How the Winklevoss Twins Found Vindication in a Bitcoin Fortune - <AUTHOR> https://www.nytimes.com/2017/12/19/technology/bitcoin-winklevoss-twins.html?hp&action=click&pgtype=Homepage&clickSource=story-heading&module=second-column-region&region=top-news&WT.nav=top-news&_r=0 <comment><USER2> I think the Winklevoss twins were rightly ridiculed for thinking they invented Facebook. However, they've made two prescient bets and deserve credit for those: (1) Getting Facebook stock instead of cash as part of their legal settlement; (2) Not only seeing bitcoin's future potential, but investing in it and sticking with it. While the final result on the second one is still TBD, they deserve credit for investing in something at a time when many thought they were stupid for doing so.

<comment><USER3> The deserve credit for what? For getting lucky on FB settlement and BTC rise? I mean, it's not like they actually built something meaningful and productive... Not sure how much "credit" they deserve.

<comment><USER4> They didn't just buy btc and sit on it. They also contributed greatly to the ecosystem. They built and run the Gemini Bitcoin exchange, they are trying to get a Bitcoin ETF approved, the CBOE bases their futures pricing on mechanisms they put in place. They have done a ton and built a ton.

</comment></comment></comment><comment><USER5> >> They said they might look at selling when the value of all the Bitcoin in circulation approaches the value of all gold in the world — some $7 trillion or $8 trillion compared with the $310 billion value of all Bitcoin on Tuesday — given that they think Bitcoin is set to replace gold as a rare commodity. But then Tyler Winklevoss questioned even that, pointing out the ways that he believes Bitcoin is better than gold.

I found this to be the most fascinating part of the article.

<comment><USER6> That's quite a balony.

\- Both are in fixed quantity so none is more rare than other.

\- Gold has practical use in industry which puts lower bound on its value. BTC has no lower bound.

\- Gold is exchangeable virtually in any country and any culture regardless of how technologically advanced that society is.

\- Thousands of years of history has proven that humans have almost natural lust for this shiny metal and it gets displayed as jewelry uses. This again further sets the lower bound for gold prices.

\- Gold is not only rare but is virtually rust proof and can be stowed away without any advanced tech for 100s of years. BTC will be pointless if there was a natural or human made disaster and few people had electricity.

\- Gold is far more unlikely to be made illegal by governments.

\- There are no new rare metals popping up every day like whole slew of new cryptocurrencies which might fragment and trump each other. No one knows which cryptocurrency will end up dominating 10 years down the line.

\- BTC has huge risk of getting stolen and hacked because someone exploiting zero day vulnerabilities in your system even if you did everything you possibly could to keep your system safe.

\- Governments can start their secret operations to control the crypto market behind the scene, hack in to exchanges, find vulnerabilities or do dirty trades.

\- Crypto exchanges are wild west without regulations which means clever deep pocketed traders would be exploiting them by techniques like frontrunning, wash trades, willybot, spoofing etc. This enables big investors to profit at the expense of small investors.

Above arguments should make it clear that btc has very real upper bound that it can rationally reach and its most definitely less than gold market cap. Of course, big investors can juice up things in the short term but it would be impossible to sustain irrational highs on long term.

<comment><USER7> One disadvantage of gold I can think of is you cannot hide it in your head.

<comment><USER8> No one can steal it from you with 50%+1 CPU resources though.

<comment><USER9> The 51% attack allows you to double spend. It doesn't allow you to steal other people's coin.

<comment><USER10> By allowing you to double spend, it reduces confidence in coins you buy to zero, which reduces the value of all coins to zero. You still have your coins, but they aren't worth anything.

<comment><USER9> Which is exactly why no one would spend the crazy amounts of money it takes to execute a 51% attack. It would be like self-immolation. Billions of dollars in equipment and energy and you'd have 51% of a worthless network. In practice, you would have to control much more than 51% of the network, because you'd have to catch up to the 49% that are still hashing away.

<comment><USER11> Unless they are a government, shorted bitcoins, or own a massive stake in a competitor etc.

PS: Remember the value of Bitcoin is limited as a function of the cost of that 51% attack. If the price increases by 10x the transaction fees need to also increase by 10x or Bitcoin becomes less secure.

<comment><USER12> This idea comes back many times... but I don't see a reason why government would want to short bitcoins or disturb the market to get their hands in it.

1\. They have BEP printing press; instead of stealing or brute forcing into bitcoin and then selling the loot for $, the might as well ask Bernanke to print few thousands more sheets of 100 dollar bills (of course not legally but i'm sure there is some overprint like in any business).

2\. screwing people out of bitcoins would mean screwing US citizens as well. Why would any part of government do that just to upset Congress and get themselves in front of bunch of congresspeople for grilling? Doesn't make sense.

<comment><USER11> Government is unrelated to shorting, Governments may chose to destroy Bitcoin for the same reason the may ban it. Basically, currency controls etc.

Someone shorting Bitcoin on the other hand has an economic incentive to destroy it. The cost benefit of doing so scales with the size of their short vs the current hashing power. But, a malware writer may have access to a 51% attack briefly without owning any equipment.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Does anyone know the actual value of the money put into bitcoin so far vs this market cap of recent sale price x count? I'm keen to know actually how many people could withdraw at similar sale prices to now before it evaporated.

Because it's so exponential, I would imagine a rapid sale of 5% would remove 90% of the value, but I'd love to know the specifics.

<comment><USER14> Bank of America and Bitcoin both have market caps of ~$290 billion. Bank of America usually sees huge trading volume for a stock and it traded about $1.8 billion of volume today. BTC/USD alone has done $3 billion today.

I realize it's not a perfect comparison, but I think it highlights the fact that large sales aren't going to just decimate bitcoin's value.

<comment><USER15> > BTC/USD alone has done $3 billion today.

Given those figures come from the completely unregulated, unaudited, incredibly sketchy exchanges themselves, I would take that with a huge grain of salt. Odds are good a vast majority of that $3 billion is trades using funny money or, for all you know, made up out of thin air. Easy to just trade with yourself all day...

</comment></comment></comment><comment><USER16> This seems like a good indicator of a bubble. Everyone and their uncle knows a crash is coming, and these guys are shooting nonsense about regret and disappointment.

1b is a lot of money. Even for these guys.

<comment><USER17> > Everyone and their uncle knows a crash is coming

A crash is always coming. Be it stock market or bitcoin. Everyone knows that but nobody knows when. It is just like saying we all are gonna die. Nobody knows when.

<comment><USER16> True, but someone with an end stage terminal illness shouldn't buy a car.

<comment><USER18> I'd say that's the best to buy a lambo.

<comment><USER19> especially on credit

</comment></comment></comment></comment></comment><comment><USER20> How will quantum computing impact crypto currencies? Isn't the scarcity based on the slow rate of mining, aka crypto hashing? Seems like its going to be due for some serious future disruption.

Until we can find a way to manufacture gold atoms on a mass scale at least gold will continue to be scarce.

<comment><USER21> I had the same thought as you but then have a look at the Etherium fork, the Bitcoin fork etc.

Bitcoin isn't the original white paper, to be carried on into infinity. Bitcoin is a brand. The white paper(s) and code can change (while honouring historic transactions) and adapt to changes in crypto, but you are still holding bitcoin, you are still buying and transaction bitcoin.

The word Bitcoin is essentially a "pointer" to the current accepted bitcoin implementation.

</comment></comment><comment><USER22> Has anyone ever tried to sell a billion dollars worth of Bitcoins and collected?

<comment><USER23> Novogratz sold $250M of Ethereum earlier this year when the market cap was $25-35B.

Bitcoin market cap is $291 billion right now and the trade volume an order of magnitude higher. So pretty sure they wouldn't have much problem unloading their position.

<comment><USER24> > trade volume

is not the same thing as liquidity

<comment><USER23> They are linked very closely, especially with a volatile market like crypto. Besides, the volume is 10x what it was when Novogratz unloaded $250M on a smaller market cap. A billion would certainly move the price, but it doesn't appear it would crash it.

<comment><USER24> I was playing around with automated trading algorithms this summer on GDAX. With a bankroll of only $2.5k USD I was routinely contributing $500k+ worth of trading volume each day (that's only 100 r/t trades with $2.5k).

Surely there's a lot more sophisticated high-volume trading algorithms taking place than what I did.

Take a look at GDAX's full book [1] -- Even going all the way down to a BTC price of $8600 (-50% current prices), there's only outstanding buy orders to consume 5169 BTC if someone entered a market sell order. Obviously that would trigger a lot of automated trades that don't live on the book but I think the assumption that "trading volume" == "liquidity" is very dangerous.

[1] [https://api.gdax.com/products/BTC- USD/book?level=3](https://api.gdax.com/products/BTC-USD/book?level=3)

<comment><USER25> It's been so crazy to see things like that just papered over in thread after thread. People talk about trading volume as though they have the faintest idea what the true, non manipulative volume is. The term "market cap" being thrown around as though anything remotely close to the figure could be realized.

I'm starting to lose sympathy for the people who are ultimately going to get hurt when this crashes. The signs are not hard to see at all.

<comment><USER15> > The signs are not hard to see at all.

Oh but this time it's different™

Seriously though, given all these trades occur on god knows what kind of sketchy exchanges for all we know half that stuff is literally random inserts in a database with no bearing in reality at all. Toss in "innovative" things like Tether and who really knows what the true value of BTC is.

This stuff is gonna fail, and fail hard. Hopefully for good. BTC and the whole crypto bandwagon is a massive, _massive_ waste of energy.

</comment></comment></comment></comment></comment></comment></comment><comment> brian-armstrong The hilarious thing is, they're not liquidating. So they may in fact lose it all in the end. Not diversifying at the current prices can only be seen as insane.

<comment><USER26> Also, selling this many bitcoin at this time is a delicate thing. The sane thing to do is offload the tulip bulbs before the market collapses, yet offloading all of the bulbs at once might flood the market and trigger the collapse.

No matter what, they'll not be able to exchange all of their imaginary wealth to real wealth but they'll definitely make a killing. Unless they really intend to go down with the ship which would be poetic in its own way.

</comment></comment><comment><USER27> The most interesting thing for ne about this article is they use a dynamic bitcoin price ticket inline. Ive never seen that in an mainstream article, it always looks so dated when looking negatively at $100 or $500 bitcoin...

</comment><comment><USER21> I hope they are good guys. I hope, if bitcoin goes up more and more, they can use their resources to help solve some of the worlds problems.

