Ask HN: Where can I find "unsolved problems" for various industries? - <AUTHOR> As a developer, I'm interested in working on a problem in my spare time. However, most of the problems I've thought of over the years have already been addressed in my field. I'd like to consider other fields that have problems needing solving, but I'm not really sure where to start other than doing pretty generic Google searches. <comment><USER2> I've had some level of success with the following 2 strategies:

1\. Take your closest circle of friends and family. Cross off anyone who is also a developer. Among the rest, look at people who are professionals or small business owners. Take them to lunch. Ask if you can shadow them at work a bit. Take copious notes. _Find out what the most annoying /tedious part of their business is_. Also, if they rely on clerical/support staff, talk to those people too.

2\. Pick an industry that you have an interest or curiosity in. Put a job posting in your local Craigslist for people in this industry (ex: mortgage brokers or elementary school teachers). Say you are looking for an advisor to discuss some startup ideas. You will get several responses. Have lunch with a couple people. You don't have to have ideas up front. Just ask them the same questions as option 1 above. Ask them if they'd be willing to beta test something you built.

Protip: there are some industries I'd suggest avoiding. For example, restaurant owners are extremely busy and working in a very low-margin industry. They generally don't have time to meet or test things.

Disclaimer: these are mainly B2B strategies. Most B2B problems really boil down to _saving money_ , _making more money_ , or _saving time_ (time is money). If you can do any of those things for someone, they will pay you.

<comment><USER3> If you're a developer and want to work on restaurant stuff message me.

<comment><USER4> Hi bwilliams18

I'm interested in learning more. What do you do in the restaurant side? I've been showing a prototype of an app to GMs but open to solving real issues.

</comment></comment></comment><comment><USER5> Let me turn that question around a bit.

Part of the art of being a successful solution provider is having the expertise to identify a problem in the first place. Usually that comes from having a lot of experience in that industry already.

I know this doesn't directly answer your question, but bear in mind that you have a bunch of saleable skills (otherwise you wouldn't have thought of this already) _and_ you're willing to apply those skills in helping people who are willing to pay for them.

Also, we have a tendency to ignore the things we're _already_ good at in favour of the things we've _most recently become_ good at, so when you start narrowing your focus and zoning in on problems you want to solve, you might ignore some of the things people might find most valuable in your skillset, however long ago and intellectually uninteresting to you those skills are. Remember, solving business-level problems is more about your overall viewpoint of the industry and how its bits fit together, not about tickling your own brain with this month's interesting JS framework.

So, as a really bad example, you might have written a bunch of task scheduling/interleaving code to drive PLCs on a production line a few years back, and that might not be interesting to you anymore, and you might also have become really good at hooking Hibernate up to replace a bunch of badly- handwritten SQL after that, and again, that's not interesting anymore. But, if you _really_ know automation and enterprise app ORM, you might suddenly find something that people are willing to pay for.

<comment><USER6> Great way to think about it!

</comment></comment><comment><USER7> One option: get a part time job in an interesting industry.

I discovered this by getting a contract (few days a month) doing onsite work for a small/medium size organization. I asked lots of questions about things that I perceived as broken and found out what processes and software they hated. Then I worked on a prototype (evenings, for fun) and showed it to them. Now a year or so later that organization is my first customer for a SaaS I saw that they needed.

Also, make friends with other vendors while you're there. A company that already serves that industry can give valuable feedback and even market your app to their other clients if it integrates well with their solution.

<comment><USER8> What's the SaaS?

<comment><USER9> Software as a Service

In Pizza as a service terms: you dine out.

<comment><USER10> Surely it's the other way around, normal software is dining out, and SaaS is dining in?

<comment><USER9> Depends on the term comparison: for on premise / iaas / saas/ paas, normal software is baking it yourself.

[http://www.ektron.com/assets/0/75/132/2147483682/2b35a8f4-f2...](http://www.ektron.com/assets/0/75/132/2147483682/2b35a8f4-f28d-4e06-8b65-c0027e44a127.jpeg)

</comment></comment></comment></comment></comment><comment><USER11> There is a dilemma that others pointed out: you need to know the industry pretty well to be aware of the pain points. On the other hand you tend to settle for things you get accustomed to, taking for granted that "things are the way they are". One way out of it is every time you find yourself slightly frustrated at something, but just continue schlepping, ask yourself: do things _really_ have to be that way? Is there anything that can be improved, any single aspect?

Just to give you an idea from the area you know well: programming. It is not a secret that a lot of programming these days boils down to searching stackoverflow and copy pasting the code fragments. You switch from an editor to SO, do a search browse from comments, pick one, copy paste the answer, format it.

As a developer you usually have a large monitor or dual monitors. What if you had an editor plugin that on a shortcut would open SO in the browser, searching on the question that you already typed in. Few other shortcuts give you the movement across answers, another shortcut copies nicely formatted code from the currently selected comment. Bonus points for automatic renaming of variables according to the type information if you have it.

It shaves only seconds to minutes from the workflow, but imagine how many people are doing it how many times a day, and this might be an example of the problem totally worth solving.

<comment><USER12> I don't think that the search+copy+paste is where all the time is; the time is spent on looking at the seven questions that _almost_ ask how to solve the exact same problem you're facing, then reading the twelve answers (none of them marked as the correct one) that _almost_ look like they might be what you're looking for, and then trying to figure out which one is the easiest one to start from and then cobble together with the others to actually fix the issue.

<comment><USER13> OK, how about highlighting some error message in a log file, right clicking and choosing a menu option that googles for the string (filtering out dates, times, host/domain names and perhaps some filenames too) then opens a browser window with a tab for each SO answer? Now _that_ is definitely part of my debug workflow. Not sure its the next killer app though. Actually, I could probably knock it up in half an hour with AppleScript and Automator on OSX, as a new 'Services' menu item...?!

<comment><USER12> I fiddled with Intellij plugins; seems like it would be pretty easy to write if you've written one before, maybe a weekend project if you have passing knowledge.

I'd give myself a week, including the time to search Stack Overflow :)

</comment></comment></comment></comment><comment><USER6> I cross-posted this in another thread, but it's relevant here. Modified slightly:

I think an interesting direction is figuring out how to leverage web tech (or just code in general) to interact with the real world. Consider companies like Uber and AirBNB. They've identified a real-world problem and set out to solve it using technology. A lot of the cutting edge stuff these days is figuring out how to take a real-world problem (genetics, taxis, mail), and writing some code to make it accessible, cheap, and easy to do.

IMO to find interesting projects, a better idea is to look backward: what industries are still in the 20th century, and how can you help bring them into the 21st with modern technological advancements?

What about farmers, truck drivers, construction workers? Why are they still driving tractors, trucks and bulldozers? Why aren't robots doing those things more widely?

What about real estate agents and their legalese? Why are real estate agents still handing me stacks of paperwork? Can't you Zenefits the crap out of that process?

What about community outreach programs and community centers? Why are community outreach programs still accosting me on the street and handing out fliers? Can't they do outreach digitally? Can't we automate scheduling basketball games and pick-up kickball games?

What about having to fill out paper applications or stand in line at the DMV? (Shouldn't all that crap be automated by now?)

What about having to actually hand your credit card to the cashier at the drive-thru at McDonald's? (Can't they just magically detect who I am somehow and charge me accordingly? Why do I have to hand some punk ass kid my card or cash?)

What about planning weddings or raising kids? (Haven't enough people gotten married that planning a wedding should be as simple as browsing Amazon for a few hours? Haven't enough people had kids that we should have some solid data about what works and doesn't work?) (These two things aren't really tech- related, but man, if you could figure those out...)

The best part about this approach is that pretty much _any_ idea you come up with will be an improvement over the status quo. These are the things we're still doing the same way we did 50 years ago, before computers were even a thing. Can't we do better?

<comment><USER14> You are an idea machine!

<comment><USER15> >> You are an idea machine!

Nah, he's just sensitive to things that waste a lot of time.

His friends say he's a real whiner. No, that's a joke. I don't know him or his friends.

</comment></comment></comment><comment><USER16> There are lots of unsolved problems. Unsolved problems which can easily be solved with appcrap and webcrap are getting scarce, though. Too many people in that space.

