How I recovered cryptocurrency from a broken laptop - <AUTHOR> https://www.engadget.com/2017/12/05/how-not-to-store-your-bitcoins/ <comment><USER2> I'd call myself a developer and a "computer" expert, especially relative to 99% of the people I know in real life. I've also been in the bitcoin game a long time. I run full bitcoin and monero nodes. Absolutely none of this is easy and frankly, at times it can be absolutely terrifying considering the sums of real dollars you may be transferring. To think that the market cap of Bitcoin and Crypto in general is where it is is actually shocking considering how absolutely _UN_ friendly the entire endeavor is from step 0 to actually buying, selling, transferring coins or buying goods and services.

When using cryptocurrency becomes as easy as pumping gas or sending an email or depositing a check - watch out, because it inevitably will become that simple. It will make the run up we've seen in 2017 seem absolutely darling. I'm certain the usability will come. Personally, I'm waiting for Square Cash to figure it out and then integrate with Twitter.

<comment><USER3> I don't know, for buying and selling Coinbase seems to be pretty user friendly. You can sign up for an account, link it to your bank account and start trading in minutes. Not sure how much easier it could get.

<comment><USER2> Right, I was gonna say that Coinbase is currently the best way to buy and sell coins today. I can say that as I have accounts on a number of exchanges. Still, Coinbase does not let you know that they also operate GDAX.com, where you can "make a market" and buy/sell for _no fee_. A buy/sell on Coinbase is basically a market order on GDAX.

<comment><USER4> Navigate to coinbase.com, scroll to bottom: Products - GDAX. Hardly a secret.

<comment><USER5> Sigh... "You just had to go the basement bathroom past the sign that says beware of the leopard!" (To misquote Douglas Adams). I had to have a friend tell me that there's seamless transfer between yhr 2 systems, if they really wanted to let you know they would've had this trading capability as no. 4 in their "Getting Started"..

</comment></comment></comment></comment></comment><comment><USER6> Someone else might find this tool I wrote useful, it finds BTC wallets by scanning raw block devices:

[https://github.com/jakewins/findbtc](https://github.com/jakewins/findbtc)

I deleted 26BTC a while back when reinstalling a laptop, because they were effectively worthless. A few years later, they weren't anymore, so I wrote this to get them back. As long as the file system isn't encrypted, it scans the raw bytes on the disk to find remnants of wallets. It also unzips compressed files it finds and does the same scanning in there.

<comment><USER7> How do you build this? I see it's go and I have that installed on my laptop but I'm not familiar with the commands to run to build it and the last 15min or so of googling around have been fruitless.

<comment><USER6> If you have Go installed as per [https://golang.org/doc/install](https://golang.org/doc/install) you can build/install this project like this:

> go install github.com/jakewins/findbtc

I'll update the readme!

If that's giving you trouble, I can cross compile it here and upload a binary to github for you if you tell me your OS and processor - although since this is potentially sensitive software, I'd advice building it from source

</comment></comment></comment><comment><USER8> Are there good estimates of the amount of bitcoin lost every year due to carelessness? Based on many anecdotes like this, I fear it's pretty large.

Bitcoin was supposed to be slightly inflationary, due to mining. But if a sufficient fraction is lost every year due to hardware failures and forgotten passwords, it will end up being deflationary. Someday (around log(1e6)/log(1+x) years from now, where x is the fraction lost every year), there'll be only 21 bitcoins left in the world, trading either at 0 or a number with 3 or 4 commas.

[edit: fixed in/de-flation mixup]

<comment><USER9> First there's no practical way btc can be deflationary given the current interest. The currency pool hasn't kept up with the amount of fiat in the markets at all.

Anyway, second part:

[https://bitinfocharts.com/top-100-richest-bitcoin- addresses....](https://bitinfocharts.com/top-100-richest-bitcoin- addresses.html) is a good list. What you're looking for are wallets with a really early first in and no first out (or not one in a really long time).

#4 is a good one! [https://bitinfocharts.com/bitcoin/address/1FeexV6bAHb8ybZjqQ...](https://bitinfocharts.com/bitcoin/address/1FeexV6bAHb8ybZjqQMjJrcCrHGW9sb6uF) This wallet was last touched in 2011 and has $1,008,433,581.88 in it (yes, ba- ba-billion) Either this is the most disciplined investor ever or it's a lost file.

This person dropped $1,000 in 2010 on a few btc and it's now worth $245million ([https://bitinfocharts.com/bitcoin/address/1PeizMg76Cf96nUQrY...](https://bitinfocharts.com/bitcoin/address/1PeizMg76Cf96nUQrYg8xuoZWLQozU5zGW)) ... again, that's either super discipline or just a misplaced file.

The untouched wallets are sadly really really common, especially when you get a few pages in ... you see things like this: [https://bitinfocharts.com/bitcoin/address/13DyBwhpDw6152q1dr...](https://bitinfocharts.com/bitcoin/address/13DyBwhpDw6152q1drbK2US5S3CdY1mRnU) ... this person put in $8 (100btc), then $21 (400), then $122 (1700) and that was their july, 2010. Now it's $26.3 million.

Nobody ever believed the fantasy talk in 2010 that 1 btc was going to be worth a dollar, yet alone 12,500! Lots of people were really careless.

I'm there somewhere and have millions of dollars of bitcoins in a lost wallet. Weee, how fun!

<comment><USER10> Layman question: there is no way to brute force access to these accounts?

<comment><USER11> Yes, maybe, kind of?

With quantum computing it's expected that the ECDSA public-key cryptography used in bitcoin addresses will be broken. However, the ECDSA public key is only exposed when your first transaction _out_ of the address is signed. If you only use addresses once (recommended practice), an attacker would have to break your private key faster than it takes for your transaction to propagate to the entire network in order to steal your coins. It would take a long time between the first cracking of ECDSA to nearly instantly being able to crack it. For example, the first publicly-disclosed attack on SHA1 took 110 GPU- years.

If the accounts listed by the OP have sent transactions in the past and reused addresses (which was common back in 2010/11), it's possible the private keys can be bruteforced in the future.

If not, we don't know the ECDSA public key for the address. Bruteforcing it gets a LOT harder--but never say never.

</comment></comment></comment></comment><comment><USER12> >People .. ridicule cryptocurrencies, dismissing bitcoin as a scam, a Ponzi scheme or a bubble.

>Wealth disparity is at record levels and the ultrarich have cornered the market on every asset class, but with bitcoin, an entirely new economy has sprung into existence. That's the pitch for decentralized cryptocurrencies: They offer hope that there might be another, fairer way of doing things.

The irony here is Bitcoin, like most other cryptocurrencies are structured similar to a pyramid scheme and highly favor existing capital to control the supply and exploiting users who join the network past a certain date where barrier to entry increases.

They tell the story of acquiring this digital asset for a small capital sum, and simply passing it off to someone else for a greater sum. The intention is not utility but psychological exploitation of greater fools.

[http://bitcoin.stackexchange.com/questions/86/is-it- possible...](http://bitcoin.stackexchange.com/questions/86/is-it-possible-to- estimate-the-gini-coefficient-for-bitcoins-and-if-the-trend-is)

[http://www.businessinsider.com/bitcoin- inequality-2014-1](http://www.businessinsider.com/bitcoin-inequality-2014-1)

      Best estimates (2014) are that there are
      about one million holders of
      Bitcoin; 47 individuals hold about
      30 percent, another 900 hold a
      further 20 percent, the next
      10,000 about 25% and another
      million about 20%, with 5% being
      lost. So 1/10th of one percent
      represent about half the holdings
      of Bitcoin and 1 percent close to
      80 percent

<comment><USER13> Part of the irony around bitcoin is that some of the early users of Bitcoin are from the Occupy Wall Street movement. We all remember hearing them request donations via btc, people giving thousands of btc for them to buy pizzas.

I think (entirely without proof) it's likely that many of these organisers were/are holding large quantities of bitcoins themselves and have become unwitting millionaires.

I haven't heard anybody mention this before, but I'm very curious to know if this bears any grain of truth. If the people who led rallies against the top 1% suddenly find themselves deep inside that 1% tail.

<comment><USER14> > I think (entirely without proof) it's likely that many of these organisers > were/are holding large quantities of bitcoins themselves and have become > unwitting millionaires.

I suspect (no proof either) many early bitcoin adopters sold most of their bitcoins long ago. They cashed out when their capital reached a significant amount, long before becoming millionnaire. For instance, I suppose that if today my BC portfolio were worth $5000, I'd sell them (because I certainly would _not_ buy $5000 worth of BC today if I had none).

<comment><USER15> Maybe, but does it matter? If you made a few million, should you be sad because you missed out on a few more?

The first (few) million are life changing. But the difference between 20 and 100m is flying private and owning a yacht vs flying first and chartering one for the week.

<comment><USER16> The question is, can you actually cash out thousands of bitcoins these days? Would any exchange support that and then would you be able to get your money into your actual bank account.

Then comes tax.

<comment><USER17> You still have to pay your taxes but cashing out a few thousand BTC on one of the large exchanges can be easily done. 24 hour volume at bitfinex is $781MM so you would have to dump a lot of coin to move the needle. A multi-thousand coin sell all at once can cause a brief flash crash though. If you have tens of thousands of coins you go to the OTC market.

<comment><USER13> I mentioned this before, but one of my former colleagues quit to trade BTC and claimed he could account on some days for 10% of exchange volume.

No idea which exchange.

But his trading activity as far as I understand were on-average neutral (not net long or short). Though I think he also kept a bunch himself too.

So volume alone does not imply the exchange could absorb a large one-sided addition of sell orders without significant move in spot.

Also it's unclear if any of this volume is 'churning', by those with significant quantities of BTC happy to pay transaction fees to create a sense of false liquidity.

<comment><USER17> Definitely. I did see someone dump 1000 BTC on finex the other day though, and while it did cause a ~$1000 dip they were bought up in a few minutes. Like you say though, there's no way of knowing if the buyers were third parties or the seller rigging the order book (although I don't know how one could have much control over a transaction like that without having control of the exchange itself, but exchanges faking volume and manipulating the price is par for the course in bitcoin land).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> I can identify with the emotions in the article. I spent the better part of the day wrangling with an old version of MultiBit to get some bitcoin out of an old wallet. And I'm currently in process of trying to recover access to an old Coinbase account that I'm pretty sure has a few bitcoin in it.

