An update on our security incident - <AUTHOR> https://blog.twitter.com/en_us/topics/company/2020/an-update-on-our-security-incident.html <comment><USER2> >For up to eight of the Twitter accounts involved, the attackers took the additional step of downloading the account's information through our "Your Twitter Data" tool.

Yikes. Pretty much a confirmation of the speculation that the hackers would have access to Twitter DMs. Question is, which accounts?

edit: For reference, here's what's included in the "Your Twitter Data" tool [0]. There's some other info that may be of note than just DMs. I wonder what risks there are to knowing, for example, the past IP addresses and geolocations that VIP politicians access Twitter from? Hopefully they're behind a government VPN.

0: [https://help.twitter.com/en/managing-your- account/accessing-...](https://help.twitter.com/en/managing-your- account/accessing-your-twitter-data)

<comment><AUTHOR> > There is a lot speculation about the identity of these 8 accounts. We will > only disclose this to the impacted accounts, however to address some of the > speculation: none of the eight were Verified accounts.[0]

[0]: [https://twitter.com/TwitterSupport/status/128433914877449830...](https://twitter.com/TwitterSupport/status/1284339148774498305)

<comment><USER2> >none of the eight were Verified accounts.

That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them picking solely non-verifieds.

<comment><USER3> This is by far the most eyebrow-raising part of the update. To take over such a large number of verified accounts and then run a download on only eight non- verified ones seems almost impossible to have been anything other than targeted.

The original idea that the bitcoin scam was a diversion starts to look more plausible in this light, but in the absence of any information about the downloaded accounts, there's really no way to guess what their value may have been and to whom.

Alternately, to throw cold water on the above, maybe the process to kick off a download for verified accounts has extra safeguards and the eight non-verified were simply tests to try to determine why the verified downloads weren't working.

<comment><USER4> The idea that someone would opt out of downloading Elon masks or Jeff bezos' DMs is insane. Completely and perfectly insane. Not to mention the other people. Even if just in terms of profit, clearly the dms of the richest man in the world have enough value to just click download. It seems like the probability of this guy passing it up due to lack of interest is very small. Slightly more likely is that he was overwhelmed by the massive implications of having this access and simply didn't think to do it in the rush to do something before his source chickened out or realized what was going on. And most likely to me is that he simply couldn't do it because of a higher level of security associated with verified accounts, hence why none of the accounts were verified. He wasn't able to do anything with trumps twitter so I suspect that for certain high profile accounts, there is a much higher level of security that this guys source couldn't override.

<comment><USER5> I'm not sure what you're thinking, but it's perfectly reasonable.

People like you're talking about don't communicate anything of value over twitter. Bezos only follows his ex-wife who doesn't follow him back, barely uses twitter and would be unlikely to have any DMs at all. After the saudi hack, I would be surprised if he has much of anything installed on his phone.

The only real reason to hack celebrity accounts in this instance, and which they should have done, would be to deflect attention from the accounts they actually went after.

<comment><USER6> I wouldn't be so sure with Musk, for example. He even met his partner via DM.

<comment><USER7> Yeah, Musk spends a lot of time on Twitter, his DMs are def loaded, but I also agree that Bezos' is definitely empty. Still, I'm sure there are _some_ verified accounts they would've downloaded the data from if they could, so it makes me think they couldn't easily.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> To me the really irresponsible bit is that they kept the service up knowing full well there was a live attack in progress and they had not yet found a way to stop it. The Big Red Button has a place and the time to use it was last week. Given the prominence of the accounts that were compromised there isn't a shadow of doubt that shutting it down was the only responsible course of action. The world will continue to spin without Twitter for an hour or two, that this attack did as little damage as it did is because of the immaturity of the attackers, not because of Twitter being well defended. Pure luck.

<comment><USER9> I think that the fact the world will continue to spin without twitter is exactly why the hesitated to make that type of call.

<comment><USER10> Exactly. It's Twitter; nothing of value was lost. The recreationally outraged cancel mob had a minor setback.

<comment><USER11> hah!

"The recreationally outraged cancel mob"

FWIW, I actually enjoy twitter and get plenty of value from it (by selectively following interesting, intelligent people who post about things I care about) ... but your description is pretty funny -- and probably apt, at least for a sizable % of its users.

<comment><USER12> I personally had to leave twitter. I found a lot of value from it but despite keeping what I followed to a strict curated list, the 'outrage mob' seemed to always bleed into feed. Unfortunately it wasn't worth the value I got out of Twitter

</comment></comment></comment></comment></comment><comment><USER13> > 2FA compromised

This is why sending or generating a OTP, that the user types in, is not secure. The user can be tricked into handing the OTP over the phone. Even the O365 system isn't secure (because the user can be told which number to tap over the phone).

The only secure authentication these days is a _non-communicable_ possession: Yubikey or similar. This reflects *very poorly on Twitter opsec.

<comment><USER14> _very poorly_ is a bit much. Yes yubikey would be much better, but its not exactly standard across the industry yet.

For something to reflect very poorly on twitter opsec, I would expect it to be something that is below what the average tech company was doing. e.g. There was some news article claiming [Without a whole lot of evidence] that the compromised tool used a shared password that was posted as the topic of a slack channel. Now if that was actually true, I think that would fit the description of "very poor" opsec.

<comment><USER15> Google has made it a requirement to use hardware keys internally since early 2017 and has noted there have been zero successful phishing attempts since. Twitter would have done the same if they had competent security staff.

<comment><USER16> Twitter may not have the corporate ability to care about things beyond the horizon. IIRC the first time they posted a profit was less than two years back.

Google embarked on their BeyondCorp/zero-trust initiative after the 2009 Chinese APT breach. The teams working on their internal security had firepower and support from the very top of the organisation - and it took them _seven_ years to get from "we want to make entire classes of attacks impossible" to "we can now enforce it".

The disappointing truth in tech is that - apart from a few exceptions - security gets only superficial attention, because doing it right is a long- term investment. You need to be reliably profitable for that.

</comment></comment></comment></comment><comment><USER17> ' we are deliberately limiting the detail we share on our remediation steps at this time to protect their effectiveness '

Translation - it's not fixed. Security through obscurity.

Also timeline says 'Wednesday' post-mortem should be accurate to the minute or second.

<comment><USER18> > _Also timeline says 'Wednesday' post-mortem should be accurate to the minute > or second._

That's because it took them almost two hours to stop the attack - doesn't look good.

<comment><USER19> is two hours really that long?

<comment><USER20> When you have heads of state making insane executive proclamations via your platform, and you know that your weak sauce security is compromised — yes, it's way too long.

<comment><USER21> I feel like we're elevating Twitter to something way more meaningful and official than what it really is as a large scale public community bulletin board.

Like take down the forged messages, fix the hole that let them post them, issue an apology, and compensate the people who had their data stolen. No need to blow this up into something huge.

</comment></comment></comment></comment></comment><comment><USER22> I remember that answer to "What keeps you up at night?" of a major security advisor to be "Our employees! They click everything!".

Fitting video: [https://www.youtube.com/watch?v=bLXW2JQ0TZk](https://www.youtube.com/watch?v=bLXW2JQ0TZk)

Training to prevent these social engineering leaks is definitely critical.

<comment><USER23> Training is not the answer to security problems, as empirically it has no effect. The only measures that work are technological, like U2F keys.

<comment><USER24> Technical solutions can always be defeated by social engineering. Training is supposed to prevent that.

<comment><USER25> How do you socially engineer someone to compromise their U2F-based dongle?

<comment><USER26> When U2F is widely used, there will be more social engineering tricks - like, visit this attacker website or download this tool/browser extension, put cursor in box, now please touch your key to verify your identity.

Countless creative ways will be tried and discovered.

</comment></comment></comment></comment></comment><comment><USER27> > did the attackers see any of my private information? For the vast majority > of people, we believe the answer is, no.

This is such a weasel-y answer. "Yes, most of Earth's population was not affected by this breach" - sure, but those that were affected, how would you be certain that they didn't have their private information, such as DMs, pulled?

<comment><USER28> That's kind of a cynical take. I parsed that statement as saying:

> did the attackers see any of my private information? For the vast majority > of people [who we previously mentioned were affected by this hack], we > believe the answer is, no.

<comment><USER29> There is no indication that the accounts whose data was accessed were the accounts which tweeted the crypto scam.

Therefore, I'm not sure that's a straightforward explanation.

<comment><USER30> They say the attackers reset passwords on the accounts. Any competent engineering team would have a complete list of those events in logs

<comment><USER31> You can't assume competence after such an hack. Before this has happened, you would have assumed that Twitter employees wouldn't fall for social engineering on this scale.

I wonder especially how they could have bypassed their 2FA.

Unless they specifically tell you something, you can't assume it to be the case.

</comment></comment></comment></comment></comment><comment><USER32> Like many of you, I watched this rolling on Wednesday night using live verified accounts link that was widely shared. I was also just looking at the 'regular people' tab without verified accounts and saw many, many, many accounts tweeting the same "double your bitcoin" link, with the same BTC address. These weren't retweets. I'd assumed these accounts had also been compromised - was I wrong? It was far more than 130 accounts.

Or was this just people copying and pasting the same message (if so why that rather than retweet)? There were so many every few seconds I assumed it was a script just running through accounts. But --- if it wasn't, what were people hoping to gain? Views on their own profile?

<comment><USER33> Yes! I'm confused at what the automated attack was about. Possibly botnets tweeting it to distract from the real account access or to make the attack look worse than it was?

</comment></comment><comment><USER34> > Attackers were not able to view previous account passwords, as those are not > stored in plain text or available through the tools used in the attack.

They so carefully avoiding mentioning how they _do_ store passwords that I have to wonder what their security practices are on that front (and the rest). What tools _are_ they available under? You'd think they would've said "passwords are hashed and salted" to rule it out entirely if that was a thing.

<comment><USER35> > "passwords are hashed and salted"

Means something to you and me, but means nothing to the average Twitter user who is the audience for this blog post.

