Android Phones Can Be Hacked Remotely by Viewing Malicious PNG Image - <AUTHOR> https://source.android.com/security/bulletin/2019-02-01.html <comment><USER2> It's kind of ridiculous that my Google Nexus 5X, which was released just over 3 years ago, will not receive updates to patch vulnerabilities like this anymore.

<comment><USER3> Absolutely agree - there should be regulation demanding a 5 year period of security updates (or similar)..

Check out [https://www.lineageos.org](https://www.lineageos.org) or one the other dists out there - and get that loaded up..

<comment><USER4> Do you really want legislators defining what is and what is not a 'security' issue?

<comment><USER5> What is your proposal for fixing that devices are not updated these days?

<comment><USER6> Get a new device and pick a manufacturer that provides updates.

<comment><USER7> So daydream. Such a company doesn't exist.

<comment><USER8> Here you go: [https://puri.sm/products/librem-5/](https://puri.sm/products/librem-5/)

<comment><USER9> You do realize that phone is only available for preorder? They may not even be around in 3 or 5 years. The OP likely suggested Apple (5s is in its 6th year of updates).

<comment><USER8> >You do realize that phone is only available for preorder?

Yes, it is only for preorder, but the devkit already exists [0].

> They may not even be around in 3 or 5 years.

If they manage to make the final version of the phone (which is quite likely), it won't matter anymore, since the OS is just GNU/Linux. Correspondingly, the updates do not so much depend on the phone manufacturers.

[0] [https://puri.sm/posts/how-we-designed-the-librem-5-dev- kit-w...](https://puri.sm/posts/how-we-designed-the-librem-5-dev-kit- with-100-free-software/)

<comment><USER10> So how does that solve a problem lineage os doesn't?

You're buying into a phone that _should_ get continued support for years to come, assuming the company survives, and they don't end up finding the maintenance burnden utterly untenable (once they on model version 3, I can't see it being the easiest thing to support the older models - Apple does, but Apples huge). It seems to be relatively underpowered (though that's really up to how many resources the system uses), and I can't imagine will age well. There will be little to no mainstream app support (they seem to be touting "just run it in a browser" as a solution to that - I thought we left those dark ages).

It seems like a neat, niche product, like a raspberry pi phone, but it doesn't give me a lot of hope for the future.

<comment><USER8> > So how does that solve a problem lineage os doesn't?

LineageOS depends on the proprietary drivers and/or undocumented devices, which will never get any updates. If there is a security bug in your WiFi driver, game over. This phone is being designed to work with free software, anyone could do updates.

>assuming the company survives, and

Again, free software gives us the freedom to do updates ourselves (or pay to someone to get them). GNU/Linux supports most of the old computers quite well.

>There will be little to no mainstream app support

"We will test the capabilities of powering Anbox or Shashlik to allow users the ability to run Android applications within PureOS on the Librem 5", [https://puri.sm/faq/](https://puri.sm/faq/)

>It seems to be relatively underpowered

True, but one has to start somewhere. Personally, I think this phone brings a lot of hope for the future.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> If you follow the monthly Android Security Bulletin, there has been a long stream fixes for remote-code-execution vulnerablities in codec implementations. It got big in 2015 when the Stagefright branded vulnerability got some publicity, and they continued testing & have continued to fix an endless stream of codec vulns ever since.

There was also a Bluetooth RCE in this month's bulletin. And in November there was yet another round of WiFi pwnage, this time in Qualcomm WiFi (CVE-2018-11905). It's all quite bad.

<comment><USER12> And this is exactly the reason why you need vendor support to apply fixes. Half of those fixes are in binary blobs, so if you don't update those (e.g you rely only on AOSP/Lineage updates), you're screwed.

<comment><USER12> Apart from the fact that the only answer right now for security-conscious android buyers is "get a Pixel" (I'm exagerating, flagship from a few vendors are good to go for 1-2 years), this is once again a reminder of the damages of binary blobs, here directly for consumers (they have non-updatable security holes).

<comment><USER13> Actually Android One devices are also guaranteed (inasmuch as the tiny text at the bottom of the Android One website [1] says) three years of security updates

> Monthly security updates to be supported for at least 3 years after initial > phone release.

(scroll down to the bottom of the page and look for the double asterisks footnote. I don't know why they want to hide what is IMO the best reason to get an Android One device)

[1]: [https://www.android.com/one/](https://www.android.com/one/)

<comment><USER12> Good point. They previously removed this language from the website, glad they put it back. So yeah, buy an Android One at launch is good advice for the 3 years of security support.

It's still a short window IMHO, and it's bad for the planet to throw working devices after 3 years.

</comment></comment></comment></comment></comment><comment><USER14> >> We encourage all users to update to the latest version of Android where possible.

Good luck with that.

<comment><USER15> My phone gets the latest Android updates the day they are released even though it is a discontinued phone and not from Google.

The issue isn't Google or Android. It is phone manufacturers.

<comment><USER16> Heh. I got the Galaxy Nexus when it was the flagship, and I never got a single update. I got the Nexus 5X a couple of years ago, and Google is failing to provide this update for that phone.

If Google can't even get it right on their own devices, they can't be shifting the blame to manufacturers.

The only remotely-safe choice is an iPhone.

</comment></comment></comment><comment><USER17> I have a Moto G6 Forge purchased a couple months ago, and it lists no updates available with the last update Jan 1 2019.

This is just the android ecosystem these days, don't count on security updates?

(This phone is actually my first smart phone, I can't even explain why I had a flip phone for so long... except this. But I'm still figuring out what to expect from em.)

<comment><USER18> If you want the quickest Android updates, you'll need either a carrier unlocked Google Pixel, or an Android One device. These are devices where there are fewer hurdles between a patch and your device.

If, for example, you have a Samsung device from Verizon, it goes something like this: Google releases new source code containing patch. Samsung takes a few months to roll it into their updates, and sends it to Verizon to Q&A. Verizon either pushes back or accepts it after some time. That whole process takes far longer than it should, partly because they are mixing security and features in the same updates.

<comment><USER17> Thanks, so I gather it's normal to expect significant delays in security patches for most Android phones, with some exceptions.

People are talking about how _old_ phones don't get patches at all, but even most _new_ phones have "zero-day" vulnerabilities (cause zero day lasts for months apparently) for significant periods.

What a world! How is this okay?

<comment><USER18> How it's OK is likely because there hasn't been a huge category-5 fuck up yet. Or at least none that we know of. Some of this is probably from sheer luck. Some of it is probably from some decent security design baked in like sandboxing and the like. The first time it becomes public that 80% or more of Android users just had their personal info stolen, it'll suddenly become not okay. Especially if that user group contains significant amounts of celebrities and government types.

It's not all doom and gloom though- there have been improvements. Different partitioning schemes, breaking out core services out of firmware and into the play store, etc. It's just that thus far Samsung, the biggest Android player by far, has decided not to implement all of them.

</comment></comment></comment></comment><comment><USER19> Shouldn't all code be gradually updated to use Rust libraries when they exist? Is it a stupid idea?

I know it's a lot of work, but the Android/Chrome teams are big, and this is important enough work that could improve the security of the systems.

<comment> yjftsjthsd-h Well... Rust has some safety features, but 1. so do others (Go is a Google project...), 2. it helps with some things and less with others. So yeah, if you have the resources, using Rust/Go/whatever and taking a security-first view is sensible. It's not a silver bullet, but it's probably helpful.

<comment><USER19> Actually Rust _is_ a silver bullet, that's why it's so exciting.

System level programming memory safety was a dream for a long time.

Go is not capable of this at all, so it's out of question for replacing low level libraries.

<comment><USER20> Why isn't Go capable of system level programming memory safety?

<comment><USER21> It does not _actually_ provide memory safety in concurrent scenarios, only for purely sequential code. Given the predicted use-case scenarios for Go, that's pretty much a truck-sized hole in the language's purported guarantees, especially in comparison with Rust.

</comment></comment></comment></comment></comment><comment><USER22> Is there a test to see if my device is vulnerable?

</comment><comment><USER23> I remember a similar bug with gifs years ago. It was possible to embed html inside gif and browsers would actually render the html.

It was great for stealing peoples sessions on forums using a malformed avatar.

<comment><USER24> There was also the Windows Metafile mayhem [0].

[0]: [https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability](https://en.wikipedia.org/wiki/Windows_Metafile_vulnerability)

<comment><USER23> yes! that one was a doozy.

</comment></comment></comment><comment><USER25> Seems the vulnerability was in Skia, thankfully, rather than libpng.

</comment><comment><USER26> Is this another backdoor or am I being paranoid again cause this type of exploit is like those who see in the movies, we start laughing ironically and we are like "cmon now, that's insane...hack every phone using an image, not in a billion"

<comment><USER27> It's notoriously hard to make parsers bulletproof against malicious input.

For a toy example, imagine the format says [number of bytes to come] [the bytes]. Allocate an array with the specified size and then copy the rest of the message into it. Right?

Now you've got a remote buffer overflow. How about [start sentinel byte] [up to N data bytes] [end sentinel byte]? Just put more than the allowed bytes before the end sentinel.

Unless a format is designed to facilitate secure implementation (which would include being very simple), there are going to be at least a few vulnerable implementations. Is it a backdoor? Read the patch yourself, decide whether the original authors and reviewers knew what they were doing.

<comment><USER28> > For a toy example, imagine the format says [number of bytes to come] [the > bytes]. Allocate an array with the specified size and then copy the rest of > the message into it. Right? Now you've got a remote buffer overflow.

Well then you're doing it wrong. You copy [number of bytes to come] bytes, not [rest of message] size bytes, only once you've validated that [rest of message size] is not too large to begin with. That is a _completely_ toy example. A decent programmer would _never_ trust the remote end to actually just send [number of bytes to come] bytes.

<comment><USER29> > A decent programmer would never...

You might want to Google for ImageTragick. Or heartbleed. Or shell shock. Or Java deserialization. Or flash. But please, tell me more about what a decent programmer would never do.

<comment><USER30> Decent programmers are also context dependent. For example when ImageMagick's delegate functionality was envisioned (before 1999 - that's the earliest page I was able to quickly found that mentions the feature), IT security was not taken that seriously. Basically Mitnick was just arrested (1995), multi user systems were all guarded and watched closely by bastard operators from hell like dragons sitting on a mountain of gold.