</comment><comment><USER28> A Bitcoin fortune _on paper._ It remains to be see if anyone will come out of this with real money.

I'm sure they'll still be rich. But $1.65 billion rich? Probably not.

<comment><USER29> Plenty of people already have. Even if they come out with only 10% of the value of their holdings that is still a Huge return for what they initially put into it

<comment><USER19> I suspect many people are holding BTC waiting for it to go to $400k or whatever.

</comment></comment></comment><comment><USER30> can someone tell me something i've been wondering for a couple days now (considering taking the plunge and toying around with bitcoin): how fast can you execute trades on coinbase/gdax? obviously i'm asking if i could experiment with hft-esque strategies. is that possible or the clearing time too long?

note: on a very small scale (like ~100$ total "aum")

<comment><USER31> You're gonna get killed by transaction fees.

<comment><USER32> What? Fees are 0.1%. that's nothing compared to fees for regular stocks exchanges.

I'm perfectly fine paying 10 cents for every $100 I trade.

<comment><USER33> What are the fees for regular stock exchanges?

<comment><USER34> Roughly similar: [http://nasdaqtrader.com/Trader.aspx?id=PriceListTrading2](http://nasdaqtrader.com/Trader.aspx?id=PriceListTrading2)

But GDAX is a vertically integrated exchange and retail trading platform, so the 0.1% taker fee is all you pay. A stock exchange won't talk to you directly so you must pay additional broker/clearing/bank fees.

Real all-in fees for stock can be 2 USD to trade 2k USD, so 0.1%, same as GDAX. But you can also find fees of 10 USD to trade 100k USD and many other rate examples which are either higher or lower.

I think a lot of people don't notice the huge difference between a traditional exchange (which does not handle money, only agreements about money) and GDAX (vertically integrated exchange + clearing house + trading application).

</comment></comment></comment></comment></comment><comment><USER35> Did they really post that QR code?

<comment><USER36> Interesting that it's only one of two necessary.

But given how it's posed for the photo it's (hopefully) a prop.

<comment><USER37> Or an empty address.

</comment></comment></comment><comment><USER38> Well, they were at right place at right time speaking about BTC

</comment><comment><USER39> I think they should actualize some their gains after making a 100x profit.

That's what a smart investor would do.

</comment><comment><USER40> If both items are products that store of value. If it cost 1x amount of energy to mine gold and 3x amount energy to mine bitcoins and keep it secure. Should bitcoin be value more than gold ?

<comment><USER41> I find this link it looks mine gold cost far more energy consumption. (6.6 vs 123.3 In 2016) [https://srsroccoreport.com/bitcoin-vs-gold-which-ones-a- bubb...](https://srsroccoreport.com/bitcoin-vs-gold-which-ones-a-bubble-how- much-energy-do-they-really-consume/)

</comment></comment><comment><USER42> is it liquid in the way gold is ?

<comment><USER43> Liquidity problems are an issue with exchanges, not Bitcoin itself. I can email you a Bitcoin instantly. Good luck doing that with a gold bar.

<comment><USER42> Without liquidity its point less and arguably worthless but you could transfer Gold ETFs electronically to me

<comment><USER44> BTC is pretty liquid. Tens of millions change hands hourly/daily.

The linked article even cites one hodlr that purchased a professional hockey team with his crypto profits.

<comment><USER23> $550M on just the Coinbase BTC-USD book in the past 24 hours. $1B on Bitfinex. Liquidity is currently very strong.

<comment><USER45> That is trading volume, not liquidity. And we should be wary of the trading volume on bitcoin exchanges, a lot of it is manipulated. (In particular, I would never trust any numbers coming from Bitfinex)

<comment><USER23> Ok...last 10 minutes proved your point. That was bananas.

<comment><USER45> What happened?

<comment><USER23> Coinbase added Bitcoin Cash to GDAX.

BTC plummeted from mid $17.8k to $14.9k in 15 minutes, now back to $16.6k. ETH from $857 to $700 same period, back to $771 now.

Good times...

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> Facebook's market cap is $521 Billion. So good on them but they probably should have had more of FB.</comment>


An update on Better Ads (Chrome native ad-blocking) - <AUTHOR> https://developers.google.com/web/updates/2017/12/better-ads <comment><USER2> There are no "better" ads. The only good ads are the ones I cannot see. My computer, my rules. Lately now blocking coin mining in addition to all ads, trackers, beacons, pixels, etc. I have the right to surf on my terms. Traffic to websites is a cost of doing business; don't try to recoup in ways that I never agreed to (mining), selling my data w/o my permissions, etc.

You have to love the tripe in the article: "Better ads experience..." No one enjoys the experience. No one except those in a position to make money from same. Everyday IT people and others find ads intrusive, annoying, and dangerous. Ads are a major vector for malware. Again, my rules, my computer. I've not seen an ad in many years, but I do keep up with the tech and means to keep blocking all newcoming means to circumvent my own security.

<comment><USER3> > My computer, my rules

Or maybe their website, their rules? Otherwise this is like walking into a store and telling them to take off their ads, because your eyes, your rules.

<comment><USER4> Sorry, but nobody ever promised to render your website in any specific way; my browser does whatever I programmed it to do. I might be using w3m. I might be using a browser you never heard of. I might be using a text-to-speech engine. Website owners do not get to set the rules on my machine, no matter how badly they want to.

<comment><USER3> You can put on rose-colored glasses (or AR goggles) when you walk into a store, too. I don't really see a contradiction.

<comment><USER4> Exactly: you can put on AR goggles and have them draw opaque rectangles over all the ads in the store, and there is nothing wrong with that.

</comment></comment></comment></comment></comment><comment><USER5> An attempt by Google to take over the Adblocking market and thus maintain their own whitelist which will obviously not block Adsense ads. I have already moved over to firefox

<comment><USER6> > maintain their own whitelist which will obviously not block Adsense ads

You make this sound like some kind of trick. The stated goal is to block especially obnoxious ads, of the kind adsense doesn't do.

I can't say if it's going to be fair or not, but the way it treads adsense specifically isn't going to be the deciding factor.

<comment><USER7> >The stated goal is to block especially obnoxious ads, of the kind adsense doesn't do.

Either way you think the relation goes probably depends on your opinion of Google, but I would take this as thinking backwards.

Google has lots of interest in preventing Adsense from being blocked as part of some broad-stroke policy, so everything they do as part of their adblocking policy has that in mind - wherever users prefer the Chrome native policy, Google wins. Whatever criteria gets picked for the adblocker is going to fit Adsense pretty well, or else Google loses.

If Adsense, and the ad revenue model, weren't deciding factors in introducing these partial blockers in the first place, Google wouldn't be taking the steps to implement one.

<comment><USER8> Put another way, this is an example of standard Google strategy: defend and control the approaches to the advertising river of gold.

Chrome was itself just such an investment. By controlling a major browser (eventually, the dominant browser), they can prevent Mozilla or Microsoft from cutting them out.

Now they want to prevent the increasing pool of ad blockers from freezing out adsense. Happily for Google, this means that advertisers will prioritise advertising through them, as they will _only_ be guaranteed to show up in Chrome if they use adsense.

Their next step will be to bundle Contributor with Chrome. Again, by happy coincidence, this blocks out anyone else from getting a good run at microsubscription. Last I checked, the design is intended to be revenue- neutral for Google.

Disclosure: I have been working on a business, Robojar, intended to remove advertising and bypass paywalls in exchange for microsubscriptions. Google have a very similar model in Contributor.

<comment><USER6> > Disclosure: I have been working on a business, Robojar, intended to remove > advertising and bypass paywalls in exchange for microsubscriptions. Google > have a very similar model in Contributor.

Good luck! I love the idea of micropayments from a fixed budget to support sites, but Contributor's bidding-based system was not a good path at all.

> they will only be guaranteed to show up in Chrome if they use adsense

That's the worst-case scenario, as far as power abuse here. But they might be fair! We'll have to see.

<comment><USER8> I want to give Google the credit for a conceptually elegant approach that will slot neatly into the existing bidding system.

But it seems to think of humans and adtech bidding ecosystems as identical economic agents. If we're all perfect consumers, sure, the system converges to an equilibrium.

That seems like a mighty generous "if". It's already annoying to manage the mental cost of schemes like Patreon's. How much more annoying is to have to forecast, several weeks in advance, a bidding system that settles in milliseconds, millions of times per minute?

It's worth noting that I may be misunderstanding or misrepresenting the nuances and design of the Contributor scheme. I'm a potential competitor, my remarks ought to be look on skeptically.

But likewise I ask people to follow the money. Cui bono? In this case: Google.

<comment><USER6> My main objection to the bidding system is not even the unpredictability, but that it rewards the wrong things. I don't want to pay more to a site that happens to have car insurance ads. I don't want to pay less to a site that installed fewer banners.

...hang on, when did google contributor relaunch as a service that pays per- page-load, is opt-in per domain, and is basically useless?

Google, you manage to do youtube red just fine. Try harder.

<comment><USER8> Oh wow, you're right. The model has gotten even more cognitively expensive.

This somewhat widens my ray of hope.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> How is this not a monopolistic, anticompetitive measure?

The largest ad company starts a shell coalition so their largest market-share browser can use it as justification to block "non-approved" (competitor's) ads.

</comment><comment><USER10> At this point, I'm dealing with so many pop-ups asking me to turn off my ad- blocker that the original purpose of the ad-blocker (don't bother me) is becoming moot.

If this effort by Google can somehow raise the quality of online ads from horrendous to just terrible, I'll reluctantly support it.

<comment><USER11> >If this effort by Google can somehow raise the quality of online ads from horrendous to just terrible, I'll reluctantly support it

I think the rationale for this move is to stem the growth of adblockers rather than anything else. Google Chrome on Mobile does not allow any extension so thats safe for their monetization. Its only on desktop which is dwindling and they are using this opportunity to make sure this is contained

<comment><USER12> Only on Android does this save Google. iOS has had the ability to install content blockers for a few years. They not only work in the browser but also the newer embedded Web Views (WebViewController?)

</comment></comment></comment><comment><USER13> I asked before, but never really got a good answer. Is this client side only? If not, how are they querying a server? And where can I download the full list of unacceptable ads/sites? And if I can't, why not? And finally, why does this have to be native instead of an extension?

Edit: I guess another question, why aren't the answers to obvious questions like these readily available? Or am I just ignorant?