Some medium-sized unsolved problems:

\- Solar panel installation. Installation is about half the cost of an installed system. Figure out how to get that down. Can solar panels be integrated into roof systems? And last for 40 years without leaks?

\- Police paperwork. Cops spend far too much time doing paperwork, which they hate. There's pressure for cops to wear body cameras, which they also hate. So come up with a system where the body camera images, audio, GPS info, and what you can pull from police files are used to put together most of the arrest report. Cops would like that. Start with something where a camera glance at an ID or license plate or face fills in much of the details.

\- Tablet based basic education - reading, writing, spelling, and basic arithmetic. Not just canned lessons, ones that adjust adaptively to the student's performance and errors. Ship on a $50 tablet.

\- Good $50 tablets. Some are good, some suck, some have weak points. Evaluate some, find the weak points, talk to the manufacturers in Shentzen about getting them fixed, and set up a distribution chain where they're sold in bubble packs in the back-to-school section of stores.

\- A rugged phone with no holes in it. No connectors, wireless charging only. Permanent battery. Hermetically sealed at the factory.

\- Intelligent HVAC for homes. The next step after "Nest", which can only turn heat and A/C on and off. Window fans and A/C with inside and outside temp, humidity, CO, and CO2 sensors. Outside air is used as much as possible. The whole system learns the house, self-adjusts, and doesn't need HVAC engineering.

\- Video from talks where the speaker image and slides are combined intelligently, with the system deciding when to emphasize what.

\- A PA system which absolutely cannot feedback. It's a simple DSP problem; why isn't it everywhere?

Those are a few ideas to get you started.

<comment><USER17> > \- Video from talks where the speaker image and slides are combined > intelligently, with the system deciding when to emphasize what.

This, at least for chalkboards instead of slides, exists. And works surprisingly well.

[http://www.birs.ca/facilities/automated- video](http://www.birs.ca/facilities/automated-video)

<comment><USER16> That's fascinating. The company behind it has a web site.[1] They had this working in 2002. Their web site is so outdated that it uses RealVideo and QuickTime. Their standard system costs $90,000. Their web site was last updated in 2004.

The name "AutoAuditorium" is licensed from Telcordia, which used to be Bellcore, which used to own Bell Labs. So this may be a Bell Labs spinoff that was commercialized, but not very well.

Somebody in the online education business should buy this technology and modernize it, so it costs about $9000, or $900, instead of $90,000.

[1] [http://www.autoauditorium.com](http://www.autoauditorium.com)

</comment></comment></comment><comment><USER18> It's getting really hard to find simple problems that have software solutions in a niche that isn't already competitive. There are a lot of software companies out there and more talented developers with successful side projects floating around than ever before.

10+ years ago you could maybe just google around and find a niche business problem with a simple software solution in a wide open market. This is not the case today.

As a developer your experience of the world typically overlaps with every other developer, so anything you can relate to by a few degrees of separation is pretty picked over and likely very competitive. Ditto for anything in a cash-rich industry.

So really anything that's easy to solve with an MVP product that wouldn't require clawing for attention, is lurking deep in the trenches of an industry or hobby you've never heard of and wouldn't be exposed to without being embedded in that world for a long time. There may be some sort of very valuable software solution for a problem with wool production in patagonia but you'd never know if you weren't a patagonian wool producer.

I think the best approach these days is pick out a very programmer un-sexy field, study it intensely and chat with as many people in that field as possible until something shakes out. Or just bite the bullet and go head first into a competitive market and try to make something that outshines the competition...

</comment><comment><USER19> I picked a niche (US contractor-type businesses)...HVAC, builders, etc. I grabbed contacts off the Internet and started emailing and calling the owners. Cold calling if necessary. After about 55 successful calls, I documented 115 specific pains that I grouped into 12 "solutions" I could provide as a SaaS. I'm currently building the first one right now.

Also try to find out where your target market hangs out. LinkedIn and Facebook groups are sources of very valuable information...just dont go into the groups and start posting "hey everyone tell me your painz!!!"...you'll be ignored. Build the rapport over time. Lurk for a while, then like some of the posts, then make a few comments, then make your own post in the group based off someone else's recent post and make sure you reference them.

<comment><USER20> Can you share other 11? :)

</comment></comment><comment><USER21> I don't think you'll find anything useful looking at "grand challenges" or other such lists. Problems get on such lists because they are hard to solve and because they require significant resources.

A better approach might be to find a slightly technically backward field, learn about it in detail, and then apply modern technology to improve performance or lower cost. I remember meeting a guy, years ago, who had made a fortune inventing a new high-tech way to remove the casings from hot dogs.

Finding an appropriate problem to solve is part of the problem.

</comment><comment><USER22> [https://en.wikipedia.org/wiki/Lists_of_unsolved_problems](https://en.wikipedia.org/wiki/Lists_of_unsolved_problems)

These are mostly sorted by academic fields, but it's a good place to start.

<comment><USER23> Related:

[https://en.wikipedia.org/wiki/List_of_emerging_technologies](https://en.wikipedia.org/wiki/List_of_emerging_technologies)

</comment></comment><comment><USER24> See whom of your friends have a career on the fringes of what you do or know about. Grab them some coffee and ask what pain points they have about their job or the inefficiencies they see in their workplace.

If you show enough enthusiasm and curiosity to solve the things they mention, they can connect you to others in that industry that can open more doors for you.

I second not looking to Google to discover these problems. While you will see more bitching than praising on the internets, much of you see will be superficial symptoms of a more serious problem. To understand the true cause you need to talk to people directly and in a way where they can be vulnerable (managers may not say what unsolved problems their companies face if you're just shopping around for solutions that could possibly benefit their competitors).

</comment><comment><USER25> The thing is, it's not always about an "unsolved problem" per-se. I think looking for "unsolved problems", in a manner of speaking, is an overly simplistic idea. The question is more "where are the places where the introduction of some technological solution could (make some process more efficient | help somebody make quicker/better decisions | improve quality | reduce costs | drive revenue | etc). In most cases, firms have _some_ kind of solution to their problems, they may just not have the _best_ solution.

I guess you could also say that this is arguing semantics, but they may also have places where things could be better using some new technology, but they don't think of it as a problem, since they don't know the technology exists, and therefore don't even think in terms of applying it to their "problem".

Also, as somebody else mentioned, people tend to "normalize pain" over time, to the point that something can be painful but yet if you ask them "tell me about your pain points so I can help you", they don't even think of $WHATEVER (because it's become "normalized pain").

My point is, it's hard to just ask around for "unsolved problems" and find good stuff, even if you called up people in various companies and asked them flat out. And that's simply because they may not know what to tell you.

I think the best way to really identify areas for improvement is to have a deep knowledge of how a particular company (or at least, companies in a given industry in general operate) and identify the problems spots based on your own knowledge. That, of course, is difficult for domains that you don't know much about. Unfortunately I don't think there are any easy answers to this. Probably the best answer I can offer is to say, build relationships with people in a given company / industry, spend as much time talking to them as you can, and bounce ideas back and forth until something seems to resonate. IF you can find a company that has "business process analysts" on staff, some of those people may be able to help you, since they spend all their time looking at business processes and trying to find ways to improve them.

<comment><USER26> My thoughts exactly. find what they _need_ , not what they _want_

</comment></comment><comment><USER27> The best discussion I've read about this is in this reddit ama: [https://www.reddit.com/r/IAmA/comments/13q8ja/iama_serial_in...](https://www.reddit.com/r/IAmA/comments/13q8ja/iama_serial_inventor_with_120_patents_to_my_name/) search for "On average how long does it take you to come up with an invention?" for a relevant section, but the whole thing is very interesting.

<comment><USER28> What did you like about that AMA? As many of the comments expressed, most of the answers were very vague, and the whole thing was pretty much a tease.

>Basically, it is a specialized method of learning faster and retaining knowledge more comprehensively. Think about it -- what percentage of what you learn do you retain? In all likelihood, you are losing information almost as fast as you are gaining. Second, assemble the information into a useful format within your mind. Then, find out where inventions emerge within the mind. Turns out, you won't like the answer. Your mind invents in a place you may not be able to access. Break into this space and you will be inventing quickly, methodically, and reliably. To solve the learning problem and the thinking problem will take some years.