<comment><USER23> Hashed and salted is insufficient, as GPUs are extremely fast at crunching through hashes. Unless they use a memory-intensive (for GPU/FPGA résistance) algorithm like argon2 or scrypt, I would assume those credentials compromised.

<comment><USER36> Doesn't matter how fast GPUs are, they only get linearly faster. Passwords are exponential in terms of difficulty so assuming your password isn't password123 no GPU in the world is going to crack a 'decent' password in a decade on any modern algorithm memory-intensive or not.

<comment><USER35> It is unfortunate that manjalyc has been downvoted here :(

If you use unique strong random passwords like those typically chosen by a password store (e.g. 24 alphanumerics) it doesn't matter what password hash is used, it doesn't even matter whether salt was used, because there's no chance anybody else has the same one.

For example here is simple MD5() of a password I use every day, you have no idea what it is, and even very powerful MD5 "reversing" tools won't help you change that.

f72ffd77701fba433394548eedca5fd0

Good password hashes somewhat protect people who chose _bad passwords_. They're a mitigation. Your users will choose bad passwords so you need to use a password hash in software you build, but if you never use bad passwords you needn't care whether this or that site used a good hash since it has no impact on your security.

</comment></comment></comment></comment></comment><comment><USER37> I wish they mentioned what kind of social engineering attack it was. It could be a case study for any such incidents in the future.

P.S. I feel bad for the employees who were manipulated to give away the info.

<comment><USER38> I want to know how they social engineered an employee at a 2FA-enabled company into bypassing 2FA.

Was the employee able to disable 2FA for their own account?

Was the employee social engineered into adding someone else's 2FA key to their account?

Did the employee read a 2FA code to the attacker, and that somehow enabled all the evil things the attacker did, without any additional checks or 2FA codes?

Did the attacker hack the employee's system and MITM their 2FA code without their knowledge? It doesn't sound like it, because that wouldn't be social engineering.

<comment><USER39> I wonder if it was something like DUO and employees were told to just hit approve.

Get employee's password

Call employee

"Hey [employee], I'm [coworker] from the security team and we noticed your DUO was locked. I just enabled it, but we want to make sure it works. Hit Approve when you get a notification."

Log in with password

Wait for employee to hit Approve.

<comment><USER40> That's why you need a phishing-resistant method of 2FA. U2F is phishing resistant. Any type of OTP, or anything that doesn't bind the user action to the url bar is susceptible to phishing. U2F has the computer verify the url bar so it's phishing-resistant.

<comment><USER41> I just find it ironic that the same people pushing for 2FA and arbitrary password rules are now saying "oh I guess 2FA is phishable"

The best defense against Phishing seems to be to hire competent people and to train them on that and to establish "No You-Know-Who-You're-Talking-To" policies, as if something gets failed to do by whomever that didn't follow security procedures (example: "CEO" asking for "urgent" favour) is not blamed

<comment><USER40> Arbitrary password rules don't make phishing any easier or harder.

For phishing involving malicious websites the answer is not training, it's U2F. For other phishing, yes, training is useful.

</comment></comment></comment></comment></comment></comment><comment><USER42> I will use this as an ugly reminder that it's better to assume that any DMs could be public at any moment.

I don't subscribe to the "nothing to fear, if you have nothing to hide", I had conversations that are not illegal, lewd or even non-politically correct jokes, but would still hate to made public by a 3rd entity; from secrets that were shared by friends, to sensitive data like addresses, or information with clients with NDAs.

<comment><USER43> If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.

<comment><USER23> Cardinal Richelieu.

</comment></comment></comment><comment><USER44> Nothing about how they are fixing their internal processes that enabled individual employees to do password resets. Can anyone at twitter get control of any account? That seems problematic.

</comment><comment><USER45> They seem to be tiptoeing around without providing actual extent of the hack. They mentioned data exports being used for 8 non verified accounts, but haven't mentioned "direct messages" as the thing that were not accessed for other accounts. Twitter tracks user engagement, so it should be possible for them to have this information either from logs/user analytics.

I would be very wary of using their product's DMs now. Considering most journalists use Twitter, I can only hope that no one had used DMs to contact a journalist about something which can put the source in jeopardy.

<comment><USER46> They don't want to say what happened. It sounds like the problem is negligence in security design and not just a few employees who were manipulated.

<comment><USER45> Yeah, I can understand why they wouldn't want to say much as something like your DMs were accessed will lead to a lot of bad press; but they can't really keep hiding behind that. The less they say, the more the people who are privacy/security conscious will doubt their product.

I don't know how people use DMs on Twitter but if they are anywhere close to the general usage of Signal/WhatsApp/iMessage/Messenger etc. It is incredibly bad for them and something which can kill the platform unless they rethink that completely considering they don't even have E2E.

</comment></comment></comment><comment><USER47> Not sure if it has been mentioned previous, but Reply All did an episode on sim swaping and OG handles [https://gimletmedia.com/shows/reply- all/49ho5a/130-the-snapc...](https://gimletmedia.com/shows/reply- all/49ho5a/130-the-snapchat-thief)

</comment><comment><USER48> This is pathetic. How the hell did a comapny as rich as Twitter not have a break-glass around accessing this data. No one person should have had this level of access. No TWO people should have had this level of access. Unbelievable.

<comment><USER7> I don't think they "accessed" any data directly, rather they used the support access to initiate an account recovery (which I assume is very common, to help people who have lost their 2FA), and from there were able to take over the account. I do agree that there should probably be higher limits around initiating password reset for some very high value accounts.

</comment></comment><comment><USER49> ,,We became aware of the attackers' action on Wednesday, and moved quickly to lock down and regain control of the compromised accounts.''

They don't write about the fact that they let the scam going on for hours destroying lives of people. Locking down the accounts actually helped.the scammers, as the owners of the accounts or other Twitter employees weren't able to delete the scam messages.

<comment><USER50> > the fact that they let the scam going on for hours destroying lives of > people

Source?

<comment><USER49> You can look at the blockchain how much money people lost, and for how long the scam went on. Or you can just read Twitter's announcement: they did nothing to mitigate the scam. I remember being scammed for about $200 when I was a teenager and it was awful. I was ashamed of myself.

<comment><USER51> Has anyone stepped forward and claimed they were scammed yet?

It's _normal_ for scammers to pay themselves to make their scam look more legitimate.

If no one steps forward... it's not impossible that they actually didn't manage to scam anyone.

<comment><USER49> You're right, but it's also normal for people to be ashamed of getting scammed and not come forward. I have a friend who got scammed by altcoiners and lost most of his BTC even though I warned him many times. He didn't tell me this for many years because he was ashamed. At this time he doesn't have any chance of buying so many Bitcoins again ever in his life.

Leaving those messages up for so much time (at least an hour) was unacceptable anyways. When I was holding a pager for a product that impacted millions of people, my job was to mitigate all problems that could affect them as soon as I could.

<comment><USER51> > You're right, but it's also normal for people to be ashamed of getting > scammed and not come forward

It's true-- but ... no one?

> Leaving those messages up for so much time (at least an hour) was > unacceptable anyways.

They were actually still up many hours later and hidden for browsers only by javascript. Pretty remarkable when you consider that almost all of them had a bitcoin address or similar in them and could have been safely substring matched.

</comment></comment></comment></comment></comment></comment><comment><USER52> I like how Twitter wrote this post. It's apologetic, transparent, and clear. I feel like Cloudflare and Twitter have been really good with communicating what has happened and that is impressive. I'm glad these companies have learned from others' mistakes. Being transparent is the starting point of gaining back lost trust.

<comment><USER53> Agree, this is transparent, self aware, and takes responsibility. Kudos to Twitter.

It's in stark contrast to how FB wrote the post this week about their SDK crashing a bunch of third party apps. Some PR firm did all sorts of verbal gymnastics to avoid actually apologizing and taking real responsibility by shifting blame. [1]

[1] [https://news.ycombinator.com/item?id=23827885](https://news.ycombinator.com/item?id=23827885)

<comment><USER54> I've been a big fan of Twitter's engineering blog and how they're able to give historical context for why they made certain decisions. For example this recent post about search indexing could have been a university lecture:

[https://blog.twitter.com/engineering/en_us/topics/infrastruc...](https://blog.twitter.com/engineering/en_us/topics/infrastructure/2020/reducing- search-indexing-latency-to-one-second.html)

</comment></comment></comment><comment><USER55> Makes me think if social engineering is easier to do when employees are working from home.

</comment><comment><USER56> It would be helpful if Twitter supported the deletion of Direct Messages for all parties, as they do with public tweets. Right now, they just sit around in at least one party's inbox and accumulate, creating a valuable cache of private information.

(Twitter's implementation of Direct Messaging aligns more closely with instant messaging than email, therefore I believe a real deletion feature isn't an unreasonable expectation or ask.)

</comment><comment><USER57> This is one hell of a Friday night news dump.

</comment><comment><USER12> > Attackers were not able to view previous account passwords, as those are not > stored in plain text or available through the tools used in the attack.

I feel stupid for just realizing that social media account save previous passwords? How far back does it go?

<comment><USER58> Probably just the old hashes to prevent a user from reusing the last N passwords.

If you know the value of N (from UI errors trying to reuse one) and want them to get rid of an old hash for some reason then you could reset your password N times.

</comment></comment><comment><USER59> I think the Bitcoin scam is a red herring.

<comment><USER60> What could it be distracting from, or what would be the purpose of running a smaller/dumber attack before the actual one?

<comment><USER61> Whenever people start speculating that some dumb crime is a small part of some mastermind plot, you can rest assured that it's probably not.

</comment></comment></comment><comment><USER62> I believe it's much more interesting to know that the attackers got the email and personal phones of the involved targeted users, that means they will explore new vectors to attack them from other sources. That alone is more valuable than 100K USD, I guess all affected users going to change their emails and phones asap, but probably it will be late. My theory is the public tweet storm was just to kill the exploit in public, they can be accesing and using the tools for very long time without anyone from twitter noticing.

<comment><USER63> If they got access by triggering a password reset, it probably wouldn't go unnoticed for long.

