The value of friendships in academic success - <AUTHOR> https://www.ethz.ch/en/news-and-events/eth-news/news/2019/01/the-value-of-friendships-in-academic-success.html <comment><USER2> In almost every college course I was in, there was a clique of students that shared homework answers and copies of tests from previous semesters. I had access to these if i was lucky enough to know someone in the clique.

College is a lot easier for those who cheat. I remember courses where the class average was in the 40s before it's curved. A slight advantage could be the difference between an A and a C.

<comment><USER3> But those who cheat might not be the ones who will achieve great things.

<comment><USER4> I think a certain amount of cheater mentality is important, perhaps even necessary, for outsized success.

</comment></comment></comment><comment><USER5> Not very surprising, right?

<comment><USER6> Do they separate causation from correlation, or is that not the point?

</comment></comment><comment><USER7> Citation and nomination circles are the whole game in any mature academic field. One problem (of many) is universities and funding orgs. don't downsize mature fields.

The circular logic of scientific merit is insane. Often those who get ahead most rapidly are those who reinforce and build these circles (organizing workshops etc)

Simple things like double blind review would help this a lot and there's data to back that up, but the foundation in the US is deeply rotten.

<comment><USER8> How is this related to the article, which talks about first-year students?</comment></comment>


Top Gear's Budget Bond Submarine Car  - <AUTHOR> http://www.beaulieu.co.uk/news/top-gear-budget-bond-submarine-car <i>Features extendable rear dive planes, electrically-powered rear thrusters, a double skinned passenger compartment, a roof hatch for access and a cunning ballast system which involved filling the tyres with concrete.</i> <comment><AUTHOR> _Features extendable rear dive planes, electrically-powered rear thrusters, a double skinned passenger compartment, a roof hatch for access and a cunning ballast system which involved filling the tyres with concrete._</comment>


Marketwatch.com bug has Ford stock up 879.55% - <AUTHOR> http://www.marketwatch.com/quotes/f

<comment><USER2> You ain't seen nothing yet:

<http://finance.google.com/finance?q=iso> (up 100,067.23%)

<http://finance.google.com/finance?q=jdo> (up 81,870.14%)

<comment><USER3> I noticed a lot of numbers that were wrong outright last night myself on Google Finance's page. Obviously the source from where MarketWatch and Google Finance are getting their numbers has it screwed up. Take a look at this for instance: <http://venkatcc.googlepages.com/ObsceneNumbers.jpg>

<comment><USER4> like veecee said this is usually a data provider problem and seems like it in this case too... Fixing this is a manual process. I have notified the marketwatch.com data team and someone at marketwatch.com should be taking care of this shortly. Apparently over 4k ticker data were corrupted by the provider.

</comment></comment></comment><comment><USER5> <http://finance.yahoo.com/q?s=mo>

52-week high: 79.59

<http://www.bloomberg.com/apps/quote?ticker=mo>

Actual: 24.55

...That's not as flagrant, but here's the thing: It's been like that for months, and no one has bothered to correct it yet.

<comment><USER6> wait what?

</comment></comment><comment><AUTHOR> Looks like someone put the decimal in the wrong place:

Marketwatch price: $26.35 Actual Price: $2.63

</comment><comment><USER7> I will gladly sell you some ford stock at 26 bucks a share. Let me know.

</comment><comment><USER4> this is fixed now :-)</comment>


Orbiting Data Centers for Global Connectivity [video] - <AUTHOR> http://blog.ecomm.ec/2011/03/orbiting-data-centers.html <comment><USER2> How do you deal with radiation an heat dissipation?</comment>


Nazi Past of Long Island Hamlet Persists in a Rule for Home Buyers - <AUTHOR> http://www.nytimes.com/2015/10/20/nyregion/query-for-home-buyers-in-a-long-island-hamlet-are-you-german.html <comment><USER2> I don't get why this is even a lawsuit. It's obviously illegal.

It's completely unenforceable. They _might_ be able to forbid them from posting a sign, but the homeowners association can not stop them from listing it publicly, they simply don't have that power.

<comment><USER3> Put aside for a moment the racist implications of the bylaws and consider just the legality of listing the house publicly:

I think the league can legally prevent the listing. They own the land on which the house stands. In cases like these the homeowners lease the land. I think it could be legal for a private community that owns its grounds to prevent someone from listing their house publicly. If the homeowners were able to pick their house up and move it off the land they would not have to abide by the terms of the lease anymore, but if it's written into the lease you are legally obligated to follow the terms. If your house is permanently there you are pretty much screwed.

Of course, that is assuming that everything else is on the level and you aren't violating federal law with the terms of your lease (like only accepting people of German descent).</comment></comment>


Don't login to reference.me - <AUTHOR>

Funny story.
A web site, you login with google oauth, and after that send invitations to all of your contacts. Including that email accounts that are reserved for monitoring and alert systems.
See how my college receive and sms from and alert system and asking to ack the alert "you have and invitation from reference.me" was fun, but not serious.
So for your good. Don't even enter this spammers site.
And if you do, remember to revoke access from your oauth provider. <comment><USER2> Here's a clue: "A third party service is requesting permission to access your Google Account."

That's full access you're granting there - not just oAuth login. It's pretty hard to spot that though. Not sure if I would have.

<comment><AUTHOR> Yeah. I know is totally my fault. But that site seems like a site to trust. And yes. That is a huge mistake.

</comment></comment><comment><USER3> Your post got disappeared.

So mixtent (the guys behind reference.me) or some fans decided to all flag you? Or was it admin action?

For whatever reason, all traces of stories about startups behaving badly have a tendency to disappear from HN these days. As do stories about the dissapearance itself. Really disappointing to someone who likes the HN community.

<comment><USER4> It'd be nice to have an audit trail of admin actions on HN somewhere.

</comment></comment><comment><USER3> Well you weren't the only one at least. I got a crapload of spam from other people signing in this morning and yesterday.

What the hell was their plan here? Unless this was some project to show people not to trust these types of sites with oauth permissions then it was a catastrophic failure wasn't it?

I'd never heard of them and now all I've heard, from multiple people, is to never sign in to their site because they're horrible spammers. The tone has, 100% percent of the time, been one where they wanted to at least spit in someone from reference.me's face, if not punch them.

Unless they've figured out a way to monetize user hatred ...

</comment><comment><USER5> Why don't you report scam to oauth providers?

<comment><USER2> Any specific suggestions as to what reporting method to use?

Is there anything in place for this kind of abuse? Has anyone reported anything like this before and can comment on the efficacy of the complaint?

</comment></comment><comment><USER6> That's really disappointing. It's hard enough trying to get people to trust your app without jokers like this ruining it for the rest of us. I agree with alpb, report it!

<comment><USER7> Yeah - whew. If you guys are interested in reference websites, check out solidreference.com.

</comment></comment><comment><USER8> It's worth setting up a fake/honeypot account to play with services like this.

</comment><comment><USER9> Very happy I spotted this thread! I did wonder what they'd do with so much access to my Google account. Dodged a bullet there I think!</comment>


Show HN: Kubernetes Cronjob/Job Notifier to Slack - <AUTHOR> https://github.com/sukeesh/k8s-job-notify <comment><USER2> Nice work. So it's polling the jobs list api every minute and checking the status. But wouldn't it be possible to get an update instantly?</comment>


Symantec Issues Intermediate CA Certificate for Blue Coat Public Services - <AUTHOR> https://crt.sh/?id=19538258 <comment><AUTHOR> I'm posting this because within the past year, Symantec has gotten in hot water for issuing rogue certificates[1]. While Symantec has agreed to certificate transparency, Blue Coat is a known operator of MITM services they sell to nation-states, and this certificate would allow Blue Coat to issue arbitrary MITM certificates.

It's not clear to me why Blue Coat would need to be a trusted CA by all systems and browsers, but given their own checkered history[2] I don't think it would be unreasonable to suggest they're going to use this for MITM purposes.

[1] - [https://security.googleblog.com/2015/09/improved-digital- cer...](https://security.googleblog.com/2015/09/improved-digital-certificate- security.html)

[2] - [https://en.wikipedia.org/w/index.php?title=Blue_Coat_Systems...](https://en.wikipedia.org/w/index.php?title=Blue_Coat_Systems&oldid=721816010#Controversy)

<comment><USER2> They have a cloud services platform, perhaps it's for that? Symantec would get destroyed if they issued a CA cert that was misused, right?

Edit: This product says it does real-time traffic analysis for user transactions. It's understandable they want to make this as easy for customers as possible, just like CloudFlare. [https://www.elastica.net/cloudsoc/\--](https://www.elastica.net/cloudsoc/--) or maybe I'm misunderstanding what it does?

<comment><USER3> Yes they have a cloud service: [https://www.bluecoat.com/products-and- solutions/global-cloud...](https://www.bluecoat.com/products-and- solutions/global-cloud-operations)

In fact, other than running a legit CA service, using this intermediate CA to intercept and decrypt traffic on their cloud is the _only_ acceptable use of the intermediate CA I can think of, as long as they disclose to their cloud customers that they MitM TLS connections. After all, Blue Coat's cloud is their network, so they have the right to operate it the way they want.