>I invent using a specific system that was developed by myself and a colleague when we were in college. The system allows one to invent in whatever field you want and methodically (you will definitely solve the problem more effectively than even the practitioners within the field). However, there are specific limitations. However, it is one of the few "systems" that is methodical and that can be taught. It is not random. My colleague has something like 60-70 patents and is also a successful inventor and intrapreneur. He did not like being independent so he has stayed at a large company. I went solo.

Everyone wanted to know the details of these ideas, but the OP refused to provide any specifics, not even a very general overview.

Despite this, there were a few interesting tidbits concerning patents and about how he generally approaches his career and problem solving. I'd really like to know more about his process though.

</comment></comment><comment><USER29> There is a really easy way to evaluate ideas to see whether it would make a good niche startup: does it involve one or more complicated spreadsheets?

If the answer is yes, and the spreadsheet is connected to a problem with currency attached, you've got a decent shot at building a better mousetrap, because the mousetrap they're using now sucks.

If the answer is no, then its probably not a hard enough problem that people are willing to pay for it, or their current solutions aren't a pain point.

</comment><comment><USER4> One thing that is strikingly weak across the board in many industries is service.

In the pursuit of profits, industries have automated, off-shored, etc. etc. etc. most things that have to do with customer interaction.

I am having weekly examples of having to interact with services I buy, needing help with something, filing a claim, etc. where the space for improvement is huge.

Anyone out there that makes services a core value generator of their business, and finds a way to scale it without leaving quality behind will make a ton of money.

In other words, break the assumption that good service is for expensive services.

My take is that most of the time, what lacks, is people on the other side (the customer service team) with the intention, will and ability to understand what is happening to the client. They are not paid to understand what the heck I need, someone pre-determined (offshoring agency?) what will happen to me and try to solve it as fast as possible. God forbids your scenario has not been through about by the geniuses when implementing the system!

It is a shame to be living in the most advanced economy of the world and have to waste time on a phone trying to explain things to someone who doesn't care much, or can't even understand it.

</comment><comment><USER30> I think it is more complicated than just doing the tech. I have a certificate in GIS and worked in a completely unrelated department in a Fortune 500 company for over 5 years. They even had existing means to submit suggestions/new ideas. My GIS training was routinely helpful in doing my job that de facto involved working with various databases. It made me really talented at figuring out what the new glitch was when we had updates and we worked with a lot of geographically related info (addresses were a big thing). My GIS related suggestions were routinely ignored and dismissed. Only one guy at the entire company in the more than 5 years I worked there even knew what GIS was before I explained it to them.

A lot of these problems remain unsolved because LA LA LA NOT LISTENING, not because "gosh, it's just a hard problem to solve and we have been trying and it just is so very hard." A lot of it is cultural and lack of understanding, etc. You won't get past that just by creating the latest, greatest technical solution.

</comment><comment><USER31> Asking people isn't likely to get you an answer, based on my experience. If you want to find a problem to solve, you'll have to actually _see_ what they're doing that can be easily automated. They have blind spots and just do it, without thinking about how it can done differently.

</comment><comment><USER32> I'd like to consider other fields that have problems needing solving>

The odd thing about people in other industries; they may be perfectly happy with the status quo. So asking industry insiders might not yield anything more than how to tweak current processes. As an outsider, you are the person most likely to find true breakthroughs. What space frustrates you the most?

The James Dyson story is instructive in this regard > [http://www.goodreads.com/book/show/955045.Against_the_Odds](http://www.goodreads.com/book/show/955045.Against_the_Odds)

</comment><comment><USER17> I am a professor at a university. Unbelievably, all the classes offered by our math department (with roughly 100 different teachers) are scheduled by hand.

This takes a tremendous effort, and then when one class gets cancelled and one professor has to be reassigned to a different class, but she can only teach on Tuesday/Thursdays, it sets off a giant stack of dominoes...

Seriously, the amount and sheer drudgery of thankless admin work in my department makes me want to cultivate a reputation for disorganization and irresponsibility.

<comment><USER33> But will your university pay for a better solution? Most small universities, public or private, won't shell out the cash to solve that particular problem. Same thing goes with small hospitals, high schools and probably dozens of other public and private institutions.

<comment><USER17> I wouldn't trust my _university_. Their IT department has the collective IQ of a toad.

But individual departments have their own budget. If one faculty member says "I'll do the scheduling if you pay $500 for this software", and everyone else says "I'm too busy", then that $500's gonna get spent.

</comment></comment></comment><comment><USER34> Go to an event for people in another field and ask people.

</comment><comment><USER35> you can try looking at:

[https://www.reddit.com/r/somebodycodethis/](https://www.reddit.com/r/somebodycodethis/)

[https://www.reddit.com/r/SomebodyMakeThis/](https://www.reddit.com/r/SomebodyMakeThis/)

...who knows, you might find something interesting to spark your imagination.

</comment><comment><USER36> I have been told that this problem was a business problem in itself... I've been thinking about ways to gather a list of problems deemed worthy of being solved, and to actually make it a business. Or at least, a hobby.

What kind of problems are you interested in? What kind of skills do you practice on a regular basis?

<comment><USER37> what if someone (who has basic knowledge of programming) went around interviewing experts from other industries and posting the interviews? the interviews should be problem specific - _what tasks they do daily, that can potentially be automated_ type of questions. How can this be a business though? this interviewer could probably become a consultant?

<comment><USER36> Well, I had ideas about how to make a business out of it, but I'll start with seeing if I can make a hobby first :) You are bringing good ideas to the topic at hands though - thank you for this!

</comment></comment></comment><comment><USER38> Hey, I applaud your approach.

Only thing I would add is that don't just look for problems but for inefficient workflows as well. A person may have to do some same set of tasks everyday and not realise that they can do it faster or it is a problem at all.

Perhaps go to random meetups or business networking events etc

</comment><comment><USER39> Partys. Just state you are a developer looking to solve problems. Not kidding.

<comment><USER40> Be prepared for tons of idiotic, impossible or simply not that interesting ideas in this case. If you hate parties and in general want your social interactions be as short as possible then it's not a good method for you. OTOH, if you can have fun while simultaneously _maybe_ hearing something inspiring then it seems a really good solution.

</comment></comment><comment><USER41> Ive found if youre really interested in a subject and read about it in your spare time, youll kind of know what problems exist and what have been solved.

So just do something that interests you and let the problems emerge

</comment><comment><USER42> Yellow Pages, or your local directory / ad compilation books. People post lots of advertisements for problems they need solved - en mass, some of those problem spaces may be disruptable.

</comment><comment><USER43> Irregular newsletter on problems submitted by users. [http://probhunt.com/](http://probhunt.com/)

</comment><comment><USER44> Talk with "domain experts".

Your job is to identify and abstract domain problems into models that can be solved using your technical expertise.

</comment><comment><USER45> Reach out to people who work in those industries.......... not google.</comment>


Show HN: Eirify – Creative Digital Marketplace - <AUTHOR> https://eirify.com/and-were-up-an-running <comment><USER2>
      Commision (sic). A flat 75% Commision (sic) on sales.

Yikes.</comment>


Next generation of Google Cloud SQL - <AUTHOR> http://googlecloudplatform.blogspot.com/2015/12/the-next-generation-of-managed-MySQL-offerings-on-Cloud-SQL.html <comment><USER2> Still no Postgres :(

<comment><USER3> I've been considerably dissatisfied with AWS lately, namely their lack of real customer support for billing issues and was shopping around for a Postgres provider. [http://databaselabs.io](http://databaselabs.io) seems to be a good choice if you're looking for AWS alternative.

<comment><USER4> When it comes to support, Google isn't doing anything exceptional either.