</comment></comment><comment><USER64> Is there any information on whether a single employee or a number of employees were involved? I don't think the attackers could have had someone hired at Twitter Support only to carry out this attack, given how they tried to monetize. Also I suspect no more than one employee was involved, and that "social engineering" was done only to compromise their credentials, instead of asking them nicely to allow them access to multiple (130) popular accounts.

<comment><USER65> Some of the people involved were interviewed by the New York Times [0] and indicated that the person who was offering access claimed they managed to get into the Twitter Slack account and saw credentials being shared. I don't know if that is true or not, but all the external reporting doesn't indicate that a Twitter employee was actively involved. It's always possible someone was, but given the small amount of money made and the goal of the hackers themselves (OG accounts), it strikes me as unlikely. I would assume that any engineer with access to those types of systems would want to sell out for more than a tiny amount of crypto to some script kiddies on Discord, but you never know.

[0]: [https://www.nytimes.com/2020/07/17/technology/twitter- hacker...](https://www.nytimes.com/2020/07/17/technology/twitter-hackers- interview.html?referringSource=articleShare)

<comment><USER66> _> all the external reporting doesn't indicate that a Twitter employee was actively involved_

Joseph Cox at Vice Motherboard is claiming exactly that from his interview with the hackers:

 _" We used a rep that literally done all the work for us," one of the sources told Motherboard. The second source added they paid the Twitter insider. Motherboard granted the sources anonymity to speak candidly about a security incident. A Twitter spokesperson told Motherboard that the company is still investigating whether the employee hijacked the accounts themselves or gave hackers access to the tool._

[https://www.vice.com/en_us/article/jgxd3d/twitter-insider- ac...](https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel- account-hacks-biden-uber-bezos)

</comment></comment></comment><comment><USER67> > For 45 of those accounts, the attackers were able to initiate a password > reset, login to the account, and send Tweets

How did they initiate a password reset and successfully reset the password to login to the account? They must've had the owners' email passwords too? EDIT: So they changed the mail associated to the accounts to their own... but the system didnt email out to "old" email to notify them of the action being taken like most companies do?

<comment> a-wu As I understand it, the internal tools allow for changing the email. Change email -> password reset.

<comment><USER68> If this is true then it completely defeats the purpose of a two-factor authentication

<comment><USER14> Almost all internet companies have internal tools to disable 2FA. People destroy/break/etc their phones constantly and need it reset.

2FA is meant to protect against someone impersonating you. It is not designed to protect against malicious insider at the org you are trying to prove your identity to

<comment><USER23> But operations like that should require a second randomly chosen individual to verify.

The reality is the public loses credentials and keys all the time and at most companies security takes a back seat to convenience and customer service.

</comment></comment></comment></comment></comment><comment><USER69> There's no way to earn back trust after Twitter's shadow ban functionality got exposed through the leaked screenshots. Censorship is a terrible sin.

</comment><comment><USER65> It's interesting that the Your Data tool only started including DMs after GDPR stuff went into effect. For many years, DMs weren't part of the archive. When the feature was added in late 2018 or early 2019, it became clear that Twitter actually maintained an archive of all DMs, whether you had previously deleted them or not.

I'm glad this was only 8 accounts — but it's a good reminder that DMs aren't encrypted or secure and shouldn't be used that way.

</comment><comment><USER70> It's still happening. I just saw this blue checkmark account linking to cryptocurrency scams only 2 hours ago: [https://twitter.com/sephr/status/1284310424855343105](https://twitter.com/sephr/status/1284310424855343105)

<comment><USER71> I believe that's just a fake screenshot of an Elon Musk tweet.

</comment></comment><comment><USER72> What I get is even if they had the credentials of internal tools how did they actually access the internal network? Surely the internal tools are not just accessible on the open internet without VPNing into Twitters internal network?

</comment><comment><USER73> > Attackers were able to view personal information including email addresses > and phone numbers, which are displayed to some users of our internal support > tools.

Can anyone explain to me why the phone number is stored in plain text for them to see?

<comment><USER61> In case you need to call them?

<comment><USER73> And there is no way to secure them meanwhile?

This is horrible. Twitter forced me at some point to provide my phone number. I never wanted it.

</comment></comment></comment><comment><USER74> > on Wednesday, July 15, 2020, we detected a security incident at Twitter and > took immediate action.

> We became aware of the attackers' action on Wednesday

No mention of how they detected the incident or what alerted them to the attackers' action?

<comment><USER14> The fact it was world news was probably their first hint.

</comment></comment><comment><USER75> Why do companies store previous passworda, does this make my now strong passwords moot due to not being being as security conscious previously and reusing passwords?

<comment><USER76> Generally if a service was to keep them it would be to keep a history of passwords you may not use ever again. They wouldn't be available for use in authentication.

Obviously this is very implementation specific though, and can't be considered a rule.

</comment></comment><comment><USER77> What a joke of a company. They literally have done nothing in terms of building innovative products in the past 7 yrs since IPO and their monthly active users is static. And then, to distract away from their poor product roadmap, they take controversial political stands - but which don't result in any major impact given mostly bots and celebrities use that platform. And now this.

Keep in mind, some 4k employees work in this jungle. Don't know what they do apart from just tweeting #lovewhereyouwork

<comment><USER78> > In 2009, an 18-year-old hacker from the US managed to gain access to > Twitter's back-end systems by targeting a member of the company's support > staff

[https://decrypt.co/35911/6-times-twitters-security-was- breac...](https://decrypt.co/35911/6-times-twitters-security-was-breached)

</comment></comment><comment><USER79> Was this linked to the coming changes of the new API?

[https://blog.twitter.com/developer/en_us/topics/tools/2020/i...](https://blog.twitter.com/developer/en_us/topics/tools/2020/introducing_new_twitter_api.html)

<comment><USER80> They posted yesterday that it was not linked. but they delayed the release because of the incident.

</comment></comment><comment><USER81> This postmortem (if it exists at all) will never see the light of the day...

</comment><comment><USER82> Immediate action? The Dutch politicians account was hijacked for a whole day.

<comment><USER83> The immediate action is only for people that matter.

<comment><USER84> I don't understand.

The Dutch politicians fit that description

</comment></comment></comment><comment><USER85> Any comment on the buttons for blacklist trending and blacklist search?

</comment><comment><USER86> Let me guess, their internal support tools were available on the wide Internet instead of requiring the additional step of a VPN with certificate+password based login?

</comment><comment><USER87> I kind of like the messaging around this, but I don't have the feeling we know an awful lot more than we did before.

I'm glad they at least seem to realize all trust is gone.

</comment><comment><USER88> This seems like just a PR blog, there is no information here that everyone already does not know.

</comment><comment><USER89> So a single twitter support person can take over the account of Biden and Musk?

</comment><comment><USER90> How did they manipulate their employees? that's the most important part don't you think?

<comment><USER66> In an interview with the hacker by Vice Motherboard, they claimed they had an employee on the inside doing all the work, and they just paid the employee to do it:

[https://www.vice.com/en_us/article/jgxd3d/twitter-insider- ac...](https://www.vice.com/en_us/article/jgxd3d/twitter-insider-access-panel- account-hacks-biden-uber-bezos)

<comment><USER91> I just don't buy it. This guy or girl managed to get a job at Twitter but was willing to sell access to underground hackers for a bit of extra cash and expected no blowback? When the hackers were instructing the employee to post these tweets on behalf of Barack Obama and Joe Biden, did the employee not wonder if this could go wrong for him?

<comment><USER92> I think it's possible. Not everyone think rationally all the time. Perhaps this employee was blackmailed, perhaps s•he was soon fired from Twitter and wanted to get more money without thinking about the consequences.

Most people in jail didn't think or care about what could go wrong.

</comment></comment></comment></comment><comment><USER93> I wonder if ZeroHedge prediction might end being accurate:

That attackers probably would get most of their profits from blackmailing people because of their DMs.

I had hoped the hack was just API abuse to tweet in someone's name, not an actual account takeover, this introduce a whole lot of issues (including the fact some world powers use twitter... ever thought what would have happened if they had hijacked Trump's and Khamenei's accounts and started to give plausible threats to each other?)

</comment><comment><USER94> > None of the eight were verified accounts.

So.... Lowerclass plebs we don't care about as much? It's funny they admit this.

<comment><USER95> They are simply stating a relevant fact, you seem to be reading a jugement that's not there.

</comment></comment><comment><USER96> So the photos going around showing they have detrending tools might be real?

Is it ethically acceptable that they "curate" what is trending? (Edit: I was actually asking, but apparently got my answer)

Edit: I didn't believe it when I saw people claiming those pictures were being deleted when posted by to twitter, but verge confirms they're real. Trends blacklist and search blacklist. Didn't Jack testify to Congress they do not manipulate trends? [https://www.theverge.com/2020/7/15/21326656/twitter-hack- exp...](https://www.theverge.com/2020/7/15/21326656/twitter-hack-explanation- bitcoin-accounts-employee-tools)

<comment><USER97> I haven't seen this, do you have a link?

<comment><USER98> Can't tell which part you mean by "this." The pictures, or the Jack testimony.

You have one of the best usernames ever btw.

</comment></comment></comment><comment><USER99> > As mentioned above, we are deliberately limiting the detail we share on our > remediation steps at this time to protect their effectiveness and will > provide more technical details, where possible, in the future.

With all due respect, I have no confidence in measures that aren't transparent and open. They can share a lot of details without risking security, but by being vague about remediations, they're being obscure, not secure.

If they posted their exact remediations (hiding sensitive parts like precise information needed to take control of an admin account or use it), they would have an entire world of security experts ready to critique their plans. Instead, we have to trust and hope they get it right the second time.

</comment><comment><USER100> I don't understand the hubbub. It's just a stupid messaging network. Not our emails that got hacked.

I think this is relevant here - [https://m.youtube.com/watch?feature=emb_title&v=MjufyLPKsEw](https://m.youtube.com/watch?feature=emb_title&v=MjufyLPKsEw)

<comment><USER101> It's indeed a stupid messaging network, but having seen doctors and lawyers happily exchange documents and other sensitive data about their patients and clients through Facebook and Whatsapp, I wouldn't be surprised at all if it turns out that Twitter is being used for sensitive information as well.