Any other use of the intermediate CA would be highly irresponsible/dangerous. For example if they used it in their SSL Visibility Appliance, any owner of the appliance could extract the CA private key from the appliance.

<comment><USER4> It's acceptable (albeit a terrible practice) to MITM traffic on your own network. It's not at all acceptable for any CA certificate accepted by default in _all_ browsers (not just those on your network), no matter whether root or intermediate, to ever issue a certificate for a domain to anyone other than the owner of that domain. Issuing such a certificate is grounds for immediate revocation of browser trust.

If you want to MITM traffic on your network, have clients install your MITM certificate, which gives them ample warning about what you're doing.

<comment><USER5> It may be acceptable in certain states and jurisdictions, but it is throughly illegal in others. Remember you aren't just MITMing your own network, if someone from your network connects to my server you are MITMing me too and you have not obtained my consent for that. Even if your state is a one party consent state, mine may not be or have laws that heavily restrict interception.

<comment><USER6> He isn't talking about the legality of it at all. He is talking about what the browsers include in their trust store.

</comment></comment></comment></comment></comment></comment><comment><USER7> I wonder just how many certs I'd notice failing if I pulled Symantec's root out of my keystore - and if I'd get any mileage contacting the sites that end up broken and explaining why.

This is exactly the sort of thing I'd like to have the "CA death penalty" seriously considered against Symantec - but I fear they're going to be judged "too big to fail". A grass roots campaign of contacting sites (especially sites I've got paid accounts with) saying "Sorry, I can't use your site anymore because I've had to disable Symantec's root keys (see this link for reasons), can I please cancel my billing." might be the only thing I can do.

(Oh, and joy! [https://www.apple.com](https://www.apple.com) is secured by a Symantec cert for me right now. How much would you bet against all my Mac OS X and iOS software updates also being "secured" that way?)

<comment><USER8> What I would really like to see is a curated list of CAs and intermediates instead of the huge list my browser currently trusts. Preferably a browser extension like EFF's Privacy Badger, to make it easier to use.

I have gone into Firefox's settings and deleted random certs like the Hong Kong Post Office and this didn't break any of the sites I use, but all certificates are re-installed each time Firefox updates.

Thinking more globally, someone living in Hong Kong might prefer to keep the Post Office one but distrust all American CA's from their browser and they should be accommodated too.

Imagine treating the set of trusted CAs in your browser just like your ad blocker's filter list. You would damn sure need a trustworthy curator to maintain that list, but it seems doable (in my admittedly non-expert and humble opinion). Does such a thing exist? Moxie's Convergence extension is the closest thing to it that I'm aware of: [https://en.wikipedia.org/wiki/Convergence_%28SSL%29](https://en.wikipedia.org/wiki/Convergence_%28SSL%29)

<comment><USER9> > but distrust all American CA's from their browser and they should be > accommodated too.

Even a (mainland) Chinese user won't be able to distrust American CA's and still browse the Internet fine, and it is known that China's network is one of the most isolated one on earth filtered by the GFW. For example, Baidu's certificate is signed by Verisign, Taobao by GlobalSign, QQ by GeoTrust. All of those certificate authorities all headquartered in the United States.

CA's like Symantec is just too big to fail, even if your proposal is implemented.

</comment></comment></comment><comment><USER10> TL;TR: Don't get wild for no reason. Take instead a look at the certificate. pathlen=0

I doubt that this certificate will be used on BlueCoat appliances to MITM connections. It has a pathlen of 0 which means that it can be used to sign leaf certificates (i.e. for servers) but it cannot be used to create an additional CA. Thus in order to use this CA certificate for MITM on BlueCoat devices BlueCoat would install this certificate __including its private key __on all BlueCoat devices which would quickly expose the private key to the public.

I think that this certificate is more used inside BlueCoat's own infrastructure, i.e. to sign their companies certificates. This would be similar to what Google and others do for a long time already. And with a similar setup, i.e. "Google Internet Authority G2" has also a pathlen=0.

(this is a copy of my post on reddit/r/netsec).

<comment><USER11> not true, bluecoat devices could simply ask a bluecoat server with the CA for arbitrary certs.

<comment><USER10> That's actually a possibility but I very much doubt this would be used in practice. Apart from the scaling problem there is a more serious problem which would make use of this certificate for lots of MITM impossible:

\- today's browsers use certificate pinning, i.e. Chrome, Firefox... have predefined lists of sites where they know which public key to expect. One example of such a site is google.com.

\- The browser will usually complain if the certificate for this site is not the expected one.

\- The browser will not complain on pinned certificates if the CA issuing this certificate was explicitly added as trusted into the browser. This is to allow legal SSL interception, i.e. the one done in lots of companies to protect against malware and data leakage and done by several desktop AV products for the same reason.

Thus, if the certificate is signed by the BlueCoat CA which is implicitly trusted due to derived trust then the browser will complain because the certificate does not match the expected (pinned) one. If instead the certificate was signed by an explicitly installed CA the browser will not complain.

That's actually the way the usage of misissued certificates in Iran was detected (ComodoHacker). So this behavior would make the use of this BlueCoat CA for many MITM attacks impractical.

<comment><USER12> > today's browsers use certificate pinning, i.e. Chrome, Firefox... have > predefined lists of sites where they know which public key to expect. One > example of such a site is google.com.

Yes, this may be true, but the list is _quite_ small. You may not be able to trick Chrome into connecting to a fake google.com certificate but there's lots other "high security site[s]" as Adam Langley suggests[1] should apply when they opened this up:

> Can I get this for my site? If you run a large, high security site and want > Chrome to include pins, let me know.

The reason why this list is small is because key pinning in practice is difficult — and risky. Look to comments on Twitter from Sleevi et al. as to how easy it is to shoot yourself in the foot. HPKP is a terrific idea, but has complicated implementation challenges.

[1] [https://www.imperialviolet.org/2011/05/04/pinning.html](https://www.imperialviolet.org/2011/05/04/pinning.html)

<comment><USER10> While the list is definitely incomplete I would not call it small. Have a look at [https://chromium.googlesource.com/chromium/src/net/+/master/...](https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json)

<comment><USER11> its easy to discover whats on the list by people doing mitm...

</comment></comment></comment></comment></comment></comment><comment><USER13> This isn't necessarily as nefarious as it seems - Blue Coat is going to have to comply with Symantec's Certification Practice Statement(CPS) which prohibits the issuance of MitM certificates. In all likelihood it's to allow Blue Coat to roll out a service that allows it to create certificates for clients of its security services. Any deviation from that CPS would necessitate revoking this intermediate certificate.

That said, I'm quite curious though if Google is going to require that Blue Coat submit all issued certificates to be submitted to Certificate Transparency logs like the rest of Symantec's certificates[0].

[0] [https://security.googleblog.com/2015/10/sustaining- digital-c...](https://security.googleblog.com/2015/10/sustaining-digital- certificate-security.html)

<comment><USER14> I'm hesitant to relax here. Blue Coat's got a nasty history of making money off of the regimes that'd do this without hesitation:

[https://www.newsrecord.co/us-based-internet-surveillance- tec...](https://www.newsrecord.co/us-based-internet-surveillance-technology- used-by-authoritarian-regimes/)

<comment><USER13> Sure, but if they started issuing MitM certs ANYWHERE then Symantec would have no choice but to revoke the CA's certificate. It doesn't matter if the CA was functioning for a corrupt regime or a well-intentioned business legitimately MitM'ing employees traffic.

If Symantec didn't revoke the certificate then it would almost certainly lead to their root certificate being untrusted by major browsers and destroy their entire certificate business.

<comment><USER14> Between the time of issue and renovation, a lot of people can get arrested, monitored, or blackmailed.

<comment><USER15> that's how the beautiful rule of law works. damage done, people killed, complaint rejected, "overruled".

</comment></comment></comment></comment></comment><comment><USER16> [https://archive.is/FEZfj](https://archive.is/FEZfj) just in case this goes down.

How to untrust this certificate: [https://blog.filippo.io/untrusting-an- intermediate-ca-on-os-...](https://blog.filippo.io/untrusting-an-intermediate- ca-on-os-x/)

<comment><USER17> Its funny how reluctant I am to install the certificate in the first step. I know it works as a vaccine of sorts, but still. It feels wrong.

<comment><USER18> If you already have the signing Symantec cert trusted (likely), installing and even trusting that one doesn't make you more vulnerable than you already were. That's why it's troubling.

</comment></comment></comment><comment><USER19> What was Symantec thinking? Doing decisions that undermine their whole business?

Unless there's something that can explain this in better light, it's time to untrust Symantec brands and stop purchasing their certificates. Is it really that VeriSign, one of the pioneers in CA industry, cannot be trusted anymore?

Remember that also Thawte is their brand.

Incredible.

</comment><comment><USER20> Assad's Syria, among other newsworthy nations, is reportedly a BlueCoat customer.

</comment><comment><USER21> This sounds like a good time to mention [https://perspectives- project.org/](https://perspectives-project.org/). It augments the standard CA trust model with one based on figuring out what certs everyone else is seeing, and whether or not that's changed recently.