<comment><USER5> I wonder if you've actually submitted a ticket to Google Cloud support at all? At the Gold level of $400/m I've had excellent experiences including:

a) First responders actually being engineers who know the code well, can reference the open source repositories pointing to where issues are and suggesting workarounds.

b) Full workarounds being coded by the first responder (in Python for our use but they officially support other languages too) which are simple drop in replacement to fix the problem temporarily until the root cause is addressed.

c) Fast troubleshooting of critical issues (within minutes) with helpful debugging advice to resolve the issue.

d) A single contact owning the issue by default, with handover to alternative timezones on requst e.g. when an issue is long running or (in my case) you were in one location for a few weeks then change to another.

e) Consistently achieving the above over 1+ years worth of tickets, including responses handled from Google support teams worldwide to fit into the timezone e.g. Tokyo based support answering questions UK time Sunday night (Monday in Tokyo).

f) The same level of support offered for alpha and beta products even though the official word is "best effort/no SLA"

Where it has been more frustrating is with bugs discovered in the products. These have tended to be escalated to the engineering teams which take a while to fix the root cause, although acceptable workarounds are provided in the meantime. Their support ticket UI is also pretty rubbish.

Google might have a poor reputation for support when you're a consumer, but then you're not paying them anything. For both Google Cloud and Google Apps, their support has been excellent.

<comment><USER4> > At the Gold level of $400/m I've had excellent experiences.

This is what's different. Yes I've submitted tickets. I did for SSL certificates related issues as they are currently migrating that functionality from google apps to developer console. I also emailed them about some issues I had with storage but nothing. Eventually I found workarounds but I guess I don't pay for support so I shouldn't be expecting it.

</comment></comment></comment></comment></comment><comment><USER6> Not sure how well the second gen supports appengine. With 1st gen you could ask the database to follow an appengine app so they are both in the same cell. I also don't see how to allow connection from appengine apps I only can select IP addresses. Are these unnecessary now?

Also curious about the on demand option. I had it in 1st gen but its gone now. I can only select Always on or Never. I had a large database that I only used for a few hours per month. I'd love to migrate to second gen but if its always in it might make it much more expensive.

At last I tried to perform an export from 1st gen into 2nd gen and I'm getting server errors will try again later.

<comment><USER7> I'd love to hear about the errors you're experiencing; if there's any bumps in the road we want to smooth them out ASAP.

Please email firstname.lastname@example.com with your instance names and the error message, and I'll get someone to look into it for you.

Second Gen is indeed always on. Crunch the numbers for your use case, I've been told by the pricing mavens that for many use cases Second Gen ends up cheaper. And yeah, Second Gen doesn't follow your AppEngine app the way it used to. This will be a call you need to make based on your use case. If you are low-traffic and highly latency-bound and your app runs on App Engine, first gen may ( _may_ ) be quicker. For other bounds (I/O, RAM, CPU) you should expect better performance from Second Gen.

</comment></comment><comment><USER8> Looks like its neck to neck with AWS RDS MySQL. Has anyone done any benchmarks on performance?

<comment><USER9> It is more comparable with AWS Aurora, since this is a compatible reimplementation and _not_ a MySQL box with beefed up hardware specs.

<comment><USER7> Hey, I'm a software engineer on Cloud SQL.

Cloud SQL isn't a compatible reimplementation, it's the same vanilla MySQL that you know and love, but with a few tweaks (such as removal of SUPER privileges so you can't bork your backups, which is rather important as a managed service).

Second Generation instances should have better uptime than First Generation, as we now have live migration ala GCE if the host machine requires maintenance, and we can upgrade much of the infrastructure without restarting MySQL as we used to.

We do have failover capabilities for Second Generation instances if a zone goes down, so we're hoping between failover between zones and host migration we should have some really good uptime.

<comment><USER10> Awesome, thanks!

Any idea on how long a failover takes? Seems to be about 30 seconds for First generation cloud SQL, is it the same-ish for 2nd generation?

Only thing I don't love about the Cloud SQL is the failover time, but I guess if it stays at 30 seconds and doesn't fail too much - it is still way better than trying to run my own SQL server.

<comment><USER7> So that depends on what's happening.

If it's host maintenance (the machine your database is on needs to be brought down) then you should "see" the same results as Google Compute Engine live migration, which is that you hopefully see nothing :) This was one of the most common reasons a first gen instance would require restarting, alongside us pushing updates. So nixing that one, alongside the other non-restarting updates we can do now, is good stuff.

If a whole zone goes down, we start the failover process automatically for you. This is order minutes. It won't be seamless, but zones going down is hopefully a very rare occurrence.

<comment><USER10> ya that makes sense, sounds pretty good.

I have a small product on a gen1 D1 with 512 mb ram. I wonder how that compares to a db-g1-small in performance. db-g1-small has more memory but not sure if it is as apples to apples as that..

</comment></comment></comment></comment></comment></comment><comment><USER11> And still no private IPs?

<comment><USER12> It's also a shame you can't use their own firewall rules with CloudSQL, or even specify instance tags to allow traffic inbound to CloudSQL. You have to specify IP ranges (CIDR) for each of your hosts. Makes it near impossible to allow an auto-scaling group to access CloudSQL since you have no control over the public IP that will be assigned to a new host being spun up in the ASG.

<comment><USER13> It seems they approached the problem with a new solution: [https://cloud.google.com/sql/docs/sql- proxy](https://cloud.google.com/sql/docs/sql-proxy)

,,The Cloud SQL Proxy provides secure access to your Cloud SQL Second Generation instances. ... It is especially useful when connecting from clients with dynamic IP address, such as Managed VM and Google Container Engine applications."

<comment><USER11> The proxy solution looks OK, shame it wasn't mentioned in the blog unless I'm blind.

Lack of private IPs has been the single reason why we've not moved our current dbs over. I'm sure it's hard but you're Google after all o_0

<comment><USER14> Pretty much the same situation for us, too.

<comment><USER15> I was really excited about the possibility of using Cloud SQL. Unfortunately, the lack of private IP whitelisting forces you to make some tradeoffs that don't make sense from the security perspective.

</comment></comment></comment></comment></comment></comment><comment><USER16> Is it just me or does Google Cloud SQL seem extremely expensive compared to the alternatives (RDS, etc)?

<comment><USER17> It's just you.

Looking at Amazon's m4 instances vs Google's standard instances.

       n1-standard-2=$0.1930  db.m4.large=$0.175
       n1-standard-4=$0.3860  db.m4.xlarge=$0.35
       n1-standard-8=$0.7720  db.m4.2xlarge=$0.70
       n1-standard-16=$1.5445 db.m4.4xlarge=$1.401

That's without Google's sustained use discount, so it comes out as cheaper most of the time.</comment></comment>


Ask HN: How would you solve redistricting? - <AUTHOR>

I caught part of a discussion on NPR this morning regarding California's newly drawn districts. There seem to be many complaints (most from different groups feeling like they were split, or combined unfairly).
While it's an improvement to have been done by an independent commission, the way these maps are drawn still seems archaic. Redrawing district lines, to me, seems like a problem that could pretty easily be solved algorithmically.
What do you think? What sort of inputs would you need? What factors would you take into account? Any good articles on this sort of thing? Any existing partitioning algorithms suitable for this? Would simply randomising districts be preferable?
Thoughts. <comment><USER2> Turn each state into a multi-member district. Small states with only one rep can be combined with other states to form three-rep blocks, i.e., North Dakota, South Dakota, and Montana can be combined into one election. Elections can be party-list elections. For example, Utah has 3 seats; each party puts forward a list of 3 candidates, and the voters vote for the party of their choice. There's no longer a need to redraw lines because there are no more lines.

<comment><USER3> There is some value in geography-based representation! Idealistically, well, there's idealistic value. Cynically, considering that many members of Congress are capable of bringing pork-barrel projects to their home districts, it makes sense for voters that their representative is accountable to the district.

While the idea of decoupling representation from geography is an interesting one and it may seem appealing, in practice I would not be surprised at all to see this result in a rapid deterioration in the quality of representation for areas in which representatives do not live and a corresponding rise in legislative effectiveness for the areas housing the representatives.

Following this line of assumptions a little further, it's easy to understand why Congress is divided into components where representation is based on different geographical scales.</comment></comment>


Domino's Pizza in the UK recommend changing password and checking bank statement - <AUTHOR> http://communicatoremail.com/cxoF~sYgjYCRc25DwXgcY8usiup~j8lNrvn6lscejgK/WebView.aspx <comment><USER2> NPR's Marketplace did an interview with Domino's CEO a few years back and surprisingly, one of the things he said was top on his list was digital security. Smart man.