<comment><USER11> I believe this is a hybrid. Chrome sends telemetry data to their server and they already know what kind of sites and ads are blocked.

I think they need correlation of ads shown followed by an adblocker extension install so that they want to block such ads to prevent the growth in adblockers

</comment></comment><comment><USER14> I really hope a service will be created where I can pay for adfree content internetwide.

<comment><USER11> you already have that here: [https://contributor.google.com/v/beta](https://contributor.google.com/v/beta)

</comment></comment><comment><USER15> So removal of ads is based on a blacklist, rather than client-side identification?

</comment><comment><USER16> Members of the "Coalition for Better Ads" are listed at the link below. Which major internet advertising providers are not listed? (I am not familiar with the market.)

[https://www.betterads.org/members/](https://www.betterads.org/members/)

</comment><comment><USER17> I'm not a lawyer, but it just seems like the biggest online ad peddler of the world blocking ads of exclusively it's competitors in his preinstalled browser on the most widely used mobile platform in the world is a recipe for a blockbuster anti-trust sanction.

<comment><USER18> I'm sure Google's employees who can say I am a lawyer reviewed this.

They've been paying Ad Block Plus to do this for years. Bringing it in house can't change the legality much.

</comment></comment><comment><USER19> So, basically all ad networks like zeropark, popads, popcash, propeller ads, will soon disappear?

<comment><USER20> That or we'll start seeing "this browser not supported"</comment></comment>


Japanese-born canned coffee is conquering America - <AUTHOR> https://www.economist.com/business/2020/09/12/who-will-win-the-brewing-battle-between-japan-and-america <comment><USER2> [https://archive.is/y4czy](https://archive.is/y4czy)

[https://outline.com/6zrkHy](https://outline.com/6zrkHy)</comment>


Transgender children and gender dysphoria - <AUTHOR> http://www.theguardian.com/society/2015/sep/12/transgender-children-have-to-respect-who-he-is <comment><USER2> The worrisome thing here is that batman outfits and swords are used as proof of the "boy" identity and pink princess stuff as proof of the "girl" identity. This is complete crap - gender roles are not dictated by which aisle of Toys 'R' Us you favor.

I am willing to grant that the children profiled in the article aren't just in it for the toys, but the author is encouraging this perception, and I have seen more than a couple Bay Area parents buying into this, and rushing to call their kid gender-fluid as soon as they put on a dress.

<comment><USER3> And you're right; these are totally two separate things (cross-dressing, for example, is not much of an indicator as to whether someone is transgender or not.)

Now, that said, kids should be free to wear whatever the hell they want, but nobody should take what they wear as an indicator as to what gender they would be more comfortable as.

<comment><USER4> >Now, that said, kids should be free to wear whatever the hell they want

I am none too keen seeing young girls wearing heavy make up. Children should be able to be children and not little adults.

<comment><USER5> What is inherently "adult" about makeup?

<comment><USER4> I am not talking about children playing with mum's make up - I am talking about young girls being peer pressured into wearing heavy make up at an age they don't need it. It is an arms race that no young kids need.

On this topic I really hope men can continue to resist the cosmetics industry. I have zero desire to see it become the expected social norm like it has for women.

</comment></comment></comment></comment></comment><comment><USER6> If I had grown up in a culture this accepting of transgender people I would have transitioned. That would have been the worst decision of my life. I've grown into my identity as a man since then and I'm thankful for my parents and society pushing me in the right direction. We need to be careful to avoid putting borderline cases like me into a group with such high rates of suicide and depression.

<comment><USER7> You would have only transitioned after lots (maybe years) of sessions with doctors and therapists where they would have made sure that it's really what you need.

As the article mentions, the biggest change right now is delaying puberty for some kids so that if they _are_ trans, they get the chance to transition more easily later in life.

Regardless, I'm glad that you're happy with your body.

<comment><USER8> Delaying puberty and sexual maturation is quite odd in this case.

It's a bit hard to know what gender you identify as when you aren't even remotely sexually mature hormonal and neurological changes during puberty might be a very important factor. And while yes sex isn't equal gender in this case but it still means allot. If you pump a man full of estrogen and make him feel like a woman you'll might be able to push him hard enough to identify as one.

</comment></comment></comment><comment><USER9> Reading this article made me realize I have no idea what "gender" is. It used to be synonymous with what parts and chromosomes you have, where there are no questions of "I identify as XYZ," but now what the hell is it really?

All the fluidity and tension created by gender makes me think why don't we just get rid of it? Stop making children conform to social norms/behavior/dressing/everything based on their sex. Drop all social expectations of gender and let people do whatever they naturally want to do. But then we're just left with sex, which is basically where we started. So what the hell is gender?

<comment><USER10> Sex/gender together cover, as I see it, three main areas; all of which are complicated, but misery of which haven't been recognized as such (or even recognized at all) until fairly recently.

The first is biological (usually called "sex"), chromosomes and various traits. This is often percieved as being strictly binary, but it's not: the genetic traits and other features typical of one sex or the other don't always spread together, and often the most superficially obvious ones don't match the ones that have broader impact. So that's complicated in ways that are often not recognized.

Then there is socially ascribed roles (this is ones of the things usually labeled "gender"); these are the expectations put on someone by society related to masculinity or femininity.

The there is one's own perception of one's own masculinity or femininity (this is sometimes also referred to as "gender", but often, and more clearly, "gender identity").

This is complicated, because it shaped by lots of things, including social gender stereotypes, and whether they align our conflict with ones current socially ascribed gender.

</comment></comment><comment><USER11> I think the fact that our society is being more thoughtful towards gender identity is a good thing. But is it possible in our attempt to be thoughtful we sometimes will over analyze individual situations and change our environments, interactions, and treatment, towards those we are trying to help in such a way that it is actually detrimental to them?

In the case of allowing children to choose their identity in the way this article describes, is it possible that a parent might misunderstand their child and enable a short-term change that could be detrimental to a child's development (socially, academically, etc)?

I feel like gender identity is a hot issue right now, and people in general get caught up in the rhetoric and forget about the actual people.

<comment><USER12> > a short-term change that could be detrimental to a child's development > (socially, academically, etc)?

Why should letting a child explore their gender identity be any more detrimental to their development than letting them explore their sexuality?

It'd be far worse to tell them to repress it and not let them come to understand themselves.

<comment><USER13> Note that the OP said "COULD be detrimental" while you shoot from the hip with a definitive "It WOULD be far worse [otherwise]".

"Why should letting a child explore their gender identity be any more detrimental to their development than letting them explore their sexuality?"

Because some kids, sometimes, make stupid decisions. Also, what 3-year-old (from the original article) needs to "explore their sexuality"?

</comment></comment></comment><comment><USER14> Worth watching on this topic is a recent Louis Theroux piece on this (if you can source it). [1]

When I watched this I couldn't help but wonder if some of these kids are actually intersex, have Congenital Adrenal Hyperplasia, Androgen Insensitivity Syndrome or something similar [2]. There was no mention in the documentary about any chromosomal testing being done by these doctors. The testing seems to be behavioural. I wonder what the overlap is between trans kids and Sex Chromosome Abnormalities?

[1] [http://www.bbc.co.uk/programmes/b05qkzt2](http://www.bbc.co.uk/programmes/b05qkzt2)

[2] [http://www.who.int/genomics/gender/en/index1.html](http://www.who.int/genomics/gender/en/index1.html)

</comment><comment><USER15> I feel like we are confusing children with people that have actual gender identity issues.

My 5 year old can decide what her favorite color is, much less what gender she wants to be the rest of her life.

<comment><USER16>
        > My 5 year old can decide what her favorite color is,
        > much less what gender she wants to be the rest of her
        > life.

I think you may be confusing gender dysphoria with people waking up one day and thinking "Heck, it'd be kinda cool to be another gender!", rather than a pervasive and persistent deeply held belief that their body is wrong.

<comment><USER17> >rather than a pervasive and persistent deeply held belief that their body is wrong.

There have been cases of children and young teenagers who have such beliefs, and then change their minds when they're adults. This may not be the norm, but I think it's important that children and teenagers don't undergo irreversible transition treatment. Thankfully, I believe there are many reversible treatments, like puberty blockers.

</comment></comment></comment><comment><USER18> The elephant in the room for me during conversations like this is theory of gender. It doesn't seem like we have one. I sideline myself, or at least error on the side of compassion, because it feels like we just don't know how to think about gender, either in a scientific way, or if significant features of it are non-scientific, how to approach it then at all.

I think more attention to it as a subject of serious research could help us all a lot.

</comment><comment><USER19> Some users flagged this submission, but the article is substantive, so we're going to try turning flags off.

Since the topic is controversial, please keep this thread a thoughtful one.

Edit: thank you all for keeping this thread a thoughtful one.

<comment><USER20> Substantive? Maybe. On-topic for HN? No.

(I trust the rule that we're supposed to flag and move on rather than complaining about submissions being off-topic no longer applies since you've turned off flagging)

<comment><USER21> I don't know what your definition for "satisfies intellectual curiosity" is but this article definitely does it for me. Sexuality and gender issues are _fascinating_ , as is developmental psychology.

<comment><USER20> I find the subject fascinating (and, FWIW, extremely personally relevant). But I didn't find this article at all satisfying; too much is anecdote, the Guardian is too far from neutral (and I say that as a reader and fan of a lot of their work), and parts of it ring false in terms of my own experience (contrast e.g. e.g. _Wandering Son_ ( _Hōrō Musuko_ ), which felt very true- to-life for me - though I guess it's possible things have changed in the years since I was a schoolchild). To satisfy _intellectual_ curiosity requires a level of intellectual honesty that I don't think is here.

<comment><USER19> This is a perceptive comment that is a fine addition to the thread. You could make it even better by expanding on what parts of the article ring false in your experience. But an article having bias or other weaknesses isn't enough to convict it of offtopicness, the capital offense of articles. Many on-topic articles have that degree of weakness, especially when the topic is poorly understood.

Nor would I call anecdote a weakness. Anecdotes are legitimate, fascinating, and indispensable to good conversation. Half if not more of the best material on HN is anecdotes. That's how communities function, so it's deeply ok.

<comment><USER20> Then conversely, what is it that makes a political or gossip article off- topic? Many such articles are just as fascinating, just as curiosity- satisfying, as this one. (To my mind objectivity and generality is what separates intellectual curiosity from the regular kind; if not that, then what?)