I think it's been a little bit inactive of late, due to poor takeup - but it would certainly benefit from more users and more people contributing to the project.

<comment><USER9> > I think it's been a little bit inactive of late, due to poor takeup

I just checked out the website, and found it interesting. And then I found it only has a Firefox extension, but not a Chrome extension. Given that the Chrome's market share is several times that of Firefox globally, maybe that is the reason of the poor takeup?

</comment></comment><comment><USER22> It really sucks that there's no way to block this intermediate CA or even the root symantec CA on iOS; the type of roaming device where it's most needed (and most likely to be used with random wifi).

</comment><comment><USER22> You know, the main job for a web CA is to verify the owner of a domain. What if... domain registrars had that job instead? They definitively know the domain registrant, no need to play games with email verification tokens or http challenges.

<comment><USER23> Domain registries & registrars do not generally verify the identity of the registrant. It can occur, but only if trademark protection mechanisms are invoked.

By testing the DNS, you really verify the domain operator, which in practice means anyone who can update the NS/DS/glue records. It's arguably quite a weak assertion.

Similarly this explains why DV certificates are cheap and EV certificates are less cheap.

<comment><USER22> I was talking about DV certificates. The registrar is in the perfect position to provide this. You could probably even set it up so nobody but the real registrar can issue certificates for a given domain, as opposed to the current free-for-all.

</comment></comment></comment><comment><USER24> So, how much of my internet will break if I distrust the Symantec cert on my machine?

<comment><USER25> If your threat model contains nation-states, you shouldn't be trusting any CAs in the first place.

With a nation-state adversary, you really need to be manually verifying certificate hashes that have been securely communicated to you out of band.

<comment><USER7> Sure - but from the (to be taken with appropriate credibility rating) WikiPedia page for BlueCoat:

"Blue Coat products are primarily used by enterprises, schools, hospitals, governments, and public agencies to block malware and malicious threats, control access to applications and content in the workplace, surveillance, censorship, and improve the performance of network applications."

I'm resigned to acknowledging that if the NSA (GHCQ/ASD/insert-local- equivalent at least for five-eyes nations) wants to investigate _me_ specifically, I'm fucked and my only option is to not use the internet (or telephones or mail or or or).

I'm not (yet) prepared to give up and hand that level of access to my digital life to enterprises, schools, (most bits of the) government, or public agencies.

<comment><USER25> Ok, so if your adversary is your employer or your school, you are presumably using a network not controlled by you, in which case your endpoint ought to already be a VPN.

A good number of employer or school-provider devices will have their own certificates preinstalled anyway.

Nobody ever said privacy was convenient.

<comment><USER7> I'm good with my work or school owned/issued device trusting a root cert installed by that device's owner.

I'm _not good with a school or employer's network being able to generate arbitrary certs for my email, bank, social networks, etc - WITHOUT ME KNOWING ABOUT IT ON MY PERSONAL DEVICES... Sure, MitM me if it's your network - but I 100% should be able to rely on my browser on my device reliably being able to tell me "You're attempting to visit [https://mybank.com](https://mybank.com), but the certificate identifies it as mybank.suspiciouscorp.net Continue anyway (not recommended): [OK] [Hell no!]"

<comment><USER26> If you have a problem with that, use your own network.

<comment><USER5> What if the site they're connecting to has a problem with that? If I for example serve E-Healthcare records, and have an agreement that a given person that I have vetted has access to them, I might have a problem with your unvetted IT staff having access but how would I know?

<comment><USER26> Sounds like you have a contract problem with the vetted individual.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> Oh hell. This can't be good.

</comment><comment><USER28> This is very much a case of "the who not the what"... they've been in some shady dealings with countries that explicitly have goals to deny freedom of information.

</comment><comment><USER29> Also [https://news.ycombinator.com/item?id=11781875](https://news.ycombinator.com/item?id=11781875).

</comment><comment><USER30> I'd forgotten that Symantec had acquired Verisign at some point and they are huge certificate supplier. I was planning to untrust Symantec but not sure that is feasible for the Verisign certs too.

<comment><USER31> Bear in mind that Symantec also owns Thawte.

</comment></comment><comment><USER32> 'azet noted in another forum that with pathlen:0, this cert cannot be used to issue other intermediate certs, such as they would to place in a traffic inspection device.

<comment><USER33> Blue Coat can trivially work around this limitation by placing the intermediate cert on a server. Now when the traffic inspection device wants a (leaf) cert, it calls home to the server and the server provides it.

<comment><USER32> Seems like it would have unacceptable performance limitations.

<comment><USER33> That's your source of security? Performance limitations?

I'm not even convinced it would have performance limitations. Let's say Alice and Bob are communicating and Eve has the BlueCoat device in the middle. Alice sends the initial connection request to Bob, but Eve gets it instead. Eve then sends a new initial request to Bob AND a request to the BlueCoat server to get the fake cert _in parallel_. As long as the BlueCoat server responds with similar latency to Bob, Alice won't see any significant difference in latency as compared to Eve simply forwarding the requests.

<comment><USER32> I didn't say that at all.

<comment><USER33> Okay, so what did you mean when you said, "Seems like it would have unacceptable performance limitations."

</comment></comment></comment></comment></comment></comment><comment><USER34> Isn't the dead-line for Google removing Symantec from Chrome supposed to be this June? (if they don't adopt CT for all of their certificates by then, that is)

<comment><USER35> Google hasn't said anything about removing Symantec under those circumstances. Failing to publish a certificate will result in a browser warning for visitors beginning June 1st[1].

[1]: [https://groups.google.com/a/chromium.org/forum/#!topic/ct- po...](https://groups.google.com/a/chromium.org/forum/#!topic/ct- policy/hNKxsHIO8gU)

</comment></comment><comment><USER15> once again, evidence how completely broken the ca system is. let the blame game begin.</comment>


Making Penicillin at Home - <AUTHOR> https://www.doomandbloom.net/making-penicillin-at-home/ <comment><USER2> Not sure I'd risk this myself. However when I did chemistry at A level at school, with the intention of going into pharma for a bit, I did extract aspirin from willow bark. This is something you can do relatively easily and safely yourself. Disclaimer: if you kill yourself it wasn't my fault.

Thanks to my wonderful chemistry teacher I got a couple of hours at Glaxo and run NMR on it to validate it. Was an amazing experience even if it was a bit worrying getting the train there with vials of white crystalline substance on me.

<comment><USER3> Just to be clear: There is no aspirin in willow bark. Willow bark contains salicin which metabolizes into salicylic acid (which is still different from aspirin, ie. acetylsalicylic acid).

<comment><USER4> > salicylic acid

I could be wrong, but isn't that the main ingredient in Stridex? I used to have oily skin (before changing my diet) and I could've sworn that I used salicylic acid as a chemical exfoliant.

<comment><USER5> Yes. Also the active ingredient in Wart remover, though at higher concentrations (2% for stridex and 17% for wart remover). Good at melting skin I guess.

<comment><USER3> Which perhaps illustrates why it's not so good for your stomach and why, therefore, aspirin (same properties without stomach issues) was a breakthrough.

<comment><USER6> Aspirin isn't especially great on your stomach either.

<comment><USER3> It is much better. That's the point...

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Reminds me that to do just about anything, you need tools, and most importantly measurement tools. Metrology is subtle. I'd love to know how to make sub milligram scale.

Something a little more stable than [http://sci- toys.com/scitoys/scitoys/mathematics/microgram_ba...](http://sci- toys.com/scitoys/scitoys/mathematics/microgram_balance/balance.html)

ps: More like [https://erowid.org/psychoactives/hardware/hardware_info1.sht...](https://erowid.org/psychoactives/hardware/hardware_info1.shtml)

<comment><USER8> Saw this DIY one a few years back on youtube, looks like the Erowid one, thought it was a neat build - [https://www.youtube.com/watch?v=n90whRO- ypE](https://www.youtube.com/watch?v=n90whRO-ypE)

YouTube just dug up a a real nice breakdown that Ben Krasnow did - [https://www.youtube.com/watch?v=ta7nlkI5K5g](https://www.youtube.com/watch?v=ta7nlkI5K5g)

<comment><USER7> I see Ben Krasnoz I click

</comment></comment></comment><comment><USER9> The big breakthrough with penicillin wasn't discovery it was mass production. Many fungal species produce it, but it took an extensive search to find one that produced a lot of it and then "genetic engineering" (via mutagenesis) to produce a variant which made enough to make the whole thing feasible.

<comment><USER10> Perhaps to combat drug resistance to human-facing bacteria, we should be promoting resistance in bacteria that infect fungi. Eventually, nature may lead us to the next step in the arms race.

</comment></comment><comment><USER11> You can also homebrew tetracycline beer like the ancient Nubians.

[http://www.emory.edu/EMORY_REPORT/stories/2010/09/07/beer.ht...](http://www.emory.edu/EMORY_REPORT/stories/2010/09/07/beer.html)

I guess the trick is to obtain and maintain a healthy Streptomyces colony. Antibiotic laced beer should keep real well without refrigeration, too.