And PHP was seen as harmless fun.

And malware was thought of as boot sector viruses and even though the first worm (1988, the Morris) worked _exactly_ like what people are harping about (buffer overrun), no one cared, because C++ was slow to compile, and managed runtimes are evil.

And still no one cares. It takes some competence to stop using C, but it's easier to simply shout at those who point out the obvious.

And when someone brings out the good old Therac-25 everyone starts to fall silent. (Even if healthcare accreditation is very expensive, it's expensive exactly because the whole IT field is still full of unverifiable code.)

<comment><USER28> > For example when ImageMagick's delegate functionality was envisioned ... IT > security was not taken that seriously

Yes it might have been easy to get away with writing the OP's faulty specification into code back then. After 25 years of people screaming about the dangers of buffer/integer overflows, it's very hard for me to think that a serious C/C++ programmer could look at that specification and not see the issue before blindly committing it to code today. I suppose it could happen.

OpenSSL (which everyone else here is crying about as an example) is also over 20 years old.

> And still no one cares. It takes some competence to stop using C, but it's > easier to simply shout at those who point out the obvious.

Well imagine trying to rewrite the Linux kernel today in a memory safe language, without losing any support for any of the current target architectures. Or NetBSD even more so for that matter. Nobody has convinced me it could be done, and as of yet, it hasn't been.

Throwing away C and C++ for good is fine - if you don't want to do much in the way right now of embedded programming, or working with sophisticated games engines (eg. UE4), just for fun.

If you're not confident of the quality of the code, then maybe don't deliver it to for all and sundry saying its fit for purpose. And if you are confident, then check it again. That's all I'm saying.

<comment><USER30> > Nobody has convinced me it could be done, and as of yet, it hasn't been.

Agreed. And even though it could be done, but it'd of course came at an enormous cost to the current pace of driver and other updates.

Google is trying something with Fuchsia though.

And there are experiments similar to how Linux itself got started. (Redox OS comes to mind.)

<comment><USER28> > Google is trying something with Fuchsia though. And there are experiments > similar to how Linux itself got started. (Redox OS comes to mind.)

Aware of both of these, but yeah, wake me up when either are close to being capable of being even a niche competitor, for example, as complete and accessible as Haiku currently is.

<comment><USER30> What's Haiku's offering? It's BeOS resurrected. It's in C++. (Which - IMHO - has too much baggage, and still lacking sane module support.) In development since 2009 and still lacking SMP, hm.

<comment><USER28> Oh nothing on a technical level, I agree with your critcisms there. Just in the sense that it's available now. It has package management and you can install applications, compile applications, run applications etc right now. Unlike Fuchsia and Redox AFAIK.

Most of the BSD's didn't have decent working SMP for a period longer than that either.

I think it's kind of sad that it takes a company the size of Google to create something like Fuchsia, which we can't be sure will ever see the light of day for most users, even given the vast pools of code available in Linux and BSD they could reference.

Hardware has grown exponentially in complexity since Linux was initially developed of course, which makes the job of writing a new OS much tougher. But you could probably find 20-30 different hobby OS's over on osdev.org that are more complete and accessible for the end user than Fuschsia or Redox right now, even if they are just more boring POSIX clones.

<comment><USER30> > Hardware has grown exponentially in complexity since Linux was initially > developed of course, which makes the job of writing a new OS much tougher.

Though, interestingly hardware also got a lot smarter (because usually they have some kind of microprocessor and RTOS on them), so in theory interfacing with it should be more easier. (Serial buses, simple enumerate, simple addressing, we have a lot of good abstractions, no need to fiddle with registers, just use a PCI-E, DMA, I2C library.)

But of course at the same time just supporting these smart standards is hard (because initialization of things is not trivial, even just getting DDR RAM to work requires tinkering with MSRs, and ACPI is its own special hell).

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> Semi-OT: is there already a shellcode for this? The Chromecast should be vulnerable to this too, given it's Android based?

<comment><USER32> Chromecast _was_ Chrome OS, which is _not_ Android. (And I doubt that's changed.)

<comment><USER33> ...which probably uses Skia as well.

<comment><USER32> For sure. This post freaked me out because my main machine now is a Pixelbook.

</comment></comment></comment></comment><comment><USER22> Is this going to be used as an opportunity to get us all to buy new phones much earlier than we normally would?

</comment><comment><USER34> I woke up this AM to an update on my Pixel 2 so at least Google is keeping on top of their own phones (even though the Pixel 2 is one gen old now)

</comment><comment><USER35> If I have a Samsung Tab S3, do I need to wait until Samsung releases an update to fix this?

edit: N/M I found the updates on Samsungs page that address these

[https://security.samsungmobile.com/securityUpdate.smsb](https://security.samsungmobile.com/securityUpdate.smsb)</comment>


Visual.ly: The Future of Data-Based Infographics - <AUTHOR> http://eagereyes.org/blog/2011/visually-the-future-of-data-based-infographics

<comment><AUTHOR> wow, this really opened my eyes up to the real interesting stuff at Visual.ly. None of this was apparent to me at launch a few days ago, nor when I signed up recently.

"This is Disruptive Technology" ha, nice heading.</comment>


IBrothers Grimm: The eBook is dead, long live the eBook - <AUTHOR> http://recombu.com/news/ibrothers-grimm-the-ebook-is-dead-long-live-the-ebook_M11639.html

<comment><USER2> I hope people notice this and vote it up. A great success story. (Usual disclaimer: I'm not part of it.)</comment>


Why I Hate Running But Still Do It Anyways - <AUTHOR> http://alexanderle.com/blog/2012/05/08/why-i-hate-running-but-still-do-it.html

<comment><USER2> well said, felt exactly the same about running. It is not as exciting as football(soccer I mean), or badminton, or any other ball game. But somehow, there is something about it that keep you coming back for more. Having say that, I have not run anything more than 5k for months now. Should pick it up again. Not sure if you have read this before, but a really good book from Haruki Murakami for runner. [http://www.amazon.com/What-Talk-About-When- Running/dp/030726...](http://www.amazon.com/What-Talk-About-When- Running/dp/0307269191)

<comment><AUTHOR> Thanks for the book suggestion Kahfei - I'll look into it!

</comment></comment><comment><USER3> I am just now today experiencing this exact thing for the first time! The so- called "addiction" is strong too—I just did a long run on Sunday and am sore and tired and am already looking forward to my next run. I'm a new runner, and thinking about it, I am drawn to it more for the alone time + weight loss than I am the actual running (which is tough for sure). Thanks for the post—it was fun to read and think about.</comment>


Entri - Free collaborative article writing tool, any use to any of you? - <AUTHOR> http://entri.co/

<comment><USER3> Very nice looking, potentially useful.

I take it 'lock' is to avoid conflicts? Good idea, but do I have to activate it manually every time I think someone else might open the doc at the same time as me? Perhaps it should lock automatically if I am editing it.

Otherwise, very nice.

edit: I just noticed on your haloweb site that you made invoice bubble as well - I bookmarked that a while back when I was collecting good-looking sites. You do good design!

edit 2: Invoice bubble appears to have been redesigned since I last checked. Still looks pretty good though (I preferred the minimalism of the old one, but I expect this one is more functional)

<comment><AUTHOR> Hey nudge, thanks for the kudos. Yes I did Invoice Bubble too, it has been developed quite a bit since you last looked but design wise it should all be quite the same?

Yeah the locking automatically is whats happens in Writeboard and some people have expressed this to be a problem, so I'm just gathering feedback at the moment.

Thank you!

Stu

</comment></comment><comment><USER4> Looks really cool - but it needs real-time collaboration. If you could pull in something like Etherpad/AppJet to it and make it editable in real-time by multiple people, then I think you might be onto something.

<comment><AUTHOR> Hey thanks. People can edit in realtime, but the changes won't get reflected unless the master user changes the version - so thoughts welcome on this.

I'm not sure technically how you would do it, literally in realtime, unless the data was pushed to the editor somehow every time there was a change - <USER2> then that could get annoying for the person actually in the flux of writing.</comment></comment>


Rebranding Carrots as Junk Food - <AUTHOR> http://www.thedieline.com/blog/2010/9/1/rebranding-carrots-as-junk-food.html <comment><USER2> Brilliant! And fitting, since baby carrots are already the sort of "junk food of the carrot world." At least, insofar as that they're the lazy alternative to buying and cutting your own damn carrots.

(Baby carrots are just big carrots that have been pre-cut and marked way up. Info here: [http://www.wisebread.com/baby-carrots-the-frugal-idea- that-i...](http://www.wisebread.com/baby-carrots-the-frugal-idea-that-isnt) ... which also brings to mind the semi-related issue of America's aversion to non-"perfect" produce. That's one of the reasons small, local producers have a hard time selling to big grocery chains -- they can't afford to cull their produce of the "ugly" carrots, tomatoes, peppers, etc.)

<comment><USER3> This aversion to ugly fruit and veg invaded UK and Australia year ago as well. So now, when you go to a supermarket, you will have beautiful tastless food, whereas when you go to Spain or Italy, you have ugly delicious fruit and veg.

<comment><USER4> I totally agree. I live in Australia, and I didn't realise this until I went to India a little while ago.

The fruit there seemed smaller, but far, FAR more tastier.

So it's not just the looks, but also the size that seems to matter in Australian supermarkets.

</comment></comment></comment><comment><USER5> Clever idea. I subscribe to the wacky theory that kids prefer junk food to vegetables because it tastes better rather than because they've been brainwashed by evil advertisers, but either way this will provide useful data.

<comment><USER6> While I agree with you, I notice that I eat disproportionately few carrots than their taste would suggest (they are pretty delicious), and it's mostly because of the inconvenience of cleaning them and their relative unavailability. If I had a vending machine with carrots, I'd definitely choose them over the other snacks most of the time.

<comment><USER7> Is it really that inconvenient to clean a carrot? Just peel it and eat it. I can peel a carrot quicker than most people can even decide what to have at a vending machine.

<comment><USER8> You don't need to peel carrots, really. They are nice to eat just like they are!

<comment><USER9> How about all the pesticides though?

<comment><USER10> Carrots are roots. Even if the plant has been sprayed, you're not eating the part of the plant that got sprayed.

