CI publish a build but to create a versioned public release it should require manual auth.

<comment><USER11> That's a view of course (although in the case of gVisor they don't actually do versioned build just nightlies) but here's a question.

As a consumer of software libraries, have you ever looked into the security practices of the library author before choosing whether to use it or not?

<comment><USER15> This is becoming increasingly impractical for certain ecosystems as packages depend on packages, which depend on packages, etc. It's less of a problem with the bundler ecosystem, where larger packages with relatively few dependencies is more standard, but in the JS world installing a package means that you're likely installing tens or hundreds of sub-dependencies.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> It's mind-boggling to think how fragile and potentially dangerous those dependency ecosystems are – no matter if it's Ruby, JS, PHP or other languages widely used for web apps.

We all just hope that nothing bad will happen or that it will be noticed fast enough. Accounts get compromised, maintainers quit and transfer their project, bad actors might even pay the dev of some lesser-known dependency…

I have no easy solution for this problem and of course I too use external dependencies in my projects – but it feels like it's only a matter of time till disaster will happen and most of us just ignore this problem till then.

<comment><USER11> Yeah this problem has been a known issue for a long time, but there really is no easy fix, and incentives are stacked against it getting resolved in any meaningful way.

I did a talk for AppsecEU back in 2015 on this topic and found good material talking about it as a risk going back years before that...

<comment><USER17> I think I might start using fully isolated environments (i.e., via Vagrant/Docker/etc.) for all of my projects from now on (I already do for some).

<comment><USER18> That approach will mitigate your machine getting compromised (which is good) but it won't fix your production machines getting compromised if the gem or package gets deployed. That is usually a much worse outcome.

And even in isolated environments I find myself running code outside of the container for testing. Usually a quick script to test some package's functionality or opening a REPL to run something or running a code-generator (manage.py, artisan, etc). That's all it takes for the malware to break out of the isolation and attack your machine.

</comment></comment></comment></comment><comment><USER19> Ruby gem hijacking also happened to Strong_password a few weeks ago.

[https://news.ycombinator.com/item?id=20377136](https://news.ycombinator.com/item?id=20377136)

This is major new line of attack, and web app infrastructure is critically weak to it. We rejected distro-controlled package management in favor of pip and gem and npm years ago (for good reasons), but as this sort of attack becomes much more common (which it will), we might find ourselves missing the days of strong central control.

Rubygems should have acted on the Strong_password news, but missed the opportunity. I hope that they can get their act together now that they are lucky enough to have a second chance before this style of attack really explodes.

<comment><USER20> > We rejected distro-controlled package management in favor of pip and gem and > npm years ago (for good reasons)

While I'm generally a fan of distribution-provided packages, they would not have helped in this case. Distributions simply lack the manpower to audit all upstream releases for these kinds of issues.

<comment><USER21> This gem was published six days before it was found, which means that the effectiveness of the attack seems to have relied on it being picked up by people doing automatic upgrades. Wouldn't a distro help because it fundamentally is less predictable about when it takes a new version?

</comment></comment></comment><comment><USER22> It's worth noting that the hijacker pushed a malicious version of 1.6.x

Version 1.7.0 was released to rubygems on 8th July 2014, and 2.0.0 on 2nd July 2016, so anyone who has started using rest-client or run a `bundle update` recently is unlikely to be affected.

The impact _could_ have been significantly greater had the hijacker pushed a new versions of 1.8.x or 2.x as well, so it's very fortunate the breach was spotted now.

<comment><USER23> That's a good point. Could indicate a targeted attack?

<comment><USER24> That was my first thought - it would seem as though releasing on a version that old would be deliberate and why else would you do that if you weren't targeting something specific?

</comment></comment></comment><comment><USER25> I'm an author of gems with a total of more than 4 million downloads. I just setup 2fa now after seeing this.