Part of the problem with all the security around cryptocurrencies is that it can be really hard to keep access and not lose them. So many passwords, two- factor authorizations, Authy tied to phone numbers, etc. I am not using nearly as much security on my bitcoin stuff now. I think the risk of getting hacked is lower than the risk of me losing access.

<comment><USER19> I actually have no idea how to recover Authy/2FA if my phone is taken away..

<comment><USER20> Authy keep the seed so you can recover the 2FA token providing you can still log in to your Authy account.

That's why I use Google Authenticator. I don't _want_ the seed kept (or even known) by a third party. I'll keep my own backup far, far away from any device which also can be used to recover account credentials.

<comment><USER21> If you use Gemini exchange I believe they only support Authy, at least that's what I had to use. Which is a little annoying having to use both Authy and Google Authenticator depending on which exchange I'm using.

</comment></comment></comment></comment><comment><USER22> Ha, funny, just this Monday I had to recover wallet.dat from a slightly corrupted HDD drive. What I needed is just the private key bytes (32), unfortunately the disk was unreadable. What helped was RAW access to data on disk coupled with this little tool that scans for private key signatures: [https://www.makomk.com/gitweb/?p=bitcoin-wallet- recover.git;...](https://www.makomk.com/gitweb/?p=bitcoin-wallet- recover.git;a=summary)

Then of course the bytes had to be converted to addresses to check which one had the money (and if I found it) and then to WIF to import in Electrum. After half a day of stress I did numerous copies now.

</comment><comment><USER23> Oh man! At least the poor guy got his money back.

UX on cryptocurrency software seems absolutely terrible even today--I've had countless problems trying to get my ethereum wallet working (still hasn't worked!)

<comment><USER24> Have you tried exodus wallet ? It's UX/UI is really good, I mean for a crypto wallet

>UX on cryptocurrency software seems absolutely terrible even today

I still have nightmares about multibit UX, it was horrible

</comment></comment><comment><USER25> The cold wallet problem has vexed me. The solutions seem immature given how widespread this need is. For example, nobody seems to have developed a Shamir's secret sharing approach to cold wallets, which seems like a natural fit. Also, there remain these warnings that one must be very careful about how to transfer funds out of a cold wallet (e.g. in one transaction) which seems to defeat the entire purpose of having a cold wallet (which is safety of the funds.)

<comment><USER26> IMO it should be done like this. You have a hot wallet, probably on your phone that has a half key. You keep a QR code somewhere else with the other half. Combine these two and you have the cold storage private key. Additionally you could have the full private key in a safe or whatever that you never touch.

In this system you can top up your hot wallet by specifying all transaction details and then scanning the QR with the half code to sign the transaction and send it off.

This would roughly as secure as some sort of 2FA method. The attacker needs to have both the phone compromised, and the paper with the half key compromised.

<comment><USER2> I appreciate everything you just said and agree that this could work well for some people. On the other hand, reading it through the eyes of the 99% of people I know who can barely check their email, everything you said may as well be written in Klingon. It is simply too difficult for most people to understand.

<comment><USER27> Cryptography is a necessary lesson that we need to teach in 2017. Lowest common denominator is a hard threshold to design security for.

</comment></comment></comment></comment><comment><USER28> And that's why i never put passwords or other keys on data that I need to keep safe (as in an archive e.g.).

The chances of me messing something up and losing it forever is bigger then the chance of somebody actually steeling it.

</comment><comment><USER18> I wonder, how many of us here actually understand Bitcoin and cryptocurrencies? I know several of us probably use them, but even amongst the tech-savy, there seem to be very few who actually understand it, and even fewer of those who participate in the programming of it. I understand the descriptions of blockchains and it's advantages, but I've never looked at any code. And I realize that anyone could in theory look at the code and participate, but it's out of the reach of most programmers I think, let alone regular people. So while on the one hand it seems to be a great "power to the people" currency option, it's really still in the hands of a few.

<comment><USER29> > but it's out of the reach of most programmers

It's actually really not all that difficult. There are lots of details, and understanding it _all_ end to end is definitely a task most people will never do, but the issue is simply one of effort and motivation, not of fundamental difficulty.

</comment></comment><comment><USER30> People critical of increasing wealth disparity vouching for bitcoin is pretty ironic and just highly stupid.

<comment><USER31> Why is that? Simply because of the current distribution? That doesn't matter much, what matters is what the system incentivizes.

Fiat incentivizes bailouts and devaluing poor people's savings by printing (or QE'ing) money into gigantic financial middle-men.

<comment><USER32> >poor people's savings

I've got some bad news about poverty for you, buddy

</comment></comment></comment><comment><USER33> Anybody knows a good choice for a long-living bitcoin wallet software nowadays (cold-storage)?

Currently I am considering Electrum but I have no idead if thats a smart choice. I do not require a GUI, but it should be maintained for a while (so a large user base should help).

<comment><USER34> The wallet doesn't matter, as long as you have a BIP39-compatible seed (which you can generate with many utilities), any software (or hardware) wallet can be used.

</comment></comment><comment><USER35> This is very similar to what I had to go through to recover a few BTC in my old Multibit wallets from 2013 this summer.

I had the same problem of underpaying for the transaction because I had to sweep many small wallets.

There are many old wallets around which contain amounts too small to recover. Let's say you have 100 addresses each containing $1, it is no longer economical to sweep them into a single address.

Originally in 2011-2013 it was considered a good practice to create many different addresses for receiving.

</comment><comment><USER36> This was a fun read although as others have pointed out, the end conclusions are not supported very well by, and maybe are irrelevant to, the article as a whole.

</comment><comment><USER29> Weird choices all around for how to solve this problem. The author of the post could have saved himself a lot of trouble by just focusing on the key backup files and moving the keys to a bitcoin client like electrum that doesn't require a full blockchain sync.

</comment><comment><USER37> I feel like Engadget could use their screen real-estate a bit more effectively ;)

[https://imgur.com/a/TwXwA](https://imgur.com/a/TwXwA)

<comment><USER38> That's your adblocker blocking the ad but failing to remove the surrounding frame.

<comment><USER37> Interesting that you point that out. In a sense you're right, but actually that's the default tracking protection built into Firefox now. No adblocker required.

I was actually referring — in jest, in case that wasn't clear — to the fact that the only content above the fold on this ultrawide display is a stretched image of Hong Kong.

</comment></comment></comment><comment><USER39> Had a similar issue. when I realised that multibit was legacy I though I lost all. I recover priv. keys modifying the source code of multibit. pain in the ass with hemorrhoids

</comment><comment><USER40> This is a good read. Count me on the same boat, thanks to the shitty Multibit wallet but I am not in a hurry to open the wallet yet. That said:

> Four years ago, I was living in Hong Kong when a fellow journalist named > Mike* and I decided to _invest_ in bitcoin. I bought four while Mike went in > for 40; I spent about $2,000 while he put in $15,000.

Invest? Really? That is called speculation with the amount of money you can afford to lose. If you were investing you would go all in and track the progress and protect the password.

<comment><USER41> What is the problem with Multibit? Just recovered a 2013 wallet a few days ago. Got a password on it or something?

<comment><USER40> It's the issue highlighted in the article.

> Most users only need one wallet, but MultiBit practically demands that you > set up multiple. On top of this, it allows you to add multiple passwords to > each wallet, even though these aren't required.

So it gets confusing fast. Then:

> I tracked down an old version of the now discontinued software and > discovered that there were multiple ways to restore wallets using MultiBit

So you got links for the old version?

<comment><USER41> Mine didn't have a password (only worth a few $) but yeah that sucks

I was able to just save the wallet (as a .dat I believe) and then inspect it with a text editor. The contents were my private key and the date the wallet was created. I then used my private key and my address to import the wallet into a modern program.

</comment></comment></comment></comment><comment><USER42> I'm still confused (starting to fill with regret?) about bitcoin. I remember lively discussions with friends circa 2012. None of us bought. We'd be centi- millionaires?

Is HN now full of mega-millionaires, since the community is full of tech-savvy early adopters?

Raise your hand if you made over a million. Raise both hands if you've made over 10 million.

<comment><USER43> I sold almost all my over 2000 coins back in 2011. No one who has bought big back then has held on all this time, the only new crypto millionaires are those who find old wallets just now.</comment></comment>


Supreme Court appears ready to uphold Trump's travel ban - <AUTHOR> https://www.cnbc.com/2018/04/25/supreme-court-appears-ready-to-uphold-trumps-travel-ban.html?__source=twitter%7Cmain <comment><USER2> I can argue this either way from a constitutionality standpoint, but I think given the court's current makeup it's very likely that this will happen, and that it's probably the "correct" decision for most viewpoints on jurisprudence and interpretation.

Of course, as in the Dred Scott case, the "correct" decision is morally awful, which is one reason I'm not a big fan of our Constitution, but it puts people in the odd position of having to either oppose a core part of the American system or passively accept that the system sometimes gives you results like this.</comment>


How this 14-year-old already has 12 apps in the iOS store - <AUTHOR> http://www.builtinchicago.org/2015/08/25/zach-cmiel-pokobros-apps

<comment><USER2> This is phenominal. I wish I got moving as early as this kid. Watch him for big things.</comment>


The Beef Programming Language - <AUTHOR> https://www.beeflang.org <comment><USER2> [https://news.ycombinator.com/item?id=21991382](https://news.ycombinator.com/item?id=21991382)

<comment><AUTHOR> Wow, that story did so well a week ago, I guess I didn't catch it.

<comment><USER2> Nobody sees everything!</comment></comment></comment>


A VC: Getting a piece of my action - <AUTHOR> http://www.avc.com/a_vc/2008/11/getting-a-piece.html

<comment><USER2> FTA: _The public markets have failed to solve this problem so it's going to get solved in some other way._

The public 'markets' haven't failed to solve this problem so much as the government regulations that surround being public, such as Sarbanes-Oxley, have made it impractical for smaller (< $1B) companies to go or stay public in the US. It's impossible for a company doing $100M in revenues to justify a $5M fixed annual cost for SOX compliance, which doesn't even begin to take into account the compliance costs of other general and industry-specific regulations.

<comment><USER3> I'm trying to imagine what good solutions to this problem would look like. Under the current paradigm, you could have a large public company that served as a holding company taking stakes in a large number of small ventures based on some sort of vote or 'internal market of shareholders'.

Another model that could be brought forth with the current legal framework is for the government to provide a set of validated reporting apis, and accounting models that anyone would be free to use, and which so long as you didn't deviate from them would let you comply easily and cheaply.