</comment><comment><USER12> Actually found it more interesting that you can buy aquarium antibiotics without a prescription. But doesn't antibiotics have a fairly short shelf life? Wouldn't that be kinda difficult to stockpile?

<comment><USER13> They used to sell them on Amazon until they got wind of it. An old homeless friend taught me that trick, and as someone who was uninsured in the US for a long time (my health plan for most of the last decade was "worldwide, excluding USA") I used it a number of times when treating minor infections (versus giving the urgent care $200).

Make sure you take a full course, in any event, and recall that many bacteria these days are resistant to Penicillin.

These days, I stock my prepper kit of antibiotics from [https://www.alldaychemist.com](https://www.alldaychemist.com), and they take bitcoin now too.

</comment></comment><comment><USER14> This whole article seems like an offhand way to get people to stockpile aquarium antibiotics. This guy is obviously on Big Aquarium Pharma's payrol.

</comment><comment><USER15> Useful to know if you want to keep your digestion running predictably, without hidden disruptors: "One thing you might not know is that a lot of bakeries put a substance called a mold inhibitor on bread. This stuff, which is called mycoban, is going to suppress the fungus, so you should probably use bread that you baked yourself."

</comment><comment><USER16> ...with only 5 or 6 other hard-to-find substances. If you are stockpiling those items, why not stockpile penicillin itself?

</comment><comment><USER17> TLDR: if, in a post apocalyptic world, your home laboratory is still running, you are able to grow penicillium or aspergillus cultures. These may, or likely may not, produce penicillin..

<comment><USER18> I'm curious about what, exactly, the people who take this seriously think they're preparing _for_.

In a scenario severe enough you're trying to make your own antibiotics, you can assume hospitals aren't functioning, which means civil society is gone.

You can't assume the government is gone, BTW: Every power vacuum will get filled, one way or the other, and there are plenty of unrecognized governments which are as governmental as they need to be to enforce their idea of order in a defined region.

Therefore... you, the prepper who was responsible enough to squirrel away tools and knowledge and supplies, are a target. If the government is trying to rebuild, it's going to be seizing supplies and, possibly, conscripting anyone capable of using those supplies who didn't have the good sense to _leave_ when the getting was good. If the government isn't trying to rebuild... well, since when have gangs _not_ looted anyone with stuff worth having?

It comes down to a survivalist fantasy, which amounts to one person, one family, one karass, against the world. A small, intimate group, as opposed to the granfalloon with guns which is called a military. Well... when a small group goes up against a big group, the small group is almost always fated to lose.

"Stable ownership is the gift of social law, and is given late in the progress of society." \--Thomas Jefferson to Isaac McPherson, 1813. ME 13:333

<comment><USER8> What about cases like Katrina and Puerto Rico, where there are no local services but there are zero threats to the sovereignty of the federal government?

You don't need to survive Mad Max style for decades, you just need to make it a month or two until roads are open and power is back on. In this case having a stash of antibiotics could mean the difference between life and death for someone that's injured, and as the article points out there's no real good reason to grow your own when you can buy serviceable alternatives online.

<comment><USER19> Exactly. Living your life with zero buffer against fluctuations in the availability of life-critical materials is just as stupid as people who are prepping for zombie invasions. One guy thinks nothing will ever happen and the other thinks society is a transient entity. They are both fantasies. If you aren't ready for earthquakes, fires, financial disasters and etc then you have a short attention span or you're just lazy.

Besides all this, consolidation and integration of life-support is the way of the future. If you look at society as one big system, it makes a lot of sense to have lots of redundant units rather than all units depending on one central resource. Sole and batteries for example harden the whole country against equipment failure, terror attack, negligence and natural disasters. With a single power plant any instance of one of those things could bring down huge numbers of houses. Technology is making it possible to produce some of the things you need in home, so there is a funny convergence of preppers and technologists.

<comment><USER20> No idea why you've been d/ved, as you say, there's so many potential, but low risk, scenarios. Even in America and the EU we've all got a 0.5%, maybe 0.1% every year that something could go very wrong. Most likely is that it doesn't spiral, like the 2008 financial crisis, but there was a real, but small, chance that could have gone much worse.

His comment not only is ignoring real-life examples that have happened within his life time (Afghanistan, Iraq, Syria, Venezula, Katrina, Puerto Rico, etc.), he's also postulating that these new governmental structures would magically spring up over night, rather than taking years or even decades to emerge.

I'm no prepper, but I do feel that I am knowingly taking a risk, albeit a very small one, by not being one. If I had a family to care for, I would definitely be more prepared with 3 months food and some emergency medical supplies beyond a first aid kit. It's a small enough risk that it will probably not happen for my generation or my country, but it does happen.

I also often don't buy insurance for things I think aren't worth it, but it's still a deliberate choice rather than sleep walking into it.

It's almost on the same risk percentage as Home Insurance, so if you're insuring your home, why aren't you 'spending' a little time each year prepping? Just because it's socially unacceptable, but home insurance is regarded as socially acceptable?

<comment> barrow-rider Doesn't even have to be something destructive like Iraq or Puerto Rico, Argentina comes to mind: serious economic collapse, maybe not Venezula-style, but enough that it disrupted things heavily.

I agree with the parent -- it's just insurance, and is a cost-benefit trade- off that needs to be evaluated in a similar fashion as flood insurance or the like.

There are a lot of what I'd call "psychological" or perception-based factors for doing things like hoarding guns and food, and it's easy to go overboard, but they're not fundamentally poor choices.

</comment></comment></comment></comment></comment></comment><comment><USER21> This would be more interesting if they provided methods for checking/controlling the quality of the result.

</comment><comment><USER22> Huh. This is basically an advertisement for aquarium antibiotics.

Why aren't preppers building phage libraries instead? Isn't that more workable with limited resources than antibiotics production? You basically just need a DIY bacterial culture medium (such as soup stock), glassware, and dirt.

</comment><comment><USER23> Is there a book that teaches you more about this stuff? I'm getting more and more interested in this after reading the cancer drugs people in China are making. This seems like a fun experiment to do at home for a weekend.

</comment><comment><USER24> *How to kill yourself with fungal toxins because you fail to grow the correct species.

</comment><comment><USER25> Not quite biology, but sulfanilamide is simple enough to synthesize at home, as is dapsone and maybe isoniazid. Most antibiotics (e.g. cipro) are way out of reach, though.

</comment><comment><USER26> So.. who just bought a bunch of Fish-Mox?

</comment><comment><USER27> Site is 503'd, unfortunately.

</comment><comment><USER28> I thought most of the stuff you'd want antibiotics for is resistant to penicillin by now.

For the cuts and bruises mentioned, clean and bandage them and make sure your tetanus vaccination is up to date. Maybe make some calendula and/or yarrow extract, if you're into making your own remedies.</comment>


Humour 'comes from testosterone' - <AUTHOR> http://news.bbc.co.uk/2/hi/health/7153584.stm <comment><USER2> I'd never thought of it that way, to be honest:

"He suggested men might respond aggressively because they see the other unicycling man as a threat, attracting female attention away from themselves."

<comment><USER3> That or people on unicycles are stupid.

<comment><USER4> Another data point that fits the theory.

<comment><USER3> Yes, it wasn't just a joke. I actually fear a man on a unicycle stealing my wife.

</comment></comment></comment></comment><comment><USER5> Another (of countless) example of "correlation must equal causation".

(Look at all the garbage those rats brought with them.)

</comment><comment><USER6> The chaps fight with one another on blogs for the same reason. Oddly, it never helps with breeding.

</comment><comment><USER7> Worst "science" of the year</comment>


Klout Score: Measuring Influence Across Multiple Social Networks - <AUTHOR> http://arxiv.org/abs/1510.08487 <comment><USER2> I thought it died a while back..

[http://www.slate.com/articles/business/the_bet/2014/05/klout...](http://www.slate.com/articles/business/the_bet/2014/05/klout_is_basically_dead_but_it_finally_matters.html)

<comment><USER3> Klout is long dead, but Klouchebag lives on: [http://www.tomscott.com/klouchebag/](http://www.tomscott.com/klouchebag/).

<comment><USER4> How is Klout long dead? I opened an account today. So, genuinely confused. Please enlighten me.

Thanks.

<comment><USER3> Perhaps I should ask whether you think that horsecarts are long-dead as a mode of transportation. They're still legal, and one can still purchase horses, carts, tack, etc. But no more than a handful of people use them on any given day. To me, they're long-dead: still historically instructive, but not economically relevant. Klout is in the same bucket.

<comment><USER5> At least horsecarts had their day, and took millions of people for a ride to their destination.

Klout tried to take people for a ride, but nobody would hitch their wagon to them, because it was horse shit.

</comment></comment></comment></comment></comment><comment><USER6> Isn't Klout basically "Twitter followers + rand(20%)"? I only skimmed it, but the paper doesn't seem to directly address how much better Klout is over just going off Twitter followers.

See chart here: [https://moz.com/blog/social- authority](https://moz.com/blog/social-authority)

<comment><USER7> No, they count retweets and shit.

<comment><USER5> If they count shit, it's no wonder Justin Bieber had such a high score.