Scanning a document and sending it through mail has been swapped with taking a photo with the cellphone and sending it through Whatsapp, and whoever took the photo very often forgets about it, so we have thousands of people out there with their phones loaded with sensitive data about their clients in the same directories they keep photos of their cats. Want to get sensitive data about someone? Just know where his doctor/lawyer lives or works, then open a cellphone repair shop nearby and be ready to copy everything when they bring you the terminal for screen/battery replacement or other problems, probably at least twice a year overall.

</comment></comment><comment><USER102> We need the guys at CMU (who also operate CERT) to engineer a replacement and setup a program for interns to operate it as a private non-profit for the rest of time.

The system that is out there now has been a running technological joke since it was (sort of) running on Windows and it would be My_ dust now if it weren't for the President who they now (rightly or wrongly) scorn. Some seriously bad things can (and probably are going to) happen to actual human beings because of that s*faced idiot phoning it in for way too long. He doesn't get to impact the democracy or influence the beating of other human beings hearts because he is not competent or careful enough to be trusted in such capacity.

<comment><USER103> Could you provide more context?

<comment><USER102> Did hackers download DIRECT MESSAGES from some Twitter accounts, something that should not be possible were the system correctly engineered and professionally operated?

Would it be naive to expect that this is the first time this mechanism has been used just because it is new to the Public?

If this mechanism has been used before, would it not be safe to assume that sponsors with virtually unlimited resources (such as foreign states) would have employed it to spy on their adversaries?

Would it be logical to conclude that the consequences of such adversaries having their DIRECT MESSAGES revealed resulted in personal injury and loss to those individuals and their associated social graph?

Wasn't Twitter a system setup by some beach bums using a bunch of old buggy Windows systems that barely worked and although it has been reengineered, isn't that same group still calling the shots (only now amplified ten orders of magnitude by additional funding)?

Shouldn't there be a better system, setup and operated by the best software engineers (like those at CMU) available to the Public along with a clear indication of why? --You know, before anyone else realizes personal injury or loss due to the actions of distracted beach bums calling the shots on the current system?

</comment></comment></comment><comment><USER104> Uhhhh....

> _Attackers were not able to view_ previous _account passwords, as_ those are > not stored in plain text _or available through the tools used in the > attack._

Does this mean _current passwords ARE stored in plain text_??

IF this is the case, chances are it's because plaintext passwords more straightforward remediation and (statistically significantly) lower support times/costs. The convenience of this cannot be understated. BUT:

\- Twitter just leaked that current passwords are stored in plain text

\- Twitter just leaked that current passwords can be viewed by support tools used by employees susceptible to social engineering

Again, IF this is true, it's a lesson about the privacy and security risks ever-more-frequently associated with convenience (in this case internal convenience).

<comment><USER105> They mean "previous" as in before the hackers did the password resets. (So all your passwords, except the one the hackers set.)

I don't think this implies a problem with "your current password" security, just that you don't care if the hackers have the password that they set themselves (and clearly already know then).</comment></comment>


Musical.ly, the lip-syncing video app, is going to sell for at least $800M - <AUTHOR> https://www.recode.net/2017/11/9/16632112/musically-toutiao-sale-800-million-video-app-china <comment><USER2> We merged most of this thread into [https://news.ycombinator.com/item?id=15669727](https://news.ycombinator.com/item?id=15669727).

</comment><comment><USER3> To understand this you need to understand that:

1\. This is massive with the tween/teen market. That is why not many people understand its popularity; you either need to know a tween, or have one as a kid.

2\. Musical.ly became Vine after Vine shutdown. The content moved from lip- synced videos to more of a mixure of vine-like videos and lip sync.

As of now Musical.ly is still #58 on the app store. Its hard to say people aren't using it when its above some large companies on the charts (Linkedin, Shazam, Dropbox).

Their influencer network is huge as well. Nearly every popular musical.ly star has some sort of swag from the company. Think about that in the tween's mind: you're just a normal kid going to your normal middle school with your normal friends, then a national company wants YOU to be a spokesman for the company. That is quite literally getting famous for these kids.

<comment><USER4> Teen/Tween is the probably the dumbest market to target. They have no money, which means that they are not customers. This entire "Man, they grow up and they convert" is just amazing voodoo.

<comment><USER5> Tell that to Justin Bieber and Hannah Montana.

If your kid begs for something they just might get it. The tween market is valuable and easily influenced.

<comment><USER4> Your "company" is not Justin Bieber or Hannah Montana. It does not have a product for them.</comment></comment></comment></comment>


I Passed Out Yesterday and This Is What Happened… - <AUTHOR> http://www.jamesaltucher.com/2016/10/passed-out-yesterday/ <comment><USER2> He passed out for a _couple of minutes_ and afterwards he played more ping pong.

Passing out is nature's way of telling you to go see doctor isn't it? (But I can see how someone could mistake it for "play another game of ping pong".)</comment>


Don't Hit Send: Angry Emails Just Make You Angrier - <AUTHOR> http://www.wsj.com/articles/dont-hit-send-angry-emails-just-make-you-angrier-1439227360 <comment><USER2> Venting is positive reinforcement of expression of anger. Renowned Buddhist monk and peace activist Thich Nhat Hanh calls this 'Training in Aggression':

 _> People who use venting techniques like hitting a pillow or shouting are actually rehearsing anger. When someone is angry and vents their anger by hitting a pillow, they are learning a dangerous habit. They are training in aggression. Instead, our approach is to generate the energy of mindfulness and embrace anger every time it manifests._

\- [http://www.lionsroar.com/loosening-the-knots-of- anger/](http://www.lionsroar.com/loosening-the-knots-of-anger/)

<comment><USER3> What absolute nonsense. Beating a pillow -- you are not hurting anybody and there is nothing wrong in it. The important distinction is to be aware of and to express your anger, obviously not at others, but at the pillow (or exercise, etc). Such a catharsis will make you feel unburdened and relaxed, more so than from control and condemnation.

<comment><USER4> I don't think that is good advice. There is a lot of interesting science that suggests exactly the opposite. Being angry succeeds in only one thing: making you angrier.

Here is a good overview: [https://www.mtholyoke.edu/courses/jbickfor/bushman2002.pdf](https://www.mtholyoke.edu/courses/jbickfor/bushman2002.pdf)

<comment><USER5> Speaking purely from my own anecdotal personal experience:

Dwelling on something and thinking about how angry it makes me certainly does make me angrier.

However, in the handful of times of my life that I've gotten really, truly, into a rage over something monumental, I had no way to actually let go of it until I had a chance to go scream into a pillow and punched my mattress a few times. The relief was pretty immediate - almost all of the anger drained away. Prior to that I was too amped up to do anything constructive about the issue. After, I was able to focus enough to get to work on fixing it.

I don't know how to reconcile my own personal experiences with that research, outside of a cop-out answer of "Not everyone is the same".

<comment><USER6> I don't think the two are incompatible in the slightest. It could well be that expressing your anger violently 1) makes you feel calmer in the moment, and 2) trains you to be more likely to need to do so in the future.

If that's the case, then "harmless" violent expression is a useful tool when others fail (as you've experienced - and certainly much preferable to directly harmful violent expression!), but other techniques should be learned and should be preferred out of habit.

That said, it's absolutely the case that "Not everyone is the same".

</comment></comment></comment></comment></comment><comment><USER7> I agree with the title of the article, but disagree with its thesis. Anger is an emotional sign from your brain that something is wrong. And actually sitting down to write the angry email makes me actually think everything through. Without identifying the source of my anger, the rage just builds.

But then, for the love of Linus, don't actually click send. This is like committing untested, breaking social code straight to production. It might work out for the best, but only if you're lucky. Like all writing, it needs to be refactored and edited; it needs to achieve a purpose other than making you feel temporarily justified. So wait an hour if you're a little angry. Wait six hours if you're a lot angry. (I wish Gmail could detect angry emails and replace "send" with a hamburger button, then I'd definitely have to calm down to figure out how to send it.)

But anger is not useless. I've launched websites because of a long, slow- burning ire at other sites, and it fueled my work for years. It's possible to channel rage into creative work. So, if your brain works that way, use it to show your own correctness and creativity, not another's problems.

<comment><USER8>
      But then, for the love of Linus, don't actually click send.

Quotable classic! LOL.

True, anger can be a fuel to get things done. But it's not a good fuel to use for long term sustainability. Blood pressure and stress are killers, my friend. There's got to be another way.

I have battled with an angry temperament my whole life. Stocked up on all kinds of CBT material. I'm 42 and as the mist and fog of testosterone is clearing with age, I can now see myself with a bit more sharper focus. It's hilarious. Sometimes I am baffled that I blew so much steam over something trivial! :-( Then the shame of getting angry follows shortly thereafter. Which then makes me angry with myself about the whole affair. Somewhat.

I've also noticed something interesting over the years ... that a lot of folks with what we call "shorter fuses" are often used for mild entertainment by others who deliberately provoke "short fusers". The sooner the "angros" realise that they are entertainment for others, the quicker they will recover from being reactionary personalities. Let the psychopaths find other forms of entertainment.

I grew up as an exercise-induced asthmatic kid, often sidelined in sports and games. I don't know whether this has shaped my mildly resentful, impatient and contrarian personality. (I am not ready to call myself cynical yet!) :-)

It has taken me decades of personal rehabilitation in the company of a loving, caring, understanding and forgiving wife.

God bless the Beauty whose job it is to tame the Beast! (I'm going to hug her right away!)

</comment></comment><comment><USER9> Typical of newspaper columns about emotions, this article muddles along with a few anecdotes, a sprinkling of social science, and some facile conclusions. A book selected at random from the "self-help" section of your bookstore will give you much better advice.

We've all regretted sending angry emails before, which is what makes the article resonate, but it also makes it useless. Sending an email that you immediately come to realize was inappropriate is a powerful teacher, and there's no need for a panel to weigh in on that particular situation. When we subtract out this noninformative core, we're left with a corona of FUD about venting and acting out of anger, formed out of a pastiche of quotes from scientists informally summarizing their research papers.