</comment></comment></comment></comment></comment></comment><comment><USER11> This "rebranding" is obnoxious. If I was kid I'd be pissed. Kids can tell when you're bs'ing them. They're exposed to enough propaganda already.

The path to healthy food isn't in telling kids what to do, but exposing them to something better. Look at what Japanese kids eat. I _know_ kids would prefer salmon-roe onigiri and fried rice to potato chips and twinkies.

<comment><USER12> Is Japan a good example? If any country is second to the USA in packaging products to appeal to kids (or, as you put it, "BSing them"), it's Japan:

<http://japanfix.com/wp-content/uploads/2010/03/DSC_0019.jpg> <http://s7.thisnext.com/media/largest_dimension/23448865.jpg>

(I think this is a _good_ thing if, and only if, the food is healthy and worthwhile to eat - as here. It's easy to rail against branding and advertising - it's harder to prove it doesn't work.)

<comment><USER11> Yes. Yes it is. Just because they have lots of fancy candy packaging doesn't mean that Japanese kids eat tons of it.

<http://en.wikipedia.org/wiki/Epidemiology_of_obesity#Japan>

Just look at photos of what the Jap kids eat for lunch:

<http://www.flickr.com/photos/lunchinabox/1378172475/>

This is actually what they eat for lunch everyday. It's amazing.

<comment><USER12> I think I misunderstood your message. What Japanese kids eat seems to be excellent and I support healthy food choices. What I sensed, however, was an unfair antagonism towards branding and packaging design as a way to achieve that. If my inference was wrong, apologies!

</comment></comment></comment></comment><comment><USER13> My favorite bit about carrots is the idea that they'll help your night vision is propaganda from WWII:

<http://www.snopes.com/food/ingredient/carrots.asp>

</comment><comment><USER14> If carrots actually tasted like they were supposed to, sweet and carroty, it wouldn't be so hard to get kids to eat them.

Especially baby carrots, which are the junk of the carrot world, do not taste good.

<comment><USER15> Why do baby carrots taste different from regular carrots? I thought they were regular carrots, just pre-peeled/cut.

<comment><USER14> Because they use the lowest quality carrots to make them (since they are usually sold cheaply), and because by cutting and peeling they can hide defects.

Also peeling them causes them to deteriorate somewhat.

<comment><USER10> They also bleach them for color and tumble them to round the edges.

</comment></comment></comment></comment><comment><USER16> I think it's a silly idea for children since children aren't _quite_ dumb enough to buy the idea that carrots are tasty just because you advertise 'em (I didn't buy my parents' assertions that cleaning up my room was fun, either, and teenagers don't seem to buy the "abstinence is cool" message).

But I have to admit that it _did_ make me go to my fridge and get some carrots.

</comment><comment><USER17> Interesting idea, although I think the slogan (Eat 'Em Like Junk Food) might be so corn that it turns kids off of the product. If you want to reach kids you have to speak their language and whens the last time you heard a 12y.o. say anything like that?

<comment><USER18> For me, the corniness of the phrase isn't as much a turn-off as the fact that it validates gorging on junk food.

</comment></comment><comment><USER19> 1\. Nice packaging has a marketing merit no matter the product. Think how a beautiful gift wrap elevates an average gift. So why no have a nice packaging without the "Junk" logo?

2\. Never a good idea to assume that the kids are stupid.

<comment><USER20> >Think how a beautiful gift wrap elevates an average gift.

Beautiful gift wrap always makes me think "what a waste of resources" it's even worse if it's plastic.

I don't think we should be trying to trick people into following what we've decided they should eat.

</comment></comment><comment><USER21> Reminds me of "Veggie O's"

Ever see Daddy Daycare with Eddie Murphy? Carrots and Broccoli Cereal.

Enjoy: [http://www.youtube.com/watch?v=K7tjFE6QMcE&feature=relat...](http://www.youtube.com/watch?v=K7tjFE6QMcE&feature=related)

</comment><comment><USER22> Several diet books I read actually advise against carrots (maybe they are high in fructose? forgot the reason), so I was expecting this to be serious.

</comment><comment><USER23> Nice, but it may be more effective to limit advertising of unhealthy food during cartoons and shows targeted directly at children.

<comment><USER11> No, no it wouldn't. It would be more effective to stop subsidizing unhealthy food. The long-term effects of such legislation are almost guaranteed to be a net-negative because of edge cases. There are already way too many laws. You should always look first at what can be removed, rather than what can be added.

<comment><USER16> No, what would be effective is if the parents of children stopped letting 'em eat junk food all the fricking time. "Mummy, I want a Snickers". Bad fricking luck, kid, eat your fricking vegetables.

<comment><USER24> No kidding. If parents would do their damn job and not let kids eat junk just because they want it, we wouldn't have an issue.

<comment><USER16> In fairness, "we" don't have the issue.

It's somebody else's issue, and I refuse to accept any responsibility or worry over the fact that somebody else's kids are fat. I have enough problems of my own, I've got better things to do than accept part-ownership of the easily- soluble problems of others.</comment></comment></comment></comment></comment>


Intelligent Individuals Don't Make Groups Smarter - <AUTHOR> http://www.wired.com/wiredscience/2010/09/collective-smarts/

<comment><USER2> Wired gets it wrong, again. Actually the study conclusion is "Having a bunch of smart people in a group doesn't necessarily make the group smart," concludes Malone (one of the study's authors). Meaning if a group fights, they won't do as well as a group that doesn't when performing a group task.

So "Duh" to the study, and "Learn how to read" to Wired. Maybe the article should be titled" Intelligent Individuals Don't Necessarily Make a Group perform better on Group Tasks if they cause everyone to fight"

Wired is like a supermarket tabloid of sciency-type content. A link at the bottom of the article webpage is to "Animals Get Freaky at Museum of Sex"

Does anyone take anything seriously from Wired?</comment>


Schools 'too safe', teachers say - <AUTHOR> http://news.bbc.co.uk/2/hi/uk_news/education/8107858.stm

<comment><USER2> Yes, and instead of creating kids that are adaptable, we're creating ones that are weak.

If someone tries to prepare for every possible contingency, kids grow up under the grand illusion that not much can go wrong, and then _crumble_ when they're faced with the smallest unanticipated problem. (Some more along these lines in this article: <http://timesofindia.indiatimes.com/articleshow/861651.cms> )

This is reminiscent of dumbing-down projects in software. :) Something brilliant is created, but over time the original developers move on and there is a push to make the thing maintainable by cheaply-employed people who are relatively mindless automatons. Most of what they do is memorize remedies for the common issues. Their effectiveness is therefore proportional to how predictable the problems are; should something unusual occur, they have _no idea_ how to fix it and their effectiveness goes out the window. So imagine if you're a child, you grow up feeling basically capable of living your own life, only to be given the rudest of awakenings when unexpected things start revealing just how unprepared you really are.

<comment><USER3> Sorry, but the more I read that link the more skeptical I become of its contents. Children do not commit suicide because they've been coddled and suddenly are scolded by a teacher. They commit suicide because they are fearful of the consequences and are pressured to reach perfection. Being spoiled creates children who would rather blame others than themselves. Suicide just doesn't seem like a likely course of action for them.

What I find particularly disgusting about the situation is that an apparent superintendent of a mental hospital is blaming television because, get this, "On the small-screen, the protagonists commit suicide at the drop of a hat." Right, always easier to blame the media than deeper social problems that go beyond recent trends.

Another thing that seems questionable is that all these children come in with apparent self-inflicted wounds. Since when do spoiled brats hurt themselves? From what I know, self-injury is a silent way of getting attention, something that spoiled kids shouldn't have a problem with.

<comment><USER4> There is no single reason why suicides happen. I imagine everyone must have different reasons.

</comment></comment></comment><comment><USER5> Reminds me of Mike Rowe's tech talk: "Maybe we have it wrong when we say 'Safety first.' Maybe it's more like... 'Safety third.'

I wonder how the Internet has affected safety culture in schools. I can do a simple search and get all kinds of crazy school stories-- and then use those to justify any rules I want, if I had happened to be a school administrator.

<comment><USER6> We joke about this in my flying club. The official rules say "safety first"...but if safety really came first, we would be at home watching TV. Life is dangerous. It is important to take controlled risks, so that you can learn what risks are acceptable and which are not. Besides, perfectly safe translates to perfectly boring. Adventure and fun always come with an element of stress and danger.

</comment></comment><comment><USER7> But... _won't someone think of the children_!

Sometimes it seems like that's all one has to say to create an environment like this.</comment>


Tado Cooling – Intelligent AC control - <AUTHOR> https://www.kickstarter.com/projects/tado/tado-cooling-intelligent-a-c-control/ <comment><USER2> Unlike Nest, which I've always seen as a gimmick sold on false advertising, I believe this has legs. Making these kinds of air conditioning units into intelligent devices could have significant effects.

Why do think I Nest is a gimmick almost bordering on a marketing scam? Because in only works in a relatively narrow range of applications (i.e.: small one or two room apartment). In a larger family home --and particularly a two story home-- it is worthless. You could save money with a cheap programmable thermostat. In order to really save money in such settings you need a zone system with one thermostat/sensor per zone, a multiple stage compressor (or multiple condensing units), a variable speed air handler, a high efficiency HEPA filter, attic exhaust fans and, ideally, a filtered outside air bypass system to take advantage of cool night air.

I am in the middle of renovating my home and have done all the research. Nest is a waste of time and money. You'd save far more money --FAR MORE-- buying a relatively cheap whole house fan to cool the house down at night (at least in my region). But, hey, everyone believes that technology is magical. Damn the math and physics. Hence the hype and sales.

Automating window units is a different game. These are devoted mostly to cooling single rooms. So now you have the equicalent of a highly granular zone system. If you have a home or office with several of these units an intelligent control system could, depending on traffic patterns and the daily flow of people in and out of the various spaces, have a big impact. This is different.

EDIT: I see the cargo-cult HN down-voting got started right away. You can't say anything bad about Apple, Tesla, Nest and others on HN. Of course, they never back-up their downvote because it's purely emotionally driven.