</comment></comment><comment><USER4> Few things-

First of, there is a way: if you're confident that a start-up you like will succeed, you can invest in it by joining at a sub-market salary and taking a high equity stake. This way you're investing ( $market_rate - $negotiated_rate ) * 4.

Yet this approach has issues: you can't join multiple start-ups at the same time and of course you're taking a long term and substantial risk. Yet it also provides a filter of "investors": if you can get hired in start-up run by competent people, presumably you're able to judge the likelyhood of a start- up's success.

If we take substantial public investments in start-ups, we'd have people with no domain knowledge and in no financial shape making investments in start-ups that generate the most (or the most targeted) PR. This is very much what happened during the housing bubble (people with no knowledge of real estate buying "investment properties" using borrowed money at prices they couldn't afford to pay).

Bottom line is that investment in a start-up is risky. There are tons of faux- entrepreneurs who'd abuse this method as a chance to flip a quick buck (take an initial investment, float more and more PR about the company and sell their stock for a profit to investors who took are hoping for a quick profit).

There is another issue everyone is talking about: public markets are effectively closed for <$500mm companies. M&A is slowing, especially at prices between $100mm and $1bn -- the types of companies that are too big for Flickr- style exit and too small for an IPO.

Running a profitable mid-size company may be great for the founders (take bonuses/receive dividends after hiring a professional to run the company while you either step-away or step-down to a CTO/VP of Engineering), but what about the employees? The employees in this situation are not likely to see anything for the equity, other than through secondary private equity markets (which are not common in cases other than Facebook and are limited).

This leave employees screwed: either wait for the "next Google", work at a public company (where the equity may be worth something, but the quantity of it isn't substantial and you have little ability to affect the worth of your equity), be employee 1-5/founder of a small "built-to-flip" company (limits you to, essentially, consumer web-start ups) or work for a salary/bonuses.

Here's an idea I'd suggest: allow limited sales of early equity by employees to non-accredited investors who believe that the company will achieve phenomenal growth later on making their equity worth something.

</comment><comment><USER5> well SOX only deals with U.S. public companies. Whats stopping the startups from basing their parent company in some other country and selling the "stock" on the open market? Or if possible, just selling the "stock" on a foreign exchange, does the sox apply then?

i.e. PG LTD, the owner of YC Inc and HN Inc would list 10% of his company for sale on lets call it CEX(Canadian Equity Exchange). He would want to raise $100,000 in exchange for that equity, so he'd list 100,000 shares at $1/share. Then he would put an "invest in us" link on his main site. And U.S. consumers, would be able to go to CEX.com, review the terms, and then buy some equity.

<comment><USER6> Companies list on the TSX and the AIM for this reason, but you don't escape all the US regulations; google for "Regulation S". Among other things, you can't market stock on a foreign exchange to US buyers.

</comment></comment><comment><USER7> So let's say a certified investing company emerges that will take the small investments of people like us and combine them into large rounds of investments. They do this in rounds saying that after 6 months or so, they'll sit down with a company that has had interest shown and work out deals that can be voted on by the people interested in investing.

How would this be fundamentally different from a public stock exchange, except that investments would be much slower than the instantaneous trading we can do now?

</comment><comment><USER8> Often, I've thought that it would be really fun to invest a very small amount of money into a start-up, say $25 to $50.

Even though I wouldn't have any delusions about a real ROI, it would be fun to be part of the "insider's circle", such as a founder's forum or special deals for micro-shareholders.

</comment><comment><USER9> Ah the US regulatory system. The problem was never too much regulation or too little regulation, but rather, completely random regulation written hastily by people who have minimal domain knowledge, and complete unwillingness to change regulations after they have been made.

</comment><comment><USER10> Reposting from a previous thread: <http://news.ycombinator.com/item?id=363509>

Amazing. I have always wondered why micro-financed model isn't the solution for all the financial worries of startups and the VC play.

This is the "change" that would make a lot of things easier, ensure startups keep up their momentum and not waste in VC fund raising process. More you have angels who are truly angels backing founders. (I understand this can hurt lest rational thinking is lost)

Micro financing at angel level (be it 5 friends/colleagues or more) is great. Someone needs to institutionalize this or have some learnings on how to deal with accountability, resolving dispute and the like.

For people in India, Israel, Ukraine and the rest of east Europe the startup costs are quite low. $100K is like close to upper end angel funding.

I know of at least 6-7 ex-Trilogy startups in India - brilliant guys, doing it right, when it comes to funds Indian VCs are most risk averse they wouldn't invest in anything other than jobs, matrimony, real estate and travel. I have always wondered why would it really bother for couple of ex-Trilogy in US to invest. For 2 guys to put something like $50K it would be hardly anything.

</comment><comment><USER11> There are very well founded reasons for the qualified investor rules. Anytime you read someone wanting to relax them make sure they aren't trying to pick your pocket.

</comment><comment><USER12> If you have a spare money and you want to invest in a company check HN everyday for "Review My Startup". Out of the few dozens that launch here every year, I am sure you can find a good investment (with enough due diligence).

<comment><USER13> Maybe there should be a kiva like website where people can specifically make loans and/or buy shares in startup companies.

<comment><USER14> I wish that were possible, it would be a great thing. However, what you are describing is essentially a public offering, and the listed companies would be subject to all of the associated regulation (SOX included).

The loans would be legal however. This kind of sucks - I can loan 5K to a startup, but I can't become a shareholder. There has got to be a way to 'hack' around this.

<comment><AUTHOR> How about a variable loan: one that would return the profits and/or sale of the startup as interest?

</comment></comment></comment></comment><comment><USER15> oh i hate these pricks and their "oh i know you would give your nuts to be in the same room as me, here are some pointers" posts

fuck you douche, i neither want or need your money

who will want money from you is the dipshits who threw a substantial amount of cash into your sorry funds in the first place...right now they are probably wondering if your zero-return, high-risk investment vehicle is worth the paperwork. something tells me you _will_ be returning their calls</comment>


Startmydomain.com domain for sale - <AUTHOR> http://startmydomain.com <comment><USER2> thanks for letting us know.</comment>


How to Write a Spelling Corrector - <AUTHOR> http://www.norvig.com/spell-correct.html

<comment><USER2> This is posted here about every three months.

Norvig's approach assumes a very small fixed vocabulary (so it won't scale well to the basic multilingual plane), and can only recover errors with an edit distance of two or less.

If you are interested in a vastly superior yet still very intuitive approach to spelling correction, I recommend the classic paper on noisy channel model corrector by Kernighan, Church, and Gale, which fuses the probability distribution the distribution over possible errors and the probabilities over words themselves.

[http://www.aclweb.org/anthology/C90-2036.pdf](http://www.aclweb.org/anthology/C90-2036.pdf)

<comment><USER3> I actually think Norvig is making a totally different point than you are. I also think (with respect) that it's a much more important point to learn.

Where your point is that there is a better but almost-as-intuitive approach, Norvig's point is basically that a naive application of probability theory is often dramatically easier to implement, and also "good enough" when compared to a (usually much more complicated) rule-based implementation.

That's really a great lesson to learn. It's (IMHO) much less valuable to learn that there are better approaches out there -- of course there are.

</comment></comment><comment><USER4> Do not write a spell checker like this! I will hunt you down and beat you with a dictionary.

I find spell checking in almost every application that I've tried to be spectacularly bad for anything other than trivial typos. Google is quite good, but it is leveraging data not always available in other applications and is a special case optimized for search applications. Spell correcting for general writing is somewhat different in requirements and optimization vectors.

Spelling errors that can be classified in terms of edit distance, are far better characterized as "typos" not spelling errors. A typo is a transcription error, whereas incorrect spelling is a representation error. Both can be present in a particular ward, but they are different phenomenon.

People make incorrect spelling choices when they _intentionally_ chose the wrong letters to represent phonemes, or to apply spelling rules incorrectly.

A better approach in all respects is to do what's often referred to as a grapheme to phoneme transformation, which is basically to `compile` a word in to a smaller set of characters representing the phonemes of the language. With the reduced set of symbols, that in and of themselves eliminate trivial typos, statistical models can preform better, and faster. Further, unknown words can often be corrected via the corrected spelling of the phoneme.

Why most spelling checkers fail to do grapheme to phoneme transformation when it is easy and both reduces the symbol set for statistical analysis and is demonstrably more accurate (with the possible exception of Indian languages) is beyond me. It's like watching people try to solve dehydration with a "better(TM)" formula for Coke. You're thinking about this problem wrong, just drink some water.

<comment><USER5> I had always assumed that spellcheckers took into account likely mistypes based on keyboard layout when working on spelling correction.

For example, "RRROR" (error) could easily have been me fat fingering the keys, whilst "MRROR" seems far less likely unless I have truly gargantuan fingers or a really really small keyboard. So you might infer I'd missed the "i" instead of mistyped the "e".

Is that ever used as part of statistical analysis?

<comment><USER6> probably if the spell checker owns the keyboard (eg a android keyboard app) and probably not on most desktop ones. and even if it does use that on desktop ones it's probably assuming a layout and missing, giving worse results

<comment><USER7> Why not make the spellchecker keyboard-aware ? Just have it query 'xkb-switch' or 'xkblayout-state print "%s"' or whatever other API is available.

Doesn't any spellchecker use keyboard layout-aware Damerau–Levenshtein distance metrics ? [https://en.wikipedia.org/wiki/Damerau%E2%80%93Levenshtein_di...](https://en.wikipedia.org/wiki/Damerau%E2%80%93Levenshtein_distance) doesn't mention keyboard layout-awareness variants...

<comment><USER8> It's not nearly as simple as it sounds in theory. Consider that you have typos which are from hitting the wrong button - and also typos from hitting the next letter before the previous letter. Also when looking at typos it's likely you'd find statistically significant differences for typos by hitting a letter to the left, or right, or prob. of typoing given the letters general position within a layout etc.

</comment></comment></comment></comment></comment><comment><USER9> This: [http://blog.faroo.com/2012/06/07/improved-edit-distance- base...](http://blog.faroo.com/2012/06/07/improved-edit-distance-based- spelling-correction/)

is an interesting attempt at fast spellchecking, for anyone that's interested.

</comment><comment><USER10> The tech blogger's worst sin: not dating your article. This article starts out,

      In the past week, ...

but then it leaves no clue whatsoever as to when it was written. That mistake is made by almost every blogger out there. We programmers are the worst offenders when it comes to accelerating the pace of technological change. Yet our blog articles leave no hint as to their date, with rare exceptions.