Also, a company that is detecting breaching of this kind has its eyes open. Not only aren't they breached, but they are out there explaining how it happened to a tiny portion of their customer base and warning others who are using poor password management practices.

A hat tip to you Dominos Pizza. Here's the interview:

[https://www.marketplace.org/2015/09/24/business/corner- offic...](https://www.marketplace.org/2015/09/24/business/corner-office- marketplace/dominos-patrick-doyle-making-perfect-pepperoni)

<comment><USER3> There are a variety of projects that students from my university as well as other companies especially on Michigan collaborate with Domino's on. One of my favorites is the new Domino's specialized delivery car [1], and a pizza pick- up cart with accompanying mobile apps that will hopefully make it to production sometime in the future.

[1]: [http://www.dominosdxp.com](http://www.dominosdxp.com)

<comment><USER4> Reminds me of Snow Crash.

</comment></comment></comment><comment><USER5> It wasn't just the UK. Two days ago my wife's Domino's account and her stored credit card were compromised. Someone in Texas ordered pizza on her dime (we live in Atlanta). At first she thought it was just her card and the thief had tested it with a Domino's order, but she also got an email from Domino's about the order itself. She immediately filed a claim and canceled the card, and she contacted Domino's about it. Their response was along the lines of "We're not going to do anything about a $40 order, but thanks for reporting it, and good luck with your credit card." It was infuriating to say the least. Thankfully her card issuer (Amazon Visa card via Chase bank) reversed the charge without a problem.

<comment><USER6> It's weird that they didn't offer a refund, the next logical step for any consumer would be to file a chargeback, which Domino's has to pay for (in addition to the money she was refunded through the chargeback)

<comment><USER5> It's my understanding from her conversation with the credit card company that it's not being processed as a chargeback, but as a payment reversal. No extra fees to Domino's, they are just out a bit of food at one of their (likely franchisee) restaurants.

<comment><USER7> That's not how it works. Payment reversal is only possible via chargeback or by the vendor themselves refunding the charge, so Domino's will absolutely get a fee.

<comment><USER5> Then either we misunderstood the credit card company, or they misinformed us. Either way, it was handled promptly and nearly painlessly, something I didn't expect given my past experience with someone gaining access to my credit card information. Times have changed.

</comment></comment></comment></comment></comment><comment><USER8> One of the nice things about takeaway food delivery is you don't always need to give a service your payment details, if they accept cash on delivery. Domino's don't even need an account.

</comment><comment><USER9> A while ago I was at my house with friends and was looking to order takeaway. Collectively we didn't have enough cash on hand to pay on delivery so we looked at various apps, JustEat, Domino's and the like. Domino's were written off instantly when we discovered we couldn't use a third party service like PayPal. If major tech companies can't manage their security properly I have little faith in Fast Food outlets investing in getting it right. I know they don't think they have been breached, and this may well be the case, but do they really need to be storing sensitive data at all?

Edit: turns out you can use PayPal (see below), ignore me I'm wrong!

<comment><USER10> Maybe this is just a regional thing, but why in the world are you trying to pay for takeout with PayPal? If I'm with friends, one of us pays with a credit card or cash and the rest of us give them cash or square cash/venmo/bitcoin/whatever is mutually agreeable.

Half the point of a credit card is that transactions are repudiable for like 6 months, so if some careless food joint gets your credit card info stolen, it's not a huge inconvenience. You just call your bank, reverse the transaction, and get a new card in the mail in a day or two.

The real solution, of course, is to have push-based rather than pull-based digital payment systems, but consumer finance moves slowly.

<comment><USER11> Well, for me, once I reach the payment screen and have the option of pulling out my wallet and typing in my card information vs simply entering my PayPal credentials, which I have memorized, it's any easy choice.

<comment><USER5> Maybe it's a bad habit, but I have my card numbers, expiration dates, and security codes memorized. I'm that way with random strings though; I know the VINs to all of my vehicles, and I even have the license key to my old Windows 98SE disk rolling around in my head, fifteen years after the last time I reinstalled it. It's not quite a useless talent, but it's certainly a boorish one.

<comment><USER11> If only my bad habits were so useful.</comment></comment></comment></comment></comment>


Google Docs Is Randomly Flagging Files for Violating Its Terms of Service - <AUTHOR> https://motherboard.vice.com/en_us/article/zmz3yw/why-is-my-google-doc-locked-terms-of-service-bug <comment><USER2> It was nice when everything was saved in your PC .. unless you forgot to back things up.

I think services like Dropbox/Mega are the happy medium. All the files are actually on your computer. If they go away, you don't lose your files, they just stop syncing. When you put all your crap "in the cloud" (rolls eyes), it means the services you like may stop working, or they could release a new crappy version with no ability to revert to the previous one.

<comment><USER3> I use an encrypted container in Dropbox. I retain complete control over my files but they are still backed up, and Dropbox is smart enough to only upload the diff if something in the container changes. It's a little inconvenient in that I can't for example access individual files on my phone without a lot of hassle but overall it's an adequate solution for my needs.

<comment><USER4> A delta of changes in an encrypted container should be very close to the size of the full container, shouldn't?

It seems this will only be feasible when we have homorphic encryption ready.

If someone is interested on that kind of encryption, see "A FULLY HOMOMORPHIC ENCRYPTION SCHEME"[1] and "Fully Homomorphic Encryption without Bootstrapping "[2]

[1] [https://crypto.stanford.edu/craig/craig- thesis.pdf](https://crypto.stanford.edu/craig/craig-thesis.pdf)

[2] [https://eprint.iacr.org/2011/277.pdf](https://eprint.iacr.org/2011/277.pdf)

<comment><USER5> No. AES encrypts blocks (I think 256kb?). So that's the only thing you have to sync.

<comment><USER6> If you use plain AES ECB, then little penguins will show up in your encrypted data. You would want to use a disk encryption scheme, like XTS, where the encryption is not just based on the data of the block, but also on the index of the block, to prevent identical blocks at different locations from looking identical. You also want it to be based on a nonce of some sort, to prevent attackers from reverting a block to an older copy.

<comment><USER5> Penguins? What are you talking about?

I don't care about low-level encryption details. That's why I use encryption software instead of coding my own.

<comment><USER7> ECB has issues:

[https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Electronic_Codebook_%28ECB%29)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I don't know if it's fair to say that they are "randomly" flagging items - I'm guessing they're using a similar set of tools that they use to algorithmically determine if, say, Youtube videos violate their TOS.

Probably a recent update / bug increased the number of false positives more than expected.

Not that I'm sympathizing with Google - just seeing if there's a less click- baity reason for what's going on.

<comment><USER9> I think "randomly" is being used here in the sense of "without a good reason." Regardless of how the content gets classified, they shouldn't be policing _private_ files.

<comment><USER10> The anecdata from Twitter were stories about shared docs getting flagged as a ToS violation. Did anyone see the false ToS violation on a totally private, unshared file?

<comment><USER9> Where do you get that from? I randomly checked a few of the tweets and didn't see anything about shared. Nothing about private, either, but that seems like a reasonable default assumption.

</comment></comment></comment></comment><comment><USER11> Scary stuff and can only hurt Google's move to become your go-to office suite. Imagine your PC decided which files it did and didn't like and removed them without your permission? Sounds like the reality now if you own a Chromebook.

<comment><USER12> I wouldn't be surprised if it ever started happening with Windows/Office, they already have tools that scan for unlicensed media.

<comment><USER13> Microsoft has an extremely long history of doing business with companies from small to very large enterprises in size. Google as a productivity software company that deals with business clients, is still using training wheels by comparison. Why does that matter? Microsoft is less likely to make mistakes like this around any of their productivity tools businesses (including storage).

Besides that, Google is currently on a fanatical binge about censoring content they disagree with. Microsoft is not, which vastly reduces the likelihood of such a mistake in the first place.

</comment></comment></comment><comment><USER14> Article provides a good chunk of insight beyond the original tweet currently with less discussion on the front page:

Draft of a story about wildlife crime was frozen for violating Google Docs' TOS | [https://news.ycombinator.com/item?id=15593750](https://news.ycombinator.com/item?id=15593750)

</comment><comment><USER15> When will they start flagging Gmail accounts and locking you out from Android phones?