</comment></comment></comment></comment></comment></comment><comment><USER22> _"I was wearing my Spiderman costume," Tom, now five, remembers._

I couldn't read past this. No... he doesn't remember that.

<comment><USER23> I remember being carried as a two year old up and down the long driveway at my parents' place so they could deposit poopy diapers in the trash bin.(Trash service was only available for a few years out there.)

We all remember moments from our early lives that seem odd.

<comment><USER22> No you don't.</comment></comment></comment>


Show HN: Primrose – A text editor that draws to Canvas - <AUTHOR> http://capnmidnight.github.io/Primrose/ <comment><USER2> You clearly get that licenses matter, but you've released your code under the worst of all possible licenses, namely "contact me for permission."

This is an easy one to solve, it just takes a moment to pick a real license for your project[1]. Real licenses are more than one sentence long because there are real issues that both licensor and licensee need to understand before they can go forward.

[1] [http://opensource.org/licenses](http://opensource.org/licenses)

<comment><AUTHOR> If you look at the Github repository, you will see that I have a license file that specifies GPLv3. "Contact me" really only means "I haven't setup a site for you to buy a dual-license for non-FOSS projects yet, because the project isn't done".

<comment><USER2> awesome, I'd mention GPL3 in your README licensing section - so many projects lack any kind of license file that even when I thought I'd looked for one I missed it and walked away thinking you just had the vaguer statement.

</comment></comment></comment><comment><USER3> This reminds me a bit about the Mozilla Bespin editor from several years ago. They've since merged with the ACE editor, but before the merge they drew everything on a <canvas>. There's some more information about that here: [http://benzilla.galbraiths.org/2009/02/17/bespin-and- canvas/](http://benzilla.galbraiths.org/2009/02/17/bespin-and-canvas/)

</comment><comment><USER4> If you think that Primrose is neat, checkout Daniel Earwicker's carota editor. It's based on a similar idea and has way more features, as well as a license that won't hose your project (MIT):

[https://github.com/danielearwicker/carota](https://github.com/danielearwicker/carota)

<comment><USER5> Pretty sweet demo: [http://earwicker.com/carota/](http://earwicker.com/carota/) !

</comment></comment><comment><USER6> Nice demo but far from usable as an actual editor IMHO.

Doesn't seem to support a lot of common ways I edit text, like holding shift and using arrow / alt-arrow to select. Selecting and hitting delete. Selecting with the mouse and hitting delete doesn't work.

</comment><comment><USER7> Does not work on Firefox Developer Edition at all.

<comment><AUTHOR> [https://github.com/capnmidnight/Primrose/issues/7](https://github.com/capnmidnight/Primrose/issues/7)

"works in Chrome" is just all the further I've gotten so far in a weekend. I can eventually get it to work in Firefox, just need a little more time to build out the features.

<comment><USER7> Just reporting... sorry if I sounded too harsh. I actually love the idea and appreciate the effort!

<comment><AUTHOR> No, it wasn't harsh. I'm still learning how to communicate my projects here. Trying to figure out the right level of doneness (somewhere between "tartar" and "shoe leather") before serving it up to the HN masses is its own project.

</comment></comment></comment></comment><comment><USER8> I've encountered the problems you're trying to solve. First, it needs to handle word wrapping which yours doesn't seem to do. After that, it's i18n text that make this a difficult problem to solve. Specifically, RTL languages and CJK.

<comment><AUTHOR> Release early, release often--or, we'll cross that bridge if we ever get to it.

Unfortunately, I'm not out to make a tool for everyone in the world. No, I don't have a plan for those issues, but I and at least one other person I know have need for text editing in a WebGL context (specifically, with WebVR work). For that, I need a canvas element that I can make into a texture.

The only previous work towards such a thing I could find was a Kickstarter that failed to deliver ([https://www.kickstarter.com/projects/1241383920/open- source-...](https://www.kickstarter.com/projects/1241383920/open-source- programmers-text-editor-using-canvas-a/description)). The current status is that there is no way for _any_ locale to have even antiquated ASCII text, highlighted, and working with editor controls, in a WebGL context.

<comment><USER9> Text in WebGL is still really immature.

I've done a bit of tinkering with a variety of modules for word-wrapping, etc. None of them are "fully featured" or 100% stable but I have used them in a couple of production environments.

[https://github.com/mattdesl/fontpath](https://github.com/mattdesl/fontpath)

The WebGL module on top of that:

[https://github.com/mattdesl/gl-sprite-text](https://github.com/mattdesl/gl- sprite-text)

The main issue I have with most text libraries (like TxtJS) is that they assume 2D canvas, or trivial WebGL applications. The bulk of the text code really just deals with laying out rectangular glyphs; the rendering (whether geometry, bitmaps, SDF, etc) should be separate so the dev can choose the best technique for their app.

An example of SDF / fontpath in action:

[http://mattdesl.github.io/xmas](http://mattdesl.github.io/xmas)

</comment></comment></comment><comment><USER10> It seems to use it's own keyboard layout, not the one set in the operating system/printed on my keyboard.

<comment><USER11> They all do this, this is the big problem in why we're stuck with crappy text areas and content editable. The JavaScript keyboard API was designed for Americans. It does not know about combining accent keys, IMEs, etc.

<comment><USER10> There is also this inconsistency that's irritating. I'm typing on a qwertz keyboard and in Primrose, z is z (instead of y). But all 'special' characters are qwerty layout.

Great result for a weekend still :)

(it also hijacks ctrl+f/ctrl+c/… anywhere on the website and just inserts the letter instead of calling the browser function)

All this makes me wonder whether this is the right approach and whether this couldn't be done with a lot less hassle with CSS formatting.

<comment><AUTHOR> Well, the problem with CSS formatting is that it doesn't composite well with 3D scenes in WebGL contexts. That's the ultimate goal here, to have 3D objects in a VR application with code editor surfaces (for which I have another project running as well).

My code already uses a rudimentary code page system, just because it's impossible to go from DOM keyCodes to the correct text for even US keyboards, so in the long run this should be easily fixable.

</comment></comment></comment></comment><comment><USER12> This is awesome. The demo works really well in Chrome, actually almost better than native text editing for me.

</comment><comment><USER13> I am curious, what is the use case where you want a 3d transformed and depth- buffered text editor?

<comment><AUTHOR> In support of Brian Peiris' RiftSketch, as well as other, similar projects: [https://github.com/brianpeiris/RiftSketch/](https://github.com/brianpeiris/RiftSketch/)

It was something he and I discussed a few months ago and this was the first chance I had to work on it.

<comment><USER14> My project CodeChisel3D has a similar goal: [http://robert.kra.hn/projects/live-programming-with-three- an...](http://robert.kra.hn/projects/live-programming-with-three-and-webvr)

<comment><USER15> moron4hire, robertkrahn01 funny for you two to meet here. I have been working on a solution for RiftSketch that is more like Robert's approach, where I use a canvas backed by an actual textarea (Robert's canvas is cleverly backed by an Ace Editor instance). Instead of re-implementing an editor from scratch, the user keyboard inputs are received by the textarea while the canvas and corresponding 3D texture are simply a re-rendered mirror of the textarea's contents and cursor/selection state. That way you can still rely on the usual editor mechanics (cursors, text selection, keyboard shortcuts, etc.).

<comment><AUTHOR> How do you get the textarea, or any other element, into a canvas?

<comment><USER15> I don't. The textarea remains hidden (off screen) in the background. It has the user's focus, so when the user types, it's receiving keystrokes as usual. Simultaneously, the render loop simply reads the text and selection state (selectionStart, selectionEnd) from the text area and renders the textarea's text and selection cursor/selection-highlight onto a canvas.

<comment><USER14> Same approach here. Except that I use the ace editor ([http://ace.c9.io/](http://ace.c9.io/)) as the backend. This has the nice advantage that you get full code editing capabilities in 3D.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Wow, that's not much code. I'm going to have to study this.

<comment><AUTHOR> Yes, and it could even stand to be cut down more, which I find exciting.

This is not going to be anything approaching the complexity of something like Vim. Think more like Notepad2. I spent basically the last 20 hours putting together this POC just to see if the rendering was even going to be clean enough to bother going further. And it looks like it is!

<comment><USER16> Well I've got a weird little project I'm starting that might be about to change direction.

</comment></comment></comment><comment><USER17> Any plans to support bidirectional text?

<comment><AUTHOR> Maybe. Trying to keep things simple, to start.</comment></comment>


Windows Terminal Preview v0.7 Release - <AUTHOR> https://devblogs.microsoft.com/commandline/windows-terminal-preview-v0-7-release/ <comment><USER2> The UI felt very clunky at first, but it's improved a lot since then (I've been using it since launch). Already a huge improvement over the original console host.

</comment><comment><USER3> I've been using this terminal for a couple of months now with WSL and its been great! Keep it coming Microsoft!

<comment><USER4> Been using it for a month too and found it the best terminal on Windows already - but that's not saying much. Nice velocity on the development though.

</comment></comment><comment><USER5> Maybe they will release version for Linux/Mac some time later? This can become a decent terminal

</comment><comment><USER6> Nice I really like how they acknowledge the contributors!</comment>


Facebook's User Growth Continues to Decrease while Google+ Adds 625K Users Daily - <AUTHOR> http://www.launch.is/blog/facebooks-user-growth-continues-to-decrease-while-google-add.html

<comment><USER2> Well the obvious reason is mentioned in the article: most people already do have a facebook account, while G+ is still new for most of the internet.

If you are likely to be on facebook, you probably already are. I don't think it's surprising the growth is decreasing.

I would be (pleasantly) surprised if the growth was negative, but that's not going to happen :P

<comment><USER3> Actually, they _are_ losing users in the countries where they first emerged. But for now, growth is sustained by late-comers in other countries, much like it happened to RIM.

[http://www.insidefacebook.com/2011/06/12/facebook-sees- big-t...](http://www.insidefacebook.com/2011/06/12/facebook-sees-big-traffic- drops-in-us-and-canada-as-it-nears-700-million-users-worldwide/)

I think when your core users and initial early adopters are leaving your product/service, you need to start worrying immediately, rather than wait for that 3-year late "financial impact" to "believe it" that you're in trouble.</comment></comment>


Deploying Microservices to AWS at Gilt: Introducing ION-Roller - <AUTHOR> http://www.infoq.com/articles/gilt-deploying-microservices-aws

<comment><USER2> > [https://github.com/gilt/ionroller](https://github.com/gilt/ionroller)

This does (currently) return a 404.