</comment></comment></comment><comment><USER8> I don't get it:

"In this work, we present the Klout Score, an influence scoring system that assigns scores to 750 million users across 9 different social networks on a daily basis. We propose a hierarchical framework for generating an influence score for each user, by incorporating information for the user from multiple networks and communities."

why are they "proposing a hierarchical framework". the thing already exists. It's like me proposing we have a vehicles that use four wheels and internal combustion engines.

<comment><USER4> I thnk it is kind of like coming up with a standard metric that compares cars, trucks, SUVs, hang gliders, trains and horses.

</comment></comment><comment><USER9> Obligatory Klout XKCD: [http://xkcd.com/1057/](http://xkcd.com/1057/).

</comment><comment><USER10> So are they actually leveraging Klout[1]?

[1] [https://klout.com/home](https://klout.com/home)

<comment><USER11> The authors are from Klout, so it's documenting what Klout does, or at least the science behind their decision to do certain things.

</comment></comment><comment><USER12> Url changed from [http://www.forbes.com/sites/theopriestley/2015/10/30/how- klo...](http://www.forbes.com/sites/theopriestley/2015/10/30/how-klout- leverages-machine-learning-to-calculate-influence/), which points to this.</comment>


Blockchain and Trust - <AUTHOR> https://www.schneier.com/blog/archives/2019/02/blockchain_and_.html <comment><USER2> Cryptocurrencies doesn't remove all trust. It's about removing trust in third parties to send and receive transactions. That's it. And that's a big deal.

> _Honestly, cryptocurrencies are useless._

Honestly, he makes some good points but this is ignorant.

For example:

* Uncensorable donations to wikileaks

* Avoid having PayPal or other payment processors freeze your merchant account for X months, on a whim

* Avoid the risk of charge back fraud for online payments

* Ability for weed shops and porn sites to accept digital payments

* Fleeing Venezuela with your wealth intact

* Send money to and from countries where no banks or western union operate.

* Financial privacy for everyone not just the ultra rich (lookup Monero before commenting)

Cryptocurrencies have some very good features.

There are issues of course, but how can you claim all these are useless?

> _For bitcoin, that 's the cost of the additional bitcoin mined_

No, that's the cost of securing the network to prevent double spends.

<comment><USER3> I can think of counterpoints:

> * Uncensorable donations to wikileaks

Untraceable theft from your wallet

> * Avoid having PayPal or other payment processors freeze your merchant > account for X months, on a whim

Unregulated merchants who aren't incentivized to play by the rules

> * Avoid the risk of charge back fraud for online payments

No third-party intermediary in the event you get ripped off.

> * Ability for weed shops and porn sites to accept digital payments

Ability for weed shops and porn sites to accept digital payments (This depends on your stance on these issues. Not everyone feels the same as you).

> * Fleeing Venezuela with your wealth intact

Fair enough

> * Send money to and from countries where no banks or western union operate.

Indeed this is useful, but seems like a small use case relative to the hype around the tech

> * Financial privacy for everyone not just the ultra rich (lookup Monero > before commenting)

If you buy something on ebay, ebay and the credit card company have a record of your purchase. If you buy something from a bitcoin merchant, they will have a record of your purchase. How is that different?

<comment><USER4> > Untraceable theft from your wallet

Theft is traceable (by looking at the blockchain). Theft is untraceable in the fiat system, because you don't have access to the bank's coffers to check they've not pilfered your money. Turns out they never had the coffers anyway, your money is just some number on a screen, and there are people who have the ability to change those number arbitrarily.

If you take the right steps to secure your bitcoin private key, it doesn't even need to exist in digital form, or physical form, ever. It can be purely inside your head. It's just a number. One which the probability of somebody guessing correctly is unimaginably small.

> Unregulated merchants who aren't incentivized to play by the rules

The same is true for fiat money. Scammers exist, and if you get scammed, you will usually be stuck for months without access to your funds while some third party performs an "investigation" (In paypal's case, "investigation" means return money to the buyer).

How about unregulated "customers" who are not incentivized to play by the rules? Credit card fraud is a huge cost to businesses.

> No third-party intermediary in the event you get ripped off.

The correct term is _choice_ of third-party intermediary (or not). Bitcoin does not force an escrow on you, but allows you to choose whether or not to use one, and who to use. This process can be conducted digitally with multisig transactiton outputs.

> (This depends on your stance with these issues. Not everyone feels the same > as you).

 _Feels_ are overrated. What are you going to _do_ about it? We've already seen that action is worse than inaction in drug wars. If you think that paying for porn is immoral, what about the morality of you declaring unilaterally that you are cutting off the income of women because you don't like them getting naked in front of a camera?

<comment><USER5> > Theft is traceable (by looking at the blockchain).

So the people who stole the money from Mt. Gox are currently sitting in jail, right?

This also shows the doublethink you sometimes see with cryptocurrency: it's totally anonymous, and so you can use it for privacy, except for when it's not, so you can use the immutable record to figure out who harmed you.

<comment><USER4> I was referring to the ability to discover that your funds have been stolen, not necessarily who stole them. (The latter usually doesn't matter, you probably won't see the money again). The fiat system has no ability to monitor for theft. Theft can go on for years unnoticed, and by the time it is noticed, the entitiy involved may be insolvent, having a bigger effect on many people, or even the larger society if the entities are big enough.

Bitcoin is not totally anonymous. If you trade through AML compliant entities, your details will be linked to transactions, and people might be able to discover who you transact with based on the public transaction information. With coinjoin and similar fungibility enhancements, that process of tracking is made far more difficult towards impossible. Also, the Lightning Network enables anonymous payments through an onion routed network, where the only public information is who you have open channels with. Anonymity will become the norm in Bitcoin even if it not the case yet.

If you look at it from the perspective of a merchant, rather than from a "consumer protection" point of view, then a merchant generally does not know who defrauded them with stolen credit cards. In general, it is rarely worth investigating and businesses will generally count their losses. Entities like Paypal are notoriously bad for the seller as they side with the buyer most of the time - it isn't their money so they don't need to take it seriously.

Bitcoin will benefit merchants, who can take payments which are irreversible, except by their own decisions for refunding. Consumers will need to take a bit more responsibility to vet the reputations of the merchants they deal with, instead of always being bailed out for their poor decisions.

</comment></comment></comment></comment></comment><comment><USER6> He has a number of good points. He's applied his model of trust in society, which includes four major incarnations of trust (morals, reputation, institutions, and security systems), to the topic of blockchain. This is a useful way of analyzing the utility of blockchain.

However, the article doesn't touch at all on the historical situations in which people decide to reformulate the different aspects of that model. For example, why did the French people decide in the late 1700s to rise up and recast the existing institutions of trust (i.e. the monarchy)? Because they weren't working. Similarly, the bitcoin whitepaper appeared in many ways as a response to the 2008 financial crisis. During that period, it was very clearly demonstrated that existing trust institutions weren't working and that they also wouldn't be held properly accountable.

Blockchain tech does not eliminate the need for trust. Smart people working and living in the blockchain space already understand this. In a sense, it's more appropriate to look at blockchain as a next generation trust institution (and I mean institution in a broader sense e.g. the "institution of marriage") which is _more_ autonomous than what has existed previously. Just because the average modern day human doesn't understand and, therefore, trust blockchain technology doesn't mean that there aren't people who do both trust and understand the technology.

</comment><comment><USER7> _> Honestly, cryptocurrencies are useless._

It's always strange when people are overly specific.

Is it private money that will never find any use anymore, or is it just that they can never be digital?

The first is not an unreasonable opinion to have, given modern history and the relative success of fiscal policy (at least in the latter half of the 20th century), the second I find harder to justify.

 _> Would you rather trust a human legal system_

The real world is far from that clear cut. Users of other private currencies, such as eGold, might be tempted to disagree. Hacks (in any and every sense) of those systems were even more devastating.

If you only ever consider every currency an alternative to the dollar, and limit yourself to that use case, you might as well ask yourself why any other currency exist at all.

<comment><USER8> I do think he contradicts that sentence in the following one:

> ...and criminals who want a black-market way to exchange money.

So not "useless" but of questionable value. But I believe bitcoin will probably never go away for this reason alone.

<comment><USER9> There will probably never be an economy or society that exists without a black market but that doesn't mean aiding such markets is a feature, not a bug.

<comment><USER10> Well it depends on the black market.

It might not be a feature in your opinion, but other people disagree, and do believe it to be a feature.

There are literally billions of people in the world that currently live in what I'd describe as an authoritarian dictatorship. So yes, I support black markets in these areas.

</comment></comment></comment></comment><comment><USER11> _When that trust turns out to be misplaced, there is no recourse. If your bitcoin exchange gets hacked, you lose all of your money. If your bitcoin wallet gets hacked, you lose all of your money. If you forget your login credentials, you lose all of your money. If there 's a bug in the code of your smart contract, you lose all of your money. If someone successfully hacks the blockchain security, you lose all of your money. In many ways, trusting technology is harder than trusting people. Would you rather trust a human legal system or the details of some computer code you don't have the expertise to audit?_

In making the case for human systems over bitcoin, Bruce Schneider echoes the same arguments that eventually led to FDR stealing every US citizen's gold in 1933 to bail out the federal reserve. To me it seems deplorable for someone to advocate placating dishonest institutions founded on a legacy of screwing over people.