I do surmise it is _VERY_ bad form to post undated blogs to the interwebs, even more so in the realm of software technology.

As always, you are cordially invited to vote me down generously for not wearing pink glasses.

<comment><USER11> > Please don't bait other users by inviting them to downmod you.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER10> Thanks for the link, and the reminder. Sometimes, temptation is just too hard to resist.

</comment></comment></comment><comment><USER12> Working with OCR data and rankings of likely matches ('fuzzy search'), which is closely related.

Yes, a neat demo of the general idea, but really, really naive. As the page states: Edit distances are restricted to 1 or 2 and that thing isn't exactly fast or efficient. Look at it, think about it, don't copy it. :)

</comment><comment><USER13> Can you provide a side by side comparison with Google's spellchecker?

<comment><USER14> this is a very old page, it uses a very basic approach, it's highly computationally expensive to support edit distances beyond 2 (exponentially expensive) so the word length has to be kept small. This makes phraseslikethishardtobreakup.

Today's google spelling uses vastly more sophisticated approaches with gobs of data at it's disposal.

</comment></comment><comment><USER13> Have you or anyone else thought about, or imagined, applications for a spell checker that are not language-based spell checking?

<comment><USER2> Not quite sure if this is what you want, but the noisy channel model (call it "Bayesian" if you must) spell checker I linked to above is inspired by the classic approach to speech recognition (and codebreaking, and machine translation, and natural language parsing).

Norvig's algorithm essentially computes a censored form of Levenshtein distance. Dynamic programming algorithms for computing Levenshtein distance play a major role in gene sequencing, and also pop up in time series form as dynamic time warping.

</comment></comment><comment><USER15> Does anyone else get depressed when they see Norvig programming in Python instead of Lisp?

<comment><USER3> No. He has explicitly said that he does this because he thinks Python makes better pseudocode, and is easier for beginners to understand, as empirically measured by the questions he got from students of his AI books.

I understand your heart was probably in the right place, but honestly, your tone here is kind of hard to take.</comment></comment>


CLI sucks, help me learn it. Parsing Output. - <AUTHOR> http://stackoverflow.com/questions/11495526/how-to-assign-cli-variables-from-cli-output

<comment><USER2> Firstly, read this: <http://www.catb.org/~esr/faqs/smart-questions.html>

Now, I take it you are running one command and need to take a portion of its output and use it in the construction of another command - is that right?

So:

* What is the first command you're running?

* What output do you get?

* From that, what command do you want to construct?

* How much do you know about grep, sed, awk, and bash?

Be clear, precise, specific, and only waffle about generalities after you've solved a single instance.

<comment><AUTHOR> Yes.

Thanks, most of the last two years of using CLI have all been using "single specific scripts", so I'm getting sick of not actually knowing how CLI works and being a confused, brainless C&P robot. Everybody who writes the tutorials and provides me with the scripts seem to know what they are doing, but it is hard to figure it out. Thanks for the link.

In terms of specifics, it is the ones I mention at the bottom of the post, regarding finding EBS blocks with lsblk, passing the names into an MDADM command, and then the rest of the script doesn't need anything more dynamic.

I will look up grep/sed/awk (I'm writing a bash script). From what I know of them so far, they are just regexp, which concerns me, because that feels like a very dangerous "hacky" way of performing very delicate and important tasks. But it seems that everybody is saying that is the only way to handle outputs.

Anything else? Thanks for your help.

<comment><USER2> This is going to look like a rant. In a way it is, but I am honestly trying to help you, not just in this issue, but also in getting help in general. Bear with me.

OK, so it looks to me like you didn't actually answer the questions I asked. In particular, I asked:

      > * What is the first command you're running?
      > * What output do you get?
      > * From that, what command do you want to construct?

I also said:

      > Be clear, precise, specific, ...

You are asking me for help, I have indicated that I'm willing to help you, but you aren't actually answering the questions I ask, and it appears that you're not actually paying attention to what I write. If I'm going to give up some of my time to help you, someone I've never met, then you really, _really_ should make it easy for me.

Instead you've made me go back to the original posting on StackOverflow and try again to understand the exact question, even though I've clearly asked for some clarification.

For example:

      > lsblk -l -list_the_names_of_blocks_not_mounted

I know nothing about the lsblk command, I don't know if these are real parameters or part of the "pseudo code" you've invented to explain your problem, and I certainly don't know what you're expecting it to output. So let me repeat:

      > * What is the first command you're running?
      > * What output do you get?

I assume (and it appears that you've confirmed) that you need to extract some information from the output and use it to construct a new command. That's pretty easy to do and I'll happily talk you through the process. Mostly these processes use standard tools like grep, sed, and awk, but it would appear at the time of writing that all you have of them is a negative impression that "they are just regexp" and as such that "feels like a very dangerous 'hacky' way of performing very delicate and important tasks."

Perhaps you should judge that after you've actually seen them in operation for real. If you still consider them "hacky" then you will have acquired enough information to do it all in Python (or other languages) if you choose.

So, if you'd still like me to help, please re-read this reply carefully, in full, and you'll know how to proceed.

 _Added in edit: I've just read your comment on the one reply you've had over there, and now I really don't know what you're expecting. In the CLI you can take the output of one command and feed it into a pipeline that does stuff to it. What more are you expecting than tools designed to work with a pipeline of text?_

<comment><AUTHOR> Thanks, Colin.

1) MDADM requires specific parameters in order to mount physical drives into a virtual RAID drive. 2) Meaning, piping outputs doesn't work, since the text that is output does not equal the parameters needed. 3) First, the script has to automatically determine which drives should be used. This is done by calling lsblk -l (easier to parse than fdisk) and looking for non-mounted partitions. It outputs:

      NAME MAJ:MIN RM   SIZE RO MOUNTPOINT
      sr0   11:0    1  49.8M  0 /media/VBOXADDITIONS_4.1.18_78361
      sda    8:0    0     8G  0
      sda1   8:1    0   7.5G  0 /
      sda2   8:2    0     1K  0
      sda5   8:5    0   510M  0 [SWAP]

4) MDADM's command parameter is the following:

sudo mdadm --create --verbose /dev/md0 --level=10 --chunk=256 --raid- devices=$RNUM $DRIVES

Where $RNUM is an integer corresponding to the number of drives, and $DRIVES is a space-separated list of the paths to the unmounted drives (which should probably further be filtered on size, since one of them is only 1K but let's ignore its size for now). We also have to remember to prefix '/dev/' since that is where the drives are mounted onto. So explicitly:

DRIVES=/dev/sda /dev/sda2 RNUM=2

Which then makes:

5) sudo mdadm --create --verbose /dev/md0 --level=10 --chunk=256 --raid- devices=2 /dev/sda /dev/sda2

Notes: a) I've been able to accomplish this using node, since in JS I can just do things like string.split(" ") and get an array which I can loop through, or split on newlines, or whatever. But I don't know how this is accomplished in bash scripting.

Thanks for helping out somebody very unintelligent with respect to CLI, despite the last year and a half being fully involved, and trying to google the help out of every issue and tutorials. I hope some day I'll be good enough to help teach people as well.</comment></comment></comment></comment>


Data Is Good, Code Is a Liability - <AUTHOR> http://glinden.blogspot.com/2008/11/data-is-good-code-is-liability.html <comment><USER2> What happens when most of your data has been generated by machine learning algorithms ? Where do you learn from then ?</comment>


Show HN: The First P2P In-Browser Internet Speed Test - <AUTHOR> https://diegorbaquero.github.io/PeerFast/ <comment><USER2> It shows "Test is starting" forever in my case. I am behind a company proxy. Should I create a bug report, or is it unnecessary (unfixable), as your experiment's point is to use WebTorrent?

</comment><comment><USER3> Does this account for differences in upload/download speeds from the peers?

<comment><AUTHOR> May you rephrase the question please? I don't understand it</comment></comment>


Let's Code a TCP/IP Stack: TCP Retransmission - <AUTHOR> http://www.saminiir.com/lets-code-tcp-ip-stack-5-tcp-retransmission/ <comment><USER2> I don't really intend to promote this yet but anyway here's my in-progress TCP/IP stack implementation:

[https://github.com/ambrop72/aprinter/tree/master/aipstack](https://github.com/ambrop72/aprinter/tree/master/aipstack)

It is written in C++14, is platform-independent and works within a single- threaded reactor environment. Microcontrollers are the primary target for example the stack does no dynamic memory allocation at all. I consider the TCP part to be "pretty complete" at this point, it even has PMTUD which lwIP lacks. The TCP code is also quite commented.

<comment><USER3> Can something like this be used on a linux PC? Does the input come from reading in a file handle of raw ethernet input like these tutorials?

<comment><USER2> It is already possible. The current test setup involves my APrinter software (firmware for 3d printers) ported to run on Linux including its web interface. It does indeed use a TAP interface and yes it reads/writes Ethernet frames (the stack does implement Ethernet/ARP).

Linux specific code is here: [https://github.com/ambrop72/aprinter/tree/master/aprinter/ha...](https://github.com/ambrop72/aprinter/tree/master/aprinter/hal/linux)

However note that the LinuxTapEthernet is not directly for my TCP/IP stack but there is a driver abstraction in between, which is also the part that configures/instantiates the stack (aprinter/net/IpStackNetwork.h).

It is possible to try it out if you have the Nix package manager (since the configuration/build system is based on that):

      python -B config_system/generator/generate.py | nix-build - -o ~/aprinter-build
      ./aprinter-build/aprinter.elf -ttap0

That will result in trying to get an IP address using DHCP (yes DHCP client is included). Static IP can be configured using these commands:

      M926 INetworkDhcpEnabled V0
      M926 INetworkIpAddress V192.168.64.10
      M926 INetworkIpNetmask V255.255.255.0
      M926 INetworkIpGateway V192.168.64.1
      M930

The software will run a command line usable via nc on port 23, and also an HTTP server on port 80. To get the HTTP server to actually serve files, an SD card image with FAT filesystem needs to be created and the web interface files put into it (I can explain if anyone wants to try).

What is to be done is a minimal example for integrating the stack and corresponding documentation. For example how to integrate with the reactor, which is abstract from the perspective of the stack but must follow a specific interface. The stack itself only uses timers since other event sources would be used for I/O by e.g. interface drivers. Currently there are two event loops provided, one for Linux based on epoll (aprinter/system/LinuxEventLoop.h) and one that uses busy looping meant for microcontrollers (aprinter/system/BusyEventLoop.h).