<comment><USER25> I actually ended up going further and removing me as author from gems I don't actually maintain anymore, which brings down my exposure considerably. It's actually not as easy as it could be to remove yourself as an author from a gem (have to do it via command line).

<comment><USER23> What happens to orphaned gems? It seems like someone could make the case for getting ownership of them much easier than if you kept ownership and added a loud deprecation warning.

<comment><USER25> I wasn't the only author on those gems, the others are (mostly) still active. Not sure how orphaned gems are handled, though.

</comment></comment></comment></comment><comment><USER26> This is bad. Also from the Github comments, here's a useful snippet to quickly search your projects to see if any of your projects are impacted[0]:

      cd ~/code # Where all my projects live
      grep --include='Gemfile.lock' -r . -e 'rest-client \(1\.6\.1[0123]\)'

[https://github.com/rest-client/rest- client/issues/713#issuec...](https://github.com/rest-client/rest- client/issues/713#issuecomment-522987796)

</comment><comment><USER27> Whitelist outbound access from your network. It's not perfect and it can be painful to deploy, particularly gems, but it stops several categories of attacks.

</comment><comment><USER11> Following closely on from Webmin's compromised CI/CD pipeline, this is another instance of the growing problem of supply chain attacks.

With the software supply chain being as complex as it is, and the large number of moving parts, we're only going to see more of these ...

</comment><comment><USER28> Rubygems acted when they were notified [0]. There were a few affected by this at the same time, not just rest-client.

[0] [https://github.com/rubygems/rubygems.org/wiki/Gems-yanked- an...](https://github.com/rubygems/rubygems.org/wiki/Gems-yanked-and-accounts- locked#19-aug-2019)

</comment><comment><USER11> For all the people who are rightly concerned about these attacks here's a a couple of questions

\- Would you pay money for access to a package repository that had good security practices? How much would you pay? Would you accept delays in library updates to allow for security checks? If so, how long a delay would be acceptable.

\- Have you ever looked into the security practices of open source applications or libraries that you wanted to use and had the information you did or did not find affect your decision to use that software?

\- How often do you use the inventory of all the libararies you have, to periodically check on the provenance of those libaries and that they are maintaining good security practices?

Ultimately these problems (like most) are one of incentives. It's very easy to build software very quickly using the huge number of open source components that are freely available.

Whilst speed of development and price are the primary considerations, it's not going to be surprising that security takes a lower rung on the ladder.

<comment><USER29> I used to work for the government and we had a private gem server that introduced much for what you're asking about; delays in releases as a trade- off for security practices. Ultimately, I don't think there was any tooling available to automate the vulnerability scanning enough that a private server gives you much of a jump start on any kind of CVE that bundle audit wouldn't already catch. The workaround of needing to hit GitHub directly to get a current version and bypass the private server is also available.

Additionally, GitHub provides a bundler-audit like service for free. And, identifying those that are t CVEs yet seems like something scriptable but also obfuscatable (on the attacker end).

I don't think any team I've been on (federal or private) would pay extra for this kind of service given the frequency with which we do updates and the amount of effort that needs a careful developer spends when doing these updates. The most recent breaches have been noted well I'm advance of any updates we would have done.

I'd be glad to be wrong about it because I think a few more tools in this space would only help the community.

It would be nice if a service could summarize the differences in actual gem releases, to make things like the changelog and the diff easily digestable for all the available updates though (versus a scan/lint). That would let a developers more easily identify these kinds of breaches than cloning and diffing.

</comment></comment><comment><USER30> This actually is a perfect illustration why in production all of your systems have to go through a while-listing proxy rather than a NAT for the outside access.

There should be a very limited number of known external URLs that your production system needs to hit. Whitelist them on a proxy. Block the rest. Dump the blocked requests into a log. Put alerts on a log. It will get most of data exfiltration attempts or attacks such as this. Remember, when your goal is not to have a perfect security -- your goal is to have a better security than someone else so that someone else gets to be a chump and not you.