<comment><USER4> Not only 1933, they've been stealing money ever since through a monetary policy of constant inflation. Deliberate inflation is theft of a small percentage of the money of all savers.

<comment><USER12> You do realize that non-inflation was one of the main causes of the great depression, right? Are you telling me that you would spend your money on consumer products and employing people if you knew that it would be worth more if you left it sitting in your bank?

<comment><USER4> Whether you think inflation is justified or not does not negate the argument. It is still theft. If savers did not have money, economists would not have anything to inflate. The inflation benefits the money printer, because they spend it at the market rate at the time of printing, but by the time it works its way through the economy, the effect is reduced purchasing power for the saver or consumer.

Yes, inflation is a deterrent on saving, pushing people to instead invest their money. Whether it is a good thing that people blow all of their money on junk consumer goods is another question.

What if some people just want to save, and not take risks? Well, it's their own choice, and now they are able to make such choice because there are no economists controlling the monetary policy of Bitcoin. What you think was justified previously, might no longer be possible. If we slip into depression due to deflation again, we might have to come up with some other solution, which isn't just kicking the can down the road.

<comment><USER13> I consider this debate an unresolved issue in economics. We don't know how to create a genuinely balanced and productive economy.

Option #1: deflationary economy where monetary velocity collapses and with it employment, investment, and innovation, ending in permanent depression (dark age) and slavery to a money-hoarding landed rentier class. Board game: Monopoly.

Option #2: inflationary economy that prioritizes spending and investment over saving, runs on debt, and ends with slavery to consumerism, bullshit jobs, and landfills overflowing with junk. Board game: Risk.

Pick your poison.

In the 20th century most nations went for option #2 because those that didn't tended to be overcome by the financial and military power of those that did. China is currently performing the most extreme inflationary economics experiment in history.

This post makes me remember a definition I heard once in school of economics: "the science of why everything sucks."

<comment><USER14> I mean it is resolved, and your two options kind of show it. The resolution is very low and slow inflationary economics, to match the growth rate in the economy. This should prioritize a safe level of saving and investment.

Higher and lower rates of inflation can be enforced (via central banks) to help fight recession or demand driven inflation (price level increases). However constantly tweaking inflation rates to get the exact right level for the current period of countries economic cycle (debt/savings levels, price levels etc...) is quite difficult. So yes we do know "how" to balance an economy in a general sense, in the same way we know how to build a web application in the general sense, but there is always work do be done in the details.

<comment><USER13> We've been trying to do that. The problem is that macroeconomic inflation is a big sausage number that doesn't really say much about the reality on the street.

Take a look at this:

[http://thesoundingline.com/why-inflation-is-much-worse- than-...](http://thesoundingline.com/why-inflation-is-much-worse-than-the- headline-numbers-suggest/)

Price stability has only been achieved for a few categories of things and the divergence is huge.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> This is technically a repost from the Wired article.

[https://news.ycombinator.com/item?id=19097613](https://news.ycombinator.com/item?id=19097613)

</comment><comment><USER16> > Bitcoin might theoretically be based on distributed trust, but in practice, > that's just not true.

I'll grant that Bitcoin is not perfectly centralized. But I challenge you to find a more decentralized digital currency on the planet.

A digital currency doesn't need to be 100% decentralized to be very useful as a digital medium of exchange.

<comment><USER17> It depends on your definition of "useful". It doesn't need to be 100% decentralised to allow exchange to take place without a single technical point of failure existing, but it probably does need to be substantially more decentralised than it actually is to not actually have bigger trust issues than traditional currency (at least for people trying to carry out legal transactions in a developed world financial system).

</comment></comment><comment><USER18> > In fact, a system where you can lose your life savings if you forget your > key or download a piece of malware is not particularly trustworthy. No > amount of explaining how SHA-256 works to prevent double-spending will fix > that.

A second-layer solution, built on top of bitcoin, that would allow transactions to be reversed by a central authority, if a person decided to place their trust in that authority, could fix that, though.

This is the problem with the article: it doesn't take into account bitcoin's ability to change. It's like Schneier is saying the internet will never work because dial-up modems are slow and hog your phone line.

He's assuming no further innovation will occur. And like the early internet, it's practically impossible to predict what cryptocurrencies will look like in a few decades.

</comment><comment><USER19> Of course trust is still involved. The whitepaper specifically puts "trust" in the context of trusted third parties ("financial institutions serving as trusted third parties to process electronic payments"), and proposes a solution to the double-spend problem when they are not relied upon. It is a very unique solution that could be useful in solving some very specific use cases. There are a wide number of risks that could cause bitcoin to crumble - Core Dev Matt Corralo often says he gives bitcoin a 5% chance of success. The wide-sweeping conclusion is that blockchain is useless, though I would agree in almost all cases, it disregards the successful instances where trust minimization provides substantial benefit.

</comment><comment><USER20> >but centralized (as in there's only one)

I think that should be "global", especially since "centralized" means something significantly different in blockchain circles (and bs goes on to use it in that sense later in the article).

<comment><USER21> Logically centralized but physically decentralized would be a specification, but his statement is correct. "Centralized" does not have a different meaning in blockchain circles, however it (and especially the inverse "decentralized) has become a weasel word that people use frivolously.

<comment><USER22> I've definitely seen, and been guilty of, using "centralization" as a weasel word in blockchain circles. Agreed this should change. Usually what's meant is "potential for corruption or abuse."

</comment></comment></comment><comment><USER23> If blockchain is so great, where are all the killer apps for this fantastic new technology? C'mon, we're 10 years into the cryptocurrency revolution, and we're still arguing about hypothetical use cases.

<comment><USER24> I think ICOs were something of a killer app and they served to move things forward considerably. I don't think people have fully realized the breadth and depth of impact ICOs have had yet.

For some relativity:

      - 1969: ARPANET
      - 1971: Email
      - 1973: TCP/IP
      - 1980: Usenet
      - 1989: Commercial ISP
      - 1994: Netscape
      - 1999: AJAX / Live Journal
      - 2001: Dot com bubble.
      - 2004: Gmail/Facebook
      - 2006: Twitter
      - 2009: Bitcoin
      - 2011: Twitch
      - 2013: First ICO
      - 2014: Alexa
      - 2015: Ethereum
      - 2017: Cryptokitties, EOS
      - 2018: Tron
      - 2019: Profit?

I think the next wave of killer apps will include a lot of creative new games. I think gaming will be a big force in blockchain adoption in general.

<comment><USER25> Nice timeline.

But... Tron?!

<comment><USER24> I'm not a Tron fan, I listed it because 1) it was something that happened last year and 2) a few of the most played dapp games are running on Tron right now (and EOS)

Now I'm wondering, what else happened last year? I was sleepy.

</comment></comment></comment></comment><comment><USER26> The trust Nakamoto refers to is explicitly and obviously the trust demanded by "trusted third parties" that intrude into transactions.

Removing this intrusion allows _increased_ trust between members of society.

</comment><comment><USER27> This person is unfamiliar with what it means to run a public trading vehicle along with the value that comes with that. Public trading vehicles are designed to exercise capital from the capital markets. This is what enables public companies to grow. Crypto another form of a public trading vehicle in a new global capital marketplace and it helps legitimate companies grow.

</comment><comment><USER28> _When that trust turns out to be misplaced, there is no recourse. If your bitcoin exchange gets hacked, you lose all of your money. If your bitcoin wallet gets hacked, you lose all of your money. If you forget your login credentials, you lose all of your money. If there 's a bug in the code of your smart contract, you lose all of your money. If someone successfully hacks the blockchain security, you lose all of your money. In many ways, trusting technology is harder than trusting people. Would you rather trust a human legal system or the details of some computer code you don't have the expertise to audit?_

Most of these things have nothing to do with "blockchain" or Bitcoin. Exchanges are outside the scope - entirely. They are merely one kind of merchant. "Wallets" are also outside the scope, because the protocol only knows about scripts. Login credentials play no role whatsoever in Bitcoin - that's an add-on provided by third parties.

Bugs in contract code are a problem. That's why you don't trust it. You _verify_ it - just like you read any contract you sign.

"Hacking blockchain security" is another matter. What Schneier is referring to is the Ethereum Classic majority hash rate attack. That's a well-known limitation of all block chains. Satoshi's white paper deals with it extensively and quantitatively. It's not like Schneier has stumbled onto something novel here.

 _These four elements work together to enable trust. Take banking, for example. Financial institutions, merchants, and individuals are all concerned with their reputations, which prevents theft and fraud. The laws and regulations surrounding every aspect of banking keep everyone in line, including backstops that limit risks in the case of fraud. And there are lots of security systems in place, from anti-counterfeiting technologies to internet-security technologies._

The nativity here beggars belief. Does this man not remember 2008? Does he not remember HSBC? Does he not know that the individuals responsible for the most egregious bank fraud have never been punished in a criminal sense? Does he not remember the vast amounts of sensitive, personal information leaked by these institutions? Has he never heard of the massive, unconstitutional civil asset forfeiture problem in the US?