</comment></comment></comment><comment><USER4> If you're going to write a TCP stack to see how it works, it's useful to log all packets that don't advance the connection. This includes all rejected packets, plus any duplicates or ACK-only packets that don't advance the connection sequence. Examining the contents of the bit bucket is useful. I did that in the early days of TCP, mostly to debug other implementations that had interoperability trouble.

</comment><comment><USER5> What a great series of posts! Thanks for sharing.

Minor nitpick - I wish the author would link to the previous installments in the series at the bottom of the page :)

<comment><USER6> Thanks! I'll add the links.

</comment></comment><comment><USER7> I love this series - it is what inspired me to have a crack at it in rust ([https://github.com/rthomas/rust_net](https://github.com/rthomas/rust_net)) - however I am only at the stage of responding to arping, and other shiny things have come along to distract me.

</comment><comment><USER8> Very informative indeed. Minor nitpick- one should avoid the use of strcpy() - something that (believe it or not) Microsoft outlawed within any code that they wrote which reduced the number of buffer overflows drastically.

</comment><comment><USER9> I wonder, is TCP generally integrated in ethernet chips, or is it mainly software ?

<comment><USER10> There have been NICs that integrate TCP/IP offload features[1]. I'm not sure how widely used they are anymore. It seems when CPU clock frequencies leveled off, and core count started to increase (~10 years ago), there was less rationale to use dedicated hardware versus consuming more available CPU/core resources to deal with the network protocol processing in software.

1 - [https://en.wikipedia.org/wiki/TCP_offload_engine](https://en.wikipedia.org/wiki/TCP_offload_engine)

<comment><USER11> All Intel NICs do TCP offload, they are quite widely used.

<comment><USER3> Do you have a source for more information? I know Intel NICs are mostly regarded pretty highly.

<comment><USER12> I don't know much about it, but it's briefly described here: [https://www.intel.com/content/www/us/en/support/network- and-...](https://www.intel.com/content/www/us/en/support/network-and- i-o/ethernet-products/000005593.html) (ctrl-f offload)

[https://wiki.linuxfoundation.org/networking/toe](https://wiki.linuxfoundation.org/networking/toe) suggests it's done mostly in closed-source firmware.

</comment></comment></comment></comment></comment><comment><USER13> This is an outstanding way to step through understanding TCP. Thank you Sami!

<comment><USER14> Yes, and in addition, this is a good way to choose projects. We need to "reinvent the wheel"" a lot more rather than just building on top of frameworks that we have inherited from the past. The more work we do at the lower layers of our stacks, the better the quality of our software will be, in terms of its usefulness. There's so many coders around now that there's not enough work at the top of our stacks anymore

</comment></comment><comment><USER15> Problem with rolling your own TCP stack is all the RFCs that compose what we collectively know as TCP.

Congestion control and flow control for instance, there are many RFCs that define them.

<comment><USER16> I like the explanation I've heard that rolling your own TCP stack is a very educational and worthwhile experience. But, what makes TCP so difficult in practice is that there are so many home-rolled stacks out there in the wild that all have different quirks and errors.

So yes, please roll your own. But no, please do not add to the wild zoo of errors by deploying it.

<comment><USER17> That's literally how the original TCP/IP implementations were tested: by running them against each other in "bake-offs":

[https://tools.ietf.org/html/rfc1025](https://tools.ietf.org/html/rfc1025)

I think there's a lot to be said for testing network code against the myriad of real world implementations out there.

<comment><USER6> Very interesting and yes, interoperability is hard.

[https://www.snellman.net/blog/archive/2014-11-11-tcp-is- hard...](https://www.snellman.net/blog/archive/2014-11-11-tcp-is-harder-than- it-looks.html)

</comment></comment></comment></comment><comment><USER18> Very interesting. I suppose you could reimplement the Ethernet part of the layer on an FPGA?

</comment><comment><USER19> For reference, here are links to the first four parts:

[http://www.saminiir.com/lets-code-tcp-ip-stack-1-ethernet- ar...](http://www.saminiir.com/lets-code-tcp-ip-stack-1-ethernet-arp/)

[http://www.saminiir.com/lets-code-tcp-ip- stack-2-ipv4-icmpv4...](http://www.saminiir.com/lets-code-tcp-ip- stack-2-ipv4-icmpv4/)

[http://www.saminiir.com/lets-code-tcp-ip-stack-3-tcp- handsha...](http://www.saminiir.com/lets-code-tcp-ip-stack-3-tcp-handshake/)

[http://www.saminiir.com/lets-code-tcp-ip-stack-4-tcp-data- fl...](http://www.saminiir.com/lets-code-tcp-ip-stack-4-tcp-data-flow-socket- api/)</comment>


Statistical paradoxes for sharping your Bayesian skills - <AUTHOR> https://gfrison.com/2019/statistical-puzzle-bayesian-conditioning <comment><USER2> For those looking for the simple to understand solutions:

Bertrand's box paradox:

The trick here is that you are not actually drawing a card, but a card side. There are 3 cards, but each card has two sides so there are 6 card sides and half of those sides are white.

So, now we have to pick one of the 3 white card sides at random. Of those 3, 2 have white on the other side and one has black. Therefore, if you pick a white side at random, there is a 2/3 chance that it is white on the other side.

Monty Hall Problem:

Say you're going to switch no matter what. Then the only way you can lose is if you pick the right door on your first try - a 1/3 chance. Conversely, as long as you pick either of two wrong doors first you win. Therefore, you have a 2/3 chance of winning if you switch vs a 1/3 chance if you stick with your original pick.

<comment><USER3> > Bertrand's box paradox:

I suspect the problem isn't well stated, at least in the article. If one considers a random choosing a card, repeating until the card has a white side on it, and then putting that card a white side upwards, then probability doesn't seem to me be the one mentioned.</comment></comment>


Non-Unique SSH Host Keys Ed25519 on Hetzner - <AUTHOR> http://wiki.hetzner.de/index.php/Ed25519/en <comment><USER2> This is probably pretty common. When I first deployed virtualization at a previous job ~5 years ago, it took almost two years before I realized all images used the same host keys.

Can someone versed in cryptography comment on whether this allows _passive_ eavesdropping? Active MITM sure, but I thought session keys would be unique.

<comment><USER3> You are right: it allows active impersonation, but not passive eavesdropping.

<comment><USER4> > impersonation

"Impersonification" of the server, you mean (inservication if that's a word). It would allow an attacker to operate a machine under their control that poses as mine.

But then, for password based logins, that will actually be enough to impersonify the user as well (the attacker will create an ssh connection to the real server with the given password). But I wonder how things work with key based logins.

I've ordered a server from Hetzner recently, I guess I'll just ditch it (and perhaps order a new one). BTW I haven't gotten any email notification from Hetzner about this yet.

<comment><USER5> No need to junk your server, just regenerate the affected key. Instructions are on their wiki here: [http://wiki.hetzner.de/index.php/Ed25519](http://wiki.hetzner.de/index.php/Ed25519)

<comment><USER4> My point was that the issue didn't just allow a MITM to capture traffic, but also take over the machine(?). So cancelling the server and installing a new one will be the safer bet (I'm considering moving to a different company at the same time, as the IP _block_ my old server is in seems to be the reason I can't deliver mail to Google, Hotmail and Yahoo (my own IP is all green in blacklists, but my neighbours' IPs aren't)). YMMV.

<comment><USER5> I suppose it depends on your paranoia level and whether or not you were using keybased auth or passwords. If you were using keybased auth then simply regenerating the host key should be enough.

Re: mail issues. We had the same problem (our IP was green but the block it was in was tainted). We solved the delivery issues by going through the various processes on: [https://mail.live.com/mail/postmaster.aspx](https://mail.live.com/mail/postmaster.aspx) [http://postmaster.google.com](http://postmaster.google.com) and [https://postmaster.aol.com/](https://postmaster.aol.com/) [ in addition to following all the usual best practices - SPF, DMARC etc. ]

<comment><USER4> Thanks for the info about your mail. I'm using SPF and DKIM too, I don't see how DMARC would help deliverability so I haven't tried that yet. I've verified my domains (including the reverse name(s) of my server's IPs) with postmaster.google.com to no avail (and I'm not sending enough mail to get the actual tools enabled). Interesting that you think you could solve it that way, perhaps you're sending more mail, or perhaps M$/Google/AOL are interchanging info and it only helps when going through all of their tools, or perhaps you've sent enough mail that what actually helped was people marking mail as ham, or perhaps you're in a block that's tainted less. My strategy remains to try another IP block. I might also try disabling IPv6 (although IIRC it delivers to Google over IPv4?).

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> At least they are aware of the issue and warning their customers.

A lot of companies would just fix the issue (or not even that) and try to silently sweep it under the rug.

<comment><USER7> Their business is being a trustworthy, high quality service.

Sweeping it under the rug would destroy their business. (Not that competitors wouldn't have done it anyway)

<comment><USER8> > Their business is being a trustworthy, high quality service.

Really. Here I thought their business is renting out servers made from desktop parts for insanely low amounts of money. I have no problems with this strategy, I enjoy my 42EUR a month 2x3TB HDD + 2x120GB SSD, 16GB i7 2600 server, thanks much. It runs hobby sites and such. I know what I bought and what I can expect.

<comment><USER9> They also offer reasonably priced server-class dedicated servers with Xeon processors, ECC memory and datacenter-series SSDs.

<comment><USER10> "reasonably priced". You never needed a private network with 3 nodes.

<comment><USER5> €12,61/month extra per server and a one off ~€25 for the switch is hardly extortionate given what they charge for servers...

<comment><USER10> no. you've forgotten something. you need to pay at least the flexi pack for ever server, too. So your math is Switch + 12.95/month (per server) + 15 /month (per server) and now you outpriced nearly every cloud.

<comment><USER5> The €12,61 I mentioned is the Flexi-Pack charge (just without VAT). There are no other costs apart from a one off charge of ~€25 to install a switch.

<comment><USER10> with the flexi pack you need to pay an additional cost of the second network card you need.

<comment><USER5> Ah ok. I've only ever rented servers from them that already had a second NIC present (so I just needed to pay the flexi-pack charge to activate it). Didn't realise they also sold servers with single NICs.

<comment><USER10> Most of them are. Only if you use the "bigger" ones which aren't cheaper than the cloud providers anyway so. If you care for pricing it's cheaper to either have a colocation or a cloud or a own datacenter. renting servers is mostly not cheap if you need more than a single server.