</comment><comment><USER31> Is there a way to check if a gem was released by an account using MFA?

If there was a "published with mfa" flag on every gem release and it would allow a Bundler setting to block installing gems without 2FA.

Of course, this would also help attackers find targets. But maybe its worth the trade-off?

<comment><USER32> Seems like a pointless, false sense of security.

What about all the attacks where the malicious actor is someone with publish rights, like friendly package takeover? Your proposal makes that even more effective since now the attacker gets a nice "published with mfa" badge.

<comment><USER31> It would have prevented this attack, so I'm not sure how its pointless. Obviously it doesn't fix everything. MFA is MFA. I don't know why anyone would take it as a guarantee that some third-party has audited all the code.

<comment><USER32> > It would have prevented this attack

Your post was about a "published with mfa" vanity badge which I was responding to, not the merits of mfa in general.

<comment><USER31> sorry, that is not what I mean.

I don't care really about a badge, I care about the information being available so that it can be used in Bundler. Its about developers being given the choice in their gemfile to disallow installation of any gems uploaded without 2FA. But in order to do that, we need rubygems to publish that information.

<comment><USER32> No, I understand you. My point is that whether a package uses 2FA or not should have zero impact on your security practices, yet your proposal suggests otherwise.

It doesn't seem like it does you much good to know if a package uses 2FA except to potentially weaken your defenses. For example, any scrutiny you level at a non-2FA package should also be leveled at 2FA-enabled packages. Though I suppose there is a non-zero benefit, so I won't belabor this argument any further.

Perhaps package repositories should be nagging publishers to enable 2FA. Though poorly implemented 2FA also introduces new attack vectors like the "lol lost my phone" social engineering attack.

</comment></comment></comment></comment></comment></comment><comment><USER33> Seems rather similar to the strong_password case from a month back: [https://news.ycombinator.com/item?id=20377136](https://news.ycombinator.com/item?id=20377136) . I wonder if anyone has checked basic things like scanning all of rubygems for "pastebin" or "eval( * http * )".

<comment><USER34> it surprises me a bit.

I'm wondering why wouldn't RubyGems implement some basic form of malware detection? This type of code shouldn't be too hard to classify.

<comment><USER35> Malicious users would just change their code slightly to get past it. Use a different service than pastebin, or just obfuscating it more.

<comment><USER34> After thinking about.. I think you must be right. Malware detection is not an easy task especially because of Ruby's dynamic nature.

Even simple open(), sleep(), eval() could be easily obfuscated.

</comment></comment></comment></comment><comment><USER36> Does ruby gems allow for signing releases? For example, the maintainer could upload their public key and use their private key to sign a package release. Then the consumer could verify the signature via the public key. If the public key changes, then the consumer could be alerted to that fact.

<comment><USER25> Yes it does, and I do this with my gems, but it's not widely used and I'm sure virtually none of the users of the gems I author probably take advantage of it.

[https://guides.rubygems.org/security/](https://guides.rubygems.org/security/)

> However, this method of securing gems is not widely used. It requires a > number of manual steps on the part of the developer, and there is no well- > established chain of trust for gem signing keys. Discussion of new signing > models such as X509 and OpenPGP is going on in the rubygems-trust wiki, the > RubyGems-Developers list and in IRC. The goal is to improve (or replace) the > signing system so that it is easy for authors and transparent for users.

</comment></comment><comment><USER37> This is a fairly old version of the gem, but probably what attacker was going for (users who infrequently go to new versions, and avoiding those who watch most up to date version)

</comment><comment><USER38> That is sadly a good example of why relying on trusted and accountable API clients should be considered critical for business.

When consuming APIs and not thinking about this, we are only building technical debt and security issues for the future.

Today's example is really bad since it targets a well-used meta API open- source library, but how many of those issues are already present on hundreds of other obscure open-source API clients?