The best you can say about the banking system is that laws/regulations may inhibit, to some degree, some forms of theft and fraud.

<comment><USER29> The loses as a percentage of funds have been vastly less in conventional banking and similar than in cryptocurrency.

</comment></comment><comment><USER30> Regressive author can't understand the Theory of Conservation of Mass. Gives us the environmental waste straw man and follows it up with an appeal to power. Fails to understand that the real innovation in trust is the stable horizontal structure that makes top down governance obsolete. Enjoyed reading anyway

<comment><USER31> > is the stable horizontal structure that makes top down governance obsolete

lol, how can bitcoiners still believe this? SegWit was introduced top-down, The DAO was top-down governance.

Everthing about bitcoin, the mining, the software, the majority owners of all bitcoins ever mined, is ruled and in the hands of less than 12 people.

<comment><USER32> The counterpoint that those n<12 people are supported by, and theoretically accountable to, the vast ecosystem of miners, investors, and developers.

...and the counter-counterpoint: for all the shortcomings of modern democracy, the same is at least somewhat true of the board members of the Federal Reserve, and the elected congress-critters who occupy the relevant regulatory committees.

</comment></comment></comment><comment><USER33> almost all the comments are negative about the article but many people upvoted. I like the dynamics of HN

<comment><USER24> Increasingly I have noticed that people who can see the future have given up on engaging those that can not.

</comment></comment><comment><USER34> I like Bitcoin, I don't see a use for any other coin. Decentralized verification seems to be valuable in Currency only.

Timestamps and voting do not seem to be valuable, this was the craze over alt coins.

</comment><comment><USER35> This article uses the common criticism of there already being existing institutions and security systems for money transfer. However, this may be true in well developed countries but it's not true at all in developing countries. IMO, this is a common oversight by critics.

<comment><USER36> In what world do people have the technological and social infrastructure for Bitcoin (end user devices, networks, miners, etc) but bad infrastructure for money transfer? How do you think they would be buying their phones/devices and paying to connect to the network?

<comment><USER35> Venezuela for one.

<comment><USER37> How? There's always a flavour of the moment failing state inserted as a reference here. But if you can't transfer Venezuelaean currency out of the country, how are you buying bitcoins with it? How are you getting the money to that person?

<comment><USER35> Check out LocalBitcoins

</comment></comment></comment></comment></comment><comment><USER38> > It can also be extremely expensive, both in data storage and in the energy > required to maintain it. Bitcoin has the most expensive consensus algorithm > the world has ever seen, by far.

When Bruce complains that Bitcoin's consensus is expensive he really compliments Bitcoin's security and resistance to attacks on immutability.

He's spot on that private blockchains and most public blockchains are nothing but hype, that opinion is not news though.</comment>


Astronomers on the verge of detecting "first light" - <AUTHOR> https://www.universetoday.com/144188/astronomers-are-about-to-detect-the-light-from-the-very-first-stars-in-the-universe/ <comment><USER2> This title was a bit confusing since "first light" is also an astronomic term for the first use of a telescope.

[https://en.wikipedia.org/wiki/First_light_(astronomy)](https://en.wikipedia.org/wiki/First_light_\(astronomy\))

<comment><USER3> Detecting that doesn't make sense though.

</comment></comment><comment><USER4> Seems like that light would have already passed the earth by now.

<comment><USER5> But it's coming from everywhere, and the universe is infinite, so if you look at a distant enough point, you'll find some light from [AGE OF THE UNIVERSE] light-years away. This is probably a horrendous misunderstanding.

</comment></comment><comment><USER6> The Wiki page is most confusing page I every saw, even have seconds and minutes after mix with 377k. Need some help there I think.

</comment><comment><USER5> But wouldn't the hot dense stuff before reionisation have emitted light?

</comment><comment><USER7> [http://cosmology.info/](http://cosmology.info/)</comment>


People in Thailand are migrating from Twitter after a privacy policy update - <AUTHOR> https://qz.com/1860804/thai-users-ditch-twitter-for-crypto-social-network-minds <comment><USER2> Twitter's changing their policy to share device level data, and people are changing to another service that doesn't currently do that.

What's to prevent Twitter from sharing data from the last 5 years with the government who may prosecute a Thai for saying something disparaging about the king? Or with an NGO who decides to make life difficult for people they disagree with?

</comment><comment><USER3> > Like many other Thais, the prominent writer and social critic had grown wary > and distrustful of Twitter over a recent string of developments on the > platform that sparked privacy concerns. Last week, she joined a massive > migration of Thai users to Minds, an open-source and decentralized platform > that prides itself on being transparent about how it manages data and > revenue—users receive "tokens" based on interactions and time spent on the > service. The platform saw a spike of 100,000 new Thai users in a single day > last week, its founder told Coconuts Bangkok, causing the service to crash > temporarily. There are now more than 200,000 Minds users in Thailand, > according to the company.

They've migrated over to [https://www.minds.com/](https://www.minds.com/)

Never heard of it before. Tried looking for any significant discussion on hacker news about it but couldn't find anything that had more than just a handful comments.*

Has anyone here used it?

* [https://news.ycombinator.com/from?site=minds.com](https://news.ycombinator.com/from?site=minds.com) and [https://news.ycombinator.com/item?id=19340801](https://news.ycombinator.com/item?id=19340801)

<comment><USER4> I used it before and I still have an account on Minds and Gab as I don't have any other social networking profiles.

The problem with those two is that they're a sanctuary for racists (Gab more than Minds), even though I didn't want to believe it at first. That alone isn't the problem. The problem is when you start building your online presence on those websites, you will have those people comment on your submissions. And before you know it, every post you make will be turned into a moderation hell where you'll spend more time deleting disgusting comments and blocking people than actually replying to legitimate ones.

It's very hard to build something meaningful and long-lasting on those two alternative websites. People from Thailand might be in a better position because they use their own language and their own alphabet.</comment></comment>


Ask HN: What steps to take to rebuild an existing application? - <AUTHOR> I've been tasked with rebuilding a successful desktop application into a web application. A few relevant points:<p>- The app is in the scheduling realm and involves some semi-complicated algorithms<p>- I did not contribute in any way to the desktop app and it's written in an old language that I don't know at all<p>- I plan to build the new app in Ruby on Rails, which I am experienced with<p>- We've identified ~75% of the current functionality that needs to be included in the first version of the web app<p>- The desktop app has had strong acquisition interest in the past and the best case scenario for all parties would to be acquired in the next 2 years<p>What steps would you suggest I take to make the process as successful and pain-free as possible? <comment><USER2> (1) If you can recycle the old "semi-complicated algorithms" in some way you should. For instance if these are written in FORTRAN or C it is not that hard to write wrapper code to access them in a more complex language on the back end, it also may be able to compile them to webassembly.

(2) If you can't do that, or even if you can, you should build a test suite that works on both the old and the new code so your reimplementation is correct. This will save you so much suffering.

(3) If you want to make an app that has the same sensibility as a desktop app in 2020 I would look to React, Vue, Svelte or something like that.

</comment><comment><USER3> If you want it as pain-free as possible, optimize for the transition once it's ready, and so avoid making improvements over the UI. Leave UI improvements until after people are using it.

I've been working on rebuilding a legacy system for the last "few" years, and now that it's mostly ready, we have a nightmare in figuring out how to transition the users as seamlessly as possible. They can do everything, simpler, but it's different, and will require training. Improvements would have been a lot better to do piecemeal after they've started using the new codebase. After discussing it a few months ago, we came to the agreement that we really should have done a port that resembled the original as closely as possible to ease the transition.

Too late to back out of it now, though.

</comment><comment><USER4> As others already mentioned, the best thing would be if it is possible to reuse the non-UI code (so logic & algorithms) and put it on a server behind an API.

On the other hand, if the code is not written in the modular fashion and things are tightly coupled, it might be harder than writing everything from scratch (of course, that depends a lot on the volume of the code).

As PaulHole suggested, writing a test suite would also be very important to make sure your code works as expected - that will save you a lot of trouble in the long run.

RoR seems like a good and stable choice for the backend, do you plan to use something like React/Vue/Angular on the frontend?

On the side note, I am working on a project that would hopefully make app dev easier and more sustainable in the long run, but unfortunately it is still in the very early stage of development. Would appreciate your feedback though! [https://wasp-lang.dev/](https://wasp-lang.dev/)

<comment><USER2> I think systems like WASP will proliferate. React, Vue, Svelte and similar frameworks have gotten people used to code generation, transpiling, etc. Technically, people are ready for something that blurs the front-end/back-end distinction.

<comment><USER4> Thank you very much for your feedback PaulHoule! Feedback like this motivates us to keep going :)

</comment></comment></comment><comment><USER5> Dump the desktop applications logic layer into a Web Api and build the Web Application off of that, basically just re-implement the UI</comment>


A Dark Room - A Minimalist Text Adventure Game - <AUTHOR> http://rawgithub.com/Continuities/adarkroom/master/index.html

<comment><USER2> Previous Discussions:

(4 months ago) [https://news.ycombinator.com/item?id=5961205](https://news.ycombinator.com/item?id=5961205)

(3 months ago) [https://news.ycombinator.com/item?id=5985138](https://news.ycombinator.com/item?id=5985138)

<comment><USER3> I finished the game back then (thanks for loss of my weekend by the way :p)

Did anything change now?