Don't fear anger. Like all emotions, it's not under your direct control. What you _should_ do is name it (say you're feeling angry, at least to yourself), accept that it is ok you are feeling that way, and ask yourself what in particular makes you so angry. Most people are pretty bad at one or more of these steps, and venting is a way to recruit someone else to help.

One person claims he is not angry, but goes on and on about a particular point in an angry tone. Another person knows she is angry, and immediately disparages herself for it. Yet another person has a persistent anger around their boss, but they do not know why and cannot seem to shake it, while the boss is indeed behaving badly in some way that would make anyone miserable. These people do not need any sort of admonitions against putting voice to their feelings.

</comment><comment><USER10> This is so true--I learned this long ago back when Scribophile was new. Members would sometimes get in to fights with each other, then email me in anger about how such-and-such person is terrible and how I was terrible for allowing terrible things to happen on the site. When I was new to everything I would email back, pointing out the error of their ways--often sharply, because I had been put in a bad mood. This _never, ever_ worked. Not once. It only made things worse.

I soon learned that often the best response is none at all. Sometimes a person needs to vent, and by whatever chance you end up being the punching bag. There's a 90% chance that if you don't hit 'reply' to that angry email with an angry email of your own, that the person will forget things in the morning and go about business as usual.

Next time you feel the overwhelming urge to write an angry email, or to put someone in their place, make yourself wait till tomorrow to do it. You'll find that most of the time the urge will have passed, life will go on just fine, and you won't have made an enemy in the end.

<comment><USER11> I was on Scribophile too. But I guess I came in after this era. Things were very civil except for the occasional misfit.

</comment></comment><comment><USER12> What's missing here is the most important factor of all, which isn't even directly tied to anger: the fight or flight response.

Humans have a biological reaction to certain kinds of stress which triggers this response and the impact on the ability to interact well with other humans is disastrous. We need to understand this, learn how to spot it, and learn how to deal with it. When a person is in this state they are literally less intelligent and less rational than normal, by an enormous margin. This is by design, because the response is geared toward enabling you to survive a life or death threat. It gives you an edge by preparing you for the worst case scenario and encouraging you to give everything you've got. When you're sprinting away or wrestling with a leopard or some such these things matter. You can't afford to doubt what you're doing or to have second thoughts even for a moment. You are much better off fighting like a feral animal or running like a scared rabbit than intentionally deliberating what to do next, and that affects your survival chances a lot.

But we don't live in those circumstances any more, yet getting in a heated argument at work, online, or with a significant other still triggers those same responses. But now they are harmful almost all of the time. This is precisely why there is so little rationality in a heated argument, because both sides "have their blood up", which means they are in the midst of experiencing the fight or flight response. Their body is forcing them to be irrational in the moment, and it just makes things worse.

Recognize when this is happening to you, recognize the ways that it's common to trigger other people into this sort of thing (e.g. being excessively negative, mean, and confrontational rather than professional and kind) and adjust your communication style accordingly. Also, avoid making the mistake of continuing a heated argument while you are under the influence of fight or flight. Take a break, take a walk, come back to the subject later when you have the opportunity to be rational.

Justified anger can actually have a positive effect if used well, but irrational, seething, mindless, feral anger will just spread irrationality and is generally unproductive or actively harmful.

I would highly recommend everyone read a book called "Crucial Conversation" about precisely this subject and how to ensure that you not only communicate well and rationally to others but they feel safe doing so with you.

</comment><comment><USER11> I wholeheartedly agree. I've learned this lesson the hard way, several times over. Catharsis is frequently not a healthy way to deal with anger. In many cases, anger is just a temporary storm in your brain that you need to let pass. It's not sealing the spout of some Freudian kettle that will result in a future explosion (though sometimes long-held grudges can be just that). It is never a good idea to make any sort of decision while under the influence of emotion. The advice I give myself: "Sleep on it. If you still want to do it tomorrow morning, knock yourself out."

</comment><comment><USER13> I don't even have to read the article to know I agree. Every time I've actually hit 'send' on an angry email, or 'post' in a thread, I get a temporary burst of self-righteousness, and... crushing regret the next morning. Every time. You'd think id've learned by now...

</comment><comment><USER14> For those that haven't read How to Win Friends and Influence People, Lincoln used to write long letters telling his generals how incompetent they are, but never sent them. It was his way of getting it out of his system.

Some people recommend doing this with emails as well - type but don't send. If you do do this though, make sure you don't send the angry version of your email by mistake: [http://www.dailymail.co.uk/news/article-2951973/Is-rudest- re...](http://www.dailymail.co.uk/news/article-2951973/Is-rudest-rejection- letter-Jobseeker-shocked-sent-email-calling-old-aesthetically-challenged- professional-pr-no-teeth.html)

<comment><USER15> I find it best to make sure not to fill out the "to" field in emails which I know are going to be "controversial".

An errant tab+enter in gmail can really make the day a lot more complex.

Edit: Once it's been toned down, if it still needs to be sent (usually it doesn't), adding the recipient is the last step, and final filter that a nasty message should pass.

Reading a fuming email to a spouse or friend before sending is also a good way to keep them in the drafts folder and out of other people's inboxes.

</comment></comment><comment><USER16> Just reading this thread made me angry, as I remembered every time I've been angry.

</comment><comment><USER17> The main thesis is probably not true, but the advice about writing the email and not sending it is straight out of how to win friends and influence people.

</comment><comment><USER18> The energy for anger comes from outside. Anger itself is an internal emotion that helps you 'get shit done', but it has to run on that energy to function. When I feel myself getting angry, I try focusing on being present and find an outlet for the energy. Games are a good way to vent. :)

<comment><USER19> Agreed - it's fuel to push things forward. My house gets a lot cleaner when I'm angry.

</comment></comment><comment><USER20> Yeah, you can probably say the exact same thing about internet article comments. It's pretty hard to put the breaks on the internet hate machine specifically because there's no real connection between semi-anonymous internet rage and loss of social status. Facebook is a different case.

Emotions tend to reinforce each other the more they're learned and practiced.

</comment><comment><USER21> reminds me of my languished (v1) project that is the bullet-proof shoe for people who shoot themselves in the foot: [http://frustrometer.com/](http://frustrometer.com/)

I just couldn't get a data model with results I was happy with. I should probably revisit it and tough it out.

</comment><comment><USER22> I'd go even further and say that, especially in management scenarios, just don't try to resolve interpersonal conflicts or disagreements over email. It fails far too often.

</comment><comment><USER23> At least now we have a url to send back in reply to such emails ;)

</comment><comment><USER24> What about things that are worth being angry about ?

<comment><USER25> I once had a friend with which I fought almost all the time. We were miserable, the two of us. Eventually, he just dropped me (didn't return my calls, answer my emails, etc). I was very angry, but decided not to do anything about it. Over time, I came to respect his decision and even be grateful for it. I have no idea how he is doing. I tried to send him an email, but he didn't respond ;-) I'm very much happier without him in my life. I owe him a debt I can never repay. I hope he is similarly happy without me in his life.

If there is something that your friends are doing that causes you a problem, you can discuss that very reasonably without being angry. If it's something that really, truly deserves your anger, then it is probably best not to discuss it at all. There is no need to make everyone even worse off than they were before. Letting go of the situation that caused the anger is the first step in healing yourself. Don't bind yourself to it. Sometimes this means losing a friend, but in this case, wouldn't that be a potentially good solution?</comment></comment>


Common obstacles when working with Quantified Self APIs - <AUTHOR> http://quantifiedself.com/2013/06/apis-what-are-the-common-obstacles/

<comment><USER2> Today I had another interesting conversation with a person who is starting a company to unite diverse Quantified Self data streams into a simple, useful API. I was encouraged and discouraged at the same time. This is obviously needed. But there are some serious technical challenges that are invisible when these ideas are pitched and funded, but cause big problems later. These include: lack of insight into way derivation of end point data is achieved in various personal data systems, naivety about dependence on device makers / servie providers maintaining API stability; and, underestimation of the challenge of responding to API calls quickly and efficiently enough to support the app "ecosystem" that is typically envisioned. A bit more realistic dialog about these issues would help everybody.</comment>


Gmail Man - <AUTHOR> http://daringfireball.net/linked/2011/07/28/gmail-man <comment><USER2> Posted several times, some with relevant comments:

<http://news.ycombinator.com/item?id=2818407> : 3 comments

<http://news.ycombinator.com/item?id=2819411> : 2 comments

<http://news.ycombinator.com/item?id=2820611> : 0 comments

<http://news.ycombinator.com/item?id=2821072> : 2 comments

<http://news.ycombinator.com/item?id=2821210> : nothing relevant

<http://news.ycombinator.com/item?id=2821635> : nothing relevant

</comment><comment>==

ADDED IN EDIT: I've started a poll about this:

<http://news.ycombinator.com/item?id=2822041></comment>


Is Scvngr/LevelUp's Latest Marketing Ploy a Cry for Help? - <AUTHOR> http://bostinnovation.com/2011/08/30/is-scvngrlevelups-latest-marketing-ploy-a-cry-for-help-freelunch/

<comment><USER2> Poor guys. I met Seth and the first few employees back at Dreamit Ventures. Seth is a brilliant guy, and for such a young guy he was quite impressive. It's a shame to hear that things arent looking great for the company at present. I havent been following the storyline of SCVNGR religiously, but this does sound a bit like the company got pushed into trying to be a home-run when it was a sure thing as a single or double. Unfortunately, when funding is in the mix the incentives point in the direction of trying to become gigantic at all costs. To be honest, I feel this is the same thing that did in the first startup I was a member of - we knew we could be a successful business but the pressure to become the next LinkedIn for fundraising reasons caused us to pivot and crush ourselves as we got over-extended and ran out of runway. I'd hate to see the same thing happen to SCVNGR.

</comment><comment><USER3> Theory: The first pivot to LevelUp was planned partially to change the name to something more memorable. They thought they might as well pivot to something else more profitable while they were at it.