<comment><USER3> We plan to release the software in early June, but the article was published in advance of the release.

I've put a public repository at the location to make this clear, we'll update it soon.

</comment></comment><comment><USER4> great stuff!</comment>


How  to Clarify and Strengthen US Cybersecurity Law - <AUTHOR> http://www.defenseone.com/ideas/2016/02/5-ways-clarify-and-strengthen-us-cybersecurity-law/125793/ <comment><AUTHOR> It's interesting that HN changed the title (not that it matters; it's just curious). The title of the article as displayed on the page, as appearing in the HTML <title>, and as submitted is,

* 5 Ways to Clarify and Strengthen US Cybersecurity Law

HN automatically changed it to,

* How to Clarify and Strengthen US Cybersecurity Law

Is HN just tired of all the counting headlines? (I sure am.)</comment>


The Low Down on Recovering Deleted Files - <AUTHOR> http://www.dataversity.net/the-low-down-on-recovering-deleted-files/

<comment><USER2> This article does not mention how TRIM on SSDs comes in to play.</comment>


Hacking into a CPU'S Microcode (2017) - <AUTHOR> https://hackaday.com/2017/12/28/34c3-hacking-into-a-cpus-microcode/ <comment><AUTHOR> Excerpt: "The result was 29 microcode operations including logic, arithmetic, load, and store commands — enough to start writing microcode code. The first microcode programs written helped with further discovery, naturally. But before long, they wrote microcode backdoors that triggered when a given calculation was performed, and stealthy trojans that exfiltrate data encrypted or "undetectably" through introducing faults programmatically into calculations. This means nearly undetectable malware that's resident inside the CPU. (And you think the Intel Management Engine hacks made you paranoid!)"

<comment><USER2> Fortunately microcode updates are not persistent and need to be applied on every boot.

<comment><USER3> I think that's 'unfortunately', and I think that such updates should require the movement of a switch or jumper to be activated. Obviously the 'hands off' and 'lights out' trends in the datacenter make such a requirement a non- starter but from a security perspective it would make good sense.

<comment><USER4> I think it's good. There's not much space in the microcode patch RAM, so hiding a malicious update like you would a root kit would be extremely difficult.

<comment><USER5> A stealth privilege escalation would be far more likely. Find a redundant, or unused bit, and...

<comment><USER5> It's too late to edit, but that's exactly what I would go for.

</comment></comment></comment></comment></comment></comment><comment><USER6> Ben Hawkes from Google Project Zero has an excellent blog post on Intel CPU Microcode:

[http://www.inertiawar.com/microcode/](http://www.inertiawar.com/microcode/)

He even extracted and posted the RSA public keys used to verify the microcode. Though he later removed them, they're still available on the internet archive:

[https://web.archive.org/web/20140403200048/http://inertiawar...](https://web.archive.org/web/20140403200048/http://inertiawar.com/microcode/microcode_rsa_modulus.txt)

<comment><USER7> It's a good investigation of the microcode update binary format, but doesn't reveal anything about the microcode itself unfortunately.

</comment></comment><comment><USER8> How do they get around the crypto signature checks that the CPU does before loading a microcode patch?

<comment><USER6> From [1]:

"Most update mechanisms are protected by signatures or other cryptographic primitives. However there were some indications that older CPU models (until around 2013) do not have a strong cryptographic protection and thus would accept custom updates."

[1]: [https://media.ccc.de/v/34c3-9058-everything_you_want_to_know...](https://media.ccc.de/v/34c3-9058-everything_you_want_to_know_about_x86_microcode_but_might_have_been_afraid_to_ask)

</comment></comment><comment><USER9> I've been waiting over a decade(s?) for someone to pull this off. Reverse engineering this is a great accomplishment.</comment>


Elon Musk scales up his ambitions, considering going "well beyond" Mars - <AUTHOR> http://arstechnica.com/science/2016/09/spacexs-interplanetary-transport-system-will-go-well-beyond-mars/ <comment><USER2> As the article says, Musk will be speaking at the IAC conference on September 27th, and hes expected to give some details on how he plans to colonize Mars.

The conference will be doing a livestream here: [http://livestream.com/accounts/4426843/events/6315496/player...](http://livestream.com/accounts/4426843/events/6315496/player?width=640&height=360&enableInfoAndActivity=true&autoPlay=true&mute=false)</comment>


Cell Phone Guide for Occupy Wall Street Protesters (and Everyone Else) - <AUTHOR> https://www.eff.org/deeplinks/2011/10/cell-phone-guide-occupy-wall-street-protesters-and-everyone-else <comment><USER2> I was watching Occupy Raleigh earlier today at the State Capitol, and I didn't see any evidence that the police were planning to interfere. There were about eight officers on-site, but they were mostly just watching. Maybe the possibility of police misconduct is a bigger issue in other cities.</comment>


Ask HN: Do I have the right to rewrite Hugh Everett's dissertation in HTML? - <AUTHOR> It is available on the net[1], but it's in PDF so it's not great to read on a e-reader.
So I started re-writing it in HTML[2].  Do I have the right to do that?  If I do, would anyone be willing to help?
1.
https://www-tc.pbs.org/wgbh/nova/manyworlds/pdf/dissertation.pdf
2. http://grondilu.github.io/dissert.html <comment><USER2> For e-readers you should use epub or similar format built specifically for them for the output. For actually rewriting Latex or other format that uses a make file is probably a good choice since it can be used to output to various formats (html, pdf of different sizes, epub, mobi, chm, man pages, etc.) This way people can download it and use it offline in various ways.

In terms of rights, no because as it has not been 70 years since he has passed. Now, if he has transferred his copyright or changed it himself to be public domain then yes. Otherwise you would have to wait until after the year 2052 legally when it goes into public domain.

<comment><AUTHOR> Ok, I'll remove it then and keep it local.

I don't know how to write epub, though I guess I should write in LaTeX : there has to be a conversion tool somewhere.

<comment><USER3> Consider pandoc: [http://pandoc.org/](http://pandoc.org/)

<comment><USER4> fyi - I don't know how else to reach you. Your comment here: [https://news.ycombinator.com/item?id=3848894](https://news.ycombinator.com/item?id=3848894) is my first google result for 'ycombinator green username'. So much for teaching people how to fish :)

<comment><USER3> > _I don 't know how else to reach you._

Click on my name to read my profile. See my interests. Google my name and some of those interests. When I do that in an incognito window the first 23 hits are me. Of them, about half are to web pages that have a means to email me.

It seems to me that if you really wanted to contact me it isn't really that hard.</comment></comment></comment></comment></comment>


A man says he's stockpiling billions of our photos - <AUTHOR> https://www.cnn.com/2020/02/10/tech/clearview-ai-ceo-hoan-ton-that/index.html <comment><AUTHOR> _though the photo is old and I 'm almost unrecognizable_

 _no false positives_

Oy.</comment>


As sites move to SHA2 encryption, millions face HTTPS lock-out - <AUTHOR> http://www.zdnet.com/article/as-sha1-winds-down-sha2-leap-will-leave-millions-stranded/?linkId=18208342 <comment><USER2> At CloudFlare, our solution to this problem for our customers is to automatically support SHA2 for modern browsers and fall back to SHA1 for legacy browsers that don't support SHA2. This is in place for most paying customers already. It will be complete for all paying customer by the end of the week.

For free customers using our Universal SSL solution, only modern browsers are supported so it has only used SHA2 certificates since it launched over a year ago.

The danger is that after December 31, 2015 we may no longer be able to get SHA1 certificates for new customers because CAs have been told by browser vendors to no longer issue them. While that won't cause a problem for modern browsers, for legacy browsers that can't be upgraded it will mean they will not be able to access the encrypted web. Unfortunately, that disproportionately affects regions of the world where censorship risk is high. In Iran, China, and parts of Africa with more restrictive governments, legacy browser traffic is as high as 30%.

If providers like CloudFlare who can safely support SHA1 certificates only for legacy browsers, while supporting SHA2 for modern browsers, cannot continue to get SHA1 certificates then we risk cutting off a substantial portion of the most vulnerable Internet users from the encrypted web. That is a bad outcome.

We will be talking more about this on our blog in the coming weeks and plan to open source the TLS handshake fingerprinting logic we're using to identify what browsers only support SHA1. I'm hopeful that the browser vendors and CAs will do the appropriate thing by requiring modern browsers to only support modern hashing algorithms but allow providers like us to continue to support the best available cryptography for those users who cannot upgrade to the latest browser tech.

<comment><USER3> (A) A significant percentage of users with legacy browsers _could_ upgrade (by installing Chrome or Firefox, instead of relying on a woefully out of date bundled browser). If much of the internet stops working for them, I imagine knowledge of how to get it working again will spread pretty quickly.

(B) It seems incredibly difficult (impossible?) to support graceful downgrade to older insecure approaches to TLS without also introducing the opportunity for a downgrade attack.

Many of the TLS attacks we've witnessed over the last few years seem to be the direct result of bending over backwards to maintain backwards compatibility. I'm unconvinced it can be done safely.

<comment><USER4> Amusingly, these users may not be able to download modern browsers from the official websites, which will of course be only available over TLS for obvious security reasons ...

<comment><USER5> You mean as the article explicitly points out with "Mozilla's one million downloads mistake"? I'm not sure how that could be considered amusing.

<comment><USER4> Unintended consequences. Unfortunate. But after you've seen enough of them, funny as well.

</comment></comment></comment></comment></comment><comment><USER6> Can someone please explain why this encryption limitation is OS level and not application level? XP can't handle new encryption but why can't Firefox/Chrome on XP handle it? Why can't they include their own updated encryption code within their browser?

<comment><USER7> They can and they do. Mozilla uses NSS, Chrome their own OpenSSL fork (BoringSSL). This only really affects IE and other applications which don't have to be actual browsers.

This mess also affects me greatly because I have around 2k Windows Mobile 6 based barcode scanners around which use SSL. Their HTTP client is just using the OS provided APIs.

Now we're going to have to use a self-signed cert and update the application to accept that pinned cert

<comment><USER8> One solution is to use a proxy. I run a filtering proxy, and force all HTTP and HTTPS traffic through it. It can be upgraded easily since it uses the standard OpenSSL DLLs.