</comment></comment><comment><USER4> Link to the original developer's page for the game - [http://adarkroom.doublespeakgames.com/](http://adarkroom.doublespeakgames.com/)

Also -

> What will happen if I hotlink to a rawgithub.com URL on a production > website?

> Bad things. If you hotlink to a rawgithub.com URL on a site that gets lots > of traffic, requests will be throttled. If this heavy traffic continues, > requests originating from your site will eventually be dropped.

</comment><comment><USER5> nice game! the save game is just a base64 encoded string.. Here are game stat ``` "{"version":1.3,"features":{"location":{"room":true,"outside":true}},"stores":{"wood":62,"fur":54,"bait":0,"meat":100,"teeth":10,"scales":20},"character":{},"income":{"gatherer":{"delay":10,"stores":{"wood":0},"timeLeft":1},"builder":{"delay":10,"stores":{"wood":2},"timeLeft":5}},"timers":{},"game":{"builder":{"level":4},"buildings":{"trap":3,"cart":1,"hut":1},"population":0,"workers":{},"outside":{"seenForest":true}},"playStats":{}}" ```

</comment><comment><USER6> Did you make this? It is very engaging from the start.

</comment><comment><USER7> Nicely done. Looks boring at first glance, but a few idle clicks and suddenly it's compelling.</comment>


NimConf 2020 schedule released – starts tomorrow - <AUTHOR> https://www.youtube.com/playlist?list=PLxLdEZg8DRwTIEzUpfaIcBqhsj09mLWHx <comment><USER2> looking forward to this! I think the organizers did a great job:

* it is in interesting format: an online conference with pre-recorded video and opportunity to interact. I guess it aims for maximum impact with limited effort.

* the content is very varied, videos for beginners, a nice game framework (nico), nim on Game Boy, nim on ESP8266 microchip, web stuff, the much awaited talk by Araq on the new memory management system (arc/orc), mratsim on multithreading, treeform on UI development with fidget, and much more...

* unfortunately not much in my domain (data science), hopefully next time (this will be done again next year, right?) I will be able to contribute something.

Overall I think it deserves much more publicity than what has been getting yet (but that is also a feature of Nim, which would definitely deserve to be more known and used).

</comment><comment><USER3> Website with schedule and other details here, can we get the URL for this post changed? [https://conf.nim-lang.org/](https://conf.nim-lang.org/)

<comment><USER2> also, adding Nim keyword to title could be good for finding this when searching for Nim in HN: [https://hn.algolia.com/?dateRange=last24h&page=0&prefix=fals...](https://hn.algolia.com/?dateRange=last24h&page=0&prefix=false&query=nim&sort=byPopularity&type=story)

</comment></comment><comment><USER4> Looking forward to tomorrow, thanks to the Nim team for organizing this!

</comment><comment><USER5> This is going to be great!</comment>


How to Create an Effective Mobile App with Great User Retention Rate - <AUTHOR> https://medium.com/simbirsoft/how-to-create-an-effective-mobile-app-with-great-user-retention-rate-9b27038186fb <comment><USER2> If you can save someone a significant amount of time or hassle your app will work. A great example of this is the Sam's Club app: as you shop you can scan the barcodes of the products you're buying and then make the purchase right on your phone which presents a QR code for the cart-checker at the door to scan to verify you're not stealing. This app allows the shopper to skip the check- out line, which saves time. Any app which speeds up a slow process you have to do repeatedly is likely to be a winner.</comment>


Detection of visible light from the darkest world - <AUTHOR> http://www.astro.princeton.edu/%7Edsp/PrincetonSite/Home_files/darkest_world.pdf

<comment><AUTHOR> And something from the popular press:

<http://www.bbc.co.uk/news/science-environment-14476411></comment>


HN iPhone app? - <AUTHOR>

I was searching the app store for HN app but there were too many listed with this name. I dont know which is the offiial one (if there is any) or which is the best.<p>Your suggestions would be great. <comment><USER2> I don't think that there is an official one. I use iHackerNews.com and then saved it to my home screen. It works quite well.

<comment><AUTHOR> Thanks for this. Just what I wanted :)</comment></comment>


GoDaddy has shut down Richard Spencer's white supremacist site - <AUTHOR> https://arstechnica.com/tech-policy/2018/05/godaddy-has-shut-down-richard-spencers-white-supremacist-site/ <comment><USER2> If free speech is only for people we like, it's not worth much.

<comment><USER3> Private companies are not subject to freedom of speech. Something they do not like can go as long as not a protected class.

<comment><USER4> Your conflating the principle of "freedom of speech" with the implementation in law. The social expectation of neutral service providers has been seriously eroded over the last 2 decades. We never had laws in this space because we never needed them (we do for telephones).

<comment><USER5> I'm of similar mind on this. Free speech is a concept that transcends law, and while _you_ absolutely don't have to agree with it I expect service providers to. The second they willingly remove content that is not illegal, I cannot trust they will treat my content fairly should it come under scrutiny. Should I find myself under the scorn of an internet lynchmob, I could very well find my content removed.

<comment><USER6> So if someone said that they wanted to kill the President (not being political this is true no matter who is President) how fast do you think you would see government agents knocking on their door?

Why should a private citizen get any less protection?

<comment><USER5> > how fast do you think you would see government agents knocking on their > door?

Couldn't tell you, I don't exactly research SS response times.

> Why should a private citizen get any less protection?

Because our elected representatives determined the President needs additional protection.

</comment></comment></comment></comment></comment></comment><comment><USER7> Okay, sounds like the site definitely is pushing things too far.

However, it kinda makes me nervous that this happening at the DNS level. I understand go daddy is a private entity, but I think the DNS records should be held to a higher standard.

</comment><comment><USER8> While I agree with the sentiment here of free speech, GoDaddy shouldn't be forced to participate in something they don't want to. He's free to try another provider or setup his own BGP rules etc.

<comment><USER9> The dillema I see with this argument in regards to the Internet is that it's exceedingly cost-prohibitive to publish content on the internet without the discretion of an entity like GoDaddy. What's more, even if you have the monetary means to buy an ASN and IPv4 space (which has a market value of about $4,000 for the smallest block you can announce), nobody is legally obligated to provide transit to you (which itself typically costs somewhere in the ballpark of $300/month).

I don't believe resilience to censorship on the internet should be a right reserved for the wealthy (or even reserved for networking experts who could build their own AS), but I have yet to reconcile that with the right that private service providers have to turn down customers (and it goes without saying that this particular website will not be missed). I wonder if a non- profit hosting provider that was bound by its constitution to host any legal content for anyone that could pay could be successful.

<comment><USER8> > without the discretion of an entity like GoDaddy

There are lots of other domain registers, some in specific that specialize in free speech rights.

> What's more, even if you have the monetary means to buy an ASN and IPv4 > space (which has a market value of about $4,000 for the smallest block you > can announce)

Realistically someone could publish to IPFS and do CNAME redirects without a server.

> I wonder if a non-profit hosting provider that was bound by its constitution > to host any legal content for anyone that could pay could be successful.

Reminds me of riseup, but that has a littered history as well.

Also there is Namecoin and .bit addresses. Not saying they work flawlessly, but the concept does solve this problem.

<comment><USER7> Still we are talking about the underlining infrastructure here. While not versed in all the details of ICANN's policies I am actual surprised there no policy stopping a registrar from doing this.

I can understand hosting, but I think DNS records should held to higher standards. People don't like governments messing with the DNS system why should we give a private company a pass?</comment></comment></comment></comment>


A chart's ability to mislead is off the scale - <AUTHOR> https://www.ft.com/content/3062d082-e3da-11e6-8405-9e5580d6e5fb <comment><USER2> Actual title: "How alternative facts rewrite history"

"A chart's ability to mislead is off the scale" is the subtitle.

</comment><comment><USER3> paywall

<comment><USER2> Have you tried the "web" link under the submission title? It worked for me.

Also, please note that paywalled articles are okay on HN as long as there's a workaround (which is what the "web" link is for). Same goes for popups. Yes, they're annoying. Some people avoid them with scripts.

From the FAQ ([https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)):

 _Are paywalls ok?

It's ok to post stories from sites with paywalls that have workarounds.

In comments, it's ok to ask how to read an article and to help other users do so. But please don't post complaints about paywalls. Those are off topic._

More discussion if you're interested:

[https://news.ycombinator.com/item?id=10178989](https://news.ycombinator.com/item?id=10178989)

<comment><USER4>
      Have you tried the "web" link under the submission title? It worked for me.

I tried all of the top web links provided (including both ft.com links) and still hit paywall. The farthest I got was the Opinion main page. This was in a fresh Opera Beta private window.

<comment><USER2> Safari (not private) with Ghostery. 4 blocked scripts. Wish I knew what the triggering factor is.</comment></comment></comment></comment>