The second pivot is just desperation.</comment>


How can we catch a kidnapper if he demands a ransom in Bitcoin? - <AUTHOR>

If the criminal wants cash, we can catch him by his geographic location. If he is stupid enough to ask for a check, we can catch him by the bank account that the money gets deposited to. However, if he asks for Bitcoins, there is no way we can track him. Any thoughts? <comment><USER2> You can track the bitcoins, and as soon as a transaction occurs with a known party, you can go back up the transaction chain.

It's just like with GSM IMEI, notably pre-paid GSM cards, they're identified (in most countries), by an ID card when you buy the pre-paid card. If people wanted anonymity, they'd have to swap their pre-paid card randomly and anonymously in the street.

If you want anonymity with bitcoins, you will have to swap them on paper, in the street.

And even having shuffled bitcoins, you'd have to be very careful, because there are other ways to identify entities, based on their behavior. See for example:

[https://hal.archives- ouvertes.fr/file/index/docid/718763/fil...](https://hal.archives- ouvertes.fr/file/index/docid/718763/filename/TR.pdf)

[http://homepages.laas.fr/mkilliji/docs/journals/jcss.pdf](http://homepages.laas.fr/mkilliji/docs/journals/jcss.pdf)

[http://www.cl.cam.ac.uk/~ks640/files/papers/wpes2014.pdf](http://www.cl.cam.ac.uk/~ks640/files/papers/wpes2014.pdf)

etc.

There are only 9 billion humans. Therefore to identify one, you only need 34 bits! Extracting the right 34 bit of information from the petabytes available each second, while requiring some mathematical and computing resources, is clearly not impossible.

Beware also of the Air Force 1 effect: when the American secret services destroyed the World Trade Center, they issued an order to ground all airplanes. All, but one, Air Force One. And therefore everybody knew where it was, because it was the only plane in the sky keeping signaling meteorological data.

Similarly, when everybody is tracked on facebook, on ApplePay and on bitcoin (however anonymously), getting outside of those tracking system only serves to flag and identify your even better!

We're certainly very close to have a system like in Minority Report, where not only real-time tracking of everybody will be relatively easy, but of course, probabilistic prevision of (near) future behavior will be possible as well.

When you can track with a high resolution spy satellite or drone somebody in downtown Los Angeles at 11:43, you can predict with quite a certainty that he won't be in New York at 11:50. Given physical constraints and Bayes statistics, you can predict quite a lot.

[http://www.dailymail.co.uk/sciencetech/article-2269563/The-U...](http://www.dailymail.co.uk/sciencetech/article-2269563/The- U-S-militarys-real-time-Google-Street-View-Airborne-spy-camera-track-entire- city-1-800MP.html)

</comment><comment><USER3> Getting ready for Nanowrimo tomorrow? :)</comment>


Show HN: Sktchr – Balsamiq plugin for Sketch  - <AUTHOR> https://assemblymade.com/sktchr <comment><USER2> I am a big fan of Sketch, and have used Balsamiq plenty. But this isn't a "Show HN" this is an "Ask HN" or perhaps a "Request HN". Am I understanding correctly you are not a developer and seeking someone to create this in partnership with you?

Also, the blackletter font on the "product site" makes it extremely hard to read.

</comment><comment><USER3> I just added my name to the list. it looks interesting, I look forward to what you guys come up with.

</comment><comment><USER4> Yeah this was a bit misleading. As a fan of both Balsamiq Mockups and Sketch, I thought I was looking at an available product (or at least something in progress, not a wish).

edit: I would _pay_ for this if it was available..

<comment><USER5> I'd pay too. Loving sketch.

</comment></comment><comment><USER6> Am I the only one surprised to read this line?

> More recently development on the product has stopped, or worse – fell > behind.

Balsamiq looks to be going strong...at least I've not noticed anything wrong with it.

<comment><USER5> Yeah, and very responsive team as well.</comment></comment>


Show HN: Log.io (Realtime log monitoring, powered by node.js + socket.io) - <AUTHOR> http://logio.org/ <comment><USER3> > Log.io has no persistence layer. Harvesters are informed of file changes via > inotify, and log messages hop from harvester to server to web client via > socket.io.

This struck me as really odd. Why is it done that way? Most stuff is logged via syslog. Those things are already in the buffer and it seems the local nodes are doubling the seek+read of what was just written. Downsides:

\- double disk action for every log line

\- inotify overhead for the system

\- logging requires local disk space

\- disk io delays mean collection delays

\- when disk get full / fail on write you don't collect the message about the failure if one was attempted to be written

\- when syslog daemon decides that messages are coming in too fast, it might drop them from the for_the_disk buffers - this way the only copy was lost (not 100% sure, but I believe syslog-ng can send to one destination even if another is blocked)

I really can't see positive sides of this approach. Logstash seems to handle everything log.io does and much more... am I missing something?

<comment><USER4> A lot of things don't use syslog. For example, default configurations of Apache write logs directly without syslog. The benefit of this method is that it is general enough to work for most people without configuration changes, and I assume they could always add syslog support later.

<comment><USER3> Log.io assumes multiple nodes. If you want any kind of visit statistics in that scenario, you're already collecting the logs somehow. Unless you rolled out some homemade script for that purpose, you're probably using remote syslog anyways.

Or do you store your logs on a random server that request happened to hit / session was bound to?

</comment></comment></comment><comment><USER5> I know very little about system administration, but the comment I want to add to this conversation is: wow, this is a tremendously good product website.

1\. Show the glamour shot (even just a screen shot of text makes it compelling). 2\. Quickly explain the problem you're solving. 3\. Quickly explain how you solve the problem. 4\. List the most compelling RTBs ("reasons to believe")

Just a heads up: it wasn't immediately clear that I could click on the screenshot for a demo. I'd make that a huge call-to-action. The product can sell itself.

</comment><comment><USER6> Also realize that if you are connected over websockets all data will be transferred unencrypted even if you put log.io behind https. A much better fit for these cases is SSE which works fine over https:

<http://www.html5rocks.com/tutorials/eventsource/basics/>

<comment><USER7> How have I never heard of this before? (Oh, no Firefox or IE support).

Also, I don't believe your claims about WebSockets are true. I thought wss:// would allow for SSL secured WebSocket connections...

edit: Googling indeed seems to indicate that wss is ws over TLS. See: <http://websocket.org/echo.html> for an example.

<comment><USER8> Modern HTTPS uses TLS too.

</comment></comment></comment><comment><USER9> It's cool to see log files streamed in real time to your browser but most of the time it scrolls too fast to get any useful information out of it (unless you use regex filters of course). It would be cool to have graphs that show, say, browser usage (or IP geolocation or operating system or page visited or any other metric that can be gathered from log files), being updated in real time.

<comment><USER10> This is probably what you described: <https://github.com/stagas/maptail>

</comment></comment><comment><USER11> I like this, and I'd use it in my projects if I knew it was reliable.

I've seen socket.io drop messages and I wonder if it's happening here.

Open both Chrome and Firefox at the same time and watch logio_server in each browser. After several minutes I start seeing different messages in each browser. Is socket.io not delivering every message to each socket?

<comment><USER12> [author of socket.io]

It's possible that log.io is not trying to send absolutely every message (which is the reason I introduced the volatile flag for the upcoming version: <https://github.com/learnboost/socket.io-node/tree/develop>)

</comment></comment><comment><USER13> Oh man, and I just coded essentially the same (with persistence through, for we need history) with CouchDB over the last 2 months. If only you'd have launched a bit sooner!

ps. Maybe it's me, but 2 hours ago your site worked great in Opera, and now the design seems broken. If you changed some CSS, then that might be it :)

</comment><comment><USER14> You know what would be cool. Write your own npm that does logging which would open up a socket connection to your server bypassing sending logs to disk and being watched by inotify.

<comment><USER15> Yeah that would be cool. Even better if it could be done over UDP, so the log messages are fire-and-forget from the client side. Even BETTER if there was a standardized way for all programs regardless of implementation language to write to said socket/log.

Yeah, they thought that up 30 years ago. It's called syslog.

<comment><USER3> There are some issues with syslog. Fortunately an extension is ready: <http://www.graylog2.org/about/gelf> \- can be structured and is not limited in size anymore.

<comment><USER16> Except my Cisco switches, HP printers etc won't be talking that anytime soon.

In addition, graylog appears to be "solving" something RFC 5424 already has with structured messages.

<comment><USER3> Tbh, I haven't seen any standard syslog daemon supporting structured messages - except for apple's syslogd and syslog-ng. Others mostly cut the message to 1024 or so bytes and each one handles new-lines in a different way. So far it seems noone is sending messages that way and noone is expecting them. If a new protocol is the way to push structured logging forwards, I'm all for it. It doesn't mean those two protocols cannot coexist. It doesn't mean a typical logging pipeline cannot include syslog->gelf converter which adds annotations / parses the message.

It also seems that the structured messages handling assumes the message fits in a packet and can be processed dropped when convenient depending on its size. That's not something I expect from a logging system. Gelf adds chunking / compression just in case.

<comment><USER17> rsyslog also supports structured RFC5424 messages. Others will support it in time.

I agree it's not the most perfect format, but it's usable, and already much better than freeform text messages if you intend to do programmatic processing.

Another interesting initiative in normalized logging is CEE (<http://cee.mitre.org/>). The 'lognorm' and 'libee' libraries (<http://www.liblognorm.com/>) are early attempts to implement this.

Note that I haven't looked at 'gelf' yet so I don't know how it compares.

</comment></comment></comment></comment></comment></comment><comment><USER18> This looks similar to logstash, which has been on my tools to try list for a while.

"logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs. It is fully free and fully open source."