Courtesy of that, this comment has been posted to HN with TLSv1.2 ECDHE-RSA- AES128-GCM-SHA256, from a client that only supports TLS 1.0 and nothing beyond RC4-MD5. (It's actually configured to ask for ECDHE-RSA-AES256-GCM-SHA384 first, which is probably overkill, so I don't see many servers that choose it.)

<comment><USER7> That's another very good idea I'm going to look into, though I'm a bit weary of dealing with writing and/or finding and compiling a proxy server for a version of Windows CE that's now 4 years out of support.

</comment></comment></comment></comment><comment><USER9> Nobody seems to have yet picked up on tls 1.0 becoming obsolete next June for PCI purposes - about 20% of Web users can't do better without an OS upgrade - IE on xp, older android, etc. We've been measuring this for about a year and it was 24% this time last year.

Can't see that percentage dropping all that much before then, and clients won't be blaming users' poor practices or the pci council - it'll be the fault of Web developers, everywhere.

<comment><USER10>
      20% of Web users can't do better without an
      OS upgrade - IE on xp

XP users don't need an OS upgrade - they just need to switch to Firefox or Chrome.

<comment><USER11> Chrome is already dropping XP support in just a month or two. While Firefox is not going to change in the short term, its really not a great idea to stay on XP if you have a way out.

<comment><USER12> Still, even if they dropped support today, the current version is a huge improvement over an IE that hasn't been updated in most of a decade.

</comment></comment></comment></comment><comment><USER13> They've had plenty of warning. We've already seen that SHA1 could soon be cracked by relatively cheap computing power. Also, this is essentially saying that 3rd party companies should continue to support Windows XP, which is silly, considering even Microsoft stopped (officially) supporting it a while ago.

</comment><comment><USER14> SHA256 software compatibility: [https://support.globalsign.com/customer/portal/articles/1499...](https://support.globalsign.com/customer/portal/articles/1499561-sha-256-compatibility)

</comment><comment><USER15> Sadly, XP users who should be installing Firefox or Linux or Nokia users who should be installing Opera Mini don't read tech news. Is anyone trying to inform them ahead of time?

<comment><USER2> Worse than that. As the migration to SHA2 is forced, even if they want to upgrade they won't be able to because they won't be able to securely download executables for modern browsers.

Catch-22

<comment><USER15> Hence, "ahead of time".

</comment></comment></comment><comment><USER16> It's a damn shame that X.509v3 doesn't support multiple signatures on a single certificate. That would really ease the transition to new signing algorithms. I can't really fault the CAs or browser developers here because X.509 doesn't facilitate forwards compatibility.

</comment><comment><USER17> Everyone is talking about personal computers and mobile devices. Not mentioned: the IoT movement with devices in the field with minimal capabilities and no path for upgrade.

Older version of devices like TI's CC3200 (which appears to support SHA2 in hardware at least) will be forced offline without an upgrade (and in many cases I assume SW implementation of missing HW algos)

It's ironic: device developers tried to be forward looking with TLS security only to stumble over it later. I'm sure the subset of decisions makers that are clueless will blame security for crippling their systems. Now security is evil to the ignorant.

tl;dr; Plan for upgradability with embedded hardware products

</comment><comment><USER18> No, it's not SHA2 encryption. SHA2 is a hashing function, meaning it's one way. Encryption is two way or else it wouldn't work. People often confuse the two but they are quite different.

</comment><comment><USER19> Does anyone have any sense of who or what groups would benefit from dropping $75k on developing an attack that might not even return any results? I've heard a bit about the underground Russian scene. Those guys are smart and their leaders are motivated and loaded.

</comment><comment><USER20> only Windows XP SP2 IE8/7 and Android 2.2 are affected

Even I use Windows XP sp3 (and firefox/chrome anyway, not native IE)

No idea what percent of Android 2 users are out there but even I dumped my last 2.2 phone recently - kitkat 4 is so much better

<comment><USER21> [http://www.statista.com/statistics/271774/share-of- android-p...](http://www.statista.com/statistics/271774/share-of-android- platforms-on-mobile-devices-with-android-os/)

0.2%. Don't know if locking them out is really a problem.

<comment><USER20> when I see numbers that low I start thinking it is bots spoofing user agents based on old code

just like you still see IE6/7 user agents sometimes

however the millions of vulnerable kitkat install over the next decade is alarming

</comment></comment></comment><comment><USER22> XP is 14 years old, I don't care what bullshit excuses you have. It's your problem now and the world is not going to wait for you. Sick and tired of people offloading responsibility to the rest of the world because they can't be bothered to spend the time and resources to catch up with time.

<comment><USER23> Windows XP actually supports it, you just need SP3 installed (released in 2008). Android 2.2x (and below) is the biggest group of incompatible users, many XP users will be fine.

And before someone says "Android 2.2 users can just install custom ROMs!!!" keep in mind that a lot of unbranded or no-name handsets exist in other parts of the world, without a big enough community to create and maintain customs ROMs.

A lot of devices are legitimately stuck on 2.2 or 2.1.</comment></comment>


Ask HN: What about taking Hackathons online? - <AUTHOR>

Living in a rural area I've never been to a hackathon or startup weekend. I realize those benefit massively from hackers being in one physical space with other fellow hackers, but I'm thinking about ways to take a hackathon online without losing too much momentum. Having seen Minecraft's notch stream entire coding sessions live I wonder if this could be a viable solution. I looked into it, there are good ways to stream a desktop (or parts of it) via justin.tv, even on linux systems.
Let's say we create a website that embends the desktops of all participants and their projects in a grid thus transporting some of this "woah, they're doing something, i should too" feeling. With regard to projects there are many possible ways to do it. One idea would be to make it a nonprofit hackathon where organizations could apply and teams or individual hackers could pick what they'd like (similar to random hacks of kindness), or just let startups do their own things.
But first I'd like to know if the online hackathon idea is even remotely interesting. Would you share (parts of) your desktop live for such an event? Do you think it's possible to create a momentum this way? <comment><USER2> I like the idea, but I don't think it would work. Let's look at the aspects of a Hackathon:

\- People might not like it, but part of hackathons is the social side: meeting hackers and other like-minded people. Meeting them online you can do anyday, wether it's on HN, Reddit, Stackoverflow or whatever else.

\- The woah, they're doing something, i should too" feeling. You can partially copy that using desktop streaming and that stuff, but still it's too easy to just walk away from it, when you're not around those people physically. For exactly the same reason as why people are so much ruder online than that they are in real life: you don't see the people on the other end. Introduce webcams, you might say, but still I don't think any virtual connection can fully replace the feeling of a Hackathon.

-It's also way too easy to cheat. Fair enough, it's quite easy to cheat at Hackathons anyway, but again, people are ruder online than in real life, and thus more likely to cheat.

Okay, it might turn out to be a nice little event for a bunch of people, but I don't think it'd come anywhere near a "real" Hackathon.

</comment><comment><USER3> Make it simple, make it small. And just do it. If you can't persuade several people you know to take part, it probably wouldn't be a goer on a bigger level. Just do a small one, figure out the tech, see what works and what doesn't, and then bring it to us as something to take part in.

It sounds great but it's edgy/new enough for you to need to do a small test run first to refine the idea. And you'll find it hard to sell without having the experience under your belt. It's one of those "meh, sounds weird" ideas that just needs some momentum before people will be won over, IMHO.

</comment><comment><USER4> I would share my desktop. I figure that the idea that somebody could be watching would be very motivating. And since the chances of someone _actually_ watching are so slim, I wouldn't feel too embarrassed.

<comment><USER5> I stream my desktop when I work on personal projects. Some guys I knew in high school occasionally watch it.

</comment></comment><comment><USER6> Even though the idea seems a little crazy I think it`s possible to organize such a event.

There are couple of hey things that have to be taken care of:

-cheating ( by announcing a topic couple hours before event starts )

-getting media sponsors ( preferably startups with API' )

-presentations streamed ( justin.tv/ustream etc.)

-progress written up ( like [http://www.travisglines.com/web-coding/lets-make-a-twitter-c...](http://www.travisglines.com/web-coding/lets-make-a-twitter-clone-in-node-js))

-possible prizes via AppSumo or similar venue

I`ve been actually thinking about putting together such a event in the next couple of weeks.

Since I`m launching a website in exactly that area soon, check it out in my profile.

</comment><comment><USER7> While I like the idea and see the benefits I would feel uncomfortable with people watching over my shoulder while programming.

<comment><AUTHOR> While I know that feeling you could minimize it by streaming just your browser window or some other part of the desktop.

</comment></comment><comment><USER8> hm, imho it is not as fun as offline</comment>


Covid-19 Fast Grants recipients - <AUTHOR> https://fastgrants.org/#recipients <comment><USER2> I'm part of one of these! Very exciting. Overall fastgrants is a great organization. 48 hour turnaround is incredible and could be paradigm shifting for getting science done. Thanks pc and everyone else for the chance to get some science done!

<comment><USER3> Are you able to discuss what you're working on? It would be very interesting to hear more about it if so.

<comment><USER2> I'm working with the Satpathy lab on their project. I'm a PI at the Parker Institute. We usually do cancer, but are bringing our tools to COVID research in this time.

</comment></comment></comment><comment><USER4> Glad to see Dr. Patrick Hsu ([https://bioeng.berkeley.edu/faculty/patrick- hsu](https://bioeng.berkeley.edu/faculty/patrick-hsu)) among the recipients. He is one of the smartest and most impressive people I know, so at least from my limited vantage point, this money is going to the right people :).

</comment><comment><USER5> This is a great initiative, and it's heart warming to see that the list is getting quite long. Most of these go far beyond my level of understanding, so I'm guessing I'm not the target audience. Nevertheless, it would be great if they could a one or two line elevator pitch-style "why this is important" section to each recipient's blurb.

</comment><comment><USER6> This is fantastic - thank you Fast Grants!

Mental health is an area that could really use your support in the next round of grants.

Spikes in post-traumatic stress disorder are being documented among vulnerable populations, health workers and other front-line personnel.

\- [https://news.berkeley.edu/2020/04/17/covid-19-mental- health-...](https://news.berkeley.edu/2020/04/17/covid-19-mental-health-and- well-being-for-ourselves-and-our-children/)

\- [https://www.cnbc.com/2020/04/16/grocery-store-workers- need-f...](https://www.cnbc.com/2020/04/16/grocery-store-workers-need-for- mental-health-care-may-outlast-pandemic.html)

\- [https://www.newyorker.com/culture/video-dept/the-mental- heal...](https://www.newyorker.com/culture/video-dept/the-mental-health- crises-of-the-coronavirus-pandemic)

Sadly, no one appears to be funding the COVID-19 mental health crisis. This would be a great opportunity for Fast Grants to be proactive. I personally know clinical psychologists and researches desperately looking for funding to get ahead of this next wave. LMK if you're interested in helping.