</comment><comment><USER39> Out of curiosity, is there a legal way to go after people that do these? e.g., File a police report?

<comment><USER11> Unless the attacker had very poor OpSec, it would be hard to track them down, even assuming the relevant police force had the skills/manpower to do so.

Then you get the delight of likely jurisdictional issues, if it turns out the attacker is not a resident of the same country as the victim that reported it.

<comment><USER40> It's also likely it was done by an intelligence agency.

<comment><USER41> Not really. The attacker seemed to target bitcoin once again... surprising this shit is still profitable, though.

<comment><USER6> _> surprising this shit is still profitable_

If the cost of the attack is as near to zero as makes no odds, _any_ income is profit, whether it comes from being able to compromise bitcoin related accounts elsewhere, getting a miner to run on 00s of servers and/or 000s of clients, or getting other details to use in a "send me bitcoint and I will/won't X" blackmail. And if there is no income from the attack, the cost of trying is near zero.

</comment></comment></comment></comment></comment><comment><USER42> What's kind of interesting about this is the fact that it is able to just blindly dump environment variables.

For a long time, environment variables have been evangelized as the secure place to store credentials and things, but that just gives third party scripts a known place to look.

You could argue that might actually be more secure to store your secrets in a separate, custom config file that gets read into the rails app via an initializer or something.

</comment><comment><USER43> Many of these attacks seem to use pastebin. I will add a hosts entry pointing pastebin to localhost in my production servers.

</comment><comment><USER34> Many popular gems have multiple authors(with push ability) on RubyGems. Like 4, 5 authors, sometimes even more. It may look impressive on their profile but from a security standpoint that's 4x, 5x Attack surface from what it potentially could be.

</comment><comment><USER44> Hello, here is an explanation and analysis of this rest-client backdoor: [https://application.security/ruby- backdoor](https://application.security/ruby-backdoor)

</comment><comment><USER45> Good thing your Gemfile.lock is checked in and gems hosted on rubygems.org are frozen / imutable

</comment><comment><USER46> Another case for universal adoption of 2FA.

</comment><comment><USER47> Why doesn't this repo mandate 2FA?</comment>


BART signs up for 20 years of Wi-Fi - <AUTHOR> http://news.cnet.com/8301-1035_3-10154093-94.html

<comment><USER2> 20 years seems like a long commitment to any particular technology.

In 1989, token ring (a LAN technology backed by IBM) was a viable alternative to Ethernet. If a particularly info-highway-smitten municipality had made a 20-year deal with IBM to have token ring networking installed in all new buildings, they would have been kicking themselves for the past 15 years...

</comment><comment><USER3> I have to complain, I've ridden BART in San Francisco for three years and had no idea I could have signed up for wifi. I wish I'd noticed the network on my phone and looked into it, but of course looking for wifi on BART never occurred to me (to save battery life I have "search for networks" turned off). I ride the train almost every day and I've never seen a notice at a station about the network. If only 16,000 people of several million in the BART service area signed up, then apparently tens or hundreds of thousands of wifi- enabled commuters never heard of this either.

And now they'll be expected to pay as much per month for a daily hour of the Internet as they do for constant access at work and home.

As a layperson, the only reasons I can see for BART to set such a high price point are a misunderstanding about the economics or a desire to keep usage at a low, manageable level.

I suspect I should be glad that there's wifi at all, at any price, but frankly $30 a month makes this "public service" a toy for highly paid commuters rather than an intensely useful public tool for all the area's travelers. I hope against hope that the daily and hourly fees aren't high enough to remind me of AOL-by-the-hour. To think we've reached a point where the privately owned cafes give away wireless, and the publicly owned transit charges for it.

<comment><USER4> I'd rather have them charge for the WiFi service in liu of raising, already above national public transit average, prices to give it away for free.

<comment><USER3> The difference of magnitude between the revenue of the proposed wifi charges and the revenue of BART ticket prices is so staggering that a comparison makes little sense. It's much more likely that money could be taken from another area of costs than that the cost of wifi would affect ticket prices.