So, here's the challenge: If you think I am wrong about Nest tell me why and back it up. The comparison is between Nest and a cheap programmable thermostat. People's lives are reasonably regular and heat cycles in the summer are too. If you are intent on saving money a programmable thermostat will do wonders. I've been experimenting with this for three years knowing that we would have to redo our cooling and heating system in 2014/15\. I've gone two full summers without running the air conditioner but for two weeks by rigging and intelligent $200 fan (meaning, I hooked it up to a $5 timer) to exchange air out of the house when outside air was cooler than inside. That move alone represented a savings of around $500 PER MONTH. See my point?

<comment><USER3> Your argument is mostly right in terms of what would be required (the super- high efficiency filter is not necessary, nor are attic fans, to achieve anything interesting), but actually, you _have_ to have multiple condensing units past a certain point.

It's simply not efficient, even with auto-closing dampers, to zone and duct a multi-zone system with single condensing units.

You'd be much better off, efficiency wise, either: 1\. Using mini-splits everywhere. 2\. Going geothermal. You can support multiple units off a single loop. I did this in maryland. My 4000 square foot house had all the hot water and cooling provided by GSHP. My energy bills, keeping it whatever temperature I liked, dropped from about 400 a month in the winter to about 50 bucks. The wonder of 41 EER, 5 COP. Unlike the air source heat pumps, they actually publish real efficiency curves for various temperatures, and your pump actually work at close to expected efficiency!

<comment><USER4> Why is a multi-zone system not efficient with a single unit? That's what I have, should I uninstall it or turn it off?

<comment><USER3> Either you have motor controlled dampers, which means the system can't be entirely responsive all the time, or everything is open all the time, which means you are losing a lot of airflow to parts you don't need them.

<comment><USER4> It is motor controlled. It has two thermostats and it adjusts the motors to only heat or cool one floor.

I'm not seeing why that wouldn't be equivalent to two units.

<comment><USER3> Okay:

Two small units

For the sake of argument, let's make everything otherwise equivalent. We'll say the small units are 1.5kw each

When upstairs and downstairs call for heat, you use ... 3kw When upstairs calls for heat alone, you use 1.5kw When downstairs calls for heat alone, you use 1.5kw

Ducting/blower loss from this setup (assumes two completely separate duct runs): 0%

One large unit:

3.0kw to make life easy (in reality, if you use small units, you often need less)

When upstairs and downstairs call for heat, you use ... 3kw When upstairs calls for heat alone, you use 3kw When downstairs calls for heat alone, you use 3kw

Ducting loss from this setup: 25-30% (at least, it's just the way it goes due to longer duct runs, more tees, etc. If you have, say, flex runs, it'd be even more)

It is essentially guaranteed to run for more than half the time of the smaller units (due to ducting loss, etc), making overall cost more.

Note that if you had mini-splits as the small units, the comparison would be crazily in favor of that. you'd have no loss due to ducting, they would almost certainly be DC based, and would be completely variable to actual load (even a "variable speed blower" on a large unit isn't), not 1.5kw on/off. Smaller unit efficiency is also almost always greater than larger unit efficiency.

Also note this is all a comparison of _efficiency_. It may be more _cost effective_ to do one or the other (though it depends how long you own the house, insulation, blah blah blah)

</comment></comment></comment></comment></comment></comment><comment><USER5> _< 60MB per month upload, < 5MB per month download_

1) Seems like a lot of data, what exactly is it communicating and to whom? What are the privacy policies?

2) What happens if/when the company stops running its servers? Does the device continue to work or will it become junk?

<comment><USER6> Rough numbers may a general guideline to CYA, but to your privacy and second point. What data is gathered, stored, for how long and shared with who? What are your options if the system goes offline?

I have a Nest Thermostat that I bought before Google acquired Nest, which raises another general issue of your device having an evolving T&C to use.

</comment></comment><comment><USER7> ConEdison in NYC will give you a device like this for free, and pay you $25 after installation if you sign up.

[http://www.coned.com/energyefficiency/residential_directload...](http://www.coned.com/energyefficiency/residential_directloadcontrol_program.asp)

<comment><USER8> It looks like a central A/C system is a requirement for this program, so if you use window units, you will not be eligible.

<comment><USER7> Sorry - guess I linked the wrong program. Here's the ThinkEco program. Works on window-based AC units.

[https://www.coolnycprogram.com/](https://www.coolnycprogram.com/)

</comment></comment></comment><comment><USER9> That's a very nice idea for an Arduino project. I already have an Arduino hooked up to my home server that can sense motion/light/temperature, so it should be easy to set it up to remotely control the AC as well.

</comment><comment><USER10> Strange thing to come from a company from Munich, as AC is barely used there.

<comment><USER11> Mind you, if you look closely on their website, it works with gas heating - which most of the houses here use. I personally have a Buderus ( although fully automated - but quite inflexible) and I'd really like to try it. 300 Euro doesn't seem to much, considering that it can do savings on the same level per year. EDIT: the central Munich is heated with the SWM's powerplants. But around Munich there is a huge amount of houses which just fit this device.

<comment><USER12> Be careful: these are two distinct devices. One works with gas heating, the other with HVACs.

</comment></comment></comment><comment><USER13> According to Thingsquare, Tado is using their firmware [1], Mist, based off of the open source Contiki [2]. This is pretty cool, as it enables a ton of features like over the air firmware updates or running your own applications. I'm especially curious how they added bluetooth and ibeacon support into this.

[1] [http://thingsquare.com/customers/](http://thingsquare.com/customers/) [2] [http://www.contiki-os.org/](http://www.contiki-os.org/)

</comment><comment><USER14> I was thinking about it until they decided to charge MORE for the developer edition. As there isn't a Windows (Phone or otherwise) version out there I couldn't use it.

Yes, I know, I run a Windows Phone and don't own Android or iOS devices but companies should at least give people the ability without pay walling it.

<comment><USER12> Kinda like the Occulus, which are also charging more for the DevKit. Why do you think it should be cheaper? It's not like they have an app store they want to promote.

</comment></comment><comment><USER15> I wonder where they got the name Tado?

It's quite similar to the name Taco, which is an 80+ year-old American HVAC company [0]. I hope they don't get in trouble in the U.S.!

Other than that, great idea!

[http://www.taco-hvac.com/whoweare.html](http://www.taco- hvac.com/whoweare.html)

<comment><AUTHOR> [http://www.tado.com/de-en/blog/tadayimaor-how-we-chose- our-c...](http://www.tado.com/de-en/blog/tadayimaor-how-we-chose-our-company- name-26)

"The name tado° is derived from the Japanese greetings 'tadaima' and 'okaeri'. Loosely translated, they mean 'I am home' and 'welcome home'."

<comment><USER16> Would also imply that it's pronounced "tah-doh"

</comment></comment></comment><comment><USER17> all the IR stuff is done if you want it Tado. :D or at least a start

allows record and playback of IR codes as well as search of LIRC

also, if you are building an IR database, would you consider sharing the IR codes with the community?

after all, I'm sure Ken Sheriffs library and arduino are open tools that are likely helping you quite a lot in the early stages...

[https://github.com/dandroid88/webmote](https://github.com/dandroid88/webmote)

</comment><comment><USER18> Just for fun I once thought about using my Lego Next kit to build a bluetooth controlled robotic finger to operate my AC remote. So sorry I never got to it.

</comment><comment><USER19> Isn't this what Nest does as well?

<comment><USER20> This is for those with window or portable A/C units that are controlled with an infrared remote. Nest is for those with central air.</comment></comment>


Tech C.E.O.s Are in Love with Their Principal Doomsayer - <AUTHOR> https://www.nytimes.com/2018/11/09/business/yuval-noah-harari-silicon-valley.html <comment><USER2> Why wouldn't they be? He told their story before it unfolds. But he isn't their doomsayer. He is their prophet.

</comment><comment><USER3> "Profound."</comment>


Ask HN: Did Online Course Lead into a Job for Anyone? - <AUTHOR> Did any one do online courses like
Coursera Edx Udacity
And then use it and get a JOB.
Also what about below course
https://pe.gatech.edu/online-masters-degrees/online-master-science-analytics
Once i finish it what approach i should use to leverage this new qualification to secure a related job.
what difficulties will i face in leveraging it. <comment><USER2> My entire career at this point was jump-started by udacity web dev course. Prior to that I was flitting around with developing scrapers and some basic desktop systems. After I took that course, I went from one level to another and am now working remotely with buffer.

As of late I've been looking back on this experience and wondering how much I'm losing out on by not taking more courses. Hoping to change that from March this year.

<comment><USER3> Did you take the Front-end or the Full-stack course?

<comment><USER2> It was this one. [https://www.udacity.com/courses/web- development](https://www.udacity.com/courses/web-development)

I did it in the early days before the tracks were introduced and where it was still single courses

<comment><USER4> Sorry it looks like your link goes to a number of courses. Which one in particular did you do?

Thanks.

<comment><USER2> Yikes! I shared the course directly from the udacity app. Looks like I got the wrong link.

[https://www.udacity.com/course/web-development-- cs253](https://www.udacity.com/course/web-development--cs253)

That should take you to the right one hopefully. It's basically Steve Huffman's course on how to build a blog. :)

<comment><USER4> Great! Thank you!

</comment></comment></comment></comment></comment></comment><comment><USER5> I completed a couple of courses offered by Coursera and Udacity on Android development and managed to get a great role in a decent company a few months later with no previous professional experience. The courses are mostly entry level, but they gave me just enough motivation and knowledge to create my own apps, which I feel is the real reason I was hired.

The difficulty come from having no prior professional experience, so showing that you can design, build and ship a project in your own time really helps you to stand out.

The only thing about the course that you linked is that its not specific to a certain field. I would suggest that you try a couple of different courses and find a subject / stack which really interests you, then build small but increasingly more complex projects using what you've learnt.

I list the courses I've completed along with links to any verified certificates on my resume, but not once have they been referenced in interviews.. It's always the projects that make me stand out.

I'd be happy to answer any other questions you have! Also, the forums are also great place to meet like minded people!

<comment><USER6> Is it possible to see what projects you had on your portfolio when you were hired and what courses you took? Just to have a better idea about your story and the possibilities.

<comment><USER5> Sure, sorry for the delay. I built an extremely basic portfolio website to show all the apps and describe them, however it's no longer online and I've lost the assets unfortunately.