<comment><USER7> Noble cause but not really what this is for.

</comment></comment><comment><USER8> Nice to see Dr.Netea there. I had the opportunity to work with him and his team in a collaboration ten years ago, when studying the pathways leading to antigen presenting cells activation.

On the topic of the immune system he certainly knows his quarters.

</comment><comment><USER9> My university also received a RAPID grant - [https://www.udel.edu/udaily/2020/march/covid-research- superc...](https://www.udel.edu/udaily/2020/march/covid-research- supercomputer-simulations-juan-perilla-jodi-hadden-perilla/)

</comment><comment><USER10> All very worthy, but nothing really unexpected [0]. I was hoping we would see some radical ideas and scientists from obscure universities getting funded.

0\. Disclosure. I was a failed applicant, but I am not surprised as I am neither an academic these days (I am in industry), nor did I ask for any money.

<comment><USER11> You applied for a grant but you didn't ask for any money?

<comment><USER10> Yep. I have money, what I asked for was collaborators. Of course I was rejected because the fund supposedly ran out of money!

I should add I got no help with collaborators, but given the form letter I was sent I strongly suspect nobody even read my application. If this wasn't such a serious problem it would be comical.

</comment></comment></comment><comment><USER12> This makes me hopeful for the future, the next decade is likely to be amazing for healthcare research.

Hopefully some good comes out of this unfolding tragedy and drives the next generation to critical issues like healthcare & climate change than building yet another photo/video sharing app.

</comment><comment><USER13> Small typo / wrong link on the site -> the link to "covidhge.com" (COVID Human Genetic Effort) near the bottom of the page should be to [https://www.covidhge.com/](https://www.covidhge.com/) (right now, it incorrectly links to [https://fastgrants.org/covidhge.com](https://fastgrants.org/covidhge.com) )

</comment><comment><USER14> Cool to see Dr. Julia Schaletzky and her research work listed, she also did a pretty informative podcast on the development of a vaccine a few weeks ago [https://omny.fm/shows/curiosity- daily/covid-19-coronavirus-v...](https://omny.fm/shows/curiosity- daily/covid-19-coronavirus-vaccine-development-scientific-challenges-and- timelines-dr-julia-schaletzky)

<comment><USER15> Youtube Mirror, as having ad blocks on will not allow you to listen on their website:

[https://www.youtube.com/watch?v=xyvwD8HI6Vs](https://www.youtube.com/watch?v=xyvwD8HI6Vs)

Listening now.

Update: Very good points, and I'm glad the interviewers pretty much gave her a format to let her run free and discuss a myriad of points from Viral structure, research efficacy, potential vaccine approaches, and regulatory capture/political failure in diagnostics. She uses how the NIH pulled funding prior to having a vaccine imminent only to have the priorities shift entirely as a recent example of how short-lived memories and fashion can be deadly if this government funded research paradigm alone is how we approach these problems.

She seems like a very knowledge person (beyond her academic concentration) and understands the implications to other catastrophes when dealing with an unnecessary bureaucratic-political maze, its just not suited for foresight or critical crisis management. Its a best reactionary in a knee-jerk manner, and fails at scale in a catastrophic way. She makes a salient, albeit alarming, point how this can be seen with how climate-change is being mishandled.

I'd like to get to know more about her and her work, highly recommended podcast.

</comment></comment><comment><USER16> Proud to see a number of Canadian researchers and institutions on that list. I wish them all success in their work on this.

</comment><comment><USER17> Only 2 North American universities. 12 programs in California funded.

</comment><comment><USER18> Surprised to see researchers from big name universities. I was under the impression that those universities took good care of their researchers.

<comment><AUTHOR> _I was under the impression that those universities took good care of their researchers._

I'm under the impression that most university researchers's reputation, labs, and tenure cases rely heavily on grants, and that most university "scientists" today are really grant writers and grant managers.

That might be a little too cynical a take, but I've heard variations of it enough times to take the view pretty seriously.

<comment><USER19> Unfortunately it's not cynical but the reality. Most people would be shocked how much time academics have to spend on grant writing and other administrative things. The whole system is completely broken, essentially we are applying for money to spend time on writing grants to apply for more money. The unfortunate reality is that in the experimental sciences there is no way around this. You need the funds to be able to run experiments (grad students are part of this as well) and if you ever stop you will never be able to start back up again. Essentially you need to be able to show a track record & preliminary results to be successful at getting a grant, if you stopped applying for grants you have neither. Moreover often universities will give you more teaching duties because you are not bringing in research funding. It is a vicious circle.</comment></comment></comment>


Are there any startups that create software for governments around the world? - <AUTHOR>

Are there any startups that create software for governments around the world?<p>I recently had an idea to make a service which would make certain bureaucratic processes quite a bit easier and just wanted to know if there already are any startups working in this space. <comment><USER2> With regard to the US govt., a startup's burn-rate won't let them survive the contract acquisition process (you'll be out of money before you get a signature).</comment>


Show HN: Remote Desktop from any browser - <AUTHOR> https://www.allmydesktops.com/ <comment><USER2> So relevant:

[https://guacamole.apache.org/](https://guacamole.apache.org/)

Back ~4 years ago I did a similar web application as a way to bring a legacy Windows desktop to the web...I used the Guacamole project before it was brought into the ASF. It was remarkably easy to use and even modify for our business use case.

<comment><AUTHOR> This project is based on guac too. I LOVED guacamole. One thing I didn't like was the client dependency on Java and Tomcat. So I wrote a client myself and made some improvements in websocket protocol. It's still a wip.

<comment><USER3> Do you have it somewhere on, like, github ?

<comment><AUTHOR> Not yet but I plan to. It's written in nodejs.

</comment></comment></comment></comment><comment><USER4> yet another site which asks for your email before showing you anything. Just one page telling how incredible this is. But not even a page about the authors/makers and how the magic (not plugin required) works.

<comment><AUTHOR> I tried showing a quick demo in the attached video. I wonder how can I improve this.

<comment><USER5> The demo didn't show up for me (Brave v.0.20.29) until I started to scroll down, and it was not obvious to me that I could do so until I read this comment and wondered.

EDIT: to be clear, there was enough screen real estate to show it; it was simply empty white.

<comment><AUTHOR> Might be a bug. Let me try it on Brave.

<comment><USER6> Same bug happened to me on Chrome stable, though only on the first load

</comment></comment></comment></comment></comment><comment><USER7> How would this compare to something such as [https://guacamole.apache.org/](https://guacamole.apache.org/)

<comment><USER8> if you install Guacamole on a server, what kind of software to be installed on machines that need remote access? there's no mention of how to access windows machines, even thought it's in the demo?

<comment><USER9> There's a HTML5 browser interface. With some basic scripting/"programming" skills and some front-end magic anyone could build such a service. More important is a good network and security engineer to keep it safe and stable for everyone (around the globe).

</comment></comment></comment><comment><USER10> What measures have take to secure your infrastructure??? If someone is able to penetrate your network can they now have access to all your clients machines???

<comment><USER10> just the lack of _any_ answer from the founder shows me that they haven't even thought this far into the security of their product and that, _right there_, tells me I shouldn't be using their product.

</comment></comment><comment><USER11> Does this use Apache Guacamole or is it a custom-made software?

<comment><AUTHOR> This indeed is mostly a wrapper around guac. But we did design a custom client protocol for speed.

<comment><USER12> Doesn't Guacamole Client's Apache License 2.0 require you to provide copyright notice / attribution for using it in this way? I don't see it anywhere here.

<comment><USER11> I think the Apache License 2.0 does not require any attribution or copyright notice, unless you redistribute the source code.

[https://www.apache.org/foundation/license- faq.html#WhatDoesI...](https://www.apache.org/foundation/license- faq.html#WhatDoesItMEAN)

<comment><USER13> From the license itself, it seems like you do need to include the license contents within the derivative work somewhere. Since "Derivative works" includes "Object" (compiled) projects, and 4a states:

> You must give any other recipients of the Work or Derivative Works a copy of > this License

They're pretty clear on attribution being in the source only in 4c:

> You must retain, in the Source form of any Derivative Works that You > distribute, all copyright, patent, trademark, and attribution notices from > the Source form of the Work, excluding those notices that do not pertain to > any part of the Derivative Works

<comment><AUTHOR> OP here. So it's okay to keep the license in source only right? Do I need to attribute on the site too?

<comment><USER14> According to the letter of the law probably. But I would suggest that it might be nice to credit the main Open Source project(s) on which your business is built, maybe in a 'Thanks to...' page.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> How does it fair against a firewall or behind a router? Is it just a simple client for convenience or does it provide a server too? Cause being able to pass through a firewall would be worth paying for, otherwise I still have the same problems as using a normal client.

<comment><AUTHOR> This works through websockets. So if you (the client) can access this website, you can RDP to your machines.

<comment><USER15> But how does it work if I can't normally RDP to my computer due to NAT router?

<comment><USER9> ngrok.com (freemium) or [https://github.com/mmatczuk/go-http- tunnel](https://github.com/mmatczuk/go-http-tunnel) (open source, needs some afford, very fast and easy configurable)

btw. @op go-http-tunnel would provides you with great base for a "branded" ngrok like client for your users.

<comment><AUTHOR> Thanks for the link. I have been planning on doing this since most people don't keep their machines with public IP.

</comment></comment></comment></comment></comment><comment><USER16> Chrome remote desktop is very fast, speedwise how does this compare?

<comment><USER12> I feel like it got a little slower when they moved it from a Chrome App to [https://remotedesktop.google.com](https://remotedesktop.google.com) as part of deprecating Chrome Apps. Other than that, it's pretty great (and simple to use). I always recommend it to people with Windows home editions, since they can't use RDP.

<comment><USER17> Is it private? I know it says it's encrypted, but that's not the same as end- to-end encrypted.

</comment></comment></comment><comment><USER18> I think this only works on the local network (or vpn) ? In which case I wonder what the added value is ? There are several free solutions that work exactly like this in a local network (like vnc). The only (?!) difference is you asking money ?

The bigger challenge (and therefore added value) is to access desktops from remote locations. Similar to TeamViewer or Google RemoteDesktop.