<comment><USER16> That happens to me often. When my home ip changes and k9 mail connects for the first time to gmail, they always lock my account out until I log in from a desktop they recognize. Freaky freaky.

<comment><USER10> I actually like it when services that host my data have some protection against unrecognized devices accessing it.

<comment><USER5> I disagree. It should treat unrecognized devices as any device. In other words, it shouldn't remember devices. Because you know, privacy.

The only thing I ask these services is that they won't let anyone in who doesn't have the right password. I think it's not too much to ask.

<comment><USER17> In terms of user security, that's just not a good idea. Google has likely prevented an absurd number of account compromises (and therefore identity theft, fraud, personal information leakage, espionage...) by recognizing logins from new devices and unfamiliar locations. Google's user account security practices are pretty much the best in the business.

It's silly to think Google doesn't _already_ know everything about every device you log in from, so that horse is already out of the barn and running on the highway privacy-wise. They might as well use that information to actually protect their users since they're already using it for advertising.

<comment><USER18> I'm sure that Google's decision has improved the account security of the average user, but I'd really like it if there were some way I could signal them that I'm not an average user. My password likely has more entropy than the hash they check it against; if that gets compromised, the attacker also has access to any other information Google would use to identify me. Which is a joke anyway, since "which city do you usually log in from" is hard to answer when you've been using a VPN for more than a year. I dread the day when they make 2FA mandatory and my account security becomes vulnerable to a social- engineering attack hijacking my phone number.

<comment><USER5> I thought I had a way around that, but no.

You CAN add a phone number, then ask you use FreeOTP token, then delete the phone number. Great, right?

No. Because if you click that "I forgot my password / don't have access to my 2FA" button, they do let you use your phone number to identify yourself, even though you've deleted your number from your google account.

Fuck these people.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> This is something you'd expect in China, not the US. It raises real questions about whether Chromebooks are viable for business.

 _All your data are belong to us._

</comment><comment><USER20> When stuff like this happens at Google it's tempting to think that it is in fact random, and Google uses complaints as feedback for their derp-learning algorithms in order to become better at finding content that is truly violating their terms of service.

<comment><USER21> > Google ... derp-learning algorithms

Probably a typo, but I laughed pretty hard. You're not wrong.

</comment></comment><comment><USER22> Regardless of the bug, we need a service that cannot read your docs/email/data.

GSuite has to be the most paradoxical Google product - you pay Google and "trust" them to not go through your company data!

<comment><USER7> As opposed to Office 365?

<comment><USER22> Office 365 reads your data. They just don't advertise against it because their ad business isn't significant

<comment><USER23> Why would their ad strategy, or lack thereof, prevent them from enforcing TOS in their document tools as Google apparently does?

</comment></comment></comment></comment><comment><USER24> This is what happens when you tolerate walled gardens.

</comment><comment><USER25> This means Google is scanning your stuff one way or another. How much would one like to bet that they're surreptitiously stealing secrets to use to make money?

<comment><USER25> "Google Drive Terms of Service [google.com]

We may review your conduct and content in Google Drive for compliance with the Terms and our Program Policies.

When you upload, submit, store, send or receive content to or through Google Drive, you give Google a worldwide license to use, host, store, reproduce, modify, create derivative works (such as those resulting from translations, adaptations or other changes we make so that your content works better with our services), communicate, publish, publicly perform, publicly display and distribute such content. The rights you grant in this license are for the limited purpose of operating, promoting, and improving our services, and to develop new ones. This license continues even if you stop using our services unless you delete your content. Make sure you have the necessary rights to grant us this license for any content that you submit to Google Drive."

Oh, look, right there it says they can use your stuff for pretty much anything. Funny how many of the people having their file access suspended are people in the middle of very large important projects or journalism reports.

Oh, would you look at that! One of my accounts which is used for my energy efficiency research is suspended. And my LED lighting. That's pretty suspicious.</comment></comment>


Rave Panic Button: Vulnerabilities in a Nationwide Emergency Alert System - <AUTHOR> https://randywestergren.com/rave-panic-button-vulnerabilities-nationwide-emergency-alert-system/ <comment><USER3> So they found a hard-coded API token and no further user authentication to limit the requests. This is obviously a common rookie mistake (didn't Facebook, Snapchat, Instagram all fall for this at some point?) and security software particularly should not have such a basic vulnerability, but I do think TFA veers past security writeup into editorial when they start critiquing the cost/pricing and calling for customers to drop the software, particularly since the vendor was responsive to the report.

It seems like maybe the vendor's communication trailed off toward the end leaving OP with bad feelings which show up in the write-up.

Generally I like to see security research and vulnerabilities reported as a way to document the process used and experience gained, but not to skewer the company except with respect to their responsiveness of a patch.

Of course, everyone here is free to skewer the app as much as they like, I just don't like reading it in the actual write-up.

<comment><USER4> Sure, but.. this isn't Instagram, is it? Somehow I feel that if you're purporting to build a safety-critical service, the bar ought to be set a bit higher for you than if you're sharing pictures of people's lunch.

It's a common rookie mistake, but perhaps the takeaway is that this kind of area isn't something that rookies should be tackling.

<comment><USER5> >Sure, but.. this isn't Instagram, is it? Somehow I feel that if you're purporting to build a safety-critical service, the bar ought to be set a bit higher for you than if you're sharing pictures of people's lunch.

To your point and going back to what zaroth was getting at I'm wondering why I didn't see the typical references to a bug bounty, permission or payout that are typical in write-ups of this nature. This really does concern me.

Poking around server-side with an account you clearly weren't meant to interact with could have serious repercussions up to and including service outages. You'd be amazed at the sorts of mistakes I've seen in code that could lead to unintentionally taking down a service. A number of years ago I discovered a flaw with a major identity management provider. If the POST request parameters were placed out of expected order it crashed the application into a zombied state where it could no longer accept requests, causing a denial of service situation until it was restarted. Worse, the event wasn't logged. You don't typically log POSTs in the HTTPD and they didn't have application layer logging at that level either so without monitoring HTTPS traffic there was no way to troubleshoot why the application was hanging.

I've seen lots of vulnerabilities like this including in life critical systems. Because of the unexpected as well as US law, I always check to see if there's a bug bounty first or I reach out to the vendor and get written permission. I really am paranoid about what's in criminal code as well as accidentally causing an outage.

There are certainly a number of ethics and possibly legal issue which appear to be at play here beyond just embarrassing the company.

Hopefully we'll here more about the bug bounty program.

</comment></comment></comment><comment><USER6> Montana TV station EAS system hacked a few years a go [1]. While I applaud for the humor, I am still in awe of how little attention this Orson Welles(ish) episode got.

[1]: [https://www.youtube.com/watch?v=TQWtqJylMKQ](https://www.youtube.com/watch?v=TQWtqJylMKQ)

</comment><comment><USER7> This discovery and write-up was an awesome read but I do disagree on the price critique. 70K seems relatively inexpensive for deployment of an app at a state level, let alone development of an app. Proof of Concept, perhaps but what does a full security audit cost these days? If anything I would be concerned that the budget did not include those kinds of factors and should have cost a bit more :)

This article does lead me to wonder if Rave has missed an opportunity - installation of an app on Crestron / Andoird room automation systems that accomplish similar things. That would take the mobile component out but still have a benefit from a facilities / awareness perspective.

<comment><AUTHOR> Appreciate the feedback! My point on the price concern was that the app was not developed solely for my county, it was resold to multiple customers - <USER2> least 2,000 according to the link I posted in another comment.

I'm not sure what other customers were charged for the app, but if they were all $70K (as my County was), then that's a hefty rake.

<comment><USER8> That makes sense now, but was not clearly communicated in the post (consider clarifying there).

</comment></comment></comment><comment><USER9> The author says that $70k seems a lot to build the app.

I don't know how long it took, but depending on the size of the team etc, it sounds pretty cheap TBH - certainly not enough $ there to make something secure and supported.

<comment><AUTHOR> They have at least 2K customers according to this: [http://www.king5.com/tech/schools-businesses-emergency- respo...](http://www.king5.com/tech/schools-businesses-emergency-responders- talk-tech-and-public-safety/346228264)

Not sure what each customer was charged, but it sounds like the app/system was resold to individual customers at a pretty hefty price.