I'm not saying the money will appear out of nowhere, but it's certainly not staggering if the current charge structure is expected to create a profit for the company that installed the network.

</comment></comment></comment><comment><USER5> This raises so many doubts. As with numerous other comments to the original SF Chronicle article, I am outraged at the idea that _one more WIFI_ service area thinks I should be subscribing for $30/ month or so. Right :/ Furthermore: who decided to sign a 10-year contract? The supervising Board for BART must have been blinded by its drool over a cash cow to help fund its operations. Did it not occur to them that it's likely rates will be coming down because of increased competition & new technologies within even _5_ years? Of course 16,000 signed up _for free_. Let's form a pool to bet how long it'll take to get that number of _paid_ subscribers.

</comment><comment><USER6> The day pass for wifi is $10? I think by 2011 (date set to be completed), a lot of people will be on mobile data plans and it won't really be worth it to pay for internet on a 30 min ride.

<comment><USER7> Good luck getting mobile data signals on BART -- it's difficult just to maintain a cell phone call. The value here is the _consistency_ of the signal.

(Not that I think that $10 is reasonable for a day pass.)

<comment><USER4> Which line are you riding on? I take BART from Dublin/Pleasanton to New Montgomery every day and the only time I lose my signal is through the Lake Merrit tunnel and Transbay Tube.

<comment><USER7> I mainly commute between the city and Berkeley. The signal obviously goes dead in the transbay, but it's been pretty spotty in the above-ground parts, too.</comment></comment></comment></comment>


How Fraudulent Users Slip Under the Radar - <AUTHOR> http://blog.siftscience.com/blog/2015/how-fraudulent-users-slip-under-the-radar <comment><USER2> Some useful patterns, but also quite likley noise.

Both Alaska and Delaware are small states, with (relatively) small populations. For classifiers with uneven numbers of members (e.g., states), odds are high that whatever your outlier member is _will be a lower-population classifier_. It's simply a matter of variance and other elements.

To test for _actual_ significance of those findings, you'd want to look at Monte Carlo simulations through your dataset over time to see if there's a _consistent_ trend for these particular indicators, or if the locus shifts among several other regions.

Other indicators such as multiple accounts and time/day of activity suggest stronger causal relationships.

<comment><USER3> This post is not useful or meant to be useful, I think. It's just supposed to be entertaining enough to get you to think about Sift. You shouldn't blacklist Delaware addresses or elderly people…

That said, your point about noise here is a good and interesting one

</comment></comment><comment><USER4> Fraud doesn't just cause merchants lost goods. It makes ordering from stores more difficult when there are extra steps (at least 3-D secure) just for fraud reduction. This both annoys customers and causes sales to be lost because ordering is less convenient.

It causes unnecessary returns when merchants end up sending things to non- existent addresses that someone just invented to see if their stolen card was working or not.

It even makes things like A/B testing less reliable, when your numbers are skewed by fraud. Eliminating an extra step in your order process might look like a great A/B testing win. Unless it was just because that "optimization" just made fraud easier to commit. At the very least it adds noise.

It also makes it more difficult to know where you as a merchant stand financially, as orders can become reversed in the future. Even if you seemingly turned a $1000 profit this month, later you might find out you actually didn't.

It's a sad situation that we have to just try to guess who might be committing fraud or not, sometimes denying service to perfectly legitimate users while still missing many cases of actual fraud.

</comment><comment><USER5> I often buy sub-$20 items and have to try a few credit cards because I forget how much is left on each one (I use one-time load cards for security).

So that explains the holds I sometimes get on orders, where I am like why hold up a $20 order.

Regarding Deleware, I bet there are drop mailers there, surprised there isn't a database of those.

</comment><comment><USER6> And now the fraudiest fraudsters in the fraudlands know how to fraudulently defraud without ringing any fraudbells.