<http://logstash.net/>

</comment><comment><USER19> very, very cool.

node.js is also my (current) tool of choice for real time logfile analysis, i use a slightly different approach.

i ssh funnel the logfiles to my machine i.e.:

       ssh server.example.com sudo tail -f /var/log/nginx/example.com_access.log > test.log

then use this ( _disclaimer: coded it during a hackweek_ ) lib <https://github.com/franzenzenhofer/nolog> to attach events to the logfile

       nolog('./test.log').shoutIf('googlebot', /Googlebot/i ).on('googlebot', function(data) { ... });

basically you

       - watch a logfile
       - shoutIf you come across a given pattern (can be regex or function)
       - listen if a shout event occurs

i will definitly look into log.io and see if there is a way to plug nolog somewhere in there.

an important addition to log.io would be log servers in php, asp(x) and all the other legacy languages. my experience is that webservices that allow and/or use modern development approches already have a suitable logfile observation, but all the millions of sites stuck with yesteryear really struggle with it.

</comment><comment><USER20> vsConsole is a similar application that solves the same problem, but based on java technologies.

* Java Agents run on the servers * vsConsole is a web application that runs on Tomcat

Use a browser to select the desired log file, and you can tail it. (When the browser polls the web app, the web app will contact the agent for the latest changes to the file).

View the demo at:

* [http://demo.vamonossoftware.com/vsconsole/file/index#1:DEV:8...](http://demo.vamonossoftware.com/vsconsole/file/index#1:DEV:8081:/tmp/example.log)

More information at * <http://demo.vamonossoftware.com/>

vsConsole is aimed at development teams, not as a production log monitor. For example, while developers and testers are working with an application, when they want to see whats going on in the log, they can just click a button - <USER2> unix accounts, ssh, tailing, needing to know where the logs are etc.

A new version which looks a lot better, and has simple messaging and application monitoring will be out soon.

</comment><comment><USER21> I built something similar a while back during the Django Dash, but there's no server software to install because it just uses ssh and tail: <https://github.com/ericflo/servertail>

This looks more polished and complete though from a user interface perspective, nice job!

</comment><comment><USER22> This is really cool; very impressed!

</comment><comment><USER23> Cool, but doesn't run on CentOS. Init files are coded exclusively for Debian, and I don't have time to convert them.

</comment><comment><USER24> Couldn't get it to start in Ubuntu (couldn't find module "connect", totally unsupported on Centos.

<comment><USER25> did you use npm for packages? did you install connect?

<comment><USER24> Yep.

</comment></comment></comment><comment><USER26> This would be awesome as a plugin/add-on for Heroku - if that's not already in the works.

</comment><comment><USER27> nice, however unless you left it out deliberately to fire the error log, you should add a favicon to your site.

<comment><USER28> Could you explain your concern? I don't understand why a favicon is important in this case.

<comment><USER29> Look at the app; favico 404's are the entire error log.

</comment></comment></comment><comment><USER30> ssh user@server tail -f logfile

It's even encrypted.

<comment><USER3> Try that with N servers and M log files where nodes join / leave the cluster at any time.

<comment><USER31> As long as N is not too big, remote syslog works well for this case.

</comment></comment></comment><comment><USER32> Very cool!

</comment><comment><USER15> Cool, you just reinvented syslog, poorly.

<comment><USER33> Syslog is cool and all, but this is a nice UI for displaying the logs in the browser, so everyone in the company can watch them, or you can easily open it up on an iPad, and hang it on the wall.

Could I use SSH over iTerm, and display multiple windows in Screen? Sure. But this is easier/quicker.

It would be nice if it didn't need to constantly hit local disk on every machine, though.

<comment><USER3> What is a usecase for everyone in the company to see raw logs? Nagios / zabbix dashboard - sure. Some visits analytics - maybe. General stats / resource usage - not for everyone, but ok.

But why would you ever inflict raw, unprocessed, scrolling logs on anyone other than developers working on a specific bug? (they'd expect an accessible backwards search too)

<comment><USER33> I was thinking it would be fun, in a somewhat similar vein to Google displaying Search Queries on the wall - <http://www.flickr.com/photos/kchrist/21051526/>

That said, I agree- Historical Search is a necessary feature for it to be very useful to debugging.</comment></comment></comment></comment>


Ask HN: Is it a good time to buy a new Macbook Pro? - <AUTHOR> Current laptop is getting old and Im in a market for a replacement. My top pick so far is a new MBP but Im having my doubts. I'll list my reasons and concerns and maybe HN can help me decide<p>-Must be a laptop since I don't have place for a desktop setup<p>-Looking to buy the least expensive option<p>-I want to do iOS development<p>-Want to be able to hook up a external monitor later, hence the MBP and not air<p>-Why new: 3 year old MBP is still over 1000$ and no guarantee<p>-Biggest concern: new MBP expected in December according to some rumors and I don't want to miss out on new upgrades for the same price and lose some value of the "old" MBP <comment><USER2> I am a relative new comer to the Mac sphere of things. I personally bought my first MBP a bit over 2 years ago, and my current employer bought be a new MBP 3 months ago. These are the only Mac products I have ever owned. I didn't think I would like them as much as I do and I honestly broke down and bought my first one due to social pressure, to be brutally honest.

I have done a lot of thinking about the whole "when to buy Mac products thing". At first I almost didn't want to buy my first MBP because "what if they announce something new in X weeks/months from now and I miss out!" "What is new announcement in X weeks/months lowers the value of my current MBP!" "Ack I am going to be BEHIND!" These are all real thoughts that I had. Then I realized the flaw in my own logic.

First of all, the value of my MBP is not in its resale value. It's in my ability to complete work for clients which brings me $xxx dollars per hour (or really $xxxxx dollars per week, but that's an entirely different discussion). I have two MBP's in my possession at this very moment that are top of the line and exactly two years apart. If I placed them side by side and told you to pick which one was the newer one, you couldn't. If I let you code on them for one day each and then told you to pick the newer one, you couldn't (unless you looked in "About This Mac" but that would be cheating now, wouldn't it?). Trust me, the hype over the latest and greatest MBP feature is exactly that, marketing hype.

Second, MBP's are honestly just really solid machines for working. The battery life is long, the case is light, the features are more than sufficient for development. My 2+ year old MBP is running like a champ (and if it wasn't I would just take it to Apple, I have Apple Care, and they would fix it). Decide what you are buying the laptop for. If it's for telling your friends that you have the latest and greatest MBP that looks exactly like every other MBP, then wait until the newest one comes out and preorder it, then get ready for it to be old news three weeks later. If you want to build great iOS apps for your own business or for others, then get a good solid machine and start making money with it and stop worrying about all of the Apple hype.

<comment><USER3> > the case is light MBP are great machines, but being light is not one of > their quality.

</comment></comment><comment><USER4> Unless you are in a state of emergency, I would wait till the new generation is released. Chance is, they are a very big update on the current generation. And if not, you can get the previous gen at a better deal on sale.

</comment><comment><USER5> I'm weighing the same decision. It's time to replace my eight year old Mac Pro, and I'd like to go with a laptop + docking station + external monitors, but I'm torn as to weather and get the current model or the next.

I've decided to wait. The current model will be discounted, and I want to know how many USB-C ports will be on the next version and what the impact will be. I've heard it is painful if not impossible to connect older Cinnema dispays to mac book via USB-C.

Edited to add:

>-I want to do iOS development You can do iOS development on any intel-based mac. My 8 year old mac pro is fine. My Macbook Air is perfectly fine.

>-Want to be able to hook up a external monitor later, >hence the MBP and not air

You can hook up an external monitor to any of the modern macbooks, you just have to purchase an adapter. A mini-display cable will plug into a thunderbolt port, and there are adapters for other cable types (thunderbold to vga, thunderbolt to DVI, etc). I have a set of adapters I carry in a bag just for presentations.

If you want to drive 4k monitors, there be dragons.

<comment><USER4> The current MBP with the ATI GPU can even drive the Dell 5k screen when using dual-displayport. A coworker of mine uses it in this configuration. But there is a chance, the next iteration improves this, if it offers TB3.

</comment></comment><comment><USER6> I'm not sure what you want to know that isn't already fleshed out on the rumor sites [1].

Nobody here knows any more about what is coming than such sources. It is up to you to decide how urgently you need an upgrade.

[1] [http://buyersguide.macrumors.com/#Retina_MacBook_Pro](http://buyersguide.macrumors.com/#Retina_MacBook_Pro)

</comment><comment><USER7> I haven't used it for formal dev work in a while, but what is now my wife's 2012 MBA will do iOS development (she had a 2010 MBA before that, and it, too, would run Xcode w/o issue) just fine with an external 27" non-retina Apple display attached to it. Assuming Xcode has not gotten particularly piggish in its last few iterations, even that 2012 MBA should still work. A new one should fly. You don't need a MBP to do iOS dev. If you favor raw power over portability, get the MBP. If you want a portable machine that will, for most of your day, be indistinguishable in perf over a MBP then get the Air.

But to answer your question: no, _now_ is not a good time unless you must have one for work. New ones, with what some suspect is a redesign, are just around the corner. Or buy a used one now, wait for the new ones, then turn around and sell the used one for about what you paid for it.

</comment><comment><USER8> Pretty simple, wait until the new one comes out and buy it. One will probably come out in September/October if not earlier:

[http://buyersguide.macrumors.com/#Retina_MacBook_Pro](http://buyersguide.macrumors.com/#Retina_MacBook_Pro)

<comment><USER9> They're killing me. I'm going on a three-week overseas trip in September and I want a new laptop (old one is 2011 model with a dead battery on Mountain Lion that can't be upgraded). And here we are in August and no announcement and we're way past the average release date for everything but the 12" MacBook.

</comment></comment><comment><USER10> The Macbook Air is cheaper than the Macbook Pro, and you can definitely attach an external monitor. It has a standard mini DisplayPort (Thunderbolt) port for external devices.

The currently available Macbook Pro is very outdated, and is not a good purchase at this time.

<comment><AUTHOR> I would like to buy a 4k Ultra Wide monitor at some point, can the Air support it?

</comment></comment><comment><USER11> If you want to wait and see what comes next, you could always buy something used on Craigslist. I recently reapplied the thermal paste and put a new battery in a 2009 13" MBP (previously upgraded to 8 GB of RAM and a 256 GB SSD), and it runs better than it did when it was new. I wouldn't be surprised if you could find a used one for $600 that would do what you want for now. By the time the new ones come out, you'll be able to make an informed decision about whether you need an upgrade. If you do, flip the old one on Craigslist again :)

</comment><comment><USER12> I'm pretty sure you can attach an external monitor to an air or any other MacBook*.