Projects Listed: Birthday Reminder App ([https://github.com/Julesssss/BirthdayReminder](https://github.com/Julesssss/BirthdayReminder)) & Podcast Player ([https://github.com/Julesssss/PodcastPlayer](https://github.com/Julesssss/PodcastPlayer))

Followed by all the apps I created as part of the courses below. They were all basic apps, I just listed what I learnt and added a few screenshots. At the end of the courses you'll have a nice amount of projects to show off.

Courses: [https://www.mooc-list.com/course/creative-serious-and- playfu...](https://www.mooc-list.com/course/creative-serious-and-playful- science-android-apps-coursera) (No longer available), [https://www.coursera.org/learn/android- programming](https://www.coursera.org/learn/android-programming), [https://www.coursera.org/learn/android- programming-2](https://www.coursera.org/learn/android-programming-2), Followed by a couple of these beginner courses: [https://www.udacity.com/courses/android](https://www.udacity.com/courses/android)

</comment></comment></comment><comment><USER7> Not sure if this is the anecdote you're looking for, but my spouse did a few online Python classes, decided she enjoys it, and enrolled in a coding bootcamp. She's set to graduate in a couple weeks and already has an offer.

</comment><comment><USER8> I teach online courses and have had students report back to me that the course helped them get a job or pass an interview, but it's pretty much always in addition to their own self study and experience. an online course can definitely help you get a job, but it alone probably won't be enough. although more and more I see online courses or degrees that guarantee a job or your money back, do that might be with checking out.

</comment><comment><USER9> Yes, for many people!

How do I know? I am actually building FirstDevJob and am interviewing such people. I have published two interviews[0][1] with people who used FreeCodeCamp. More are in the pipeline!

It is absolutely possible. But just don't depend on one course or site. Be flexible and willing to learn from many different places to develop your skills enough to land a job.

[0] [https://firstdevjob.com/stories/dan- minshew/](https://firstdevjob.com/stories/dan-minshew/)

[1] [https://firstdevjob.com/stories/taylor- milliman/](https://firstdevjob.com/stories/taylor-milliman/)

</comment><comment><USER10> Anecdotally, I get many, many emails from people who have taken my React courses on Udemy ([https://www.udemy.com/user/sgslo/](https://www.udemy.com/user/sgslo/)) and go on to get jobs. They generally have some previous programming experience, but I assume if they are taking the time to write me an email then they figure the course helped them.

<comment><USER11> I am one of those people! Thanks!

</comment></comment><comment><USER12> I've done a lot of online classes, and I have a job. But I also have 15+ years of experience as a developer, so it would be hard to suss out exactly which attributes did or didn't contribute to my successful candidacy the last couple of times I changed jobs. Subjectively, I feel like that stuff helped, but it's hard to be sure.</comment>


As Cars Collect More Data, Companies Try to Move It All Faster - <AUTHOR> https://www.nytimes.com/2018/08/16/business/cars-internal-data-networks.html <comment><USER2> Not even a mention of Thunderbolt? Surely the distance could be boosted (is 3m the limit? quick search didn't say), rather than make a whole new protocol from scratch.

<comment><USER3> With this much money at stake it will be committee'd to death and a new underwhelming standard will be upon us...

</comment></comment><comment> King-Aaron At least a carburettor doesn't breach GDPR.

</comment><comment><USER4> They shouldn't be collecting the surveillance data in the first place. It's an abuse of our freedom.</comment>


Cassandra cluster that spans 3 different network domains with 2 shell commands - <AUTHOR> http://weaveblog.com/2014/10/08/i-just-created-a-cassandra-cluster-that-spans-3-different-network-domains-by-using-2-simple-shell-commands-how-cool-is-that/

<comment><USER2> Pretty cool demonstration of Weave[1]. Is it correct to summarize Weave as "Hamachi for Docker containers"? For those that don't remember Hamachi, perhaps "VPN for Docker containers" is a more contemporary technical description.

[1] [https://github.com/zettio/weave](https://github.com/zettio/weave)

EDIT: I know this was just a proof-of-concept, but I believe if one were to bring up a multi-datacenter Cassandra ring, you'll want to ensure your replication configuration is "NetworkTopologyStrategy" and not the default "SimpleStrategy" setting[2].

[2] [http://www.datastax.com/documentation/cassandra/2.0/cassandr...](http://www.datastax.com/documentation/cassandra/2.0/cassandra/architecture/architectureDataDistributeReplication_c.html)

<comment><USER3> I think VPN is a use case for SDN. Weave is fundamentally a software network that provides a virtual switch at layer 2.</comment></comment>


Show HN: CarHunting – The smartest place to find your next car (UK) - <AUTHOR> https://carhunting.co.uk <comment><AUTHOR> Hi guys,

I'm Chris and I just wanted to show something I've been working on in the evenings between nappy changes.

Due to these nappy changes development is slow going, but so far the feedback I've received has been positive.

I'd love to get some feedback from some of you serial car buyers as to whether you would find a tool like this useful.

Thanks!</comment>


The war to sell you a mattress - <AUTHOR> https://www.fastcompany.com/3065928/sleepopolis-casper-bloggers-lawsuits-underside-of-the-mattress-wars <comment><USER2> The business models for pricing aggregators and reviews sites are completely absent. Even Consumer Reports struggles to meet the costs of testing and staffing. The BBB is a mess. The "Good Housekeeping Seal of Approval" hasn't meant anything for decades.

It's a sad state of affairs: We all want unbiased reviews, but we won't pay for them. We all want to know the spread of prices so we can balance service/trust with cheap, but price aggregators are all either blocked out of existence or become affiliate listings.

While so many things have come true, there are still a few internet dreams like free-flow price summaries and wisdom-of-the-honest-crowd which are sadly still just beyond our grasp.

<comment><USER3> The problem goes deep.

I recently decided to get a Consumer Reports subscription after not having one for 10 years. I used it to find the absolute BEST dishwasher.

But because their rating system is a little strange, and they don't exactly tell you BUY THIS, DONT BUY THAT, I ended up with a Dishwasher I hate. It was the most expensive, and best according to CR, but I cannot express how miserable this piece of junk makes me.

Then I look at the FREE reviews on Amazon, where I see many people who have the exact same issues as me. Why did I pay for Consumer Reports? According to their "tests" this dishwasher might last 20 years or something amazing like that, but for what I care about it sucks, its hard to use, and it doesn't dry dishes AT ALL.

I want to fund unbiased reviews, but I also need Consumer Reports or others to step up their game on providing information that is actually useful and changes my experience as a buyer.

<comment><USER4> A dozen years ago, I had a house built, and I bought all the appliances myself. I thought I would research the market, find the sweet spot, and get a good deal through a specialty appliance store because I was getting everything at once. Boy, was I wrong.

I subscribed to Consumer Reports online, and came up with what I thought was the right brand: GE "Gold". I bought everything in the line: stove, microwave, dishwasher, refrigerator, washer, and dryer. Within 5 years, the washer and dryer had both been replaced, almost all the plastic accessories on the fridge had broken, the stove's convection fan failed, and one of the rails on the storage pan fell off, several screws fell out of the dishwasher before I ever started noticing, and the silverware tray broke, and I couldn't keep microwave lights working.

What I finally figured out was that ALL of the stuff CR is reviewing is made by a few companies, and it's ALL crap. They make it seem like you can buy something "good" by paying twice as much, but even if CR is truly impartial, there's no material difference. I got more years of service out of the second- hand, refurbished, mismatched washer and dryer that I bought from the ratty converted house/shop on 3rd street than I got out of the "higher" end models, and paid 1/4 of the price.

And I'll tell you something else for free: it was damn refreshing to hear the guy who FIXES UP appliances for a living tell me he wouldn't even take my old units off my hands to refurbish -- for free -- because they really were total junk. Talk about salt on the wound! Find a local guy who does this and ask HIM what you should buy; not Consumer Frickin' Reports.

Before I was born, my parents went to Sears, and bought a "good" Kenmore washer and dryer. They lasted almost 30 years, till they couldn't get some replacement part for the dryer. I've concluded that the only way to get this level of quality is to buy "commercial" kit, and pay TEN times as much.

<comment><USER5> > I got more years of service out of the second-hand, refurbished, mismatched > washer and dryer that I bought from the ratty converted house/shop on 3rd > street than I got out of the "higher" end models, and paid 1/4 of the price.

I think that's one misperception. High end anything models aren't high end because they're more reliable - they're high end because they have more features or more expensive finishes, but have more complexity to go wrong. It's true of cars too.. My pet theory is the most reliable model is the highest volume model because the company doesn't want to get eaten by support costs.

I bought a low-end GE twenty years ago and it kept going with fairly easy parts repair on anything that wore out. But it was a very basic washer. I did eventually replace it with a higher end washer from another company - but I had to make my peace that I was getting low-water use and more complexity while likely giving up reliability. My wife and I have fantasized about starting an appliance company that values repairability and reliability without high-end features, but quality materials ...

<comment><USER6> > they're high end because they have more features or more expensive finishes, > but have more complexity to go wrong

Sigh, this describes my recent tech purchases to a T. New wireless headphones? More trouble than I had with wired cans in five years, at 3.5x the cost. My first laptop with a dedicated GPU? More glitches than my Intel-only MacBook Air ever had, at 2x the cost. €120 speakers? Their wired "desktop remote" was so dumb that I returned them and bought used €11 speakers on a craigslist clone. (I actually think they sound better.)

I spent at least a day reading reviews for each purchase, too.

On the upside, I will save lots of money by never treating myself to "nice tech" again.

</comment></comment></comment></comment></comment><comment><USER7> Amazing to see people stumbling upon millions. Most techies are trying to come up with clever technical solutions to try and build an online business. Whilst elsewhere there are people making millions from reviewing mattresses. Or whatever the next accidental hot market will be.

<comment><USER8> Review sites in any niche industry can be extremely popular. I am a guitarist, and there are a LOT of blogs and Youtube channel reviewing guitars, amps and pedals. Most are pretty boring, technical reviews which aren't all bad, but get a handful of views.

Then there are the channels that thrive on drama and conflict. One particular guitar reviewer is an older chap, with questionable playing skills and knowledge, but he excels in riling up companies, which in turn leads to more publicity and views for him.

He is well known for taking expensive electronic gear apart and saying things like "I can't believe they charge $2000 for this guitar effects processor when I know the motherboard and DSP chips on here only cost $200... etc.". When the company refutes these claims or tried to explain, he shuts them down with demands for payment to remove his negative reviews etc.