</comment><comment><USER7> I wonder if the age range identified is because these fraudsters speed through the sign up and select the low value when asked their age. I wonder if they are either 1/1 or 12/31 babies too.

<comment><USER8> That is definitely a trend. Similarly, Alaska (first in the abbreviated drop down list for states) could be fraudulent due to the same reason. I don't believe that the fraud users are actually from Alaska.

</comment></comment><comment><USER9> A little off-topic, but today there was a pretty entertaining post on Gawker about ISIS follower accounts who were caught talking about mundane stuff and having run-of-the-mill "Twitter" drama:

[http://gawker.com/even-isis-guys-have-twitter- drama-17405414...](http://gawker.com/even-isis-guys-have-twitter- drama-1740541455)

What was funny was not just the purported content of the tweets -- now apparently removed by Twitter -- but how these guys were identified:

> _...Abu Yusuf Al-Jabarti is an avid tweeter (his handle, @AlJabarti42, > indicates he's been banned 41 times) and supporter of the Islamic State. > Most of his tweets are like this, just trying to expand his brand like > everyone else..._

I'm not saying it's easy to write a general algorithm that follows a rule of "If an account gets banned an another account with the same name but a Levenshtein distance of 1 sprouts up from the same IP block and its first tweets contain similar content to the deleted account, then ban that new account, too"...at least, it wouldn't be easier than removing these accounts ad-hoc (i.e. after Gawker discovers them)...but some problematic users don't even make themselves hard to find and yet the prospective computational solution isn't necessarily practical to implement or particularly worth anyone's time (at the moment...).

</comment><comment><USER10> Systems like Sift are interesting. Machine learning can pick up a lot of trends over time that humans can't. The problem is that they often fail to react quickly to new trends, many of which hit hard quickly. I've talked to a lot of these vendors and most of them are complimenting machine learning systems with traditional rule-based systems and human review because ML by itself is too slow in adapting to attackers.

</comment><comment><USER11> >Fraudsters work at night. 3 a.m. is the fraudiest time of day, regardless of time zone.

what does that even mean? it's always 3 am somewhere in the world.

<comment><USER12> I think they mean consumers who make transactions at 3am their time are more likely to be committing fraud.

</comment></comment><comment><USER13> I'm generally opposed to torture, but I make an exception for people who coin neologisms like 'fraudiest.' No thanks for that assault on literacy.

<comment><USER14> Q: What do you call a language that doesn't change year after year?

A: Dead.

There was a great interview with the folks at the OED about why they added words to the dictionary that someone had just "made up" (like 'selfie'). And their answer was simply that all words are made up at some point, and trying out a new word exposes it to the population and ones that effectively communicate a concept or idea get picked up and distributed. That is how the language evolves to deal with a world and a society that evolves.

On the flip side, many folks are rather annoyed that technologists took previously fine words and repurposed them for their own use and now they speak a language that sounds like English but isn't understandable by non-techies.

I'm guessing the OED folks would have preferred that new words were created to cover that case :-)

<comment><USER15> One might also consider that a dictionary should be considered a service, to provide the user a means to identify and understand unfamiliar language. I think, too often, people treat dictionaries as official authority on language. But I'm not aware that there is any such thing as a central language authority for any language other than French. So, for a dictionary to include a word like "selfie" is not necessarily a definitive inclusion of the word in the language (as literally no-one holds that authority), but a statement that new things are going on that readers might, just perhaps, want to know about to stay relevant.

<comment><USER16> > _I think, too often, people treat dictionaries as official authority on > language._

They aren't, and a lot of people miss it - they don't know that dictionaries are descriptive, not proscriptive. They do not _define_ words, they only catalogue ones that are used, providing their most popular meanings.

<comment><USER15> That is a much more succinct way of describing what I was hamfistedly trying to say.</comment></comment></comment></comment></comment>