The current MBP is a very nice machine.

The new MBP is rumored to have some questionable features: Thinner (what will do that do to the keyboard?); touch-sensitive OLED panel replacing real function keys.

<comment><USER13> Does anyone actually use the F-keys on macOS?

<comment><USER7> Every time I want to get to the menu (Ctrl-F2), so probably a minimum of a few dozen times a day for that one. F11 to show desktop. ⌘-F5 to toggle VoiceOver for accessibility testing. And probably others I've forgotten I use.

</comment></comment></comment><comment><USER3> trcollinson is exactly right focus on the value your machine is bringing now. That being said every evidence point to a major upgrade in December, so unless your really need a new computer waiting is the safest bet a this point.

Specific advice : 1 - Don't get this generation macbook air or non retina macbook pro those are just bad value

2 - which ever decision you make,understand that in 6 month you won't care

3 - One way to edge your bets would be buy a used macbook pro now, resell a later when/if you decide to upgrade. Macbook have a great resale value, and by buying used you avoid the biggest part of the asset depreciation which appends in the first couple of years.

</comment><comment><USER14> Buy now if you need it now. Otherwise, just wait. You can find some data for your decision here: [http://buyersguide.macrumors.com/#Mac](http://buyersguide.macrumors.com/#Mac)

</comment><comment><USER15> I bought one last month. It's fine. Not having to buy all new connectors was a selling point for me.

</comment><comment><USER16> Do you want to overpay for 3 year old technology? I'd wait.

</comment><comment><USER17> I would wait for the new one.

</comment><comment><USER18> get the MacBook. Macbook Pro is too heavy to carry around.</comment>


How Facebook is losing it's essence? - <AUTHOR> http://microreviews.org/how-facebook-is-losing-its-essence/ <comment><USER2> "The very essence of Facebook was to recreate the joys of college life in the virtual space."

Maybe back when it first started. It hasn't been the 'essence of Facebook' for a long time now.

They've evolving, as they need to if they want to stay in the lead.

<comment><USER3> Yes, but getting all celebrity junk into the timeline would sort of kill all the fun. It may just go the myspace way.

<comment><USER4> a. Why not just unsubscribe from it if it bothers you so much? b. Facebook is not afraid to change stuff that isn't working, so I have confidence that they'll tweak that feature as the usage patterns dictate

<comment><USER3> You can unsubscribe from the celebrity news and stuff but your friends will end up sharing as they would have subscribed to the celebrity junk. You can't do much about that.

<comment><USER5> Get new friends, or block the ones who do that.

<comment><USER6> This. Don't follow/friend/circle people you don't want to keep in touch with or hear updates on. It's that simple.

</comment></comment></comment></comment></comment></comment><comment><USER7> Well, Facebook corp enroached on my privacy, and apps spammed my feed with useless crud. People posted high noise, low signal updates.

So I left.

<comment><USER3> A lot of people will gradually leave because of such junk.

</comment></comment><comment><USER8> Totally beside the point, but "How Facebook is losing its essence" is a statement. You've analyzed the situation and you're going to tell me what's happening. Following that statement with a question mark just tells me that you're frightened of sharing your opinion. Don't make a bold statement if you're just going to wimp out and make it a question.

<comment><USER3> Point taken. The title of the post has been updated.

</comment></comment><comment><USER3> Possible duplicate <http://news.ycombinator.com/item?id=3016955></comment>


Show HN: Compost: a group of simple Web Component mixins - <AUTHOR> https://github.com/lamplightdev/compost <comment><AUTHOR> A set of small, efficient, no dependency mixins to provide simple shadow root templating, property observers and event binding for vanilla web components. An example HN reader implementation is at [https://compost-35844.firebaseapp.com](https://compost-35844.firebaseapp.com) (code: [https://github.com/lamplightdev/compost- hn](https://github.com/lamplightdev/compost-hn))</comment>


Go tool for finding all impls of a Go interface type on GitHub - <AUTHOR> https://sourcegraph.com/blog/go-interfaces-and-implementations

<comment><AUTHOR> We made this tool and presented it at GoSF[0] this week.

Example links (scroll down to 'Implements ## Go interfaces' or 'Implemented by ## Go types'):

* What types implement http.ResponseWriter? [https://sourcegraph.com/code.google.com/p/go/symbols/go/code...](https://sourcegraph.com/code.google.com/p/go/symbols/go/code.google.com/p/go/src/pkg/net/http/ResponseWriter:type)

* What types implement io.Writer? [https://sourcegraph.com/code.google.com/p/go/symbols/go/code...](https://sourcegraph.com/code.google.com/p/go/symbols/go/code.google.com/p/go/src/pkg/io/Writer:type)

* What types implement json.Marshaler? [https://sourcegraph.com/code.google.com/p/go/symbols/go/code...](https://sourcegraph.com/code.google.com/p/go/symbols/go/code.google.com/p/go/src/pkg/encoding/json/Marshaler:type)

* What types implement http.Handler? [https://sourcegraph.com/code.google.com/p/go/symbols/go/code...](https://sourcegraph.com/code.google.com/p/go/symbols/go/code.google.com/p/go/src/pkg/net/http/Handler:type)

* What interfaces does crypto/tls.Conn implement? [https://sourcegraph.com/code.google.com/p/go/symbols/go/code...](https://sourcegraph.com/code.google.com/p/go/symbols/go/code.google.com/p/go/src/pkg/crypto/tls/Conn:type)

* What interfaces does *os.File implement? [https://sourcegraph.com/code.google.com/p/go/symbols/go/code...](https://sourcegraph.com/code.google.com/p/go/symbols/go/code.google.com/p/go/src/pkg/os/File:type)

It uses go/types for underlying type analysis.

There's a bug tracker at [https://github.com/sourcegraph/sourcegraph.com/issues](https://github.com/sourcegraph/sourcegraph.com/issues) if you see any issues.

[0] [http://www.meetup.com/golangsf/events/146083272/](http://www.meetup.com/golangsf/events/146083272/)</comment>


Here Are 10 Awesome Chrome Flags to Try Out - <AUTHOR> https://medium.com/better-programming/10-awesome-chrome-flags-you-should-enable-right-now-2684e4518cb5 <comment><USER2> that qr tab sharing, I've never had a problem going into history > tabs on other devices. even picks up YouTube videos where I left off.</comment>


Glycemia, starch, and sugar in context (2009) - <AUTHOR> http://raypeat.com/articles/articles/glycemia.shtml <comment><USER2> There are perhaps some things worth considering, much of it in wild opposition to other studies, but I'm going to say that this type of prognostication without myriad examples of success in application is probably dangerous to be considered as expert advice to the average disinterested person.

If you are interested in an example of a healthy person that eats this way, check out durianrider on YouTube. Dude lives on a bicycle though. It is actually hard to get fat on just sugar, because such a small amount produced satiety so quickly - unless you also wary regular foods like starch and fat along with it, and then you are going to explode.

So I'd say that he's not wrong, it's just not practical for most people. Honestly, if you're fat, and I once was, the easiest and most reliable way to lose weight is to cut out all fats. You'll be amazed how much that reduces total calories without affecting the way you feel.

</comment><comment><USER3> Wow - Ray Peat here on HN. Never thought I would see the day.

<comment><USER4> I'm not familiar with Ray Peat, why's it surprising for his article to be here?

<comment><USER5> He's one of the greats of the crazy diets: people should eat more white sugar and fructose, people shouldn't exercise because it stresses the body, people should reduce or eliminate vegetables from their diets, and so on.

Also the king of cherry-picking parts of studies that agree with his view and ignoring everything else, no matter how prevalent.

<comment><USER6> He also doesn't say such things at all. I haven't decided whether the impossibility of his writing to be read and discussed charitably is primarily his fault or ours, if it even makes sense to think of it that way.

I agree with the cherry-picking, though. A glaring omission in his writing is adaptation (or hormesis), which is surprising for someone who draws such inspiration from Selye.

<comment><USER7> I have no idea who he is or what he's trying to say, but his "about" page reeks of quackery.

 _> The key idea was that energy and structure are interdependent, at every level.

> It seems that all of the problems of development and degeneration can be > alleviated by the appropriate use of the energy-protective materials. When > we realize that our human nature is problematic, we can begin to explore our > best potentials._

<comment><USER6> > The key idea was that energy and structure are interdependent, at every > level.

This doesn't strike me as so far out there. The concepts of entropy and enthalpy are often used at the molecular and cellular levels, along with statistical mechanics, which definitely interconnect the concepts of energy and structure.

> It seems that all of the problems of development and degeneration can be > alleviated by the appropriate use of the energy-protective materials. When > we realize that our human nature is problematic, we can begin to explore our > best potentials.

This is a strong claim, for sure. But it becomes less quacky if interpreted more plainly: our nature is to degrade under the force of entropy, which can be countered (to a limited extent) by energy.

<comment><USER5> > if interpreted

But that's the point. He doesn't claim that, he makes a vague claim with ambiguous terms that could be interpreted in any way, even if he's qualified enough to know the precise terms.

That's the health equivalent of post-modern literature.</comment></comment></comment></comment></comment></comment></comment>


LEGO Robot Solves Any Rubik's Cube In Less Than 12 Seconds (Video) - <AUTHOR> http://singularityhub.com/2010/02/17/lego-robot-solves-any-rubiks-cube-in-less-than-12-seconds-video/

<comment><USER2> It doesn't look like the lego I grew up with.</comment>


Kaleidoscope Toy Language to Lua Transpiler - <AUTHOR> https://github.com/wqweto/kscope/releases <comment><AUTHOR> kscope is a LuaJIT implementation of LLVM's Kaleidoscope toy language providing both an interpreter and a compiler which can build statically linked (portable) executables.

Currently the implementation is Windows based/tested only and heavily relies on MinGW-w64 project for bootstrapping the compiler and linking compiler output executables.</comment>