We cannot expect much more though - a whole generation of audience has been trained to seek out such drama and negative energy and latch on to it like a remora to a shark.

<comment><USER9> Yeah basically he is committing extortion and blackmail, pretty sad.

<comment><USER10> More accurately, he's accepting bribes to silence his freedom of speech. He's entirely in his right to have negative reviews as long as they're truthful.

<comment><USER11> That's blackmail. Making a legal threat and making a legal money request combine into an illegal act.

<comment><USER12> What law says I can't give you an incentive to stop badmouthing me?

According to this link, defamation - written (libelous) or verbal (derogatory) - is a civil matter and not a crime.

[https://www.nolo.com/legal-encyclopedia/defamation-law- made-...](https://www.nolo.com/legal-encyclopedia/defamation-law-made- simple-29718.html)

<comment><USER13> See this page[1] for a detailed explanation, which explains that under most extortion laws, the threatened act may be perfectly legal (like leaking photos of someone in a compromised position). It becomes illegal if the threatened act would "harm" the victim and you demand money in exchange for not doing it. (Legally, harm has a _very broad_ scope, and can include loss of reputation.)

[edit] Note that what this YTer is doing would probably not be extortion under California law as long as his claims are truthful, as he has _already_ posted the videos, and is only demanding money to take them down.

[1] [https://www.shouselaw.com/extortion.html](https://www.shouselaw.com/extortion.html)

<comment><USER12> Agree (regarding your edit.)

The guy posted an opinion. The company weighed the costs of refuting his opinion or paying him to shut up. I don't think this is blackmail or extortion. How an opinion can be construed as defamatory I fail to see.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> The whole mattress industry is a scam. Actual manufacturing cost is $75-$300. Mattresses are even cheaper on Alibaba. Vacuum-packing memory foam shrinks mattresses for shipping, and now they can be imported easily.

If you really want to annoy the US mattress industry, set up a review site and review sub-$100 mattresses off Alibaba.

(Personally, I have an air bed which cost about $200.)

<comment><USER15> Personally I question visco-elastic foam. Sure, it's cheap and may be ok for a lot of people, but _I_ personally sleep better on an standard spring bed.

Foam mattresses don't breathe, they stink (some mattress I've seen are 1+ yr old and continue to stink) and aren't firm enough for me.

Do any online retailers sell standard beds? Or am I a dinosaur?

<comment><USER16> My brother has a foam mattress in his guest room. He found it on Craigslist (it was someone's unused guest bed), used it himself for several years, then replaced it with a larger spring mattress.

I can't stand sleeping on the foam mattress for more than a night or two. When I wake up it's like I've sunk into the foam and have been immobilized for hours. People are supposed to be able to move when they sleep.

He's since gotten an air bed for the other room, and I choose that one when I go to visit.

<comment><USER17> Memory foam seems like terrible idea to me unless you are immobilized for some untelated reason.

But I absolutely love latex foam. You can move easily during sleep and every position is comfortable. It lasts forever.

</comment></comment></comment></comment><comment><USER18> The irony here being, after I read this article, I'm now seeing ads for mattresses all over the web due to the embedded ads in the article. Marketing and advertising feels more like a virus than anything these days.

<comment><USER19> The only way is to blur your analytics. Move out of Google/Facebook. Install Ad Nauseam extension to not just block tracking but click on everything in the background. This will ruin the information they gather about you with noise.

[https://adnauseam.io/](https://adnauseam.io/)

<comment><USER20> Not really, just use a real adblocker and move on with your life. Adtech has plenty of problems but this kind of silly abuse is easily caught and filtered out with no effort. You might even cause yourself more annoyance with fraud and spam prevention tools used with common services.

<comment><USER21> >this kind of silly abuse is easily caught and filtered out with no effort

Not an AdNauseum user myself, but how can we tell this isn't ad industry FUD? They would certainly have a vested interest in discouraging the practice.

If nothing else at least AdNauseum can contribute somewhat to bandwidth and administrative costs.

<comment><USER20> Because it's one of the most data driven industries with petabytes generated everyday of actual user behavior so abnormal usage, especially wild clicks, are among the easiest to catch.

Bandwidth costs would be a few extra bytes and you would likely only hurt yourself if using a metered connection. There are 0 extra admin costs.

If you don't like the ads then avoid the site, but if you must still access the content the use an ad blocker because loading ads just to falsely click on them only generates a stronger signal than usual.

</comment></comment></comment></comment></comment><comment><USER22> I've found Ikea to be a great place to buy a mattress. No shady sales tactics or aggressive salesmen, several models you can physically try out in the store, and good quality/value.

<comment><USER23> I went in there a couple of years ago, and bought a full-sized Sultan Havberg after trying a few out (it looks like they don't sell this anymore, but you can find it in their product catalog - [http://www.ikea.com/ms/en_US/pdf/buying_guides_fy15/Mattress...](http://www.ikea.com/ms/en_US/pdf/buying_guides_fy15/Mattresses_bg.pdf))

At the time it felt fine, but when it arrived I found it nearly impossible to sleep on. I could feel the springs pressing into me as I inevitably rolled around over them. I guess you get what you pay for.

Fortunately a friend of mine whose girlfriend was moving in was giving away a memory foam mattress topper, which has turned it from one of the worse beds I've owned into the best bed I've owned.

It's really hard to anticipate how a mattress will actually feel when you try to sleep on it, and I recommend not skimping on one.

<comment><USER24> Next time ask the IKEA staff which one they buy. I forgot the name, but I bought one after a clerk in that department said, "We all own this one." It's amazing. Sometimes I wake up in the morning marveling at how comfortable I was.

<comment><USER17> Not sure if that's the one but I bought Hamnvik there. It was so nice that right after carying it up to our 3rd floor me and my girlfriend fell aslep on it in the middle of the day for no reason. Unfortunately it lasted just few years. They have 10 years warranty though.

<comment><USER25> > me and my girlfriend fell aslep on it in the middle of the day for no > reason. Unfortunately it lasted just few years

I love that an un-careful reading of this accidentally implies a Rip Van Winkle style experience, where you and your GF fell asleep for a few years.

</comment></comment></comment></comment></comment><comment><USER26> There is similar situation in the diamond engagement ring market, of all places! NiceIce, Beyond4Cs, Yourdiamondteacher, ProsumerDiamonds -- all affiliate marketing blogs that drive a lot of sales. No lawsuit yet to reveal the inner workings, but undoubtedly there is the same shadiness.

<comment><USER27> The whole jewelry diamond market is shady and should be boycotted. It is a shame that many still fall for the marketing and think diamonds are rare

<comment><USER28> The fact diamonds can't be tracked means they're all, effectively, blood diamonds, given that everyone in the chain has a huge incentive for people to believe they're not and absolutely nobody has any incentive to tell the truth about them if they are.

Lying about whether a diamonds is a blood diamond is the only move which makes sense, so everyone must assume every diamond is a blood diamond, as it is impossible to prove otherwise.

<comment><USER29> Owners of non conflict diamonds have an incentive to demonstrate otherwise.

However, the massive diamond glut means DeBeers has an incentive to buy up conflict diamond using proceeds from regular diamond sales. Which arguably makes all natural diamonds blood diamonds more directly.

<comment><USER28> > Owners of non conflict diamonds have an incentive to demonstrate otherwise.

Right, but because diamonds can't be tracked, they're indistinguishable from the good liars who want to pass off blood diamonds as good ones.

> However, the massive diamond glut means DeBeers has an incentive to buy up > conflict diamond using proceeds from regular diamond sales. Which arguably > makes all natural diamonds blood diamonds more directly.

This is also a very good point.

<comment><USER30> >diamonds can't be tracked //

That's a little surprising to me, don't minerals usually have characteristic chemical fingerprints that allow them to be located once the "fingerprint" has been established?

Doing a quick search now, eg [https://cen.acs.org/articles/90/i18/Fingerprinting- Conflict-...](https://cen.acs.org/articles/90/i18/Fingerprinting-Conflict- Minerals.html), suggests I'm right in this assumption?

<comment><USER28> That's a proposal, one, and, two, it doesn't mention anything about diamonds being tracked that way, only other ores. An important thing to do, but not entirely relevant to the discussion at hand.

My knowledge comes from my knowledge of what people have said about Brilliant Earth, which charges a premium based on the notion that its diamonds come from Canada.

[https://iwantwhatitsworth.com/blog/brilliant-earth- diamond-s...](https://iwantwhatitsworth.com/blog/brilliant-earth-diamond- scam/)

> Small problem: Everyone who's worked in the diamond industry—for more than a > week—knows tracking diamonds all the way to the mine is flat out impossible.

The only other info I can find says that diamonds _could theoretically_ be tracked, but not in any way which implies they'd be tracked _chemically_ , just that they could be tracked through a supply chain, in a way ultimately dependent on the goodwill and honesty of the diamond industry

[https://www.jckonline.com/editorial-article/brilliant- earth-...](https://www.jckonline.com/editorial-article/brilliant-earth-and- that-video/)

> Second, the video is incorrect when it states baldly, "Diamonds can't be > tracked." It is true, there is nothing gemologically in a diamond that > offers any proof of origin, as there sometimes is with colored stones. But > there is no reason that diamonds can't be tracked. Bananas are tracked. > Coffee is tracked.

> If a manufacturer buys directly from a specific mine, establishing a > diamond's origin should be relatively easy. All it has to do is segregate > those specific goods and then make its systems open to audit. For an extra 2 > to 3 percent, I can't imagine many manufacturers would have much problem > doing that. (There are probably some manufacturers that would eat the > diamonds if it meant an extra 2 to 3 percent. But that's another story.)

> So just because diamonds haven't been tracked traditionally doesn't mean > that is not possible—or that companies aren't currently doing it. In > addition to Brilliant Earth, the Forevermark, Canadamark, and Rio Tinto's > new Canadian and Australian diamond programs all make provenance claims.

I think I've made my case as to why I doubt this would be sufficient.

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> The mattress industry is a total scam. Nest Bedding's CEO, the one that was quoted in the article, even goes so far as to threaten people who post negative reviews on Yelp. I left a one-star review on their website, but it doesn't even appear in their product ratings. The ratings distribution on Nest's website is statistically impossible!