<comment><AUTHOR> This should work from anywhere if the server you are connecting to has a public IP.

<comment><USER18> None of 'all my desktops' have a public ip. Therefore I use Teamviewer or Google RemoteDesktop which give access to any desktop anywhere. Occasionally I use vnc or rdp for the networks where I can use vpn for access.

Its still very unclear to me what your added valude is ?

<comment><USER19> I believe most of the rented VMs on AWS/Azure have public IPs. I suppose you could use this product with those.

<comment> yjftsjthsd-h But in that case we can just run vnc on the server

<comment><USER19> I've found RDP to be a better protocol, personally.

<comment> yjftsjthsd-h Once it's set up I agree, but it's a bit of a pain to set up on Linux servers (in my limited experience, even including SSH encapsulation to make vnc not completely vulnerable).

<comment><USER19> Oh, could be. I am not a proper sysadmin though, so my experience is limited to managing a few machines at our small startup.

<comment><AUTHOR> I have seen RDP to be way faster in comparison too.

If I may ask, how do you manage those machines right now? What does the workflow look like.

<comment><USER19> I don't have a workflow as such, but being a programmer, I've tried to automate as much as I can through AD group policy and scripts. Most weeks I don't have to spend any time managing them. We're a biotech company so people here are mostly non-technical (IT) and rarely install random software, etc..

Security: I lock down most machines so that they can only run executables from certain directories, streamline windows updates through GPO, strict firewall rules, etc. At the router level, I use cisco's meraki service, which manages VPNs, content filtering and router firmware updates, etc for me.

Machine Management: I use RDP if needed. I have a 'request support' script that sends me a message if anyone needs anything.

Machine Imaging: I have a clean W10 sysprep-ed image with our LOB software, office 365, etc. I have a deployment script that sets up the partitions and images the machines, etc. I'm looking into getting Intel's ME for our office so I can do that over the network without physically going to the machine. We have two locations and its a pain if I have to physically go to the other one.

Storage: We have networked drives for every user and those get backed up every day through veeam, along with all of our VMs, etc.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Do you have to install anything on the host machine? Or can both just go to the website? (Will this help me fix my mom's computer remotely?)

<comment><AUTHOR> Unfortunately not a replacement for teamviewer right now. This only helps you access machines that already have Remote Desktop enabled and accessible on public internet. Like servers.

</comment></comment><comment><USER21> Do you support smart card authentication?

<comment><AUTHOR> Not right now! I wonder if that's doable here.

<comment><USER9> Chrome provides the WebUSB API for example: [https://developers.google.com/web/updates/2016/03/access- usb...](https://developers.google.com/web/updates/2016/03/access-usb-devices- on-the-web)

</comment></comment></comment><comment><USER22> remoteApp support?</comment>


Pyposterous, a Python API wrapper for Posterous - <AUTHOR> http://github.com/thomasw/pyposterous

<comment><USER2> If you have any feedback or if you find any bugs, I would really appreciate it if you report them with the github issues tool.

I should be able to hammer out fixes fairly quickly.</comment>


Focus on making a kickass UI, performance be damned (for now). - <AUTHOR> http://www.joelonsoftware.com/items/2007/09/18.html <comment><USER2> NewSDK is going to change everything.

<comment><AUTHOR> And Paul Graham will give those bratty NewSDK guys another 6000 boxes of instant noodles to eat if he has to, so they stay in business another three years perfecting things.

</comment></comment><comment><USER3> Why is this an either/or?

Anyway the only kickass UI is the nipple. Somehow it's just more compelling than any given layout of tabs and checkboxes....</comment>


Ask HN: Recommendation for a reliable dock for Macbook Pro 2017 - <AUTHOR> I need to connect 2 4k monitors to my 15 inch Macbook Pro. Can someone recommend a dock which would reliably for this purpose? <comment><USER2> Almost all docks available share the same Intel reference design. They differ in the type of ports offered. Just pick one of the following Thunderbolt docks that satisfies your requirements: Belkin, Elgato, Plugable, Caldigit, Kensington and OWC.

As far as I know, the only one that doesn't use Intel reference design is Mantiz: [https://mymantiz.com/products/md-01-zeus](https://mymantiz.com/products/md-01-zeus)</comment>


Ask HN: Hide button does not work for me for couple of days - <AUTHOR> I press `hide` button on NH, for several days, on several browsers, from mobile and PC. But whatever I hide appears again.<p>It never was an issue before. Do anybody see same regression? Or may be I have pressed hide to many times before and reached some limit? <comment><USER2> It's working for me. Try contacting the mods: email@example.com Sometimes this threads disappear unnoticed.</comment>


PostgreSQL is the DBMS of the Year 2017 - <AUTHOR> https://db-engines.com/en/blog_post/76 <comment><USER2> Prediction: AWS Aurora will win this award for 2018.

<comment><USER3> You think so? Spanner looks more amazing to me but I haven't had the chance to try it yet. Aurora did half my teams query time over traditional MYSQL RDS though.

<comment><USER4> Spanner is very cool, but AFAIK you will only ever use it when you realize you need to use it. It costs a minimum of $400/mo (3 nodes, in a _single_ region, triple that for multi region) and the API is non-standard (you can execute non-DML SQL against it, but DML queries are via RPC).

Aurora, OTOH is very easy to setup, speaks both Postgres and MySQL which makes it a ton more accessible. Spanner is amazing, but I don't think it will get the distribution to be DBMS of the year.

In that case, I really wish GCP had an Aurora-like solution. A standard-SQL database for applications on a pay-per-use model. Not having to lock your application into something like Cloud Datastore is nice and not having to teach people about it's weirdness is better.

<comment><USER3> The biggest google cloud sql instance is 5760$ a month on demand and 6681$ on AWS.

Both of them are designed for very large scale datasets. I find little reason to lock yourself into aurora or spanner if a single RDBMS fits your needs for cheaper pricing.

<comment><USER4> It's my understanding that there is no (reduced) lock in with Aurora because its "just MySQL/Posgresql". Push comes to shove you can `mysqldump` it, just like you can do with Cloud SQL or RDS. Spanner is a completely different beast.</comment></comment></comment></comment></comment>


Tell HN: Save your two-factor authentication backup codes - <AUTHOR>

If you use two-factor authentication, make sure you don't ignore those backup codes they tell you to save or print out. I recently was mugged (so my both my phone and laptop were taken in addition to my wallet), and I really wish I had saved my Google backup codes into Dropbox (or actually printed them out). As our identities and lives become more entrenched in the online realm, it becomes increasingly important to take the extra (even if seemingly inconvenient) precautionary steps. Life can throw all kinds of random events you'd never expect to happen to you, so as the old adage goes, it's better to be safe than sorry.<p>P.S. If anyone knows anyone at Google who can help me recover my account quicker, that would be sweet. <comment><USER2> That's a nightmare if your business is connected with that account. I wish more services employing two-factor authentication had the backup codes feature. My bank, domain registrar, and server host do not have it (but at least have 2FA). For my google apps email, I have them printed out on small cards. One in my wallet, one in my bag, one at home, and one with a trusted third party.

</comment><comment><USER3> A) If you can get a new phone (or you have a backup phone you can activate quickly) you can get a 2 factor from text.

B) You can have multiple devices with the 2 factor app. (i.e. Nexus 7 and phone)</comment>


Tech Entrepreneurs Get a Hand Pairing Up - <AUTHOR> http://on.wsj.com/OQgJ47 WSJ talks to startup founders finding each other through FounderDating and it's gaining popularity. <comment><USER2> We just got access to Founder Dating in Las Vegas. It's a great resource. I enjoy not getting pitched by biz people looking for developers, but instead have meaningful conversations about starting up businesses.

And long walks on the beach.

</comment><comment><USER3> I was a bit confused as to what Founder Dating was. It's not actually a single "meet up," but rather an online community.

We opened up Founder Dating for SLC in just a few hours. I love the program, and those behind it seem super sharp. The reasons I'm a fan:

1\. 50/50 tech/biz. Everyone knows the ratios are usually not this way, but something awesome happens when tech founders aren't outrageously outnumbered.

2\. Exclusivity. This might not be the right word, but having some control over who is in is very valuable.

</comment><comment><USER4> Founder Dating consistently does a great job in keeping the quality up as they open in each city. Agreed that the exclusivity aspect of it is one of the most valuable aspects.

</comment><comment><USER5> Linking to content behind a pay wall is really annoying...

<comment><AUTHOR> you can get beyond the paywall by copy/pasting the article title into google (almost all the time) The WSJ decides what's behind the paywall...

</comment></comment><comment><USER6> Always impressed with the people I meet who are involved with FD.

I did it a couple years back and had a terrific experience.</comment>


5,000 megapixel photo of night sky stitched together from 37,440 exposures - <AUTHOR> http://skysurvey.org/ <comment><USER3> I would pay for the dataset of these 37440 unstiched images. Author - <USER2> contact me (email in my profile).

</comment><comment><USER4> This is really amazing, just spent a few mins trying to pick out objects.

The Andromeda galaxy, the pleiades and the Orion nebula stand out in the photo in a very similar way to the real night sky.

<comment><USER5> yeah, Andromeda, Orion Nebula, SMC, LMC, all stand out so clearly

I'm really tempted to buy the 120"x30" print, I feel like the guy should be compensated for this epic task. Problem is I'd then need to find a 3 meter wall to mount the picture on!

<comment><USER6> I just saw the 120"x30" print rolled out in front of my office a couple days ago. I think the biggest challenge is figuring out a way to mount a rolled print that big without stabbing it with pushpins.

</comment></comment></comment><comment><USER7> NASA's budget was cut by $241M in 2011.

Makes you wonder sometimes.

</comment><comment><USER8> Very cool. I just wish he had made it with an area-preserving projection like the Hammer-Aitoff. Now things are distorted beyond recognition at the top and bottom.

</comment><comment><USER9> Really, why is there no download? Isn't that the whole idea? A flash-based viewer thingy is nice, but absolutely no replacement for actually downloading the entirety.

(Yes, they do provide some scaled downloads that appear to be designed for using as a desktop background. The highest resolution is only 3000x5000 though)

<comment><USER10> He might intend to sell this and doesn't want everyone and their 2nd cousin stealing it. Of course the flash thing doesn't prevent that either but it will probably prevent a large percentage of the people who see it on the web site.

</comment></comment><comment><USER11> Might not be tech-related, but this just made my day.</comment>