<comment><USER10> What was included in the 70k? Typically the govt agency I work for bundles things like support for 5 years, professional services, data migration, maybe even hosting into the "purchase" price because capital is easier to get than operating budget.

</comment></comment></comment><comment><USER11> Interesting technical detail but for me the main takeaway from that was that we're still seeing expensive software systems ($70k per customer) being procured by large numbers of organizations (~2000 customers) to do safety critical work, and still none of them are mandating security reviews as part of the procurement process (or indeed requiring the vendor to have had a review done).

The vulns found here are serious, but any moderately detailed app security review should/would have found them.

Until customers start requiring security reviews for the software their buying we'll see a load more insecure apps being sold.

<comment><USER12> It's not $70k per customer. It's $70k in development costs. On the other hand, 2000 customers is for all of the developer's products, not just this app.

</comment></comment><comment><USER13> That's definitely concerning. Makes you wonder how well secured our other emergency/critical systems really are.

</comment><comment><USER5> Hey, good find but I'm a little confused. It appears that you found what could be a serious issue if no other checks are in place; however, in doing so you appear to have exceeded the access you were provided through the application to their back-end system. Did this fall under a bug bounty program where you had permission to do this or did the company give you written permission? I was looking for a bug bounty program and couldn't find one.

I ask because it looks like you were performing testing which touched their infrastructure, not just your phone and the US Computer Fraud and Abuse act gets pretty scary (Felony scary) when it comes to such things:

[https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act](https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act)

I do a ton of mobile application reviews and find stuff like this quite often but back away at the point I start touching their infrastructure rather than just my phone.

</comment><comment><USER14> > In order to confirm this suspicion, I decided to proxy my phone's traffic > and attempt registering with the app using dummy phone values.

Am I wrong in assuming that being able to proxy the app's HTTPS traffic is evidence of another security problem, specifically that the app is not validating the server's SSL certificate?

<comment><USER3> No, the proxy is a trusted CA and so it can mint a valid cert.

It does mean they are not pinning their cert, but most apps do not.

Even if it was pinned, you just have to disassemble and modify the pin and you can still MITM.

</comment></comment><comment><USER15> Great snooping, and an awesome writeup! As the author points out, organizations should be wary of security even when the developer/publisher claims that it's secure.

</comment><comment><USER16> The vendor was notified three weeks before this public disclosure. Is this reasonable? How should a timeline for public disclosure be determined?

<comment><USER17> You're misreading, it was in November.

</comment></comment><comment><USER18> Anyone have a mirror for the redacted source code?

<comment><USER19> Here you go: [http://archive.is/Ui0Ap](http://archive.is/Ui0Ap)

Courtesy /u/Vusys on Reddit from /r/netsec

</comment></comment><comment><USER20> Rave Panic Button: For when the drop goes too deep.</comment>


Pi Connects Colliding Blocks to a Quantum Search Algorithm - <AUTHOR> http://abstractions.nautil.us/article/508/how-pi-connects-colliding-blocks-to-a-quantum-search-algorithm <comment><USER2> Here is the 3blue1brown video that is alluded to in the article: [https://youtu.be/jsYwFizhncE](https://youtu.be/jsYwFizhncE)

<comment><USER3> The posted article is by 3blue1brown (Grant Sanderson) himself. Where the article says _" Early in 2019, I published a set of three videos about Galperin's result..."_ the link is to the playlist [https://www.youtube.com/playlist?list=PLZHQObOWTQDMalCO_AXOC...](https://www.youtube.com/playlist?list=PLZHQObOWTQDMalCO_AXOC5GWsuY8bOC_Y) of which the video you posted is the second video. IMO, it's best to watch all three (or at least the first two) together :-)

</comment></comment><comment><USER4> If you want to learn more about the quantum search algorithm, I got a lot out of this pretty in-depth essay on how it works-

[https://quantum.country/search](https://quantum.country/search)

<comment><USER5> I got to the "mnemonic medium" part of that and promptly lost interest. No, I don't want you to track me.

<comment><USER6> Quantum Country is a fantastically useful learning resource. They're tracking you so you don't have to digest it all in one gulp, and can pick up where you leave off.

</comment></comment></comment><comment><USER7> anything that is cyclical or periodic is going to have a Pi in the formula that describes its behavior

<comment><USER8> Often this is the case, and pi crops up plenty of other unexpected places, but counterexamples abound as well.

Pick any function defined on [0, 1], and replicate it along the real line at unit intervals. You can force a description of it using pi, but the most natural descriptions won't have any reference to it at all.

<comment><USER9> >replicate

you mean construct the periodic extension?

>You can force a description of it using pi

don't know what about the fourier series is forced...?

>but the most natural descriptions won't have any reference to it at all

can you give an example? when comparing piece-wise definitions and fourier series definitions i think the fourier series _is_ the more natural.

<comment><USER10> > can you give an example?

How about a sawtooth; no pi needed, and the period is 1.

f(x) = x-floor(x)

The Gibbs phenomenon is my proof that Fourier series is not more natural.

<comment><USER11> Why? The Gibbs phenomenon is just an exhibit of a finite Fourier series, no?

<comment><USER9> fourier series converges pointwise but not uniformly. for many use cases you would like uniform convergence (e.g. approximation in an entire neighborhood of a point) and a fourier series won't give you that no matter how many terms you add. but like i said above - gibbs only occurs at non-removable discontinuities and so you shouldn't expect it to be well behaved at those points regardless of the representation.

</comment></comment></comment></comment></comment></comment><comment><USER12> This is fascinating to this very-much-a-math-beginner person.

It's like a glimpse into another dimension.

<comment><USER13> or, indeed, many dimensions.

</comment></comment><comment><USER14> Grant Sanderson is doing such amazing work in divulgation of science and mathematics, promoting, I think, real understanding rather than the mere illusion of fluency. He's like the opposite extreme from WIRED Magazine, Chris Anderson, Malcolm Gladwell, and Deepak Chopra.

</comment><comment><USER15> And here I was wondering if 3B would be powerful enough, or would I need to get a 4.</comment>


Ask HN: How can you get started with software consulting/contracting - <AUTHOR> As a software developer how can you begin your career as a consultant or contractor after gaining some experience <comment><USER2> I've been freelance consulting and developing for more than ten years.

[http://typicalprogrammer.com/how-to-start-freelancing-and- ge...](http://typicalprogrammer.com/how-to-start-freelancing-and-get-clients)

<comment><USER3> Hi Greg, just read this article and some others (joy of maintenance) and what you have written is very inline with my experience, I did a lot of maintenance work (complex shipping rates calculation based on country and product types, optimizing product/cart page to increase conversion) and my clients loved me and don't care what language I am using (Ruby/Rails/Ubuntu)

The twitter follow button in your blog doesn't work, have you changed your twitter handle?

<comment><USER2> I quit Twitter a year ago. I'll remove that link, sorry. Thanks for reading.</comment></comment></comment>


RescueTime Launches Introductions, A Carfax Report For Top Job Candidates - <AUTHOR> http://techcrunch.com/2011/06/13/rescuetime-launches-introductions-a-carfax-report-for-top-job-candidates/

<comment><USER2> And this is why I'm glad I never use RescueTime. This can't possibly help a job seeker - at best, you confirm that you're looking at the right things. At worst, it's an easy reason for a recruiter to pass you over.

<comment><USER3> Totally understand your concern here. I can assure you recruiters will never see the data you don't show them yourself. It's part of our core values for this project. Hell, I wouldn't want to show recruiters my data without removing some things or highlighting others. That's why we launched with the ability to create your own profile. That's the only thing anyone can ever see of your data, and you have full control over it.

</comment></comment><comment><USER3> Hey guys, I just wanted to say that we really did consider the HN crowd when we made this. PG and I had a conversation where it became clear that the core of this project needs to be don't offend HN. Check out the bottom of this page: <http://rescuetime.com/intros> and our faq: <http://rescuetime.com/profiles/faq>

We realize that the whole point of this breaks down if it ventures into the creepy side. We'd rather do something creatively useful and beneficial for our users with their data they're trusting us with.