I mean most people's need definitely suites inside the cloud since they don't need to have the full capacity 24 hours. There are some other people who need the full capacity every time, but if you run a globally distributed services you mostly run into other problems than datacenter costs.

<comment><USER5> In my case, I have three servers (each with ECC 32GB, Xenon quad core, 2x3TB disks and unlimited bandwidth), a 5 port internal switch, two public IPv4 addresses per server, a public failover IP, 300GB of network backup space and two additional rack slots reserved in the same rack for future expansion.

The total monthly cost for this (exc. VAT) is €180. I haven't been able to find any co-location or cloud providers that can come anywhere close to that price for a similar resource setup.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> If anyone works for a hosting provider, please write a script that checks all of your customers' SSH ports for identical fingerprints. If you have any collisions, you have a problem.

<comment><USER12> Except that performing network scans, even on your own network, is illegal in many countries.

Even in countries where this is legal, providers cannot take the risk of running a scan that could possibly crash a customer application, or they could be sued for that.

<comment><USER13> Which countries and under which laws?

Which T&Cs do not have a blanket clause to indemnify the hosting company in such situations? If I accidentally reboot the virtualisation host, can my company be sued for making the application "crash"?

<comment><USER14> There's multiple examples of legal issues mentioned on [https://nmap.org/book/legal-issues.html](https://nmap.org/book/legal- issues.html)

</comment></comment></comment></comment><comment><USER15> Affected customers have received an email about the issue. I got mine about 2 hours ago.

It would be great not to publish an article like that until some time later, so that everyone gets a chance to fix the problem on their machines before it goes fully public - especially since it's the holiday season and some people don't check email or news that often.

<comment><USER16> The problem is that as soon as you send the email, someone will leak it, setting the usual internet machine of FUD, "this must be a fake" etc at work.

</comment></comment><comment><USER17> Use virt-sysprep to prepare your templates. [http://libguestfs.org/virt- sysprep.1.html](http://libguestfs.org/virt-sysprep.1.html)

</comment><comment><USER18> Some additional details and their mail to customers here: [http://blogs.intevation.de/thomas/hetzner-duplicate- ed25519-...](http://blogs.intevation.de/thomas/hetzner-duplicate-ed25519-ssh- host-keys/) "I must say, I'm impressed. Especially at this time of the year I would have expected a slower reaction or a less detailed announcement."

</comment><comment><USER19> Yet another reason not to use images provided by your hosting company.

In anycase, if you are relying on hosting company images (complete with their root backdoor for "performance monitoring control panel!"), it's not like you care very much about your servers' security in the first place...

<comment><USER20> If you really believe your hosting provider puts root backdoors in your systems, you really shouldn't run anything in a hypervisor controlled by them.

<comment><USER21> [http://help.ovh.com/InstallOVHkey](http://help.ovh.com/InstallOVHkey)

> In order to be able to intervene on your dedicated server without your root > password, the automatic installation of ssh key is done. Only authorized > employees of OVH will use it. It is not a gap in security, contrary, thanks > to this OVH has root rights to your server and may identify the problems > with your server. When you request an intervention, we need to have access > to ssh.

<comment><USER22> This is an opt-in process, not an opt-out. They don't have authorized keys on your server by default, only instructions to add them if needed.

<comment><USER23> Unless it has changed recently, it's opt-out. The instructions are mostly for re-adding the key if you have removed it.

</comment></comment></comment></comment></comment><comment><USER24> May be helpful for others:

[https://github.com/hannob/ed25519hetzner](https://github.com/hannob/ed25519hetzner)

(script to check host key and known_hosts file for vulnerable hetzner keys)

</comment><comment><USER25> This is very widespread.

I reported a similar issue on Chunkhost ([https://chunkhost.com/](https://chunkhost.com/)) back in 2011... They never responded to my email about remediation, but hopefully the issue was fixed.

</comment><comment><USER26> I do hope this page is not the only source for the announcement, since it's a wiki page on a non-HTTPS MediaWiki instance that runs an abysmally old and unsupported (= unsafe) version of the software.

</comment><comment><USER27> Wasn't there a cloud hosting provider that didn't even bother cleaning out the SSH known_hosts file?</comment>


Show HN: NodeGear – Node.js hosting on Docker - <AUTHOR> https://nodegear.com/

<comment><AUTHOR> Hello, I want to introduce NodeGear.

NodeGear is a node.js hosting company. We host node.js applications and provide a simple control panel. Our goal is to simplify node.js hosting as much as possible.

\- Stream logs straight to the control panel \- Add new processes to load balance your app (across datacentres) \- Add environment variables, domains, subdomains (on _.ngapp.io) \- Stream process statistics straight to your control panel \- SPDY support and free SSL on_.ngapp.io \- Get and set up mongodb and mysql databases. \- The control panel is blazing fast, built with angular.js and socket.io \- Monitoring emails. If your app goes down, you'll know it.

In addition, deploy a custom ghost.js blog with a single click. (It only needs a name).

Sign up (its free and obligation-free) on [https://nodegear.com](https://nodegear.com) (and [https://nodegear.io](https://nodegear.io)).

That being said, i should mention its a Beta and that things may break. If you're interested in joining our venture, let me know! The platform is entirely built on node.js. It utilises redis, mongodb, websockets and angular.js.

<comment><USER2> You use Docker, you say? Looks pretty neat!

<comment><AUTHOR> Rudi, we're aiming to keep it simple but still enable advanced usage like linking Docker containers.

<comment><USER3> This is cool! I was hacking on a project for hosted Docker containers (think, for devs to create a stack and quickly be able to use it to develop or push to prod) let me know if you'd like to talk!

</comment></comment></comment></comment><comment><USER4> I'm getting JS console errors with /register/verify

        Uncaught Error: Mismatched anonymous define() module: function (){return a(window)}
        http://requirejs.org/docs/errors.html#mismatch require.js:141
        Failed to load resource: the server responded with a status of 403 (Forbidden) https://nodegear.io/profile/profile
        ReferenceError: Bugsnag is not defined
            at https://nodegear.io/0.12.0/js/controllers/auth_verify.js:27:10
            at https://nodegear.io/0.12.0/vendor/angular/angular.min.js:72:132
            at x (https://nodegear.io/0.12.0/vendor/angular/angular.min.js:100:150)
            at x (https://nodegear.io/0.12.0/vendor/angular/angular.min.js:100:150)
            at x (https://nodegear.io/0.12.0/vendor/angular/angular.min.js:100:150)
            at https://nodegear.io/0.12.0/vendor/angular/angular.min.js:101:414
            at k.$eval (https://nodegear.io/0.12.0/vendor/angular/angular.min.js:112:15)
            at k.$digest (https://nodegear.io/0.12.0/vendor/angular/angular.min.js:109:96)
            at k.$apply (https://nodegear.io/0.12.0/vendor/angular/angular.min.js:112:345)
            at h (https://nodegear.io/0.12.0/vendor/angular/angular.min.js:72:300)
        Failed to load resource: the server responded with a status of 403 (Forbidden) https://nodegear.io/auth/verifyEmail

<comment><USER5> Hi Lewis, our database shows that your email address has been confirmed..

Sorry about the issue, our team is working on the resolution.

Thanks!

<comment><USER4> Yes, I got it to work after logging in.

</comment></comment></comment><comment><USER6> That thing where you tell them your e-mail address and set a password and then it says "We're currently running a beta program. You have been put onto a waiting list. We will let you know shortly!" feels an awful lot like a scam.

<comment><AUTHOR> Thanks for the feedback Kent. Interesting observation. We are running a Beta and there is a wait-list in the sense that we check email addresses for those that have applied. Do you have an example of a company that is handling this in a way you like? Or some wording that you recommend we use instead?

</comment></comment><comment><USER7> It looks like the two-factor authentication email template is incomplete:

\</comment><comment>-

Two Factor Authentication Added

Your account is protected by a second form of authentication. TFA tokens can be added to Authy or Google Authenticator app.

You will be asked for a token when logging in, [something], [something else too].

<comment><AUTHOR> Thanks James, Appreciate the feedback. As Matej says we're looking to keep it simple but powerful. Lots of useful feedback like yours today to help us improve the product. ~S

</comment></comment><comment><USER8> Congrats on the launch! I just signed up and it tells me that this in invitation only :(

Also, according to the pricing - [https://nodegear.com/pricing.html](https://nodegear.com/pricing.html), the development version for testing out small apps is not free?

<comment><USER5> Hi, thanks for your feedback. We'll consider this option. In the meantime, please don't hesitate to use the system as one app is given for free.

Thanks!

<comment><USER9> I didn't see that mentioned on the pricing page.

<comment><AUTHOR> Thanks Jonny, we're sorting out the pricing so that it's clearer. Right now first app is free. As we're in Beta you can get some more by adding your cc details though would not be charged until you decide to manually top up.

</comment></comment></comment></comment><comment><USER5> Hi guys share feedback here: [https://docs.google.com/a/castawaylabs.com/forms/d/1beXJdTXB...](https://docs.google.com/a/castawaylabs.com/forms/d/1beXJdTXBDAEhghlL7thTpn9xLj4pu6sXeeUFRIXvLyw/viewform?usp=send_form)

<comment><USER10> Hey, just a heads up: That link is set to private. I get a message saying 'You need permission This form can only be viewed by users in the owner's organisation.'

<comment><USER5> Hi Andy, its public now. Sorry!

<comment><USER10> Awesome :) Nice product!

<comment><AUTHOR> Thanks Andy. Glad you like it. Let us know what we can do to make it valuable for you.

</comment></comment></comment></comment></comment><comment><USER11> Im getting a 403 forbidden on the Verify URL: [https://nodegear.io/auth/verifyEmail](https://nodegear.io/auth/verifyEmail)

<comment><USER5> Hi, thats a bug :P. Send us an email email@example.com and we'll do it manually.

</comment></comment><comment><USER12> Looks neat and simple! Makes me want to do Node again! :-)

Seems really affordable too! Is NodeGear profitable (already)? Will it be at the current price point?

<comment><USER5> Hi, good question!

We're deciding which IaaS to use, and are currently running on top of Google Compute.

That being said, nodegear isn't currently profitable.

Its possible the price might change, but we'll let everyone know (in a newsletter/blog).

</comment></comment><comment><USER13> 160TB/month data for $5 USD is pretty cheap bandwidth. (Unlimited 500 mbs per process for production applications).

<comment><AUTHOR> Thanks - we're figuring out our pricing model. At least have to make enough money to keep it improving!

</comment></comment><comment><USER14> Looks interesting, trying it out now! First (tiny) bump in the road: the "Get Started!" link on the Pricing page doesn't work.