Other companies aren't any better. Casper cheapened the materials used in their mattress, but is still riding on positive reviews for the original model which used latex (more expensive) as a top layer.

</comment><comment><USER32> Why is everything a "war" in the American media? war on obesity, war on diabetes, war on this, war on that...?

It is just businesses competing to sell products - maybe a little too interested in suing, but business nevertheless.

<comment><USER33> It's really unfortunate. There's a great book called Metaphors We Live By [1] that digs into this same observation, using "arguments" as an example: you "attack" another person's argument, you "defend your point." You either win or lose. We could have just as easily chosen arguments to be a dance instead of a war.

A lot of narrative here in America eventually turns into good vs. evil, and War on X is an example of that. I've heard people attribute this to anything from religion, to the revolutionary origin of the country, to military- industrial conspiracy.

[1]: [http://press.uchicago.edu/ucp/books/book/chicago/M/bo3637992...](http://press.uchicago.edu/ucp/books/book/chicago/M/bo3637992.html)

<comment><USER30> >We could have just as easily chosen arguments to be a dance instead of a war.//

I don't see how that works - partners dancing together are cooperating to improve the outcome. Those competing in business are (unfortunately, in capitalist systems) almost always trying to profit and destroy their competitors. It's perhaps a bit like moshing?

War fits as a better metaphor for companies under capitalism.

If the companies were helping each other and targeting better products with less profit, that would be more like dance partners.

<comment><USER34> Companies help each other all the time; it's called "collusion," and it's usually frowned upon.

</comment></comment></comment></comment><comment><USER35> Now this made me thinking of other online review sites. Are they all like that?

I couldn't give an honest review, if I get more money from B than A. So if they state otherwise, I call it fraud And I know that's what people call marketing in general and there might be some truth in it - but that's why you go to these review site to get a neutral view.

So normally the customer should pay the reviewer, he is doing work for him, because when the company pays the reviewer ...

<comment><USER36> Yes. Any online review should be taken with a huge grain of salt. The vast majority are influenced by affiliate payments.

Some, like credit cards and other financial products, are especially bad since the payments per conversion (i.e. person who looks at the review site and then signs up for the credit card) can be massive. But even seemingly innocent niche markets, like light-weight backpacking equipment, can be full of affiliate marketing.

That said, just because a blog or website is influenced by affiliate marketing doesn't mean they don't have useful information in their reviews. They usually are accurate when describing a product's basic attributes. Where they typically bend the truth is when they're comparing products against each other (the one with higher affiliate payments is almost always better), or they simply won't talk about genuinely better products that don't pay for conversions.

<comment><USER37> And they certainly won't tell you "don't buy any of these things". I recently came across BabyGearLab ([http://babygearlab.com](http://babygearlab.com)), which has nice reviews of, say, different car seats or different strollers, and will tell you which one is the best if money is no object, which one is the best if you're on a limited budget, etc. But what I really want is the web site that will tell me "you don't need a smart sock". Yes, that's a thing.

Of course I can just not buy a smart sock. But I pretty much know that at some point I'm going to buy some thing that's almost as useless because it's for the baby.

</comment></comment></comment><comment><USER38> If you want to make a lot of money - place yourself between the consumers and the producers.

<comment><USER39> Why isn't everybody doing this then?

<comment><USER38> I did not say it would be easy ... Only that it's easier then producing and selling the products/services/needs yourself. It will take much less work if you figure out a clever way to stand in-between.

<comment><USER39> Ah. Sorta like consultancy.

</comment></comment></comment></comment><comment><USER40> I'm shocked that no one has posted [https://www.themattressunderground.com/](https://www.themattressunderground.com/) yet. It is totally worth a look. The amount of technical detail is right up HN's alley.

Full disclosure: I paid nothing to the site, but used it to find a local mattress shop (and manufacturer) and purchased a mid-range queen mattress at a good price. Apparently the shop owner had received quite a few referrals from them, but he never paid them or received any payment from them.

</comment><comment><USER41> How do you make the switch to foam mattresses? They just feel so strange and different compared to regular mattresses?

<comment><USER42> Foam actually lacks the support of a traditional mattress. If you do end up making a switch, take a look at your typical sleeping position. Medium firm is good for side sleepers and firmest you can find is better for your back but honestly inner spring is best for your back.

<comment><USER30> I've suffered with backpain for almost a decade, a new foam mattress (Ikea) replacing a spring mattress seems to have helped a lot. It's a supportive foam with a memory foam top; firmer than the sprung mattress.

The only downside is, err, it doesn't bounce when you want to bounce, if y' catch my drift.

It feels quite different, definitely warmer (not a problem in UK), took a few days to get used to.

</comment></comment></comment><comment><USER8> The whole online mattress industry has a bit of a stink to it. Here in Australia, I have been stalked for months by a particular brand of online mattress, Koala(?), on my Facebook feed, which I ignored, but on the past few weeks, I see the SAME ads on FB with the SAME girl in them etc., sold as a completely new brand.

I assume the original company either went bankrupt or received a C&D from somewhere and had to change their name. But this does nothing at all to increase my confidence in these online sellers. Welcome to the Cialis of 2017...

<comment><USER43> Koala is still about. But seems like lots of similar ones popping up as well. Apparently all made in same factory? No idea if that is true or not

</comment></comment><comment><USER44> What does YC think of companies that make affiliate revenue? Is it a positive or a negative in the VC world?

<comment><USER39> Isn't affiliation a sort of a pyramid scheme? Oh sorry .. multi level marketing .. ?

<comment><USER45> No. Affiliate sales is just a basic "every sale you send my way, you make some money" arrangement, different only from traditional commissioned sales in that the affiliates usually don't work "directly" for the company selling the product.

Multi level marketing (MLM) schemes are situations in which people make money, or are promised money, based on their ability to _recruit additional affiliate salespeople_. The typical MLM pitch is "if you sell product X, we'll give you a (typically huge) sum of money, and also if you convince someone else to enter into this same agreement, we'll give you a different (usually smaller) sum of money, and what's more you'll get money for every sale that recruit makes, any people they recruit, and any sales they make, recursively on down the tree."

The con is usually in the fact that product X is difficult née impossible to sell, and that entering into such an agreement in the first place requires payment into the scheme. Those factors result in the people towards the "root" of the tree making tons of money simply from the fact that more people are getting recruited and paying in at lower levels. They make money from the tree growing, even though the leaves are not making sales.

This is widely considered unethical (and illegal, in some cases) since its primary profit engine is recruitment under usually-false pretenses. MLM can be practiced ethically _between a given two parties_ , but usually only makes money due to subsequent unethical practices (e.g. one seasoned affiliate marketeer agrees to be a recruit of another such seasoned salesperson in a multilevel scheme, knowing full well the behavior of the scheme; they then both go on to enrich themselves and each other by shilling unsuspecting rubes with the typical "you can work your own hours, get tons of money, and, if you grow your network big enough, rake in the cash while your recruits do all the hard work!" sell concealing the "...for a nominal [signup|monthly|etc] fee" hook).

Edit: removed accidentally repeated repeated words.

<comment><USER39> Great reply. Thank you very much!

>based on their ability to recruit additional affiliate salespeople

If Casper took owership of every outstanding matress review website there is and ever will be (or made some of their own in the pocess and have it high ranked, whichever is the cheapest form of tactics), affiliation would never be an issue. Wouldn't be ethic, but eh...

</comment></comment></comment></comment><comment><USER46> This just proves it: the worst thing a company can do is to underestimate the stupidity of its customers.

</comment><comment><USER47> This article kind of makes Casper sound like the Uber of mattress companies.

</comment><comment><USER48> Many podcasters are in the same boat, though they try to mask it. I only listen to probably 3 podcasts, but I hear the same sponsor reads on a daily basis. Casper, Fracture, Betterment, Warby-Parker, etc. The reads given by these sponsors are only guidelines, the better podcasters personalize them to make them sound like real endorsements not just ad reads.

<comment><USER42> Sadly some people can't tell the difference between a sponsored read and an endorsement precisely because they make it sound like an endorsement.

<comment><USER48> Even when you can tell the difference, it's hard to ignore the effect of someone you enjoy listening to do the read. With my favorite podcasts, I enjoy the "company" of the hosts, and have an implicit bias towards what they say. So an ad read by them is extremely effective. If it was a canned commercial like on TV, I'd be able to tune it out much more effectively.

<comment><USER49> I can't help but laugh when the guys at Pod Save America plug Square Cash and other companies

<comment><USER50> They advertise one of the non-Casper mattress brands, though. Internet mattress hipsters!

Also, two brands of internet razor. Podcasts seem to specialize in advertising things that I definitely would want to buy in an actual shop and not the internet.

</comment></comment></comment></comment></comment><comment><USER51> This reminds me a lot of the web hosting industry, which also has a huge issue with questionable review sites set up for affiliate payments and hosting companies owning supposedly neutral sites about the industry.

There are at least a few active forums you can ask about good hosting companies on (which is something the mattress buying process seems to lack), but then you have to deal with astroturfing and companies 'hinting' that you should use their service in every post.

Either way, I think these industries (and many others) are in this situation because the internet has just made good, high quality journalism unprofitable. Along with clickbait and actual lies, it seems affiliate commissions are where the money is in writing nowadays, meaning there's a huge incentive to write pandering crap and an equally large disincentive to care about being a truly helpful source for this information.

</comment><comment><USER52> This article is way too long.

<comment><USER53> Felt about right for the complexity of the story and the thoroughness of the research. I think we should be encouraging long form journalism, not falling back to click-bait news.

</comment></comment><comment><USER42> Sad thing is even with full disclosures there are vast numbers of people who will not read the disclosure. Some sites do a bang up job of making the disclosures so unnoticeable that they never lose a referral.

</comment><comment><USER54> I really knew very little about the whole affiliate marketing economy before reading this. My primary reaction after reading it is just to SMH at the fundamentally greedy acquisitive dishonesty of the whole mess. I realize it's nothing new, but still.

</comment><comment><USER55> Really interesting article but he really zoomed past the "I got a free mattress" part

</comment><comment><USER56> Fascinating read. Who would've thought to roll a massage and ship it? I grew up and still sleep on spring mattresses. No rolling here.