-B

<comment><USER4> Quoth PG: "After all these years of moderating Hacker News, I understand it very well, and it is going to _hate_ this project unless the entire design spec is "don't offend HN.""

That's prescient feedback. I want you to succeed, I really do. I understand the vision for the product. But tell me: which part, specifically, of "We automatically developed a CarFax report on Patrick McKenzie for distribution to recruiters" is supposed to convey value to me?

I thought I had forgotten CarFax's value proposition, so I Googled them: "Don't run the risk of buying a used car with costly hidden problems." Nope, looks like I remembered accurately. That sounds catastrophically against my interests.

How about this? "We automatically discover what you're great at by comparing you to other people who are great at it, and optionally introduce companies looking for great people to you. It's like having a resume which updates automatically and comprehensively matches all the buzzword bingo without you having to do any work you're not already doing."

<comment><USER3> Yeah, I admit, the carfax analogy is not the best one. We don't really use it anywhere on our site - mostly because it's not really accurate. Your wording is much better and truer to what we're building. Can I use it? :)

<comment><USER4> Please, use it or anything else that suggests you are not using Oceanian MiniPax/Google levels of insight into my activities to tell prospective employers that I spend too much time on HN.

</comment></comment></comment></comment><comment><USER5> Yeesh. A future in which you can't get a job without sharing your browsing history is a scary one.

<comment><USER3> Yipes, agreed! That's a pretty long way from what we're doing though, thankfully.

</comment></comment><comment><USER6> Free idea for YC W12: RescueTime Introductions Manipulatr.ly Extend he TrackMeNot to generate a fictitious browsing history modelled after the employee an HR department thinks it wants.

</comment><comment><USER7> This announcement seems likely to make RescueTime's individual offering seem radioactive. They must be doing well with Team Edition.

</comment><comment><USER8> I predicted a long time ago that this is the direction the product would take.

It is an opt-in thing for now. But if they become really successful, it will become the norm that if you are not willing to share your browsing/app usage statistics with your potential employer you are automatically assumed to have something you wish to hide. Kind of like how absence of credit history puts you in the high-risk bin.

<comment><USER3> In fact, the opposite is true. Every single employer we talked to wanted their concerns address that they would be perceived as invading people's privacy by having them introduced through us. In the end, employers are recruiting you. If you're turned off by the way they're doing it, they lose.

</comment></comment><comment><USER9> Creepy as hell.

</comment><comment><USER10> Hey guys,

We sincerely appreciate the feedback. You guys are a tough crowd, but I'd expect nothing less from HN readers. RescueTime users are our bread and butter and that likely will not change. We need our users to power any model that we setup. We appreciate the comments and feedback - keep it coming. Thanks for reading this far down - for more info go to www.rescuetime.com/intros or blog.rescuetime.com.

If you have any further questions do not hesitate to email me at jason [at] rescuetime [dot] com.

</comment><comment><USER11> Time to invest in a portable Wimax hotspot.</comment>


Minnesota's frozen turbines raise new doubts about wind power - <AUTHOR> http://green.venturebeat.com/2010/02/08/minnesotas-frozen-turbines-raise-new-doubts-about-wind-power/ <comment><USER2> Wow, this is a really misleading article. It takes a minor problem caused by a technical mistake, and turns it into something that threatens the viability of wind power as we know it.

There are known hydraulic fluids that operate fine in Minnesota temperatures. There are wind turbines that currently operate without problems in places colder than Minn.

The only problem is that these particular turbines were designed for the California climate and then someone bought them used and moved them to Minnesota without doing a proper feasibility study.

This is at most a story about local corporate and/or government incompetence. It has nothing to do with the future of wind power.

<comment><USER3> Totally agree. Funny that, in order to diagnose this problem, they probably drove out to the turbines in a vehicle with hydraulic brakes. Judging from the tone of this article, that accomplishment constitutes a major scientific discovery.

</comment></comment><comment><USER4> It's so frustrating that anytime we talk about _any_ new idea the same old battles have to be rehashed with a lack of perspective on the current status quo having its own set of problems. I'm pretty sure we can figure out how to make a turbine that works and harness solar & wind power efficiently and reliability. I have doubts we can convince OPEC nations to keep selling us cheap oil as their production peaks and declines in the near future. I have doubts that the existing energy cartels will ever invest serious time and resources into making carbon energy cleaner. I have serious long term doubts that we can continue to extract carbon energy sources from the Earth in the required quantities to provide energy for 6 billion+ people. I'm almost sure we can't do it in an environmentally friendly way. Doubts? Yeah lots.

</comment><comment><USER5> This is a tiny technical issue and isn't worth reading about. Long story short -- they need to paint the turbine black or use a tiny bit of energy to heat the fluid.

<comment><USER6> Wouldn't switching the hydraulic fluid be sufficient? It's not like there's one single hydraulic fluid in existence, there's thousands of natural and artificial fluids that can be used in hydraulics.

The hydraulic fluid was obviously chosen for California weather not Minnesota, so the hydraulic fluid could suitably be changed for operating in lower temperature ranges.

</comment></comment><comment><USER7> We have lots of wind turbines up here in Canada, and they spin year round. I don't think it's a fatal problem with turbines in general, just with the used ones they tried to transplant from California.

<comment><USER6> Agreed, P.E.I. has countless wind turbines and I've never heard a problem. They're on an island unprotected from the brunt force of the Atlantic all year round, if this was a common problem then P.E.I. wouldn't be covered with turbines.

</comment></comment><comment><USER8> The writer certainly didn't show any effort to demonstrate non-viability of fixes, and he also didn't provide any information on performance of newer turbines or those from other vendors.

This was a case of 20 year old units being purchased used and moved to a much harsher environment. I would not be surprised if the people involved didn't even check to see what operating temperature range was specified by the manufacturer.

I don't think anyone has claimed that wind power is practical everywhere. Sites must be studied in adequate detail, and in some cases a test installation is appropriate ahead of wide-scale deployment.

There seem to be far too many writers and anal-ists giving opinions where they're not qualified to.

</comment><comment><USER9> "As new sources of renewable energy are developed like thin film and solar thermal, for example more and more doubts about wind are coming to the fore."

So technology doesn't stand still. Passive voice is a sure-fire red flag. Who is raising these alleged doubts. Where are the numbers comparing the other technologies to Wind. Why are a few 20-year old turbines that some one forgot to change the hydraulic fluid relevant to the current tech level in Wind power?

As Heinlein said, "What are the facts, and to how many decimal places?"

</comment><comment><USER10> Yeah, one turbine is mis-designed, so wind power is a failure. Some other things that had bugs in their first revision: <list of everything you use on a daily basis>.

<comment><USER11> Yeah, but one dude who was doing climate change research fudged his numbers! That means this wind turbine was set up to fail from the beginning and it's very existence is part of a conspiracy to dupe people into spending .00001% of the federal budget on alternative energy!

<comment><USER10> Exactly. If wind power catches on, the terrorists will have won... or something...

</comment></comment></comment><comment><USER12> tl;dr: it gets cold in Minnesota in the winter, and you need different gear oil in your equipment.

</comment><comment><USER13> At mines in the upper midwest, the diesel fuel used in (expensive, famous- name) heavy equipment wouldn't flow when its temperature got far below zero. At that time, they had to let the engines idle all night because they had no other (engineered) way to keep the fuel warm.

Yet there are obvious solutions to problems like these. So it's not a "windmill fail" like this newbie journalist is painting it. That they often put out less than their "peak" power is a self-evident part of windpower, and matters nothing so long as the plant is cost-effective. Unlike nuclear.

</comment><comment><USER14> [http://www.greenharbor.org/2010/01/wind-turbines- installed-a...](http://www.greenharbor.org/2010/01/wind-turbines-installed- and-operating-in-antarctica/)

Uh, something doesn't seem right here...

</comment><comment><USER15> Every growth industry has it's ups and downs. You find out what works and what doesn't, fix what doesn't, and keep on going. Shouldn't be a big deal.

</comment><comment><USER16> Haha, I live right near this wind turbine. It has literally not spun once the entire time it has been installed. I'd love to know how much it cost the taxpayers of the city that it's in.

<comment><USER10> Probably no more than any other research project.

"Out of sight, out of mind" at its best, but the opposite.</comment></comment>