<comment><AUTHOR> Thanks for the bug report Jonalmeida. We'll get that fixed. The signup page is here if you've not already found it: [https://nodegear.io/register](https://nodegear.io/register)

</comment></comment><comment><USER15> What does "Docker-ready" mean?

<comment><USER5> Hi Justin,

It means our infrastructure runs on docker, and all apps launched run on docker. We don't support custom images, but thats in the works! Stay tuned

</comment></comment><comment><USER16> Any plans for meteor.js support?

<comment><AUTHOR> Thanks Schnie.

You can run any kind of node.js application.. Make sure your app can be started via "npm start" and its good to go :).

For custom apps, they should be hosted on a git repository, private or public. Shout if you need some help!</comment></comment>


Effect of Low-Fat vs. Low-Carb Diet on 12-Month Weight Loss in Overweight Adults - <AUTHOR> https://jamanetwork.com/journals/jama/article-abstract/2673150 <comment><USER2> Fulltext: [https://www.dropbox.com/s/cbpt3bw8ql310kr/2018-gardner.pdf?d...](https://www.dropbox.com/s/cbpt3bw8ql310kr/2018-gardner.pdf?dl=0)

Worth noting that the genetics here was just 3 SNPs based on a 2010 candidate- gene study of apparently n=133 (it was never published, it's just a conference talk, based on the citation & description of the work in [https://www.wsj.com/articles/SB10001424052748703862704575099...](https://www.wsj.com/articles/SB10001424052748703862704575099742545274032) ), which made the absolutely crazy claim that "those with a genetic predisposition to benefit from a low-carbohydrate diet lost 2 1/2 times as much weight as those on the same diet without the predisposition". So unfortunately, their total failure is exactly what you would predict from a non-GWAS-derived set of SNPs and the result is meaningless. This tells you nothing about whether SNPs can predict or cause more/less weight loss, be used to optimize diet choice, or have any cross-racial differences, despite people apparently interpreting it that way.

<comment><USER3> The key thing for these diets is the ratios of Carb/Fat/Protien :

 _In the HLF vs HLC diets, respectively, the mean 12-month macronutrient distributions were 48% vs 30% for carbohydrates, 29% vs 45% for fat, and 21% vs 23% for protein._

Both of those diets seem fairly balanced. A typical ketogenic diet (high-fat, low-carb) is usually < 10% calories from carbohydrates, 20-30% from protein (depending on exercise) and 60-75% fat calories. It seems unlikely any of the HLC participants would have gotten into ketosis, so I don't see this study as being relevant to the current debate over the efficacy of ketogenic diets.

</comment></comment><comment><USER4> Low-Carb proponents don't necessarily disagree that 'a calorie is a calorie' in the physics sense. We just feel there's no need to be hungry when you can eat to satiation and still lose weight, and that unnecessarily high glucose in the bloodstream is not good for you anyway.

<comment><USER5> Complex carbs like potatoes are some of the most satiating and nutritious foods you can eat:

[https://scottabelfitness.com/potato-and-the-satiety- index/](https://scottabelfitness.com/potato-and-the-satiety-index/)

High fat diets can also be satiating but there are a lot of downsides to eating saturated fats, which make up most of the fats in the typical keto/paleo high fat diet.

[https://nutritionfacts.org/video/the-saturated-fat- studies-s...](https://nutritionfacts.org/video/the-saturated-fat-studies-set- up-to-fail/)

<comment><USER4> I guess it depends on how a potato is prepared. The guy in the link eats baked potatoes which I suppose would be pretty filling. Personally I've found most 'filling' foods I eat when (trying to get back to) low-carbing are: cauliflower, eggs, paneer (a type of Desi cheese), coconut, and beans/legumes.

<comment><USER5> Boiling potatoes provides the best glycemic profile. Letting them cool before you eat them increases the amount of resistant starch further:

[https://yurielkaim.com/resistant-starch/](https://yurielkaim.com/resistant- starch/)

Legumes are a very healthy food on a lot of counts.

</comment></comment></comment></comment><comment><USER6> Missing from the title is the qualifier "healthy", as in "healthy low-fat" diet vs "healthy low-carb" diet. What does "healthy" mean, here? It's not defined in the abstract.

<comment> fredrik-j The closest I got to definition of "healthy low X" was a general description of the approach in the paper:

"Briefly, the main goals were to achieve maximal differentiation in intake of fats and carbohydrates between the 2 diet groups while otherwise maintaining equal treatment intensity and an emphasis on high-quality foods and beverages.

Thus, participants were instructed to reduce intake of total fat or digestible carbohydrates to 20 g/d during the first 8 weeks. Higher priorities for reduction were given to specific foods and food groups that derived their energy content pri- marily from fats or carbohydrates. For example, the reduction of edible oils, fatty meats, whole-fat dairy, and nuts was prioritized for the healthy low-fat group, whereas the reduction of cereals, grains, rice, starchy vegetables, and legumes was prioritized for the healthy low-carbohydrate group.

Then individuals slowly added fats or carbohydrates back to their diets in increments of 5 to 15 g/d per week until they reached the lowest level of intake they believed could be maintained indefinitely. No explicit instructions for energy (kilocalories) restriction were given. Both diet groups were instructed to (1) maximize vegetable intake; (2) minimize intake of added sugars, refined flours, and trans fats; and (3) focus on whole foods that were minimally processed, nutrient dense, and prepared at home whenever possible."

I find the last sentence interesting, reminds me of Michael Pollan's quip: "Eat food. Not too much. Mostly plants."

</comment></comment><comment><USER7> Conclusions: In this 12-month weight loss diet study, there was no significant difference in weight change between a healthy low-fat diet vs a healthy low- carbohydrate diet, and neither genotype pattern nor baseline insulin secretion was associated with the dietary effects on weight loss. In the context of these 2 common weight loss diet approaches, neither of the 2 hypothesized predisposing factors was helpful in identifying which diet was better for whom.

</comment><comment><USER8> I wonder which of the two is easier to keep. Feeling hungry most of the time is little joy and leads to relapses.

<comment><USER9> Oh but. . . "weak willpower", and "immorality", and "fat people deserve their misery and shame". . . we really need to maintain our comfortable mindset.

</comment></comment><comment><USER10> I'm not sharing this because it doesn't confirm my self-tested and proven beliefs. #NoCarbsForLife

</comment><comment><USER11> 29% cal from fat isn't really low fat. It would be interesting to see a study on lower fat diets.

<comment><USER12> Also, 30% of calories from carbs (on the so-called low-carb diet) is not really low-carb. As mentioned in another comment, for a 2,000 calorie diet, that's 600 calories from carbs! Most low-carb diets aim way lower than that because they aim at reaching a state of ketosis, where your body is essentially burning fat instead of sugar for energy. This might be something like 20-50 grams per day, depending on a lot of factors like specific carbs consumed, etc. This is the stage where a lot of the health benefits including increased energy, no afternoon crash, weight loss, etc. come in.

I realized recently that I was getting fat (4 inches of waist size increase in just a couple years), so for the past couple months, I've tried restricting my calories. At first, I tried cutting out things that are just ridiculous like beer and bread. In the past week or so, I've gotten more 'restrictive' and have been trying to eat almost exclusively meat. I'm not counting calories or anything like that, I just eat until I'm full and then I stop. I have lost 20 lbs in the past two months, and I feel much better overall. I have way more energy than I did before and I fart a lot less.

I can understand if it sounds extreme, but look at the standard American diet. Since the food pyramid was introduced, with a base of grains, people have gotten nothing but fatter, more diabetic, more heart attacks and stokes, etc. While there are essential fats and proteins, there are NO essential carbohydrates. I'm not sure if I'm going to stay on this diet forever, but it doesn't seem like the mainstream diet is very healthy, so I'm going to listen to what my body tells me and use reason to try to get out of this mess.

<comment><USER11> I've done both keto and whole-foods-plant-based diets.

Both lose weight - but I feel a lot more energy on a starch based diet. Whole plant foods contain the right amount of fat (10%). Who cares about farts when I never get constipated. With a little exercise and a starch based diet I was able to lose 80lbs. When I started introducing fats and added refined sugars - the weight came back. The fat you eat is the fat you wear.

Long term ketosis is not optimal health.

[https://www.ncbi.nlm.nih.gov/pubmed/22850317](https://www.ncbi.nlm.nih.gov/pubmed/22850317)

[https://www.ncbi.nlm.nih.gov/pubmed/11108325](https://www.ncbi.nlm.nih.gov/pubmed/11108325)

Look at cheese consumption and it tracks national weight gain. We're taking in way more fat today than long ago.

[http://www.pcrm.org/images/media/blog/cheese_consumption.jpg](http://www.pcrm.org/images/media/blog/cheese_consumption.jpg)

But we're taking more calories overall - so people get to blame whatever they want.

Starches powered all civilizations up to the 20th century. Only when we started consuming lots of meat and purified sugars and white flour did we really gain weight.

</comment></comment></comment><comment><USER13> I'm guessing they used a random sample to study the diets hopefully and also this would generally mean I believe that any general diet low in fat or carbs can lose weight because they listed that participants still lost 5 to 6 kg no matter the diet?

</comment><comment><USER14> Ketosis can apparently lead to more weight loss because ketones are less efficient vehicles of energy in general. Additionally, unused ketones can be eliminated through sweat, urine, and breath.

<comment><USER15> Apparent to what evidence?

<comment><USER16> The Krebs Cycle I am guessing.

</comment></comment></comment><comment><USER17> >>In the HLF vs HLC diets, respectively, the mean 12-month macronutrient distributions were 48% vs 30% for carbohydrates, 29% vs 45% for fat, and 21% vs 23% for protein.

30% carbs is hardly "low-carb".

Indeed, most low-carb diets suggest 50g or less carbs per day - 200 calories or less.

[https://www.dietdoctor.com/how-low-carb-is-low- carb](https://www.dietdoctor.com/how-low-carb-is-low-carb)

edit: why am I being downvoted?

<comment><USER18> 30% of a 2000-calorie diet is going to be 150g of carbohydrates per day. Not very low carb at all.

<comment><USER19> > 30% of a 2000-calorie diet is going to be 150g of carbohydrates per day.

600g

<comment><USER20> There are 4 calories per gram of carbohydrate.

</comment></comment></comment></comment><comment><USER21> Unsurprising results- calories intake & expenditure defines weight loss/gain, not other nutrition information like fat, carbs, vitamins, etc.