<comment><USER57> No, they can do it with inner springs now too.

That tech is relatively new.

<comment><USER56> Oh wow thank you, I had no idea.

</comment></comment></comment><comment><USER58> I got a $5000 queen sized latex mattress for $300 because I bought from the clearance section at [popular mattress store chain].

</comment><comment><USER59> > Much of this traffic went to Amazon (when Derek lacked a direct affiliate > relationship, he sent traffic to a brand's page on Amazon, with whom he > did).

Something is not not right here. Was Derek banned from the Amazon affiliates program? How else does he "lack a direct affiliate relationship" ? I made a viral cat videos site for kicks and was approved by amazon affiliates to link to cat product reviews... so why wouldn't someone like this guy be able to get a direct amazon.com affiliate account?

<comment><USER60> I think the author meant he lacked a direct affiliate relationship with the mattress websites. So instead of linking to the mattress websites, he linked to Amazon.

</comment></comment><comment><USER61> This was fascinating.

</comment><comment><USER62> Article sounds like infotainment to me, made to advertise mattress advertising websites. After reading that article you certainly going to remember their name.

Everything in the article is probably true, however.</comment>


How Not to Write Code pt. 2 - <AUTHOR> http://funcall.blogspot.com/2009/08/how-not-to-write-code-ii.html

<comment><USER2> thanks, cool.</comment>


Must haves to live a life worth living - <AUTHOR> http://twentysomething.nl/2013/04/must-haves-to-live-a-life-worth-living/

<comment><USER2> nice</comment>


Cargo ships are emitting boatloads of carbon, and nobody wants to take the blame - <AUTHOR> https://phys.org/news/2018-12-cargo-ships-emitting-boatloads-carbon.html <comment><USER2> If only there were a way to power a cargo ship with a renewable such as wind... /s

In all seriousness, I don't think the market would bear how slowly cargo moves under sail.

There is an extant design, a decade old now, to add a kite to merchant ships to reduce fuel consumption when steaming downwind. It reportedly works, but hasn't been adopted much past the prototype, MS Beluga Skysails.[0]

[0] [https://en.m.wikipedia.org/wiki/MS_Beluga_Skysails](https://en.m.wikipedia.org/wiki/MS_Beluga_Skysails)

<comment><USER3> [https://en.wikipedia.org/wiki/Rotor_ship](https://en.wikipedia.org/wiki/Rotor_ship)

<comment><USER4> Perhaps closer to OP's vision: [https://en.wikipedia.org/wiki/SkySails](https://en.wikipedia.org/wiki/SkySails)

<comment><USER5> Or maybe: [https://en.wikipedia.org/wiki/Nuclear_marine_propulsion](https://en.wikipedia.org/wiki/Nuclear_marine_propulsion)

</comment></comment></comment></comment><comment><USER6> Not that it should not be addressed, but it is still by far the most CO2 efficient mode of transport.

<comment><USER7> I think what might be worth addressing is why the ships need to transport things in the first place. We're always going to need them, but I think we need to be more selective about what we're transporting. It's just too much stuff.

How we do that, I have no idea. Everyone is very entitled to their consumption habits in the west.

<comment><USER8> A carbon tax is how we do it. Calculate the carbon involved in producing the item and shipping it to you, then tax it. People will decrease their consumption of high-carbon goods.

<comment><USER9> My first glimpse of how a carbon tax is in alignment with the interests of protectionist trade policy.

"Make it too expensive to produce outside of our borders."

Who knew?!

<comment><USER10> Well except that it's probably more carbon-expensive to move a container of widgets by truck from the East coast to California than it is to truck them from Mexico or by container ship from Asia.

A carbon tax designed to fairly internalize externalities will not really please protectionists.

</comment></comment></comment></comment></comment><comment><USER11> You should smell it when they're loading hundreds of tonnes of butyl acrylate.

Or as I have said on occasion, brutal acrylate.</comment>


Millennials are getting stung by back-to-back economic crises - <AUTHOR> https://www.bloomberg.com/news/articles/2020-04-08/millennials-are-getting-stung-by-back-to-back-economic-crises <comment><USER2> And other generations are living in a parallel universe with a different set of crises.

<comment><USER3> Timing matters. If the economy takes a shit as soon as you start looking for your first job, that has knock on effects. And right around the time that many millennials are just becoming able to join the housing market, the economy is going to take a shit again. The article explains this.

<comment><USER4> Just like happened to many of my friends who graduated in 2001 and then were ready to buy a house in 2008/2009\. The point above is valid, this is not special.

</comment></comment></comment><comment><USER5> doesn't feel too different from the dot com bust into the housing crisis.</comment>


Support of OpenBSD pledge(2) in programming languages - <AUTHOR> https://gist.github.com/ligurio/f6114bd1df371047dd80ea9b8a55c104 <comment><USER2> I was just listening to Theo's pledge presentation ([https://www.youtube.com/watch?v=F_7S1eqKsFk](https://www.youtube.com/watch?v=F_7S1eqKsFk)) and immediately wondered how this is applied to scripting languages.

The github link for Python seems to be a high-level wrapping of the entire Python environment itself. I was wondering if there is a way to surface pledge in an environment such as Python so that a developer could drop privileges, for example, open files for writing and then drop the privilege to open any further files.</comment>


Show HN: GDPR Shield – Block EU users from accessing your website - <AUTHOR> While I love the EU's new data privacy regulation from a user's perspective, it's a nightmare for businesses to achieve compliance, because of the (sometimes intentionally) vague language of the law. And even if you pay an experienced lawyer to draft the policies and procedures required by GDPR, there's a very real residual risk of predatory law firms collecting penalties from mass-mailed cease-and-desist letters based on technicalities. Even if your business isn't located within the EU, you are required to comply with GDPR because the location of the user matters.
I've built a tool that blocks users who are trying to access your website from within the EU as a short-cut to compliance, which makes sense if your business isn't reliant on EU users and you don't want to spend thousands in legal fees to achieve GDPR compliance.
You can check it out here: https://www.gdpr-shield.io <comment><USER2> Except GDPR also covers EU citizens outside of the EU, so this service is useless.

</comment><comment><USER3> Amazing idea. Thank you for doing this.

Indeed, I feel like europeans must prohibited from using my services, if they're making unnaceptable demands through their regulation malpractices.

</comment><comment><USER4> If that would gain popularity in the US, it were yet another for Europeans not to visit the US. You couldn't reasonably prepare your trip, because you cannot get up local businesses. Of course VPN is cheap and simple but why bother if you are not forced too. You can spend your travel money elsewhere.

</comment><comment><USER5> [https://www.gdpr-shield.io/](https://www.gdpr-shield.io/) gives me a `503 Service Unavailable`. But maybe that's the point, as I'm trying to access it from Germany?

</comment><comment><USER6> Even if I am not presently outside the EU, I might want to browse your products so that when I do go outside the EU, I will be able to buy such a product from you.

A website that would do this is a huge sign that I should look for the said product somewhere else.

<comment><AUTHOR> I recently wanted to check the menu of one of the top 10 US restaurant/cafe chains (which only has locations within the US) while I was abroad and was surprised that they block all non-US traffic. I completely agree that "actual GDPR-compliance" is always superior, but some companies have spent _months_ preparing for GDPR, involving their engineering and legal team. For some, outright avoiding the headache and potential financial fallout if they get something wrong can be the better option, even if it may mean losing a few potential customers.

</comment></comment><comment><USER7> I would use this for my websitew, which get few EU visitors;however, it'll be cheaper to just use [https://www.maxmind.com/en/geoip2-databases](https://www.maxmind.com/en/geoip2-databases) which I was hoping to avoid, but this is too pricey to be worth it when we can simply code a bit and have pay a lower fee.

</comment><comment><USER8> Lol.</comment>


A Brief History of Hardware Accelerated Decoding on Macs - <AUTHOR> http://www.objc.io/issue-23/videotoolbox.html

<comment><USER2> Small point, the article mentions Apple's QuickTime as the first software only video system.

I seem to remember at the time that Acorn's Replay video codec had been around for a few years prior to QuickTime.

Replay was designed by Sophie Wilson who also designed the original ARM instruction set whilst at Acorn.

</comment><comment><USER3> Nice info.

The article mention 3 SDKs, 10.6 10.8 and 10.10, what is the oldest Mac OS version allowing to use the Video Toolbox framework ?

Will using the higher level API AV foundation also give hardware acceleration ?

</comment><comment><USER3> There are 2 links at the end of the article but you can only download them if you went to WWDC…

</comment><comment><USER4> The title should perhaps mention that it's about video decoding.

</comment><comment><USER5> I badly need this info! Thanks</comment>


Geologic Atlas of the Moon - <AUTHOR> http://butdoesitfloat.com/The-prevailing-hypothesis-today-is-that-the-Moon-formed-after-a-Mars

<comment><USER2> This is the actual link: [http://www.lpi.usra.edu/resources/mapcatalog/usgs/](http://www.lpi.usra.edu/resources/mapcatalog/usgs/)

</comment><comment><USER3> This is also available in Google Earth's Moon Mode. Switch to 'Moon', then select the layer 'Geologic Charts' under Moon Gallery -> Historic Maps. Click on each tile will bring up the original USGS sheet which can be viewed in high detail.

</comment><comment><USER4> any ideas on what this is useful for? I know this probably has thousands of different applications -- but was wondering what people are most excited to use this for?

<comment><USER5> I plan to just stare at it because I find it intently interesting.</comment></comment>


Do you want some Belle with your ReactJS? - <AUTHOR> https://www.startersquad.com/blog/you-need-to-belle-with-reactjs/

<comment><USER2> Built with ❤ on Planet Earth :)

</comment><comment><USER3> Awesome library.</comment>


What Jesus' page can tell us about Wikipedia's history - <AUTHOR> http://www.slate.com/id/2281294/

<comment><USER2> _Many edits were now being struck down by Jesus's loyal defenders because they're "NPOV" —a Wikipedia term for "non-neutral point-of-view."_

Incorrect. It actually stands for "Neutral point of view". ( [https://secure.wikimedia.org/wikipedia/en/wiki/Wikipedia:Neu...](https://secure.wikimedia.org/wikipedia/en/wiki/Wikipedia:Neutral_point_of_view) )

Nonetheless, a small detail in an interesting article.</comment>