<comment><USER22> calorie intake and expenditure is a _description_ not a _prescription_. this is about as useful as saying "make more money than you spend" in order to become wealthy. sure, that's true, but it won't help you make $10 million. how do you eliminate the desire to waste time and money on useless pursuits? _that_ is the analogy we need to use to reframe this discussion. yes, there is a certain level of maturity and self-control involved, but you need to know what _NOT_ to do first.

what is causing people the intense desire to overeat, and the intense lethargy that follows? probably insulin-spiking processed carbs and sugar. have you seen anyone in the throes of a carb addiction/crash cycle? it's damn near supernatural the amount of power these foods have over people.

at this point i consider them about the same level as cigarettes or alcohol. cheap, widely availabe, intensely addictive, and people who don't have a problem just telling you to "use less", "it's so easy". okay. sure.

"how do i graduate college?" "take more credits than it requires to graduate."

try telling this to the person who got sucked into the for-profit university and is $50k in debt.

the world is not as cut and dry as it seems, especially if you are burdened with a low IQ like the people who most easily fall for these schemes.

<comment><USER23> Good points, but there is something else going on.

If you travel alot you start to see that every culture is heavy on carbs: Rice, pasta, potatoes, noodles, bread. They are ubiquitous.

Find a frenchmen that isn't eating bread from first meal to last...or an asian with rice / noodles. Or an Italian with pasta / bread, etc.

There is something else wrong here. I don't pretend to know what it is, but it seems like its almost a "food culture" problem. The most immediate things you notice are: (a) Americans portion size is double the rest of the world, and (b) Americans eat very very fast.

<comment><USER5> Exactly. The idea that carbohydrates, which have been the staple of most human diets for millennia, are somehow suddenly toxic makes no sense. Complex carbohydrates are fine. What's gone wrong in the US is that we are eating more processed carbohydrates along with way more chicken and cheese and our portion sizes and overall calorie intake have gone up significantly:

[http://geeksta.net/visualizations/calories- us/](http://geeksta.net/visualizations/calories-us/)

Excess consumption leads to obesity, which correlates strongly with just about every major chronic illness. Portion sizes are a big part of the problem. Every time I come back to the US after living in Asia I'm shocked at how ridiculously large restaurant serving sizes are.</comment></comment></comment></comment>


Teens Find Innovative Ways to Control Their Facebook Presence - <AUTHOR> http://www.allfacebook.com/teens-find-innovative-ways-to-control-their-facebook-presence-2010-11

<comment><USER2> What came to my mind when I read this was the concept of pre vs post moderation. I find myself viewing posts to my wall in a very timely fashion, almost immediately after I receive an email from facebook letting me know that I have a new post on my wall from a friend. The purpose of doing so is more so I can moderate what the individual has posted on my wall and much less because I am so interested in the immediate consumption of that post. I would love an option on facebook to place many public actions in a pre-moderation queue...tagging me in a photo, posts on my wall to name two. In the absence of those tools, the idea of always deactivating on logout seems like an inconvenient but possible alternative to close that time gap.

<comment><USER3> You know that giddy feeling you get when you think you've struck it gold with a genius idea only for that excitement to settle after you've given it a bit more thought? Yeah, well, it's that same feeling people get when they tag all their friends in a bunch of photos, or post something inappropriately on someone's wall; and once it is up in the public's eye, they feel it'd look cowardly of them to retract whatever statement they might've made. So with a feature like that, you're essentially stalling the entire posting process and increasing the chance of people engaging their filters to assess whether a specific post would be appropriate for their world to see. If I know that the pictures I just uploaded won't all be up for everyone to see instantaneously, and that so-and-so will have a chance to filter through the pictures before they're posted, I'd likely not be as excited about posting stuff and I'd actually start posting less. You're basically putting a kink in the hose.

If you've noticed, after all the privacy features Facebook has implemented, not one of them involves moderating the brain -> screen process. I may be reading too much into this all, but I do have a feeling that Facebook understands social dynamics and pressures extremely well and places its users in positions where they will almost always choose the decision to benefit Facebook. For instance, you want to be 'friends' with both acquaintances and friends, and so both groups have the ability to post on your wall. You could block those who you feel may say inappropriate things, but that is a burden and they'll likely find out. So what's your next option? Not allowing anyone to post on your wall. But then you'll seem cold and unsocial. So you'll likely choose to keep your wall open for posts.

People tend to hate on Facebook, but I think they are psychological masterminds.

</comment></comment><comment><USER4> I'm just speculating, but if everyone in your close circle of friends does this, then FB might start feeling like IM on steroids. You can only see people who are online. When they're offline, all traces of them vanish.

<comment><USER5> There's no reason someone couldn't create an IM client for this. All profile data could be stored on your local client.

<comment><USER6> That's sort of what Opera Unite is like, without the UI or killer apps or any users.

</comment></comment></comment><comment><USER7> Wish people would link to original sources more often. Come on this is HN, we don't need or want the extra layer of gloss for this.

[http://www.zephoria.org/thoughts/archives/2010/11/08/risk- re...](http://www.zephoria.org/thoughts/archives/2010/11/08/risk-reduction- strategies-on-facebook.html)

</comment><comment><USER8> I use a different way to keep people away from my wall, that is as effective, but less work.

I have a whitelist (a list of friends) that sets who has access to my wall. So, when I accept friendship from someone, this new connection does not have access to my wall and private photos straight away. I must put him explicitly to the whitelist.

I fing lists a very good tool to set who sees my wall, pictures and info, and even to set who sees what on my wall (more personal posts are just visible to a subset of the whitelist).

<comment><USER9> How do you deal with allowing others to post on your wall? This is either on or off for all friends right?

<comment><USER10> He said

> I have a whitelist (a list of friends) that sets who has access to my wall.

<comment><USER9> I know what he said so let me clarify. Facebook's wall permissions break down into three groups of differing granularity:

1) Who can see a given post by you on your own wall: Each post can have different permissions w/ groups.

2) Who can see a given post _by others_ on your own wall: All posts of this type are controlled by a single permission assignment with groups.

3) Are friends allowed to post on your wall: This is an all or nothing setting. In other words you can either let all friends post to your wall regardless of visibility or none.

My question was, what happens when you allow friends to post on your wall (item 3) but not give them permissions to view posts? This would be a somewhat awkward situation, hence my question.

<comment><USER10> Gotcha. I let everyone see everything all the time, so I wasn't familiar with that problem. I'd just assumed you'd misread him. My bad.

</comment></comment></comment></comment></comment><comment><USER11> Maybe I'm missing something, but this seems really pointless. What would be wrong with friends browsing your content when your not around? As if you knew they were accessing your profile and what-not anyways. The only way I could see this as being useful would be to keep friends from posting inappropriate material - but then setting filters/blocking would be more sensible.

<comment><USER12> Some people simply cannot be dissuaded from occasionally posting inappropriate content. If they do it all the time, you might want to de-friend them. But it might be only occasional, and de-friending may have other real-life consequences (if only to your social life).

What kind of inappropriate content? The canonical example, I think, is for someone to tag you in a photo where you are doing something against the rules or otherwise inappropriate. It doesn't even have to be illegal; I've read a number of stories (and heard some personally) of elementary and high school teachers getting in trouble for simply being in a photograph where alcohol was also present. Even if they're over 21 and so is everyone else in the photo. I think it's horrifying that school principals and school districts are able to have that kind of policy, but some of them do.

</comment></comment><comment><USER13> Am I not using Facebook like everyone else is? I've never had anyone post anything inappropriate on my wall, or tag me in a photo I'd rather not be tagged in. If it ever happens, I'm removing that person as a Facebook friend. Not sure why it needs to be more complicated than that.

<comment><USER14> You're not 14 years old. As adults, we use facebook much differently than people with no/little self control.

If I was 14 again, I would probably superdelete as well. Nothing would stay on for more than 2 days. This is not for friends, but in case parents were watching over my shoulder.

I'd also probably have a private board with psuedononymous names for all of my friends so we could say what we really thought.

</comment></comment><comment><USER15> Although whitewalling will prevent users of FB from accessing your data, FB will probably retain it, as we have seen them do with pictures: [http://arstechnica.com/web/news/2009/07/are-those-photos- rea...](http://arstechnica.com/web/news/2009/07/are-those-photos-really- deleted-from-facebook-think-twice.ars)

<comment><USER16> That was the point of the article - she doesn't delete her account, she reactivates, which means all her data comes back, wall, photos etc..

<comment><USER17> You two are talking about two different things. "Whitewalling" is deleting all content from your wall so it's blank (hence the name). "Super-logoff" is when you deactivate your account when you logoff.

</comment></comment></comment><comment><USER18> Someone needs to write a chrome extension to make whitewalling and super- logoff more convenient. If users are able to forgo the annoying questionnaire that is coupled with deactivation and batch delete posts after an expiration date, these techniques become a whole lot more attractive.

</comment><comment><USER19> The downside is that no one can add you while your account is deactivated. Maybe that's an upside?

</comment><comment><USER20> I think you can set it to allow "Only Me" to tag yourself in photos. At least, I recall doing that a while back. (Knowing FB, it wouldn't surprise me if it's been changed or broken since then...)

</comment><comment><USER21> Am curious; what if Facebook comes up with a limit on the number of times "activation+deactivation" can be done during a time period?</comment>


US throws away 3,500 donated kidneys every year with 93,000 on the wait list - <AUTHOR> https://www.cnn.com/2019/08/26/health/thousands-of-kidneys-thrown-away/index.html <comment><USER2> This CNN title is rather unhelpful. Some answers I found in the article:

\- 3500 is 20%

> There are several other reasons a kidney would be discarded. It could be in > bad shape, there could be an abnormal biopsy on the organ, or some other > physical issues. But there are also financial and regulatory reasons that > they get discarded. An older kidney or one with comorbidities costs more to > transplant, because a patient is hospitalized longer and it takes a patient > longer to recover.

> the overly stringent and restrictive process of monitoring transplant > programs in the United States has resulted in many transplant programs > taking a risk averse approach</comment>


By 2050, human-on-robot sex will be more common than human-on-human sex - <AUTHOR> http://www.telegraph.co.uk/technology/news/11898241/By-2050-human-on-robot-sex-will-be-more-common-than-human-on-human-sex-says-report.html <comment><USER2> Fox news once reported that by 2000, hedgehogs might be a more popular pet choice than either cats or dogs.

</comment><comment><USER3> Forgive me if I maintain my skepticism...</comment>